@mars-sea/dsh-commandcode-provider 0.11.16 → 0.11.17

package/lib/index.js

@@ -2,12 +2,12 @@ import { homedir, tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { MAX_TIMER_DELAY_MS } from "@deepseek-ai/dsh-timeout";
-import { CONTEXT_WINDOW_EXCEEDED_CODE, IMAGE_OFFLOAD_REQUIRED_CODE, LlmAdapter, LlmError, ReasoningEffortId, ToolCallId, assertUsableApiKey, attributionHeaders, errorChain, isContextWindowExceededError, offloadedImageText, projectOffloadedImages, requiredImageOffload, resolveRetryPolicy, textOnlyImageText } from "@deepseek-ai/dsh-llm";
+import { CONTEXT_WINDOW_EXCEEDED_CODE, IMAGE_OFFLOAD_REQUIRED_CODE, LlmAdapter, LlmError, ProviderRequestId, ReasoningEffortId, ToolCallId, assertUsableApiKey, attributionHeaders, errorChain, isContextWindowExceededError, offloadedImageText, projectOffloadedImages, requiredImageOffload, resolveRetryPolicy, textOnlyImageText } from "@deepseek-ai/dsh-llm";
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
 import { launchEnvironmentOf } from "@deepseek-ai/dsh-launch-environment";
 import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { randomBytes, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { createServer } from "node:http";
 import { createServer as createServer$1 } from "node:net";
@@ -18,18 +18,12 @@ import { WebError } from "@deepseek-ai/dsh-web";
 * reasoning-effort levels, vision/thinking flags, model → minimum plan tier,
 * subscription-plan labels, deals, and hourly (peak/off-peak) pricing.
 *
-* Everything in this module is synced from official sources (the command-code
-* CLI bundle's model table and the official plan/pricing/model docs — see the
-* dsh-commandcode-upstream skill for the exact extraction procedures), and
-* changes whenever an upstream CLI release reshuffles models/plans/prices.
-* Keeping the snapshot in its own module confines those frequent sync diffs
-* here: src/adapter.ts holds only the stable wire/runtime logic and imports
-* these tables + read helpers.
-*
-* Snapshot read helpers (planLabel, dealLabel, formatContext,
-* capabilityDescription, peakPricing*, compareByPlan, modelVisibleInPlan,
-* subscriptionPlanInfo, isFreeModel) live here too — they exist only to read
-* the tables, so a sync never has to touch src/adapter.ts.
+* Everything here is synced from official sources — the command-code CLI
+* bundle's model table (`dist/cli.mjs`, re-verified at command-code@1.66.0) and
+* the official plan/pricing/model docs; see the dsh-commandcode-upstream skill
+* for the extraction procedures. Keeping the snapshot in its own module
+* confines those frequent sync diffs here: src/adapter.ts holds only the stable
+* wire/runtime logic. The read helpers live here too, for the same reason.
 *
 * Ported from pi-commandcode-provider (MIT); originally part of src/adapter.ts
 * and split out so upstream syncs stay reviewable.
@@ -313,6 +307,11 @@ const KNOWN_EFFORTS = {
 		"low",
 		"medium",
 		"high"
+	],
+	"stealth/pixel-canary": [
+		"low",
+		"medium",
+		"xhigh"
 	]
 };
 /**
@@ -378,6 +377,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"moonshotai/Kimi-K2.7-Code-Highspeed",
 	"moonshotai/Kimi-K3",
 	"sakana/fugu-ultra",
+	"stealth/pixel-canary",
 	"stealth/space-bunny-alpha",
 	"stepfun/Step-3.7-Flash",
 	"stepfun/Step-5-Preview",
@@ -395,20 +395,22 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 ]);
 /**
 * Models WITHOUT a zero-data-retention upstream, per the official CLI's own
-* registry (`command-code@1.65.2` `dist/cli.mjs`, unchanged from 1.65.0:
-* `modelSupportsZdr(id)` is exactly `!nonZdrSet.has(canonicalize(id))`, and
-* `knownModelSupportsZdr`
-* carries the same membership in the sibling route table — the union is this
-* set). The official docs (commandcode.ai/docs/resources/zdr) put it in prose
-* — "99% of our models have ZDR-capable upstreams … only a small handful of
-* models are affected" — so the CLI's exclusion list is the only per-model
-* evidence there is; a ZDR request naming one of these fails with HTTP 422
-* `cmd_zdr_no_providers` instead of routing through a provider that retains.
+* registry (`command-code@1.66.0` `dist/cli.mjs`): `modelSupportsZdr(id)` is
+* exactly `!nonZdrSet.has(canonicalize(id))`, and `knownModelSupportsZdr`
+* carries the same membership in the sibling route table — the UNION of both
+* is this set. Reading only the sibling route table would drop `meituan/
+* LongCat-2.0` and `stealth/pixel-canary`, which each appear in
+* `modelSupportsZdr` alone. The official docs (commandcode.ai/docs/resources/
+* zdr) put it in prose — "99% of our models have ZDR-capable upstreams … only
+* a small handful of models are affected" — so the CLI's exclusion list is
+* the only per-model evidence there is; a ZDR request naming one of these
+* fails with HTTP 422 `cmd_zdr_no_providers` instead of routing through a
+* provider that retains.
 *
 * Why a NEGATIVE set, and why "not listed" answers TRUE: 99% of the catalog is
 * covered, so the maintained difference is the exception list. This helper is
 * informational; the adapter sends the ZDR header for EVERY request when the
-* switch is on. The provider remains the routing authority and refuses an
+* switch is on — the provider remains the routing authority and refuses an
 * unsupported model rather than silently dropping the privacy guarantee.
 *
 * `minimax/minimax-m3-free` is the one entry the public catalog
@@ -419,16 +421,9 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 * Keep in sync via the dsh-commandcode-upstream skill: the CLI's registry data
 * (its `zdr:{only:[…]}` provider routes and the per-provider `zdr`/`noTraining`
 * flags) is upstream-internal routing, not a per-model contract, so this table
-* is the snapshot of the exclusion set and nothing more. The 1.62.0 → 1.64.0
-* diff of that union is EMPTY: both anchors were extracted from both bundles
-* during the 2026-09-23 check and each carries the same 20 members — which is
-* how rare a change here is expected to be. The 1.64.0 → 1.65.0 diff (2026-09-24)
-* is the counterexample that proves the check still runs: exactly one member
-* joins (`stealth/space-bunny-alpha`), and it is in both anchors. `meituan/
-* LongCat-2.0` is the one member the two anchors disagree about (it is in
-* `modelSupportsZdr`'s set in both releases and in neither `knownModelSupportsZdr`
-* set), so the union is
-* what this table follows; reading only the sibling route table would drop it.
+* is the snapshot of the exclusion set and nothing more. It is a rare change:
+* 20 members held across 1.62.0 → 1.64.0, and 1.65.0 and 1.66.0 each added
+* exactly one (the two stealth-preview models below).
 */
 const KNOWN_NON_ZDR_MODELS = /* @__PURE__ */ new Set([
 	"MiniMaxAI/MiniMax-M3",
@@ -443,6 +438,7 @@ const KNOWN_NON_ZDR_MODELS = /* @__PURE__ */ new Set([
 	"poolside/laguna-s-2.1-free",
 	"sakana/fugu-ultra",
 	"stealth/space-bunny-alpha",
+	"stealth/pixel-canary",
 	"stepfun/Step-3.7-Flash",
 	"stepfun/Step-5-Preview",
 	"xai/grok-4.5",
@@ -462,36 +458,18 @@ function supportsZeroDataRetention(modelId) {
 	return !KNOWN_NON_ZDR_MODELS.has(modelId);
 }
 /**
-* Models the official CLI's model table (command-code@1.53.0) marks
-* `reasoning:!0` but defines no selectable `reasoning_effort` levels — they
-* think automatically, with Command Code driving the depth. This is the
-* authoritative "thinks, effort not adjustable" set: `KNOWN_EFFORTS` (which
-* mirrors the CLI's effort map exactly) stays the sole source for selectable
-* effort levels, and this snapshot is not surfaced in the picker's compact
-* description — it exists for programmatic consumers.
+* Models the official CLI's model table marks `reasoning:!0` but defines no
+* selectable `reasoning_effort` levels — they think automatically, with
+* Command Code driving the depth. `KNOWN_EFFORTS` (which mirrors the CLI's
+* effort map exactly) stays the sole source for selectable effort levels, and
+* this snapshot is not surfaced in the picker's compact description — it exists
+* for programmatic consumers.
 *
-* Source: the command-code@1.53.0 bundled model table (dist/cli.mjs),
-* cross-checked with https://commandcode.ai/docs/reference/cli/models.
-* (`stealth/ox-alpha` left this set in command-code@1.32.1, which gave it
-* selectable `['low', 'high', 'max']` efforts; the preview then ended in
-* 1.34.0, removing the model from the catalog entirely. `tencent/hy4-preview`
-* joined this set in command-code@1.37.0 — reasoning:!0, no efforts, 1M
-* context, routed through OpenRouter — then gained selectable
-* `['low', 'medium', 'high']` efforts in command-code@1.38.0 and moved to
-* `KNOWN_EFFORTS`. `moonshotai/Kimi-K3` followed the same path in
-* command-code@1.39.3 — it gained `['low', 'high', 'max']` efforts and moved
-* to `KNOWN_EFFORTS`. command-code@1.42.0 added LongCat 2.0 (then
-* `meituan/LongCat-2.0:free`, now the paid `meituan/LongCat-2.0`; reasoning:!0,
-* no efforts). command-code@1.45.0 gave the Muse Spark family
-* (1.1, 1.2, 1.2-contributor, 1.3, 1.3-contributor) selectable
-* `['low', 'medium', 'high', 'xhigh']` efforts — they moved to `KNOWN_EFFORTS`.
-* command-code@1.51.3 gave `MiniMaxAI/MiniMax-M3` selectable
-* `['low', 'medium', 'high']` efforts — it moved to `KNOWN_EFFORTS` too.
-* command-code@1.52.0 added `inclusionai/ling-3.0-flash-sante:free`
-* (reasoning:!0, no efforts).)
-* command-code@1.53.0 added `deepseek/deepseek-v4.1-flash` with selectable
-* ['low', 'high', 'max'] efforts, so it lives in `KNOWN_EFFORTS`, not here.)
-* Keep in sync via the dsh-commandcode-upstream skill.
+* Source: the bundled model table (dist/cli.mjs), cross-checked with
+* https://commandcode.ai/docs/reference/cli/models. Keep in sync via the
+* dsh-commandcode-upstream skill; a model that GAINS selectable efforts leaves
+* this set for `KNOWN_EFFORTS` (Tencent Hy4 Preview, Kimi K3, the Muse Spark
+* family and MiniMax M3 all took that path).
 */
 const KNOWN_THINKING_MODELS = /* @__PURE__ */ new Set([
 	"Qwen/Qwen3.6-Max-Preview",
@@ -520,7 +498,7 @@ const KNOWN_THINKING_MODELS = /* @__PURE__ */ new Set([
 *
 * Measured 2026-09-16 against the live catalog (command-code@1.54.0): all 69
 * models were posted to `/provider/v1/chat/completions`; exactly these eight
-* — the whole Claude family — refused, and every one of them is routed
+* — the whole Claude family then — refused, and every one of them is routed
 * normally by `/alpha/generate` (a lower-plan key gets the ordinary
 * `MODEL_NOT_IN_PLAN` 403 there, never a routing error). So the CLI transport
 * is a complete fallback and the adapter does not need a Messages transport.
@@ -531,13 +509,15 @@ const KNOWN_THINKING_MODELS = /* @__PURE__ */ new Set([
 * the Provider API by default — picking any Claude model there failed every
 * request before this snapshot existed.
 *
-* Keep in sync when models ship (see the dsh-commandcode-upstream skill).
 * `requiresMessagesEndpoint()` additionally treats any `claude-*` id as
-* Messages-only, so a Claude model added upstream is routed correctly by an
-* un-updated plugin instead of hard-failing with the 400 above; the worst case
-* of that rule going stale the other way (upstream teaching
-* `/provider/v1/chat/completions` to serve Claude) is one model riding the CLI
-* transport it already works on.
+* Messages-only, so a Claude model added upstream (`claude-opus-5-5` in
+* command-code@1.64.0 was the first this snapshot missed) is still routed
+* correctly by an un-updated plugin instead of hard-failing with the 400
+* above. The worst case of that rule going stale the other way (upstream
+* teaching `/provider/v1/chat/completions` to serve Claude) is one model
+* riding the CLI transport it already works on.
+*
+* Keep in sync when models ship (see the dsh-commandcode-upstream skill).
 */
 const MESSAGES_ONLY_MODELS = /* @__PURE__ */ new Set([
 	"claude-sonnet-5",
@@ -555,31 +535,14 @@ function requiresMessagesEndpoint(modelId) {
 }
 /**
 * The minimum subscription plan a model is included in, per the official plan
-* pages (`/docs/plans/go`, `/docs/plans/goat`, `/docs/plans/pro`, `/docs/plans/max`
-* and `/docs/resources/pricing-limits`). Each plan's model list is a superset of
-* the one below it: Go ⊂ GOAT ⊂ Pro ⊂ Provider/Max. Models absent from every
-* plan list (Claude Opus/Fable, Fugu Ultra) are Provider-tier.
-* `claude-fable-5-1` (Claude Fable 5.1, added in command-code@1.40.0) is
-* Provider/Max-tier exactly like `claude-fable-5` — its availability matrix on
-* the official plan/pricing pages grants individual-provider/max/ultra and
-* teams-pro only, and the CLI's plan-access map blocks it on Go/GOAT/Pro.
-* command-code@1.41.0 added `Qwen/Qwen3.8-Max-0902` (Go) and 1.42.0 added
-* LongCat 2.0 (Go — a free promo until 2026-09-19, when the backend renamed
-* `meituan/LongCat-2.0:free` to the paid `meituan/LongCat-2.0`); 1.43.0 added
-* `google/gemini-3.8-flash` (GOAT) and 1.44.0 added `meta/muse-spark-1.3`
-* (GOAT) plus its Contributor sibling (Go); command-code@1.52.0 added the
-* free `inclusionai/ling-3.0-flash-sante:free` (Go); command-code@1.53.0
-* added `deepseek/deepseek-v4.1-flash` (Go); command-code@1.56.0 added
-* `Qwen/Qwen3.8-Omni-Flash` (Go); command-code@1.57.0 added
-* `z-ai/glm-5.3-flashx` (Go); command-code@1.59.0 added `xai/grok-4.7` (GOAT)
-* and 1.60.0 added `stepfun/Step-5-Preview` (Go); command-code@1.62.0 added the
-* MiMo V2.6 family — `xiaomi/mimo-v2.6-flash` + `xiaomi/mimo-v2.6-pro` (Go) and
-* `xiaomi/mimo-v2.6-pro-ultraspeed` (GOAT) — so the 1.58.0 -> 1.62.0 window's
-* only tier changes are additions and the superset chain still holds. The
-* 1.62.0 -> 1.65.0 window continues the pattern: 1.64.0 added
-* `claude-opus-5-5` (Provider/Max), `gpt-6-sol` (Pro) and `gpt-6-luna` (Go),
-* and 1.65.0 added `stealth/space-bunny-alpha` (Go, every tier) — additions
-* only, no tier moves.
+* pages (`/docs/plans/go`, `/docs/plans/goat`, `/docs/plans/pro`,
+* `/docs/plans/max` and `/docs/resources/pricing-limits`). Each plan's model
+* list is a superset of the one below it: Go ⊂ GOAT ⊂ Pro ⊂ Provider/Max.
+* Models absent from every plan list (Claude Opus/Fable, Fugu Ultra) are
+* Provider-tier. Re-verified at command-code@1.66.0 (2026-09-27): 82 catalog
+* ids at 52/60/74/82 cumulative, a strict superset chain — every release since
+* 1.49.0 has been additive with no tier move, and per-entry tags below name the
+* release that added each row.
 *
 * The Provider API exposes no plan metadata, so this snapshot is the source of
 * truth for the picker's plan annotation — it answers "which plan do I need to
@@ -624,6 +587,7 @@ const KNOWN_PLANS = {
 	"stepfun/Step-3.5-Flash": "go",
 	"stepfun/Step-3.7-Flash": "go",
 	"stepfun/Step-5-Preview": "go",
+	"stealth/pixel-canary": "go",
 	"stealth/space-bunny-alpha": "go",
 	"tencent/hy3-paid": "go",
 	"tencent/hy4-preview": "go",
@@ -717,11 +681,11 @@ function compareByPlan(a, b) {
 }
 /**
 * Subscription plan table, synced from the official CLI bundle's plan maps
-* (located by the `"individual-go"` key in command-code@1.53.0 `dist/cli.mjs`,
-* re-verified unchanged through 1.53.0): subscription `planId`
-* prefix → display name and the plan's monthly credit total. This is the
-* account's own subscription (from `/alpha/billing/subscriptions`) — distinct
-* from {@link KNOWN_PLANS}, which maps catalog models to their minimum tier.
+* (located by the `"individual-go"` key in `dist/cli.mjs`, re-verified unchanged
+* through command-code@1.66.0): subscription `planId` prefix → display name and
+* the plan's monthly credit total. This is the account's own subscription
+* (from `/alpha/billing/subscriptions`) — distinct from {@link KNOWN_PLANS},
+* which maps catalog models to their minimum tier.
 *
 * `tierWeight` is plugin-added (not from the CLI maps): the plan's rank on
 * the {@link PLAN_ORDER} scale, used by the picker's plan filter
@@ -836,6 +800,10 @@ const KNOWN_DEALS = {
 	"stealth/space-bunny-alpha": {
 		label: "FREE",
 		free: true
+	},
+	"stealth/pixel-canary": {
+		label: "FREE",
+		free: true
 	}
 };
 /**
@@ -844,24 +812,11 @@ const KNOWN_DEALS = {
 * charges by the hour: peak hours are 01:00–04:00 and 06:00–10:00 UTC (7h per
 * weekday, full price) **Monday to Friday only**; the other 17 hours of a
 * weekday and every hour of Saturday/Sunday (UTC) are off-peak at half price.
-* The V4 Flash Vision (exp) variant (command-code@1.32.0) shares the V4 Flash
-* rates exactly — $0.15/$0.60 off-peak and $0.30/$1.20 peak, per the page's own
-* `timeOfDay` block, not merely 2× its own off-peak figures: a rate that is
-* internally consistent can still be the wrong row, which is why the vendored
-* price table (`./model-prices.ts`) is synced from the page and not hand-kept.
-* The picker shows the
-* *current* state as a compact
-* label (`Peak`/`Half`) matching the English noun style of the other markers
-* (`Image`, `FREE`), so a developer can tell at a glance whether calling the
-* model right now is cheap or expensive.
-*
-* Authoritative extraction: the pricing page embeds a model JSON array whose
-* hourly-priced entries carry a `timeOfDay` block
-* (`{ windows: "01–04 & 06–10 UTC, Mon–Fri", peakHoursPerDay: 7,
-* offPeakHoursPerDay: 17, peak: {...}, offPeak: {...} }`). Exactly four models
-* carry it: V4 Pro, V4 Flash, V4 Flash Vision (exp), and V4.1 Flash (added in
-* command-code@1.53.0 at $0.15/$0.60 off-peak, $0.30/$1.20 peak — the same
-* schedule as the other three).
+* Exactly four models carry the page's `timeOfDay` block (the four rows below).
+* The picker shows the *current* state as a compact label (`Peak`/`Half`)
+* matching the English noun style of the other markers (`Image`, `FREE`), so a
+* developer can tell at a glance whether calling the model right now is cheap
+* or expensive.
 *
 * Extraction caution: the rendered HTML rows are a trap. Each annotation div
 * sits inside its OWN row's container, immediately before the NEXT row starts,
@@ -869,7 +824,11 @@ const KNOWN_DEALS = {
 * to the model printed after it — that is how `deepseek/deepseek-v4-flash-fast`
 * was wrongly added here (its row is flat-priced at $0.28/$0.56/$0.07 and has
 * no `timeOfDay` block). Trust the embedded JSON's `timeOfDay` membership and
-* the 2× price relation, never the flat-text neighbor.
+* the 2× price relation, never the flat-text neighbor. A rate that is
+* internally consistent can still be the wrong row (the V4 Flash Vision (exp)
+* variant is priced from the page's own `timeOfDay` block, not from 2× its own
+* off-peak figures), which is why the vendored price table
+* (`./model-prices.ts`) is synced from the page and not hand-kept.
 *
 * Keep in sync with the official pricing page when the model set, the peak
 * windows, or the weekday rule change (see the dsh-commandcode-upstream skill).
@@ -908,11 +867,8 @@ function isPeakPricingHour(now = Date.now()) {
 	return PEAK_HOUR_RANGES.some(([start, end]) => hour >= start && hour < end);
 }
 /**
-* Whether `now` (defaults to `Date.now()`) falls in a peak-pricing window for
-* time-of-day-priced models. Peak rates apply Monday–Friday (UTC) only: the
-* official rule charges Saturday and Sunday completely off-peak for all 24
-* hours, so a weekend timestamp is off-peak even inside `PEAK_HOUR_RANGES`.
-* `undefined` for models outside the snapshot.
+* As {@link isPeakPricingHour}, plus the {@link KNOWN_PEAK_PRICING} membership
+* test; `undefined` for models outside the snapshot.
 */
 function peakPricingState(modelId, now = Date.now()) {
 	if (!KNOWN_PEAK_PRICING.has(modelId)) return void 0;
@@ -1802,7 +1758,7 @@ const MODEL_PRICE_ROWS = [
 	{
 		id: "step-3.5-flash",
 		rates: [
-			.1,
+			.09,
 			.3,
 			.02
 		]
@@ -1838,6 +1794,14 @@ const MODEL_PRICE_ROWS = [
 			2.501,
 			.042
 		]
+	},
+	{
+		id: "typesafe/jev",
+		rates: [
+			.042,
+			0,
+			0
+		]
 	}
 ];
 /**
@@ -1854,8 +1818,8 @@ const PRICE_SLUG_OVERRIDES = { "nvidia/nemotron-3-ultra-550b-a55b": "nemotron-3-
 * not consistently: `tencent/hy4-preview` keeps its prefix while
 * `Qwen/Qwen3.8-Max-0902` becomes `qwen-3.8-max-0902`, with a hyphen the
 * catalog id does not have. Generating candidates and taking the first that
-* exists in the vendored table absorbs that drift without a hand-maintained
-* map of seventy ids.
+* exists in the vendored table absorbs that drift without a hand-maintained map
+* of eighty ids.
 */
 function priceSlugCandidates(modelId) {
 	const lower = modelId.toLowerCase();
@@ -1910,13 +1874,10 @@ function wireRow(id, slug, row) {
 * Rows are keyed by CATALOG id wherever the two namespaces reconcile, because
 * that is what a session reports, and every row also carries its page slug as a
 * second lookup key. Price rows no catalog model claims are served under the
-* slug alone, so drift in either direction still prices: a page rename the
-* catalog has not followed, or a model the catalog snapshot has not learned
-* yet. Free models are served explicitly at zero so the composer can say so
-* instead of showing nothing.
-*
-* The peak windows travel with the table, so the browser applies the very
-* schedule this snapshot knows instead of restating it.
+* slug alone, so drift in either direction still prices. Free models are served
+* explicitly at zero so the composer can say so instead of showing nothing; the
+* peak windows travel with the table so the browser applies the very schedule
+* this snapshot knows instead of restating it.
 */
 function modelPriceTable() {
 	const bySlug = new Map(MODEL_PRICE_ROWS.map((row) => [row.id, row]));
@@ -1970,13 +1931,13 @@ function peakHour(at, windows) {
 	return time.getUTCDay() !== 0 && time.getUTCDay() !== 6 && windows.some(([start, end]) => time.getUTCHours() >= start && time.getUTCHours() < end);
 }
 /**
-* All prompt billing buckets determine a request's band, never cumulative session input.
+* All prompt billing buckets determine a request's band, never cumulative
+* session input.
 *
 * A tiered model returns the matching band and does NOT then apply `peak`: the
-* page publishes those two dimensions independently, no row carries both today,
-* and the generator would report a tiered row on every sync — so the combination
-* becoming real is visible before it reaches a user. This ordering is a latent
-* choice, not a verified upstream rule.
+* page publishes those two dimensions independently and no row carries both
+* today, so the combination becoming real is visible before it reaches a user.
+* This ordering is a latent choice, not a verified upstream rule.
 */
 function requestRates(price, at, contextTokens, table) {
 	const tier = price.contextTiers?.find((tier) => tier.maxContext === void 0 || contextTokens <= tier.maxContext);
@@ -2020,11 +1981,11 @@ function costGroupKey(group, table) {
 //#endregion
 //#region src/cost-projection.ts
 const record$2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? v : void 0;
-const finite$1 = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
+const finite = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
 function tokensOf(value) {
 	const u = record$2(value);
-	if (!u || !finite$1(u.inputTokens) || !finite$1(u.outputTokens)) return void 0;
-	if (u.cacheReadTokens !== void 0 && !finite$1(u.cacheReadTokens) || u.cacheWriteTokens !== void 0 && !finite$1(u.cacheWriteTokens)) return void 0;
+	if (!u || !finite(u.inputTokens) || !finite(u.outputTokens)) return void 0;
+	if (u.cacheReadTokens !== void 0 && !finite(u.cacheReadTokens) || u.cacheWriteTokens !== void 0 && !finite(u.cacheWriteTokens)) return void 0;
 	return {
 		uncachedInputTokens: u.inputTokens,
 		outputTokens: u.outputTokens,
@@ -2050,13 +2011,13 @@ function usageOf(type, data) {
 }
 function parseState(value) {
 	const s = record$2(value), facts = record$2(s?.facts);
-	if (!s || !facts || !finite$1(facts.pricingKey) || !Array.isArray(facts.groups)) throw new TypeError("invalid commandCodeCost state");
+	if (!s || !facts || !finite(facts.pricingKey) || !Array.isArray(facts.groups)) throw new TypeError("invalid commandCodeCost state");
 	const group = (v) => {
 		const g = record$2(v), t = record$2(g?.tokens);
-		return !!g && typeof g.provider === "string" && typeof g.model === "string" && (g.at === null || finite$1(g.at)) && finite$1(g.contextTokens) && !!t && COST_TOKEN_KEYS.every((k) => finite$1(t[k]));
+		return !!g && typeof g.provider === "string" && typeof g.model === "string" && (g.at === null || finite(g.at)) && finite(g.contextTokens) && !!t && COST_TOKEN_KEYS.every((k) => finite(t[k]));
 	};
 	const sel = record$2(s.selection), last = record$2(s.last);
-	if (!(s.selection === null || sel && typeof sel.provider === "string" && typeof sel.model === "string") || !(s.at === null || finite$1(s.at)) || !facts.groups.every(group) || !(s.last === null || last && finite$1(last.turn) && finite$1(last.step) && group(last.group))) throw new TypeError("invalid commandCodeCost state");
+	if (!(s.selection === null || sel && typeof sel.provider === "string" && typeof sel.model === "string") || !(s.at === null || finite(s.at)) || !facts.groups.every(group) || !(s.last === null || last && finite(last.turn) && finite(last.step) && group(last.group))) throw new TypeError("invalid commandCodeCost state");
 	return value;
 }
 /** Optional registry uses only synchronous parse/view; no new runtime module is required. */
@@ -2090,11 +2051,11 @@ function createCostProjection(table = modelPriceTable()) {
 			}
 			if (event.type === "step/start" || event.type === "llm/retry-started") return {
 				...state,
-				at: finite$1(event.time) ? event.time : null,
+				at: finite(event.time) ? event.time : null,
 				last: null
 			};
 			const tokens = usageOf(event.type, data);
-			if (tokens === void 0 || !finite$1(data.turn) || !finite$1(data.step)) return state;
+			if (tokens === void 0 || !finite(data.turn) || !finite(data.step)) return state;
 			const previous = state.last?.turn === data.turn && state.last.step === data.step ? state.last.group : void 0;
 			const group = {
 				provider: state.selection?.provider ?? "",
@@ -2166,34 +2127,18 @@ const IDENTITY_ENCODING_HEADER = { "accept-encoding": "identity" };
 /**
 * Multi-account pool for the Command Code provider (host side).
 *
-* One Command Code subscription (e.g. the Go plan's 5-hour window) is
-* metered; a user with several subscriptions wants a request that hits one
-* account's limit to continue on the next account without a visible failure.
-* This module owns that rotation:
+* One subscription's 5-hour window is metered, and a user with several wants a
+* request that hits one account's limit to continue on the next without a
+* visible failure. Rotation is passive: a key is marked only on a real
+* pre-stream rejection, and when nothing can serve, marked keys are revived by
+* probing their real usage windows.
 *
-*   - {@link CommandCodeAccountPool.resolveKey} hands out the first account
-*     whose key is not currently marked exhausted — or, when the request's
-*     model matches a {@link CommandCodeModelAccountRule} and that account is
-*     usable, the routed account — resolving each slot's key lazily (literal
-*     config key → credential seam → launch environment → the official CLI
-*     auth file for the default slot only).
-*   - {@link CommandCodeAccountPool.markRejected} records a 429 or 401 against
-*     the exact API key, so several slots sharing one key share one state. A
-*     429 that NAMED a usage window marks the window exhausted; a 429 that
-*     named none is recorded as a plain throttle, which rotates the same way
-*     but is never reported as an exhausted window (issue #54).
-*   - When every account is marked, the pool probes each key's
-*     `/alpha/billing/credits` window limits (through the injected
-*     {@link CommandCodeAccountPoolDeps.probeWindow}): an account whose window
-*     no longer reports `exceeded` is revived, otherwise the pool throws a
-*     `RATE_LIMIT` error naming the earliest reset time.
-*   - An account the user explicitly asked for — the manual pin
-*     ({@link CommandCodeAccountPoolDeps.preferredId}) or a model rule's
-*     routed account — is probed the same way when a mark would demote it, so
-*     a fallback is never permanent (issue #51).
+* The non-obvious rules — which rejection may be REPORTED as a spent window, why
+* a fallback is never permanent, what an explicitly selected account's probe
+* costs — are stated at the members below, and recorded in full in AGENTS.md.
 *
-* The pool is deliberately cordis-free (like the adapter): every host fact
-* arrives through injected thunks, so node tests can drive it directly.
+* Cordis-free like the adapter: every host fact arrives through injected thunks,
+* so node tests can drive the pool directly.
 *
 * @module dsh-commandcode-provider/accounts
 */
@@ -2201,22 +2146,21 @@ const IDENTITY_ENCODING_HEADER = { "accept-encoding": "identity" };
 * Upper bound on the retry wait this pool attaches to the all-exhausted
 * `RATE_LIMIT` error. Must equal the `backoff.maxDelayMs` in the adapter's
 * `providerRetryPolicy` (which imports it from here): dsh-llm-retry honors a
-* provider-specified wait verbatim only at or below that cap — in normal mode
-* a LONGER attached wait makes the executor abandon the retry entirely
-* instead of falling back to local backoff, which would turn "poll until the
-* window opens" into "fail now".
+* provider-specified wait verbatim only at or below that cap — a LONGER one
+* makes the executor abandon the retry instead of falling back to local backoff
+* (in normal mode), turning "poll until the window opens" into "fail now".
 */
 const RETRY_MAX_DELAY_MS = 9e5;
 /**
 * How long an explicitly selected account's rate-limit mark may stand before
-* its window is probed again. A 429 whose reset was never learned marks the
-* key `unknown`, which {@link accountUsable} refuses forever — deliberately,
-* because the all-marked revival pass is the only thing meant to clear it and
-* it costs one billing call per key. That is fine for a key nobody asked for,
-* and wrong for the one the user pinned: a single 429 would otherwise demote
-* the user's own selection until the process restarts (issue #51). The probe
-* is therefore allowed once per interval per key, which bounds an endpoint
-* that keeps failing while a successful probe resolves the mark for good.
+* its window is probed again.
+*
+* A 429 whose reset was never learned marks the key `unknown`, which
+* {@link accountUsable} refuses — for a key nobody asked for that is correct
+* (only the all-marked pass clears it, and it costs one billing call), but for
+* the user's own pinned account a single 429 would demote it until the process
+* restarts (issue #51). Once per interval per key bounds a probe endpoint that
+* keeps failing; a successful probe resolves the mark for good.
 */
 const EXPLICIT_ACCOUNT_PROBE_INTERVAL_MS = 6e4;
 /** A labeled, human-readable clock reading for error messages. */
@@ -2235,10 +2179,10 @@ function accountUsable(state) {
 	return false;
 }
 /**
-* Pick the account that should serve now: the manually preferred slot when it
-* is usable, otherwise the first usable account in rotation order; undefined
-* when no account is usable. Shared by the pool (request path) and the plugin
-* entry (the usage view's active badge) so both always agree.
+* Pick the account that should serve now: the manually preferred slot when it is
+* usable, otherwise the first usable account in rotation order; undefined when
+* no account is usable. Shared by the pool (request path) and the plugin entry
+* (the usage view's active badge) so both always agree.
 */
 function selectActiveAccount(accounts, preferredId) {
 	const usable = accounts.filter((account) => accountUsable(account.state));
@@ -2321,27 +2265,26 @@ var CommandCodeAccountPool = class {
 		return out;
 	}
 	/**
-	* Hand out the key for a request: the model-routed account when the
-	* request's model matches a rule (and that account is usable), else the
-	* manually preferred account when usable, else the first usable account in
-	* rotation order. Returns `undefined` when no account resolves any key at
-	* all (the caller then reports the missing credential). Throws
-	* `RATE_LIMIT` — naming the earliest window reset — or
-	* `INVALID_CREDENTIAL` when accounts exist but none can serve.
+	* Hand out the key for a request: the model-routed account when the request's
+	* model matches a rule (and that account is usable), else the manually
+	* preferred account when usable, else the first usable account in rotation
+	* order. Returns `undefined` when no account resolves any key at all, or when
+	* an account this request already used is still UNMARKED — that rejection is
+	* the honest answer, so the caller's own rejection surfaces as itself. Throws
+	* `RATE_LIMIT` (naming the earliest window reset) or `INVALID_CREDENTIAL`
+	* when accounts exist but every one of them is marked.
 	*
 	* `options.model` is the request's model id; routing rules re-read per
-	* resolution, so a settings change applies live.
-	*
-	* `options.tried` lists the keys this request has already used — the
-	* just-rejected one included. They are removed from the resolution entirely,
-	* which is what lets one request walk a four-account pool: an account-scoped
-	* rejection that does not mark the key (no credits, a model outside the
-	* account's plan) would otherwise be offered again on every attempt, and the
-	* accounts behind it would never be reached.
+	* resolution, so a settings change applies live. `options.tried` lists the
+	* keys this request has already used — the just-rejected one included — and
+	* they are removed from the resolution entirely, which is what lets one
+	* request walk a four-account pool: a rejection that does not mark the key
+	* (no credits, a model outside the account's plan) would otherwise be offered
+	* again on every attempt and the accounts behind it never reached.
 	*
-	* An explicit selection (the pin or a model rule) that a rate-limit mark
-	* would demote is probed before the fallback serves, so "falls back while
-	* exhausted" never becomes "stays demoted until the process restarts".
+	* An explicit selection (the pin or a model rule) that a rate-limit mark would
+	* demote is probed before the fallback serves, so "falls back while exhausted"
+	* never becomes "stays demoted until the process restarts" (issue #51).
 	*/
 	async resolveKey(options) {
 		const accounts = await this.resolvedAccounts();
@@ -2397,21 +2340,18 @@ var CommandCodeAccountPool = class {
 		throw allAccountsUnusable(latestAccounts.length > 0 ? latestAccounts : accounts);
 	}
 	/**
-	* Record a rejection against one key. `rate-limit` marks the key's usage
-	* WINDOW exhausted — as a `cooldown` until `resetAtMs` when the rejection
-	* body named the provider's own reset time, otherwise as an `unknown` mark
-	* whose window is probed lazily. `throttled` (the plain 429 that named no
-	* window) marks the key with the `throttle` cause instead: it leaves rotation
-	* exactly like a window mark does, but the pool's own diagnosis keeps saying
-	* "rate limited" rather than inventing an exhausted window. A 401
-	* (`invalid-credential`) disables the key until the stored credential
+	* Record a rejection against one key. A `throttled` rejection (the plain 429
+	* that named no window) marks the key with the `throttle` cause, leaving
+	* rotation exactly like a window mark but keeping the pool's own diagnosis at
+	* "rate limited" rather than inventing an exhausted window. `rate-limit`
+	* marks a `cooldown` until `resetAtMs` when the body named the provider's own
+	* reset, otherwise an `unknown` mark whose window is probed lazily.
+	* `invalid-credential` (401) disables the key until the stored credential
 	* changes.
 	*
-	* `resetAtMs` is seconds-to-millis converted by the adapter from the
-	* provider's `error.rateLimit.reset`: knowing the real reset immediately is
-	* what keeps an exhausted account out of rotation for exactly as long as the
-	* provider said. It only applies to a window mark; a plain throttle keeps the
-	* window unknown on purpose, so a probe can still find out.
+	* `resetAtMs` is seconds-to-millis converted by the adapter from
+	* `error.rateLimit.reset`; it applies to a window mark only. A plain throttle
+	* keeps its window unknown on purpose, so a probe can still find out.
 	*/
 	markRejected(apiKey, rejection, resetAtMs) {
 		if (rejection === "invalid-credential") this.states.set(apiKey, {
@@ -2443,15 +2383,12 @@ var CommandCodeAccountPool = class {
 	* One account's key: literal → credential seam → auth file (default slot).
 	*
 	* Every source is normalized here, at the single point where a slot's key
-	* enters the pool. The adapter sends the key through the harness's
-	* `assertUsableApiKey()`, which trims it — a stored key from the credentials
-	* seam, a `.env` line, or a shell export all pick up surrounding whitespace
-	* — and reports that trimmed form back to `markRejected()`. Returning the
-	* raw value would file every 429/401 mark under a key no later lookup can
-	* find: rotation would re-offer the same account, the account card would show
-	* no mark, and the usage endpoints would 401 while chat kept working.
-	* Normalizing once makes resolution, probing, marking, and the request path
-	* agree on one string.
+	* enters the pool. The adapter sends the key through
+	* `assertUsableApiKey()`, which trims it, and reports that trimmed form back
+	* to {@link markRejected}: returning the raw value would file every 429/401
+	* mark under a key no later lookup can find — rotation would re-offer the same
+	* account, the account card would show no mark, and the usage endpoints would
+	* 401 while chat kept working.
 	*/
 	async resolveSlotKey(slot) {
 		if (slot.literal !== void 0) {
@@ -2474,12 +2411,11 @@ var CommandCodeAccountPool = class {
 		}
 	}
 	/**
-	* The account the user explicitly asked for: the slot a model rule routes
-	* the request to when that id exists among the resolved slots, else the
-	* manually pinned slot. Consulted only on the fallback path — a usable
-	* routed account already returned above — so unlike
-	* {@link selectAccountForModel} it does NOT require the account to be
-	* usable, which is exactly what {@link resolveKey} re-probes.
+	* The account the user explicitly asked for: the slot a model rule routes the
+	* request to when that id exists among the resolved slots, else the manually
+	* pinned slot. Consulted only on the fallback path, so — unlike
+	* {@link selectAccountForModel} — it does NOT require the account to be usable,
+	* which is exactly what {@link resolveKey} re-probes.
 	*/
 	explicitAccount(accounts, model, preferredId) {
 		const rule = matchModelRule(model, this.deps.modelAccountRules?.());
@@ -2489,9 +2425,9 @@ var CommandCodeAccountPool = class {
 	/**
 	* Whether an explicitly selected account's mark is due for a window probe.
 	* Only an `unknown` mark (a 429 whose reset was never learned) is worth
-	* re-probing: a `cooldown` already carries its reset time and expires by
-	* itself, and a `disabled` (401) key stays out until the stored credential
-	* changes. The interval bounds a probe endpoint that keeps failing.
+	* re-probing: a `cooldown` carries its reset and expires by itself, and a
+	* `disabled` (401) key stays out until the stored credential changes. The
+	* interval bounds a probe endpoint that keeps failing.
 	*/
 	canProbeExplicit(account) {
 		if (account.state?.kind !== "unknown") return false;
@@ -2505,8 +2441,8 @@ var CommandCodeAccountPool = class {
 	/**
 	* Probe one explicitly selected account's window and apply the answer. A
 	* window that is no longer exceeded drops the mark, so the user's own
-	* selection serves again on this very request. An exceeded one is stamped
-	* as a cooldown carrying the provider's reset time, after which
+	* selection serves again on this very request; an exceeded one is stamped as
+	* a cooldown carrying the provider's reset time, after which
 	* {@link accountUsable} lets the account back in with no further probe. A
 	* probe that fails changes nothing: the mark stays `unknown` and the next
 	* attempt waits out the interval.
@@ -2558,22 +2494,20 @@ var CommandCodeAccountPool = class {
 *     read a window as exceeded) → the window diagnosis, naming the earliest
 *     known reset when the provider published one;
 *   - every mark a plain throttle (a 429 that said nothing about a window, and
-*     no probe could confirm one) → a throttle diagnosis that says so. Claiming
-*     "all accounts have exhausted their usage window" here is issue #54: the
-*     report's account panel showed the five-hour window at 2% and the weekly
-*     one at 10% while the turn failed with exactly that sentence.
+*     no probe could confirm one) → a throttle diagnosis that says so.
+*     Claiming "all accounts have exhausted their usage window" here is issue
+*     #54: a bare 429 was reported that way while the account card showed both
+*     windows barely used.
 *
-* Shared by the all-marked tail of {@link CommandCodeAccountPool.resolveKey}
-* and by its already-tried diagnosis, so the two can never drift apart.
+* The attached `providerRetryAfterMs` is the exact wait until the earliest known
+* window reset, so dsh-llm-retry sleeps through the window instead of polling at
+* its backoff cadence. It is capped at {@link RETRY_MAX_DELAY_MS} — see there for
+* why a longer attached wait is worse than a capped one; longer resets simply
+* ride the capped local backoff and the probe revival. A throttle diagnosis
+* attaches none: its marks carry no reset.
 *
-* The attached `providerRetryAfterMs` is the exact wait until the earliest
-* known window reset, so dsh-llm-retry sleeps through the window instead of
-* polling at its backoff cadence. It is capped at {@link RETRY_MAX_DELAY_MS}:
-* the executor honors a provider wait verbatim only at or below the policy's
-* `maxDelayMs` — a LONGER attached wait makes it abandon the retry entirely
-* (normal mode), which would turn "poll until the window opens" into "fail
-* now". Longer resets simply ride the capped local backoff and the probe
-* revival. A throttle diagnosis attaches none: its marks carry no reset.
+* Shared by the all-marked tail of {@link CommandCodeAccountPool.resolveKey} and
+* by its already-tried diagnosis, so the two can never drift apart.
 */
 function allAccountsUnusable(accounts) {
 	if (accounts.filter((account) => account.state?.kind === "disabled").length === accounts.length) return new LlmError(`llm-commandcode: every configured Command Code account (${accounts.length}) was rejected with 401 — check the stored API keys (Models page / settings) or the auth file；已配置的 ${accounts.length} 个 Command Code 账户密钥均被拒绝（401）——请在设置页检查存储的 API 密钥，或重新运行 command-code login`, "INVALID_CREDENTIAL");
@@ -2616,14 +2550,14 @@ const REQUEST_IMAGE_MAX_LONG_EDGE = 1568;
 const REQUEST_IMAGE_MAX_ENCODED_BYTES = 1048576;
 /**
 * Aspect-preserving projection onto a long-edge budget; never enlarges, and
-* never returns a zero dimension (a 1-px degenerate side is what the round of
-* an extreme aspect ratio can produce, and a 0 would make the encoder refuse).
+* never returns a zero dimension.
 *
 * `dsh-attachment` exports an equivalent `longEdgeDimensions`, but it does not
 * guard its inputs: a reference whose declared size is 0 or NaN — a malformed
 * or fabricated attachment record — would project to a zero-sized target and
-* make the encoder refuse the whole request. The guard is the reason this stays
-* local; `tests/image-tokens.test.ts` pins the degenerate cases.
+* make the encoder refuse the whole request. This local guard is the ONLY
+* reason the function is not imported; do not replace it with the upstream one.
+* `tests/image-tokens.test.ts` pins the degenerate cases.
 */
 function longEdgeDimensions(width, height, longEdge) {
 	if (!Number.isFinite(width) || !Number.isFinite(height) || width <= 0 || height <= 0) return {
@@ -2667,16 +2601,13 @@ function requestImageTarget(ref) {
 * that the heuristic prices at ~0 tokens each, so context pressure is
 * under-reported and the session walks into its own context window.
 *
-* This route is a gateway in front of many upstreams — one catalog id per model,
-* but the visual-token rule belongs to whoever serves it. So the estimate is per
-* FAMILY, using each vendor's published rule, and the families are recognised by
-* the catalog id (which names the vendor). Every formula is stated here rather
-* than imported: the only in-tree implementations live inside the official
-* adapters, and this plugin deliberately does not depend on those protocols.
-*
-* These are ESTIMATES for context accounting, not invoices — the provider's own
-* usage remains authoritative for a completed request, exactly as the published
-* per-token rates the session-cost readout uses are.
+* This route is a gateway in front of many upstreams, so the estimate is per
+* FAMILY, using each vendor's published rule, and the families are recognised
+* by the catalog id (which names the vendor). Every formula is stated here
+* rather than imported: the only in-tree implementations live inside the
+* official adapters, and this plugin deliberately does not depend on those
+* protocols. These are ESTIMATES for context accounting, not invoices — the
+* provider's own usage remains authoritative for a completed request.
 *
 * @module dsh-commandcode-provider/image-tokens
 */
@@ -2826,14 +2757,11 @@ function scaleBy(size, factor) {
 * Opt-in raw-stream trace for the Command Code transports.
 *
 * Why this exists: this route's failure mode of record is a response that ENDS
-* EARLY. The gateway, an intermediary proxy, or the network closes the socket
-* mid-generation, so the adapter's read loop sees `done` without ever seeing
-* the transport's terminal event. From inside the adapter those two endings are
-* indistinguishable — the provider cut the stream, a proxy timed out, or the
-* socket was dropped — and the only artifact that separates them is the raw
-* wire: which events actually arrived, when the last one landed, how long the
-* socket then sat silent, and how it ended. Without that, a truncated answer is
-* a report with no evidence attached.
+* EARLY — the gateway, a proxy or the network closes the socket mid-generation,
+* so the adapter's read loop sees `done` without the transport's terminal event.
+* A provider cut, a proxy timeout and a dropped socket are indistinguishable
+* from inside the adapter; only the raw wire separates them — which events
+* arrived, when the last one landed, how long the socket then sat silent.
 *
 * Enable it per process:
 *
@@ -2843,24 +2771,25 @@ function scaleBy(size, factor) {
 * ```
 *
 * Any value that is not a flag is a path, and the explicit off-spellings
-* (`0`, `false`, `no`, `off`) are recognized as "off" rather than being taken
-* for a file name.
+* (`0`, `false`, `no`, `off`) are read as "off" rather than as a file name.
 *
 * Every model request appends one JSONL record per raw chunk plus lifecycle
-* records (`response`, `eof`, `idle-timeout`, `read-error`, `end`,
-* `stream-close`), each stamped with `at` — milliseconds since that request's
-* first byte. The chunk records carry the provider's own payload verbatim
-* (bounded per chunk), because a truncated answer is exactly what is being
-* diagnosed: treat the file as conversation content, not as a log safe to
-* share. It never carries the request body, an API key, or any request header.
-*
-* Deliberate trade-offs:
-*  - OFF costs one `process.env` read per request.
-*  - ON appends synchronously, one file open per chunk. The trace must survive
-*    a host killed mid-diagnosis, and the microseconds it costs are irrelevant
-*    beside the seconds-scale silences it is there to measure.
-*  - A trace that cannot be written turns itself off instead of failing the
-*    request it is observing: a diagnostic must never become the outage.
+* records (`request`, `response`, `eof`, `idle-timeout`, `read-error`, `end`,
+* `stream-close`), each stamped with `streamId` and `at` — milliseconds since
+* the trace opened, before connecting. `stream-open.startedAt` is Unix time in
+* milliseconds, so interleaved calls and session logs can be correlated.
+*
+* PRIVACY: the chunk records carry the provider's own payload verbatim, because
+* a truncated answer is exactly what is being diagnosed — treat the file as
+* conversation content, not as a log safe to share. The request-side record
+* records structural counts and SHA-256 fingerprints only; it never carries the
+* raw request body, an API key, or any request header. Keep it that way.
+*
+* Trade-offs: OFF costs one `process.env` read per request; ON appends
+* synchronously, one file open per chunk, because the trace must survive a host
+* killed mid-diagnosis. A trace that cannot be written turns itself off rather
+* than failing the request it observes — a diagnostic must never become the
+* outage.
 *
 * @module
 */
@@ -2883,7 +2812,7 @@ const FLAG_VALUES = /* @__PURE__ */ new Set([
 * A user turning the trace off writes `false` as readily as they write `1` to
 * turn it on, and without this set every one of these spellings fell through to
 * "…so it must be a path" — the trace switched ON and wrote the conversation to
-* a file NAMED `false` (or `0`, or `off`) in the process's working directory.
+* a file NAMED `false` in the process's working directory.
 */
 const OFF_VALUES = /* @__PURE__ */ new Set([
 	"0",
@@ -2935,6 +2864,7 @@ function openStreamTrace(scope, options = {}) {
 	if (path === void 0) return OFF;
 	const now = options.now ?? Date.now;
 	const startedAt = now();
+	const streamId = randomUUID();
 	let written = 0;
 	let stopped = false;
 	let capped = false;
@@ -2954,6 +2884,7 @@ function openStreamTrace(scope, options = {}) {
 			line = `${JSON.stringify({
 				at: now() - startedAt,
 				scope,
+				streamId,
 				...record
 			})}\n`;
 		} catch {
@@ -2967,6 +2898,7 @@ function openStreamTrace(scope, options = {}) {
 			line = `${JSON.stringify({
 				at: now() - startedAt,
 				scope,
+				streamId,
 				event: "trace-capped",
 				bytes: written
 			})}\n`;
@@ -2978,9 +2910,14 @@ function openStreamTrace(scope, options = {}) {
 			stopped = true;
 		}
 	};
-	write({ event: "stream-open" });
+	write({
+		event: "stream-open",
+		startedAt
+	});
 	return {
-		enabled: true,
+		get enabled() {
+			return !stopped && !capped;
+		},
 		record(event, fields) {
 			write(fields === void 0 ? { event } : {
 				event,
@@ -3004,20 +2941,17 @@ function openStreamTrace(scope, options = {}) {
 * community-maintained integration; you need your own Command Code account
 * and API key or subscription, and Command Code's terms apply.
 *
-* Wire protocol (reverse-engineered by the pi plugin, command-code@1.28.4;
-* re-verified through command-code@1.65.2):
-*   POST {apiBase}/alpha/generate
-*   body: { config, memory, taste, skills, params: { model, messages, tools,
-*          system, max_tokens, temperature, stream, reasoning_effort? }, threadId }
-*   SSE-ish JSONL events: text-delta | reasoning-start/delta/end | tool-call
-*                         | tool-result | cache-write-tokens | finish | error
-*   Model catalog: GET {apiBase}/provider/v1/models -> { object: 'list', data: [...] }
+* Owns the two chat transports (`/alpha/generate`, `/provider/v1/chat/completions`),
+* message conversion, SSE/JSONL parsing, the catalog + its on-disk cache, and
+* the pre-stream account rotation loop. The wire protocol is
+* reverse-engineered (command-code@1.28.4, re-verified through 1.66.0);
+* AGENTS.md holds the full protocol record.
 *
 * The adapter is deliberately free of cordis/schemastery: it receives a
 * per-request options thunk and an API-key resolver from the plugin entry
 * (src/index.ts), so a settings change reaches the very next request.
 */
-const COMMAND_CODE_CLI_VERSION = "1.65.2";
+const COMMAND_CODE_CLI_VERSION = "1.66.0";
 const DEFAULT_API_BASE = "https://api.commandcode.ai";
 const DEFAULT_GENERATE_MAX_TOKENS = 64e3;
 const DEFAULT_MAX_OUTPUT_TOKENS = 65536;
@@ -3051,6 +2985,97 @@ function stringValue(value) {
 function numberValue(value) {
 	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
+/** Hash one request value without retaining or logging its contents. */
+function fingerprintValue(value) {
+	let serialized;
+	try {
+		serialized = JSON.stringify(value) ?? String(value);
+	} catch {
+		serialized = String(value);
+	}
+	return {
+		bytes: Buffer.byteLength(serialized),
+		sha256: createHash("sha256").update(serialized).digest("hex")
+	};
+}
+/**
+* Structural request facts for issue #64's cache diagnosis.
+*
+* This deliberately records hashes and counts, never the prompt, tool
+* descriptions, image bytes, headers, or credentials. `body` catches changes
+* in any wire field; the named sections make a changed system/tools/messages
+* prefix visible without making the trace a copy of the conversation.
+*/
+function requestFingerprint(protocol, body) {
+	const params = protocol === "cli" ? recordOrEmpty(body.params) : body;
+	const messages = Array.isArray(params.messages) ? params.messages : [];
+	const tools = Array.isArray(params.tools) ? params.tools : [];
+	return {
+		protocol,
+		model: typeof params.model === "string" ? params.model : void 0,
+		threadId: typeof body.threadId === "string" ? body.threadId : void 0,
+		body: fingerprintValue(body),
+		config: fingerprintValue(body.config),
+		system: fingerprintValue(protocol === "cli" ? params.system : messages.filter((m) => isRecord(m) && m.role === "system")),
+		tools: {
+			count: tools.length,
+			...fingerprintValue(tools)
+		},
+		messages: {
+			count: messages.length,
+			roles: messages.map((message) => isRecord(message) && typeof message.role === "string" ? message.role : "unknown"),
+			...fingerprintValue(messages),
+			items: messages.map((message) => fingerprintValue(message))
+		}
+	};
+}
+/** Only provider correlation headers, never a wholesale response-header dump. */
+const RESPONSE_ID_HEADERS = [
+	"x-request-id",
+	"request-id",
+	"x-trace-id",
+	"x-generation-id",
+	"traceparent"
+];
+function responseIdentifiers(headers) {
+	const result = {};
+	for (const name of RESPONSE_ID_HEADERS) {
+		const value = diagnosticId(headers.get(name));
+		if (value !== void 0) result[name] = value;
+	}
+	return result;
+}
+function diagnosticId(value) {
+	return typeof value === "string" && value.trim().length > 0 && value.length <= 512 ? value : void 0;
+}
+function captureResponseIdentifiers(metadata, event) {
+	if (!isRecord(event)) return;
+	if (metadata.protocol === "openai" && Array.isArray(event.choices) || event.type === "response-metadata") {
+		const id = diagnosticId(event.id);
+		if (id !== void 0) metadata.responseId = id;
+	}
+	for (const name of [
+		"generationId",
+		"providerRequestId",
+		"traceId"
+	]) {
+		const id = diagnosticId(event[name]);
+		if (id !== void 0) metadata[name] = id;
+	}
+}
+function hasResponseIdentifiers(metadata) {
+	return Object.keys(metadata.headers).length > 0 || metadata.responseId !== void 0 || metadata.generationId !== void 0 || metadata.providerRequestId !== void 0 || metadata.traceId !== void 0;
+}
+/** Keep the provider's request id on DSH's durable failure, when it supplied one. */
+function failureWithRequestId(error, metadata) {
+	const id = metadata.providerRequestId ?? metadata.headers["x-request-id"] ?? metadata.headers["request-id"];
+	if (!(error instanceof LlmError) || error.failure.requestId !== void 0 || id === void 0) return error;
+	return new LlmError(error.message, error.code, {
+		...error.failure,
+		requestId: ProviderRequestId(id),
+		...error.cause === void 0 ? {} : { cause: error.cause }
+	});
+}
 function booleanValue(value) {
 	return typeof value === "boolean" ? value : void 0;
 }
@@ -3060,16 +3085,13 @@ function booleanValue(value) {
 *
 * Entries are read by their own text members rather than filtered on `type`:
 * DeepSeek sends `{ type: 'reasoning.text', text }` while the OpenAI family
-* sends `{ type: 'reasoning.summary', summary, format: 'openai-responses-v1' }`
-* — the same summary text the scalar `delta.reasoning` carries, in the
-* Responses protocol's vocabulary. A `type` filter would drop one family or the
-* other, and losing thinking is the failure this exists to prevent.
-*
-* `text` wins per entry, but an EMPTY `text` must not shadow a populated
-* `summary` (the Responses wire emits `text: ''` placeholders), so the fallback
-* tests for non-empty rather than merely present. Entries carrying neither
-* member — the encrypted blobs — contribute nothing, and no entry contributes
-* both, so a summary is never counted twice.
+* sends `{ type: 'reasoning.summary', summary }` — the same summary text the
+* scalar `delta.reasoning` carries. A `type` filter would drop one family, and
+* losing thinking is the failure this exists to prevent. `text` wins per entry,
+* but an EMPTY `text` must not shadow a populated `summary` (the Responses wire
+* emits `text: ''` placeholders), so the fallback tests for non-empty rather
+* than merely present. Encrypted-blob entries carry neither member and
+* contribute nothing; no entry carries both, so nothing is counted twice.
 *
 * Returns undefined when the array yields nothing, so the caller's `??` chain
 * keeps falling through instead of treating "no text" as a reasoning delta.
@@ -3090,9 +3112,7 @@ function reasoningDetailsText(value) {
 * none" — the same rule {@link reasoningDetailsText} applies inside the array.
 * The scalar and the array describe the same thinking, so an empty spelling of
 * one must not shadow populated text in the other (the Responses wire pads with
-* `text: ''`). `??` alone cannot express this: an empty string is not nullish,
-* so `reasoning: ''` beside a populated `reasoning_details` used to drop the
-* whole chunk's thinking.
+* `text: ''`), and `??` alone cannot express that.
 */
 function nonEmptyText(value) {
 	return value === void 0 || value === "" ? void 0 : value;
@@ -3156,30 +3176,21 @@ function isZdrNoProviders(providerCode, providerDetail, errText) {
 /**
 * Classify one in-band stream `error` payload into the failure the caller
 * throws. Shared by both transports — the CLI transport delivers it as an
-* `error` event (`{ type: 'error', error }`), the Provider API transport as a
-* top-level `error` member of an SSE chunk — so the two cannot drift apart.
+* `error` event, the Provider API transport as a top-level `error` member of
+* an SSE chunk — so the two cannot drift apart.
 *
 * The wording decides before the status does, mirroring the official CLI's
-* `classifyKind` (which reads the message first) and the harness helpers
-* (which exist so thrown and in-band delivery share one classifier). Order is
-* load-bearing:
+* `classifyKind` (which reads the message first). Order is load-bearing:
 *
 * - A context-window rejection is terminal for THIS request but recoverable by
 *   the harness: `dsh-compaction-basic` listens on `agent/request-error` for
 *   `CONTEXT_WINDOW_EXCEEDED` and answers it with a compaction + retry of the
-*   reduced surface. That is what lets a long session survive a request that
-*   outgrew the model's window, and it is what the official CLI does (its
-*   non-retryable `truncated` kind). Reported as retryable `SERVER` — where
-*   this wording landed before — the adapter resent the byte-identical
-*   oversized request up to `maxRetries` times and the session could never
-*   recover, which is exactly the endless-retry-at-long-context report
-*   (issue #39).
+*   reduced surface. Reported as retryable `SERVER` instead, the adapter resent
+*   the byte-identical oversized request up to `maxRetries` times and the
+*   session could never recover (issue #39).
 * - Credits/plan wording is terminal, so an exhausted balance or a model
 *   outside the plan is not retried as if it were a transient rate limit.
-* - Only then does the status/`isRetryable` pair decide — and an explicit
-*   refusal (`isRetryable: false`) or a terminal marker OUTRANKS a status, so a
-*   5xx carrying "insufficient credits" stays terminal instead of entering the
-*   retry cadence as `SERVER`.
+* - Only then does the status/`isRetryable` pair decide.
 */
 function streamErrorToLlmError(value, fallbackMessage) {
 	const record = isRecord(value) ? value : void 0;
@@ -3283,6 +3294,8 @@ function mergeCombinatorBranches(node, depth) {
 * resolved/merged; anything else (an array/scalar root, or no schema at all)
 * degrades to a permissive free-form object, because a request the provider
 * refuses helps no one and the tool's own description is still in the prompt.
+* Only the root is touched and every path returns a copy: the harness may
+* deep-freeze the caller's schema.
 */
 function toolParametersSchema(parameters, depth = 0) {
 	if (!isRecord(parameters)) return {
@@ -3401,11 +3414,10 @@ async function writeModelsCache(cachePath, models) {
 * The tool result one message answers, or undefined when it answers none.
 *
 * The harness models a tool result as its own `role: 'tool'` message carrying
-* `toolCallId`/`isError` beside raw content blocks (a closed role map:
-* `MessageRoleMap.tool` is the only role a tool result can arrive on). Pairing
-* and emission MUST agree on this same view: otherwise a dropped result either
-* drops its call too (making the model forget completed work), or leaves an
-* unanswered call on the wire.
+* `toolCallId`/`isError` beside raw content blocks (`MessageRoleMap.tool` is
+* the only role a tool result can arrive on). Pairing and emission MUST agree
+* on this same view, or a dropped result either drops its call too (making the
+* model forget completed work) or leaves an unanswered call on the wire.
 */
 function toolResultOf(message) {
 	if (message.role !== "tool") return void 0;
@@ -3448,8 +3460,8 @@ function pairedToolCalls(messages) {
 * another provider issued the call — so overlong paired ids are remapped to
 * short per-request aliases. Correlation only needs to hold within one
 * request (each call travels with its result in the same body), so a
-* sequential alias is enough: no durable state, no cross-request stability,
-* and the harness log keeps the original ids.
+* sequential alias is enough: no durable state, and the harness log keeps the
+* original ids.
 */
 const MAX_WIRE_TOOL_CALL_ID_LENGTH = 64;
 /**
@@ -3481,7 +3493,7 @@ function blockText(block) {
 /**
 * Collect text and nested images of one tool result. The harness `read_image`
 * tool returns both, so dropping the image half is what made a tool-read image
-* invisible to a Vision model (issue #30). Deduplication keeps a result that
+* invisible to a Vision model (issue #30); deduplication keeps a result that
 * repeats one attachment from paying for the same pixels twice.
 */
 function toolResultMedia(block) {
@@ -3521,17 +3533,14 @@ const TOOL_RESULT_IMAGE_TEXT = "Attached image(s) from tool result";
 * tool it just ran rather than to the user; it also leads the part list,
 * because an image-first content array is what some gateways reject.
 *
-* The note names the tool call the image came out of, because a turn's
-* carriers are emitted as a group after the whole tool group (issue #33):
-* position alone would have to carry the association, and every `read_image`
-* result renders the same envelope text, so two parallel calls would produce
-* two identical notes. The id is the WIRE id — the one the model saw on the
-* `tool-call` it issued and on the tool message just above — so an overlong
-* cross-provider id is named by the alias that replaced it, not by the
-* harness-side id the model never saw.
-*
-* Count and pixel dimensions are appended when the tool's own text does not
-* already state them (a result that returns the image and nothing else).
+* The note names the tool call the image came out of: a turn's carriers are
+* emitted as a group after the whole tool group (issue #33), so position
+* cannot carry the association — and every `read_image` result renders the
+* same envelope text, so two parallel calls would produce two identical
+* notes. The id is the WIRE id, the one the model saw on the `tool-call` and
+* on the tool message just above, so an overlong cross-provider id is named
+* by the alias that replaced it. Count and pixel dimensions are appended
+* when the tool's own text does not already state them.
 */
 function toolResultImageNote(media, toolCallId) {
 	const lead = `${TOOL_RESULT_IMAGE_TEXT} (${toolCallId}):`;
@@ -3562,10 +3571,10 @@ const ENGINE_IMAGE_POLICY = {
 	requiredImageOffload
 };
 /**
-* The failure a route raises instead of evicting on its own. The
-* count is the ONE thing the harness needs: `dsh-compaction-image-offload`
-* records it as an `image/offload` event, marks that many oldest retained
-* occurrences, and retries the step.
+* The failure a route raises instead of evicting on its own. The count is the
+* ONE thing the harness needs: `dsh-compaction-image-offload` records it as an
+* `image/offload` event, marks that many oldest retained occurrences, and
+* retries the step.
 *
 * Deliberately outside `providerRetryPolicy()`'s whitelist: a byte-identical
 * resend cannot succeed, so the retry belongs to the surface mutation, not to
@@ -3627,8 +3636,9 @@ async function readRequestImage(attachments, ref) {
 * Price one request occurrence.
 *
 * Two cases cost no vision tokens at all, and both are priced as their
-* model-visible TEXT so the caller's estimator can charge that instead: a model
-* that accepts text only (the harness projects those images to placeholder text
+* model-visible TEXT so the caller's estimator can charge that instead (which
+* is what stops the meter counting an evicted image as context): a model that
+* accepts text only (the harness projects those images to placeholder text
 * before the request), and an occurrence the session surface has already
 * offloaded (the same placeholder text rides in every later request). A retained
 * occurrence on this route contributes no text at all — the pixels are inlined —
@@ -3883,7 +3893,6 @@ function parseUsageTotals(usage) {
 		periodBasis: stringValue(usage.periodBasis) ?? "billing-period"
 	};
 }
-/** Parse one window-limit block (`fiveHour` / `weekly`). */
 /**
 * Parse one window block into a window limit, or undefined when the endpoint
 * reported no such window.
@@ -3951,6 +3960,46 @@ function classifyTotalFailure(failures, failed) {
 	if (failed.every((item) => item.kind === "invalid-response")) return "invalid-response";
 	if (failed.every((item) => item.kind === "transport")) return "network";
 }
+/** UUID shape accepted by the official CLI's `toWireThreadId` helper. */
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const THREAD_ID_NAMESPACE = Buffer.from("6ba7b8119dad11d180b400c04fd430c8", "hex");
+/**
+* Map the harness session identity to the CLI transport's UUID thread ID.
+*
+* The official CLI creates one thread ID per agent run and reuses it for the
+* tool-loop requests that follow. DSH stamps its loop-owned session ID onto
+* GenerateOptions, but ordinary IDs are `session-<UUID>`, not bare UUIDs.
+* UUIDv5 gives every non-UUID session ID a stable, wire-compatible mapping.
+* An already valid UUID remains unchanged; a one-shot call without a session
+* ID still gets a fresh thread ID.
+* This alone does not establish cache affinity (issue #64's A/B found none).
+*/
+function cliThreadId(sessionId) {
+	if (!sessionId) return randomUUID();
+	if (UUID_PATTERN.test(sessionId)) return sessionId;
+	const digest = createHash("sha1").update(THREAD_ID_NAMESPACE).update("dsh-commandcode-provider/session/").update(sessionId).digest();
+	digest[6] = digest[6] & 15 | 80;
+	digest[8] = digest[8] & 63 | 128;
+	const hex = digest.toString("hex", 0, 16);
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+/**
+* The CLI wire's explicit system-section form.
+*
+* The official CLI's current transport sends system text as an array and marks
+* stable sections with Anthropic-compatible ephemeral cache control. DSH's
+* adapter has one already-folded system string rather than the CLI's internal
+* section list, so preserve that text as one cacheable section. This does not
+* recover the CLI's separate static/dynamic boundaries or guarantee a hit.
+*/
+function cliSystem(systemText) {
+	if (!systemText) return "";
+	return [{
+		type: "text",
+		text: systemText,
+		cache_control: { type: "ephemeral" }
+	}];
+}
 /** Build the legacy CLI (`/alpha/generate`) request body for one call. */
 async function buildCliBody(options, connection, facts) {
 	return {
@@ -3977,13 +4026,13 @@ async function buildCliBody(options, connection, facts) {
 				description: tool.description,
 				input_schema: toolParametersSchema(tool.parameters)
 			})),
-			system: facts.systemText,
+			system: cliSystem(facts.systemText),
 			max_tokens: facts.maxTokens,
 			temperature: options.temperature ?? .3,
 			stream: true,
 			...facts.reasoningEffort ? { reasoning_effort: facts.reasoningEffort } : {}
 		},
-		threadId: randomUUID()
+		threadId: cliThreadId(options.sessionId)
 	};
 }
 /** Build the documented Provider Chat Completions request body for one call. */
@@ -4012,12 +4061,11 @@ async function buildOpenAIBody(options, facts) {
 }
 /**
 * One pre-stream connect attempt: POST the body and wait for response
-* headers only (`requestTimeoutMs` must never bound the body stream — see
-* the caller). Returns the live response plus its cleanup, or the rejection
-* facts for the rotation loop to classify. Every failure path cleans up
-* before returning or throwing; on success the caller-abort listener
-* outlives the connect phase (it aborts a stalled body read), so the
-* streaming tail calls cleanup.
+* headers only (`requestTimeoutMs` must never bound the body stream). Returns
+* the live response plus its cleanup, or the rejection facts for the rotation
+* loop to classify. Every failure path cleans up before returning or throwing;
+* on success the caller-abort listener outlives the connect phase (it aborts a
+* stalled body read), so the streaming tail calls cleanup.
 */
 async function connectGenerate(deps, key, protocol, body) {
 	const { options, connection, fetchImpl } = deps;
@@ -4074,6 +4122,7 @@ async function connectGenerate(deps, key, protocol, body) {
 		if (connectTimedOut || error instanceof DOMException && error.name === "TimeoutError") throw new LlmError(`Command Code API request to ${endpoint} did not respond within ${connection.requestTimeoutMs}ms: ${errorChain(error)}；Command Code API 请求在 ${connection.requestTimeoutMs} 毫秒内未收到响应——通常是网络或代理问题，请检查后重试`, "TIMEOUT", { cause: error });
 		throw new LlmError(`Command Code API request to ${endpoint} failed: ${errorChain(error)}；Command Code API 请求连接失败——通常是网络或代理问题，请检查网络或代理设置后重试`, "TRANSPORT", { cause: error });
 	}
+	deps.onResponse(response);
 	if (!response.ok) {
 		const errText = await response.text().catch(() => "");
 		cleanup();
@@ -4203,13 +4252,13 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	* unbounded loop): `RATE_LIMIT`/`SERVER`/`TIMEOUT`/`TRANSPORT`/
 	* `EMPTY_RESPONSE` retry up to 1000 times with waits doubling from 500 ms
 	* and capping at 15 minutes (±10% jitter), so an exhausted 5-hour window
-	* recovers in-session instead of failing after two tries. Permanent
-	* failures (an invalid key's `INVALID_CREDENTIAL`, `UNSUPPORTED_CONTENT`,
-	* plan rejections) are absent from the whitelist and surface immediately
-	* instead of looping. Waits the pool/adapter attach as
-	* `providerRetryAfterMs` are honored verbatim at or below the 15-minute
-	* cap and never attached above it (in normal mode a longer attached wait
-	* makes the executor abandon the retry outright — see RETRY_MAX_DELAY_MS).
+	* recovers in-session instead of failing after two tries. Permanent failures
+	* (an invalid key's `INVALID_CREDENTIAL`, `UNSUPPORTED_CONTENT`, plan
+	* rejections) are absent from the whitelist and surface immediately instead
+	* of looping. Waits the pool/adapter attach as `providerRetryAfterMs` are
+	* honored verbatim at or below the 15-minute cap and never attached above it
+	* (in normal mode a longer attached wait makes the executor abandon the
+	* retry outright — see RETRY_MAX_DELAY_MS).
 	*
 	* Captured once at route registration (dsh-llm snapshots this value), so a
 	* future config knob for it would apply on profile restart, not per request.
@@ -4240,12 +4289,8 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	* session reports far less context than it is actually carrying. The price is
 	* computed at the dimensions this route would send (the same request target
 	* `readImageRequest` encodes to), so the estimate tracks the wire rather than
-	* the stored original.
-	*
-	* Both payload generations are handled, because they disagree: ≤0.1.5 hands
-	* over bare `ImageAttachmentRef`s, ≥0.1.6 hands over `ImageBlock`s that also
-	* carry the surface's `offloaded` mark. Returning a price per occurrence, in
-	* order, is a hard requirement — the meter throws when the counts differ.
+	* the stored original. One price per occurrence, in order, is a hard
+	* requirement — the meter throws when the counts differ.
 	*/
 	imageRequestPricing(_provider, model) {
 		const imageCapable = KNOWN_IMAGE_MODELS.has(model);
@@ -4331,10 +4376,10 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	}
 	/**
 	* Fetch one account endpoint and parse its JSON body. Returns the HTTP
-	* status alongside the parsed record so each caller applies its own
-	* failure accounting: the billing probe fails open silently, the usage
-	* report books failures per endpoint. Non-2xx and invalid JSON bodies come
-	* back without a record; only a fetch failure propagates to the caller.
+	* status alongside the parsed record so each caller applies its own failure
+	* accounting: the billing probe fails open silently, the usage report books
+	* failures per endpoint. Non-2xx and invalid JSON bodies come back without a
+	* record; only a fetch failure propagates to the caller.
 	*
 	* `timeoutMs` is the caller's budget for this one request. The default is the
 	* CATALOG probe's short cap, which fits the picker's fail-open reads; the
@@ -4371,9 +4416,6 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	* per picker load). `undefined` means the filter cannot be evaluated at all
 	* — no key resolved — which {@link modelVisibleForAnyAccount} reads as
 	* "show everything".
-	*
-	* The serving account is only the first entry: with several accounts the
-	* model list must not depend on which of them rotation happens to be using.
 	*/
 	async loadPoolBillingAccess() {
 		const keys = await this.poolAccountKeys();
@@ -4486,10 +4528,9 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	* but a hard refusal. `/alpha/generate` routes every one of them, so this
 	* costs nothing.
 	*
-	* That decision is deliberately NOT written to `protocolCache`. The cache is
-	* keyed by API key alone, so remembering it would pin the whole ACCOUNT to
-	* the CLI transport and drag every other model — DeepSeek, GLM, Qwen, all of
-	* which the Provider API serves correctly — off it until the entry expired.
+	* That decision is deliberately NOT written to `protocolCache`, which is
+	* keyed by API key alone: remembering it would pin the whole ACCOUNT to the
+	* CLI transport and drag every other model off it until the entry expired.
 	*/
 	resolveProtocol(apiKey, model) {
 		const forced = this.deps.options().protocol;
@@ -4515,18 +4556,14 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	* the default resolves the currently active account.
 	*
 	* Two failure modes are NOT "the network is down", and the report must say
-	* so rather than let {@link classifyTotalFailure} blame the connection:
-	*
-	*  - A key that no HTTP header can carry (a stray newline from a paste, a
-	*    full-width character) makes `fetch` throw a `TypeError` **before any
-	*    I/O**, for every endpoint at once. The chat path refuses such a key
-	*    through `assertUsableApiKey`; this path must too, and it answers
-	*    `blocked: 'invalid-key'` instead of four phantom transport failures.
-	*  - The four endpoints get the SAME per-request budget as a chat call
-	*    (`connection.requestTimeoutMs`, default 60 s), not the catalog's 10 s
-	*    probe budget: on a slow link a 10 s cap made every account query time
-	*    out while chat kept working, which is exactly a "check your network"
-	*    banner that never clears.
+	* so rather than let {@link classifyTotalFailure} blame the connection: a
+	* key that no HTTP header can carry (a stray newline from a paste, a
+	* full-width character) makes `fetch` throw a `TypeError` before any I/O,
+	* for every endpoint at once, so this path runs `assertUsableApiKey` too and
+	* answers `blocked: 'invalid-key'`; and the four endpoints get the SAME
+	* per-request budget as a chat call (`connection.requestTimeoutMs`, default
+	* 60 s), not the catalog's 10 s probe budget, because on a slow link a 10 s
+	* cap made every account query time out while chat kept working.
 	*/
 	async getUsage(apiKey) {
 		const connection = this.deps.options();
@@ -4604,17 +4641,16 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	* the same time (the two are metered separately), and reading only the
 	* shorter one revived such an account as "usable" — the pool then handed it
 	* out, the provider rejected the request again, and the next all-marked pass
-	* revived it once more, so a used-up account kept coming back (issue #51's
-	* follow-up: "切到一个不可用账号"). `exceeded` is therefore true when ANY
-	* published window is exceeded, and `resetAt` is the LATEST reset among the
-	* exceeded ones — the binding constraint, because a clear five-hour window
-	* buys nothing while the weekly quota is spent.
+	* revived it once more (issue #51's follow-up: "切到一个不可用账号").
+	* `exceeded` is therefore true when ANY published window is exceeded, and
+	* `resetAt` is the LATEST reset among the exceeded ones — the binding
+	* constraint, because a clear five-hour window buys nothing while the weekly
+	* quota is spent.
 	*
 	* Returns `undefined` when the probe itself failed (transport, non-200, or a
 	* payload with no window limits at all) — a failed probe never changes pool
-	* state. The monthly/purchased/free credit balances are deliberately NOT part
-	* of this answer: they are balances rather than windows, they carry no reset
-	* time, and the server remains the final gate on them.
+	* state. The credit balances are deliberately NOT part of this answer: they
+	* carry no reset time, and the server remains the final gate on them.
 	*/
 	async probeWindowLimits(apiKey) {
 		try {
@@ -4680,73 +4716,110 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			readImage
 		});
 		let body = await buildBody(protocol);
+		const trace = openStreamTrace(`${options.provider}/${options.model}`);
 		const tried = /* @__PURE__ */ new Set();
+		let attemptNumber = 0;
+		let responseMetadata = {
+			protocol,
+			headers: {}
+		};
 		const connectDeps = {
 			options,
 			connection,
-			fetchImpl: this.fetchImpl
+			fetchImpl: this.fetchImpl,
+			onResponse: (response) => {
+				responseMetadata = {
+					protocol,
+					headers: responseIdentifiers(response.headers)
+				};
+				trace.record("response", {
+					protocol,
+					endpoint: protocol === "cli" ? `${connection.apiBase}/alpha/generate` : `${connection.apiBase}/provider/v1/chat/completions`,
+					status: response.status,
+					attempt: attemptNumber,
+					accountsTried: tried.size,
+					maxTokens,
+					...reasoningEffort === void 0 ? {} : { reasoningEffort },
+					headers: responseMetadata.headers
+				});
+			}
 		};
 		let connected;
-		for (;;) {
-			tried.add(apiKey);
-			const attempt = await connectGenerate(connectDeps, apiKey, protocol, body);
-			if ("response" in attempt) {
-				connected = attempt;
-				break;
-			}
-			if (protocol === "openai" && isUpgradeRequiredError(attempt.status, attempt.errText)) {
-				protocol = "cli";
-				this.rememberProtocol(apiKey, true);
-				body = await buildBody("cli");
-				continue;
-			}
-			if (attempt.status === 413 && REQUEST_IMAGE_BUDGETS.length > 1) {
-				const missing = this.surfaceOffload.requiredImageOffload(requestOptions.messages, coreBudget(REQUEST_IMAGE_BUDGETS[1]), imageVersionBytes);
-				if (missing > 0) throw imageOffloadRequired(missing);
-			}
-			const rotate = this.deps.rotateApiKey;
-			const rejection = classifyAccountRejection(attempt.status, attempt.errText);
-			if (rejection !== void 0 && rotate !== void 0 && options.signal?.aborted !== true && tried.size < MAX_ACCOUNT_ROTATIONS) {
-				const next = await rotate(apiKey, rejection.reason, connection, options.model, {
-					tried: [...tried],
-					...rejection.resetAtMs !== void 0 && { resetAtMs: rejection.resetAtMs }
+		try {
+			for (;;) {
+				tried.add(apiKey);
+				attemptNumber++;
+				responseMetadata = {
+					protocol,
+					headers: {}
+				};
+				if (trace.enabled) trace.record("request", {
+					attempt: attemptNumber,
+					sessionId: options.sessionId,
+					...requestFingerprint(protocol, body)
 				});
-				if (next !== void 0 && !tried.has(next)) {
-					apiKey = next;
+				const attempt = await connectGenerate(connectDeps, apiKey, protocol, body);
+				if ("response" in attempt) {
+					connected = attempt;
+					break;
+				}
+				if (protocol === "openai" && isUpgradeRequiredError(attempt.status, attempt.errText)) {
+					protocol = "cli";
+					this.rememberProtocol(apiKey, true);
+					body = await buildBody("cli");
 					continue;
 				}
+				if (attempt.status === 413 && REQUEST_IMAGE_BUDGETS.length > 1) {
+					const missing = this.surfaceOffload.requiredImageOffload(requestOptions.messages, coreBudget(REQUEST_IMAGE_BUDGETS[1]), imageVersionBytes);
+					if (missing > 0) throw imageOffloadRequired(missing);
+				}
+				const rotate = this.deps.rotateApiKey;
+				const rejection = classifyAccountRejection(attempt.status, attempt.errText);
+				if (rejection !== void 0 && rotate !== void 0 && options.signal?.aborted !== true && tried.size < MAX_ACCOUNT_ROTATIONS) {
+					const next = await rotate(apiKey, rejection.reason, connection, options.model, {
+						tried: [...tried],
+						...rejection.resetAtMs !== void 0 && { resetAtMs: rejection.resetAtMs }
+					});
+					if (next !== void 0 && !tried.has(next)) {
+						apiKey = next;
+						continue;
+					}
+				}
+				if (rejection !== void 0 && (rejection.reason === "rate-limit" || rejection.reason === "throttled") && (rejection.resetAtMs !== void 0 || attempt.status !== 429)) {
+					const reset = rejection.resetAtMs;
+					const wait = reset === void 0 ? 0 : Math.min(Math.max(1e3, reset - Date.now()), RETRY_MAX_DELAY_MS);
+					const when = reset === void 0 ? void 0 : new Date(reset).toISOString();
+					const window = rejection.reason === "rate-limit";
+					throw new LlmError((window ? "llm-commandcode: the Command Code account is rate limited" : "llm-commandcode: the Command Code account is rate limited (429) — the provider did not report an exhausted usage window") + (when === void 0 ? "" : ` — the provider reports it resets at ${when}`) + (window ? "；当前 Command Code 账户已被限流" : "；当前 Command Code 账户被限流（429），服务商未报告用量窗口用尽") + (when === void 0 ? "" : `，服务商给出的重置时间为 ${when}`), "RATE_LIMIT", wait > 0 ? { providerRetryAfterMs: wait } : void 0);
+				}
+				throw generateHttpError(attempt.status, attempt.errText, attempt.retryAfterMs);
 			}
-			if (rejection !== void 0 && (rejection.reason === "rate-limit" || rejection.reason === "throttled") && (rejection.resetAtMs !== void 0 || attempt.status !== 429)) {
-				const reset = rejection.resetAtMs;
-				const wait = reset === void 0 ? 0 : Math.min(Math.max(1e3, reset - Date.now()), RETRY_MAX_DELAY_MS);
-				const when = reset === void 0 ? void 0 : new Date(reset).toISOString();
-				const window = rejection.reason === "rate-limit";
-				throw new LlmError((window ? "llm-commandcode: the Command Code account is rate limited" : "llm-commandcode: the Command Code account is rate limited (429) — the provider did not report an exhausted usage window") + (when === void 0 ? "" : ` — the provider reports it resets at ${when}`) + (window ? "；当前 Command Code 账户已被限流" : "；当前 Command Code 账户被限流（429），服务商未报告用量窗口用尽") + (when === void 0 ? "" : `，服务商给出的重置时间为 ${when}`), "RATE_LIMIT", wait > 0 ? { providerRetryAfterMs: wait } : void 0);
-			}
-			throw generateHttpError(attempt.status, attempt.errText, attempt.retryAfterMs);
+		} catch (error) {
+			trace.record("connect-error", {
+				message: boundTraceText(errorChain(error)),
+				responseMetadata
+			});
+			trace.close();
+			throw options.signal?.aborted ? error : failureWithRequestId(error, responseMetadata);
 		}
 		if (connected === void 0) throw new LlmError("Command Code API connection failed without a response", "TRANSPORT");
 		const { response, cleanup } = connected;
 		if (!response.body) {
 			cleanup();
-			throw new LlmError("Command Code API returned no response body", "PROVIDER_PROTOCOL_ERROR");
+			trace.record("end", {
+				outcome: "empty",
+				code: "PROVIDER_PROTOCOL_ERROR"
+			});
+			trace.close();
+			throw failureWithRequestId(new LlmError("Command Code API returned no response body", "PROVIDER_PROTOCOL_ERROR"), responseMetadata);
 		}
 		const reader = response.body.getReader();
 		const decoder = new TextDecoder();
 		let buffer = "";
-		const trace = openStreamTrace(`${options.provider}/${options.model}`);
 		const streamStartedAt = Date.now();
 		let chunkCount = 0;
 		let totalBytes = 0;
 		let lastChunkAt = streamStartedAt;
-		trace.record("response", {
-			protocol,
-			endpoint: protocol === "cli" ? `${connection.apiBase}/alpha/generate` : `${connection.apiBase}/provider/v1/chat/completions`,
-			status: response.status,
-			attempts: tried.size,
-			maxTokens,
-			...reasoningEffort === void 0 ? {} : { reasoningEffort }
-		});
 		let idleTimer;
 		let idleFired = false;
 		const armIdle = () => {
@@ -4768,6 +4841,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		let usageEmitted = false;
 		let endRecorded = false;
 		function* handle(event) {
+			captureResponseIdentifiers(responseMetadata, event);
 			for (const chunk of handleEvent(asm, protocol, event)) if (chunk.type === "finish") finish = chunk;
 			else if (chunk.type === "usage") usage = chunk.usage;
 			else yield chunk;
@@ -4838,11 +4912,15 @@ var CommandCodeAdapter = class extends LlmAdapter {
 					chunks: chunkCount,
 					bytes: totalBytes,
 					totalMs: Date.now() - streamStartedAt,
-					sawContent: asm.sawContent
+					sawContent: asm.sawContent,
+					responseMetadata
 				});
 				endRecorded = true;
 				if (failure !== void 0) throw failure;
-				yield finish;
+				yield hasResponseIdentifiers(responseMetadata) ? {
+					...finish,
+					replayState: { response: responseMetadata }
+				} : finish;
 			} else {
 				const elapsed = Date.now() - streamStartedAt;
 				const detail = `${chunkCount} chunk(s), ${totalBytes} bytes, ${elapsed}ms`;
@@ -4851,7 +4929,8 @@ var CommandCodeAdapter = class extends LlmAdapter {
 					chunks: chunkCount,
 					bytes: totalBytes,
 					totalMs: elapsed,
-					sawContent: asm.sawContent
+					sawContent: asm.sawContent,
+					responseMetadata
 				});
 				endRecorded = true;
 				if (!asm.sawContent) throw new LlmError("Command Code returned an empty response；Command Code 返回了空响应，重试通常可恢复", "EMPTY_RESPONSE");
@@ -4871,9 +4950,10 @@ var CommandCodeAdapter = class extends LlmAdapter {
 				sawContent: asm.sawContent,
 				chunks: chunkCount,
 				bytes: totalBytes,
-				totalMs: Date.now() - streamStartedAt
+				totalMs: Date.now() - streamStartedAt,
+				responseMetadata
 			});
-			throw error;
+			throw options.signal?.aborted ? error : failureWithRequestId(error, responseMetadata);
 		} finally {
 			clearIdle();
 			cleanup();
@@ -4890,16 +4970,16 @@ var CommandCodeAdapter = class extends LlmAdapter {
 * status alone cannot distinguish them. The status also decides the failure
 * CODE via {@link httpErrorCode}, which is what the retry policy routes on —
 * a transient 5xx must not be reported as a permanent provider rejection. A
-* 429's `Retry-After` header rides along as
-* `providerRetryAfterMs` so dsh-llm-retry can wait exactly that long instead
-* of guessing at the backoff cadence — capped at RETRY_MAX_DELAY_MS, because
-* in normal mode a longer attached wait makes the executor abandon the retry
-* outright instead of falling back to local backoff.
+* 429's `Retry-After` header rides along as `providerRetryAfterMs` so
+* dsh-llm-retry can wait exactly that long instead of guessing at the backoff
+* cadence — capped at RETRY_MAX_DELAY_MS, because in normal mode a longer
+* attached wait makes the executor abandon the retry outright.
 *
 * One body is read, not just its status: a client-side rejection whose
 * `error.code`/`type`/`message` names the model context window is reported as
-* `CONTEXT_WINDOW_EXCEEDED` (see the branch below), because that failure has a
-* recovery the harness performs and a generic provider error does not.
+* `CONTEXT_WINDOW_EXCEEDED`, because that failure has a recovery the harness
+* performs and a generic provider error does not. Every message built here is
+* bilingual — the harness renders it verbatim in its retry chrome.
 */
 function generateHttpError(status, errText, retryAfterMs) {
 	let providerCode;
@@ -4932,16 +5012,11 @@ function generateHttpError(status, errText, retryAfterMs) {
 * status, never the provider's `error.type` — so a status that arrives here as
 * a permanent code is never retried, whatever it says about itself.
 *
-* 5xx is the provider's own "we are temporarily unavailable" class (Cloudflare's
-* 520-527 included; a 520 body says exactly that in words) and the only sane
-* answer to it is the byte-identical resend the retry policy exists to make.
-* Keeping it on `PROVIDER_HTTP_ERROR` — absent from the whitelist by design, so
-* that a 403 plan rejection or a 400 shape error fails fast — made the one
-* failure that asks to be retried the only one that never was, while the same
-* status arriving as an in-band stream `error` event was classified retryable
-* `SERVER` (see the `error` case of {@link handleCliEvent}). 408 is the same
-* story for the request itself. Everything else stays permanent: a 400/403/404/
-* 409/422 rejection repeats identically on every attempt.
+* 5xx is the provider's own "temporarily unavailable" class (Cloudflare's
+* 520-527 included) and the only sane answer to it is the byte-identical
+* resend the retry policy exists to make; 408 is the same story for the
+* request itself. Everything else stays permanent: a 400/403/404/409/422
+* rejection repeats identically on every attempt.
 */
 function httpErrorCode(status) {
 	if (status === 429) return "RATE_LIMIT";
@@ -5206,12 +5281,6 @@ function emptyCompletionError(reason, maxTokens, usage) {
 	return new LlmError(`Command Code finished without producing answer text or a tool call (${detail})；Command Code 返回了空响应（可能只有思考内容），重试通常可恢复`, "EMPTY_RESPONSE");
 }
 /**
-* True when a Provider API pre-stream rejection is Command Code's Go-plan
-* gate (`upgrade_required`). Only this exact class of rejection should fall
-* back to the CLI /alpha/generate transport; other 4xx/5xx must surface as
-* ordinary errors so real account/model problems are not masked.
-*/
-/**
 * Classify a pre-stream rejection that is about the ACCOUNT rather than about
 * the request, using the official CLI's own rules (command-code@1.56.0:
 * `parseWindowLimitError`, `isInsufficientCreditsRequestError`,
@@ -5221,46 +5290,31 @@ function emptyCompletionError(reason, maxTokens, usage) {
 * oversized body or a context overflow must fail fast instead of walking the
 * whole account pool.
 *
-* Issue #51's follow-up is why this exists. Only 429/401 used to rotate, so
-* every other account-scoped rejection was terminal AND invisible to the pool:
-* an account that could not pay, or could not run the model, stayed "usable",
-* was handed out again on the next request, and produced the same error again
-* ("切到一个不可用账号后就报 400，还挺频繁"). The three reasons differ in what
-* the host should do with them, which is the caller's decision, not this
-* function's:
+* It must recognize the whole account-scoped class, not just 429/401: when it
+* did not, an account that could not pay, or could not run the model, stayed
+* "usable" in the pool and was handed out again on the next request (issue
+* #51's follow-up). The four reasons are defined on
+* {@link AccountRotationReason}; what this function owes them is the evidence
+* split:
 *
-*   - `rate-limit`: a usage WINDOW is spent. The code `RATE_LIMITED` is the
-*     authoritative signal — the CLI accepts the code OR a 429 status — and the
-*     body's `error.rateLimit` names the window and its `reset` (in seconds),
-*     so the host can hold the account out until the provider's own reset time.
-*   - `throttled`: the provider refused the request (429 or a bare
-*     `RATE_LIMITED` code) without naming a usage window. It is account-scoped
-*     like the above, so it rotates and marks the key the same way, but it is
-*     NOT evidence that a metered window is spent: the CLI's own
-*     `parseWindowLimitError` returns a window limit only when
-*     `resolveWindowLabel` can name one, and a burst/model/spend limiter the
-*     billing endpoint cannot see is exactly this shape (issue #54's report: a
-*     429 whose probe read five-hour 2% and weekly 10% while the error claimed
-*     both were exhausted).
-*   - `invalid-credential`: 401; the key itself is bad.
-*   - `unavailable`: the key is fine but this account cannot serve: no credits
-*     (`400 Insufficient credits`, the codes `INSUFFICIENT_CREDITS`,
-*     `USAGE_EXCEEDED`, `PREMIUM_CREDITS_EXHAUSTED`, or a spend-cap wording)
-*     or a model outside its plan (`MODEL_NOT_IN_PLAN`). Rotating must NOT mark
-*     the account: the fact is about the model or the balance, it can change
-*     without the key changing, and a `:free` model can still be served by an
-*     account with an empty balance. These codes are recognized on EVERY
-*     status — a 5xx that proxies the provider's own credits/plan body is
-*     still an account fact, and only the prose scan is confined to 4xx.
+*   - `rate-limit` / `throttled`: the code `RATE_LIMITED` is the authoritative
+*     signal — the CLI accepts the code OR a 429 status — and only a body that
+*     NAMES a window (`error.rateLimit.window`, see {@link readWindowLimitEvidence})
+*     may be called a spent one. A bare 429 is a burst/model/spend limiter the
+*     billing endpoint cannot see, so it stays `throttled` and the host claims
+*     no window (issue #54).
+*   - `unavailable`: no credits, or a model outside this account's plan, so it
+*     rotates but must NOT mark the key — the fact is about the model or the
+*     balance, and either can change without the key changing.
 */
 /**
 * The provider's structured "this account cannot serve this request" codes.
 *
 * Status-independent on purpose, mirroring the CLI's classifier, which reads
-* the code before any status guard. A 5xx that carries one of these must not
-* be retried as a transient provider failure: the same request against the
-* same account cannot succeed, so the caller rotates past it (without marking
-* the key) instead of replaying it on the harness's retry cadence.
+* the code before any status guard: a 5xx carrying one of these must rotate
+* past the account instead of being retried as a transient provider failure,
+* because the same request against the same account cannot succeed. Only the
+* prose scan below is confined to 4xx.
 */
 const ACCOUNT_UNAVAILABLE_CODES = /* @__PURE__ */ new Set([
 	"USAGE_EXCEEDED",
@@ -5310,12 +5364,12 @@ const MAX_TRUSTED_RESET_MS = 2592e6;
 * `parseWindowLimitError` → `resolveWindowLabel`/`extractResetAtMs` pair.
 *
 * `window` is present only when the body actually names one: a
-* `error.rateLimit.window` of `fiveHour`/`weekly`/`daily`, or the
-* "usage limit for your plan" wording (read as `weekly` when it says so, else
-* `fiveHour`). That is the CLI's own bar for calling a rejection a WINDOW
-* limit, and it is what keeps a bare 429 — a burst limiter, a model-level
-* limit, a spend cap `windowLimits` cannot show — from being reported as an
-* exhausted window (issue #54).
+* `error.rateLimit.window` of `fiveHour`/`weekly`/`daily`, or the "usage limit
+* for your plan" wording (read as `weekly` when it says so, else `fiveHour`).
+* That is the CLI's own bar for calling a rejection a WINDOW limit, and it is
+* what keeps a bare 429 — a burst limiter, a model-level limit, a spend cap
+* `windowLimits` cannot show — from being reported as an exhausted window
+* (issue #54).
 *
 * `resetAtMs` is the reset the body publishes: `error.rateLimit.reset` is
 * SECONDS (`1e3 * reset`, like the CLI), and a `resets at <ISO>` stamp in the
@@ -5346,6 +5400,13 @@ function readWindowLimitEvidence(errText) {
 		...resetAtMs === void 0 ? {} : { resetAtMs }
 	};
 }
+/**
+* True when a pre-stream rejection is Command Code's Go-plan gate
+* (`upgrade_required`) — the only plan without Provider API access. Only this
+* class of rejection should fall back to the CLI `/alpha/generate` transport;
+* other 4xx/5xx must surface as ordinary errors so real account/model
+* problems are not masked.
+*/
 function isUpgradeRequiredError(status, errText) {
 	if (status !== 403) return false;
 	const lower = errText.toLowerCase();
@@ -5361,7 +5422,9 @@ function isUpgradeRequiredError(status, errText) {
 			const message = stringValue(error.message) ?? "";
 			if (message.toLowerCase().includes("go plan") && message.toLowerCase().includes("api access")) return true;
 		}
-	} catch {}
+	} catch {
+		return false;
+	}
 	return false;
 }
 /** Map an OpenAI Chat Completions usage payload to harness disjoint counts. */
@@ -5414,7 +5477,6 @@ const commandcodeCommand = {
 		weeklyLine: "  📅 每周    {used} / {cap}{warn}",
 		windowBarLine: "     └ {bar}  重置 {when}",
 		exceededWarning: "  ⚠️ 超限!",
-		resetSuffix: "重置 {when}",
 		partialFailures: "⚠️  部分端点失败: {list}",
 		noData: "（无数据 — 请检查 API 密钥）",
 		errorText: "获取 Command Code 用量失败：{message}"
@@ -5446,25 +5508,19 @@ const commandcodeCommand = {
 		weeklyLine: "  📅 Weekly   {used} / {cap}{warn}",
 		windowBarLine: "     └ {bar}  resets {when}",
 		exceededWarning: "  ⚠️ exceeded!",
-		resetSuffix: "resets {when}",
 		partialFailures: "⚠️  some endpoints failed: {list}",
 		noData: "(no data — check your API key)",
 		errorText: "Could not fetch Command Code usage: {message}"
 	}
 };
 /**
-* Resolve the active locale for a Host-side command run.
-*
-* Priority: explicit `override` (from `Config.lang`) → `LC_ALL` → `LANG` →
-* the conventional fallback (`'zh'`, matching the existing single-language
-* behavior so unconfigured deployments keep their current output).
+* Resolve the active locale for a Host-side command run: explicit `override`
+* (from `Config.lang`) → `LC_ALL` → `LANG` → the `'zh'` fallback that keeps
+* unconfigured deployments on their current output.
 *
-* The values are matched on the leading tag only — `zh_CN.UTF-8`,
-* `zh-Hans`, `zh` all map to `'zh'`; everything starting with `en` maps to
-* `'en'`; anything else falls back to `'zh'` (a non-`en` shell that
-* already has Chinese in the terminal is the closest sensible default;
-* a Western shell that happens to be neither keeps the existing Chinese
-* output rather than swapping to half-translated English).
+* Matched on the leading tag only — `zh_CN.UTF-8`, `zh-Hans` and `zh` all
+* map to `'zh'`, anything starting with `en` maps to `'en'`, everything else
+* falls back to `'zh'` rather than to half-translated English.
 */
 function pickCommandLocale(override, env = process.env) {
 	if (override === "zh" || override === "en") return override;
@@ -5477,11 +5533,10 @@ function commandCopy(locale, key) {
 }
 //#endregion
 //#region src/commands.ts
-/** Format a dollar amount. */
 function money(value) {
 	return `$${value.toFixed(4)}`;
 }
-/** Format a dollar amount compactly (2 decimals). */
+/** Compact dollar amount (2 decimals), for the summary and window rows. */
 function moneyShort(value) {
 	return `$${value.toFixed(2)}`;
 }
@@ -5493,14 +5548,14 @@ function tokensCompact(value) {
 	return String(value);
 }
 /**
-* Format a success-rate percentage (already in percent units): at most two
-* decimals, trailing zeros trimmed — mirrors `formatSuccessRate` in
+* Success-rate percentage (already in percent units): at most two decimals,
+* trailing zeros trimmed — mirrors `formatSuccessRate` in
 * `./client/usage.ts`, which the settings card uses.
 */
 function successRateText(value) {
 	return String(Number(value.toFixed(2)));
 }
-/** Format a millis timestamp as a local date; `n/a` when unset. */
+/** A local date, or `n/a` when the provider published no reset time. */
 function resetLabel(ms) {
 	if (ms <= 0) return "n/a";
 	return new Date(ms).toLocaleString();
@@ -5604,16 +5659,16 @@ const REMOTE_SERVICE = "commandcodeUsage";
 /** The wire namespace all Command Code endpoints share. */
 const REMOTE_NAMESPACE = "commandcode";
 /**
-* Build the validator helpers one endpoint uses. `prefix` names the
-* endpoint in the rejection message (e.g. `commandcode/report result:`), so
-* each wire file keeps its own diagnostic phrasing while sharing the helper
-* bodies.
+* Build the validator helpers one endpoint uses. `prefix` names the endpoint
+* in the rejection message (e.g. `commandcode/report result:`), so each wire
+* file keeps its own diagnostic phrasing while sharing the helper bodies.
 *
 * The helpers return the reject call directly in the failure branch: since
 * `reject` is typed `never`, the ternary's union collapses to the success type
 * without relying on TypeScript's control-flow analysis of a never-returning
 * call (which only recognizes function declarations, not the destructured
-* arrow `reject` callers receive from this factory).
+* arrow `reject` callers receive from this factory). Callers that need the
+* narrowing in an `if` must therefore assign inside the positive branch.
 */
 function makeBoundaryValidator(prefix) {
 	const reject = (field) => {
@@ -5641,10 +5696,8 @@ function makeStrictCodec(typeSymbol, schema) {
 }
 /**
 * Build one strict invocation descriptor. Every Command Code Remote shares the
-* `commandcode` namespace, the `commandcodeUsage` service, and a strict
-* `mode: 'strict'` result — only the endpoint, method, result type symbol, and
-* schema differ — so the boilerplate lives here once and each endpoint supplies
-* only its own facts.
+* `commandcode` namespace, the `commandcodeUsage` service, and a strict result
+* — only the endpoint, method, result type symbol, and schema differ.
 */
 function makeRemoteDescriptor(endpoint, method, typeSymbol, schema) {
 	return {
@@ -5668,7 +5721,6 @@ const USAGE_REPORT_ENDPOINT = "commandcode/report";
 * so rejection messages name the offending boundary.
 */
 const { reject: reject$1, record: record$1, stringField: stringField$1, numberField, booleanField } = makeBoundaryValidator("commandcode/report result:");
-/** Validate one window-limit block (`fiveHour` / `weekly`). */
 /**
 * Parse one quota window, or undefined when the frame carries no such window.
 *
@@ -5969,12 +6021,10 @@ var CommandCodeUsageService = class extends TypertRemoteService {
 		this.deps = deps;
 	}
 	/**
-	* Account, usage, and credit state for the settings page's account card —
-	* one entry per pool account when the plugin entry wired `reports`, a
-	* single default-account entry otherwise. Degrades per endpoint like the
-	* `/commandcode` command (failures land in `report.failures`); throws
-	* `MISSING_CREDENTIAL` when no key resolves, which the Gateway folds into
-	* the failure branch the page renders as a hint.
+	* Account, usage, and credit state for the settings page's account card.
+	* Degrades per endpoint like the `/commandcode` command (failures land in
+	* `report.failures`); throws `MISSING_CREDENTIAL` when no key resolves, which
+	* the Gateway folds into the failure branch the page renders as a hint.
 	*/
 	async report() {
 		if (this.deps.reports !== void 0) return this.deps.reports();
@@ -5989,20 +6039,19 @@ var CommandCodeUsageService = class extends TypertRemoteService {
 		}] };
 	}
 	/**
-	* The full model catalog for the settings page's model editors (the
-	* routing-rule editor and the visible-models filter). The browser never
-	* calls the Command Code API directly — the Host serves the catalog
-	* (already fetched/cached by the adapter) so models can be picked from
-	* the live list instead of typed by hand.
+	* The full model catalog for the settings page's model editors. The browser
+	* never calls the Command Code API directly — the Host serves the catalog
+	* (already fetched/cached by the adapter) so models can be picked from the
+	* live list instead of typed by hand.
 	*/
 	async models() {
 		return this.deps.listModels?.() ?? { models: [] };
 	}
 	/**
 	* The model price table the composer prices an in-progress session with.
-	* Static vendored data (the official pricing page's rates), served Host-side
-	* so the browser bundle never carries a copy that could drift from the
-	* snapshot, and so a price update reaches an open page without a rebuild.
+	* Static vendored data, served Host-side so the browser bundle never carries
+	* a copy that could drift from the snapshot, and so a price update reaches an
+	* open page without a rebuild.
 	*/
 	async prices() {
 		return (this.deps.prices ?? modelPriceTable)();
@@ -6010,8 +6059,7 @@ var CommandCodeUsageService = class extends TypertRemoteService {
 	/**
 	* Start (or rejoin) a browser-login attempt and return its fresh status —
 	* `waiting` carrying the Studio URL. Rejects when the flow cannot start
-	* (no free loopback port, disposed plugin); the Gateway folds the throw
-	* into the failure branch the page renders.
+	* (no free loopback port, disposed plugin).
 	*/
 	async loginBegin(targetRef) {
 		return this.requireLogin().begin(targetRef);
@@ -6054,11 +6102,8 @@ function applyUsageRemote(ctx, deps) {
 //#endregion
 //#region src/login.ts
 /**
-* Host half of the Command Code browser login (the loopback flow).
-*
-* Mirrors what the official `command-code login` CLI command performs
-* (reverse-engineered from `command-code@1.32.1`, `createAuthFlowController`
-* + `createAuthServer` in its bundle):
+* Host half of the Command Code browser login (the loopback flow), mirroring
+* what the official `command-code login` CLI command performs.
 *
 * 1. Bind a temporary HTTP server on `127.0.0.1`, first available port from
 *    5959 upward (10 attempts).
@@ -6070,12 +6115,12 @@ function applyUsageRemote(ctx, deps) {
 * 4. The delivered key is validated against `GET {apiBase}/alpha/whoami`
 *    before anything is stored.
 *
-* Server behaviour is mirrored exactly: POST-only `/callback`, a 10 KB body
-* cap, JSON responses (`{success:true}` / `{success:false,error}`), CORS for
-* the Studio origins only, and state-token equality as the anti-forgery
-* check. One deliberate hardening over the CLI build: the CORS origin is
-* echoed only when it is allowlisted (the CLI falls back to the first
-* origin), which browsers treat identically.
+* The server contract is CLI-mirrored: POST-only `/callback`, a 10 KB body
+* cap, JSON responses (`{success:true}` / `{success:false,error}`), and
+* state-token equality as the anti-forgery check. Three deliberate hardenings
+* over the CLI build: the CORS origin is echoed only when allowlisted (the
+* CLI falls back to the first origin), `Connection: close`, and the denial
+* branch checks the state token before it ends the attempt.
 *
 * Storage stays out of this module: the plugin entry supplies
 * {@link CommandCodeLoginFlowDeps.storeKey}, which writes through the dsh
@@ -6185,16 +6230,15 @@ var CommandCodeLoginFlow = class {
 	* asynchronously (`complete()`), and that window is open to a cancel or a
 	* fresh `begin()`; the generation lets a late completion recognize that it
 	* no longer owns the status face and stop instead of storing a credential
-	* the user cancelled and flipping the page back to success.
+	* the user cancelled.
 	*/
 	attemptSeq = 0;
 	/**
-	* The start currently binding a port, if any. Every `begin()` that arrives
-	* before it settles joins it: two independent starts would each bind their
-	* own loopback server, and only the LAST one is reachable by
-	* {@link CommandCodeLoginFlow.teardown} — the orphan keeps listening and
-	* answering `/callback` for the process's lifetime, and ten of them exhaust
-	* the port window so browser login dies until the Host restarts.
+	* The start currently binding a port, if any. Every `begin()` arriving before
+	* it settles joins it: two independent starts would each bind a loopback
+	* server, and only the LAST one is reachable by `teardown()` — the orphan
+	* keeps answering `/callback` for the process's lifetime, and ten of them
+	* exhaust the port window so browser login dies until the Host restarts.
 	*/
 	starting;
 	/** A live attempt's destination; different rows may not rejoin it. */
@@ -6548,20 +6592,15 @@ function corsOrigin(origin) {
 //#endregion
 //#region src/web-search.ts
 /**
-* dsh-commandcode-provider — Command Code web search provider over `ctx.web`.
+* Command Code web-search provider over `ctx.web`.
 *
-* The official Command Code CLI ships a built-in `web_search` tool that POSTs
+* The official CLI's built-in `web_search` tool POSTs
 * `{ query, numResults, allowedDomains?, blockedDomains? }` to
 * `{apiBase}/alpha/web-search` and reads `{ results: [{ title, url, snippet }] }`
-* back. It authenticates with the SAME `Authorization: Bearer <key>` header and
-* `x-command-code-version` the model adapter uses, so this provider reuses the
-* plugin's existing credential chain (`COMMANDCODE_API_KEY` → credentials seam →
-* `~/.commandcode/auth.json`) — no separate DeepSeek key, no extra endpoint.
-*
-* This mirrors the host-side `@deepseek-ai/dsh-web-search-deepseek` provider in
-* shape: a cordis-free class registered into the web seam, resolving its key per
-* search, mapping each server-side result to the harness's normalized
-* `WebSearchSource`. The web seam owns `maxResults` truncation.
+* back, authenticating with the SAME `Authorization: Bearer <key>` and
+* `x-command-code-version` headers the model adapter uses. This provider
+* therefore reuses the plugin's existing credential chain and `apiBase`, so
+* the model-facing `web_search` tool needs no separate configuration.
 *
 * @module dsh-commandcode-provider/web-search
 */
@@ -6569,12 +6608,9 @@ function corsOrigin(origin) {
 const COMMANDCODE_SEARCH_PROVIDER_ID = "commandcode";
 /**
 * The factory-declared search provider id dsh ships by default (from
-* `dsh-base`'s cordis patch `web.config.searchProvider`). Kept as a
-* documented reference only: disabling this plugin's `webSearch` toggle
-* restores the previously selected backend (see
-* {@link applyCommandCodeSearchSelection}) — it never forces this default,
-* because forcing it is what used to silence sibling search plugins such as
-* modsearch even with Command Code search turned off (issue #26).
+* `dsh-base`'s cordis patch `web.config.searchProvider`). A documented
+* reference only: disabling this plugin's `webSearch` toggle restores the
+* PREVIOUSLY selected backend, never this default (issue #26).
 */
 const DEFAULT_WEB_SEARCH_PROVIDER_ID = "deepseek-official";
 /** Fresh selection state: the plugin starts out not owning the selection. */
@@ -6590,24 +6626,15 @@ function commandCodeSearchSelection() {
 * providers (issue #26).
 *
 * - Enabling writes `commandcode` and remembers whatever it displaced. When
-*   the plugin already owns the selection (e.g. a settings save while still
-*   on), the original `displaced` value is kept — the field currently holds
-*   our own id, which must never be mistaken for the user's backend.
-* - Disabling hands the selection back to the remembered backend. When the
-*   state holds no memory (a fresh boot straight into `webSearch: false`),
-*   the field is left alone: the runtime's current value — a sibling's
-*   cordis pin such as `searchProvider: modsearch`, or unset for
-*   auto-select — already says what the user wants.
-* - When the field already reads `commandcode` at first touch (e.g. a
-*   surviving runtime the plugin did not set, or a manual
-*   `searchProvider: commandcode` pin), `displaced` stays undefined and
-*   `preexisting` is set, so the later disable is a no-op rather than a guess
-*   at the factory default. A "no-op" means the field is left ALONE: writing
-*   that `undefined` back would destroy the user's own pin, and dsh-web reads
-*   a cleared `searchProviderId` as auto-select — where a second usable
-*   provider (the shipped `deepseek-official` is usable whenever a DeepSeek
-*   key resolves) makes EVERY later search throw
-*   `WEB_PROVIDER_AMBIGUOUS`.
+*   the plugin already owns the selection, the original `displaced` is kept —
+*   the field currently holds our own id, which must never be mistaken for the
+*   user's backend.
+* - Disabling hands the selection back to the remembered backend only when
+*   this plugin actually took it over. A fresh boot straight into
+*   `webSearch: false`, or a `preexisting` field, leaves it ALONE: writing the
+*   empty memory back would clear the user's own `searchProvider: commandcode`
+*   pin and hand the selection to dsh-web's auto-select, where a second usable
+*   provider makes every later search throw `WEB_PROVIDER_AMBIGUOUS`.
 *
 * Never throws: like the low-level rewrite, a hardened runtime shape degrades
 * to registered-but-unselected.
@@ -6661,7 +6688,7 @@ function toSource(result) {
 		...snippet !== void 0 && snippet.length > 0 ? { snippet } : {}
 	};
 }
-function isAbortError$1(error) {
+function isAbortError(error) {
 	return error instanceof DOMException && error.name === "AbortError";
 }
 /** Build the provider's stable cancellation error while retaining the caller's reason. */
@@ -6672,11 +6699,11 @@ function throwIfAborted(signal) {
 	if (signal?.aborted === true) throw searchAborted(signal, void 0);
 }
 /**
-* A `ctx.web` search provider backed by the Command Code Provider API. Reuses
-* the plugin's credential chain and `apiBase`, so search "just works" with the
-* existing key — the model-facing `web_search` tool needs no separate
-* configuration. Selection between multiple search providers is the web seam's
-* job (pin `searchProvider: commandcode` if ambiguous).
+* A `ctx.web` search provider backed by the Command Code Provider API, reusing
+* the plugin's credential chain and `apiBase` so the model-facing `web_search`
+* tool needs no separate configuration. Selection between multiple search
+* providers is the web seam's job (pin `searchProvider: commandcode` if
+* ambiguous).
 */
 var CommandCodeSearchProvider = class {
 	deps;
@@ -6716,7 +6743,7 @@ var CommandCodeSearchProvider = class {
 				...signal !== void 0 ? { signal } : {}
 			});
 		} catch (error) {
-			if (signal?.aborted === true || isAbortError$1(error)) throw searchAborted(signal, error);
+			if (signal?.aborted === true || isAbortError(error)) throw searchAborted(signal, error);
 			throw new WebError(`Command Code web search request failed: ${error instanceof Error ? error.message : String(error)}`, "WEB_PROVIDER_ERROR", { cause: error });
 		}
 		if (!response.ok) {
@@ -6731,7 +6758,7 @@ var CommandCodeSearchProvider = class {
 					if (typeof code === "string" || typeof inner === "string") message += `: ${typeof code === "string" ? code : ""}${typeof code === "string" && typeof inner === "string" ? " — " : ""}${typeof inner === "string" ? inner : ""}`;
 				}
 			} catch (error) {
-				if (signal?.aborted === true || isAbortError$1(error)) throw searchAborted(signal, error);
+				if (signal?.aborted === true || isAbortError(error)) throw searchAborted(signal, error);
 				const slice = (await response.text().catch(() => "")).trim().slice(0, 200);
 				if (slice !== "") message += `: ${slice}`;
 			}
@@ -6741,7 +6768,7 @@ var CommandCodeSearchProvider = class {
 		try {
 			payload = await response.json();
 		} catch (error) {
-			if (signal?.aborted === true || isAbortError$1(error)) throw searchAborted(signal, error);
+			if (signal?.aborted === true || isAbortError(error)) throw searchAborted(signal, error);
 			throw new WebError("Command Code web search returned an unparseable response body", "WEB_PROVIDER_ERROR", { cause: error });
 		}
 		const results = payload?.results;
@@ -6765,7 +6792,7 @@ var CommandCodeSearchProvider = class {
 		try {
 			key = await this.deps.resolveKey();
 		} catch (error) {
-			if (signal?.aborted === true || isAbortError$1(error)) throw searchAborted(signal, error);
+			if (signal?.aborted === true || isAbortError(error)) throw searchAborted(signal, error);
 			if (error instanceof Error && typeof error.code === "string") {
 				const code = error.code;
 				if (code === "MISSING_CREDENTIAL") throw new WebError(error.message, "WEB_PROVIDER_CREDENTIAL_MISSING", { cause: error });
@@ -6806,11 +6833,10 @@ const OTHER_GROUP_ID = "models-other";
 * free before paid inside a tier, then by id.
 *
 * The list is the static capability snapshot rather than a live catalog read
-* on purpose — a settings page must draw synchronously, and the snapshot is
-* synced from the same upstream table the picker's tier headings come from.
-* A model added upstream after this build still reaches the user: an empty
-* allowlist shows everything, and a model named in the allowlist but absent
-* here is rendered by the "Other" group instead of disappearing.
+* on purpose — a settings page must draw synchronously. A model added
+* upstream after this build still reaches the user: an empty allowlist shows
+* everything, and a model named in the allowlist but absent here is rendered
+* by the "Other" group instead of disappearing.
 */
 function commandCodeTuiModelChoices() {
 	return Object.keys(KNOWN_PLANS).map((id) => ({
@@ -6838,14 +6864,13 @@ function storedIds(value) {
 * Build the section descriptor. Pure, so tests can pin the exact fields
 * without a dsh-TUI host.
 *
-* Field choices worth keeping: the two option-bearing fields (`activeAccount`,
-* `lang`) are `text` + `options` rather than `select`, because a `select`
-* cannot express "unset" — cycling only ever lands on a declared option, so a
-* `select` would strand the user on a pinned value with no way back to
-* automatic. The `auto` sentinel plus a `parse` that clears the path keeps the
-* unset state reachable. `filterModelsByPlan` formats its EFFECTIVE default
-* (unset means true at the adapter), so a fresh install reads true instead of
-* the screen's "(empty)".
+* The two option-bearing fields (`activeAccount`, `lang`) are `text` +
+* `options` rather than `select`, because a `select` cannot express "unset" —
+* cycling only ever lands on a declared option, so it would strand the user on
+* a pinned value with no way back to automatic. The `auto` sentinel plus a
+* `parse` that clears the path keeps unset reachable. `filterModelsByPlan`
+* formats its EFFECTIVE default (unset means true at the adapter) so a fresh
+* install reads true instead of the screen's "(empty)".
 */
 function buildCommandCodeTuiSection(deps) {
 	const ref = deps.apiKeyRef();
@@ -6875,12 +6900,9 @@ function buildCommandCodeTuiSection(deps) {
 	* ONE draft: every one of them then parses that same draft on save, all N
 	* write ops address the same path, and only the LAST field's op survives —
 	* which silently rewrote the allowlist from the last catalog model instead
-	* of the one that was toggled. A per-model key is what makes a checkbox
-	* express one model's state.
-	*
-	* An override equal to what the array already says is written as a CLEAR, so
-	* toggling a model back to its inherited state leaves no residue and the
-	* document stays minimal.
+	* of the one that was toggled. An override equal to what the array already
+	* says is written as a CLEAR, so toggling a model back to its inherited
+	* state leaves no residue.
 	*/
 	const modelField = (id, hint, group) => ({
 		path: ["modelVisibility", id],
@@ -6953,54 +6975,6 @@ function buildCommandCodeTuiSection(deps) {
 					};
 				}
 			},
-			{
-				path: ["commandGuard"],
-				group: "advanced",
-				kind: "boolean",
-				label: "AI command guard",
-				descriptions: { zh: "AI 命令安全预判" },
-				hint: "typesafe/jev judges whether a shell command is safe; sandbox escalations also need separate scope and necessity verdicts. All must be confident enough; everything else asks as usual. Off by default.",
-				hintDescriptions: { zh: "由 typesafe/jev 判断 shell 命令是否安全；沙箱提权还要分别判断范围与必要性，三项都足够确定才自动放行，其余照常弹窗。默认关闭。" },
-				format: (value) => value === true ? "true" : "false",
-				parse: (text) => ({
-					kind: "set",
-					value: text.trim() === "true"
-				})
-			},
-			{
-				path: ["commandGuardLevel"],
-				group: "advanced",
-				kind: "select",
-				label: "Auto-approve threshold",
-				descriptions: { zh: "自动放行阈值" },
-				hint: "How confident typesafe/jev must be before a command runs without asking. Default: medium.",
-				hintDescriptions: { zh: "typesafe/jev 需要多确定才免弹窗放行；默认「中」。" },
-				options: [
-					{
-						value: "high",
-						label: "High (0.95, approves least)",
-						descriptions: { zh: "高（0.95，放行最少）" }
-					},
-					{
-						value: "medium",
-						label: "Medium (0.9)",
-						descriptions: { zh: "中（0.9）" }
-					},
-					{
-						value: "low",
-						label: "Low (0.8, approves most)",
-						descriptions: { zh: "低（0.8，放行最多）" }
-					}
-				],
-				format: (value) => value === "high" || value === "low" ? value : "medium",
-				parse: (text) => {
-					const trimmed = text.trim();
-					return trimmed === "high" || trimmed === "medium" || trimmed === "low" ? {
-						kind: "set",
-						value: trimmed
-					} : void 0;
-				}
-			},
 			{
 				path: ["zdr"],
 				group: "advanced",
@@ -7135,12 +7109,10 @@ function sectionSignature(section) {
 /**
 * Register the Command Code section on a dsh-TUI host.
 *
-* @param ctx - the context of an activated `tuiSettingsSections` injection.
-* @param deps - plugin-owned facts the section reads.
 * @returns a refresh function that re-registers the section when a fact it
-*   renders changed (the plugin entry calls it from its settings `onChange`
-*   hook), or `undefined` when the seam is unusable. The returned function is
-*   inert after the fiber is torn down.
+*   renders changed — the plugin entry calls it from its
+*   `loader/volatile-update` listener — or `undefined` when the seam is
+*   unusable. The returned function is inert after the fiber is torn down.
 */
 function applyCommandCodeTuiSettings(ctx, deps) {
 	const service = tuiSettingsService(ctx);
@@ -7176,45 +7148,26 @@ function applyCommandCodeTuiSettings(ctx, deps) {
 /**
 * A bounded retry budget for `TRANSPORT` failures (issue #39, second report).
 *
-* The route's retry policy (`providerRetryPolicy` in `./adapter.ts`) is
-* deliberately near-unbounded: 1000 attempts with waits doubling to a 15-minute
-* cap. That shape exists for the failures a provider ASKS to have retried — an
-* exhausted 5-hour window, a Cloudflare 520 — where the wait is the point.
-*
-* A transport failure is not that. The reporter's second event at ~710k
-* context was `Connect Timeout Error ... timeout: 10000ms` (undici's own
-* connect timeout; this plugin's `requestTimeoutMs` is 60s) and, on another
-* attempt, `read ECONNRESET` against `/alpha/generate`. Because `TRANSPORT` is
-* in the whitelist, each of those entered the same 1000-attempt loop: with
-* `initialDelayMs: 500` doubling, the wait before attempt 11 alone is 512 s and
-* the cumulative wait before it is ~500 s — the "模型请求重试已取消（11/1000）·
-* 482s" the reporter photographed is that 512 s countdown, 30 s into it — and
-* those waits are counted BEFORE each retry attempt, not after it.
-*
-* A connection that cannot be established is either a sub-second blip (the
-* first few attempts recover it, invisibly) or an outage that no amount of
-* waiting inside one request will fix. So transport failures get their own
-* budget, and when it is exhausted the failure is surfaced with the diagnosis
-* instead of manufacturing a multi-minute stall. Waiting out a real outage is
-* the user's call — the next send starts a fresh budget — and
-* `dsh-llm-retry`'s window for rate limits is untouched.
-*
-* Deliberately NOT counted here: the pre-stream recovery the ADAPTER performs
-* inside one `stream()` call (account rotation on 429/401, the 413 image-budget
-* step-down, the Provider-API → CLI protocol switch). Those are invisible to
-* the caller and bounded on their own; this budget caps only the harness's
-* retry loop.
-*
-* Reset rule: the budget clears at each new STEP — one step is exactly one
-* model request (`step/start` is appended immediately before the call) — so the
-* cap is per logical request and the next step of the same turn gets its own
-* grace. `agent/status` → `idle` is NOT the reset signal even though it looks
-* like the natural one: the agent loop's `setPhase` emits it only on a status
-* CHANGE, and a turn's steps all run inside one `running` phase, so it never
-* fires between them — a budget reset only there would be per-turn, and an
-* outage would fail every later step of that turn immediately instead of
-* retrying each. `assistant/attempt` is wrong for the opposite reason: the loop
-* appends it for the FAILED attempt itself, *before* dispatching
+* The route policy (`providerRetryPolicy` in `./adapter.ts`) is near-unbounded
+* on purpose — 1000 attempts doubling to a 15-minute cap — because it exists
+* for failures the provider ASKS to have retried, where the wait is the point.
+* A connection that cannot be established is not that: either a blip the first
+* few attempts absorb, or an outage no in-request waiting fixes (and its waits
+* count BEFORE each attempt, so attempt 11 alone already waits 512 s). So
+* transport failures get their own budget; waiting out a real outage is the
+* user's call, and the next send starts a fresh budget.
+*
+* Not counted here: the pre-stream recovery the ADAPTER performs inside one
+* `stream()` call (account rotation, the 413 image-budget step-down, the
+* Provider-API → CLI switch) — invisible to the caller and bounded on its own.
+* This budget caps only the harness's retry loop.
+*
+* Reset rule: the budget clears at each new STEP (one step = one model request).
+* `agent/status` → `idle` is NOT it, though it looks natural: the loop's
+* `setPhase` emits it only on a status CHANGE, and a turn's steps all run inside
+* one `running` phase, so a reset there would fail every later step of an outage
+* turn at once instead of retrying each. `assistant/attempt` is wrong the other
+* way — the loop appends it for the FAILED attempt itself, before dispatching
 * `agent/request-error`, so resetting on it would clear the budget on every
 * failure and restore the very loop this module exists to stop.
 *
@@ -7248,15 +7201,13 @@ function resetTransportFailures(agent) {
 /**
 * What one session event means for the transport budget.
 *
-* Exported and pure on purpose: the choice of event is the part of this design
-* that is easy to get plausibly wrong (`agent/status` → `idle` looks like the
-* natural reset and is not one — see the module comment), so it is stated once,
-* here, where a test can pin it, instead of being implied by a listener body.
+* Pure and exported on purpose: the choice of event is the part of this design
+* that is easy to get plausibly wrong (see the module comment), so it is stated
+* once, where a test can pin it.
 *
 * @param type - the appended session event's type.
-* @returns `'reset'` for a new step (one model request), `'forget'` when the
-*   turn ended and the session → agent mapping is no longer needed, otherwise
-*   `'none'`.
+* @returns `'reset'` for a new step, `'forget'` when the turn ended (the
+*   session → agent mapping is no longer needed), otherwise `'none'`.
 */
 function transportResetAction(type) {
 	if (type === "step/start") return "reset";
@@ -7266,880 +7217,44 @@ function transportResetAction(type) {
 /**
 * The diagnosis a capped turn ends with. Bilingual, because the harness renders
 * a failed turn's message verbatim and this plugin's other user-facing failures
-* are bilingual too (see the adapter's error builders). It names the retry
-* budget and the checks that actually help, instead of the bare "fetch failed"
-* chain the retry chrome would otherwise show.
+* are too; it names the retry budget and the checks that actually help instead
+* of the bare "fetch failed" chain the retry chrome would otherwise show.
 */
 function transportBudgetMessage(failureMessage, maxRetries) {
 	return `${failureMessage}；Command Code API 连接在连续重试后仍失败——已停止重试以免整轮卡死。插件已自动重试 ${maxRetries} 次。通常说明当前网络到 api.commandcode.ai 的连接不通，常见原因是代理未生效：DSH 只读取环境变量 HTTPS_PROXY/HTTP_PROXY（系统代理/PAC 不会被读取），请确认启动 DSH 的终端里已导出代理，或先关闭代理直连后重试。网络恢复后直接重发即可 — Command Code API transport still failed after ${maxRetries} automatic retries, which were stopped so the turn could not stall for minutes. This is a connectivity problem between this machine and api.commandcode.ai, not a context-window or request-size rejection. Common cause: the proxy is not reaching the harness — DSH reads HTTPS_PROXY/HTTP_PROXY from the environment only (a Windows system proxy/PAC setting is not consulted), so export it in the launching shell, or turn the proxy off and retry. Resend when the network recovers; the budget is per request and has been reset`;
 }
 //#endregion
-//#region src/systemone.ts
-/**
-* Host-side client for Command Code's System One decision endpoint
-* (`POST {apiBase}/provider/v1/systemone`).
-*
-* `typesafe/jev` is **not a chat model**: it takes a `state` plus typed
-* questions and answers with probabilities, never text, and it never streams.
-* It is therefore absent from `/provider/v1/models` (so the picker can never
-* offer it) and must never be registered as a model route — this plugin uses it
-* as an internal advisor instead: the command guard in `./command-guard.ts`
-* asks it whether a shell command is safe to auto-approve.
-*
-* The three question types are the whole vocabulary (command-code@1.65.2
-* `systemOneRequestSchema`, unchanged since 1.64.0):
-*
-* - `noul` — "is this true?", optional `criteria: { true, false }` describing
-*   each verdict. Answers with `noul`, the probability of *yes*.
-* - `choice` — "which one?", `criteria` maps each option key to its
-*   description. Answers with `choice`, plus optional `confidence` and
-*   `probabilities`.
-* - `score` — "where on this rubric?", `criteria` is an array of at least two
-*   levels, lowest first. Answers with `score`, `legend` and `probabilities`.
-*
-* A request carries at most 20 questions and every answer is keyed by the
-* question id it belongs to. `usage` is reported per request, in tokens.
-*
-* Billing: free through 2026-09-24T23:59:59Z, then $0.042 per 1M input tokens
-* with output free. The model has **no ZDR-capable upstream**, so a request
-* carrying `x-cmd-zdr: 1` is refused with HTTP 422 `cmd_zdr_no_providers` —
-* this client never sends that header, and it must stay that way even though
-* the plugin now ships a ZDR switch for chat (`Config.zdr` → the `x-cmd-zdr: 1`
-* header per model, gated on `KNOWN_NON_ZDR_MODELS`): the decision endpoint is
-* reached through THIS module's own request path, never through the adapter's
-* chat connection, so the two cannot drift — and a deployment that later widens
-* ZDR must exclude this endpoint rather than route it through the switch.
-*
-* Auth is the plugin's ordinary chain (the multi-account pool, the credentials
-* seam, the CLI auth file) through the same `Authorization: Bearer <key>` and
-* `x-command-code-version` headers every other endpoint uses.
-*
-* @module dsh-commandcode-provider/systemone
-*/
-/** Path of the decision endpoint, relative to `apiBase`. */
-const SYSTEMONE_ROUTE = "/provider/v1/systemone";
-/** The one error type this client throws. Callers fail closed on it. */
-var SystemOneError = class extends Error {
-	kind;
-	status;
-	constructor(message, kind, status, options) {
-		super(message, options);
-		this.kind = kind;
-		this.status = status;
-		this.name = "SystemOneError";
-	}
-};
-/**
-* Combine the caller's signal with a timeout, keeping the two distinguishable:
-* a timeout is this client's own budget expiring (the guard delegates to the
-* user) while a caller abort means the approval was already withdrawn (answer
-* nothing) — both fail closed, but the diagnosis must not lie about which.
-*
-* The timer is a plain `setTimeout` rather than `AbortSignal.timeout()`, whose
-* timer Node unrefs: with nothing else pending (a test double, a socket that
-* never opened) an unref'd timer lets the process exit while the promise is
-* still pending, which reads as a hang rather than as the timeout it is.
-*/
-function deadlineOf(signal, timeoutMs) {
-	const controller = new AbortController();
-	let timedOut = false;
-	const timer = setTimeout(() => {
-		timedOut = true;
-		controller.abort();
-	}, timeoutMs);
-	const onCallerAbort = () => controller.abort();
-	if (signal !== void 0) {
-		if (signal.aborted) controller.abort();
-		else signal.addEventListener("abort", onCallerAbort, { once: true });
-	}
-	return {
-		signal: controller.signal,
-		callerAborted: () => signal?.aborted === true,
-		timedOut: () => timedOut,
-		dispose: () => {
-			clearTimeout(timer);
-			signal?.removeEventListener("abort", onCallerAbort);
-		}
-	};
-}
-/** Whether a caught value is an abort-shaped failure. */
-function isAbortError(error) {
-	return error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
-}
-/** Stop waiting for an operation that does not accept an AbortSignal. */
-function withinDeadline(operation, deadline, timeoutMs) {
-	return new Promise((resolve, reject) => {
-		const onAbort = () => {
-			reject(deadline.callerAborted() ? new SystemOneError("decision request aborted", "aborted") : new SystemOneError(`decision request timed out after ${timeoutMs}ms`, "timeout"));
-		};
-		deadline.signal.addEventListener("abort", onAbort, { once: true });
-		operation.then((value) => {
-			deadline.signal.removeEventListener("abort", onAbort);
-			resolve(value);
-		}, (error) => {
-			deadline.signal.removeEventListener("abort", onAbort);
-			reject(error);
-		});
-		if (deadline.signal.aborted) onAbort();
-	});
-}
-/** A finite number in `[0, 1]`, or undefined. */
-function probability(value) {
-	return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 1 ? value : void 0;
-}
-/** A finite number, or undefined. */
-function finite(value) {
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
-/** A record of finite numbers (probabilities), or undefined when the shape is off. */
-function numberRecord(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
-	const out = {};
-	for (const [key, entry] of Object.entries(value)) {
-		const parsed = finite(entry);
-		if (parsed === void 0) return void 0;
-		out[key] = parsed;
-	}
-	return out;
-}
-/**
-* Parse one answer entry strictly by its own `type`. A body whose answer does
-* not carry the member its type promises is rejected rather than defaulted:
-* an absent probability is exactly the case the caller must not read as "safe".
-*
-* @param value - one raw entry from the response's `answers` object.
-* @returns the parsed answer, or undefined when the entry is malformed.
-*/
-function parseSystemOneAnswer(value) {
-	if (typeof value !== "object" || value === null) return void 0;
-	const raw = value;
-	if (raw.type === "noul") {
-		const noul = probability(raw.noul);
-		return noul === void 0 ? void 0 : {
-			type: "noul",
-			noul
-		};
-	}
-	if (raw.type === "choice") {
-		if (typeof raw.choice !== "string" || raw.choice === "") return void 0;
-		const confidence = raw.confidence === void 0 ? void 0 : probability(raw.confidence);
-		if (raw.confidence !== void 0 && confidence === void 0) return void 0;
-		const probabilities = raw.probabilities === void 0 ? void 0 : numberRecord(raw.probabilities);
-		if (raw.probabilities !== void 0 && probabilities === void 0) return void 0;
-		return {
-			type: "choice",
-			choice: raw.choice,
-			...confidence === void 0 ? {} : { confidence },
-			...probabilities === void 0 ? {} : { probabilities }
-		};
-	}
-	if (raw.type === "score") {
-		const score = finite(raw.score);
-		if (score === void 0) return void 0;
-		const confidence = raw.confidence === void 0 ? void 0 : probability(raw.confidence);
-		if (raw.confidence !== void 0 && confidence === void 0) return void 0;
-		const probabilities = raw.probabilities === void 0 ? void 0 : numberRecord(raw.probabilities);
-		if (raw.probabilities !== void 0 && probabilities === void 0) return void 0;
-		return {
-			type: "score",
-			score,
-			...confidence === void 0 ? {} : { confidence },
-			...probabilities === void 0 ? {} : { probabilities }
-		};
-	}
-}
-/**
-* Parse a decision response body. Every answer entry must be well formed — one
-* malformed entry fails the whole response, because a partially understood
-* decision is not a decision. Unknown extra members are ignored so a server-side
-* addition cannot break the guard.
-*
-* @param value - the decoded JSON body.
-* @returns the parsed response, or undefined when the body is not one.
-*/
-function parseSystemOneResponse(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
-	const raw = value;
-	const rawAnswers = raw.answers;
-	if (typeof rawAnswers !== "object" || rawAnswers === null || Array.isArray(rawAnswers)) return void 0;
-	const entries = Object.entries(rawAnswers);
-	if (entries.length === 0) return void 0;
-	const answers = {};
-	for (const [id, entry] of entries) {
-		const answer = parseSystemOneAnswer(entry);
-		if (answer === void 0) return void 0;
-		answers[id] = answer;
-	}
-	const usage = raw.usage === void 0 ? void 0 : parseUsage(raw.usage);
-	if (raw.usage !== void 0 && usage === void 0) return void 0;
-	return {
-		...typeof raw.model === "string" ? { model: raw.model } : {},
-		answers,
-		...usage === void 0 ? {} : { usage }
-	};
-}
-/** Parse the optional `usage` member; an unreadable one is a malformed body. */
-function parseUsage(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
-	const raw = value;
-	const inputTokens = raw.input_tokens === void 0 ? void 0 : finite(raw.input_tokens);
-	if (raw.input_tokens !== void 0 && inputTokens === void 0) return void 0;
-	const outputTokens = raw.output_tokens === void 0 ? void 0 : finite(raw.output_tokens);
-	if (raw.output_tokens !== void 0 && outputTokens === void 0) return void 0;
-	return {
-		...inputTokens === void 0 ? {} : { inputTokens },
-		...outputTokens === void 0 ? {} : { outputTokens }
-	};
-}
-/** Validate the outgoing request where the server would only reject it with a 400. */
-function assertRequest(request) {
-	const ids = Object.keys(request.questions);
-	if (ids.length === 0) throw new SystemOneError("a decision request needs at least one question", "invalid-request");
-	if (ids.length > 20) throw new SystemOneError(`a decision request carries at most 20 questions (got ${ids.length})`, "invalid-request");
-	for (const id of ids) if (id.trim() === "") throw new SystemOneError("every decision question needs a non-empty id", "invalid-request");
-}
-/** Read the endpoint's error body into a one-line diagnosis. */
-async function httpFailure(response) {
-	let detail = "";
-	try {
-		const slice = (await response.text()).trim().slice(0, 200);
-		if (slice !== "") detail = `: ${slice}`;
-	} catch {}
-	return new SystemOneError(`Command Code decision request failed (HTTP ${response.status})${detail}`, "http", response.status);
-}
-/**
-* Run one decision request.
-*
-* @param deps - connection facts, credential chain and fetch seam.
-* @param request - the state and typed questions.
-* @param options - caller cancellation and the per-call budget.
-* @returns the parsed decision.
-* @throws {SystemOneError} on every failure path; callers fail closed.
-*/
-async function runSystemOne(deps, request, options = {}) {
-	assertRequest(request);
-	const apiBase = deps.apiBase();
-	if (!URL.canParse(apiBase)) throw new SystemOneError(`Command Code decision request is misconfigured: apiBase ${JSON.stringify(apiBase)} is not a valid URL`, "invalid-request");
-	if (options.signal?.aborted === true) throw new SystemOneError("decision request aborted", "aborted");
-	const timeoutMs = options.timeoutMs ?? 1500;
-	const deadline = deadlineOf(options.signal, timeoutMs);
-	try {
-		let key;
-		try {
-			key = await withinDeadline(Promise.resolve().then(() => deps.resolveApiKey()), deadline, timeoutMs);
-		} catch (error) {
-			if (error instanceof SystemOneError && (error.kind === "aborted" || error.kind === "timeout")) throw error;
-			throw new SystemOneError(`Command Code decision request has no usable credential: ${error instanceof Error ? error.message : String(error)}`, "credential", void 0, { cause: error });
-		}
-		const body = {
-			model: request.model ?? "typesafe/jev",
-			state: request.state,
-			questions: request.questions
-		};
-		if (deadline.signal.aborted) throw deadline.callerAborted() ? new SystemOneError("decision request aborted", "aborted") : new SystemOneError(`decision request timed out after ${timeoutMs}ms`, "timeout");
-		let response;
-		try {
-			response = await (deps.fetchImpl ?? fetch)(`${apiBase.replace(/\/$/, "")}${SYSTEMONE_ROUTE}`, {
-				method: "POST",
-				headers: {
-					"Content-Type": "application/json",
-					...IDENTITY_ENCODING_HEADER,
-					Authorization: `Bearer ${key}`,
-					"x-command-code-version": COMMAND_CODE_CLI_VERSION,
-					...attributionHeaders()
-				},
-				body: JSON.stringify(body),
-				signal: deadline.signal
-			});
-		} catch (error) {
-			if (deadline.callerAborted()) throw new SystemOneError("decision request aborted", "aborted", void 0, { cause: error });
-			if (deadline.timedOut() || isAbortError(error)) throw new SystemOneError(`decision request timed out after ${timeoutMs}ms`, "timeout", void 0, { cause: error });
-			throw new SystemOneError(`Command Code decision request failed: ${error instanceof Error ? error.message : String(error)}`, "network", void 0, { cause: error });
-		}
-		if (!response.ok) throw await httpFailure(response);
-		let payload;
-		try {
-			payload = await response.json();
-		} catch (error) {
-			if (deadline.callerAborted()) throw new SystemOneError("decision request aborted", "aborted", void 0, { cause: error });
-			throw new SystemOneError("Command Code returned an unparseable decision body", "invalid-response", void 0, { cause: error });
-		}
-		const parsed = parseSystemOneResponse(payload);
-		if (parsed === void 0) throw new SystemOneError("Command Code returned a decision body this plugin cannot read", "invalid-response");
-		return parsed;
-	} finally {
-		deadline.dispose();
-	}
-}
-//#endregion
-//#region src/command-guard.ts
-/** Tool names whose `arguments.command` this guard judges. */
-const COMMAND_GUARD_SHELL_TOOLS = ["bash", "pwsh"];
-/** Question id the primary safety verdict is keyed by. */
-const COMMAND_GUARD_QUESTION_ID = "safe";
-/** Question id for the narrow-purpose part of a sandbox escalation. */
-const COMMAND_GUARD_ESCALATION_SCOPE_QUESTION_ID = "escalation_scope";
-/** Question id for the necessity/proportionality part of a sandbox escalation. */
-const COMMAND_GUARD_ESCALATION_NECESSITY_QUESTION_ID = "escalation_necessity";
-/** The selectable levels, strictest first (the order the settings surfaces list them in). */
-const COMMAND_GUARD_LEVELS = [
-	"high",
-	"medium",
-	"low"
-];
-/** Each level's probability threshold. */
-const COMMAND_GUARD_LEVEL_THRESHOLDS = {
-	high: .95,
-	medium: .9,
-	low: .8
-};
-/** The level an unset config reads as. */
-const COMMAND_GUARD_DEFAULT_LEVEL = "medium";
-/** Probability of "safe" at or above which the guard grants `allowed-once` by default. */
-const COMMAND_GUARD_DEFAULT_THRESHOLD = COMMAND_GUARD_LEVEL_THRESHOLDS[COMMAND_GUARD_DEFAULT_LEVEL];
-/** The threshold for a stored level; anything unrecognized reads as the default level. */
-function commandGuardThreshold(level) {
-	return typeof level === "string" && Object.hasOwn(COMMAND_GUARD_LEVEL_THRESHOLDS, level) ? COMMAND_GUARD_LEVEL_THRESHOLDS[level] : COMMAND_GUARD_DEFAULT_THRESHOLD;
-}
-/**
-* Decision budget; the approval prompt must not wait longer than this. Fixed
-* rather than configurable: it only bounds how long a late verdict can delay
-* the prompt, and every failure (a timeout included) already falls back to
-* asking the user, so there is nothing for a user to tune. 3 s leaves room for
-* credential resolution plus one decision round trip on a slow link.
-*/
-const COMMAND_GUARD_TIMEOUT_MS = 3e3;
-/**
-* Longest command the guard will send for judgement. A longer one is delegated
-* instead of truncated: a verdict on the first N characters of a command is a
-* verdict on a different command.
-*/
-const COMMAND_GUARD_MAX_COMMAND_CHARS = 6e3;
-/**
-* Hard denylist: commands the guard never auto-approves, and never even sends
-* for judgement. Each entry is a deliberate, narrow reading of one destructive
-* family — the goal is not to classify every dangerous command (that is the
-* model's job) but to make sure the classics cannot be talked into a grant by a
-* persuasive-looking command string.
-*
-* Every pattern is allowed to OVER-match: a false positive costs one ordinary
-* human prompt, while a false negative would hand a destructive command to a
-* model that has to guess. That asymmetry is why `sudo` is matched anywhere in
-* the line rather than only in command position, and why `fdisk` is listed even
-* though `fdisk -l` only lists partitions.
-*/
-const COMMAND_GUARD_DENY_LIST = [
-	{
-		id: "rm-root",
-		pattern: /\brm\s+(?:-[a-zA-Z]*[rR][a-zA-Z]*f[a-zA-Z]*|-[a-zA-Z]*f[a-zA-Z]*[rR][a-zA-Z]*|--recursive[^\n]*--force|--force[^\n]*--recursive)\s+(?:\/|\/\*|~|~\/\*|\$HOME(?:\/\*)?|\*|\.\/\*|\.)(?:\s|$)/
-	},
-	{
-		id: "rm-home",
-		pattern: /\brm\s+-[a-zA-Z]*[rR][a-zA-Z]*\s+(?:~|\$HOME)\//
-	},
-	{
-		id: "filesystem-write",
-		pattern: /\b(?:mkfs(?:\.\w+)?|wipefs|fdisk|parted|shred)\b/
-	},
-	{
-		id: "raw-device-write",
-		pattern: /\bdd\b[^\n]*\bof=\/dev\//
-	},
-	{
-		id: "device-redirect",
-		pattern: />{1,2}\s*\/dev\/(?:sd|disk|nvme|hd)/
-	},
-	{
-		id: "fork-bomb",
-		pattern: /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/
-	},
-	{
-		id: "privilege-escalation",
-		pattern: /\b(?:sudo|doas)\b/
-	},
-	{
-		id: "su",
-		pattern: /\bsu\s/
-	},
-	{
-		id: "chmod-world-write",
-		pattern: /\bchmod\b[^\n]*\b(?:777|a\+w|o\+w)\b/
-	},
-	{
-		id: "chown-root",
-		pattern: /\bchown\b[^\n]*\b(?:root|0):/
-	},
-	{
-		id: "git-push",
-		pattern: /\bgit\s+push\b/
-	},
-	{
-		id: "git-history-rewrite",
-		pattern: /\bgit\s+(?:filter-branch|filter-repo)\b/
-	},
-	{
-		id: "git-hard-reset",
-		pattern: /\bgit\s+reset\s+--hard\b/
-	},
-	{
-		id: "git-clean-force",
-		pattern: /\bgit\s+clean\b[^\n]*\s-[a-zA-Z]*f/
-	},
-	{
-		id: "git-discard-worktree",
-		pattern: /\bgit\s+(?:checkout|restore)\s+(?:--\s+)?\.(?:\s|$)/
-	},
-	{
-		id: "git-stash-drop",
-		pattern: /\bgit\s+stash\s+(?:drop|clear)\b/
-	},
-	{
-		id: "publish",
-		pattern: /\b(?:npm|pnpm|yarn|bun)\s+publish\b/
-	},
-	{
-		id: "release-upload",
-		pattern: /\b(?:gh\s+release|twine\s+upload)\b/
-	},
-	{
-		id: "docker-push",
-		pattern: /\bdocker\s+push\b/
-	},
-	{
-		id: "cloud-upload",
-		pattern: /\b(?:aws\s+s3|gsutil|gcloud\s+storage|az\s+storage)\b[^\n]*\b(?:cp|sync|mv|rm|rb)\b/
-	},
-	{
-		id: "remote-copy",
-		pattern: /\b(?:scp|rsync)\b[^\n]*(?::|@)/
-	},
-	{
-		id: "pipe-to-shell",
-		pattern: /\b(?:curl|wget|fetch)\b[^\n|]*\|\s*(?:sudo\s+)?(?:sh|bash|zsh|dash|ksh|python\d*|node|ruby|perl)\b/
-	},
-	{
-		id: "power",
-		pattern: /\b(?:shutdown|reboot|halt|poweroff)\b/
-	},
-	{
-		id: "kill-everything",
-		pattern: /\bkill\s+(?:-9\s+)?-1\b|\b(?:killall|pkill)\s+-9\b/
-	},
-	{
-		id: "credential-write",
-		pattern: /(?:>{1,2}|tee|cp|mv|rm|chmod|chown)\s[^\n]*(?:\.ssh\b|\.aws\b|\.gnupg\b|\.commandcode\/auth\.json|id_rsa|id_ed25519)/
-	},
-	{
-		id: "history-clear",
-		pattern: /\bhistory\s+-c\b|\bunset\s+HISTFILE\b/
-	},
-	{
-		id: "global-install",
-		pattern: /\b(?:npm|pnpm|yarn|bun)\s+(?:i|install|add)\s+(?:-g\b|--global\b)/
-	},
-	{
-		id: "system-install",
-		pattern: /\b(?:apt|apt-get|dnf|yum|zypper|apk|pacman|brew)\s+(?:install|remove|purge|uninstall|upgrade)\b/
-	},
-	{
-		id: "language-install",
-		pattern: /\b(?:pip3?|pipx|gem|cargo)\s+(?:install|add)\b/
-	}
-];
-/**
-* Why the guard refuses to judge a command, when it does.
-*
-* @param command - the raw command text.
-* @returns the matching denylist id, or undefined.
-*/
-function denyReasonOf(command) {
-	for (const entry of COMMAND_GUARD_DENY_LIST) if (entry.pattern.test(command)) return entry.id;
-}
-/** A non-empty string member, or undefined. */
-function stringMember(value, key) {
-	if (typeof value !== "object" || value === null) return void 0;
-	const member = value[key];
-	return typeof member === "string" && member.trim() !== "" ? member : void 0;
-}
-/**
-* Read a shell command out of a tool execution, or undefined when this call is
-* not one the guard judges (a different tool, or arguments without a command).
-*
-* @param name - the executed tool's name.
-* @param args - the execution's parsed `arguments`.
-* @returns the fact to judge, without the asker's reason (that arrives later).
-*/
-function shellCommandOf(name, args) {
-	if (!COMMAND_GUARD_SHELL_TOOLS.includes(name)) return void 0;
-	const command = stringMember(args, "command");
-	if (command === void 0) return void 0;
-	const description = stringMember(args, "description");
-	const workdir = stringMember(args, "workdir");
-	const sandboxPermissions = stringMember(args, "sandbox_permissions");
-	return {
-		tool: name,
-		command,
-		...description === void 0 ? {} : { description },
-		...workdir === void 0 ? {} : { workdir },
-		...sandboxPermissions === void 0 ? {} : { sandboxPermissions }
-	};
-}
-/**
-* Build the decision request for one command.
-*
-* A normal approval asks one question. A call that explicitly requests a wider
-* sandbox gets the same safety question plus two veto questions. This keeps the
-* common case cheap while making the broader permission change an explicit
-* decision: JEV must agree that the extra access has a narrow purpose and is
-* necessary, not merely that the command text looks familiar.
-*
-* The agent's own `description` and the harness's `reason` are included as
-* context, but the criteria say the command text itself decides — a
-* model-written description is a claim, not evidence.
-*
-* @param fact - the command and its context.
-* @returns the request to send.
-*/
-function buildSafetyRequest(fact) {
-	const escalated = fact.sandboxPermissions !== void 0;
-	const lines = [
-		`Tool: ${fact.tool}`,
-		"Command:",
-		fact.command,
-		...fact.description === void 0 ? [] : ["", `The agent describes this command as: ${fact.description}`],
-		...fact.workdir === void 0 ? [] : ["", `Working directory: ${fact.workdir}`],
-		...fact.sandboxPermissions === void 0 ? [] : ["", `The harness is asking because this call requests a wider sandbox mode (${fact.sandboxPermissions}) than the one currently in force.`],
-		...fact.reason === void 0 ? [] : ["", `The asker's reason for needing approval: ${fact.reason}`]
-	];
-	const question = {
-		type: "noul",
-		instructions: escalated ? "Is it safe to run this command right now WITHOUT asking the user first, including the requested sandbox escalation? Judge the command text itself; a description or stated reason is only a claim about it." : "Is it safe to run this command right now WITHOUT asking the user first? Judge the command text itself; a description is only a claim about it.",
-		criteria: {
-			true: escalated ? "A normal, non-obfuscated read, build, or test operation whose outside-workspace effects are limited to conventional build/dependency caches or temporary files and are easily reversible: no unrelated user or system data is accessed, no data leaves the machine, and no credentials, git history or remote state are touched." : "Read-only, or its effects stay inside the current project and are trivially reversible: no data leaves the machine, nothing outside the project is modified, and no credentials, git history or remote state are touched.",
-			false: "Anything else. Broad or unrelated outside-workspace access, deleting or overwriting files outside the project, rewriting or publishing git history, uploading data anywhere, installing system or global packages, changing permissions, ownership or credentials, killing processes, running as another user or as root, piping a download into a shell, or a command obfuscated enough that its effect cannot be read."
-		}
-	};
-	const questions = { [COMMAND_GUARD_QUESTION_ID]: question };
-	if (escalated) {
-		questions[COMMAND_GUARD_ESCALATION_SCOPE_QUESTION_ID] = {
-			type: "noul",
-			instructions: "Is the requested wider sandbox access limited to a narrow, conventional purpose supported by this command, such as a build cache, dependency cache, or temporary directory, rather than unrelated user files, credentials, other projects, or the network?",
-			criteria: {
-				true: "The wider access is plausibly limited to conventional local build/dependency caches or temporary files required by the command, with no unrelated host data or remote transfer in scope.",
-				false: "The command needs broad or unrelated host access, cannot establish a narrow purpose, or would use the wider permission to reach credentials, other projects, user files, or the network."
-			}
-		};
-		questions[COMMAND_GUARD_ESCALATION_NECESSITY_QUESTION_ID] = {
-			type: "noul",
-			instructions: "Is the requested sandbox escalation necessary and proportionate for this one command, rather than broader than the command needs? Treat the stated reason as a claim to check against the command, not as proof.",
-			criteria: {
-				true: "The command and its stated purpose support a one-shot escalation that is needed for the task and is no broader than the requested effect requires.",
-				false: "The wider mode is unnecessary, broader than needed, unsupported by the command, or the command is too ambiguous to justify the extra authority."
-			}
-		};
-	}
-	return {
-		state: lines.join("\n"),
-		questions
-	};
-}
-/**
-* Read a probability out of a decision response.
-*
-* @param response - the parsed response.
-* @param questionId - the question id to read (defaults to the guard's own).
-* @returns the probability, or undefined when the answer is missing or is not
-*   a `noul` verdict.
-*/
-function safeProbabilityOf(response, questionId = COMMAND_GUARD_QUESTION_ID) {
-	const answer = response.answers[questionId];
-	return answer !== void 0 && answer.type === "noul" ? answer.noul : void 0;
-}
-/**
-* One-line, length-bounded excerpt of a command for the log. The full text is
-* already in the session's tool call and was already sent to the decision
-* endpoint, so this adds no exposure — it is what makes "why did this run
-* without asking?" answerable from the log alone.
-*/
-function commandExcerpt(command, limit = 160) {
-	const flat = command.replace(/\s+/g, " ").trim();
-	return flat.length <= limit ? flat : `${flat.slice(0, limit - 1)}…`;
-}
-/**
-* The guard's stateful half: what was executed (by call id) and what has
-* already been decided (by agent and complete decision context), both bounded.
-*
-* The execution cache is the bridge between the two seams — `tools/pre-execute`
-* knows the arguments, `approval/request` knows the call id — and it is keyed by
-* call id with an agent-identity check when read: an entry for an execution
-* that never asked is never read, so there is nothing to clean up on the result
-* side (and the ask happens before the result anyway).
-*/
-var CommandGuard = class {
-	deps;
-	executions = /* @__PURE__ */ new Map();
-	decisions = /* @__PURE__ */ new WeakMap();
-	constructor(deps) {
-		this.deps = deps;
-	}
-	/**
-	* Remember one execution's command. Never throws, never changes a decision.
-	*
-	* @param execution - the execution about to run.
-	*/
-	noteExecution(execution) {
-		const callId = execution?.callId;
-		if (typeof callId !== "string" || callId === "") return;
-		const fact = shellCommandOf(execution.name, execution.arguments);
-		if (fact === void 0) return;
-		this.executions.delete(callId);
-		this.executions.set(callId, {
-			fact,
-			agent: execution.agent
-		});
-		while (this.executions.size > 64) {
-			const oldest = this.executions.keys().next();
-			if (oldest.done === true) break;
-			this.executions.delete(oldest.value);
-		}
-	}
-	/** Forget every remembered execution and decision (disposal, tests). */
-	clear() {
-		this.executions.clear();
-		this.decisions = /* @__PURE__ */ new WeakMap();
-	}
-	/**
-	* Judge one approval request.
-	*
-	* @param request - the pending approval.
-	* @returns the verdict; `approve` is the only outcome that grants anything.
-	*/
-	async judge(request) {
-		const settings = this.deps.settings();
-		if (!settings.enabled) return {
-			kind: "delegate",
-			reason: "guard disabled"
-		};
-		const callId = request.callId;
-		if (callId === void 0) return {
-			kind: "delegate",
-			reason: "approval carries no call id"
-		};
-		const observed = this.executions.get(callId);
-		if (observed === void 0 || observed.agent !== request.agent) return {
-			kind: "delegate",
-			reason: "the guard never saw this call for this agent"
-		};
-		const fact = observed.fact;
-		const excerpt = commandExcerpt(fact.command);
-		if (!COMMAND_GUARD_SHELL_TOOLS.includes(request.toolName)) return {
-			kind: "delegate",
-			reason: `not a shell tool (${request.toolName})`
-		};
-		if (fact.command.length > 6e3) return {
-			kind: "delegate",
-			reason: `command longer than ${COMMAND_GUARD_MAX_COMMAND_CHARS} characters`,
-			command: excerpt
-		};
-		const denied = denyReasonOf(fact.command);
-		if (denied !== void 0) return {
-			kind: "delegate",
-			reason: `denylisted command (${denied})`,
-			command: excerpt
-		};
-		const full = {
-			...fact,
-			...request.reason === void 0 ? {} : { reason: request.reason }
-		};
-		const memoKey = JSON.stringify(full);
-		const now = this.deps.now?.() ?? Date.now();
-		const agentDecisions = request.agent === void 0 ? void 0 : this.decisions.get(request.agent);
-		const memo = agentDecisions?.get(memoKey);
-		if (memo !== void 0) {
-			if (now - memo.at < 6e5) return this.verdict(memo, settings.threshold, "memo", excerpt, full.sandboxPermissions !== void 0);
-			agentDecisions?.delete(memoKey);
-		}
-		let response;
-		try {
-			response = await this.deps.decide(buildSafetyRequest(full), {
-				...request.signal === void 0 ? {} : { signal: request.signal },
-				timeoutMs: settings.timeoutMs
-			});
-		} catch (error) {
-			return {
-				kind: "delegate",
-				reason: `decision unavailable: ${error instanceof Error ? error.message : String(error)}`,
-				command: excerpt
-			};
-		}
-		const probability = safeProbabilityOf(response);
-		if (probability === void 0) return {
-			kind: "delegate",
-			reason: "the decision carried no safe verdict",
-			command: excerpt
-		};
-		let escalation;
-		if (full.sandboxPermissions !== void 0) {
-			const scope = safeProbabilityOf(response, COMMAND_GUARD_ESCALATION_SCOPE_QUESTION_ID);
-			const necessity = safeProbabilityOf(response, COMMAND_GUARD_ESCALATION_NECESSITY_QUESTION_ID);
-			if (scope === void 0 || necessity === void 0) return {
-				kind: "delegate",
-				reason: "the decision carried no complete sandbox-escalation verdict",
-				command: excerpt
-			};
-			escalation = {
-				scope,
-				necessity
-			};
-		}
-		const memoEntry = {
-			probability,
-			...escalation === void 0 ? {} : { escalation },
-			at: now
-		};
-		if (request.agent !== void 0) {
-			const decisions = agentDecisions ?? /* @__PURE__ */ new Map();
-			decisions.set(memoKey, memoEntry);
-			while (decisions.size > 64) {
-				const oldest = decisions.keys().next();
-				if (oldest.done === true) break;
-				decisions.delete(oldest.value);
-			}
-			this.decisions.set(request.agent, decisions);
-		}
-		return this.verdict(memoEntry, settings.threshold, "model", excerpt, full.sandboxPermissions !== void 0);
-	}
-	/** Apply the threshold to the primary verdict and any escalation vetoes. */
-	verdict(entry, threshold, source, command, escalated) {
-		if (entry.probability < threshold) return {
-			kind: "delegate",
-			reason: `safe probability ${entry.probability.toFixed(3)} below ${threshold}`,
-			probability: entry.probability,
-			command
-		};
-		if (!escalated) return {
-			kind: "approve",
-			probability: entry.probability,
-			source,
-			command
-		};
-		if (entry.escalation === void 0) return {
-			kind: "delegate",
-			reason: "the cached sandbox-escalation verdict was incomplete",
-			command
-		};
-		if (entry.escalation.scope < threshold) return {
-			kind: "delegate",
-			reason: `sandbox scope probability ${entry.escalation.scope.toFixed(3)} below ${threshold}`,
-			probability: entry.probability,
-			command
-		};
-		if (entry.escalation.necessity < threshold) return {
-			kind: "delegate",
-			reason: `sandbox necessity probability ${entry.escalation.necessity.toFixed(3)} below ${threshold}`,
-			probability: entry.probability,
-			command
-		};
-		return {
-			kind: "approve",
-			probability: entry.probability,
-			source,
-			...entry.escalation === void 0 ? {} : { escalation: entry.escalation },
-			command
-		};
-	}
-};
-/**
-* Register the guard on a context that has the approval seam.
-*
-* Call this from inside `ctx.inject(['approval'], …)`: the seam's presence is
-* what makes the feature meaningful (no approval service means no asks), and
-* tying the listeners to that injected fiber is what makes them go away with it.
-*
-* @param ctx - the injected context (or a test double with `on`).
-* @param deps - settings, the decision client, clock and logger.
-* @returns a disposer for both listeners.
-*/
-function applyCommandGuard(ctx, deps) {
-	const guard = new CommandGuard(deps);
-	const events = ctx;
-	const offPreExecute = events.on("tools/pre-execute", (execution, next) => {
-		guard.noteExecution(execution);
-		return next();
-	}, { prepend: true });
-	const offApproval = events.on("approval/request", async (request, next) => {
-		try {
-			if (!deps.settings().enabled) return next();
-		} catch (error) {
-			deps.log?.(`command guard failed: ${error instanceof Error ? error.message : String(error)}`);
-			return next();
-		}
-		let verdict;
-		try {
-			verdict = await guard.judge(request);
-		} catch (error) {
-			deps.log?.(`command guard failed: ${error instanceof Error ? error.message : String(error)}`);
-			return next();
-		}
-		if (verdict.kind === "approve") {
-			deps.log?.(`command guard auto-approved a ${request.toolName} call (safe probability ${verdict.probability.toFixed(3)}${verdict.escalation === void 0 ? "" : `, sandbox scope ${verdict.escalation.scope.toFixed(3)}, necessity ${verdict.escalation.necessity.toFixed(3)}`}, ${verdict.source}): ${verdict.command ?? "(command unknown)"}`);
-			return "allowed-once";
-		}
-		deps.log?.(`command guard delegated a ${request.toolName} call: ${verdict.reason}${verdict.command === void 0 ? "" : ` — ${verdict.command}`}`);
-		return next();
-	}, { prepend: true });
-	return () => {
-		guard.clear();
-		for (const off of [offPreExecute, offApproval]) if (typeof off === "function") off();
-	};
-}
-//#endregion
 //#region src/config-volatile.ts
 /**
 * Volatile-config helpers for dsh 0.1.7's schema-derived profile Config.
 *
-* 0.1.7 rewrote settings around profile Config: `settings.describe()` projects
-* each active entry's schema through `volatileForm()`, so a form contains ONLY
-* fields whose schema nodes carry `meta.volatile`, and a form edit is refused
-* unless its path lies beneath a marked node. On that generation the loader
-* resolves each marked top-level field into a readonly `Volatile<T>` reference
-* (`{ get() }`, frozen, written in place by the owning runtime) instead of a
-* plain value, commits later changes WITHOUT remounting the fiber, and
-* dispatches `loader/volatile-update` to the owning fiber.
-*
-* Two helpers keep the rest of the plugin reading a PLAIN `Config`:
-*
-* - `markVolatile(schema)` applies `.volatile()`, so 0.1.7's forms see every
-*   field we mark. The declared type is preserved through the mark on purpose:
-*   it changes what the schema PARSES to (a live reference), not the
-*   plugin-facing `Config` shape every consumer reads.
-* - `unwrapVolatileConfig(config)` reads every top-level field through its
-*   reference when one is present — returning a FRESH object per call, since
-*   a reference's identity is stable while its value changes — and returns the
-*   config untouched when none is.
-*
-* Only TOP-LEVEL fields are marked (form writes name top-level paths such as
-* `accounts` or `modelVisibility.<id>`, whose first segment is the marked
-* node), so one unwrap level is complete. The literal `apiKey` secret stays
-* unmarked on purpose: no settings surface writes it — the settings page and
-* the dsh-TUI section both write keys through the credentials seam — so it
-* keeps composition-only semantics, and a config-file edit to it reloading the
-* fiber is the correct behavior for a secret literal.
+* 0.1.7's `settings.describe()` projects each entry's schema through
+* `volatileForm()`, so a form contains ONLY nodes carrying `meta.volatile`
+* and a form edit is refused unless its path lies beneath a marked node. The
+* loader then resolves each marked field into a frozen `{ get() }` reference
+* that is written IN PLACE (no remount) and announced with
+* `loader/volatile-update`. Two helpers keep the rest of the plugin reading a
+* PLAIN `Config`: `markVolatile()` applies the mark, and
+* `unwrapVolatileConfig()` reads every top-level field through its reference
+* when one is present — FRESH per call, because a reference's identity is
+* stable while its value changes.
+*
+* Only TOP-LEVEL fields are marked (a form write names a top-level path such
+* as `accounts` or `modelVisibility.<id>`), so one unwrap level is complete.
+* The literal `apiKey` secret stays unmarked on purpose: no settings surface
+* writes it — page and TUI both write keys through the credentials seam — so a
+* config-file edit to it reloading the fiber is correct for a secret literal.
 *
 * @module dsh-commandcode-provider/config-volatile
 */
 /**
 * Mark one schema field volatile.
 *
-* `.volatile()` is unconditional: the mark is a schemastery 3.18.3 feature and
-* the only engine this bundle supports (`dsh 0.1.7-rc.2`) pins `~3.18.4`, so
-* the method is always present. It is reached through a structural member
-* rather than schemastery's own typing so the function can keep the caller's
-* declared field type, which is what lets `Config` stay the plain shape every
-* consumer reads while the schema parses to live references.
-*
-* @param schema - The field schema.
-* @returns The schema carrying `meta.volatile`.
+* `.volatile()` is unconditional: it is a schemastery 3.18.3 feature and the
+* only supported engine (`dsh 0.1.7-rc.2`) pins `~3.18.4`, so the method is
+* always present. It is reached through a structural member so the caller's
+* declared field type survives — the mark changes what the schema PARSES to (a
+* live reference), not the plugin-facing `Config` shape.
 */
 function markVolatile(schema) {
 	return schema.volatile();
@@ -8147,10 +7262,6 @@ function markVolatile(schema) {
 /**
 * Mark every field of a Config field dict volatile, except the named
 * composition-only secrets (`apiKey` here, which no settings surface writes).
-*
-* @param fields - Freshly built field schemas.
-* @param skip - Field names that must stay unmarked.
-* @returns The field dict with every non-skipped field marked.
 */
 function markVolatileFields(fields, skip = []) {
 	return Object.fromEntries(Object.entries(fields).map(([name, schema]) => [name, skip.includes(name) ? schema : markVolatile(schema)]));
@@ -8172,8 +7283,8 @@ function isVolatileRef(value) {
 *
 * Every top-level field found to be a volatile reference is read through
 * `.get()` — freshly on every call, so a live update lands on the very next
-* read. The loader resolves EVERY marked node into a reference, unset fields
-* included, so a loader-parsed config always yields a fresh object here; the
+* read (the loader resolves EVERY marked node into a reference, unset fields
+* included, so a loader-parsed config always yields a fresh object here). The
 * pass-through for a field that is not a reference is what keeps the unmarked
 * `apiKey` literal readable.
 */
@@ -8188,15 +7299,14 @@ function unwrapVolatileConfig(config) {
 //#region src/index.ts
 /**
 * dsh-commandcode-provider — DeepSeek Harness LLM provider plugin for Command
-* Code (unofficial; ported from pi-commandcode-provider@0.5.1).
+* Code (unofficial; ported from pi-commandcode-provider@0.5.1, MIT).
 *
 * Registers the `commandcode` provider route on `ctx.llm` and declares it in
 * the configurable-provider directory, so the web Models page shows a
-* "Command Code" card with an API-key field and the model picker lists the
-* live Command Code model catalog. Connection facts resolve per request over
-* the plugin's live profile Config (volatile fields, unwrapped per read) and
-* the credential seam, so a changed key, endpoint, or cache path reaches the
-* next request without a restart.
+* "Command Code" card and the model picker lists the live catalog. Connection
+* facts are resolved per request from the live profile Config (volatile
+* fields, unwrapped per read) and the credential seam, so a changed key,
+* endpoint or cache path reaches the next request without a restart.
 *
 * ```yaml
 * - id: llm-commandcode
@@ -8223,14 +7333,12 @@ const PROVIDER = "commandcode";
 const DEFAULT_MODELS_CACHE_PATH = join(homedir(), ".commandcode", "models-cache.json");
 /**
 * The Config schema: every field volatile except the composition-only `apiKey`
-* secret.
-*
-* dsh 0.1.7's settings forms are projected from the schema's `meta.volatile`
-* nodes, so an unmarked field would be invisible to AND unwritable from the
-* settings page and refused by form-edit path validation — and the loader
-* hands `apply()` a live reference per marked field, committing later writes
-* without remounting this fiber (the `loader/volatile-update` listener at the
-* bottom of `apply` covers the facts that are not re-derived per read).
+* secret. 0.1.7's settings forms are projected from the schema's
+* `meta.volatile` nodes, so an unmarked field would be invisible to AND
+* unwritable from the settings page. The loader also hands `apply()` a live
+* reference per marked field, so writes commit in place without remounting
+* this fiber — the `loader/volatile-update` listener at the bottom of `apply`
+* re-derives the two facts that are not re-read per request.
 */
 const Config = z.object(markVolatileFields({
 	apiKeyEnv: z.string().role("credential-ref").default(DEFAULT_API_KEY_ENV),
@@ -8243,14 +7351,6 @@ const Config = z.object(markVolatileFields({
 	transportMaxRetries: z.number().min(0).max(50),
 	filterModelsByPlan: z.boolean(),
 	visibleModels: z.array(z.string()),
-	/**
-	* Per-model visibility overrides for the terminal settings page's checkbox
-	* list, keyed by catalog id. dsh-TUI addresses a staged edit by its field
-	* PATH, so two checkboxes sharing one path would overwrite each other's
-	* draft and the section's last model would decide every write; a map gives
-	* each checkbox a path of its own. An id listed here wins over
-	* {@link Config.visibleModels}; ids absent here keep following it.
-	*/
 	modelVisibility: z.dict(z.boolean()),
 	webSearch: z.boolean().default(true),
 	showSidebarQuota: z.boolean().default(false),
@@ -8265,8 +7365,6 @@ const Config = z.object(markVolatileFields({
 		models: z.array(z.string()),
 		account: z.string()
 	})),
-	commandGuard: z.boolean().default(false),
-	commandGuardLevel: z.union([...COMMAND_GUARD_LEVELS]).default(COMMAND_GUARD_DEFAULT_LEVEL),
 	zdr: z.boolean().default(false),
 	lang: z.string().pattern(/^(zh|en)$/).default("zh")
 }, ["apiKey"]));
@@ -8274,7 +7372,7 @@ const Config = z.object(markVolatileFields({
 * The one explicit resolve step from raw config to validated connection
 * facts. Programmatic construction may bypass Schemastery normalization, so
 * every default is re-judged here — for the composition entry at load and for
-* each settings snapshot at its first use.
+* every settings-backed read.
 */
 function resolveAdapterOptions(config) {
 	return {
@@ -8291,11 +7389,10 @@ function resolveAdapterOptions(config) {
 	};
 }
 /**
-* Per-model visibility overrides, cleaned for the adapter. Programmatic
-* construction may bypass Schemastery normalization, so a non-object or a
-* non-boolean entry is dropped here instead of reaching the picker filter.
-* @param raw - The `modelVisibility` value from any config source.
-* @returns A frozen id → boolean map, or undefined when nothing is set.
+* Per-model visibility overrides, cleaned for the adapter: a non-object or a
+* non-boolean entry is dropped rather than reaching the picker filter, and an
+* all-empty map reads as no map. Returns a fresh id → boolean map, or
+* undefined when nothing is set.
 */
 function readModelVisibility(raw) {
 	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return void 0;
@@ -8493,26 +7590,6 @@ function apply(ctx, config) {
 			applyCommandCodeSearchSelection(webCtx.web, searchSelection, false);
 		}, "dsh-commandcode-provider: web search selection");
 	});
-	const commandGuardSettings = () => {
-		const raw = current();
-		return {
-			enabled: raw.commandGuard === true,
-			threshold: commandGuardThreshold(raw.commandGuardLevel),
-			timeoutMs: COMMAND_GUARD_TIMEOUT_MS
-		};
-	};
-	ctx.inject(["approval"], (approvalCtx) => {
-		applyCommandGuard(approvalCtx, {
-			settings: commandGuardSettings,
-			decide: (request, decideOptions) => runSystemOne({
-				apiBase: () => options().apiBase,
-				resolveApiKey: () => resolveApiKey(options())
-			}, request, decideOptions),
-			log: (message) => {
-				ctx.logger.info(`llm-commandcode: ${message}`);
-			}
-		});
-	});
 	let refreshTuiSettings;
 	ctx.inject(["tuiSettingsSections"], (tuiCtx) => {
 		refreshTuiSettings = applyCommandCodeTuiSettings(tuiCtx, {