@mars-sea/dsh-commandcode-provider 0.11.9 → 0.11.11

package/CHANGELOG.md

@@ -4,7 +4,30 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.11.11] - 2026-09-23
+
+### Fixed
+
+- **Saving account-rotation edits is visible on a long settings page** ([#60](https://github.com/Mars-Sea/dsh-commandcode-provider/issues/60)). The page's single global Save/Discard bar stays inside the settings panel, attached to the bottom of its scrolling area. A new account can be saved with only a label, then signed in through the same browser authorization flow as the default account; the Host writes the resulting key to that saved account's credential reference. Login attempts for different accounts cannot silently rejoin one another.
+
+- **Command Code responses remain readable when a DSH HTTP dispatcher passes through compressed bytes** ([#59](https://github.com/Mars-Sea/dsh-commandcode-provider/issues/59)). Host-side chat, account usage, catalog, web search, decision, and login requests now ask for `Accept-Encoding: identity`. This also lets a Go account's `403 upgrade_required` body reach the existing CLI-transport fallback. If every usage endpoint answers but its body still cannot be parsed, the account view reports an unreadable response instead of claiming that no request reached the server.
+
+## [0.11.10] - 2026-09-23
+
+### Added
+
+- **Opt-in zero data retention on every chat request.** With `zdr` on (default off), both chat transports send `x-cmd-zdr: 1` on every request. Command Code refuses a model without an available ZDR upstream with `422 cmd_zdr_no_providers`; the plugin explains that error and never retries without the header. `KNOWN_NON_ZDR_MODELS` remains an informational snapshot of the official CLI’s exception list, not a reason to drop protection. The decision endpoint behind the AI command guard has no ZDR upstream and remains a separately documented opt-in. ZDR capacity uses pass-through pricing and can cost more than the ordinary catalog estimate.
+
+- **An opt-in AI command guard: the decision model can approve a safe shell command without interrupting you.** dsh decides *that* a tool call needs approval (permission presets, `PreToolUse` hooks, the sandbox's escalation path) and then asks — there is no second opinion about whether the command is actually safe. With `commandGuard` on, this plugin inserts one answerer in front of the human on the harness's `approval/request` waterfall and asks Command Code's decision model `typesafe/jev` (`POST {apiBase}/provider/v1/systemone`, the same API key and base URL as chat) whether the command is safe to run without asking; only a probability of "safe" at or above `commandGuardThreshold` (default 0.9) becomes a one-shot `allowed-once` grant. **Off by default**, and fail-closed at every step: an unknown call, a non-shell tool, a command longer than 6000 characters (a verdict on a truncated command is a verdict on a different command), a built-in denylist hit (`sudo`, `rm -rf /`, `git push`, publish/upload commands, `curl | sh`, …), a timeout (`commandGuardTimeoutMs`, default 1500 ms), a rate limit, a missing key or an unreadable answer all delegate to the normal prompt. The guard registers only where the approval seam exists (`ctx.inject(['approval'], …)`), reads `tools/pre-execute` purely as a transparent observer (`next()` always — it can never change a decision), and must be prepended on the waterfall because the browser's approval panel otherwise claims the request first. Privacy: the command text, the agent's own description, the working directory and the asker's reason are sent to Command Code, and `typesafe/jev` has **no ZDR upstream** — which is why the feature is opt-in and documented as incompatible with a ZDR-only policy. Billing: free through 2026-09-24, then $0.042/1M input tokens; an identical decision context in the same agent reuses one verdict for 10 minutes, and the timeout also bounds credential lookup. Every decision is logged and lands in the session's own approval audit (`approval/asked`/`approval/decided`).
+
+### New settings
+
+- `commandGuard` (default `false`), `commandGuardThreshold` (0.5–1, default 0.9) and `commandGuardTimeoutMs` (200–10000, default 1500) — editable in the web page's Advanced card, in the dsh-TUI section, or in your profile config.
+- `zdr` (default `false`) — zero data retention; editable in the web page's Advanced card, in the dsh-TUI section, or in your profile config.
+
+### Changed
+
+- **Synced with the official command-code@1.64.0 CLI** (2026-09-23 check of the npm `latest`; two releases since the last sync — 1.63.0 and 1.64.0, neither of which has a changelog entry yet, so the evidence is the bundle, the public catalog and the docs). `COMMAND_CODE_CLI_VERSION` is now `1.64.0`. The train is purely additive: the CLI registry grows 83 → 86 with exactly three additions and no removal or edit, and the public catalog serves 80 models — exactly those three more than the 77 this plugin snapshot covered. `claude-opus-5-5` (Claude Opus 5.5, 1M context, text+image, the five-level `low`/`medium`/`high`/`xhigh`/`max` effort set, `['/messages']` in the catalog so the existing `claude-*` rule keeps it on the CLI transport) is a Provider/Max model — the first since `claude-opus-5` — at $4 / $20 / $0.2 / $5 per 1M, actually cheaper than its predecessor. `gpt-6-sol` (GPT-6 Sol, 1.05M context, same vision and efforts, Pro and above) is $2 / $10 / $0.2 / $2.5 inside a 272K band and $4 / $15 / $0.4 / $5 past it; `gpt-6-luna` (GPT-6 Luna, the opensource-category sibling, on every plan including Go) is $0.1 / $0.5 / $0.01 / $0.125 and $0.2 / $0.75 / $0.02 / $0.25 past the same band. In snapshot terms: the effort map gains three keys (48 → 51), the Vision set three (57 → 60), the plan map one Provider, one Pro and one Go entry without moving a tier (49/57/70/77 → 50/58/71/80), and the vendored price table exactly the three matching rows (76 → 79) with no rate change to any existing row (`node scripts/sync-model-prices.mjs` regenerated the array and cross-checked every rate against the page's rendered table). The same check re-verified unchanged: the subscription plan maps, the ZDR exception set (both CLI anchors extracted from both bundles — the union is 20 members in each, so `meituan/LongCat-2.0` was already excepted at 1.62.0 and the note in `src/capabilities.ts` now says so), the deals, the peak membership and schedule, the automatic-reasoning set, and the whole wire protocol — every `/alpha/*` path, the `x-command-code-version` / `x-cmd-zdr` header table, the stream event vocabulary and the browser-login call site are identical between the two bundles. Two things ARE new upstream and neither changes this adapter's two chat transports. The Provider API documents a fifth endpoint, `POST /provider/v1/systemone` (System One decisions, model `typesafe/jev`, absent from `/provider/v1/models` and never to be listed as a chat model): it is the endpoint the command guard above already speaks, so this sync confirms that contract rather than adding one — its three question types, its 20-question ceiling and its free-through-2026-09-24 window all match the CLI's own `systemOneRequestSchema`. And the docs' deals list carries two temporary "boosted usage" plan-budget promotions (`deepseek-v4.1-flash` and `mimo-v2.6-flash`) that raise a plan's credit allowance rather than any per-token rate — no `deal` object, no price row, nothing in the snapshot.
 
 ## [0.11.9] - 2026-09-22
 

package/README.md

@@ -54,7 +54,7 @@ Pick the release line that matches your DeepSeek Harness version:
 **pnpm 11 holds back new releases.** Its `minimumReleaseAge` defaults to 1440 minutes, so a version published less than a day ago is skipped and `@latest` resolves to the *previous* release — silently, with a success exit code. To install a release from the last 24 hours, name it exactly:
 
 ```sh
-dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.1
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.11
 ```
 
 The same applies to every profile you install into, including the terminal UI below.
@@ -73,7 +73,7 @@ dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@0.9.1      #
 Each profile updates separately — the terminal UI owns its own plugin list (see below):
 
 ```sh
-dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.1
+dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.11
 ```
 
 To move to a version published less than 24 hours ago, name it exactly as in Install above; pnpm 11's age gate resolves `@latest` to the previous release instead.
@@ -102,7 +102,7 @@ After restart, enter your API key in **Settings → Command Code** and save; **S
 The plugin also works under a terminal front door. **Each dsh profile owns its own plugin list**, so the web install above does not reach the terminal — add the plugin to the `dsh-tui` profile as well:
 
 ```sh
-dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.1
+dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.11
 ```
 
 Pin the exact version here. For the first 24 hours after a release, a bare package name (or `@latest`) is silently resolved to the previous one: the install succeeds, but the profile gets the older build — which is how a fresh terminal install ends up with no **`/settings` → Command Code** page and no `commandcode` models at all.
@@ -156,7 +156,7 @@ The command's user-facing copy follows the shell's locale: explicit `lang: 'en'
 
 With several Command Code subscriptions, the plugin **switches to the next account automatically** when one hits its usage limit:
 
-- **Setup** — use the **Account rotation** card at Settings → **Command Code** to add accounts with a label and API key; the top-level key always serves first as the `default` account.
+- **Setup** — use the **Account rotation** card at Settings → **Command Code** to add an account and label it. Paste its API key, or use the page's global **Save** button, then **Sign in to Command Code** and open the authorization link shown on that account's row in a new browser tab. The global Save/Discard bar stays inside the settings panel, attached to the bottom of its scrolling area. The top-level key always serves first as the `default` account.
 - **Manual switching** — the **Active account** dropdown pins a preferred account; if it is exhausted, requests fall back to other accounts and return once its window resets.
 - **Route models to accounts** — the **Route models to accounts** card picks catalog models (multi-select, fetched from the live catalog) and routes them to an account. A request whose model is in a rule serves from that account while it is usable; an exhausted or invalid routed account falls back to the normal rotation. Rules match in list order — the first hit wins.
 - **Show only favorite models** — the **Model allowlist** card keeps only the checked models in the model picker; unchecked shows all (the default).
@@ -188,7 +188,7 @@ llm-commandcode:
 
 ## Configure
 
-**Settings → Command Code** covers the API key, API base URL, working directory, and request/stream timeouts; once a key is saved, a live **Account usage** card appears at the top of the page. The **Advanced** card holds the toggles — hide out-of-plan models, serve web search with Command Code, and show the quota card in the sidebar (off by default).
+**Settings → Command Code** covers the API key, API base URL, working directory, and request/stream timeouts; once a key is saved, a live **Account usage** card appears at the top of the page. The **Advanced** card holds the toggles — hide out-of-plan models, serve web search with Command Code, show the quota card in the sidebar (off by default), the AI command guard (off by default, see below), and zero data retention (off by default, see below).
 
 The same options live in `$DSH_HOME/settings.yaml` (changes apply immediately, no restart):
 
@@ -201,6 +201,10 @@ llm-commandcode:
   requestTimeoutMs: 60000          # default 60s
   streamIdleTimeoutMs: 300000      # default 300s
   showSidebarQuota: true           # optional: show the plans & quota card in the sidebar (default off)
+  commandGuard: true               # optional: let the decision model auto-approve safe shell commands (default off)
+  commandGuardThreshold: 0.9       # optional: probability of "safe" needed to skip the prompt (0.5-1, default 0.9)
+  commandGuardTimeoutMs: 1500      # optional: decision budget in ms (200-10000, default 1500)
+  zdr: true                        # optional: route requests only through zero-data-retention upstreams (default off)
 ```
 
 ## Web search
@@ -215,6 +219,32 @@ When your deployment's dsh shell mounts the web capability (`@deepseek-ai/dsh-we
 
 > This reuses the Command Code Provider API directly (like the official CLI's built-in `web_search`), so it is distinct from a DeepSeek-native search backend.
 
+## AI command guard
+
+When dsh is about to ask you to approve a shell command (`bash`/`pwsh`) — a permission preset, a `PreToolUse` hook, or a sandbox escalation — this plugin can ask the Command Code decision model `typesafe/jev` whether the command is safe to run without asking. A confident *yes* turns into a one-shot `allowed-once` grant; everything else asks you exactly as before.
+
+**Off by default.** Turn it on with the *"Let AI judge shell commands"* toggle (`commandGuard`) in the Advanced card, or in your profile config. What the guard does and does not do:
+
+- It only ever sees commands dsh had **already decided to ask about** — it never widens a permission policy, and it never answers a session whose policy is "never ask".
+- Only a `yes` with probability at least `commandGuardThreshold` (default 0.9) skips the prompt. A `no`, a low-confidence answer, a timeout (default 1500 ms), a rate limit, a missing key, an unreadable answer, a command longer than 6000 characters, or a match against the built-in denylist (`sudo`, `rm -rf /`, `git push`, publish/upload commands, piping a download into a shell, …) all fall back to the normal prompt.
+- The **command text** (plus the agent's own one-line description, the working directory and the asker's reason) is sent to Command Code to be judged — with the same API key and base URL as chat.
+- The decision model has **no zero-data-retention upstream**, so this feature is incompatible with a ZDR-only policy. Leave it off if that matters to you.
+- The endpoint is free through 2026-09-24; after that it bills $0.042 per 1M input tokens (output free) — a single decision is a few hundred tokens, and an identical command with the same approval context in the same agent reuses the previous verdict for 10 minutes.
+
+Every AI decision is logged on the Host — `llm-commandcode: command guard auto-approved a bash call (safe probability 0.97, model): <the command>` for a grant, `… delegated a bash call: <reason> — <the command>` for everything that fell through — and the outcome lands in the session's own approval audit (`approval/asked` / `approval/decided`), so a grant can always be traced back to the verdict that produced it. The log goes to the Host's console (the terminal running `dsh web`, or the desktop app's log), not to the browser.
+
+## Zero data retention (ZDR)
+
+Command Code can serve a request only through upstreams that retain no prompts or completions and never train on them — the same opt-in the official CLI exposes as `CMD_ZDR=1`, and the `x-cmd-zdr: 1` header on the Provider API ([official docs](https://commandcode.ai/docs/resources/zdr)).
+
+**Off by default.** Turn it on with the *"Zero data retention (ZDR)"* toggle (`zdr`) in the Advanced card, or in your profile config. How this plugin implements it:
+
+- The header is sent on **every chat request** while ZDR is on. The plugin maintains an informational exception list (`KNOWN_NON_ZDR_MODELS`, synced from the official CLI — about 20 models, e.g. `xai/grok-4.5`, `stepfun/Step-3.7-Flash`, `meta/muse-spark-1.3`). A model without an available ZDR upstream fails with `422 cmd_zdr_no_providers`; the request is never retried without the header.
+- If a refusal still happens (coverage churn, or no ZDR upstream with spare capacity at that moment), the error names the cause and how to turn ZDR off, instead of surfacing as a bare HTTP 422.
+- **ZDR usually costs more**: capacity is limited and billed at each upstream's pass-through rates, and which upstream serves a request can change per request. The session-cost readout keeps quoting the ordinary catalog rates; the real per-request price shows in Command Code's Studio usage page.
+- The decision model behind the **AI command guard** has no ZDR upstream, so its requests never carry the header even with `zdr` on — the two features stay independent.
+- Works on every plan; plan credits meter ZDR requests at the plan's default allowance.
+
 ## Notes & limitations
 
 - **Image input is model-gated** — only Vision models accept images; text-only models refuse them.
@@ -227,7 +257,7 @@ When your deployment's dsh shell mounts the web capability (`@deepseek-ai/dsh-we
 
 ## Permissions & privacy
 
-The plugin only communicates between your local dsh profile and your Command Code account: locally it touches only the credential store and the models cache (plus `~/.commandcode/auth.json` as a last-resort fallback); on the network it calls only the Command Code API. No telemetry.
+The plugin only communicates between your local dsh profile and your Command Code account: locally it touches only the credential store and the models cache (plus `~/.commandcode/auth.json` as a last-resort fallback); on the network it calls only the Command Code API. No telemetry. The one optional exception is the **AI command guard** (off by default), which sends the shell command it is asked to judge — see above. With **zero data retention** on (also off by default), chat requests require a ZDR upstream; models without one fail instead of running without the protection.
 
 ## Disabling / uninstalling
 

package/README.zh-CN.md

@@ -52,7 +52,7 @@
 **pnpm 11 会拦下刚发布的新版本。** 它的 `minimumReleaseAge` 默认为 1440 分钟，发布不足一天的版本会被跳过，`@latest` 解析到**上一个**版本 —— 而且是静默的，命令照样以成功退出。想装 24 小时内发布的版本，必须写精确版本号：
 
 ```sh
-dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.1
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.11
 ```
 
 这一点对每个 profile 都成立，包括下面的终端界面。
@@ -71,7 +71,7 @@ dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@0.9.1      #
 每个 profile 各自更新 —— 终端界面有独立的插件列表（见下文）：
 
 ```sh
-dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.1
+dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.11
 ```
 
 要更新到发布不足 24 小时的版本，和上面的安装一样写精确版本号；pnpm 11 的年龄门禁会把 `@latest` 解析成上一个版本。
@@ -100,7 +100,7 @@ cmd login        # macOS/Linux；Windows 原生版：cmdc login
 插件同样支持终端前端。**每个 dsh profile 有独立的插件列表**，所以上面那条 Web 安装命令不会装到终端里 —— 还要把插件装进 `dsh-tui` profile：
 
 ```sh
-dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.1
+dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.11
 ```
 
 这里请写精确版本号。新版本发布后的 24 小时内，只写包名（或 `@latest`）会被静默解析到上一个版本 —— 安装命令照样成功，但 profile 里拿到的是旧版本，结果就是全新的终端安装里既没有 **`/settings` → Command Code** 页面，也看不到任何 `commandcode` 模型。
@@ -154,7 +154,7 @@ cmd login                               # 写入 ~/.commandcode/auth.json
 
 有多个 Command Code 订阅时，插件可以在一个账户达到用量限额后**自动切换到下一个账户**：
 
-- **配置**：在 **设置 → Command Code** 的「多账户轮换」卡片添加账户并填写备注名与 API key；顶层 key 始终是第一顺位的 `default` 账户。
+- **配置**：在 **设置 → Command Code** 的「多账户轮换」卡片添加账户并填写备注名。可直接填写 API key，或先点击页面底部的全局「保存」，再在该账户行点击「登录 Command Code」并打开出现的授权链接，在新网页授权获取 key；全局「放弃 / 保存」操作栏在设置面板内部随滚动吸附于底部。顶层 key 始终是第一顺位的 `default` 账户。
 - **手动切换**：卡片上的「当前使用账户」下拉框可指定优先账户；所选账户耗尽时自动回落到其他账户，窗口重置后自动恢复。
 - **按模型切换账户**：在「按模型切换账户」卡片从实时模型目录**多选**模型并固定到某个账户。请求的模型在规则列表中且该账户可用时使用该账户；账户耗尽或密钥失效时自动回落到常规轮换。规则按列表顺序匹配，第一条命中生效。
 - **只显示常用模型**：在「模型白名单」卡片勾选要保留的模型，模型选择器只列出这些；不勾选则显示全部（默认行为不变）。
@@ -186,7 +186,7 @@ llm-commandcode:
 
 ## 配置
 
-**设置 → Command Code** 可配置 API key、API 地址、工作目录与请求/流超时；配置好 key 后，页面顶部会显示实时「账户用量」卡片。**高级设置**卡片里集中了各个开关：隐藏套餐外模型、用 Command Code 承载联网搜索，以及在侧边栏显示额度卡片（默认关闭）。
+**设置 → Command Code** 可配置 API key、API 地址、工作目录与请求/流超时；配置好 key 后，页面顶部会显示实时「账户用量」卡片。**高级设置**卡片里集中了各个开关：隐藏套餐外模型、用 Command Code 承载联网搜索、在侧边栏显示额度卡片（默认关闭）、AI 命令安全预判（默认关闭，见下），以及零数据保留 ZDR（默认关闭，见下）。
 
 同一组选项也位于 `$DSH_HOME/settings.yaml`（修改即刻生效，无需重启）：
 
@@ -199,6 +199,10 @@ llm-commandcode:
   requestTimeoutMs: 60000          # 默认 60s
   streamIdleTimeoutMs: 300000      # 默认 300s
   showSidebarQuota: true           # 可选：在侧边栏显示套餐与配额卡片（默认关闭）
+  commandGuard: true               # 可选：让决策模型自动放行安全的 shell 命令（默认关闭）
+  commandGuardThreshold: 0.9       # 可选：跳过弹窗所需的「安全」概率（0.5-1，默认 0.9）
+  commandGuardTimeoutMs: 1500      # 可选：决策等待上限（毫秒，200-10000，默认 1500）
+  zdr: true                        # 可选：请求只经由零数据保留上游（默认关闭）
 ```
 
 ## 联网搜索
@@ -213,6 +217,32 @@ llm-commandcode:
 
 > 这里直接使用 Command Code Provider API（与官方 CLI 内置的 `web_search` 相同），因此与 DeepSeek 原生搜索后端不同。
 
+## AI 命令安全预判
+
+当 dsh 准备就某条 shell 命令（`bash`/`pwsh`）征求你同意时——无论是权限预设、`PreToolUse` 钩子还是沙箱提权——本插件可以先让 Command Code 的决策模型 `typesafe/jev` 判断这条命令是否安全到无需询问。判断为「安全」且把握足够高时，直接放行这一次调用；其余情况一律照旧询问你。
+
+**默认关闭。** 在高级设置里打开「用 AI 预判命令是否安全」（`commandGuard`），或写进 profile 配置。它的行为边界：
+
+- 它只会看到 dsh **本来就要询问你**的命令——不会放宽任何权限策略，也不会替「从不询问」（policy 为 `never`）的会话作答。
+- 只有「安全」概率不低于 `commandGuardThreshold`（默认 0.9）时才跳过弹窗。判为不安全、把握不足、超时（默认 1500ms）、限流、缺 key、返回体读不懂、命令超过 6000 字符，或命中内置危险名单（`sudo`、`rm -rf /`、`git push`、发布/上传类命令、把下载内容管进 shell 等），全部回到普通弹窗。
+- 送往 Command Code 判断的内容包括**命令原文**、模型自己写的一行描述、工作目录与询问原因；使用与聊天相同的 API key 与 base URL。
+- 该决策模型**没有零数据保留（ZDR）上游**，因此本功能与「只走 ZDR」的合规要求不兼容；如果你在意这一点，请保持关闭。
+- 该端点 2026-09-24 前免费，之后按输入 $0.042/1M tokens 计费（输出免费）——单次判断只有几百 tokens；同一 agent 中命令和审批场景都相同时，10 分钟内复用上一次结论。
+
+每次 AI 决策都会在 Host 侧写日志——放行是 `llm-commandcode: command guard auto-approved a bash call (safe probability 0.97, model): <命令>`，其余是 `… delegated a bash call: <原因> — <命令>`——并进入会话自身的审批审计（`approval/asked` / `approval/decided`），所以任何一次放行都能追溯到产生它的判断。日志打到 Host 控制台（运行 `dsh web` 的终端，或桌面端日志），不进浏览器。
+
+## 零数据保留（ZDR）
+
+Command Code 可以让请求只经由「不留存提示词与回复、也不用于训练」的上游——官方 CLI 的开关是 `CMD_ZDR=1`，Provider API 上则是在请求头发 `x-cmd-zdr: 1`（[官方文档](https://commandcode.ai/docs/resources/zdr)）。
+
+**默认关闭。** 在高级设置里打开「零数据保留（ZDR）」（`zdr`），或写进 profile 配置。本插件的实现方式：
+
+- 开启后，**每次聊天请求**都会带上 ZDR 请求头。插件仍维护官方 CLI 的例外名单（`KNOWN_NON_ZDR_MODELS`，约 20 个模型，例如 `xai/grok-4.5`、`stepfun/Step-3.7-Flash`、`meta/muse-spark-1.3`）供查询。没有可用 ZDR 上游时，服务端返回 `422 cmd_zdr_no_providers`；插件不会去掉请求头重试。
+- 万一仍被拒绝（名单过期，或那一刻没有空闲的 ZDR 上游容量），错误信息会说明原因并给出关闭 ZDR 的办法，而不是抛出一个光秃秃的 HTTP 422。
+- **ZDR 通常更贵**：容量有限，按各上游实价透传计费，且每次请求落在哪个上游可能不同。会话费用读数仍按常规目录价估算；真实单价见 Command Code Studio 的用量页。
+- **AI 命令安全预判**背后的决策模型没有 ZDR 上游，因此即使打开 `zdr`，它的请求也永远不带该请求头——两个功能互不影响。
+- 各套餐均可使用；ZDR 请求按套餐的默认额度（而非提升额度）计量。
+
 ## 注意事项与限制
 
 - **图片输入按模型能力限制**：仅 Vision 模型接受图片，纯文本模型会直接拒绝。
@@ -224,7 +254,7 @@ llm-commandcode:
 
 ## 权限与隐私
 
-本插件只在本地与你的 Command Code 账号之间通信：本地仅读写凭据存储与模型缓存文件（兜底读取 `~/.commandcode/auth.json`）；网络仅访问 Command Code API。无遥测。
+本插件只在本地与你的 Command Code 账号之间通信：本地仅读写凭据存储与模型缓存文件（兜底读取 `~/.commandcode/auth.json`）；网络仅访问 Command Code API。无遥测。唯一的可选例外是 **AI 命令安全预判**（默认关闭），它会把待判断的命令文本发送出去——见上文。打开**零数据保留**（同样默认关闭）后，聊天请求必须经由 ZDR 上游；没有可用 ZDR 上游的模型会报错，不会按常规方式继续发送。
 
 ## 关闭 / 卸载
 

package/icon.svg

@@ -1,5 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="Command Code">
-  <rect width="64" height="64" rx="14" fill="#0F172A"/>
-  <path d="M18 20 L30 32 L18 44" fill="none" stroke="#4ADE80" stroke-width="6" stroke-linecap="round" stroke-linejoin="round"/>
-  <path d="M34 44 L48 44" fill="none" stroke="#94A3B8" stroke-width="6" stroke-linecap="round"/>
-</svg>
+<svg fill="none" height="137" viewBox="0 0 137 137" width="137" xmlns="http://www.w3.org/2000/svg"><path d="m0 66.7959c0-31.4879 0-47.2318 9.78204-57.01386 9.78206-9.78204 25.52596-9.78204 57.01396-9.78204h2.5357c31.4883 0 47.2323 0 57.0143 9.78204 9.782 9.78206 9.782 25.52596 9.782 57.01396v2.5357c0 31.4883 0 47.2323-9.782 57.0143s-25.526 9.782-57.0144 9.782h-2.5357c-31.4879 0-47.2318 0-57.01386-9.782-9.78204-9.782-9.78204-25.526-9.78204-57.0144z" fill="#000"/><g fill="#fff"><path clip-rule="evenodd" d="m69.3317 5.56633h-2.5357c-15.9014 0-27.2674.01182-35.905 1.17312-8.4775 1.13977-13.4886 3.29415-17.173 6.97855s-5.83878 8.6955-6.97855 17.173c-1.1613 8.6376-1.17312 20.0036-1.17312 35.9049v2.5357c0 15.9014.01182 27.2674 1.17312 35.9054 1.13977 8.477 3.29415 13.488 6.97855 17.173 3.6844 3.684 8.6955 5.838 17.173 6.978 8.6376 1.161 20.0036 1.173 35.9049 1.173h2.5357c15.9014 0 27.2674-.012 35.9054-1.173 8.477-1.14 13.488-3.294 17.173-6.978 3.684-3.685 5.838-8.696 6.978-17.173 1.161-8.638 1.173-20.004 1.173-35.9053v-2.5357c0-15.9014-.012-27.2674-1.173-35.905-1.14-8.4775-3.294-13.4886-6.978-17.173-3.685-3.6844-8.696-5.83878-17.173-6.97855-8.638-1.1613-20.004-1.17312-35.9053-1.17312zm-59.54966 4.21571c-9.78204 9.78206-9.78204 25.52596-9.78204 57.01386v2.5357c0 31.4884 0 47.2324 9.78204 57.0144 9.78206 9.782 25.52596 9.782 57.01386 9.782h2.5357c31.4884 0 47.2324 0 57.0144-9.782s9.782-25.526 9.782-57.0143v-2.5357c0-31.488 0-47.2319-9.782-57.01396-9.782-9.78204-25.526-9.78204-57.0143-9.78204h-2.5357c-31.488 0-47.2319 0-57.01396 9.78204z" fill-rule="evenodd"/><path d="m93.6604 26.1784c-8.982 0-16.2887 7.3067-16.2887 16.2888v6.9809h-18.6158v-6.9809c0-8.9821-7.3067-16.2888-16.2887-16.2888-8.9821 0-16.2888 7.3067-16.2888 16.2888s7.3067 16.2887 16.2888 16.2887h6.9809v18.6158h-6.9809c-8.9821 0-16.2888 7.3067-16.2888 16.2888 0 8.9825 7.3067 16.2885 16.2888 16.2885 8.982 0 16.2887-7.306 16.2887-16.2885v-6.981h18.6158v6.981c0 8.9825 7.3067 16.2885 16.2887 16.2885 8.9826 0 16.2886-7.306 16.2886-16.2885 0-8.9821-7.306-16.2888-16.2886-16.2888h-6.9809v-18.6158h6.9809c8.9826 0 16.2886-7.3066 16.2886-16.2887s-7.306-16.2888-16.2886-16.2888zm-6.9809 23.2697v-6.9809c0-3.8628 3.1182-6.9809 6.9809-6.9809 3.8628 0 6.9806 3.1181 6.9806 6.9809 0 3.8627-3.1178 6.9809-6.9806 6.9809zm-44.2123 0c-3.8628 0-6.9809-3.1182-6.9809-6.9809 0-3.8628 3.1181-6.9809 6.9809-6.9809 3.8627 0 6.9809 3.1181 6.9809 6.9809v6.9809zm16.2887 27.9236v-18.6158h18.6158v18.6158zm34.9045 23.2693c-3.8627 0-6.9809-3.1178-6.9809-6.9805v-6.981h6.9809c3.8628 0 6.9806 3.1182 6.9806 6.981 0 3.8627-3.1178 6.9805-6.9806 6.9805zm-51.1932 0c-3.8628 0-6.9809-3.1178-6.9809-6.9805 0-3.8628 3.1181-6.981 6.9809-6.981h6.9809v6.981c0 3.8627-3.1182 6.9805-6.9809 6.9805z"/></g></svg>