@mars-sea/dsh-commandcode-provider 0.11.8 → 0.11.10

package/lib/client.js

@@ -36,6 +36,424 @@ window.__ModuleLoader__.load({
 			};
 		}
 		//#endregion
+		//#region src/client/settings-scope.ts
+		const MEMORY_STATUS = "unavailable";
+		/**
+		* Backoff before re-reading a directory whose FIRST read failed, in millis.
+		*
+		* A first read can lose to a Host that is still coming up (the gateway's WS
+		* handshake, a settings service mid-start): the failure is transient, but the
+		* scope has nothing held, so it keeps its initial `{ status: 'loading',
+		* writable: false }` snapshot — and every control on the settings page renders
+		* disabled behind a "read-only" banner. Nothing else would ever re-read it:
+		* the forwarded `settings/document-updated` and `connection/reset` signals need
+		* a live Host to fire, and the namespace only re-mounts on a page reload. So a
+		* failure with NOTHING held retries on this bounded ladder; a failure with a
+		* held view keeps it (no retry — the page is already showing the last good
+		* document, and `tests/settings-scope.test.ts` pins that).
+		*/
+		const SETTINGS_DESCRIBE_RETRY_MS = [
+			1e3,
+			2e3,
+			4e3
+		];
+		/** The production timer: a browser/node timeout, no polling. */
+		const REAL_SETTINGS_TIMER = {
+			set(callback, ms) {
+				const handle = setTimeout(callback, ms);
+				handle.unref?.();
+				return handle;
+			},
+			clear(handle) {
+				clearTimeout(handle);
+			}
+		};
+		/** Shallow equality over the snapshot fields, so an unchanged derive never churns subscribers. */
+		function sameSnapshot(a, b) {
+			return a.status === b.status && Object.is(a.value, b.value) && Object.is(a.base, b.base) && Object.is(a.user, b.user) && Object.is(a.revision, b.revision) && a.writable === b.writable && a.mode === b.mode;
+		}
+		/** Accept a decoded row value only when it is the object a settings section is. */
+		function decodeRow(value) {
+			if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+			return value;
+		}
+		/**
+		* One shared mirror of the Host `settings.describe()` view.
+		*
+		* The run loop is the harness's own: serialize behind `inFlight`, fold a
+		* concurrent invalidation into exactly one rerun, and hold the previous view
+		* across a failed read (status stays `ready` with an `error`, or returns to
+		* `idle` when nothing was ever held).
+		*/
+		var SettingsDescribeMirror = class {
+			resolveRemote;
+			timer;
+			store;
+			persistence;
+			inFlight;
+			rerun = false;
+			generation = 0;
+			/** Pending retry handle and how many of {@link SETTINGS_DESCRIBE_RETRY_MS} are spent. */
+			retryHandle;
+			retries = 0;
+			disposed = false;
+			/**
+			* @param resolveRemote - Reads the inject-captured `remote.settings` namespace.
+			* @param persistence - Client-selected Host persistence; non-loopback pages may stay process-local.
+			* @param timer - Retry timer seam (see {@link SETTINGS_DESCRIBE_RETRY_MS}).
+			*/
+			constructor(resolveRemote, persistence, timer = REAL_SETTINGS_TIMER) {
+				this.resolveRemote = resolveRemote;
+				this.timer = timer;
+				this.persistence = persistence;
+				this.store = createSnapshotStore({
+					status: persistence === "host" ? "idle" : MEMORY_STATUS,
+					view: null,
+					error: null
+				});
+			}
+			getSnapshot() {
+				return this.store.getSnapshot();
+			}
+			subscribe(listener) {
+				return this.store.subscribe(listener);
+			}
+			/** The cheap idempotent entry: kick a first read (a no-op on memory persistence). */
+			ensure() {
+				this.load();
+			}
+			/**
+			* Refresh from the Host. A call during an in-flight read marks one rerun
+			* after it settles instead of racing a second wire read.
+			* @returns settlement after this call's freshness is reflected.
+			*/
+			load() {
+				if (this.disposed || this.persistence === "memory") return Promise.resolve();
+				this.clearRetry();
+				if (this.inFlight !== void 0) {
+					this.rerun = true;
+					return this.inFlight;
+				}
+				const run = Promise.resolve().then(() => this.run());
+				this.inFlight = run;
+				return run;
+			}
+			/**
+			* Fold one write answer's namespace ROW into the held view without a wire
+			* read, and invalidate any read still in flight: a read begun before the
+			* write committed must not publish the pre-write document over it. With no
+			* held document the answer is not published as a partial document — the
+			* next read (or the failed-write recovery) picks it up.
+			* @param row - The namespace view a settings write answered with.
+			*/
+			acceptView(row) {
+				const before = this.store.getSnapshot();
+				this.generation += 1;
+				if (this.inFlight !== void 0) this.rerun = true;
+				if (before.view === null) return;
+				const held = before.view;
+				const namespaces = held.namespaces?.some((candidate) => candidate.ns === row.ns) ? held.namespaces.map((candidate) => candidate.ns === row.ns ? row : candidate) : [...held.namespaces ?? [], row];
+				this.store.set({
+					...before,
+					view: {
+						...held,
+						namespaces
+					}
+				});
+			}
+			async run() {
+				try {
+					for (;;) {
+						const before = this.store.getSnapshot();
+						if (before.status === "idle") this.store.set({
+							...before,
+							status: "loading"
+						});
+						this.rerun = false;
+						const generation = ++this.generation;
+						let outcome;
+						try {
+							const namespace = this.resolveRemote();
+							if (namespace === void 0) throw new Error("the settings remote namespace is not mounted");
+							const response = await namespace.describe();
+							if (response.ok) {
+								const value = response.value;
+								outcome = typeof value === "object" && value !== null ? { view: value } : { failure: "settings describe answered no view" };
+							} else outcome = { failure: response.error?.message ?? "settings describe failed" };
+						} catch (error) {
+							outcome = { failure: error instanceof Error ? error.message : String(error) };
+						}
+						if (generation !== this.generation) continue;
+						if ("view" in outcome) {
+							this.retries = 0;
+							this.store.set({
+								status: "ready",
+								view: outcome.view,
+								error: null
+							});
+						} else {
+							const held = this.store.getSnapshot();
+							this.store.set({
+								status: held.view === null ? "idle" : "ready",
+								view: held.view,
+								error: outcome.failure
+							});
+							if (held.view === null) this.scheduleRetry();
+						}
+						if (!this.rerun) break;
+					}
+				} finally {
+					this.inFlight = void 0;
+				}
+			}
+			/**
+			* Schedule the next retry of a failed FIRST read ({@link SETTINGS_DESCRIBE_RETRY_MS}).
+			* Bounded: once the ladder is spent the scope keeps its degraded snapshot,
+			* exactly as before, until an invalidation or a namespace re-mount arrives.
+			*/
+			scheduleRetry() {
+				if (this.disposed || this.retries >= SETTINGS_DESCRIBE_RETRY_MS.length) return;
+				const delay = SETTINGS_DESCRIBE_RETRY_MS[this.retries];
+				this.retries += 1;
+				this.retryHandle = this.timer.set(() => {
+					this.retryHandle = void 0;
+					this.load();
+				}, delay);
+			}
+			/** Cancel a pending retry (a live read is starting, or the scope is going away). */
+			clearRetry() {
+				if (this.retryHandle !== void 0) this.timer.clear(this.retryHandle);
+				this.retryHandle = void 0;
+			}
+			/** Stop the mirror: no further reads, and no retry may fire after disposal. */
+			dispose() {
+				this.disposed = true;
+				this.clearRetry();
+			}
+		};
+		/**
+		* One namespace's derived scope over the shared mirror, plus its serialized
+		* Host writes. This is the face `CommandCodeSettingsController` consumes
+		* (`getSnapshot` / `subscribe` / `set` / `unset`), so the controller itself
+		* needs no changes for either generation.
+		*/
+		var RemoteSettingsScope = class {
+			resolveRemote;
+			store;
+			mirror;
+			namespace;
+			persistence;
+			tail = Promise.resolve();
+			writeGeneration = 0;
+			disposed = false;
+			unsubscribe;
+			/** Revision answered by a superseded write still ahead of the mirror. */
+			pendingRevision;
+			constructor(resolveRemote, mirror, namespace, persistence) {
+				this.resolveRemote = resolveRemote;
+				this.mirror = mirror;
+				this.namespace = namespace;
+				this.persistence = persistence;
+				this.store = createSnapshotStore({
+					status: persistence === "host" ? "loading" : "unavailable",
+					value: void 0,
+					base: void 0,
+					user: void 0,
+					revision: void 0,
+					writable: false,
+					mode: persistence
+				});
+				if (persistence === "host") {
+					this.unsubscribe = mirror.subscribe(() => {
+						this.derive();
+					});
+					this.derive();
+				}
+			}
+			getSnapshot() {
+				return this.store.getSnapshot();
+			}
+			subscribe(listener) {
+				return this.store.subscribe(listener);
+			}
+			/** Queue one field write (the single-path `set` op form). */
+			set(field, value) {
+				return this.mutate([{
+					op: "set",
+					path: [field],
+					value
+				}]);
+			}
+			/** Queue one field clear (the single-path `unset` op form). */
+			unset(field) {
+				return this.mutate([{
+					op: "unset",
+					path: [field]
+				}]);
+			}
+			/**
+			* Queue one atomic namespace mutation behind the single-flight fence.
+			* A rejected write (e.g. `SETTINGS_CONFLICT`) re-reads the Host so the
+			* snapshot reports what actually landed; an accepted one folds its answer
+			* in directly — unless a newer write already superseded it, in which case
+			* that answer's revision becomes the next write's fence.
+			*/
+			mutate(ops, expectedRevision) {
+				const ownedOps = structuredClone(ops);
+				const generation = ++this.writeGeneration;
+				return this.enqueue(async () => {
+					const revision = expectedRevision ?? this.pendingRevision ?? this.getSnapshot().revision;
+					const response = await this.mutateRemote(ownedOps, revision);
+					if (!response.ok) {
+						await this.recover(generation);
+						return;
+					}
+					if (this.disposed) return;
+					const row = response.value;
+					if (generation === this.writeGeneration) {
+						this.pendingRevision = void 0;
+						this.mirror.acceptView(row);
+					} else this.pendingRevision = typeof row.revision === "number" ? row.revision : void 0;
+				});
+			}
+			async mutateRemote(ops, revision) {
+				try {
+					const namespace = this.resolveRemote();
+					if (namespace === void 0) return {
+						ok: false,
+						error: { message: "the settings remote namespace is not mounted" }
+					};
+					return await namespace.mutate(this.namespace, ops, revision);
+				} catch (error) {
+					return {
+						ok: false,
+						error: { message: error instanceof Error ? error.message : String(error) }
+					};
+				}
+			}
+			/** Reload Host state for the latest failed write; superseded failures leave recovery to it. */
+			async recover(generation) {
+				if (this.disposed || generation !== this.writeGeneration) return;
+				this.pendingRevision = void 0;
+				await this.mirror.load();
+			}
+			/** Derive this namespace's snapshot from the mirror's held view. */
+			derive() {
+				if (this.disposed) return;
+				const mirrored = this.mirror.getSnapshot();
+				if (mirrored.view === null || mirrored.view === void 0) return;
+				const writable = mirrored.view.writable === true;
+				const row = mirrored.view.namespaces?.find((candidate) => candidate.ns === this.namespace);
+				if (row === void 0) {
+					this.publish({
+						status: "unavailable",
+						writable
+					});
+					return;
+				}
+				const decoded = decodeRow(row.value);
+				if (decoded === void 0) return;
+				this.publish({
+					status: "ready",
+					writable,
+					value: decoded,
+					base: row.base,
+					user: row.user,
+					revision: typeof row.revision === "number" ? row.revision : void 0
+				});
+			}
+			/** Publish `next` over the current snapshot, skipping the write when nothing changed. */
+			publish(next) {
+				const current = this.store.getSnapshot();
+				const candidate = {
+					status: next.status,
+					value: "value" in next ? next.value : current.value,
+					base: "base" in next ? next.base : current.base,
+					user: "user" in next ? next.user : current.user,
+					revision: "revision" in next ? next.revision : current.revision,
+					writable: next.writable,
+					mode: current.mode
+				};
+				if (sameSnapshot(candidate, current)) return;
+				this.store.set(candidate);
+			}
+			/** Queue operations one at a time; memory persistence and disposal are no-ops. */
+			enqueue(operation) {
+				if (this.persistence === "memory" || this.disposed) return Promise.resolve();
+				const task = this.tail.then(async () => {
+					if (this.disposed) return;
+					await operation();
+				});
+				this.tail = task.catch(() => {});
+				return task;
+			}
+			/** Stop queued operations, stop deriving, and wait for the current wire call to settle. */
+			async dispose() {
+				this.disposed = true;
+				this.writeGeneration += 1;
+				this.unsubscribe?.();
+				await this.tail;
+			}
+		};
+		/**
+		* Build the plugin's settings scope for one namespace.
+		*
+		* Subscribes the two signals that can move the Host view — the forwarded
+		* `settings/document-updated` invalidation and (when the client exposes it)
+		* `connection/reset` — kicks the first describe read, and derives the
+		* namespace row on every mirror change.
+		*
+		* `resolveRemote` is the INJECT-CAPTURED namespace (see
+		* {@link SettingsRemoteResolver}): `remote.settings` is a Cordis service nested
+		* under `remote`, so a read through our own context throws and has to be
+		* replaced by an object captured inside `ctx.inject(['remote.settings'], …)`.
+		* The caller that owns that inject calls {@link ManagedSettingsScope.refresh}
+		* once the namespace lands, which is what turns the first, namespace-less read
+		* into a served one; a profile that never mounts the namespace leaves the page
+		* in its degraded (`unavailable`, read-only) state instead of throwing.
+		*
+		* @param context - The client context slice (only the declared `remote` service is read).
+		* @param namespace - Settings namespace (profile entry id) this scope binds.
+		* @param resolveRemote - Reads the inject-captured `remote.settings` namespace.
+		* @returns The scope plus the refresh/dispose handles the entry wires into its fiber.
+		*/
+		function createSettingsScope(context, namespace, resolveRemote, timer = REAL_SETTINGS_TIMER) {
+			const loopback = context.remote.$host?.isLoopback === true;
+			const persistence = loopback ? "host" : "memory";
+			const mirror = new SettingsDescribeMirror(resolveRemote, persistence, timer);
+			const scope = new RemoteSettingsScope(resolveRemote, mirror, namespace, persistence);
+			const disposers = [];
+			if (loopback) {
+				if (typeof context.remote.$on === "function") {
+					const off = context.remote.$on("settings/document-updated", () => {
+						mirror.ensure();
+					});
+					if (typeof off === "function") disposers.push(off);
+				}
+				if (typeof context.on === "function") {
+					const off = context.on("connection/reset", () => {
+						mirror.load();
+					});
+					if (typeof off === "function") disposers.push(off);
+				}
+				mirror.ensure();
+			}
+			return {
+				getSnapshot: () => scope.getSnapshot(),
+				subscribe: (listener) => scope.subscribe(listener),
+				set: (field, value) => scope.set(field, value),
+				unset: (field) => scope.unset(field),
+				refresh: () => {
+					mirror.load();
+				},
+				dispose: async () => {
+					for (const dispose of disposers.splice(0)) dispose();
+					mirror.dispose();
+					await scope.dispose();
+				}
+			};
+		}
+		//#endregion
 		//#region src/client/settings.ts
 		/**
 		* Browser controller for the "Command Code" settings page.
@@ -56,10 +474,14 @@ window.__ModuleLoader__.load({
 		*   - Working dir, request/stream timeouts -> the same namespace.
 		*
 		* The controller mirrors the plugin-card pattern from the harness's own
-		* settings UI: it binds the `llm-commandcode` namespace through the
-		* `settingsScope` service, keeps a staged draft of edits, and writes them on
-		* save through `scope.set` / the credentials domain. The Host stays the
-		* single fact source; the snapshot is republished after each accepted write.
+		* settings UI: it binds the `llm-commandcode` namespace through a
+		* `SettingsScope` — this plugin's own binding of `remote.settings` (see
+		* `./settings-scope.ts`; the harness's `settingsScope` wrapper existed only
+		* through 0.1.6 and was removed with the 0.1.7 settings rewrite, while the
+		* wire underneath spans every supported release) — keeps a staged draft of
+		* edits, and writes them on save through `scope.set` / the credentials
+		* domain. The Host stays the single fact source; the snapshot is republished
+		* after each accepted write.
 		*
 		* This module is deliberately free of JSX — it only produces the state face
 		* the React component renders.
@@ -164,6 +586,16 @@ window.__ModuleLoader__.load({
 			booleanField$1("filterModelsByPlan"),
 			booleanField$1("webSearch"),
 			booleanField$1("showSidebarQuota"),
+			booleanField$1("commandGuard"),
+			numberField$1("commandGuardThreshold", {
+				min: .5,
+				max: 1
+			}),
+			numberField$1("commandGuardTimeoutMs", {
+				min: 200,
+				max: 1e4
+			}),
+			booleanField$1("zdr"),
 			textField("activeAccount")
 		];
 		/** Whether two model-id lists are equal as sets (order-insensitive). */
@@ -318,6 +750,10 @@ window.__ModuleLoader__.load({
 					filterModelsByPlan: this.field("filterModelsByPlan"),
 					webSearch: this.field("webSearch"),
 					showSidebarQuota: this.field("showSidebarQuota"),
+					commandGuard: this.field("commandGuard"),
+					commandGuardThreshold: this.field("commandGuardThreshold"),
+					commandGuardTimeoutMs: this.field("commandGuardTimeoutMs"),
+					zdr: this.field("zdr"),
 					sidebarQuota: this.sectionValue("showSidebarQuota") === true,
 					activeAccount: this.field("activeAccount"),
 					accounts,
@@ -2157,7 +2593,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region package.json
-		var version = "0.11.8";
+		var version = "0.11.10";
 		var repository = {
 			"type": "git",
 			"url": "git+https://github.com/Mars-Sea/dsh-commandcode-provider.git"
@@ -2359,7 +2795,11 @@ window.__ModuleLoader__.load({
 			"transportMaxRetries",
 			"filterModelsByPlan",
 			"webSearch",
-			"showSidebarQuota"
+			"showSidebarQuota",
+			"commandGuard",
+			"commandGuardThreshold",
+			"commandGuardTimeoutMs",
+			"zdr"
 		];
 		/** One labelled field row in the page body. */
 		function Field({ id, label, hint, state, disabled, numeric, placeholder, onEdit, onReset, t }) {
@@ -2545,6 +2985,49 @@ window.__ModuleLoader__.load({
 								onEdit: (text) => onEdit("showSidebarQuota", text),
 								onReset: () => onReset("showSidebarQuota"),
 								t
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)(ToggleField, {
+								id: "cc-command-guard",
+								label: t("commandGuard"),
+								hint: t("commandGuardHint"),
+								state: state.commandGuard,
+								disabled,
+								defaultChecked: false,
+								onEdit: (text) => onEdit("commandGuard", text),
+								onReset: () => onReset("commandGuard"),
+								t
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Field, {
+								id: "cc-command-guard-threshold",
+								label: t("commandGuardThreshold"),
+								hint: t("commandGuardThresholdHint"),
+								state: state.commandGuardThreshold,
+								disabled,
+								onEdit: (text) => onEdit("commandGuardThreshold", text),
+								onReset: () => onReset("commandGuardThreshold"),
+								t
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Field, {
+								id: "cc-command-guard-timeout",
+								label: t("commandGuardTimeoutMs"),
+								hint: t("commandGuardTimeoutMsHint"),
+								state: state.commandGuardTimeoutMs,
+								disabled,
+								numeric: true,
+								onEdit: (text) => onEdit("commandGuardTimeoutMs", text),
+								onReset: () => onReset("commandGuardTimeoutMs"),
+								t
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)(ToggleField, {
+								id: "cc-zdr",
+								label: t("zdr"),
+								hint: t("zdrHint"),
+								state: state.zdr,
+								disabled,
+								defaultChecked: false,
+								onEdit: (text) => onEdit("zdr", text),
+								onReset: () => onReset("zdr"),
+								t
 							})
 						]
 					}) : null,
@@ -2812,13 +3295,21 @@ window.__ModuleLoader__.load({
 					report.blocked !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "cc-usageBlocked",
 						role: "alert",
-						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-							className: "cc-usageBlockedTitle",
-							children: blockedTitle(report.blocked, t)
-						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-							className: "cc-usageBlockedHint",
-							children: blockedHint(report.blocked, t)
-						})]
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "cc-usageBlockedTitle",
+								children: blockedTitle(report.blocked, t)
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "cc-usageBlockedHint",
+								children: blockedHint(report.blocked, t)
+							}),
+							report.failures.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "cc-usageBlockedDetail",
+								title: report.failures.join("; "),
+								children: report.failures.join(" · ")
+							}) : null
+						]
 					}) : null,
 					report.usage !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "cc-usageStats",
@@ -4122,21 +4613,23 @@ window.__ModuleLoader__.load({
 		}
 		/** The report-level failure box, or undefined when the report is usable. */
 		function failureView(state) {
-			const blocked = state.report?.accounts.find((entry) => entry.report.blocked !== void 0)?.report.blocked;
+			const blockedEntry = state.report?.accounts.find((entry) => entry.report.blocked !== void 0);
+			const blocked = blockedEntry?.report.blocked;
+			const detail = (blockedEntry?.report.failures ?? []).join(" · ");
 			if (blocked === "invalid-key") return {
 				title: "errorInvalidKey",
 				hint: "errorInvalidKeyHint",
-				detail: ""
+				detail
 			};
 			if (blocked === "service-unavailable") return {
 				title: "errorServiceUnavailable",
 				hint: "errorServiceUnavailableHint",
-				detail: ""
+				detail
 			};
 			if (blocked === "network") return {
 				title: "errorNetwork",
 				hint: "errorNetworkHint",
-				detail: ""
+				detail
 			};
 			if (state.status === "error" && state.report === void 0) return {
 				title: "errorGeneric",
@@ -5791,6 +6284,7 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 .cc-usageBlocked{border:1px solid var(--dsw-alias-label-error);border-radius:10px;padding:10px 12px;display:flex;flex-direction:column;gap:4px}
 .cc-usageBlockedTitle{color:var(--dsw-alias-label-error);margin:0;font-size:13px;font-weight:600;line-height:1.5}
 .cc-usageBlockedHint{color:var(--dsw-alias-label-secondary);margin:0;font-size:12px;line-height:1.5}
+.cc-usageBlockedDetail{color:var(--dsw-alias-label-secondary);margin:0;font-size:11px;line-height:1.5;word-break:break-word;opacity:.85}
 .cc-version{margin:4px 0 0;text-align:center;color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:1.5}
 /* The Models-page provider panel root: unstyled by design — the row card the
  * Models page owns supplies the surface, the panel only stacks its controls. */
@@ -6017,6 +6511,14 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 			webSearchHint: "开启后，dsh 的 web_search 工具由 Command Code 承担（复用同一个 API key 与地址），并优先于其他搜索后端；关闭则把选择权交还给之前的后端（如 modsearch），而不是强制回退到 DeepSeek 搜索。",
 			showSidebarQuota: "在侧边栏显示额度卡片",
 			showSidebarQuotaHint: "开启后，侧边栏底部（Settings 上方）显示 Command Code 套餐与配额卡片，点击可在中间栏打开完整仪表盘。默认关闭：左侧不显示任何额度信息，也不会为其后台刷新用量。保存后立即生效。",
+			commandGuard: "AI 命令安全预判",
+			commandGuardHint: "命令确认弹窗前，先由 typesafe/jev 判断它是否安全：安全就自动放行，其余照常弹窗。默认关闭。",
+			commandGuardThreshold: "自动放行阈值（0.5–1）",
+			commandGuardThresholdHint: "typesafe/jev 判定\"安全\"的概率达到该值即放行，默认 0.9。",
+			commandGuardTimeoutMs: "判定超时（毫秒，200–10000）",
+			commandGuardTimeoutMsHint: "typesafe/jev 超过该时间未返回就照常弹窗，默认 1500。",
+			zdr: "零数据保留（ZDR）",
+			zdrHint: "开启后，请求只经由不留存提示词与回复、也不用于训练的上游（等价于 CLI 的 CMD_ZDR=1）。没有可用 ZDR 上游的模型会返回错误，请换用其他模型或关闭此开关。ZDR 容量按上游实价透传，通常更贵；费用读数仍按常规目录价估算。默认关闭。",
 			accountsTitle: "多账户轮换",
 			accountsHint: "当前账户达到用量限额（429）或密钥失效（401）时，请求自动切换到下一个账户；全部耗尽时会提示最早的重置时间。",
 			accountAdd: "添加账户",
@@ -6153,6 +6655,14 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 			webSearchHint: "When on, the model-facing web_search tool is backed by Command Code (same API key and base URL as chat), winning over other search backends. Off hands the selection back to the previous backend (e.g. modsearch) instead of forcing the shipped DeepSeek search.",
 			showSidebarQuota: "Show the quota card in the sidebar",
 			showSidebarQuotaHint: "When on, a Command Code plan & quota card sits at the bottom of the sidebar (above Settings) and opens the full dashboard in the centre column. Off by default: nothing is shown on the left, and no background usage poll runs for it. Applies on save.",
+			commandGuard: "AI command guard",
+			commandGuardHint: "Before a shell command asks for approval, typesafe/jev judges whether it is safe: safe commands run without a prompt, everything else asks as usual. Off by default.",
+			commandGuardThreshold: "Auto-approve threshold (0.5–1)",
+			commandGuardThresholdHint: "Approve when typesafe/jev rates the command \"safe\" at least this likely; default 0.9.",
+			commandGuardTimeoutMs: "Judgement timeout (ms, 200–10000)",
+			commandGuardTimeoutMsHint: "If typesafe/jev does not answer in time, the normal prompt appears; default 1500.",
+			zdr: "Zero data retention (ZDR)",
+			zdrHint: "Serve requests only through upstreams that keep no prompts or completions and never train on them (the same opt-in as the CLI's CMD_ZDR=1). A few models have no ZDR upstream; requests for those models fail rather than losing ZDR protection. ZDR capacity is billed at the upstream's pass-through rates and usually costs more; the cost readout keeps quoting the ordinary catalog rates. Off by default.",
 			accountsTitle: "Account rotation",
 			accountsHint: "When the active account hits its usage limit (429) or its key fails (401), requests switch to the next account; when every account is exhausted the error names the earliest window reset.",
 			accountAdd: "Add account",
@@ -6314,9 +6824,11 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 		const SESSION_COST_ID = "commandcode-session-cost";
 		/**
 		* Client plugin body. Gates on the services shared by both client generations
-		* (`slots`, `locale`, `connection`, `remote`, `settingsScope`). Current clients
-		* mount the page after `remote.credentials` appears; legacy clients mount it
-		* from the connection ApiProxy credential face.
+		* (`slots`, `locale`, `connection`, `remote`) — never on `settingsScope`,
+		* which 0.1.7 removed and which the settings scope here replaces for every
+		* generation. Current clients mount the page after `remote.credentials`
+		* appears; legacy clients mount it from the connection ApiProxy credential
+		* face.
 		*/
 		function apply(ctx) {
 			injectPageCss();
@@ -6341,7 +6853,18 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 		}
 		/** Mount the one shared UI implementation over either credential transport. */
 		function applyClientSurfaces(ctx, api, hostDescription) {
-			const scope = ctx.settingsScope.bind({ namespace: COMMANDCODE_NS });
+			let settingsNamespace;
+			const scope = createSettingsScope(ctx, COMMANDCODE_NS, () => settingsNamespace);
+			ctx.effect(() => () => {
+				scope.dispose();
+			}, "dsh-commandcode-provider: settings scope");
+			ctx.inject(["remote.settings"], (settingsCtx) => {
+				settingsNamespace = settingsCtx.remote.settings;
+				scope.refresh();
+				settingsCtx.effect(() => () => {
+					settingsNamespace = void 0;
+				}, "dsh-commandcode-provider: settings namespace");
+			});
 			let modelsRemote;
 			const controller = new CommandCodeSettingsController(scope, {
 				...api,
@@ -6359,6 +6882,7 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 			let usageNamespace;
 			let usageMountError;
 			let pricesController;
+			let refreshUsage;
 			const contribution = {
 				package: USAGE_REMOTE_CONTRIBUTION.package,
 				descriptors: [
@@ -6381,6 +6905,7 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 						usageNamespace = namespaceCtx.remote.commandcode;
 						controller.refreshCatalog();
 						pricesController?.reload();
+						refreshUsage?.();
 						namespaceCtx.effect(() => () => {
 							usageNamespace = void 0;
 						}, "dsh-commandcode-provider: usage namespace");
@@ -6430,6 +6955,7 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 			};
 			modelsRemote = () => usageRemote.models();
 			const usageController = new CommandCodeUsageController(usageRemote);
+			refreshUsage = () => void usageController.refresh();
 			ctx.effect(() => () => usageController.dispose(), "dsh-commandcode-provider: usage controller");
 			const usageStore = createSnapshotStore(usageController.state());
 			usageController.subscribe(() => usageStore.set(usageController.state()));
@@ -6596,8 +7122,7 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 			"slots",
 			"locale",
 			"connection",
-			"remote",
-			"settingsScope"
+			"remote"
 		];
 		//#endregion
 		exports.apply = apply;