@mars-sea/dsh-commandcode-provider 0.11.8 → 0.11.10

package/lib/index.js

@@ -1,4 +1,4 @@
-import { homedir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { MAX_TIMER_DELAY_MS } from "@deepseek-ai/dsh-timeout";
@@ -6,7 +6,7 @@ import * as dshLlm from "@deepseek-ai/dsh-llm";
 import { CONTEXT_WINDOW_EXCEEDED_CODE, LlmAdapter, LlmError, ReasoningEffortId, ToolCallId, assertUsableApiKey, attributionHeaders, errorChain, isContextWindowExceededError, offloadedImageText, resolveRetryPolicy, textOnlyImageText } from "@deepseek-ai/dsh-llm";
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
 import { launchEnvironmentOf } from "@deepseek-ai/dsh-launch-environment";
-import { existsSync, readFileSync } from "node:fs";
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { randomBytes, randomUUID } from "node:crypto";
 import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
@@ -284,6 +284,27 @@ const KNOWN_EFFORTS = {
 		"xhigh",
 		"max"
 	],
+	"claude-opus-5-5": [
+		"low",
+		"medium",
+		"high",
+		"xhigh",
+		"max"
+	],
+	"gpt-6-luna": [
+		"low",
+		"medium",
+		"high",
+		"xhigh",
+		"max"
+	],
+	"gpt-6-sol": [
+		"low",
+		"medium",
+		"high",
+		"xhigh",
+		"max"
+	],
 	"MiniMaxAI/MiniMax-M3": [
 		"low",
 		"medium",
@@ -320,6 +341,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"claude-haiku-4-5-20251001",
 	"claude-opus-4-7",
 	"claude-opus-4-8",
+	"claude-opus-5-5",
 	"claude-opus-5",
 	"claude-sonnet-4-6",
 	"claude-sonnet-5",
@@ -339,6 +361,8 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"gpt-5.6-sol",
 	"gpt-5.6-terra",
 	"gpt-6-astra",
+	"gpt-6-luna",
+	"gpt-6-sol",
 	"meta/muse-spark-1.1",
 	"meta/muse-spark-1.2",
 	"meta/muse-spark-1.2-contributor",
@@ -365,6 +389,69 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"z-ai/glm-5.3-flashx"
 ]);
 /**
+* Models WITHOUT a zero-data-retention upstream, per the official CLI's own
+* registry (`command-code@1.64.0` `dist/cli.mjs`: `modelSupportsZdr(id)` is
+* exactly `!nonZdrSet.has(canonicalize(id))`, and `knownModelSupportsZdr`
+* carries the same membership in the sibling route table — the union is this
+* set). The official docs (commandcode.ai/docs/resources/zdr) put it in prose
+* — "99% of our models have ZDR-capable upstreams … only a small handful of
+* models are affected" — so the CLI's exclusion list is the only per-model
+* evidence there is; a ZDR request naming one of these fails with HTTP 422
+* `cmd_zdr_no_providers` instead of routing through a provider that retains.
+*
+* Why a NEGATIVE set, and why "not listed" answers TRUE: 99% of the catalog is
+* covered, so the maintained difference is the exception list. This helper is
+* informational; the adapter sends the ZDR header for EVERY request when the
+* switch is on. The provider remains the routing authority and refuses an
+* unsupported model rather than silently dropping the privacy guarantee.
+*
+* `minimax/minimax-m3-free` is the one entry the public catalog
+* (`/provider/v1/models`) does not serve (it is CLI/pricing-visible and hidden
+* from the picker); it stays listed because the CLI carries it and a Go-plan
+* request can still name it.
+*
+* Keep in sync via the dsh-commandcode-upstream skill: the CLI's registry data
+* (its `zdr:{only:[…]}` provider routes and the per-provider `zdr`/`noTraining`
+* flags) is upstream-internal routing, not a per-model contract, so this table
+* is the snapshot of the exclusion set and nothing more. The 1.62.0 → 1.64.0
+* diff of that union is EMPTY: both anchors were extracted from both bundles
+* during the 2026-09-23 check and each carries the same 20 members — which is
+* how rare a change here is expected to be. `meituan/LongCat-2.0` is the one
+* member the two anchors disagree about (it is in `modelSupportsZdr`'s set in
+* both releases and in neither `knownModelSupportsZdr` set), so the union is
+* what this table follows; reading only the sibling route table would drop it.
+*/
+const KNOWN_NON_ZDR_MODELS = /* @__PURE__ */ new Set([
+	"MiniMaxAI/MiniMax-M3",
+	"Qwen/Qwen3.8-Max-0902",
+	"meituan/LongCat-2.0",
+	"meta/muse-spark-1.1",
+	"meta/muse-spark-1.2",
+	"meta/muse-spark-1.2-contributor",
+	"meta/muse-spark-1.3",
+	"meta/muse-spark-1.3-contributor",
+	"minimax/minimax-m3-free",
+	"poolside/laguna-s-2.1-free",
+	"sakana/fugu-ultra",
+	"stepfun/Step-3.7-Flash",
+	"stepfun/Step-5-Preview",
+	"xai/grok-4.5",
+	"xai/grok-4.6",
+	"xiaomi/mimo-v2.6-flash",
+	"xiaomi/mimo-v2.6-pro",
+	"xiaomi/mimo-v2.6-pro-ultraspeed",
+	"z-ai/glm-5.3-flashx",
+	"zai-org/GLM-5.2-Fast"
+]);
+/**
+* Whether the CLI snapshot lists a ZDR-capable upstream for `modelId`. This is
+* informational, never a reason to omit the header when ZDR is enabled: the
+* provider may add coverage or lack capacity after this snapshot was taken.
+*/
+function supportsZeroDataRetention(modelId) {
+	return !KNOWN_NON_ZDR_MODELS.has(modelId);
+}
+/**
 * Models the official CLI's model table (command-code@1.53.0) marks
 * `reasoning:!0` but defines no selectable `reasoning_effort` levels — they
 * think automatically, with Command Code driving the depth. This is the
@@ -508,6 +595,7 @@ const KNOWN_PLANS = {
 	"deepseek/deepseek-v4-flash-vision-exp": "go",
 	"deepseek/deepseek-v4-pro": "go",
 	"gpt-5.6-luna": "go",
+	"gpt-6-luna": "go",
 	"meituan/LongCat-2.0": "go",
 	"inclusionai/ling-3.0-flash-sante:free": "go",
 	"meta/muse-spark-1.2-contributor": "go",
@@ -558,11 +646,13 @@ const KNOWN_PLANS = {
 	"gpt-5.4-mini": "pro",
 	"gpt-5.5": "pro",
 	"gpt-5.6-terra": "pro",
+	"gpt-6-sol": "pro",
 	"meta/muse-spark-1.1": "pro",
 	"claude-fable-5-1": "provider",
 	"claude-fable-5": "provider",
 	"claude-opus-4-7": "provider",
 	"claude-opus-4-8": "provider",
+	"claude-opus-5-5": "provider",
 	"claude-opus-5": "provider",
 	"gpt-6-astra": "provider",
 	"sakana/fugu-ultra": "provider"
@@ -955,6 +1045,15 @@ const MODEL_PRICE_ROWS = [
 			6.25
 		]
 	},
+	{
+		id: "claude-opus-5-5",
+		rates: [
+			4,
+			20,
+			.2,
+			5
+		]
+	},
 	{
 		id: "claude-sonnet-4-6",
 		rates: [
@@ -1274,6 +1373,52 @@ const MODEL_PRICE_ROWS = [
 			25
 		] }]
 	},
+	{
+		id: "gpt-6-luna",
+		rates: [
+			.1,
+			.5,
+			.01,
+			.125
+		],
+		contextTiers: [{
+			"maxContext": 272e3,
+			"rates": [
+				.1,
+				.5,
+				.01,
+				.125
+			]
+		}, { "rates": [
+			.2,
+			.75,
+			.02,
+			.25
+		] }]
+	},
+	{
+		id: "gpt-6-sol",
+		rates: [
+			2,
+			10,
+			.2,
+			2.5
+		],
+		contextTiers: [{
+			"maxContext": 272e3,
+			"rates": [
+				2,
+				10,
+				.2,
+				2.5
+			]
+		}, { "rates": [
+			4,
+			15,
+			.4,
+			5
+		] }]
+	},
 	{
 		id: "grok-4.5",
 		rates: [
@@ -1856,11 +2001,11 @@ function costGroupKey(group, table) {
 //#endregion
 //#region src/cost-projection.ts
 const record$2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? v : void 0;
-const finite = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
+const finite$1 = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
 function tokensOf(value) {
 	const u = record$2(value);
-	if (!u || !finite(u.inputTokens) || !finite(u.outputTokens)) return void 0;
-	if (u.cacheReadTokens !== void 0 && !finite(u.cacheReadTokens) || u.cacheWriteTokens !== void 0 && !finite(u.cacheWriteTokens)) return void 0;
+	if (!u || !finite$1(u.inputTokens) || !finite$1(u.outputTokens)) return void 0;
+	if (u.cacheReadTokens !== void 0 && !finite$1(u.cacheReadTokens) || u.cacheWriteTokens !== void 0 && !finite$1(u.cacheWriteTokens)) return void 0;
 	return {
 		uncachedInputTokens: u.inputTokens,
 		outputTokens: u.outputTokens,
@@ -1886,13 +2031,13 @@ function usageOf(type, data) {
 }
 function parseState(value) {
 	const s = record$2(value), facts = record$2(s?.facts);
-	if (!s || !facts || !finite(facts.pricingKey) || !Array.isArray(facts.groups)) throw new TypeError("invalid commandCodeCost state");
+	if (!s || !facts || !finite$1(facts.pricingKey) || !Array.isArray(facts.groups)) throw new TypeError("invalid commandCodeCost state");
 	const group = (v) => {
 		const g = record$2(v), t = record$2(g?.tokens);
-		return !!g && typeof g.provider === "string" && typeof g.model === "string" && (g.at === null || finite(g.at)) && finite(g.contextTokens) && !!t && COST_TOKEN_KEYS.every((k) => finite(t[k]));
+		return !!g && typeof g.provider === "string" && typeof g.model === "string" && (g.at === null || finite$1(g.at)) && finite$1(g.contextTokens) && !!t && COST_TOKEN_KEYS.every((k) => finite$1(t[k]));
 	};
 	const sel = record$2(s.selection), last = record$2(s.last);
-	if (!(s.selection === null || sel && typeof sel.provider === "string" && typeof sel.model === "string") || !(s.at === null || finite(s.at)) || !facts.groups.every(group) || !(s.last === null || last && finite(last.turn) && finite(last.step) && group(last.group))) throw new TypeError("invalid commandCodeCost state");
+	if (!(s.selection === null || sel && typeof sel.provider === "string" && typeof sel.model === "string") || !(s.at === null || finite$1(s.at)) || !facts.groups.every(group) || !(s.last === null || last && finite$1(last.turn) && finite$1(last.step) && group(last.group))) throw new TypeError("invalid commandCodeCost state");
 	return value;
 }
 /** Optional registry uses only synchronous parse/view; no new runtime module is required. */
@@ -1926,11 +2071,11 @@ function createCostProjection(table = modelPriceTable()) {
 			}
 			if (event.type === "step/start" || event.type === "llm/retry-started") return {
 				...state,
-				at: finite(event.time) ? event.time : null,
+				at: finite$1(event.time) ? event.time : null,
 				last: null
 			};
 			const tokens = usageOf(event.type, data);
-			if (tokens === void 0 || !finite(data.turn) || !finite(data.step)) return state;
+			if (tokens === void 0 || !finite$1(data.turn) || !finite$1(data.step)) return state;
 			const previous = state.last?.turn === data.turn && state.last.step === data.step ? state.last.group : void 0;
 			const group = {
 				provider: state.selection?.provider ?? "",
@@ -2652,6 +2797,181 @@ function scaleBy(size, factor) {
 	};
 }
 //#endregion
+//#region src/stream-trace.ts
+/**
+* Opt-in raw-stream trace for the Command Code transports.
+*
+* Why this exists: this route's failure mode of record is a response that ENDS
+* EARLY. The gateway, an intermediary proxy, or the network closes the socket
+* mid-generation, so the adapter's read loop sees `done` without ever seeing
+* the transport's terminal event. From inside the adapter those two endings are
+* indistinguishable — the provider cut the stream, a proxy timed out, or the
+* socket was dropped — and the only artifact that separates them is the raw
+* wire: which events actually arrived, when the last one landed, how long the
+* socket then sat silent, and how it ended. Without that, a truncated answer is
+* a report with no evidence attached.
+*
+* Enable it per process:
+*
+* ```sh
+* DSH_COMMANDCODE_TRACE=/tmp/cc-stream.jsonl dsh web
+* DSH_COMMANDCODE_TRACE=1 dsh web     # -> $TMPDIR/dsh-commandcode-stream.jsonl
+* ```
+*
+* Any value that is not a flag is a path, and the explicit off-spellings
+* (`0`, `false`, `no`, `off`) are recognized as "off" rather than being taken
+* for a file name.
+*
+* Every model request appends one JSONL record per raw chunk plus lifecycle
+* records (`response`, `eof`, `idle-timeout`, `read-error`, `end`,
+* `stream-close`), each stamped with `at` — milliseconds since that request's
+* first byte. The chunk records carry the provider's own payload verbatim
+* (bounded per chunk), because a truncated answer is exactly what is being
+* diagnosed: treat the file as conversation content, not as a log safe to
+* share. It never carries the request body, an API key, or any request header.
+*
+* Deliberate trade-offs:
+*  - OFF costs one `process.env` read per request.
+*  - ON appends synchronously, one file open per chunk. The trace must survive
+*    a host killed mid-diagnosis, and the microseconds it costs are irrelevant
+*    beside the seconds-scale silences it is there to measure.
+*  - A trace that cannot be written turns itself off instead of failing the
+*    request it is observing: a diagnostic must never become the outage.
+*
+* @module
+*/
+/** Environment variable that turns the trace on. */
+const STREAM_TRACE_ENV = "DSH_COMMANDCODE_TRACE";
+/** File used when the variable is set to a bare flag instead of a path. */
+const STREAM_TRACE_DEFAULT_FILE = "dsh-commandcode-stream.jsonl";
+/** One raw chunk is recorded verbatim up to this many characters. */
+const STREAM_TRACE_MAX_TEXT = 16384;
+/** Values of {@link STREAM_TRACE_ENV} that mean "trace to the default file". */
+const FLAG_VALUES = /* @__PURE__ */ new Set([
+	"1",
+	"true",
+	"yes",
+	"on"
+]);
+/**
+* Values that explicitly mean OFF.
+*
+* A user turning the trace off writes `false` as readily as they write `1` to
+* turn it on, and without this set every one of these spellings fell through to
+* "…so it must be a path" — the trace switched ON and wrote the conversation to
+* a file NAMED `false` (or `0`, or `off`) in the process's working directory.
+*/
+const OFF_VALUES = /* @__PURE__ */ new Set([
+	"0",
+	"false",
+	"no",
+	"off"
+]);
+/** The inert trace used whenever the switch is off. */
+const OFF = {
+	enabled: false,
+	record: () => void 0,
+	close: () => void 0
+};
+/**
+* Resolve the trace file for this process.
+*
+* @param raw - the variable's raw value; defaults to the live environment.
+* @returns the file to append to, or undefined when the trace is off.
+*/
+function resolveStreamTracePath(raw = process.env[STREAM_TRACE_ENV]) {
+	const value = raw?.trim();
+	if (value === void 0 || value === "") return void 0;
+	const lower = value.toLowerCase();
+	if (OFF_VALUES.has(lower)) return void 0;
+	if (FLAG_VALUES.has(lower)) return join(tmpdir(), STREAM_TRACE_DEFAULT_FILE);
+	return value;
+}
+/**
+* Clamp one recorded payload so a single chunk cannot consume the whole cap.
+*
+* @param text - the text to record.
+* @param max - characters to keep, defaulting to {@link STREAM_TRACE_MAX_TEXT}.
+* @returns `text` unchanged, or its head plus a marker naming what was dropped.
+*/
+function boundTraceText(text, max = STREAM_TRACE_MAX_TEXT) {
+	if (text.length <= max) return text;
+	return `${text.slice(0, max)}…[+${text.length - max} chars]`;
+}
+/**
+* Open one request's trace.
+*
+* @param scope - what the records describe (the `provider/model` route).
+* @param options - `path` overrides the environment (tests pass a temp file);
+*   `now` overrides the clock the `at` stamps are measured with.
+* @returns a writer that never throws and never fails the request.
+*/
+function openStreamTrace(scope, options = {}) {
+	const path = options.path ?? resolveStreamTracePath();
+	if (path === void 0) return OFF;
+	const now = options.now ?? Date.now;
+	const startedAt = now();
+	let written = 0;
+	let stopped = false;
+	let capped = false;
+	const terminals = /* @__PURE__ */ new Set();
+	try {
+		mkdirSync(dirname(path), { recursive: true });
+	} catch {
+		return OFF;
+	}
+	const write = (record) => {
+		if (stopped) return;
+		const terminal = record.event === "end" || record.event === "stream-close";
+		if (capped && !terminal) return;
+		if (terminal && terminals.has(String(record.event))) return;
+		let line;
+		try {
+			line = `${JSON.stringify({
+				at: now() - startedAt,
+				scope,
+				...record
+			})}\n`;
+		} catch {
+			return;
+		}
+		if (terminal) {
+			if (Buffer.byteLength(line) > 16384) return;
+			terminals.add(String(record.event));
+		} else if (written + Buffer.byteLength(line) > 4194304) {
+			capped = true;
+			line = `${JSON.stringify({
+				at: now() - startedAt,
+				scope,
+				event: "trace-capped",
+				bytes: written
+			})}\n`;
+		}
+		try {
+			appendFileSync(path, line);
+			written += Buffer.byteLength(line);
+		} catch {
+			stopped = true;
+		}
+	};
+	write({ event: "stream-open" });
+	return {
+		enabled: true,
+		record(event, fields) {
+			write(fields === void 0 ? { event } : {
+				event,
+				...fields
+			});
+		},
+		close() {
+			write({
+				event: "stream-close",
+				bytes: written
+			});
+		}
+	};
+}
+//#endregion
 //#region src/adapter.ts
 /**
 * DeepSeek Harness LLM adapter for the Command Code Provider API.
@@ -2674,7 +2994,7 @@ function scaleBy(size, factor) {
 * per-request options thunk and an API-key resolver from the plugin entry
 * (src/index.ts), so a settings change reaches the very next request.
 */
-const COMMAND_CODE_CLI_VERSION = "1.62.0";
+const COMMAND_CODE_CLI_VERSION = "1.64.0";
 const DEFAULT_API_BASE = "https://api.commandcode.ai";
 const DEFAULT_GENERATE_MAX_TOKENS = 64e3;
 const DEFAULT_MAX_OUTPUT_TOKENS = 65536;
@@ -2767,15 +3087,21 @@ function periodEndValue(value) {
 * Terminal stream-error markers from the official CLI (`Xw` in command-code's
 * cli.mjs): these always mean "retrying cannot succeed", so the adapter must
 * not classify them as transient server errors.
+*
+* Written with spaces rather than the CLI's underscores, because
+* {@link hasTerminalStreamMarker} normalizes the separator before matching:
+* a JSON body usually carries `premium credits exhausted` while the CLI's own
+* list is written `premium_credits_exhausted`, and both are the same refusal
+* (the pre-stream classifier normalizes identically).
 */
 const TERMINAL_STREAM_ERROR_MARKERS = [
-	"premium_credits_exhausted",
-	"model_not_in_plan",
+	"premium credits exhausted",
+	"model not in plan",
 	"insufficient credits"
 ];
 function hasTerminalStreamMarker(message) {
-	const lower = message.toLowerCase();
-	return TERMINAL_STREAM_ERROR_MARKERS.some((marker) => lower.includes(marker));
+	const normalized = message.toLowerCase().replaceAll("_", " ");
+	return TERMINAL_STREAM_ERROR_MARKERS.some((marker) => normalized.includes(marker));
 }
 /**
 * Context-window wording the provider uses to reject a request that outgrew
@@ -2792,6 +3118,19 @@ function isContextOverflowDetail(detail) {
 	return isContextWindowExceededError(detail) || CLI_CONTEXT_OVERFLOW_PATTERN.test(detail);
 }
 /**
+* Whether one rejection says "ZDR requested, no ZDR-capable upstream": the
+* provider spells the code `cmd_zdr_no_providers` in JSON error bodies and
+* `CMD_ZDR_NO_PROVIDERS` in plain-text ones (the official CLI's own
+* classifier checks both spellings, and its error text tells the user to
+* unset `CMD_ZDR`). Underscore-separated matching normalizes the separator, so
+* one comparison covers the variants — the same normalization the pre-stream
+* rejection classifier and `hasTerminalStreamMarker` already use.
+*/
+const ZDR_NO_PROVIDERS_PATTERN = /cmd[_\s-]?zdr[_\s-]?no[_\s-]?providers/i;
+function isZdrNoProviders(providerCode, providerDetail, errText) {
+	return ZDR_NO_PROVIDERS_PATTERN.test(providerCode ?? "") || ZDR_NO_PROVIDERS_PATTERN.test(providerDetail) || ZDR_NO_PROVIDERS_PATTERN.test(errText);
+}
+/**
 * Classify one in-band stream `error` payload into the failure the caller
 * throws. Shared by both transports — the CLI transport delivers it as an
 * `error` event (`{ type: 'error', error }`), the Provider API transport as a
@@ -2814,7 +3153,10 @@ function isContextOverflowDetail(detail) {
 *   (issue #39).
 * - Credits/plan wording is terminal, so an exhausted balance or a model
 *   outside the plan is not retried as if it were a transient rate limit.
-* - Only then does the status/`isRetryable` pair decide, as before.
+* - Only then does the status/`isRetryable` pair decide — and an explicit
+*   refusal (`isRetryable: false`) or a terminal marker OUTRANKS a status, so a
+*   5xx carrying "insufficient credits" stays terminal instead of entering the
+*   retry cadence as `SERVER`.
 */
 function streamErrorToLlmError(value, fallbackMessage) {
 	const record = isRecord(value) ? value : void 0;
@@ -2829,7 +3171,7 @@ function streamErrorToLlmError(value, fallbackMessage) {
 	const statusOption = statusCode !== void 0 ? { status: statusCode } : void 0;
 	if (isContextOverflowDetail(detail)) return new LlmError(`Command Code stream error: ${message}；Command Code API 拒绝了这次请求：内容超出模型上下文窗口。正在压缩上下文后重试；如仍失败，请新建会话或减少上下文`, CONTEXT_WINDOW_EXCEEDED_CODE, statusOption);
 	const terminal = hasTerminalStreamMarker(detail);
-	if (!(isRetryable === true || (statusCode !== void 0 ? statusCode !== void 0 && (statusCode === 429 || statusCode >= 500) : isRetryable !== false && !terminal))) return new LlmError(`Command Code stream error: ${message}`, "PROVIDER_STREAM_ERROR", statusOption);
+	if (!(isRetryable === true || (isRetryable === false || terminal ? false : statusCode !== void 0 ? statusCode !== void 0 && (statusCode === 429 || statusCode >= 500) : true))) return new LlmError(`Command Code stream error: ${message}`, "PROVIDER_STREAM_ERROR", statusOption);
 	return new LlmError(`Command Code stream error: ${message}`, "SERVER", statusOption);
 }
 function recordOrEmpty(value) {
@@ -3033,42 +3375,32 @@ async function writeModelsCache(cachePath, models) {
 	}
 }
 /**
-* Whether an inbound message is a tool RESULT — a `user`-role message the
-* producer tagged with `source: { kind: 'tool' }`.
-*
-* The tag is read defensively because it is PRODUCER-supplied and nothing
-* validates it: dsh-llm's `Message` type declares `source` required, but the
-* runtime never checks it and every adapter shipped before this one ignored the
-* field outright (`dsh-llm-deepseek` never reads it). A third-party plugin that
-* assembles its own history can therefore omit it and run correctly everywhere
-* else — dsh-mneme's memory pipeline did — which made this adapter, the first
-* to actually read the field, the first to crash on such a message with
-* `TypeError: Cannot read properties of undefined (reading 'kind')` in the
-* serialization phase, 0–8 ms in, before any request left the machine and with
-* nothing in the error naming the message or the producer (issue #47).
-*
-* Two rules keep an untagged message from costing the turn:
-*
-*  - A PRESENT tag is authoritative. `kind: 'user'`, `'model'`, `'plugin'` or
-*    any producer-added kind means "not a tool result", whatever the content
-*    looks like — the tag answers *who produced this*.
-*  - An ABSENT tag falls back to the content shape. A `user` message whose
-*    first block is a `tool-result` is a tool result by the harness's own
-*    definition (`ToolResultMessage` is exactly that shape with a
-*    `ToolMessageSource`), and the fallback is not cosmetic: `pairedToolCalls()`
-*    counts a `tool-result` block from ANY message, so classifying such a
-*    message as a plain user message would drop it at emission while its call
-*    still counted as paired — leaving the assistant's tool call unanswered on
-*    the wire, which the gateway rejects outright. FIRST block, not "any block":
-*    the tool-result branch reads `content[0]` and skips anything else, so
-*    claiming a mixed message as a tool result would discard its other blocks
-*    instead of sending them.
-*/
-function isToolResultMessage(message) {
-	if (message.role !== "user") return false;
+* >=0.1.7 puts toolCallId/isError on a role:'tool' message and carries raw
+* content blocks. Older engines wrap those fields in the first tool-result
+* block of a role:'user' message. Read structurally so the bundle still builds
+* and loads against older peers. Pairing and emission MUST use this same view:
+* otherwise a dropped result either drops its call too (making the model
+* forget completed work), or leaves an unanswered call on the wire.
+*
+* For the legacy envelope a present source tag remains authoritative; an
+* absent tag falls back to the first block (issue #47). The modern role is
+* itself the discriminator, as it is for the Harness's own serializers.
+*/
+function toolResultOf(message) {
+	const current = message;
+	if (current.role === "tool") {
+		if (typeof current.toolCallId !== "string" || current.toolCallId === "") return void 0;
+		return {
+			toolCallId: current.toolCallId,
+			isError: current.isError ?? false,
+			content: current.content
+		};
+	}
+	if (message.role !== "user") return void 0;
 	const kind = message.source?.kind;
-	if (kind !== void 0) return kind === "tool";
-	return message.content?.[0]?.type === "tool-result";
+	if (kind !== void 0 && kind !== "tool") return void 0;
+	const block = message.content[0];
+	return block?.type === "tool-result" ? block : void 0;
 }
 /**
 * Collect the tool calls that have a paired tool result, plus each call's
@@ -3081,12 +3413,13 @@ function pairedToolCalls(messages) {
 	const callIds = /* @__PURE__ */ new Set();
 	const names = /* @__PURE__ */ new Map();
 	const resultIds = /* @__PURE__ */ new Set();
-	for (const message of messages) for (const block of message.content) {
-		if (message.role === "assistant" && block.type === "tool-call") {
+	for (const message of messages) {
+		const result = toolResultOf(message);
+		if (result) resultIds.add(result.toolCallId);
+		for (const block of message.content) if (message.role === "assistant" && block.type === "tool-call") {
 			callIds.add(block.id);
 			names.set(block.id, block.name);
 		}
-		if (block.type === "tool-result") resultIds.add(block.toolCallId);
 	}
 	return {
 		ids: new Set([...callIds].filter((id) => resultIds.has(id))),
@@ -3394,7 +3727,8 @@ async function messagesToCC(messages, readImage) {
 	};
 	for (const message of messages) {
 		if (message.role === "system") continue;
-		if (message.role === "user" && !isToolResultMessage(message)) {
+		const result = toolResultOf(message);
+		if (message.role === "user" && !result) {
 			flushPendingImages();
 			const parts = [];
 			for (const block of message.content) {
@@ -3437,18 +3771,17 @@ async function messagesToCC(messages, readImage) {
 			});
 			continue;
 		}
-		if (isToolResultMessage(message)) {
-			const block = message.content[0];
-			if (!block || block.type !== "tool-result" || !paired.has(block.toolCallId)) continue;
-			const media = toolResultMedia(block);
-			const wireToolCallId = wireIds.get(block.toolCallId) ?? block.toolCallId;
+		if (result) {
+			if (!paired.has(result.toolCallId)) continue;
+			const media = toolResultMedia(result);
+			const wireToolCallId = wireIds.get(result.toolCallId) ?? result.toolCallId;
 			out.push({
 				role: "tool",
 				content: [{
 					type: "tool-result",
 					toolCallId: wireToolCallId,
-					toolName: toolNames.get(block.toolCallId) || "unknown",
-					output: block.isError ? {
+					toolName: toolNames.get(result.toolCallId) || "unknown",
+					output: result.isError ? {
 						type: "error-text",
 						value: toolResultTextForWire(media)
 					} : {
@@ -3506,7 +3839,8 @@ async function messagesToOpenAI(messages, readImage) {
 	};
 	for (const message of messages) {
 		if (message.role === "system") continue;
-		if (message.role === "user" && !isToolResultMessage(message)) {
+		const result = toolResultOf(message);
+		if (message.role === "user" && !result) {
 			flushPendingImages();
 			const parts = [];
 			for (const block of message.content) {
@@ -3552,11 +3886,10 @@ async function messagesToOpenAI(messages, readImage) {
 			out.push(assistant);
 			continue;
 		}
-		if (isToolResultMessage(message)) {
-			const block = message.content[0];
-			if (!block || block.type !== "tool-result" || !paired.has(block.toolCallId)) continue;
-			const media = toolResultMedia(block);
-			const wireToolCallId = wireIds.get(block.toolCallId) ?? block.toolCallId;
+		if (result) {
+			if (!paired.has(result.toolCallId)) continue;
+			const media = toolResultMedia(result);
+			const wireToolCallId = wireIds.get(result.toolCallId) ?? result.toolCallId;
 			out.push({
 				role: "tool",
 				tool_call_id: wireToolCallId,
@@ -3761,6 +4094,7 @@ async function connectGenerate(deps, key, protocol, body) {
 		if (options.signal) options.signal.removeEventListener("abort", onCallerAbort);
 	};
 	let response;
+	const zdr = connection.zdr === true;
 	const headers = protocol === "cli" ? {
 		"Content-Type": "application/json",
 		Authorization: `Bearer ${key}`,
@@ -3769,11 +4103,13 @@ async function connectGenerate(deps, key, protocol, body) {
 		"x-project-slug": projectSlugFromPath(connection.workingDir),
 		"x-taste-learning": "true",
 		"x-co-flag": "false",
+		...zdr ? { "x-cmd-zdr": "1" } : {},
 		...attributionHeaders()
 	} : {
 		"Content-Type": "application/json",
 		Authorization: `Bearer ${key}`,
 		Accept: "text/event-stream",
+		...zdr ? { "x-cmd-zdr": "1" } : {},
 		...attributionHeaders()
 	};
 	try {
@@ -3817,6 +4153,7 @@ function createBlockAssembler() {
 		reasoningIndex: -1,
 		reasoningContent: "",
 		sawContent: false,
+		finishReason: void 0,
 		openAiToolCalls: []
 	};
 }
@@ -4036,8 +4373,10 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	/** The headers every authenticated account endpoint shares. */
 	async accountHeaders(apiKey) {
 		const connection = this.deps.options();
+		const raw = apiKey ?? await this.deps.resolveApiKey(connection);
+		const named = connection.apiKeyEnv;
 		return {
-			Authorization: `Bearer ${apiKey ?? await this.deps.resolveApiKey(connection)}`,
+			Authorization: `Bearer ${assertUsableApiKey(raw, "llm-commandcode", typeof named === "string" && named !== "" ? named : "the stored credential")}`,
 			"x-command-code-version": COMMAND_CODE_CLI_VERSION,
 			"x-cli-environment": "production",
 			...attributionHeaders()
@@ -4049,11 +4388,16 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	* failure accounting: the billing probe fails open silently, the usage
 	* report books failures per endpoint. Non-2xx and non-record bodies come
 	* back without a record; only a transport throw propagates to the caller.
+	*
+	* `timeoutMs` is the caller's budget for this one request. The default is the
+	* CATALOG probe's short cap, which fits the picker's fail-open reads; the
+	* usage report deliberately passes the connection's own request budget so an
+	* account query is not held to a stricter (and invisible) limit than chat.
 	*/
-	async fetchEndpointJson(url, headers) {
+	async fetchEndpointJson(url, headers, timeoutMs = MODELS_TIMEOUT_MS) {
 		const response = await this.fetchImpl(url, {
 			headers,
-			signal: AbortSignal.timeout(MODELS_TIMEOUT_MS)
+			signal: AbortSignal.timeout(timeoutMs)
 		});
 		if (!response.ok) return { status: response.status };
 		const parsed = await response.json();
@@ -4211,15 +4555,39 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	* view. Requires a usable API key (throws `MISSING_CREDENTIAL` otherwise).
 	* Pass `apiKey` to report on a specific account of a multi-account pool;
 	* the default resolves the currently active account.
+	*
+	* Two failure modes are NOT "the network is down", and the report must say
+	* so rather than let {@link classifyTotalFailure} blame the connection:
+	*
+	*  - A key that no HTTP header can carry (a stray newline from a paste, a
+	*    full-width character) makes `fetch` throw a `TypeError` **before any
+	*    I/O**, for every endpoint at once. The chat path refuses such a key
+	*    through `assertUsableApiKey`; this path must too, and it answers
+	*    `blocked: 'invalid-key'` instead of four phantom transport failures.
+	*  - The four endpoints get the SAME per-request budget as a chat call
+	*    (`connection.requestTimeoutMs`, default 60 s), not the catalog's 10 s
+	*    probe budget: on a slow link a 10 s cap made every account query time
+	*    out while chat kept working, which is exactly a "check your network"
+	*    banner that never clears.
 	*/
 	async getUsage(apiKey) {
-		const base = this.deps.options().apiBase;
-		const headers = await this.accountHeaders(apiKey);
+		const connection = this.deps.options();
+		const base = connection.apiBase;
+		let headers;
+		try {
+			headers = await this.accountHeaders(apiKey);
+		} catch (error) {
+			if (error instanceof LlmError && error.code === "INVALID_CREDENTIAL") return {
+				failures: [error.message],
+				blocked: "invalid-key"
+			};
+			throw error;
+		}
 		const failures = [];
 		const failedStatuses = [];
 		const getJson = async (path) => {
 			try {
-				const { status, record } = await this.fetchEndpointJson(`${base}${path}`, headers);
+				const { status, record } = await this.fetchEndpointJson(`${base}${path}`, headers, connection.requestTimeoutMs);
 				if (record === void 0) {
 					failures.push(`${path}: HTTP ${status}`);
 					failedStatuses.push(status);
@@ -4305,7 +4673,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 				reported = true;
 				if (!window.exceeded) continue;
 				exceeded = true;
-				resetAt = Math.max(resetAt, window.resetAt);
+				if (window.resetAt > 0 && window.resetAt - Date.now() <= MAX_TRUSTED_RESET_MS) resetAt = Math.max(resetAt, window.resetAt);
 			}
 			if (!reported) return void 0;
 			return {
@@ -4413,6 +4781,19 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		const reader = response.body.getReader();
 		const decoder = new TextDecoder();
 		let buffer = "";
+		const trace = openStreamTrace(`${options.provider}/${options.model}`);
+		const streamStartedAt = Date.now();
+		let chunkCount = 0;
+		let totalBytes = 0;
+		let lastChunkAt = streamStartedAt;
+		trace.record("response", {
+			protocol,
+			endpoint: protocol === "cli" ? `${connection.apiBase}/alpha/generate` : `${connection.apiBase}/provider/v1/chat/completions`,
+			status: response.status,
+			attempts: tried.size,
+			maxTokens,
+			...reasoningEffort === void 0 ? {} : { reasoningEffort }
+		});
 		let idleTimer;
 		let idleFired = false;
 		const armIdle = () => {
@@ -4429,9 +4810,16 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			}
 		};
 		const asm = createBlockAssembler();
-		const handle = (event) => handleEvent(asm, protocol, event);
+		let finish;
+		let usage;
+		let usageEmitted = false;
+		let endRecorded = false;
+		function* handle(event) {
+			for (const chunk of handleEvent(asm, protocol, event)) if (chunk.type === "finish") finish = chunk;
+			else if (chunk.type === "usage") usage = chunk.usage;
+			else yield chunk;
+		}
 		try {
-			let finished = false;
 			for (;;) {
 				let read;
 				armIdle();
@@ -4439,44 +4827,104 @@ var CommandCodeAdapter = class extends LlmAdapter {
 					read = await reader.read();
 				} catch (error) {
 					if (options.signal?.aborted) throw error;
+					trace.record("read-error", {
+						chunks: chunkCount,
+						bytes: totalBytes,
+						silentMs: Date.now() - lastChunkAt,
+						message: errorChain(error)
+					});
 					throw new LlmError(`Command Code API stream from ${connection.apiBase} failed while reading: ${errorChain(error)}；Command Code API 流式响应中途断开——网络波动所致，重试通常可恢复`, "TRANSPORT", { cause: error });
 				} finally {
 					clearIdle();
 				}
 				const { done, value } = read;
 				if (done) {
+					trace.record("eof", {
+						chunks: chunkCount,
+						bytes: totalBytes,
+						silentMs: Date.now() - lastChunkAt,
+						totalMs: Date.now() - streamStartedAt,
+						finishSeen: finish !== void 0,
+						idleFired,
+						buffered: buffer.length
+					});
 					if (idleFired) throw new LlmError(`Command Code API stream from ${connection.apiBase} was idle for ${connection.streamIdleTimeoutMs}ms (no events) and was treated as a dead connection；Command Code API 流式响应已 ${connection.streamIdleTimeoutMs} 毫秒无任何事件，被判定为死连接——长思考模型可在设置中调大流空闲超时`, "TIMEOUT");
-					if (buffer.trim()) for (const chunk of handle(parseStreamEventLine(buffer))) {
-						yield chunk;
-						if (chunk.type === "finish") finished = true;
-					}
+					if (buffer.trim()) yield* handle(parseStreamEventLine(buffer));
 					break;
 				}
-				buffer += decoder.decode(value, { stream: true });
+				const text = decoder.decode(value, { stream: true });
+				buffer += text;
+				chunkCount += 1;
+				totalBytes += value.byteLength;
+				lastChunkAt = Date.now();
+				trace.record("chunk", {
+					n: chunkCount,
+					bytes: value.byteLength,
+					text: boundTraceText(text)
+				});
 				const lines = buffer.split("\n");
 				buffer = lines.pop() ?? "";
-				for (const line of lines) {
-					const chunks = handle(parseStreamEventLine(line));
-					for (const chunk of chunks) {
-						yield chunk;
-						if (chunk.type === "finish") finished = true;
-					}
-				}
-				if (finished) break;
+				for (const line of lines) yield* handle(parseStreamEventLine(line));
+				if (finish !== void 0) break;
 			}
-			if (!finished) {
-				yield* closeText(asm);
-				yield* closeReasoning(asm);
-				if (protocol === "openai") yield* emitOpenAiToolCalls(asm);
-				if (!asm.sawContent) throw new LlmError("Command Code returned an empty response；Command Code 返回了空响应，重试通常可恢复", "EMPTY_RESPONSE");
+			if (usage !== void 0) {
+				usageEmitted = true;
 				yield {
-					type: "finish",
-					reason: { kind: "stop" }
+					type: "usage",
+					usage
 				};
 			}
+			if (finish !== void 0) {
+				const failure = asm.sawContent ? void 0 : emptyCompletionError(asm.finishReason, maxTokens, usage);
+				trace.record("end", {
+					outcome: failure === void 0 ? "finished" : failure.code === "OUTPUT_TOKEN_LIMIT" ? "output-token-limit" : "empty",
+					finishReason: asm.finishReason,
+					...failure === void 0 ? {} : { code: failure.code },
+					maxTokens,
+					...usage === void 0 ? {} : { usage },
+					chunks: chunkCount,
+					bytes: totalBytes,
+					totalMs: Date.now() - streamStartedAt,
+					sawContent: asm.sawContent
+				});
+				endRecorded = true;
+				if (failure !== void 0) throw failure;
+				yield finish;
+			} else {
+				const elapsed = Date.now() - streamStartedAt;
+				const detail = `${chunkCount} chunk(s), ${totalBytes} bytes, ${elapsed}ms`;
+				trace.record("end", {
+					outcome: asm.sawContent ? "stream-closed" : "empty",
+					chunks: chunkCount,
+					bytes: totalBytes,
+					totalMs: elapsed,
+					sawContent: asm.sawContent
+				});
+				endRecorded = true;
+				if (!asm.sawContent) throw new LlmError("Command Code returned an empty response；Command Code 返回了空响应，重试通常可恢复", "EMPTY_RESPONSE");
+				throw new LlmError(`Command Code API stream from ${connection.apiBase} ended before its finish event (${detail}) — the response was closed mid-generation, so this is not the model stopping by itself；Command Code API 流式响应在结束事件之前被关闭（生成中途断流），并非模型主动结束——请重试；若频繁出现，可用 ${STREAM_TRACE_ENV}=<文件路径> 抓取原始流以定位断流原因`, "STREAM_CLOSED");
+			}
+		} catch (error) {
+			if (!usageEmitted && usage !== void 0) yield {
+				type: "usage",
+				usage
+			};
+			if (!endRecorded) trace.record("end", {
+				outcome: options.signal?.aborted ? "aborted" : "error",
+				code: error instanceof LlmError ? error.code : "unknown",
+				finishReason: asm.finishReason,
+				maxTokens,
+				...usage === void 0 ? {} : { usage },
+				sawContent: asm.sawContent,
+				chunks: chunkCount,
+				bytes: totalBytes,
+				totalMs: Date.now() - streamStartedAt
+			});
+			throw error;
 		} finally {
 			clearIdle();
 			cleanup();
+			trace.close();
 			await reader.cancel().catch(() => void 0);
 			reader.releaseLock();
 		}
@@ -4517,6 +4965,7 @@ function generateHttpError(status, errText, retryAfterMs) {
 	const detail = providerCode ?? `HTTP ${status}`;
 	const overflowDetail = providerDetail !== "" ? providerDetail : errText.slice(0, 500);
 	if (status < 500 && isContextOverflowDetail(overflowDetail)) return new LlmError(`Command Code API error ${status}: the request exceeds the model's context window — this session is being compacted and the request retried；Command Code API 返回 ${status}：请求内容超出模型上下文窗口——正在压缩上下文后重试；如仍失败，请新建会话或减少上下文`, CONTEXT_WINDOW_EXCEEDED_CODE, { status });
+	if (status === 422 && isZdrNoProviders(providerCode, providerDetail, errText)) return new LlmError(`Command Code API error 422 (${detail}): zero data retention is enforced but no ZDR-capable upstream is available for this model — turn the ZDR setting off (or use another model)；Command Code API 返回 422：已开启零数据保留（ZDR），但该模型当前没有可用的 ZDR 上游——请关闭 ZDR 开关，或改用其他模型`, "PROVIDER_HTTP_ERROR", { status: 422 });
 	if (status === 401) return new LlmError(`Command Code API error 401 (${detail}): the API key is missing or invalid — check the key stored for COMMANDCODE_API_KEY (Models page) or the auth file；Command Code API 返回 401：API 密钥缺失或无效——请在设置页检查 COMMANDCODE_API_KEY 存储的密钥，或检查 auth 文件`, "INVALID_CREDENTIAL", { status: 401 });
 	if (status === 413) return new LlmError("Command Code API error 413: the request body exceeds the provider's size limit (the cap is undocumented, measured at about 50 MB) — the session history is too large to send, usually because of accumulated image attachments. Start a new session, or drop the image-heavy part of this one, and retry；Command Code API 返回 413：请求体超过服务端的体积上限（官方未公开，实测约 50 MB）——会话历史过大，通常是历史图片累积所致。请新建会话，或移除本会话中图片较多的部分后重试", "PROVIDER_HTTP_ERROR", { status: 413 });
 	return new LlmError(`Command Code API error ${status}${detail === `HTTP ${status}` ? "" : ` (${detail})`}: ${errText.slice(0, 500)}`, httpErrorCode(status), {
@@ -4567,7 +5016,7 @@ function handleCliEvent(asm, event) {
 			}
 			const delta = stringValue(event.text) ?? "";
 			asm.textContent += delta;
-			asm.sawContent = true;
+			if (delta.trim() !== "") asm.sawContent = true;
 			chunks.push({
 				type: "text-delta",
 				index: asm.textIndex,
@@ -4630,6 +5079,7 @@ function handleCliEvent(asm, event) {
 			break;
 		}
 		case "finish": {
+			asm.finishReason = stringValue(event.finishReason);
 			chunks.push(...closeText(asm), ...closeReasoning(asm));
 			const usage = isRecord(event.totalUsage) ? event.totalUsage : void 0;
 			if (usage) {
@@ -4643,6 +5093,8 @@ function handleCliEvent(asm, event) {
 					cacheReadTokens: cacheRead,
 					cacheWriteTokens: cacheWrite
 				};
+				const reasoningTokens = numberValue((isRecord(usage.outputTokenDetails) ? usage.outputTokenDetails : void 0)?.reasoningTokens) ?? numberValue(usage.reasoningTokens);
+				if (reasoningTokens !== void 0) tokenUsage.reasoningTokens = reasoningTokens;
 				chunks.push({
 					type: "usage",
 					usage: tokenUsage
@@ -4707,39 +5159,38 @@ function handleOpenAIEvent(asm, event) {
 			});
 		}
 		asm.textContent += contentDelta;
-		asm.sawContent = true;
+		if (contentDelta.trim() !== "") asm.sawContent = true;
 		chunks.push({
 			type: "text-delta",
 			index: asm.textIndex,
 			text: contentDelta
 		});
 	}
-	if (Array.isArray(delta.tool_calls)) {
+	if (Array.isArray(delta.tool_calls)) for (const rawCall of delta.tool_calls) {
+		if (!isRecord(rawCall)) continue;
 		asm.sawContent = true;
-		for (const rawCall of delta.tool_calls) {
-			if (!isRecord(rawCall)) continue;
-			const callIndex = numberValue(rawCall.index) ?? 0;
-			let existing = asm.openAiToolCalls.find((call) => call.index === callIndex);
-			const fn = isRecord(rawCall.function) ? rawCall.function : void 0;
-			const id = stringValue(rawCall.id);
-			const name = fn === void 0 ? void 0 : stringValue(fn.name);
-			const argDelta = fn === void 0 ? void 0 : stringValue(fn.arguments) ?? (fn.arguments === void 0 ? "" : JSON.stringify(fn.arguments));
-			if (!existing) {
-				existing = {
-					index: callIndex,
-					name: name ?? "",
-					arguments: argDelta ?? ""
-				};
-				if (id !== void 0) existing.id = id;
-				asm.openAiToolCalls.push(existing);
-			} else {
-				if (id !== void 0 && existing.id === void 0) existing.id = id;
-				if (name !== void 0 && existing.name === "") existing.name = name;
-				if (argDelta !== void 0) existing.arguments += argDelta;
-			}
+		const callIndex = numberValue(rawCall.index) ?? 0;
+		let existing = asm.openAiToolCalls.find((call) => call.index === callIndex);
+		const fn = isRecord(rawCall.function) ? rawCall.function : void 0;
+		const id = stringValue(rawCall.id);
+		const name = fn === void 0 ? void 0 : stringValue(fn.name);
+		const argDelta = fn === void 0 ? void 0 : stringValue(fn.arguments) ?? (fn.arguments === void 0 ? "" : JSON.stringify(fn.arguments));
+		if (!existing) {
+			existing = {
+				index: callIndex,
+				name: name ?? "",
+				arguments: argDelta ?? ""
+			};
+			if (id !== void 0) existing.id = id;
+			asm.openAiToolCalls.push(existing);
+		} else {
+			if (id !== void 0 && existing.id === void 0) existing.id = id;
+			if (name !== void 0 && existing.name === "") existing.name = name;
+			if (argDelta !== void 0) existing.arguments += argDelta;
 		}
 	}
 	if (choice.finish_reason !== void 0 && choice.finish_reason !== null) {
+		asm.finishReason = stringValue(choice.finish_reason);
 		chunks.push(...closeText(asm), ...closeReasoning(asm), ...emitOpenAiToolCalls(asm));
 		if (event.usage !== void 0) chunks.push({
 			type: "usage",
@@ -4787,6 +5238,13 @@ function mapFinishReason(reason) {
 	if (reason === "length" || reason === "max_tokens" || reason === "max-tokens" || reason === "max_output_tokens") return { kind: "max-tokens" };
 	return { kind: "stop" };
 }
+/** A terminal marker without text or tools is a failed attempt, not a completed turn. */
+function emptyCompletionError(reason, maxTokens, usage) {
+	const detail = `finish_reason=${reason ?? "unknown"}, max_tokens=${maxTokens}, outputTokens=${usage?.outputTokens ?? "unknown"}, reasoningTokens=${usage?.reasoningTokens ?? "unknown"}`;
+	if (mapFinishReason(reason).kind === "max-tokens") return new LlmError(`Command Code reached the output token limit without producing answer text or a tool call (${detail})；Command Code 已达到输出 token 上限，但没有生成正文或工具调用；请调整思考强度，或在模型和接口上限内增加输出预算`, "OUTPUT_TOKEN_LIMIT");
+	if (reason === "content_filter" || reason === "content-filter") return new LlmError(`Command Code filtered the response (${detail})；Command Code 拦截了响应，未生成正文或工具调用`, "CONTENT_FILTER");
+	return new LlmError(`Command Code finished without producing answer text or a tool call (${detail})；Command Code 返回了空响应（可能只有思考内容），重试通常可恢复`, "EMPTY_RESPONSE");
+}
 /**
 * True when a Provider API pre-stream rejection is Command Code's Go-plan
 * gate (`upgrade_required`). Only this exact class of rejection should fall
@@ -4831,8 +5289,25 @@ function mapFinishReason(reason) {
 *     or a model outside its plan (`MODEL_NOT_IN_PLAN`). Rotating must NOT mark
 *     the account: the fact is about the model or the balance, it can change
 *     without the key changing, and a `:free` model can still be served by an
-*     account with an empty balance.
+*     account with an empty balance. These codes are recognized on EVERY
+*     status — a 5xx that proxies the provider's own credits/plan body is
+*     still an account fact, and only the prose scan is confined to 4xx.
 */
+/**
+* The provider's structured "this account cannot serve this request" codes.
+*
+* Status-independent on purpose, mirroring the CLI's classifier, which reads
+* the code before any status guard. A 5xx that carries one of these must not
+* be retried as a transient provider failure: the same request against the
+* same account cannot succeed, so the caller rotates past it (without marking
+* the key) instead of replaying it on the harness's retry cadence.
+*/
+const ACCOUNT_UNAVAILABLE_CODES = /* @__PURE__ */ new Set([
+	"USAGE_EXCEEDED",
+	"INSUFFICIENT_CREDITS",
+	"PREMIUM_CREDITS_EXHAUSTED",
+	"MODEL_NOT_IN_PLAN"
+]);
 function classifyAccountRejection(status, errText) {
 	if (status === 429 || readProviderErrorCode(errText)?.toUpperCase() === "RATE_LIMITED") {
 		const evidence = readWindowLimitEvidence(errText);
@@ -4843,10 +5318,11 @@ function classifyAccountRejection(status, errText) {
 		};
 	}
 	if (status === 401) return { reason: "invalid-credential" };
+	const code = readProviderErrorCode(errText)?.toUpperCase();
+	if (code !== void 0 && ACCOUNT_UNAVAILABLE_CODES.has(code)) return { reason: "unavailable" };
 	if (status < 400 || status >= 500) return void 0;
 	const lower = errText.toLowerCase().replaceAll("_", " ");
-	const code = readProviderErrorCode(errText)?.toUpperCase();
-	if (code === "USAGE_EXCEEDED" || code === "INSUFFICIENT_CREDITS" || code === "PREMIUM_CREDITS_EXHAUSTED" || code === "MODEL_NOT_IN_PLAN" || lower.includes("insufficient credits") || lower.includes("premium credits exhausted") || lower.includes("model not in plan") || /insufficient (credit|balance)/.test(lower) || /out of credit/.test(lower) || /not (available|included)[^.]{0,40}plan/.test(lower) || lower.includes("upgrade your plan")) return { reason: "unavailable" };
+	if (lower.includes("insufficient credits") || lower.includes("premium credits exhausted") || lower.includes("model not in plan") || /insufficient (credit|balance)/.test(lower) || /out of credit/.test(lower) || /not (available|included)[^.]{0,40}plan/.test(lower) || lower.includes("upgrade your plan")) return { reason: "unavailable" };
 }
 /** The machine-readable `error.code`/`error.type` of a pre-stream failure body. */
 function readProviderErrorCode(errText) {
@@ -4860,6 +5336,16 @@ function readProviderErrorCode(errText) {
 	}
 }
 /**
+* How far ahead a provider-published reset may be and still be trusted.
+*
+* Generous on purpose: the weekly window is the longest this provider meters,
+* and the value is a plausibility bound rather than a policy. Beyond it the
+* reset is dropped rather than clamped, which leaves the account's mark
+* `unknown` — the state the pool's probe pass re-checks — instead of a
+* cooldown that never expires.
+*/
+const MAX_TRUSTED_RESET_MS = 2592e6;
+/**
 * The usage-window evidence carried by a rejected request, mirroring the CLI's
 * `parseWindowLimitError` → `resolveWindowLabel`/`extractResetAtMs` pair.
 *
@@ -4893,7 +5379,8 @@ function readWindowLimitEvidence(errText) {
 	const window = named === "fiveHour" || named === "weekly" || named === "daily" ? named : /usage limit for your plan/i.test(message) || /usage limit for your plan/i.test(errText) ? /weekly/i.test(message) ? "weekly" : "fiveHour" : void 0;
 	const stamp = /resets at (\d{4}-\d{2}-\d{2}T[\d:.]+Z)/i.exec(message)?.[1] ?? /resets at (\d{4}-\d{2}-\d{2}T[\d:.]+Z)/i.exec(errText)?.[1];
 	const stamped = stamp === void 0 ? void 0 : Date.parse(stamp);
-	const resetAtMs = seconds !== void 0 && seconds > 0 ? Math.round(seconds * 1e3) : stamped !== void 0 && !Number.isNaN(stamped) ? stamped : void 0;
+	const published = seconds !== void 0 && seconds > 0 ? Math.round(seconds * 1e3) : stamped !== void 0 && !Number.isNaN(stamped) ? stamped : void 0;
+	const resetAtMs = published !== void 0 && Number.isFinite(published) && published - Date.now() <= MAX_TRUSTED_RESET_MS ? published : void 0;
 	return {
 		...window === void 0 ? {} : { window },
 		...resetAtMs === void 0 ? {} : { resetAtMs }
@@ -5693,7 +6180,10 @@ function isCallbackCredentials(value) {
 /**
 * One browser-login attempt machine. Single-flight by design: `begin()` while
 * waiting returns the live attempt's status instead of starting a second one;
-* a terminal state makes the next `begin()` start fresh.
+* a start that is still binding its port is REJOINED through
+* {@link CommandCodeLoginFlow.begin}'s in-flight promise, because the status
+* face cannot say `waiting` until that bind settles; a terminal state makes the
+* next `begin()` start fresh.
 */
 var CommandCodeLoginFlow = class {
 	deps;
@@ -5711,6 +6201,17 @@ var CommandCodeLoginFlow = class {
 	* the user cancelled and flipping the page back to success.
 	*/
 	attemptSeq = 0;
+	/**
+	* The start currently binding a port, if any. Every `begin()` that arrives
+	* before it settles joins it: two independent starts would each bind their
+	* own loopback server, and only the LAST one is reachable by
+	* {@link CommandCodeLoginFlow.teardown} — the orphan keeps listening and
+	* answering `/callback` for the process's lifetime, and ten of them exhaust
+	* the port window so browser login dies until the Host restarts.
+	*/
+	starting;
+	/** A `cancel()` that arrived while a start was still binding (see {@link CommandCodeLoginFlow.cancel}). */
+	cancelPending = false;
 	disposed = false;
 	constructor(deps) {
 		this.deps = deps;
@@ -5732,6 +6233,22 @@ var CommandCodeLoginFlow = class {
 	async begin() {
 		if (this.disposed) throw new Error("login flow has been disposed");
 		if (this.statusValue.state === "waiting" && this.server !== void 0) return this.statusValue;
+		if (this.starting !== void 0) return this.starting;
+		this.cancelPending = false;
+		const starting = this.startAttempt();
+		this.starting = starting;
+		try {
+			return await starting;
+		} finally {
+			if (this.starting === starting) this.starting = void 0;
+		}
+	}
+	/**
+	* The binding half of {@link CommandCodeLoginFlow.begin}: one attempt, one
+	* server, one published `waiting` status. Callers reach it only through
+	* `begin()`'s single-flight fence.
+	*/
+	async startAttempt() {
 		this.teardown();
 		const attempt = ++this.attemptSeq;
 		const port = await this.findPort();
@@ -5743,6 +6260,16 @@ var CommandCodeLoginFlow = class {
 			};
 		});
 		await this.bindServer(port, expectedState);
+		if (this.disposed || this.cancelPending) {
+			const cancelled = !this.disposed;
+			this.cancelPending = false;
+			this.teardown();
+			if (cancelled) this.setStatus({
+				state: "failed",
+				reason: "cancelled"
+			});
+			return this.statusValue;
+		}
 		const apiBase = this.readApiBase();
 		this.setStatus({
 			state: "waiting",
@@ -5764,19 +6291,29 @@ var CommandCodeLoginFlow = class {
 		settled.then((credentials) => this.complete(attempt, credentials), (failure) => this.failFrom(attempt, failure));
 		return this.statusValue;
 	}
-	/** Cancel a waiting attempt; terminal states are untouched. */
+	/**
+	* Cancel a waiting attempt; terminal states are untouched. A start that is
+	* still binding a port is flagged instead of ignored — it cannot be torn
+	* down from here (its server does not exist yet), so `startAttempt` observes
+	* the flag once the bind settles and retires it.
+	*/
 	cancel() {
-		if (this.disposed || this.statusValue.state !== "waiting") return;
-		this.teardown();
-		this.setStatus({
-			state: "failed",
-			reason: "cancelled"
-		});
+		if (this.disposed) return;
+		if (this.statusValue.state === "waiting") {
+			this.teardown();
+			this.setStatus({
+				state: "failed",
+				reason: "cancelled"
+			});
+			return;
+		}
+		if (this.starting !== void 0) this.cancelPending = true;
 	}
 	/** Stop everything; a waiting attempt ends cancelled. Idempotent. */
 	dispose() {
 		if (this.disposed) return;
 		this.disposed = true;
+		this.cancelPending = false;
 		const wasWaiting = this.statusValue.state === "waiting";
 		this.teardown();
 		if (wasWaiting) this.setStatus({
@@ -5812,8 +6349,12 @@ var CommandCodeLoginFlow = class {
 			const server = createServer((request, response) => this.handleCallback(request, response, expectedState));
 			this.server = server;
 			server.once("error", (error) => {
-				if (this.server !== server) return;
+				if (this.server !== server) {
+					closeServer(server);
+					return;
+				}
 				this.server = void 0;
+				closeServer(server);
 				const tagged = new LoginSettleError("error", `Could not bind the login callback server on port ${port}: ${error.code ?? error.message}`);
 				if (binding) {
 					binding = false;
@@ -5982,11 +6523,17 @@ var CommandCodeLoginFlow = class {
 	/** Close the server and watchdog without touching the published status. */
 	teardown() {
 		this.clearTimer();
-		this.server?.close();
+		closeServer(this.server);
 		this.server = void 0;
 		this.settle = void 0;
 	}
 };
+/** Close one loopback server without letting "not running"/"already closed" escape. */
+function closeServer(server) {
+	try {
+		server?.close();
+	} catch {}
+}
 /** A tagged settle failure carrying the stable copy reason. */
 var LoginSettleError = class extends Error {
 	reason;
@@ -6060,7 +6607,8 @@ function selectCommandCodeSearchProvider(web, enable) {
 function commandCodeSearchSelection() {
 	return {
 		owner: false,
-		displaced: void 0
+		displaced: void 0,
+		preexisting: false
 	};
 }
 /**
@@ -6078,8 +6626,14 @@ function commandCodeSearchSelection() {
 *   auto-select — already says what the user wants.
 * - When the field already reads `commandcode` at first touch (e.g. a
 *   surviving runtime the plugin did not set, or a manual
-*   `searchProvider: commandcode` pin), `displaced` stays undefined so the
-*   later disable is a no-op rather than a guess at the factory default.
+*   `searchProvider: commandcode` pin), `displaced` stays undefined and
+*   `preexisting` is set, so the later disable is a no-op rather than a guess
+*   at the factory default. A "no-op" means the field is left ALONE: writing
+*   that `undefined` back would destroy the user's own pin, and dsh-web reads
+*   a cleared `searchProviderId` as auto-select — where a second usable
+*   provider (the shipped `deepseek-official` is usable whenever a DeepSeek
+*   key resolves) makes EVERY later search throw
+*   `WEB_PROVIDER_AMBIGUOUS`.
 *
 * Never throws: like the low-level rewrite, a hardened runtime shape degrades
 * to registered-but-unselected.
@@ -6093,14 +6647,16 @@ function applyCommandCodeSearchSelection(web, state, enable) {
 				return;
 			}
 			const prior = field.searchProviderId;
-			state.displaced = prior === "commandcode" ? void 0 : prior;
+			state.preexisting = prior === COMMANDCODE_SEARCH_PROVIDER_ID;
+			state.displaced = state.preexisting ? void 0 : prior;
 			field.searchProviderId = COMMANDCODE_SEARCH_PROVIDER_ID;
 			state.owner = true;
 			return;
 		}
 		if (state.owner) {
 			state.owner = false;
-			field.searchProviderId = state.displaced;
+			if (!state.preexisting) field.searchProviderId = state.displaced;
+			state.preexisting = false;
 			return;
 		}
 	} catch {}
@@ -6131,7 +6687,7 @@ function toSource(result) {
 		...snippet !== void 0 && snippet.length > 0 ? { snippet } : {}
 	};
 }
-function isAbortError(error) {
+function isAbortError$1(error) {
 	return error instanceof DOMException && error.name === "AbortError";
 }
 /** Build the provider's stable cancellation error while retaining the caller's reason. */
@@ -6185,7 +6741,7 @@ var CommandCodeSearchProvider = class {
 				...signal !== void 0 ? { signal } : {}
 			});
 		} catch (error) {
-			if (signal?.aborted === true || isAbortError(error)) throw searchAborted(signal, error);
+			if (signal?.aborted === true || isAbortError$1(error)) throw searchAborted(signal, error);
 			throw new WebError(`Command Code web search request failed: ${error instanceof Error ? error.message : String(error)}`, "WEB_PROVIDER_ERROR", { cause: error });
 		}
 		if (!response.ok) {
@@ -6200,7 +6756,7 @@ var CommandCodeSearchProvider = class {
 					if (typeof code === "string" || typeof inner === "string") message += `: ${typeof code === "string" ? code : ""}${typeof code === "string" && typeof inner === "string" ? " — " : ""}${typeof inner === "string" ? inner : ""}`;
 				}
 			} catch (error) {
-				if (signal?.aborted === true || isAbortError(error)) throw searchAborted(signal, error);
+				if (signal?.aborted === true || isAbortError$1(error)) throw searchAborted(signal, error);
 				const slice = (await response.text().catch(() => "")).trim().slice(0, 200);
 				if (slice !== "") message += `: ${slice}`;
 			}
@@ -6210,7 +6766,7 @@ var CommandCodeSearchProvider = class {
 		try {
 			payload = await response.json();
 		} catch (error) {
-			if (signal?.aborted === true || isAbortError(error)) throw searchAborted(signal, error);
+			if (signal?.aborted === true || isAbortError$1(error)) throw searchAborted(signal, error);
 			throw new WebError("Command Code web search returned an unparseable response body", "WEB_PROVIDER_ERROR", { cause: error });
 		}
 		const results = payload?.results;
@@ -6234,7 +6790,7 @@ var CommandCodeSearchProvider = class {
 		try {
 			key = await this.deps.resolveKey();
 		} catch (error) {
-			if (signal?.aborted === true || isAbortError(error)) throw searchAborted(signal, error);
+			if (signal?.aborted === true || isAbortError$1(error)) throw searchAborted(signal, error);
 			if (error instanceof Error && typeof error.code === "string") {
 				const code = error.code;
 				if (code === "MISSING_CREDENTIAL") throw new WebError(error.message, "WEB_PROVIDER_CREDENTIAL_MISSING", { cause: error });
@@ -6402,8 +6958,8 @@ function buildCommandCodeTuiSection(deps) {
 				label: "API key",
 				descriptions: { zh: "API 密钥" },
 				secret: { ref },
-				hint: `Stored in the credential store as ${ref}, never in settings.yaml.`,
-				hintDescriptions: { zh: `保存在凭据库（${ref}），不会写入 settings.yaml。` }
+				hint: `Stored in the credential store as ${ref}, never in configuration files.`,
+				hintDescriptions: { zh: `保存在凭据库（${ref}），不会写入配置文件。` }
 			},
 			{
 				path: ["apiBase"],
@@ -6422,6 +6978,70 @@ function buildCommandCodeTuiSection(deps) {
 					};
 				}
 			},
+			{
+				path: ["commandGuard"],
+				group: "advanced",
+				kind: "boolean",
+				label: "AI command guard",
+				descriptions: { zh: "AI 命令安全预判" },
+				hint: "typesafe/jev judges whether a shell command is safe and auto-approves it; everything else asks as usual. Off by default.",
+				hintDescriptions: { zh: "由 typesafe/jev 判断 shell 命令是否安全，安全则自动放行，其余照常弹窗。默认关闭。" },
+				format: (value) => value === true ? "true" : "false",
+				parse: (text) => ({
+					kind: "set",
+					value: text.trim() === "true"
+				})
+			},
+			{
+				path: ["commandGuardThreshold"],
+				group: "advanced",
+				kind: "number",
+				label: "Auto-approve threshold (0.5-1)",
+				descriptions: { zh: "自动放行阈值（0.5-1）" },
+				hint: "Approve when typesafe/jev rates the command \"safe\" at least this likely; default 0.9.",
+				hintDescriptions: { zh: "typesafe/jev 判定\"安全\"的概率达到该值即放行，默认 0.9。" },
+				parse: (text) => {
+					const trimmed = text.trim();
+					if (trimmed === "") return { kind: "clear" };
+					const parsed = Number(trimmed);
+					return Number.isFinite(parsed) && parsed >= .5 && parsed <= 1 ? {
+						kind: "set",
+						value: parsed
+					} : void 0;
+				}
+			},
+			{
+				path: ["commandGuardTimeoutMs"],
+				group: "advanced",
+				kind: "number",
+				label: "Judgement timeout (ms, 200-10000)",
+				descriptions: { zh: "判定超时（毫秒，200-10000）" },
+				hint: "If typesafe/jev does not answer in time, the normal prompt appears; default 1500.",
+				hintDescriptions: { zh: "typesafe/jev 超过该时间未返回就照常弹窗，默认 1500。" },
+				parse: (text) => {
+					const trimmed = text.trim();
+					if (trimmed === "") return { kind: "clear" };
+					const parsed = Number(trimmed);
+					return Number.isFinite(parsed) && parsed >= 200 && parsed <= 1e4 ? {
+						kind: "set",
+						value: parsed
+					} : void 0;
+				}
+			},
+			{
+				path: ["zdr"],
+				group: "advanced",
+				kind: "boolean",
+				label: "Zero data retention (ZDR)",
+				descriptions: { zh: "零数据保留（ZDR）" },
+				hint: "Route requests only through upstreams that retain nothing and never train on prompts (the CLI's CMD_ZDR=1). Models without an available ZDR upstream fail instead of losing protection; ZDR is usually billed at higher pass-through rates. Off by default.",
+				hintDescriptions: { zh: "请求只经由不留存数据、也不用于训练的上游（等价于 CLI 的 CMD_ZDR=1）。没有可用 ZDR 上游的模型会报错，不会降级为非 ZDR 请求；ZDR 通常按更高的透传价计费。默认关闭。" },
+				format: (value) => value === true ? "true" : "false",
+				parse: (text) => ({
+					kind: "set",
+					value: text.trim() === "true"
+				})
+			},
 			{
 				path: ["filterModelsByPlan"],
 				group: "models",
@@ -6681,18 +7301,810 @@ function transportBudgetMessage(failureMessage, maxRetries) {
 	return `${failureMessage}；Command Code API 连接在连续重试后仍失败——已停止重试以免整轮卡死。插件已自动重试 ${maxRetries} 次。通常说明当前网络到 api.commandcode.ai 的连接不通，常见原因是代理未生效：DSH 只读取环境变量 HTTPS_PROXY/HTTP_PROXY（系统代理/PAC 不会被读取），请确认启动 DSH 的终端里已导出代理，或先关闭代理直连后重试。网络恢复后直接重发即可 — Command Code API transport still failed after ${maxRetries} automatic retries, which were stopped so the turn could not stall for minutes. This is a connectivity problem between this machine and api.commandcode.ai, not a context-window or request-size rejection. Common cause: the proxy is not reaching the harness — DSH reads HTTPS_PROXY/HTTP_PROXY from the environment only (a Windows system proxy/PAC setting is not consulted), so export it in the launching shell, or turn the proxy off and retry. Resend when the network recovers; the budget is per request and has been reset`;
 }
 //#endregion
-//#region src/index.ts
+//#region src/systemone.ts
 /**
-* dsh-commandcode-provider — DeepSeek Harness LLM provider plugin for Command
-* Code (unofficial; ported from pi-commandcode-provider@0.5.1).
+* Host-side client for Command Code's System One decision endpoint
+* (`POST {apiBase}/provider/v1/systemone`).
 *
-* Registers the `commandcode` provider route on `ctx.llm` and declares it in
-* the configurable-provider directory, so the web Models page shows a
-* "Command Code" card with an API-key field and the model picker lists the
+* `typesafe/jev` is **not a chat model**: it takes a `state` plus typed
+* questions and answers with probabilities, never text, and it never streams.
+* It is therefore absent from `/provider/v1/models` (so the picker can never
+* offer it) and must never be registered as a model route — this plugin uses it
+* as an internal advisor instead: the command guard in `./command-guard.ts`
+* asks it whether a shell command is safe to auto-approve.
+*
+* The three question types are the whole vocabulary (command-code@1.64.0
+* `systemOneRequestSchema`):
+*
+* - `noul` — "is this true?", optional `criteria: { true, false }` describing
+*   each verdict. Answers with `noul`, the probability of *yes*.
+* - `choice` — "which one?", `criteria` maps each option key to its
+*   description. Answers with `choice`, plus optional `confidence` and
+*   `probabilities`.
+* - `score` — "where on this rubric?", `criteria` is an array of at least two
+*   levels, lowest first. Answers with `score`, `legend` and `probabilities`.
+*
+* A request carries at most 20 questions and every answer is keyed by the
+* question id it belongs to. `usage` is reported per request, in tokens.
+*
+* Billing: free through 2026-09-24T23:59:59Z, then $0.042 per 1M input tokens
+* with output free. The model has **no ZDR-capable upstream**, so a request
+* carrying `x-cmd-zdr: 1` is refused with HTTP 422 `cmd_zdr_no_providers` —
+* this client never sends that header, and it must stay that way even though
+* the plugin now ships a ZDR switch for chat (`Config.zdr` → the `x-cmd-zdr: 1`
+* header per model, gated on `KNOWN_NON_ZDR_MODELS`): the decision endpoint is
+* reached through THIS module's own request path, never through the adapter's
+* chat connection, so the two cannot drift — and a deployment that later widens
+* ZDR must exclude this endpoint rather than route it through the switch.
+*
+* Auth is the plugin's ordinary chain (the multi-account pool, the credentials
+* seam, the CLI auth file) through the same `Authorization: Bearer <key>` and
+* `x-command-code-version` headers every other endpoint uses.
+*
+* @module dsh-commandcode-provider/systemone
+*/
+/** Path of the decision endpoint, relative to `apiBase`. */
+const SYSTEMONE_ROUTE = "/provider/v1/systemone";
+/** Milliseconds a decision may take before the caller gives up on it. */
+const SYSTEMONE_DEFAULT_TIMEOUT_MS = 1500;
+/** The one error type this client throws. Callers fail closed on it. */
+var SystemOneError = class extends Error {
+	kind;
+	status;
+	constructor(message, kind, status, options) {
+		super(message, options);
+		this.kind = kind;
+		this.status = status;
+		this.name = "SystemOneError";
+	}
+};
+/**
+* Combine the caller's signal with a timeout, keeping the two distinguishable:
+* a timeout is this client's own budget expiring (the guard delegates to the
+* user) while a caller abort means the approval was already withdrawn (answer
+* nothing) — both fail closed, but the diagnosis must not lie about which.
+*
+* The timer is a plain `setTimeout` rather than `AbortSignal.timeout()`, whose
+* timer Node unrefs: with nothing else pending (a test double, a socket that
+* never opened) an unref'd timer lets the process exit while the promise is
+* still pending, which reads as a hang rather than as the timeout it is.
+*/
+function deadlineOf(signal, timeoutMs) {
+	const controller = new AbortController();
+	let timedOut = false;
+	const timer = setTimeout(() => {
+		timedOut = true;
+		controller.abort();
+	}, timeoutMs);
+	const onCallerAbort = () => controller.abort();
+	if (signal !== void 0) {
+		if (signal.aborted) controller.abort();
+		else signal.addEventListener("abort", onCallerAbort, { once: true });
+	}
+	return {
+		signal: controller.signal,
+		callerAborted: () => signal?.aborted === true,
+		timedOut: () => timedOut,
+		dispose: () => {
+			clearTimeout(timer);
+			signal?.removeEventListener("abort", onCallerAbort);
+		}
+	};
+}
+/** Whether a caught value is an abort-shaped failure. */
+function isAbortError(error) {
+	return error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
+}
+/** Stop waiting for an operation that does not accept an AbortSignal. */
+function withinDeadline(operation, deadline, timeoutMs) {
+	return new Promise((resolve, reject) => {
+		const onAbort = () => {
+			reject(deadline.callerAborted() ? new SystemOneError("decision request aborted", "aborted") : new SystemOneError(`decision request timed out after ${timeoutMs}ms`, "timeout"));
+		};
+		deadline.signal.addEventListener("abort", onAbort, { once: true });
+		operation.then((value) => {
+			deadline.signal.removeEventListener("abort", onAbort);
+			resolve(value);
+		}, (error) => {
+			deadline.signal.removeEventListener("abort", onAbort);
+			reject(error);
+		});
+		if (deadline.signal.aborted) onAbort();
+	});
+}
+/** A finite number in `[0, 1]`, or undefined. */
+function probability(value) {
+	return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 1 ? value : void 0;
+}
+/** A finite number, or undefined. */
+function finite(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+/** A record of finite numbers (probabilities), or undefined when the shape is off. */
+function numberRecord(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) {
+		const parsed = finite(entry);
+		if (parsed === void 0) return void 0;
+		out[key] = parsed;
+	}
+	return out;
+}
+/**
+* Parse one answer entry strictly by its own `type`. A body whose answer does
+* not carry the member its type promises is rejected rather than defaulted:
+* an absent probability is exactly the case the caller must not read as "safe".
+*
+* @param value - one raw entry from the response's `answers` object.
+* @returns the parsed answer, or undefined when the entry is malformed.
+*/
+function parseSystemOneAnswer(value) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const raw = value;
+	if (raw.type === "noul") {
+		const noul = probability(raw.noul);
+		return noul === void 0 ? void 0 : {
+			type: "noul",
+			noul
+		};
+	}
+	if (raw.type === "choice") {
+		if (typeof raw.choice !== "string" || raw.choice === "") return void 0;
+		const confidence = raw.confidence === void 0 ? void 0 : probability(raw.confidence);
+		if (raw.confidence !== void 0 && confidence === void 0) return void 0;
+		const probabilities = raw.probabilities === void 0 ? void 0 : numberRecord(raw.probabilities);
+		if (raw.probabilities !== void 0 && probabilities === void 0) return void 0;
+		return {
+			type: "choice",
+			choice: raw.choice,
+			...confidence === void 0 ? {} : { confidence },
+			...probabilities === void 0 ? {} : { probabilities }
+		};
+	}
+	if (raw.type === "score") {
+		const score = finite(raw.score);
+		if (score === void 0) return void 0;
+		const confidence = raw.confidence === void 0 ? void 0 : probability(raw.confidence);
+		if (raw.confidence !== void 0 && confidence === void 0) return void 0;
+		const probabilities = raw.probabilities === void 0 ? void 0 : numberRecord(raw.probabilities);
+		if (raw.probabilities !== void 0 && probabilities === void 0) return void 0;
+		return {
+			type: "score",
+			score,
+			...confidence === void 0 ? {} : { confidence },
+			...probabilities === void 0 ? {} : { probabilities }
+		};
+	}
+}
+/**
+* Parse a decision response body. Every answer entry must be well formed — one
+* malformed entry fails the whole response, because a partially understood
+* decision is not a decision. Unknown extra members are ignored so a server-side
+* addition cannot break the guard.
+*
+* @param value - the decoded JSON body.
+* @returns the parsed response, or undefined when the body is not one.
+*/
+function parseSystemOneResponse(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const raw = value;
+	const rawAnswers = raw.answers;
+	if (typeof rawAnswers !== "object" || rawAnswers === null || Array.isArray(rawAnswers)) return void 0;
+	const entries = Object.entries(rawAnswers);
+	if (entries.length === 0) return void 0;
+	const answers = {};
+	for (const [id, entry] of entries) {
+		const answer = parseSystemOneAnswer(entry);
+		if (answer === void 0) return void 0;
+		answers[id] = answer;
+	}
+	const usage = raw.usage === void 0 ? void 0 : parseUsage(raw.usage);
+	if (raw.usage !== void 0 && usage === void 0) return void 0;
+	return {
+		...typeof raw.model === "string" ? { model: raw.model } : {},
+		answers,
+		...usage === void 0 ? {} : { usage }
+	};
+}
+/** Parse the optional `usage` member; an unreadable one is a malformed body. */
+function parseUsage(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const raw = value;
+	const inputTokens = raw.input_tokens === void 0 ? void 0 : finite(raw.input_tokens);
+	if (raw.input_tokens !== void 0 && inputTokens === void 0) return void 0;
+	const outputTokens = raw.output_tokens === void 0 ? void 0 : finite(raw.output_tokens);
+	if (raw.output_tokens !== void 0 && outputTokens === void 0) return void 0;
+	return {
+		...inputTokens === void 0 ? {} : { inputTokens },
+		...outputTokens === void 0 ? {} : { outputTokens }
+	};
+}
+/** Validate the outgoing request where the server would only reject it with a 400. */
+function assertRequest(request) {
+	const ids = Object.keys(request.questions);
+	if (ids.length === 0) throw new SystemOneError("a decision request needs at least one question", "invalid-request");
+	if (ids.length > 20) throw new SystemOneError(`a decision request carries at most 20 questions (got ${ids.length})`, "invalid-request");
+	for (const id of ids) if (id.trim() === "") throw new SystemOneError("every decision question needs a non-empty id", "invalid-request");
+}
+/** Read the endpoint's error body into a one-line diagnosis. */
+async function httpFailure(response) {
+	let detail = "";
+	try {
+		const slice = (await response.text()).trim().slice(0, 200);
+		if (slice !== "") detail = `: ${slice}`;
+	} catch {}
+	return new SystemOneError(`Command Code decision request failed (HTTP ${response.status})${detail}`, "http", response.status);
+}
+/**
+* Run one decision request.
+*
+* @param deps - connection facts, credential chain and fetch seam.
+* @param request - the state and typed questions.
+* @param options - caller cancellation and the per-call budget.
+* @returns the parsed decision.
+* @throws {SystemOneError} on every failure path; callers fail closed.
+*/
+async function runSystemOne(deps, request, options = {}) {
+	assertRequest(request);
+	const apiBase = deps.apiBase();
+	if (!URL.canParse(apiBase)) throw new SystemOneError(`Command Code decision request is misconfigured: apiBase ${JSON.stringify(apiBase)} is not a valid URL`, "invalid-request");
+	if (options.signal?.aborted === true) throw new SystemOneError("decision request aborted", "aborted");
+	const timeoutMs = options.timeoutMs ?? 1500;
+	const deadline = deadlineOf(options.signal, timeoutMs);
+	try {
+		let key;
+		try {
+			key = await withinDeadline(Promise.resolve().then(() => deps.resolveApiKey()), deadline, timeoutMs);
+		} catch (error) {
+			if (error instanceof SystemOneError && (error.kind === "aborted" || error.kind === "timeout")) throw error;
+			throw new SystemOneError(`Command Code decision request has no usable credential: ${error instanceof Error ? error.message : String(error)}`, "credential", void 0, { cause: error });
+		}
+		const body = {
+			model: request.model ?? "typesafe/jev",
+			state: request.state,
+			questions: request.questions
+		};
+		if (deadline.signal.aborted) throw deadline.callerAborted() ? new SystemOneError("decision request aborted", "aborted") : new SystemOneError(`decision request timed out after ${timeoutMs}ms`, "timeout");
+		let response;
+		try {
+			response = await (deps.fetchImpl ?? fetch)(`${apiBase.replace(/\/$/, "")}${SYSTEMONE_ROUTE}`, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Authorization: `Bearer ${key}`,
+					"x-command-code-version": COMMAND_CODE_CLI_VERSION,
+					...attributionHeaders()
+				},
+				body: JSON.stringify(body),
+				signal: deadline.signal
+			});
+		} catch (error) {
+			if (deadline.callerAborted()) throw new SystemOneError("decision request aborted", "aborted", void 0, { cause: error });
+			if (deadline.timedOut() || isAbortError(error)) throw new SystemOneError(`decision request timed out after ${timeoutMs}ms`, "timeout", void 0, { cause: error });
+			throw new SystemOneError(`Command Code decision request failed: ${error instanceof Error ? error.message : String(error)}`, "network", void 0, { cause: error });
+		}
+		if (!response.ok) throw await httpFailure(response);
+		let payload;
+		try {
+			payload = await response.json();
+		} catch (error) {
+			if (deadline.callerAborted()) throw new SystemOneError("decision request aborted", "aborted", void 0, { cause: error });
+			throw new SystemOneError("Command Code returned an unparseable decision body", "invalid-response", void 0, { cause: error });
+		}
+		const parsed = parseSystemOneResponse(payload);
+		if (parsed === void 0) throw new SystemOneError("Command Code returned a decision body this plugin cannot read", "invalid-response");
+		return parsed;
+	} finally {
+		deadline.dispose();
+	}
+}
+//#endregion
+//#region src/command-guard.ts
+/** Tool names whose `arguments.command` this guard judges. */
+const COMMAND_GUARD_SHELL_TOOLS = ["bash", "pwsh"];
+/** Question id the safety verdict is keyed by. */
+const COMMAND_GUARD_QUESTION_ID = "safe";
+/** Decision budget; the approval prompt must not wait longer than this. */
+const COMMAND_GUARD_DEFAULT_TIMEOUT_MS = SYSTEMONE_DEFAULT_TIMEOUT_MS;
+/** Bounds of the configurable probability, mirrored by the settings schemas. */
+const COMMAND_GUARD_MIN_THRESHOLD = .5;
+const COMMAND_GUARD_MAX_TIMEOUT_MS = 1e4;
+/**
+* Longest command the guard will send for judgement. A longer one is delegated
+* instead of truncated: a verdict on the first N characters of a command is a
+* verdict on a different command.
+*/
+const COMMAND_GUARD_MAX_COMMAND_CHARS = 6e3;
+/**
+* Hard denylist: commands the guard never auto-approves, and never even sends
+* for judgement. Each entry is a deliberate, narrow reading of one destructive
+* family — the goal is not to classify every dangerous command (that is the
+* model's job) but to make sure the classics cannot be talked into a grant by a
+* persuasive-looking command string.
+*
+* Every pattern is allowed to OVER-match: a false positive costs one ordinary
+* human prompt, while a false negative would hand a destructive command to a
+* model that has to guess. That asymmetry is why `sudo` is matched anywhere in
+* the line rather than only in command position, and why `fdisk` is listed even
+* though `fdisk -l` only lists partitions.
+*/
+const COMMAND_GUARD_DENY_LIST = [
+	{
+		id: "rm-root",
+		pattern: /\brm\s+(?:-[a-zA-Z]*[rR][a-zA-Z]*f[a-zA-Z]*|-[a-zA-Z]*f[a-zA-Z]*[rR][a-zA-Z]*|--recursive[^\n]*--force|--force[^\n]*--recursive)\s+(?:\/|\/\*|~|~\/\*|\$HOME(?:\/\*)?|\*|\.\/\*|\.)(?:\s|$)/
+	},
+	{
+		id: "rm-home",
+		pattern: /\brm\s+-[a-zA-Z]*[rR][a-zA-Z]*\s+(?:~|\$HOME)\//
+	},
+	{
+		id: "filesystem-write",
+		pattern: /\b(?:mkfs(?:\.\w+)?|wipefs|fdisk|parted|shred)\b/
+	},
+	{
+		id: "raw-device-write",
+		pattern: /\bdd\b[^\n]*\bof=\/dev\//
+	},
+	{
+		id: "device-redirect",
+		pattern: /(?:^|[^0-9\w])>{1,2}\s*\/dev\/(?:sd|disk|nvme|hd)/
+	},
+	{
+		id: "fork-bomb",
+		pattern: /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/
+	},
+	{
+		id: "privilege-escalation",
+		pattern: /\b(?:sudo|doas)\b/
+	},
+	{
+		id: "su",
+		pattern: /\bsu\s/
+	},
+	{
+		id: "chmod-world-write",
+		pattern: /\bchmod\b[^\n]*\b(?:777|a\+w|o\+w)\b/
+	},
+	{
+		id: "chown-root",
+		pattern: /\bchown\b[^\n]*\b(?:root|0):/
+	},
+	{
+		id: "git-push",
+		pattern: /\bgit\s+push\b/
+	},
+	{
+		id: "git-history-rewrite",
+		pattern: /\bgit\s+(?:filter-branch|filter-repo)\b/
+	},
+	{
+		id: "git-hard-reset",
+		pattern: /\bgit\s+reset\s+--hard\b/
+	},
+	{
+		id: "git-clean-force",
+		pattern: /\bgit\s+clean\b[^\n]*\s-[a-zA-Z]*f/
+	},
+	{
+		id: "git-discard-worktree",
+		pattern: /\bgit\s+(?:checkout|restore)\s+(?:--\s+)?\.(?:\s|$)/
+	},
+	{
+		id: "git-stash-drop",
+		pattern: /\bgit\s+stash\s+(?:drop|clear)\b/
+	},
+	{
+		id: "publish",
+		pattern: /\b(?:npm|pnpm|yarn|bun)\s+publish\b/
+	},
+	{
+		id: "release-upload",
+		pattern: /\b(?:gh\s+release|twine\s+upload)\b/
+	},
+	{
+		id: "docker-push",
+		pattern: /\bdocker\s+push\b/
+	},
+	{
+		id: "cloud-upload",
+		pattern: /\b(?:aws\s+s3|gsutil|gcloud\s+storage|az\s+storage)\b[^\n]*\b(?:cp|sync|mv|rm|rb)\b/
+	},
+	{
+		id: "remote-copy",
+		pattern: /\b(?:scp|rsync)\b[^\n]*(?::|@)/
+	},
+	{
+		id: "pipe-to-shell",
+		pattern: /\b(?:curl|wget|fetch)\b[^\n|]*\|\s*(?:sudo\s+)?(?:sh|bash|zsh|dash|ksh|python\d*|node|ruby|perl)\b/
+	},
+	{
+		id: "power",
+		pattern: /\b(?:shutdown|reboot|halt|poweroff)\b/
+	},
+	{
+		id: "kill-everything",
+		pattern: /\bkill\s+(?:-9\s+)?-1\b|\b(?:killall|pkill)\s+-9\b/
+	},
+	{
+		id: "credential-write",
+		pattern: /(?:>{1,2}|tee|cp|mv|rm|chmod|chown)\s[^\n]*(?:\.ssh\b|\.aws\b|\.gnupg\b|\.commandcode\/auth\.json|id_rsa|id_ed25519)/
+	},
+	{
+		id: "history-clear",
+		pattern: /\bhistory\s+-c\b|\bunset\s+HISTFILE\b/
+	},
+	{
+		id: "global-install",
+		pattern: /\b(?:npm|pnpm|yarn|bun)\s+(?:i|install|add)\s+(?:-g\b|--global\b)/
+	},
+	{
+		id: "system-install",
+		pattern: /\b(?:apt|apt-get|dnf|yum|zypper|apk|pacman|brew)\s+(?:install|remove|purge|uninstall|upgrade)\b/
+	},
+	{
+		id: "language-install",
+		pattern: /\b(?:pip3?|pipx|gem|cargo)\s+(?:install|add)\b/
+	}
+];
+/**
+* Why the guard refuses to judge a command, when it does.
+*
+* @param command - the raw command text.
+* @returns the matching denylist id, or undefined.
+*/
+function denyReasonOf(command) {
+	for (const entry of COMMAND_GUARD_DENY_LIST) if (entry.pattern.test(command)) return entry.id;
+}
+/** A non-empty string member, or undefined. */
+function stringMember(value, key) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const member = value[key];
+	return typeof member === "string" && member.trim() !== "" ? member : void 0;
+}
+/**
+* Read a shell command out of a tool execution, or undefined when this call is
+* not one the guard judges (a different tool, or arguments without a command).
+*
+* @param name - the executed tool's name.
+* @param args - the execution's parsed `arguments`.
+* @returns the fact to judge, without the asker's reason (that arrives later).
+*/
+function shellCommandOf(name, args) {
+	if (!COMMAND_GUARD_SHELL_TOOLS.includes(name)) return void 0;
+	const command = stringMember(args, "command");
+	if (command === void 0) return void 0;
+	const description = stringMember(args, "description");
+	const workdir = stringMember(args, "workdir");
+	const sandboxPermissions = stringMember(args, "sandbox_permissions");
+	return {
+		tool: name,
+		command,
+		...description === void 0 ? {} : { description },
+		...workdir === void 0 ? {} : { workdir },
+		...sandboxPermissions === void 0 ? {} : { sandboxPermissions }
+	};
+}
+/**
+* Build the decision request for one command.
+*
+* The question is deliberately one `noul`: a single probability is a decision
+* rule that can be explained, thresholded and logged in one line, and the
+* criteria carry the whole distinction between "reads, or writes reversibly
+* inside the project" and "everything else". The agent's own `description` is
+* included as context, but the criteria say the command text itself decides — a
+* model-written description is a claim, not evidence.
+*
+* @param fact - the command and its context.
+* @returns the request to send.
+*/
+function buildSafetyRequest(fact) {
+	const lines = [
+		`Tool: ${fact.tool}`,
+		"Command:",
+		fact.command,
+		...fact.description === void 0 ? [] : ["", `The agent describes this command as: ${fact.description}`],
+		...fact.workdir === void 0 ? [] : ["", `Working directory: ${fact.workdir}`],
+		...fact.sandboxPermissions === void 0 ? [] : ["", `The harness is asking because this call requests a wider sandbox mode (${fact.sandboxPermissions}) than the one currently in force.`],
+		...fact.reason === void 0 ? [] : ["", `The asker's reason for needing approval: ${fact.reason}`]
+	];
+	const question = {
+		type: "noul",
+		instructions: "Is it safe to run this command right now WITHOUT asking the user first? Judge the command text itself; a description is only a claim about it.",
+		criteria: {
+			true: "Read-only, or its effects stay inside the current project and are trivially reversible: no data leaves the machine, nothing outside the project is modified, and no credentials, git history or remote state are touched.",
+			false: "Anything else. Deleting or overwriting files outside the project, rewriting or publishing git history, uploading data anywhere, installing system or global packages, changing permissions, ownership or credentials, killing processes, running as another user or as root, piping a download into a shell, or a command obfuscated enough that its effect cannot be read."
+		}
+	};
+	return {
+		state: lines.join("\n"),
+		questions: { [COMMAND_GUARD_QUESTION_ID]: question }
+	};
+}
+/**
+* Read the safety probability out of a decision response.
+*
+* @param response - the parsed response.
+* @param questionId - the question id to read (defaults to the guard's own).
+* @returns the probability of "safe", or undefined when the answer is missing
+*   or is not a `noul` verdict.
+*/
+function safeProbabilityOf(response, questionId = COMMAND_GUARD_QUESTION_ID) {
+	const answer = response.answers[questionId];
+	return answer !== void 0 && answer.type === "noul" ? answer.noul : void 0;
+}
+/**
+* One-line, length-bounded excerpt of a command for the log. The full text is
+* already in the session's tool call and was already sent to the decision
+* endpoint, so this adds no exposure — it is what makes "why did this run
+* without asking?" answerable from the log alone.
+*/
+function commandExcerpt(command, limit = 160) {
+	const flat = command.replace(/\s+/g, " ").trim();
+	return flat.length <= limit ? flat : `${flat.slice(0, limit - 1)}…`;
+}
+/**
+* The guard's stateful half: what was executed (by call id) and what has
+* already been decided (by agent and complete decision context), both bounded.
+*
+* The execution cache is the bridge between the two seams — `tools/pre-execute`
+* knows the arguments, `approval/request` knows the call id — and it is keyed by
+* call id with an agent-identity check when read: an entry for an execution
+* that never asked is never read, so there is nothing to clean up on the result
+* side (and the ask happens before the result anyway).
+*/
+var CommandGuard = class {
+	deps;
+	executions = /* @__PURE__ */ new Map();
+	decisions = /* @__PURE__ */ new WeakMap();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Remember one execution's command. Never throws, never changes a decision.
+	*
+	* @param execution - the execution about to run.
+	*/
+	noteExecution(execution) {
+		const callId = execution?.callId;
+		if (typeof callId !== "string" || callId === "") return;
+		const fact = shellCommandOf(execution.name, execution.arguments);
+		if (fact === void 0) return;
+		this.executions.delete(callId);
+		this.executions.set(callId, {
+			fact,
+			agent: execution.agent
+		});
+		while (this.executions.size > 64) {
+			const oldest = this.executions.keys().next();
+			if (oldest.done === true) break;
+			this.executions.delete(oldest.value);
+		}
+	}
+	/** Forget every remembered execution and decision (disposal, tests). */
+	clear() {
+		this.executions.clear();
+		this.decisions = /* @__PURE__ */ new WeakMap();
+	}
+	/**
+	* Judge one approval request.
+	*
+	* @param request - the pending approval.
+	* @returns the verdict; `approve` is the only outcome that grants anything.
+	*/
+	async judge(request) {
+		const settings = this.deps.settings();
+		if (!settings.enabled) return {
+			kind: "delegate",
+			reason: "guard disabled"
+		};
+		const callId = request.callId;
+		if (callId === void 0) return {
+			kind: "delegate",
+			reason: "approval carries no call id"
+		};
+		const observed = this.executions.get(callId);
+		if (observed === void 0 || observed.agent !== request.agent) return {
+			kind: "delegate",
+			reason: "the guard never saw this call for this agent"
+		};
+		const fact = observed.fact;
+		const excerpt = commandExcerpt(fact.command);
+		if (!COMMAND_GUARD_SHELL_TOOLS.includes(request.toolName)) return {
+			kind: "delegate",
+			reason: `not a shell tool (${request.toolName})`
+		};
+		if (fact.command.length > 6e3) return {
+			kind: "delegate",
+			reason: `command longer than ${COMMAND_GUARD_MAX_COMMAND_CHARS} characters`,
+			command: excerpt
+		};
+		const denied = denyReasonOf(fact.command);
+		if (denied !== void 0) return {
+			kind: "delegate",
+			reason: `denylisted command (${denied})`,
+			command: excerpt
+		};
+		const full = {
+			...fact,
+			...request.reason === void 0 ? {} : { reason: request.reason }
+		};
+		const memoKey = JSON.stringify(full);
+		const now = this.deps.now?.() ?? Date.now();
+		const agentDecisions = request.agent === void 0 ? void 0 : this.decisions.get(request.agent);
+		const memo = agentDecisions?.get(memoKey);
+		if (memo !== void 0) {
+			if (now - memo.at < 6e5) return this.verdict(memo.probability, settings.threshold, "memo", excerpt);
+			agentDecisions?.delete(memoKey);
+		}
+		let response;
+		try {
+			response = await this.deps.decide(buildSafetyRequest(full), {
+				...request.signal === void 0 ? {} : { signal: request.signal },
+				timeoutMs: settings.timeoutMs
+			});
+		} catch (error) {
+			return {
+				kind: "delegate",
+				reason: `decision unavailable: ${error instanceof Error ? error.message : String(error)}`,
+				command: excerpt
+			};
+		}
+		const probability = safeProbabilityOf(response);
+		if (probability === void 0) return {
+			kind: "delegate",
+			reason: "the decision carried no safe verdict",
+			command: excerpt
+		};
+		if (request.agent !== void 0) {
+			const decisions = agentDecisions ?? /* @__PURE__ */ new Map();
+			decisions.set(memoKey, {
+				probability,
+				at: now
+			});
+			while (decisions.size > 64) {
+				const oldest = decisions.keys().next();
+				if (oldest.done === true) break;
+				decisions.delete(oldest.value);
+			}
+			this.decisions.set(request.agent, decisions);
+		}
+		return this.verdict(probability, settings.threshold, "model", excerpt);
+	}
+	/** Apply the threshold to one probability. */
+	verdict(probability, threshold, source, command) {
+		return probability >= threshold ? {
+			kind: "approve",
+			probability,
+			source,
+			command
+		} : {
+			kind: "delegate",
+			reason: `safe probability ${probability.toFixed(3)} below ${threshold}`,
+			probability,
+			command
+		};
+	}
+};
+/**
+* Register the guard on a context that has the approval seam.
+*
+* Call this from inside `ctx.inject(['approval'], …)`: the seam's presence is
+* what makes the feature meaningful (no approval service means no asks), and
+* tying the listeners to that injected fiber is what makes them go away with it.
+*
+* @param ctx - the injected context (or a test double with `on`).
+* @param deps - settings, the decision client, clock and logger.
+* @returns a disposer for both listeners.
+*/
+function applyCommandGuard(ctx, deps) {
+	const guard = new CommandGuard(deps);
+	const events = ctx;
+	const offPreExecute = events.on("tools/pre-execute", (execution, next) => {
+		guard.noteExecution(execution);
+		return next();
+	}, { prepend: true });
+	const offApproval = events.on("approval/request", async (request, next) => {
+		try {
+			if (!deps.settings().enabled) return next();
+		} catch (error) {
+			deps.log?.(`command guard failed: ${error instanceof Error ? error.message : String(error)}`);
+			return next();
+		}
+		let verdict;
+		try {
+			verdict = await guard.judge(request);
+		} catch (error) {
+			deps.log?.(`command guard failed: ${error instanceof Error ? error.message : String(error)}`);
+			return next();
+		}
+		if (verdict.kind === "approve") {
+			deps.log?.(`command guard auto-approved a ${request.toolName} call (safe probability ${verdict.probability.toFixed(3)}, ${verdict.source}): ${verdict.command ?? "(command unknown)"}`);
+			return "allowed-once";
+		}
+		deps.log?.(`command guard delegated a ${request.toolName} call: ${verdict.reason}${verdict.command === void 0 ? "" : ` — ${verdict.command}`}`);
+		return next();
+	}, { prepend: true });
+	return () => {
+		guard.clear();
+		for (const off of [offPreExecute, offApproval]) if (typeof off === "function") off();
+	};
+}
+//#endregion
+//#region src/config-volatile.ts
+/**
+* Mark one schema field volatile when the installed schemastery supports it.
+* @param schema - The field schema (any generation).
+* @returns The schema carrying `meta.volatile`, or the schema itself on an
+* engine whose schemastery predates `.volatile()`.
+*/
+function markVolatile(schema) {
+	const candidate = schema;
+	if (typeof candidate.volatile !== "function") return schema;
+	return candidate.volatile();
+}
+/**
+* Mark every field of a Config field dict volatile, except the named
+* composition-only secrets (`apiKey` here, which no settings surface writes).
+*
+* The result is a NEW dict of schema instances: callers that also need an
+* UNMARKED schema for the legacy settings generation must build the fields
+* twice (`configFields()`), never share one dict — `.volatile()` clones per
+* call, and a shared instance would carry the mark into the legacy schema.
+*
+* @param fields - Freshly built field schemas.
+* @param skip - Field names that must stay unmarked.
+* @returns The field dict with every non-skipped field marked.
+*/
+function markVolatileFields(fields, skip = []) {
+	return Object.fromEntries(Object.entries(fields).map(([name, schema]) => [name, skip.includes(name) ? schema : markVolatile(schema)]));
+}
+/**
+* Whether a resolved config value is a volatile reference.
+*
+* Duck-typed on the two properties `createVolatile` produces (frozen object
+* with a `get` method) rather than cosmokit's private `write` symbol, because
+* cosmokit is not a peer of this bundle. Config values are plain parsed JSON
+* (or `!!jsExpr` wrappers), which are never frozen, so the test cannot
+* misfire on an ordinary field.
+*/
+function isVolatileRef(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && Object.isFrozen(value) && typeof value.get === "function";
+}
+/**
+* Read one config object as PLAIN values across generations.
+*
+* Each top-level field found to be a volatile reference is read through
+* `.get()` — freshly on every call, so a live update lands on the very next
+* read. When no field is a reference the input object is returned as-is,
+* keeping reference identity stable for identity-keyed memos on engines that
+* hand `apply()` plain config.
+*/
+function unwrapVolatileConfig(config) {
+	const source = config;
+	if (typeof source !== "object" || source === null) return config;
+	let found = false;
+	const plain = {};
+	for (const [field, value] of Object.entries(source)) if (isVolatileRef(value)) {
+		plain[field] = value.get();
+		found = true;
+	} else plain[field] = value;
+	return found ? plain : config;
+}
+//#endregion
+//#region src/index.ts
+/**
+* dsh-commandcode-provider — DeepSeek Harness LLM provider plugin for Command
+* Code (unofficial; ported from pi-commandcode-provider@0.5.1).
+*
+* Registers the `commandcode` provider route on `ctx.llm` and declares it in
+* the configurable-provider directory, so the web Models page shows a
+* "Command Code" card with an API-key field and the model picker lists the
 * live Command Code model catalog. Connection facts resolve per request over
-* the optional `llm-commandcode` user-settings section and the credential
-* seam, so a changed key, endpoint, or cache path reaches the next request
-* without a restart.
+* the plugin's live config — the `llm-commandcode` settings section through
+* dsh 0.1.6, profile Config (volatile fields, unwrapped per read) from 0.1.7
+* — and the credential seam, so a changed key, endpoint, or cache path
+* reaches the next request without a restart.
 *
 * ```yaml
 * - id: llm-commandcode
@@ -6717,41 +8129,88 @@ const DEFAULT_API_KEY_ENV = "COMMANDCODE_API_KEY";
 const PROVIDER = "commandcode";
 /** Default models cache path (mirrors the pi plugin's on-disk cache). */
 const DEFAULT_MODELS_CACHE_PATH = join(homedir(), ".commandcode", "models-cache.json");
-const Config = z.object({
-	apiKeyEnv: z.string().role("credential-ref").default(DEFAULT_API_KEY_ENV),
-	apiKey: z.string().role("secret"),
-	apiBase: z.string(),
-	workingDir: z.string(),
-	modelsCachePath: z.string(),
-	requestTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
-	streamIdleTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
-	transportMaxRetries: z.number().min(0).max(50),
-	filterModelsByPlan: z.boolean(),
-	visibleModels: z.array(z.string()),
-	/**
-	* Per-model visibility overrides for the terminal settings page's checkbox
-	* list, keyed by catalog id. dsh-TUI addresses a staged edit by its field
-	* PATH, so two checkboxes sharing one path would overwrite each other's
-	* draft and the section's last model would decide every write; a map gives
-	* each checkbox a path of its own. An id listed here wins over
-	* {@link visibleModels}; ids absent here keep following it.
-	*/
-	modelVisibility: z.dict(z.boolean()),
-	webSearch: z.boolean().default(true),
-	showSidebarQuota: z.boolean().default(false),
-	accounts: z.array(z.object({
-		label: z.string(),
-		apiKeyEnv: z.string().role("credential-ref"),
-		/** Literal key for one extra slot; see the top-level `apiKey` secret note. */
-		apiKey: z.string().role("secret")
-	})),
-	activeAccount: z.string(),
-	modelAccountRules: z.array(z.object({
-		models: z.array(z.string()),
-		account: z.string()
-	})),
-	lang: z.string().pattern(/^(zh|en)$/).default("zh")
-});
+/**
+* The Config schema's fields, freshly built on every call.
+*
+* A FACTORY, not a shared dict, and that is load-bearing: the exported
+* {@link Config} marks every field volatile while {@link LegacySettingsSchema}
+* must carry no mark at all, and schemastery's schema instances are
+* single-purpose objects — sharing one dict would leak the marks into the
+* legacy registration (see `config-volatile.ts` for why that is a boot-time
+* `ValidationError` on ≤0.1.6 engines whose schemastery resolved to ≥3.18.3).
+*
+* @returns One fresh schema instance per Config field.
+*/
+function configFields() {
+	return {
+		apiKeyEnv: z.string().role("credential-ref").default(DEFAULT_API_KEY_ENV),
+		apiKey: z.string().role("secret"),
+		apiBase: z.string(),
+		workingDir: z.string(),
+		modelsCachePath: z.string(),
+		requestTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
+		streamIdleTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
+		transportMaxRetries: z.number().min(0).max(50),
+		filterModelsByPlan: z.boolean(),
+		visibleModels: z.array(z.string()),
+		/**
+		* Per-model visibility overrides for the terminal settings page's checkbox
+		* list, keyed by catalog id. dsh-TUI addresses a staged edit by its field
+		* PATH, so two checkboxes sharing one path would overwrite each other's
+		* draft and the section's last model would decide every write; a map gives
+		* each checkbox a path of its own. An id listed here wins over
+		* {@link Config.visibleModels}; ids absent here keep following it.
+		*/
+		modelVisibility: z.dict(z.boolean()),
+		webSearch: z.boolean().default(true),
+		showSidebarQuota: z.boolean().default(false),
+		accounts: z.array(z.object({
+			label: z.string(),
+			apiKeyEnv: z.string().role("credential-ref"),
+			/** Literal key for one extra slot; see the top-level `apiKey` secret note. */
+			apiKey: z.string().role("secret")
+		})),
+		activeAccount: z.string(),
+		modelAccountRules: z.array(z.object({
+			models: z.array(z.string()),
+			account: z.string()
+		})),
+		commandGuard: z.boolean().default(false),
+		commandGuardThreshold: z.number().min(COMMAND_GUARD_MIN_THRESHOLD).max(1),
+		commandGuardTimeoutMs: z.number().min(200).max(COMMAND_GUARD_MAX_TIMEOUT_MS),
+		zdr: z.boolean().default(false),
+		lang: z.string().pattern(/^(zh|en)$/).default("zh")
+	};
+}
+/**
+* The 0.1.7-generation schema: every field volatile except the
+* composition-only `apiKey` secret.
+*
+* dsh 0.1.7's settings forms are projected from the schema's `meta.volatile`
+* nodes, so an unmarked field would be invisible to AND unwritable from the
+* settings page and refused by form-edit path validation — and on that
+* generation the loader hands `apply()` a live reference per marked field,
+* committing later writes without remounting this fiber (the
+* `loader/volatile-update` listener at the bottom of `apply` covers the facts
+* that are not re-derived per read). The mark is inert on engines whose
+* schemastery predates `.volatile()`.
+*/
+const Config = z.object(markVolatileFields(configFields(), ["apiKey"]));
+/**
+* The ≤0.1.6-generation registration schema: the same fields, NO volatile
+* marks.
+*
+* The legacy `installSection(owner, ns, schema, entry, hooks)` re-validates the
+* `entry` it is handed (`register()` → `resolve()` → `schema(mergeLayers(base,
+* section))`) and its `describe()` structuredClones that same `entry`. Since
+* schemastery ≥3.18.3 creates references at parse time on EVERY generation —
+* `dsh-settings` through 0.1.6 declares `schemastery: ^3.18.2`, so old engines
+* freshly installed today resolve 3.18.3 — a marked schema plus the raw
+* reference-carrying `config` is a boot-time `ValidationError` there. This
+* schema is therefore unmarked, and `apply` pairs it with
+* `unwrapVolatileConfig(config)`.
+*/
+const LegacySettingsSchema = z.object(configFields());
 /**
 * The one explicit resolve step from raw config to validated connection
 * facts. Programmatic construction may bypass Schemastery normalization, so
@@ -6768,7 +8227,8 @@ function resolveAdapterOptions(config) {
 		streamIdleTimeoutMs: config.streamIdleTimeoutMs ?? 3e5,
 		filterModelsByPlan: config.filterModelsByPlan ?? true,
 		visibleModels: Array.isArray(config.visibleModels) ? config.visibleModels.filter((id) => typeof id === "string" && id !== "") : void 0,
-		modelVisibility: readModelVisibility(config.modelVisibility)
+		modelVisibility: readModelVisibility(config.modelVisibility),
+		zdr: config.zdr === true
 	};
 }
 /**
@@ -6785,7 +8245,8 @@ function readModelVisibility(raw) {
 }
 function apply(ctx, config) {
 	installCostProjection(ctx);
-	let current = () => config;
+	let source = () => config;
+	const current = () => unwrapVolatileConfig(source());
 	let lastRaw;
 	let lastGood;
 	const options = () => {
@@ -6981,6 +8442,26 @@ function apply(ctx, config) {
 			applyCommandCodeSearchSelection(webCtx.web, searchSelection, false);
 		}, "dsh-commandcode-provider: web search selection");
 	});
+	const commandGuardSettings = () => {
+		const raw = current();
+		return {
+			enabled: raw.commandGuard === true,
+			threshold: raw.commandGuardThreshold ?? .9,
+			timeoutMs: raw.commandGuardTimeoutMs ?? COMMAND_GUARD_DEFAULT_TIMEOUT_MS
+		};
+	};
+	ctx.inject(["approval"], (approvalCtx) => {
+		applyCommandGuard(approvalCtx, {
+			settings: commandGuardSettings,
+			decide: (request, decideOptions) => runSystemOne({
+				apiBase: () => options().apiBase,
+				resolveApiKey: () => resolveApiKey(options())
+			}, request, decideOptions),
+			log: (message) => {
+				ctx.logger.info(`llm-commandcode: ${message}`);
+			}
+		});
+	});
 	let refreshTuiSettings;
 	ctx.inject(["tuiSettingsSections"], (tuiCtx) => {
 		refreshTuiSettings = applyCommandCodeTuiSettings(tuiCtx, {
@@ -6998,18 +8479,38 @@ function apply(ctx, config) {
 		}, "dsh-commandcode-provider: tui settings handle");
 	});
 	ctx.inject(["settings"], (settingsCtx) => {
-		settingsCtx.settings.installSection(ctx, NS, Config, config, {
-			setSource: (source) => {
-				current = source;
-			},
-			onChange: () => {
-				applySearchSelection(current().webSearch ?? true);
-				refreshTuiSettings?.();
-			}
-		});
+		const service = settingsCtx.settings;
+		if (typeof service.installSection === "function") {
+			service.installSection(ctx, NS, LegacySettingsSchema, unwrapVolatileConfig(config), {
+				setSource: (next) => {
+					source = next;
+				},
+				onChange: () => {
+					applySearchSelection(current().webSearch ?? true);
+					refreshTuiSettings?.();
+				}
+			});
+			return;
+		}
+		if (typeof service.configure === "function") settingsCtx.effect(() => {
+			const dispose = service.configure?.({ auto: false }, ctx.fiber);
+			return () => {
+				dispose?.();
+			};
+		}, "dsh-commandcode-provider: settings auto-form policy");
 	});
+	const loaderEvents = ctx;
+	ctx.effect(() => {
+		const off = loaderEvents.on("loader/volatile-update", () => {
+			applySearchSelection(current().webSearch ?? true);
+			refreshTuiSettings?.();
+		});
+		return () => {
+			if (typeof off === "function") off();
+		};
+	}, "dsh-commandcode-provider: volatile config updates");
 }
 //#endregion
-export { ACTIVE_ACCOUNT_AUTO, BILLING_ACCESS_TTL_MS, COMMANDCODE_SEARCH_PROVIDER_ID, COMMAND_CODE_CLI_VERSION, CommandCodeAccountPool, CommandCodeAdapter, CommandCodeLoginFlow, CommandCodeSearchProvider, CommandCodeUsageService, Config, DEFAULT_API_BASE, DEFAULT_GENERATE_MAX_TOKENS, DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_MODELS_CACHE_PATH, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_WEB_SEARCH_PROVIDER_ID, KNOWN_DEALS, KNOWN_EFFORTS, KNOWN_IMAGE_MODELS, KNOWN_PEAK_PRICING, KNOWN_PLANS, KNOWN_SUBSCRIPTION_PLANS, KNOWN_THINKING_MODELS, LANG_AUTO, LOGIN_ALLOWED_ORIGINS, LOGIN_BEGIN_ENDPOINT, LOGIN_BODY_LIMIT_BYTES, LOGIN_CANCEL_ENDPOINT, LOGIN_MAX_PORT_ATTEMPTS, LOGIN_START_PORT, LOGIN_STATUS_ENDPOINT, LOGIN_TIMEOUT_MS, PLAN_LABELS, PLAN_ORDER, PROVIDER, USAGE_REPORT_ENDPOINT, accountUsable, apply, applyCommandCodeSearchSelection, applyCommandCodeTuiSettings, applyCommands, applyUsageRemote, buildCommandAuthUrl, buildCommandCodeTuiSection, capabilityDescription, commandCodeSearchSelection, commandDefinition, compareByPlan, dealLabel, formatContext, inject, loginStatusSchema, matchModelRule, modelVisibleInPlan, name, parseLoginStatus, peakPricingLabel, peakPricingState, planLabel, projectSlugFromPath, resolveAdapterOptions, resolveAuthFileApiKey, selectAccountForModel, selectActiveAccount, selectCommandCodeSearchProvider, studioBaseForApiBase, subscriptionPlanInfo, usageReportSchema, validateCommandApiKey };
+export { ACTIVE_ACCOUNT_AUTO, BILLING_ACCESS_TTL_MS, COMMANDCODE_SEARCH_PROVIDER_ID, COMMAND_CODE_CLI_VERSION, CommandCodeAccountPool, CommandCodeAdapter, CommandCodeLoginFlow, CommandCodeSearchProvider, CommandCodeUsageService, Config, DEFAULT_API_BASE, DEFAULT_GENERATE_MAX_TOKENS, DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_MODELS_CACHE_PATH, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_WEB_SEARCH_PROVIDER_ID, KNOWN_DEALS, KNOWN_EFFORTS, KNOWN_IMAGE_MODELS, KNOWN_NON_ZDR_MODELS, KNOWN_PEAK_PRICING, KNOWN_PLANS, KNOWN_SUBSCRIPTION_PLANS, KNOWN_THINKING_MODELS, LANG_AUTO, LOGIN_ALLOWED_ORIGINS, LOGIN_BEGIN_ENDPOINT, LOGIN_BODY_LIMIT_BYTES, LOGIN_CANCEL_ENDPOINT, LOGIN_MAX_PORT_ATTEMPTS, LOGIN_START_PORT, LOGIN_STATUS_ENDPOINT, LOGIN_TIMEOUT_MS, LegacySettingsSchema, PLAN_LABELS, PLAN_ORDER, PROVIDER, USAGE_REPORT_ENDPOINT, accountUsable, apply, applyCommandCodeSearchSelection, applyCommandCodeTuiSettings, applyCommands, applyUsageRemote, buildCommandAuthUrl, buildCommandCodeTuiSection, capabilityDescription, commandCodeSearchSelection, commandDefinition, compareByPlan, dealLabel, formatContext, inject, loginStatusSchema, matchModelRule, modelVisibleInPlan, name, parseLoginStatus, peakPricingLabel, peakPricingState, planLabel, projectSlugFromPath, resolveAdapterOptions, resolveAuthFileApiKey, selectAccountForModel, selectActiveAccount, selectCommandCodeSearchProvider, studioBaseForApiBase, subscriptionPlanInfo, supportsZeroDataRetention, usageReportSchema, validateCommandApiKey };
 
 //# sourceMappingURL=index.js.map