@mars-sea/dsh-commandcode-provider 0.11.9 → 0.11.11

package/lib/index.d.ts

@@ -7,7 +7,7 @@ import { Context } from "@deepseek-ai/cordis";
 import { AttachmentStore, ImageAttachmentRef } from "@deepseek-ai/dsh-attachment";
 import { CommandDefinition } from "@deepseek-ai/dsh-commands";
 //#region src/adapter.d.ts
-declare const COMMAND_CODE_CLI_VERSION = "1.62.0";
+declare const COMMAND_CODE_CLI_VERSION = "1.64.0";
 declare const DEFAULT_API_BASE = "https://api.commandcode.ai";
 declare const DEFAULT_GENERATE_MAX_TOKENS = 64000;
 declare const DEFAULT_MAX_OUTPUT_TOKENS = 65536;
@@ -93,6 +93,16 @@ interface CommandCodeConnectionOptions {
    * the plugin's user settings schema.
    */
   protocol?: 'auto' | CommandCodeProtocol;
+  /**
+   * Whether requests enforce zero data retention by sending the
+   * `x-cmd-zdr: 1` header (the same opt-in the official CLI exposes as
+   * `CMD_ZDR=1`). Default false. Every chat request carries the header when
+   * enabled. The provider refuses a model without a ZDR-capable upstream with
+   * 422 `cmd_zdr_no_providers`; never retry that request without the header.
+   * The decision endpoint (`/provider/v1/systemone`) is deliberately never
+   * reached through this connection option — see `./systemone.ts`.
+   */
+  zdr?: boolean;
 }
 /**
  * Resolve the durable attachment service, or undefined when the host does not
@@ -249,7 +259,7 @@ interface CommandCodePlan {
  * at all, so the degraded per-endpoint view would hide the root cause behind
  * a generic "partial data" note). Undefined for partial failures.
  */
-type UsageBlockReason = 'invalid-key' | 'service-unavailable' | 'network';
+type UsageBlockReason = 'invalid-key' | 'service-unavailable' | 'invalid-response' | 'network';
 /** Everything the usage endpoints report, fetched together. */
 interface CommandCodeUsageReport {
   account?: CommandCodeAccount;
@@ -261,8 +271,9 @@ interface CommandCodeUsageReport {
   /**
    * The single reason every endpoint failed, when they all did: `invalid-key`
    * (every call rejected with 401 — the stored key is wrong or expired),
-   * `service-unavailable` (every call answered 5xx), or `network` (no HTTP
-   * response at all). Undefined when any endpoint succeeded.
+   * `service-unavailable` (every call answered 5xx), `invalid-response`
+   * (every call answered but its body was not usable JSON), or `network`
+   * (no HTTP response at all). Undefined when any endpoint succeeded.
    */
   blocked?: UsageBlockReason;
 }
@@ -338,8 +349,8 @@ declare class CommandCodeAdapter<C extends CommandCodeConnectionOptions = Comman
    * Fetch one account endpoint and parse its JSON body. Returns the HTTP
    * status alongside the parsed record so each caller applies its own
    * failure accounting: the billing probe fails open silently, the usage
-   * report books failures per endpoint. Non-2xx and non-record bodies come
-   * back without a record; only a transport throw propagates to the caller.
+   * report books failures per endpoint. Non-2xx and invalid JSON bodies come
+   * back without a record; only a fetch failure propagates to the caller.
    *
    * `timeoutMs` is the caller's budget for this one request. The default is the
    * CATALOG probe's short cap, which fits the picker's fail-open reads; the
@@ -777,6 +788,46 @@ declare const KNOWN_EFFORTS: Readonly<Record<string, readonly string[]>>;
  * dsh-commandcode-upstream skill).
  */
 declare const KNOWN_IMAGE_MODELS: ReadonlySet<string>;
+/**
+ * Models WITHOUT a zero-data-retention upstream, per the official CLI's own
+ * registry (`command-code@1.64.0` `dist/cli.mjs`: `modelSupportsZdr(id)` is
+ * exactly `!nonZdrSet.has(canonicalize(id))`, and `knownModelSupportsZdr`
+ * carries the same membership in the sibling route table — the union is this
+ * set). The official docs (commandcode.ai/docs/resources/zdr) put it in prose
+ * — "99% of our models have ZDR-capable upstreams … only a small handful of
+ * models are affected" — so the CLI's exclusion list is the only per-model
+ * evidence there is; a ZDR request naming one of these fails with HTTP 422
+ * `cmd_zdr_no_providers` instead of routing through a provider that retains.
+ *
+ * Why a NEGATIVE set, and why "not listed" answers TRUE: 99% of the catalog is
+ * covered, so the maintained difference is the exception list. This helper is
+ * informational; the adapter sends the ZDR header for EVERY request when the
+ * switch is on. The provider remains the routing authority and refuses an
+ * unsupported model rather than silently dropping the privacy guarantee.
+ *
+ * `minimax/minimax-m3-free` is the one entry the public catalog
+ * (`/provider/v1/models`) does not serve (it is CLI/pricing-visible and hidden
+ * from the picker); it stays listed because the CLI carries it and a Go-plan
+ * request can still name it.
+ *
+ * Keep in sync via the dsh-commandcode-upstream skill: the CLI's registry data
+ * (its `zdr:{only:[…]}` provider routes and the per-provider `zdr`/`noTraining`
+ * flags) is upstream-internal routing, not a per-model contract, so this table
+ * is the snapshot of the exclusion set and nothing more. The 1.62.0 → 1.64.0
+ * diff of that union is EMPTY: both anchors were extracted from both bundles
+ * during the 2026-09-23 check and each carries the same 20 members — which is
+ * how rare a change here is expected to be. `meituan/LongCat-2.0` is the one
+ * member the two anchors disagree about (it is in `modelSupportsZdr`'s set in
+ * both releases and in neither `knownModelSupportsZdr` set), so the union is
+ * what this table follows; reading only the sibling route table would drop it.
+ */
+declare const KNOWN_NON_ZDR_MODELS: ReadonlySet<string>;
+/**
+ * Whether the CLI snapshot lists a ZDR-capable upstream for `modelId`. This is
+ * informational, never a reason to omit the header when ZDR is enabled: the
+ * provider may add coverage or lack capacity after this snapshot was taken.
+ */
+declare function supportsZeroDataRetention(modelId: string): boolean;
 /**
  * Models the official CLI's model table (command-code@1.53.0) marks
  * `reasoning:!0` but defines no selectable `reasoning_effort` levels — they
@@ -1234,7 +1285,7 @@ declare const loginStatusSchema: TypertSchema<CommandCodeLoginStatus>;
  */
 interface LoginFlowFacade {
   /** Start (or rejoin) an attempt; rejects when it cannot start at all. */
-  begin(): Promise<CommandCodeLoginStatus>;
+  begin(targetRef?: string): Promise<CommandCodeLoginStatus>;
   /** The current attempt's status. */
   status(): CommandCodeLoginStatus;
   /** Cancel a waiting attempt. */
@@ -1311,7 +1362,7 @@ declare class CommandCodeUsageService<C extends CommandCodeConnectionOptions = C
    * (no free loopback port, disposed plugin); the Gateway folds the throw
    * into the failure branch the page renders.
    */
-  loginBegin(): Promise<CommandCodeLoginStatus>;
+  loginBegin(targetRef?: string): Promise<CommandCodeLoginStatus>;
   /** Poll a login attempt's status. */
   loginStatus(): Promise<CommandCodeLoginStatus>;
   /** Cancel a waiting attempt; returns the post-cancel status. */
@@ -1372,7 +1423,9 @@ interface CommandCodeLoginFlowDeps {
    * Receives the validated credentials after a successful login. Rejecting
    * fails the attempt with `unavailable`.
    */
-  storeKey(credentials: CommandCodeLoginCredentials): Promise<void>;
+  storeKey(credentials: CommandCodeLoginCredentials, targetRef?: string): Promise<void>;
+  /** Reject an account target that is not a saved slot before opening Studio. */
+  validateTargetRef?(targetRef: string | undefined): void;
 }
 /** Compose the Studio authorization URL (pure, exported for tests). */
 declare function buildCommandAuthUrl(options: {
@@ -1421,6 +1474,8 @@ declare class CommandCodeLoginFlow {
    * the port window so browser login dies until the Host restarts.
    */
   private starting;
+  /** A live attempt's destination; different rows may not rejoin it. */
+  private targetRef;
   /** A `cancel()` that arrived while a start was still binding (see {@link CommandCodeLoginFlow.cancel}). */
   private cancelPending;
   private disposed;
@@ -1434,7 +1489,7 @@ declare class CommandCodeLoginFlow {
    * `waiting` carrying the Studio URL once the loopback server is up.
    * Rejects only when the flow cannot start at all (no free port, disposed).
    */
-  begin(): Promise<CommandCodeLoginStatus>;
+  begin(targetRef?: string): Promise<CommandCodeLoginStatus>;
   /**
    * The binding half of {@link CommandCodeLoginFlow.begin}: one attempt, one
    * server, one published `waiting` status. Callers reach it only through
@@ -1872,6 +1927,44 @@ interface Config {
    * the toggle is on. Read by the browser client; the adapter ignores it.
    */
   showSidebarQuota?: boolean;
+  /**
+   * Whether the Command Code decision model (`typesafe/jev`) may auto-approve
+   * shell commands that dsh was about to ask about. Defaults to FALSE: the
+   * guard turns a model's opinion into a one-shot approval grant, so it is
+   * opt-in, and the command text (plus the agent's own description of it) is
+   * sent to Command Code to judge. Only commands a policy already wanted a
+   * human to look at are ever judged, and only a confident "safe" verdict
+   * (`commandGuardThreshold`) skips the prompt — every other outcome, including
+   * any failure of the decision call itself, delegates to the normal approval
+   * flow. See `./command-guard.ts`.
+   */
+  commandGuard?: boolean;
+  /**
+   * Minimum probability of "safe" that lets the guard skip the approval prompt;
+   * defaults to 0.9. Lowering it approves more, on less evidence.
+   */
+  commandGuardThreshold?: number;
+  /**
+   * Milliseconds the guard waits for a decision before falling back to the
+   * human prompt; defaults to 1500. This is a latency budget for an interactive
+   * approval, not a request timeout — a decision that arrives late is useless,
+   * because the user is staring at a prompt.
+   */
+  commandGuardTimeoutMs?: number;
+  /**
+   * Whether requests enforce zero data retention: the provider then routes
+   * them only through upstreams that keep no prompts/completions and never
+   * train on them (its own opt-in, `CMD_ZDR=1` in the CLI / `x-cmd-zdr: 1` on
+   * the Provider API). Defaults to FALSE: `zdr` changes WHERE a request is
+   * served. Every chat request carries the header when enabled; a model with
+   * no ZDR-capable upstream fails with 422 `cmd_zdr_no_providers` instead of
+   * being routed through an upstream that retains data. ZDR capacity is
+   * priced pass-through and usually costs more, and the price readout keeps
+   * quoting the ordinary catalog rates (the real per-request price shows in
+   * Command Code's Studio). The decision endpoint behind the command guard is
+   * never ZDR-enforced — see `./systemone.ts`.
+   */
+  zdr?: boolean;
   /**
    * Language override for the `/commandcode` Host-side command's user-facing
    * copy. Host commands cannot read the client's `ctx.locale`, so this is
@@ -1927,5 +2020,5 @@ interface ResolvedCommandCodeOptions extends CommandCodeConnectionOptions {
 declare function resolveAdapterOptions(config: Config): ResolvedCommandCodeOptions;
 declare function apply(ctx: Context, config: Config): void;
 //#endregion
-export { ACTIVE_ACCOUNT_AUTO, type ApiKeyValidation, BILLING_ACCESS_TTL_MS, COMMANDCODE_SEARCH_PROVIDER_ID, COMMAND_CODE_CLI_VERSION, type CommandCodeAccountConfig, CommandCodeAccountPool, type CommandCodeAccountSlot, type CommandCodeAccountState, type CommandCodeAccountUsage, type CommandCodeAccountsReport, CommandCodeAdapter, type CommandCodeAdapterDeps, type CommandCodeBillingAccess, type CommandCodeCommandDeps, type CommandCodeConnectionOptions, type CommandCodeLoginCredentials, type CommandCodeLoginFailureReason, CommandCodeLoginFlow, type CommandCodeLoginFlowDeps, type CommandCodeLoginStatus, type CommandCodeModelAccountRule, CommandCodeSearchProvider, type CommandCodeSearchProviderDeps, type CommandCodeSearchSelection, type CommandCodeTuiSettingsDeps, type CommandCodeUsageDeps, type CommandCodeUsageReport, CommandCodeUsageService, Config, DEFAULT_API_BASE, DEFAULT_GENERATE_MAX_TOKENS, DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_MODELS_CACHE_PATH, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_WEB_SEARCH_PROVIDER_ID, KNOWN_DEALS, KNOWN_EFFORTS, KNOWN_IMAGE_MODELS, KNOWN_PEAK_PRICING, KNOWN_PLANS, KNOWN_SUBSCRIPTION_PLANS, KNOWN_THINKING_MODELS, LANG_AUTO, LOGIN_ALLOWED_ORIGINS, LOGIN_BEGIN_ENDPOINT, LOGIN_BODY_LIMIT_BYTES, LOGIN_CANCEL_ENDPOINT, LOGIN_MAX_PORT_ATTEMPTS, LOGIN_START_PORT, LOGIN_STATUS_ENDPOINT, LOGIN_TIMEOUT_MS, LegacySettingsSchema, type LoginFlowFacade, PLAN_LABELS, PLAN_ORDER, PROVIDER, type ResolveAttachments, ResolvedCommandCodeOptions, type TuiSettingsField, type TuiSettingsFieldOption, type TuiSettingsFieldWrite, type TuiSettingsGroup, type TuiSettingsSection, type TuiSettingsSectionsService, USAGE_REPORT_ENDPOINT, accountUsable, apply, applyCommandCodeSearchSelection, applyCommandCodeTuiSettings, applyCommands, applyUsageRemote, buildCommandAuthUrl, buildCommandCodeTuiSection, capabilityDescription, commandCodeSearchSelection, commandDefinition, compareByPlan, dealLabel, formatContext, inject, loginStatusSchema, matchModelRule, modelVisibleInPlan, name, parseLoginStatus, peakPricingLabel, peakPricingState, planLabel, projectSlugFromPath, resolveAdapterOptions, resolveAuthFileApiKey, selectAccountForModel, selectActiveAccount, selectCommandCodeSearchProvider, studioBaseForApiBase, subscriptionPlanInfo, usageReportSchema, validateCommandApiKey };
+export { ACTIVE_ACCOUNT_AUTO, type ApiKeyValidation, BILLING_ACCESS_TTL_MS, COMMANDCODE_SEARCH_PROVIDER_ID, COMMAND_CODE_CLI_VERSION, type CommandCodeAccountConfig, CommandCodeAccountPool, type CommandCodeAccountSlot, type CommandCodeAccountState, type CommandCodeAccountUsage, type CommandCodeAccountsReport, CommandCodeAdapter, type CommandCodeAdapterDeps, type CommandCodeBillingAccess, type CommandCodeCommandDeps, type CommandCodeConnectionOptions, type CommandCodeLoginCredentials, type CommandCodeLoginFailureReason, CommandCodeLoginFlow, type CommandCodeLoginFlowDeps, type CommandCodeLoginStatus, type CommandCodeModelAccountRule, CommandCodeSearchProvider, type CommandCodeSearchProviderDeps, type CommandCodeSearchSelection, type CommandCodeTuiSettingsDeps, type CommandCodeUsageDeps, type CommandCodeUsageReport, CommandCodeUsageService, Config, DEFAULT_API_BASE, DEFAULT_GENERATE_MAX_TOKENS, DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_MODELS_CACHE_PATH, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_WEB_SEARCH_PROVIDER_ID, KNOWN_DEALS, KNOWN_EFFORTS, KNOWN_IMAGE_MODELS, KNOWN_NON_ZDR_MODELS, KNOWN_PEAK_PRICING, KNOWN_PLANS, KNOWN_SUBSCRIPTION_PLANS, KNOWN_THINKING_MODELS, LANG_AUTO, LOGIN_ALLOWED_ORIGINS, LOGIN_BEGIN_ENDPOINT, LOGIN_BODY_LIMIT_BYTES, LOGIN_CANCEL_ENDPOINT, LOGIN_MAX_PORT_ATTEMPTS, LOGIN_START_PORT, LOGIN_STATUS_ENDPOINT, LOGIN_TIMEOUT_MS, LegacySettingsSchema, type LoginFlowFacade, PLAN_LABELS, PLAN_ORDER, PROVIDER, type ResolveAttachments, ResolvedCommandCodeOptions, type TuiSettingsField, type TuiSettingsFieldOption, type TuiSettingsFieldWrite, type TuiSettingsGroup, type TuiSettingsSection, type TuiSettingsSectionsService, USAGE_REPORT_ENDPOINT, accountUsable, apply, applyCommandCodeSearchSelection, applyCommandCodeTuiSettings, applyCommands, applyUsageRemote, buildCommandAuthUrl, buildCommandCodeTuiSection, capabilityDescription, commandCodeSearchSelection, commandDefinition, compareByPlan, dealLabel, formatContext, inject, loginStatusSchema, matchModelRule, modelVisibleInPlan, name, parseLoginStatus, peakPricingLabel, peakPricingState, planLabel, projectSlugFromPath, resolveAdapterOptions, resolveAuthFileApiKey, selectAccountForModel, selectActiveAccount, selectCommandCodeSearchProvider, studioBaseForApiBase, subscriptionPlanInfo, supportsZeroDataRetention, usageReportSchema, validateCommandApiKey };
 //# sourceMappingURL=index.d.ts.map