@mars-sea/dsh-commandcode-provider 0.11.9 → 0.11.10

package/lib/index.js

@@ -284,6 +284,27 @@ const KNOWN_EFFORTS = {
 		"xhigh",
 		"max"
 	],
+	"claude-opus-5-5": [
+		"low",
+		"medium",
+		"high",
+		"xhigh",
+		"max"
+	],
+	"gpt-6-luna": [
+		"low",
+		"medium",
+		"high",
+		"xhigh",
+		"max"
+	],
+	"gpt-6-sol": [
+		"low",
+		"medium",
+		"high",
+		"xhigh",
+		"max"
+	],
 	"MiniMaxAI/MiniMax-M3": [
 		"low",
 		"medium",
@@ -320,6 +341,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"claude-haiku-4-5-20251001",
 	"claude-opus-4-7",
 	"claude-opus-4-8",
+	"claude-opus-5-5",
 	"claude-opus-5",
 	"claude-sonnet-4-6",
 	"claude-sonnet-5",
@@ -339,6 +361,8 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"gpt-5.6-sol",
 	"gpt-5.6-terra",
 	"gpt-6-astra",
+	"gpt-6-luna",
+	"gpt-6-sol",
 	"meta/muse-spark-1.1",
 	"meta/muse-spark-1.2",
 	"meta/muse-spark-1.2-contributor",
@@ -365,6 +389,69 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"z-ai/glm-5.3-flashx"
 ]);
 /**
+* Models WITHOUT a zero-data-retention upstream, per the official CLI's own
+* registry (`command-code@1.64.0` `dist/cli.mjs`: `modelSupportsZdr(id)` is
+* exactly `!nonZdrSet.has(canonicalize(id))`, and `knownModelSupportsZdr`
+* carries the same membership in the sibling route table — the union is this
+* set). The official docs (commandcode.ai/docs/resources/zdr) put it in prose
+* — "99% of our models have ZDR-capable upstreams … only a small handful of
+* models are affected" — so the CLI's exclusion list is the only per-model
+* evidence there is; a ZDR request naming one of these fails with HTTP 422
+* `cmd_zdr_no_providers` instead of routing through a provider that retains.
+*
+* Why a NEGATIVE set, and why "not listed" answers TRUE: 99% of the catalog is
+* covered, so the maintained difference is the exception list. This helper is
+* informational; the adapter sends the ZDR header for EVERY request when the
+* switch is on. The provider remains the routing authority and refuses an
+* unsupported model rather than silently dropping the privacy guarantee.
+*
+* `minimax/minimax-m3-free` is the one entry the public catalog
+* (`/provider/v1/models`) does not serve (it is CLI/pricing-visible and hidden
+* from the picker); it stays listed because the CLI carries it and a Go-plan
+* request can still name it.
+*
+* Keep in sync via the dsh-commandcode-upstream skill: the CLI's registry data
+* (its `zdr:{only:[…]}` provider routes and the per-provider `zdr`/`noTraining`
+* flags) is upstream-internal routing, not a per-model contract, so this table
+* is the snapshot of the exclusion set and nothing more. The 1.62.0 → 1.64.0
+* diff of that union is EMPTY: both anchors were extracted from both bundles
+* during the 2026-09-23 check and each carries the same 20 members — which is
+* how rare a change here is expected to be. `meituan/LongCat-2.0` is the one
+* member the two anchors disagree about (it is in `modelSupportsZdr`'s set in
+* both releases and in neither `knownModelSupportsZdr` set), so the union is
+* what this table follows; reading only the sibling route table would drop it.
+*/
+const KNOWN_NON_ZDR_MODELS = /* @__PURE__ */ new Set([
+	"MiniMaxAI/MiniMax-M3",
+	"Qwen/Qwen3.8-Max-0902",
+	"meituan/LongCat-2.0",
+	"meta/muse-spark-1.1",
+	"meta/muse-spark-1.2",
+	"meta/muse-spark-1.2-contributor",
+	"meta/muse-spark-1.3",
+	"meta/muse-spark-1.3-contributor",
+	"minimax/minimax-m3-free",
+	"poolside/laguna-s-2.1-free",
+	"sakana/fugu-ultra",
+	"stepfun/Step-3.7-Flash",
+	"stepfun/Step-5-Preview",
+	"xai/grok-4.5",
+	"xai/grok-4.6",
+	"xiaomi/mimo-v2.6-flash",
+	"xiaomi/mimo-v2.6-pro",
+	"xiaomi/mimo-v2.6-pro-ultraspeed",
+	"z-ai/glm-5.3-flashx",
+	"zai-org/GLM-5.2-Fast"
+]);
+/**
+* Whether the CLI snapshot lists a ZDR-capable upstream for `modelId`. This is
+* informational, never a reason to omit the header when ZDR is enabled: the
+* provider may add coverage or lack capacity after this snapshot was taken.
+*/
+function supportsZeroDataRetention(modelId) {
+	return !KNOWN_NON_ZDR_MODELS.has(modelId);
+}
+/**
 * Models the official CLI's model table (command-code@1.53.0) marks
 * `reasoning:!0` but defines no selectable `reasoning_effort` levels — they
 * think automatically, with Command Code driving the depth. This is the
@@ -508,6 +595,7 @@ const KNOWN_PLANS = {
 	"deepseek/deepseek-v4-flash-vision-exp": "go",
 	"deepseek/deepseek-v4-pro": "go",
 	"gpt-5.6-luna": "go",
+	"gpt-6-luna": "go",
 	"meituan/LongCat-2.0": "go",
 	"inclusionai/ling-3.0-flash-sante:free": "go",
 	"meta/muse-spark-1.2-contributor": "go",
@@ -558,11 +646,13 @@ const KNOWN_PLANS = {
 	"gpt-5.4-mini": "pro",
 	"gpt-5.5": "pro",
 	"gpt-5.6-terra": "pro",
+	"gpt-6-sol": "pro",
 	"meta/muse-spark-1.1": "pro",
 	"claude-fable-5-1": "provider",
 	"claude-fable-5": "provider",
 	"claude-opus-4-7": "provider",
 	"claude-opus-4-8": "provider",
+	"claude-opus-5-5": "provider",
 	"claude-opus-5": "provider",
 	"gpt-6-astra": "provider",
 	"sakana/fugu-ultra": "provider"
@@ -955,6 +1045,15 @@ const MODEL_PRICE_ROWS = [
 			6.25
 		]
 	},
+	{
+		id: "claude-opus-5-5",
+		rates: [
+			4,
+			20,
+			.2,
+			5
+		]
+	},
 	{
 		id: "claude-sonnet-4-6",
 		rates: [
@@ -1274,6 +1373,52 @@ const MODEL_PRICE_ROWS = [
 			25
 		] }]
 	},
+	{
+		id: "gpt-6-luna",
+		rates: [
+			.1,
+			.5,
+			.01,
+			.125
+		],
+		contextTiers: [{
+			"maxContext": 272e3,
+			"rates": [
+				.1,
+				.5,
+				.01,
+				.125
+			]
+		}, { "rates": [
+			.2,
+			.75,
+			.02,
+			.25
+		] }]
+	},
+	{
+		id: "gpt-6-sol",
+		rates: [
+			2,
+			10,
+			.2,
+			2.5
+		],
+		contextTiers: [{
+			"maxContext": 272e3,
+			"rates": [
+				2,
+				10,
+				.2,
+				2.5
+			]
+		}, { "rates": [
+			4,
+			15,
+			.4,
+			5
+		] }]
+	},
 	{
 		id: "grok-4.5",
 		rates: [
@@ -1856,11 +2001,11 @@ function costGroupKey(group, table) {
 //#endregion
 //#region src/cost-projection.ts
 const record$2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? v : void 0;
-const finite = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
+const finite$1 = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
 function tokensOf(value) {
 	const u = record$2(value);
-	if (!u || !finite(u.inputTokens) || !finite(u.outputTokens)) return void 0;
-	if (u.cacheReadTokens !== void 0 && !finite(u.cacheReadTokens) || u.cacheWriteTokens !== void 0 && !finite(u.cacheWriteTokens)) return void 0;
+	if (!u || !finite$1(u.inputTokens) || !finite$1(u.outputTokens)) return void 0;
+	if (u.cacheReadTokens !== void 0 && !finite$1(u.cacheReadTokens) || u.cacheWriteTokens !== void 0 && !finite$1(u.cacheWriteTokens)) return void 0;
 	return {
 		uncachedInputTokens: u.inputTokens,
 		outputTokens: u.outputTokens,
@@ -1886,13 +2031,13 @@ function usageOf(type, data) {
 }
 function parseState(value) {
 	const s = record$2(value), facts = record$2(s?.facts);
-	if (!s || !facts || !finite(facts.pricingKey) || !Array.isArray(facts.groups)) throw new TypeError("invalid commandCodeCost state");
+	if (!s || !facts || !finite$1(facts.pricingKey) || !Array.isArray(facts.groups)) throw new TypeError("invalid commandCodeCost state");
 	const group = (v) => {
 		const g = record$2(v), t = record$2(g?.tokens);
-		return !!g && typeof g.provider === "string" && typeof g.model === "string" && (g.at === null || finite(g.at)) && finite(g.contextTokens) && !!t && COST_TOKEN_KEYS.every((k) => finite(t[k]));
+		return !!g && typeof g.provider === "string" && typeof g.model === "string" && (g.at === null || finite$1(g.at)) && finite$1(g.contextTokens) && !!t && COST_TOKEN_KEYS.every((k) => finite$1(t[k]));
 	};
 	const sel = record$2(s.selection), last = record$2(s.last);
-	if (!(s.selection === null || sel && typeof sel.provider === "string" && typeof sel.model === "string") || !(s.at === null || finite(s.at)) || !facts.groups.every(group) || !(s.last === null || last && finite(last.turn) && finite(last.step) && group(last.group))) throw new TypeError("invalid commandCodeCost state");
+	if (!(s.selection === null || sel && typeof sel.provider === "string" && typeof sel.model === "string") || !(s.at === null || finite$1(s.at)) || !facts.groups.every(group) || !(s.last === null || last && finite$1(last.turn) && finite$1(last.step) && group(last.group))) throw new TypeError("invalid commandCodeCost state");
 	return value;
 }
 /** Optional registry uses only synchronous parse/view; no new runtime module is required. */
@@ -1926,11 +2071,11 @@ function createCostProjection(table = modelPriceTable()) {
 			}
 			if (event.type === "step/start" || event.type === "llm/retry-started") return {
 				...state,
-				at: finite(event.time) ? event.time : null,
+				at: finite$1(event.time) ? event.time : null,
 				last: null
 			};
 			const tokens = usageOf(event.type, data);
-			if (tokens === void 0 || !finite(data.turn) || !finite(data.step)) return state;
+			if (tokens === void 0 || !finite$1(data.turn) || !finite$1(data.step)) return state;
 			const previous = state.last?.turn === data.turn && state.last.step === data.step ? state.last.group : void 0;
 			const group = {
 				provider: state.selection?.provider ?? "",
@@ -2849,7 +2994,7 @@ function openStreamTrace(scope, options = {}) {
 * per-request options thunk and an API-key resolver from the plugin entry
 * (src/index.ts), so a settings change reaches the very next request.
 */
-const COMMAND_CODE_CLI_VERSION = "1.62.0";
+const COMMAND_CODE_CLI_VERSION = "1.64.0";
 const DEFAULT_API_BASE = "https://api.commandcode.ai";
 const DEFAULT_GENERATE_MAX_TOKENS = 64e3;
 const DEFAULT_MAX_OUTPUT_TOKENS = 65536;
@@ -2973,6 +3118,19 @@ function isContextOverflowDetail(detail) {
 	return isContextWindowExceededError(detail) || CLI_CONTEXT_OVERFLOW_PATTERN.test(detail);
 }
 /**
+* Whether one rejection says "ZDR requested, no ZDR-capable upstream": the
+* provider spells the code `cmd_zdr_no_providers` in JSON error bodies and
+* `CMD_ZDR_NO_PROVIDERS` in plain-text ones (the official CLI's own
+* classifier checks both spellings, and its error text tells the user to
+* unset `CMD_ZDR`). Underscore-separated matching normalizes the separator, so
+* one comparison covers the variants — the same normalization the pre-stream
+* rejection classifier and `hasTerminalStreamMarker` already use.
+*/
+const ZDR_NO_PROVIDERS_PATTERN = /cmd[_\s-]?zdr[_\s-]?no[_\s-]?providers/i;
+function isZdrNoProviders(providerCode, providerDetail, errText) {
+	return ZDR_NO_PROVIDERS_PATTERN.test(providerCode ?? "") || ZDR_NO_PROVIDERS_PATTERN.test(providerDetail) || ZDR_NO_PROVIDERS_PATTERN.test(errText);
+}
+/**
 * Classify one in-band stream `error` payload into the failure the caller
 * throws. Shared by both transports — the CLI transport delivers it as an
 * `error` event (`{ type: 'error', error }`), the Provider API transport as a
@@ -3936,6 +4094,7 @@ async function connectGenerate(deps, key, protocol, body) {
 		if (options.signal) options.signal.removeEventListener("abort", onCallerAbort);
 	};
 	let response;
+	const zdr = connection.zdr === true;
 	const headers = protocol === "cli" ? {
 		"Content-Type": "application/json",
 		Authorization: `Bearer ${key}`,
@@ -3944,11 +4103,13 @@ async function connectGenerate(deps, key, protocol, body) {
 		"x-project-slug": projectSlugFromPath(connection.workingDir),
 		"x-taste-learning": "true",
 		"x-co-flag": "false",
+		...zdr ? { "x-cmd-zdr": "1" } : {},
 		...attributionHeaders()
 	} : {
 		"Content-Type": "application/json",
 		Authorization: `Bearer ${key}`,
 		Accept: "text/event-stream",
+		...zdr ? { "x-cmd-zdr": "1" } : {},
 		...attributionHeaders()
 	};
 	try {
@@ -4804,6 +4965,7 @@ function generateHttpError(status, errText, retryAfterMs) {
 	const detail = providerCode ?? `HTTP ${status}`;
 	const overflowDetail = providerDetail !== "" ? providerDetail : errText.slice(0, 500);
 	if (status < 500 && isContextOverflowDetail(overflowDetail)) return new LlmError(`Command Code API error ${status}: the request exceeds the model's context window — this session is being compacted and the request retried；Command Code API 返回 ${status}：请求内容超出模型上下文窗口——正在压缩上下文后重试；如仍失败，请新建会话或减少上下文`, CONTEXT_WINDOW_EXCEEDED_CODE, { status });
+	if (status === 422 && isZdrNoProviders(providerCode, providerDetail, errText)) return new LlmError(`Command Code API error 422 (${detail}): zero data retention is enforced but no ZDR-capable upstream is available for this model — turn the ZDR setting off (or use another model)；Command Code API 返回 422：已开启零数据保留（ZDR），但该模型当前没有可用的 ZDR 上游——请关闭 ZDR 开关，或改用其他模型`, "PROVIDER_HTTP_ERROR", { status: 422 });
 	if (status === 401) return new LlmError(`Command Code API error 401 (${detail}): the API key is missing or invalid — check the key stored for COMMANDCODE_API_KEY (Models page) or the auth file；Command Code API 返回 401：API 密钥缺失或无效——请在设置页检查 COMMANDCODE_API_KEY 存储的密钥，或检查 auth 文件`, "INVALID_CREDENTIAL", { status: 401 });
 	if (status === 413) return new LlmError("Command Code API error 413: the request body exceeds the provider's size limit (the cap is undocumented, measured at about 50 MB) — the session history is too large to send, usually because of accumulated image attachments. Start a new session, or drop the image-heavy part of this one, and retry；Command Code API 返回 413：请求体超过服务端的体积上限（官方未公开，实测约 50 MB）——会话历史过大，通常是历史图片累积所致。请新建会话，或移除本会话中图片较多的部分后重试", "PROVIDER_HTTP_ERROR", { status: 413 });
 	return new LlmError(`Command Code API error ${status}${detail === `HTTP ${status}` ? "" : ` (${detail})`}: ${errText.slice(0, 500)}`, httpErrorCode(status), {
@@ -6525,7 +6687,7 @@ function toSource(result) {
 		...snippet !== void 0 && snippet.length > 0 ? { snippet } : {}
 	};
 }
-function isAbortError(error) {
+function isAbortError$1(error) {
 	return error instanceof DOMException && error.name === "AbortError";
 }
 /** Build the provider's stable cancellation error while retaining the caller's reason. */
@@ -6579,7 +6741,7 @@ var CommandCodeSearchProvider = class {
 				...signal !== void 0 ? { signal } : {}
 			});
 		} catch (error) {
-			if (signal?.aborted === true || isAbortError(error)) throw searchAborted(signal, error);
+			if (signal?.aborted === true || isAbortError$1(error)) throw searchAborted(signal, error);
 			throw new WebError(`Command Code web search request failed: ${error instanceof Error ? error.message : String(error)}`, "WEB_PROVIDER_ERROR", { cause: error });
 		}
 		if (!response.ok) {
@@ -6594,7 +6756,7 @@ var CommandCodeSearchProvider = class {
 					if (typeof code === "string" || typeof inner === "string") message += `: ${typeof code === "string" ? code : ""}${typeof code === "string" && typeof inner === "string" ? " — " : ""}${typeof inner === "string" ? inner : ""}`;
 				}
 			} catch (error) {
-				if (signal?.aborted === true || isAbortError(error)) throw searchAborted(signal, error);
+				if (signal?.aborted === true || isAbortError$1(error)) throw searchAborted(signal, error);
 				const slice = (await response.text().catch(() => "")).trim().slice(0, 200);
 				if (slice !== "") message += `: ${slice}`;
 			}
@@ -6604,7 +6766,7 @@ var CommandCodeSearchProvider = class {
 		try {
 			payload = await response.json();
 		} catch (error) {
-			if (signal?.aborted === true || isAbortError(error)) throw searchAborted(signal, error);
+			if (signal?.aborted === true || isAbortError$1(error)) throw searchAborted(signal, error);
 			throw new WebError("Command Code web search returned an unparseable response body", "WEB_PROVIDER_ERROR", { cause: error });
 		}
 		const results = payload?.results;
@@ -6628,7 +6790,7 @@ var CommandCodeSearchProvider = class {
 		try {
 			key = await this.deps.resolveKey();
 		} catch (error) {
-			if (signal?.aborted === true || isAbortError(error)) throw searchAborted(signal, error);
+			if (signal?.aborted === true || isAbortError$1(error)) throw searchAborted(signal, error);
 			if (error instanceof Error && typeof error.code === "string") {
 				const code = error.code;
 				if (code === "MISSING_CREDENTIAL") throw new WebError(error.message, "WEB_PROVIDER_CREDENTIAL_MISSING", { cause: error });
@@ -6816,6 +6978,70 @@ function buildCommandCodeTuiSection(deps) {
 					};
 				}
 			},
+			{
+				path: ["commandGuard"],
+				group: "advanced",
+				kind: "boolean",
+				label: "AI command guard",
+				descriptions: { zh: "AI 命令安全预判" },
+				hint: "typesafe/jev judges whether a shell command is safe and auto-approves it; everything else asks as usual. Off by default.",
+				hintDescriptions: { zh: "由 typesafe/jev 判断 shell 命令是否安全，安全则自动放行，其余照常弹窗。默认关闭。" },
+				format: (value) => value === true ? "true" : "false",
+				parse: (text) => ({
+					kind: "set",
+					value: text.trim() === "true"
+				})
+			},
+			{
+				path: ["commandGuardThreshold"],
+				group: "advanced",
+				kind: "number",
+				label: "Auto-approve threshold (0.5-1)",
+				descriptions: { zh: "自动放行阈值（0.5-1）" },
+				hint: "Approve when typesafe/jev rates the command \"safe\" at least this likely; default 0.9.",
+				hintDescriptions: { zh: "typesafe/jev 判定\"安全\"的概率达到该值即放行，默认 0.9。" },
+				parse: (text) => {
+					const trimmed = text.trim();
+					if (trimmed === "") return { kind: "clear" };
+					const parsed = Number(trimmed);
+					return Number.isFinite(parsed) && parsed >= .5 && parsed <= 1 ? {
+						kind: "set",
+						value: parsed
+					} : void 0;
+				}
+			},
+			{
+				path: ["commandGuardTimeoutMs"],
+				group: "advanced",
+				kind: "number",
+				label: "Judgement timeout (ms, 200-10000)",
+				descriptions: { zh: "判定超时（毫秒，200-10000）" },
+				hint: "If typesafe/jev does not answer in time, the normal prompt appears; default 1500.",
+				hintDescriptions: { zh: "typesafe/jev 超过该时间未返回就照常弹窗，默认 1500。" },
+				parse: (text) => {
+					const trimmed = text.trim();
+					if (trimmed === "") return { kind: "clear" };
+					const parsed = Number(trimmed);
+					return Number.isFinite(parsed) && parsed >= 200 && parsed <= 1e4 ? {
+						kind: "set",
+						value: parsed
+					} : void 0;
+				}
+			},
+			{
+				path: ["zdr"],
+				group: "advanced",
+				kind: "boolean",
+				label: "Zero data retention (ZDR)",
+				descriptions: { zh: "零数据保留（ZDR）" },
+				hint: "Route requests only through upstreams that retain nothing and never train on prompts (the CLI's CMD_ZDR=1). Models without an available ZDR upstream fail instead of losing protection; ZDR is usually billed at higher pass-through rates. Off by default.",
+				hintDescriptions: { zh: "请求只经由不留存数据、也不用于训练的上游（等价于 CLI 的 CMD_ZDR=1）。没有可用 ZDR 上游的模型会报错，不会降级为非 ZDR 请求；ZDR 通常按更高的透传价计费。默认关闭。" },
+				format: (value) => value === true ? "true" : "false",
+				parse: (text) => ({
+					kind: "set",
+					value: text.trim() === "true"
+				})
+			},
 			{
 				path: ["filterModelsByPlan"],
 				group: "models",
@@ -7075,6 +7301,736 @@ function transportBudgetMessage(failureMessage, maxRetries) {
 	return `${failureMessage}；Command Code API 连接在连续重试后仍失败——已停止重试以免整轮卡死。插件已自动重试 ${maxRetries} 次。通常说明当前网络到 api.commandcode.ai 的连接不通，常见原因是代理未生效：DSH 只读取环境变量 HTTPS_PROXY/HTTP_PROXY（系统代理/PAC 不会被读取），请确认启动 DSH 的终端里已导出代理，或先关闭代理直连后重试。网络恢复后直接重发即可 — Command Code API transport still failed after ${maxRetries} automatic retries, which were stopped so the turn could not stall for minutes. This is a connectivity problem between this machine and api.commandcode.ai, not a context-window or request-size rejection. Common cause: the proxy is not reaching the harness — DSH reads HTTPS_PROXY/HTTP_PROXY from the environment only (a Windows system proxy/PAC setting is not consulted), so export it in the launching shell, or turn the proxy off and retry. Resend when the network recovers; the budget is per request and has been reset`;
 }
 //#endregion
+//#region src/systemone.ts
+/**
+* Host-side client for Command Code's System One decision endpoint
+* (`POST {apiBase}/provider/v1/systemone`).
+*
+* `typesafe/jev` is **not a chat model**: it takes a `state` plus typed
+* questions and answers with probabilities, never text, and it never streams.
+* It is therefore absent from `/provider/v1/models` (so the picker can never
+* offer it) and must never be registered as a model route — this plugin uses it
+* as an internal advisor instead: the command guard in `./command-guard.ts`
+* asks it whether a shell command is safe to auto-approve.
+*
+* The three question types are the whole vocabulary (command-code@1.64.0
+* `systemOneRequestSchema`):
+*
+* - `noul` — "is this true?", optional `criteria: { true, false }` describing
+*   each verdict. Answers with `noul`, the probability of *yes*.
+* - `choice` — "which one?", `criteria` maps each option key to its
+*   description. Answers with `choice`, plus optional `confidence` and
+*   `probabilities`.
+* - `score` — "where on this rubric?", `criteria` is an array of at least two
+*   levels, lowest first. Answers with `score`, `legend` and `probabilities`.
+*
+* A request carries at most 20 questions and every answer is keyed by the
+* question id it belongs to. `usage` is reported per request, in tokens.
+*
+* Billing: free through 2026-09-24T23:59:59Z, then $0.042 per 1M input tokens
+* with output free. The model has **no ZDR-capable upstream**, so a request
+* carrying `x-cmd-zdr: 1` is refused with HTTP 422 `cmd_zdr_no_providers` —
+* this client never sends that header, and it must stay that way even though
+* the plugin now ships a ZDR switch for chat (`Config.zdr` → the `x-cmd-zdr: 1`
+* header per model, gated on `KNOWN_NON_ZDR_MODELS`): the decision endpoint is
+* reached through THIS module's own request path, never through the adapter's
+* chat connection, so the two cannot drift — and a deployment that later widens
+* ZDR must exclude this endpoint rather than route it through the switch.
+*
+* Auth is the plugin's ordinary chain (the multi-account pool, the credentials
+* seam, the CLI auth file) through the same `Authorization: Bearer <key>` and
+* `x-command-code-version` headers every other endpoint uses.
+*
+* @module dsh-commandcode-provider/systemone
+*/
+/** Path of the decision endpoint, relative to `apiBase`. */
+const SYSTEMONE_ROUTE = "/provider/v1/systemone";
+/** Milliseconds a decision may take before the caller gives up on it. */
+const SYSTEMONE_DEFAULT_TIMEOUT_MS = 1500;
+/** The one error type this client throws. Callers fail closed on it. */
+var SystemOneError = class extends Error {
+	kind;
+	status;
+	constructor(message, kind, status, options) {
+		super(message, options);
+		this.kind = kind;
+		this.status = status;
+		this.name = "SystemOneError";
+	}
+};
+/**
+* Combine the caller's signal with a timeout, keeping the two distinguishable:
+* a timeout is this client's own budget expiring (the guard delegates to the
+* user) while a caller abort means the approval was already withdrawn (answer
+* nothing) — both fail closed, but the diagnosis must not lie about which.
+*
+* The timer is a plain `setTimeout` rather than `AbortSignal.timeout()`, whose
+* timer Node unrefs: with nothing else pending (a test double, a socket that
+* never opened) an unref'd timer lets the process exit while the promise is
+* still pending, which reads as a hang rather than as the timeout it is.
+*/
+function deadlineOf(signal, timeoutMs) {
+	const controller = new AbortController();
+	let timedOut = false;
+	const timer = setTimeout(() => {
+		timedOut = true;
+		controller.abort();
+	}, timeoutMs);
+	const onCallerAbort = () => controller.abort();
+	if (signal !== void 0) {
+		if (signal.aborted) controller.abort();
+		else signal.addEventListener("abort", onCallerAbort, { once: true });
+	}
+	return {
+		signal: controller.signal,
+		callerAborted: () => signal?.aborted === true,
+		timedOut: () => timedOut,
+		dispose: () => {
+			clearTimeout(timer);
+			signal?.removeEventListener("abort", onCallerAbort);
+		}
+	};
+}
+/** Whether a caught value is an abort-shaped failure. */
+function isAbortError(error) {
+	return error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
+}
+/** Stop waiting for an operation that does not accept an AbortSignal. */
+function withinDeadline(operation, deadline, timeoutMs) {
+	return new Promise((resolve, reject) => {
+		const onAbort = () => {
+			reject(deadline.callerAborted() ? new SystemOneError("decision request aborted", "aborted") : new SystemOneError(`decision request timed out after ${timeoutMs}ms`, "timeout"));
+		};
+		deadline.signal.addEventListener("abort", onAbort, { once: true });
+		operation.then((value) => {
+			deadline.signal.removeEventListener("abort", onAbort);
+			resolve(value);
+		}, (error) => {
+			deadline.signal.removeEventListener("abort", onAbort);
+			reject(error);
+		});
+		if (deadline.signal.aborted) onAbort();
+	});
+}
+/** A finite number in `[0, 1]`, or undefined. */
+function probability(value) {
+	return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 1 ? value : void 0;
+}
+/** A finite number, or undefined. */
+function finite(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+/** A record of finite numbers (probabilities), or undefined when the shape is off. */
+function numberRecord(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) {
+		const parsed = finite(entry);
+		if (parsed === void 0) return void 0;
+		out[key] = parsed;
+	}
+	return out;
+}
+/**
+* Parse one answer entry strictly by its own `type`. A body whose answer does
+* not carry the member its type promises is rejected rather than defaulted:
+* an absent probability is exactly the case the caller must not read as "safe".
+*
+* @param value - one raw entry from the response's `answers` object.
+* @returns the parsed answer, or undefined when the entry is malformed.
+*/
+function parseSystemOneAnswer(value) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const raw = value;
+	if (raw.type === "noul") {
+		const noul = probability(raw.noul);
+		return noul === void 0 ? void 0 : {
+			type: "noul",
+			noul
+		};
+	}
+	if (raw.type === "choice") {
+		if (typeof raw.choice !== "string" || raw.choice === "") return void 0;
+		const confidence = raw.confidence === void 0 ? void 0 : probability(raw.confidence);
+		if (raw.confidence !== void 0 && confidence === void 0) return void 0;
+		const probabilities = raw.probabilities === void 0 ? void 0 : numberRecord(raw.probabilities);
+		if (raw.probabilities !== void 0 && probabilities === void 0) return void 0;
+		return {
+			type: "choice",
+			choice: raw.choice,
+			...confidence === void 0 ? {} : { confidence },
+			...probabilities === void 0 ? {} : { probabilities }
+		};
+	}
+	if (raw.type === "score") {
+		const score = finite(raw.score);
+		if (score === void 0) return void 0;
+		const confidence = raw.confidence === void 0 ? void 0 : probability(raw.confidence);
+		if (raw.confidence !== void 0 && confidence === void 0) return void 0;
+		const probabilities = raw.probabilities === void 0 ? void 0 : numberRecord(raw.probabilities);
+		if (raw.probabilities !== void 0 && probabilities === void 0) return void 0;
+		return {
+			type: "score",
+			score,
+			...confidence === void 0 ? {} : { confidence },
+			...probabilities === void 0 ? {} : { probabilities }
+		};
+	}
+}
+/**
+* Parse a decision response body. Every answer entry must be well formed — one
+* malformed entry fails the whole response, because a partially understood
+* decision is not a decision. Unknown extra members are ignored so a server-side
+* addition cannot break the guard.
+*
+* @param value - the decoded JSON body.
+* @returns the parsed response, or undefined when the body is not one.
+*/
+function parseSystemOneResponse(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const raw = value;
+	const rawAnswers = raw.answers;
+	if (typeof rawAnswers !== "object" || rawAnswers === null || Array.isArray(rawAnswers)) return void 0;
+	const entries = Object.entries(rawAnswers);
+	if (entries.length === 0) return void 0;
+	const answers = {};
+	for (const [id, entry] of entries) {
+		const answer = parseSystemOneAnswer(entry);
+		if (answer === void 0) return void 0;
+		answers[id] = answer;
+	}
+	const usage = raw.usage === void 0 ? void 0 : parseUsage(raw.usage);
+	if (raw.usage !== void 0 && usage === void 0) return void 0;
+	return {
+		...typeof raw.model === "string" ? { model: raw.model } : {},
+		answers,
+		...usage === void 0 ? {} : { usage }
+	};
+}
+/** Parse the optional `usage` member; an unreadable one is a malformed body. */
+function parseUsage(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const raw = value;
+	const inputTokens = raw.input_tokens === void 0 ? void 0 : finite(raw.input_tokens);
+	if (raw.input_tokens !== void 0 && inputTokens === void 0) return void 0;
+	const outputTokens = raw.output_tokens === void 0 ? void 0 : finite(raw.output_tokens);
+	if (raw.output_tokens !== void 0 && outputTokens === void 0) return void 0;
+	return {
+		...inputTokens === void 0 ? {} : { inputTokens },
+		...outputTokens === void 0 ? {} : { outputTokens }
+	};
+}
+/** Validate the outgoing request where the server would only reject it with a 400. */
+function assertRequest(request) {
+	const ids = Object.keys(request.questions);
+	if (ids.length === 0) throw new SystemOneError("a decision request needs at least one question", "invalid-request");
+	if (ids.length > 20) throw new SystemOneError(`a decision request carries at most 20 questions (got ${ids.length})`, "invalid-request");
+	for (const id of ids) if (id.trim() === "") throw new SystemOneError("every decision question needs a non-empty id", "invalid-request");
+}
+/** Read the endpoint's error body into a one-line diagnosis. */
+async function httpFailure(response) {
+	let detail = "";
+	try {
+		const slice = (await response.text()).trim().slice(0, 200);
+		if (slice !== "") detail = `: ${slice}`;
+	} catch {}
+	return new SystemOneError(`Command Code decision request failed (HTTP ${response.status})${detail}`, "http", response.status);
+}
+/**
+* Run one decision request.
+*
+* @param deps - connection facts, credential chain and fetch seam.
+* @param request - the state and typed questions.
+* @param options - caller cancellation and the per-call budget.
+* @returns the parsed decision.
+* @throws {SystemOneError} on every failure path; callers fail closed.
+*/
+async function runSystemOne(deps, request, options = {}) {
+	assertRequest(request);
+	const apiBase = deps.apiBase();
+	if (!URL.canParse(apiBase)) throw new SystemOneError(`Command Code decision request is misconfigured: apiBase ${JSON.stringify(apiBase)} is not a valid URL`, "invalid-request");
+	if (options.signal?.aborted === true) throw new SystemOneError("decision request aborted", "aborted");
+	const timeoutMs = options.timeoutMs ?? 1500;
+	const deadline = deadlineOf(options.signal, timeoutMs);
+	try {
+		let key;
+		try {
+			key = await withinDeadline(Promise.resolve().then(() => deps.resolveApiKey()), deadline, timeoutMs);
+		} catch (error) {
+			if (error instanceof SystemOneError && (error.kind === "aborted" || error.kind === "timeout")) throw error;
+			throw new SystemOneError(`Command Code decision request has no usable credential: ${error instanceof Error ? error.message : String(error)}`, "credential", void 0, { cause: error });
+		}
+		const body = {
+			model: request.model ?? "typesafe/jev",
+			state: request.state,
+			questions: request.questions
+		};
+		if (deadline.signal.aborted) throw deadline.callerAborted() ? new SystemOneError("decision request aborted", "aborted") : new SystemOneError(`decision request timed out after ${timeoutMs}ms`, "timeout");
+		let response;
+		try {
+			response = await (deps.fetchImpl ?? fetch)(`${apiBase.replace(/\/$/, "")}${SYSTEMONE_ROUTE}`, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Authorization: `Bearer ${key}`,
+					"x-command-code-version": COMMAND_CODE_CLI_VERSION,
+					...attributionHeaders()
+				},
+				body: JSON.stringify(body),
+				signal: deadline.signal
+			});
+		} catch (error) {
+			if (deadline.callerAborted()) throw new SystemOneError("decision request aborted", "aborted", void 0, { cause: error });
+			if (deadline.timedOut() || isAbortError(error)) throw new SystemOneError(`decision request timed out after ${timeoutMs}ms`, "timeout", void 0, { cause: error });
+			throw new SystemOneError(`Command Code decision request failed: ${error instanceof Error ? error.message : String(error)}`, "network", void 0, { cause: error });
+		}
+		if (!response.ok) throw await httpFailure(response);
+		let payload;
+		try {
+			payload = await response.json();
+		} catch (error) {
+			if (deadline.callerAborted()) throw new SystemOneError("decision request aborted", "aborted", void 0, { cause: error });
+			throw new SystemOneError("Command Code returned an unparseable decision body", "invalid-response", void 0, { cause: error });
+		}
+		const parsed = parseSystemOneResponse(payload);
+		if (parsed === void 0) throw new SystemOneError("Command Code returned a decision body this plugin cannot read", "invalid-response");
+		return parsed;
+	} finally {
+		deadline.dispose();
+	}
+}
+//#endregion
+//#region src/command-guard.ts
+/** Tool names whose `arguments.command` this guard judges. */
+const COMMAND_GUARD_SHELL_TOOLS = ["bash", "pwsh"];
+/** Question id the safety verdict is keyed by. */
+const COMMAND_GUARD_QUESTION_ID = "safe";
+/** Decision budget; the approval prompt must not wait longer than this. */
+const COMMAND_GUARD_DEFAULT_TIMEOUT_MS = SYSTEMONE_DEFAULT_TIMEOUT_MS;
+/** Bounds of the configurable probability, mirrored by the settings schemas. */
+const COMMAND_GUARD_MIN_THRESHOLD = .5;
+const COMMAND_GUARD_MAX_TIMEOUT_MS = 1e4;
+/**
+* Longest command the guard will send for judgement. A longer one is delegated
+* instead of truncated: a verdict on the first N characters of a command is a
+* verdict on a different command.
+*/
+const COMMAND_GUARD_MAX_COMMAND_CHARS = 6e3;
+/**
+* Hard denylist: commands the guard never auto-approves, and never even sends
+* for judgement. Each entry is a deliberate, narrow reading of one destructive
+* family — the goal is not to classify every dangerous command (that is the
+* model's job) but to make sure the classics cannot be talked into a grant by a
+* persuasive-looking command string.
+*
+* Every pattern is allowed to OVER-match: a false positive costs one ordinary
+* human prompt, while a false negative would hand a destructive command to a
+* model that has to guess. That asymmetry is why `sudo` is matched anywhere in
+* the line rather than only in command position, and why `fdisk` is listed even
+* though `fdisk -l` only lists partitions.
+*/
+const COMMAND_GUARD_DENY_LIST = [
+	{
+		id: "rm-root",
+		pattern: /\brm\s+(?:-[a-zA-Z]*[rR][a-zA-Z]*f[a-zA-Z]*|-[a-zA-Z]*f[a-zA-Z]*[rR][a-zA-Z]*|--recursive[^\n]*--force|--force[^\n]*--recursive)\s+(?:\/|\/\*|~|~\/\*|\$HOME(?:\/\*)?|\*|\.\/\*|\.)(?:\s|$)/
+	},
+	{
+		id: "rm-home",
+		pattern: /\brm\s+-[a-zA-Z]*[rR][a-zA-Z]*\s+(?:~|\$HOME)\//
+	},
+	{
+		id: "filesystem-write",
+		pattern: /\b(?:mkfs(?:\.\w+)?|wipefs|fdisk|parted|shred)\b/
+	},
+	{
+		id: "raw-device-write",
+		pattern: /\bdd\b[^\n]*\bof=\/dev\//
+	},
+	{
+		id: "device-redirect",
+		pattern: /(?:^|[^0-9\w])>{1,2}\s*\/dev\/(?:sd|disk|nvme|hd)/
+	},
+	{
+		id: "fork-bomb",
+		pattern: /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/
+	},
+	{
+		id: "privilege-escalation",
+		pattern: /\b(?:sudo|doas)\b/
+	},
+	{
+		id: "su",
+		pattern: /\bsu\s/
+	},
+	{
+		id: "chmod-world-write",
+		pattern: /\bchmod\b[^\n]*\b(?:777|a\+w|o\+w)\b/
+	},
+	{
+		id: "chown-root",
+		pattern: /\bchown\b[^\n]*\b(?:root|0):/
+	},
+	{
+		id: "git-push",
+		pattern: /\bgit\s+push\b/
+	},
+	{
+		id: "git-history-rewrite",
+		pattern: /\bgit\s+(?:filter-branch|filter-repo)\b/
+	},
+	{
+		id: "git-hard-reset",
+		pattern: /\bgit\s+reset\s+--hard\b/
+	},
+	{
+		id: "git-clean-force",
+		pattern: /\bgit\s+clean\b[^\n]*\s-[a-zA-Z]*f/
+	},
+	{
+		id: "git-discard-worktree",
+		pattern: /\bgit\s+(?:checkout|restore)\s+(?:--\s+)?\.(?:\s|$)/
+	},
+	{
+		id: "git-stash-drop",
+		pattern: /\bgit\s+stash\s+(?:drop|clear)\b/
+	},
+	{
+		id: "publish",
+		pattern: /\b(?:npm|pnpm|yarn|bun)\s+publish\b/
+	},
+	{
+		id: "release-upload",
+		pattern: /\b(?:gh\s+release|twine\s+upload)\b/
+	},
+	{
+		id: "docker-push",
+		pattern: /\bdocker\s+push\b/
+	},
+	{
+		id: "cloud-upload",
+		pattern: /\b(?:aws\s+s3|gsutil|gcloud\s+storage|az\s+storage)\b[^\n]*\b(?:cp|sync|mv|rm|rb)\b/
+	},
+	{
+		id: "remote-copy",
+		pattern: /\b(?:scp|rsync)\b[^\n]*(?::|@)/
+	},
+	{
+		id: "pipe-to-shell",
+		pattern: /\b(?:curl|wget|fetch)\b[^\n|]*\|\s*(?:sudo\s+)?(?:sh|bash|zsh|dash|ksh|python\d*|node|ruby|perl)\b/
+	},
+	{
+		id: "power",
+		pattern: /\b(?:shutdown|reboot|halt|poweroff)\b/
+	},
+	{
+		id: "kill-everything",
+		pattern: /\bkill\s+(?:-9\s+)?-1\b|\b(?:killall|pkill)\s+-9\b/
+	},
+	{
+		id: "credential-write",
+		pattern: /(?:>{1,2}|tee|cp|mv|rm|chmod|chown)\s[^\n]*(?:\.ssh\b|\.aws\b|\.gnupg\b|\.commandcode\/auth\.json|id_rsa|id_ed25519)/
+	},
+	{
+		id: "history-clear",
+		pattern: /\bhistory\s+-c\b|\bunset\s+HISTFILE\b/
+	},
+	{
+		id: "global-install",
+		pattern: /\b(?:npm|pnpm|yarn|bun)\s+(?:i|install|add)\s+(?:-g\b|--global\b)/
+	},
+	{
+		id: "system-install",
+		pattern: /\b(?:apt|apt-get|dnf|yum|zypper|apk|pacman|brew)\s+(?:install|remove|purge|uninstall|upgrade)\b/
+	},
+	{
+		id: "language-install",
+		pattern: /\b(?:pip3?|pipx|gem|cargo)\s+(?:install|add)\b/
+	}
+];
+/**
+* Why the guard refuses to judge a command, when it does.
+*
+* @param command - the raw command text.
+* @returns the matching denylist id, or undefined.
+*/
+function denyReasonOf(command) {
+	for (const entry of COMMAND_GUARD_DENY_LIST) if (entry.pattern.test(command)) return entry.id;
+}
+/** A non-empty string member, or undefined. */
+function stringMember(value, key) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const member = value[key];
+	return typeof member === "string" && member.trim() !== "" ? member : void 0;
+}
+/**
+* Read a shell command out of a tool execution, or undefined when this call is
+* not one the guard judges (a different tool, or arguments without a command).
+*
+* @param name - the executed tool's name.
+* @param args - the execution's parsed `arguments`.
+* @returns the fact to judge, without the asker's reason (that arrives later).
+*/
+function shellCommandOf(name, args) {
+	if (!COMMAND_GUARD_SHELL_TOOLS.includes(name)) return void 0;
+	const command = stringMember(args, "command");
+	if (command === void 0) return void 0;
+	const description = stringMember(args, "description");
+	const workdir = stringMember(args, "workdir");
+	const sandboxPermissions = stringMember(args, "sandbox_permissions");
+	return {
+		tool: name,
+		command,
+		...description === void 0 ? {} : { description },
+		...workdir === void 0 ? {} : { workdir },
+		...sandboxPermissions === void 0 ? {} : { sandboxPermissions }
+	};
+}
+/**
+* Build the decision request for one command.
+*
+* The question is deliberately one `noul`: a single probability is a decision
+* rule that can be explained, thresholded and logged in one line, and the
+* criteria carry the whole distinction between "reads, or writes reversibly
+* inside the project" and "everything else". The agent's own `description` is
+* included as context, but the criteria say the command text itself decides — a
+* model-written description is a claim, not evidence.
+*
+* @param fact - the command and its context.
+* @returns the request to send.
+*/
+function buildSafetyRequest(fact) {
+	const lines = [
+		`Tool: ${fact.tool}`,
+		"Command:",
+		fact.command,
+		...fact.description === void 0 ? [] : ["", `The agent describes this command as: ${fact.description}`],
+		...fact.workdir === void 0 ? [] : ["", `Working directory: ${fact.workdir}`],
+		...fact.sandboxPermissions === void 0 ? [] : ["", `The harness is asking because this call requests a wider sandbox mode (${fact.sandboxPermissions}) than the one currently in force.`],
+		...fact.reason === void 0 ? [] : ["", `The asker's reason for needing approval: ${fact.reason}`]
+	];
+	const question = {
+		type: "noul",
+		instructions: "Is it safe to run this command right now WITHOUT asking the user first? Judge the command text itself; a description is only a claim about it.",
+		criteria: {
+			true: "Read-only, or its effects stay inside the current project and are trivially reversible: no data leaves the machine, nothing outside the project is modified, and no credentials, git history or remote state are touched.",
+			false: "Anything else. Deleting or overwriting files outside the project, rewriting or publishing git history, uploading data anywhere, installing system or global packages, changing permissions, ownership or credentials, killing processes, running as another user or as root, piping a download into a shell, or a command obfuscated enough that its effect cannot be read."
+		}
+	};
+	return {
+		state: lines.join("\n"),
+		questions: { [COMMAND_GUARD_QUESTION_ID]: question }
+	};
+}
+/**
+* Read the safety probability out of a decision response.
+*
+* @param response - the parsed response.
+* @param questionId - the question id to read (defaults to the guard's own).
+* @returns the probability of "safe", or undefined when the answer is missing
+*   or is not a `noul` verdict.
+*/
+function safeProbabilityOf(response, questionId = COMMAND_GUARD_QUESTION_ID) {
+	const answer = response.answers[questionId];
+	return answer !== void 0 && answer.type === "noul" ? answer.noul : void 0;
+}
+/**
+* One-line, length-bounded excerpt of a command for the log. The full text is
+* already in the session's tool call and was already sent to the decision
+* endpoint, so this adds no exposure — it is what makes "why did this run
+* without asking?" answerable from the log alone.
+*/
+function commandExcerpt(command, limit = 160) {
+	const flat = command.replace(/\s+/g, " ").trim();
+	return flat.length <= limit ? flat : `${flat.slice(0, limit - 1)}…`;
+}
+/**
+* The guard's stateful half: what was executed (by call id) and what has
+* already been decided (by agent and complete decision context), both bounded.
+*
+* The execution cache is the bridge between the two seams — `tools/pre-execute`
+* knows the arguments, `approval/request` knows the call id — and it is keyed by
+* call id with an agent-identity check when read: an entry for an execution
+* that never asked is never read, so there is nothing to clean up on the result
+* side (and the ask happens before the result anyway).
+*/
+var CommandGuard = class {
+	deps;
+	executions = /* @__PURE__ */ new Map();
+	decisions = /* @__PURE__ */ new WeakMap();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Remember one execution's command. Never throws, never changes a decision.
+	*
+	* @param execution - the execution about to run.
+	*/
+	noteExecution(execution) {
+		const callId = execution?.callId;
+		if (typeof callId !== "string" || callId === "") return;
+		const fact = shellCommandOf(execution.name, execution.arguments);
+		if (fact === void 0) return;
+		this.executions.delete(callId);
+		this.executions.set(callId, {
+			fact,
+			agent: execution.agent
+		});
+		while (this.executions.size > 64) {
+			const oldest = this.executions.keys().next();
+			if (oldest.done === true) break;
+			this.executions.delete(oldest.value);
+		}
+	}
+	/** Forget every remembered execution and decision (disposal, tests). */
+	clear() {
+		this.executions.clear();
+		this.decisions = /* @__PURE__ */ new WeakMap();
+	}
+	/**
+	* Judge one approval request.
+	*
+	* @param request - the pending approval.
+	* @returns the verdict; `approve` is the only outcome that grants anything.
+	*/
+	async judge(request) {
+		const settings = this.deps.settings();
+		if (!settings.enabled) return {
+			kind: "delegate",
+			reason: "guard disabled"
+		};
+		const callId = request.callId;
+		if (callId === void 0) return {
+			kind: "delegate",
+			reason: "approval carries no call id"
+		};
+		const observed = this.executions.get(callId);
+		if (observed === void 0 || observed.agent !== request.agent) return {
+			kind: "delegate",
+			reason: "the guard never saw this call for this agent"
+		};
+		const fact = observed.fact;
+		const excerpt = commandExcerpt(fact.command);
+		if (!COMMAND_GUARD_SHELL_TOOLS.includes(request.toolName)) return {
+			kind: "delegate",
+			reason: `not a shell tool (${request.toolName})`
+		};
+		if (fact.command.length > 6e3) return {
+			kind: "delegate",
+			reason: `command longer than ${COMMAND_GUARD_MAX_COMMAND_CHARS} characters`,
+			command: excerpt
+		};
+		const denied = denyReasonOf(fact.command);
+		if (denied !== void 0) return {
+			kind: "delegate",
+			reason: `denylisted command (${denied})`,
+			command: excerpt
+		};
+		const full = {
+			...fact,
+			...request.reason === void 0 ? {} : { reason: request.reason }
+		};
+		const memoKey = JSON.stringify(full);
+		const now = this.deps.now?.() ?? Date.now();
+		const agentDecisions = request.agent === void 0 ? void 0 : this.decisions.get(request.agent);
+		const memo = agentDecisions?.get(memoKey);
+		if (memo !== void 0) {
+			if (now - memo.at < 6e5) return this.verdict(memo.probability, settings.threshold, "memo", excerpt);
+			agentDecisions?.delete(memoKey);
+		}
+		let response;
+		try {
+			response = await this.deps.decide(buildSafetyRequest(full), {
+				...request.signal === void 0 ? {} : { signal: request.signal },
+				timeoutMs: settings.timeoutMs
+			});
+		} catch (error) {
+			return {
+				kind: "delegate",
+				reason: `decision unavailable: ${error instanceof Error ? error.message : String(error)}`,
+				command: excerpt
+			};
+		}
+		const probability = safeProbabilityOf(response);
+		if (probability === void 0) return {
+			kind: "delegate",
+			reason: "the decision carried no safe verdict",
+			command: excerpt
+		};
+		if (request.agent !== void 0) {
+			const decisions = agentDecisions ?? /* @__PURE__ */ new Map();
+			decisions.set(memoKey, {
+				probability,
+				at: now
+			});
+			while (decisions.size > 64) {
+				const oldest = decisions.keys().next();
+				if (oldest.done === true) break;
+				decisions.delete(oldest.value);
+			}
+			this.decisions.set(request.agent, decisions);
+		}
+		return this.verdict(probability, settings.threshold, "model", excerpt);
+	}
+	/** Apply the threshold to one probability. */
+	verdict(probability, threshold, source, command) {
+		return probability >= threshold ? {
+			kind: "approve",
+			probability,
+			source,
+			command
+		} : {
+			kind: "delegate",
+			reason: `safe probability ${probability.toFixed(3)} below ${threshold}`,
+			probability,
+			command
+		};
+	}
+};
+/**
+* Register the guard on a context that has the approval seam.
+*
+* Call this from inside `ctx.inject(['approval'], …)`: the seam's presence is
+* what makes the feature meaningful (no approval service means no asks), and
+* tying the listeners to that injected fiber is what makes them go away with it.
+*
+* @param ctx - the injected context (or a test double with `on`).
+* @param deps - settings, the decision client, clock and logger.
+* @returns a disposer for both listeners.
+*/
+function applyCommandGuard(ctx, deps) {
+	const guard = new CommandGuard(deps);
+	const events = ctx;
+	const offPreExecute = events.on("tools/pre-execute", (execution, next) => {
+		guard.noteExecution(execution);
+		return next();
+	}, { prepend: true });
+	const offApproval = events.on("approval/request", async (request, next) => {
+		try {
+			if (!deps.settings().enabled) return next();
+		} catch (error) {
+			deps.log?.(`command guard failed: ${error instanceof Error ? error.message : String(error)}`);
+			return next();
+		}
+		let verdict;
+		try {
+			verdict = await guard.judge(request);
+		} catch (error) {
+			deps.log?.(`command guard failed: ${error instanceof Error ? error.message : String(error)}`);
+			return next();
+		}
+		if (verdict.kind === "approve") {
+			deps.log?.(`command guard auto-approved a ${request.toolName} call (safe probability ${verdict.probability.toFixed(3)}, ${verdict.source}): ${verdict.command ?? "(command unknown)"}`);
+			return "allowed-once";
+		}
+		deps.log?.(`command guard delegated a ${request.toolName} call: ${verdict.reason}${verdict.command === void 0 ? "" : ` — ${verdict.command}`}`);
+		return next();
+	}, { prepend: true });
+	return () => {
+		guard.clear();
+		for (const off of [offPreExecute, offApproval]) if (typeof off === "function") off();
+	};
+}
+//#endregion
 //#region src/config-volatile.ts
 /**
 * Mark one schema field volatile when the installed schemastery supports it.
@@ -7219,6 +8175,10 @@ function configFields() {
 			models: z.array(z.string()),
 			account: z.string()
 		})),
+		commandGuard: z.boolean().default(false),
+		commandGuardThreshold: z.number().min(COMMAND_GUARD_MIN_THRESHOLD).max(1),
+		commandGuardTimeoutMs: z.number().min(200).max(COMMAND_GUARD_MAX_TIMEOUT_MS),
+		zdr: z.boolean().default(false),
 		lang: z.string().pattern(/^(zh|en)$/).default("zh")
 	};
 }
@@ -7267,7 +8227,8 @@ function resolveAdapterOptions(config) {
 		streamIdleTimeoutMs: config.streamIdleTimeoutMs ?? 3e5,
 		filterModelsByPlan: config.filterModelsByPlan ?? true,
 		visibleModels: Array.isArray(config.visibleModels) ? config.visibleModels.filter((id) => typeof id === "string" && id !== "") : void 0,
-		modelVisibility: readModelVisibility(config.modelVisibility)
+		modelVisibility: readModelVisibility(config.modelVisibility),
+		zdr: config.zdr === true
 	};
 }
 /**
@@ -7481,6 +8442,26 @@ function apply(ctx, config) {
 			applyCommandCodeSearchSelection(webCtx.web, searchSelection, false);
 		}, "dsh-commandcode-provider: web search selection");
 	});
+	const commandGuardSettings = () => {
+		const raw = current();
+		return {
+			enabled: raw.commandGuard === true,
+			threshold: raw.commandGuardThreshold ?? .9,
+			timeoutMs: raw.commandGuardTimeoutMs ?? COMMAND_GUARD_DEFAULT_TIMEOUT_MS
+		};
+	};
+	ctx.inject(["approval"], (approvalCtx) => {
+		applyCommandGuard(approvalCtx, {
+			settings: commandGuardSettings,
+			decide: (request, decideOptions) => runSystemOne({
+				apiBase: () => options().apiBase,
+				resolveApiKey: () => resolveApiKey(options())
+			}, request, decideOptions),
+			log: (message) => {
+				ctx.logger.info(`llm-commandcode: ${message}`);
+			}
+		});
+	});
 	let refreshTuiSettings;
 	ctx.inject(["tuiSettingsSections"], (tuiCtx) => {
 		refreshTuiSettings = applyCommandCodeTuiSettings(tuiCtx, {
@@ -7530,6 +8511,6 @@ function apply(ctx, config) {
 	}, "dsh-commandcode-provider: volatile config updates");
 }
 //#endregion
-export { ACTIVE_ACCOUNT_AUTO, BILLING_ACCESS_TTL_MS, COMMANDCODE_SEARCH_PROVIDER_ID, COMMAND_CODE_CLI_VERSION, CommandCodeAccountPool, CommandCodeAdapter, CommandCodeLoginFlow, CommandCodeSearchProvider, CommandCodeUsageService, Config, DEFAULT_API_BASE, DEFAULT_GENERATE_MAX_TOKENS, DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_MODELS_CACHE_PATH, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_WEB_SEARCH_PROVIDER_ID, KNOWN_DEALS, KNOWN_EFFORTS, KNOWN_IMAGE_MODELS, KNOWN_PEAK_PRICING, KNOWN_PLANS, KNOWN_SUBSCRIPTION_PLANS, KNOWN_THINKING_MODELS, LANG_AUTO, LOGIN_ALLOWED_ORIGINS, LOGIN_BEGIN_ENDPOINT, LOGIN_BODY_LIMIT_BYTES, LOGIN_CANCEL_ENDPOINT, LOGIN_MAX_PORT_ATTEMPTS, LOGIN_START_PORT, LOGIN_STATUS_ENDPOINT, LOGIN_TIMEOUT_MS, LegacySettingsSchema, PLAN_LABELS, PLAN_ORDER, PROVIDER, USAGE_REPORT_ENDPOINT, accountUsable, apply, applyCommandCodeSearchSelection, applyCommandCodeTuiSettings, applyCommands, applyUsageRemote, buildCommandAuthUrl, buildCommandCodeTuiSection, capabilityDescription, commandCodeSearchSelection, commandDefinition, compareByPlan, dealLabel, formatContext, inject, loginStatusSchema, matchModelRule, modelVisibleInPlan, name, parseLoginStatus, peakPricingLabel, peakPricingState, planLabel, projectSlugFromPath, resolveAdapterOptions, resolveAuthFileApiKey, selectAccountForModel, selectActiveAccount, selectCommandCodeSearchProvider, studioBaseForApiBase, subscriptionPlanInfo, usageReportSchema, validateCommandApiKey };
+export { ACTIVE_ACCOUNT_AUTO, BILLING_ACCESS_TTL_MS, COMMANDCODE_SEARCH_PROVIDER_ID, COMMAND_CODE_CLI_VERSION, CommandCodeAccountPool, CommandCodeAdapter, CommandCodeLoginFlow, CommandCodeSearchProvider, CommandCodeUsageService, Config, DEFAULT_API_BASE, DEFAULT_GENERATE_MAX_TOKENS, DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_MODELS_CACHE_PATH, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_WEB_SEARCH_PROVIDER_ID, KNOWN_DEALS, KNOWN_EFFORTS, KNOWN_IMAGE_MODELS, KNOWN_NON_ZDR_MODELS, KNOWN_PEAK_PRICING, KNOWN_PLANS, KNOWN_SUBSCRIPTION_PLANS, KNOWN_THINKING_MODELS, LANG_AUTO, LOGIN_ALLOWED_ORIGINS, LOGIN_BEGIN_ENDPOINT, LOGIN_BODY_LIMIT_BYTES, LOGIN_CANCEL_ENDPOINT, LOGIN_MAX_PORT_ATTEMPTS, LOGIN_START_PORT, LOGIN_STATUS_ENDPOINT, LOGIN_TIMEOUT_MS, LegacySettingsSchema, PLAN_LABELS, PLAN_ORDER, PROVIDER, USAGE_REPORT_ENDPOINT, accountUsable, apply, applyCommandCodeSearchSelection, applyCommandCodeTuiSettings, applyCommands, applyUsageRemote, buildCommandAuthUrl, buildCommandCodeTuiSection, capabilityDescription, commandCodeSearchSelection, commandDefinition, compareByPlan, dealLabel, formatContext, inject, loginStatusSchema, matchModelRule, modelVisibleInPlan, name, parseLoginStatus, peakPricingLabel, peakPricingState, planLabel, projectSlugFromPath, resolveAdapterOptions, resolveAuthFileApiKey, selectAccountForModel, selectActiveAccount, selectCommandCodeSearchProvider, studioBaseForApiBase, subscriptionPlanInfo, supportsZeroDataRetention, usageReportSchema, validateCommandApiKey };
 
 //# sourceMappingURL=index.js.map