paseo-plugin-zcode-provider 0.3.0 → 0.4.1

package/NOTICE.md

@@ -16,11 +16,11 @@ ZCode は統合 CLI を配布していないため、このリポジトリは `z
 
 Node.js は利用者のマシンが nodejs.org の公式成果物を直接取得します。このリポジトリは Node.js を再配布しません。
 
-`server/vendor/zcode` は [zai-org/ZCode](https://github.com/zai-org/ZCode/tree/29628c9acdb81b703bbd4080c207a0e7ce5e276e) の RPC、V4 契約、wire 組み立てと純粋な差分適用、および必要なスキーマ依存を含みます。第一者コードは [上流 LICENSE](server/vendor/zcode/LICENSE) の Apache-2.0、RPC と wire codec の VS Code 由来部分は [MIT の通知](server/vendor/zcode/THIRD-PARTY-NOTICES.md) の条件を保持します。[上流 NOTICE](server/vendor/zcode/NOTICE.md) は全文を保持しており、上流製品全体の説明です。そこに記載された全機能・依存がプラグインへ同梱されることを意味しません。
+`server/vendor/zcode` は [zai-org/ZCode](https://github.com/zai-org/ZCode/tree/3c5b227649371507ddc4eb46ac5133afe6db1cab) の RPC、V4 契約、wire 組み立てと純粋な差分適用、および必要なスキーマ依存を含みます。第一者コードは [上流 LICENSE](server/vendor/zcode/LICENSE) の Apache-2.0、RPC と wire codec の VS Code 由来部分は [MIT の通知](server/vendor/zcode/THIRD-PARTY-NOTICES.md) の条件を保持します。[上流 NOTICE](server/vendor/zcode/NOTICE.md) は全文を保持しており、上流製品全体の説明です。そこに記載された全機能・依存がプラグインへ同梱されることを意味しません。
 
 ファイルごとの出典・SHA-256、private workspace import の変更、第三者通知の抽出範囲を [provenance.json](server/vendor/zcode/provenance.json) に記録しています。取得・照合は `scripts/sync-zcode-source.mjs` で行います。`npm run build` はこれらのライセンス・通知を `dist/licenses/zcode` にも配置します。
 
-開発 SDK は `@getpaseo/plugin@0.11.0-beta.5` です。ビルドは `@getpaseo/plugin/server/provider` と `zod` を外部モジュールとして維持し、Paseo に解決させます。
+開発 SDK は `@getpaseo/plugin@0.12.0` です。ビルドは `@getpaseo/plugin/server/provider` と `zod` を外部モジュールとして維持し、Paseo に解決させます。
 
 `icon.svg` は [Paseo main c424f829 の glm-acp-agent.svg](https://github.com/getpaseo/paseo/blob/c424f82922fcd36aa9cc9e473644bca04417b420/packages/app/src/assets/acp-provider-icons/glm-acp-agent.svg) のコピーです。この SVG は [ACP Registry の glm-acp-agent/icon.svg](https://github.com/agentclientprotocol/registry/blob/f3826ddd6e35951ea9b7fd0cf43c35a30c3c64cd/glm-acp-agent/icon.svg) とバイト単位で一致します。ACP Registry は Apache-2.0 で配布されており、その [LICENSE](vendor/acp-registry/LICENSE) を保持しています。アイコンは変更していません。商標への権利や公式の承認を示すものではありません。
 

package/README.md

@@ -10,10 +10,10 @@ This is an unofficial plugin. It is not endorsed or maintained by ZCode or Z.ai.
 
 | Setting        | Requirement                                                                                                                             |
 | -------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
-| Paseo          | 0.8.0 or later; development SDK 0.11.0-beta.5                                                                                           |
+| Paseo          | 0.8.0 or later; development SDK 0.12.0                                                                                                  |
 | Plugin Node.js | 22.12.0 or later (the Paseo daemon's runtime)                                                                                           |
 | Managed setup  | darwin-arm64, linux-x64, linux-arm64, win-x64, win-arm64                                                                                |
-| ZCode          | Managed: 3.14.3 (release `3.14.3-paseo.1`) with Node.js 24.21.0. Overrides: stable Server 3.14.0+ / Agent 0.16.9+ with Node.js 24.14.0+ |
+| ZCode          | Managed: 3.16.2 (release `3.16.2-paseo.1`) with Node.js 24.21.0. Overrides: stable Server 3.14.0+ / Agent 0.16.9+ with Node.js 24.14.0+ |
 
 ## Installation
 
@@ -26,7 +26,7 @@ paseo plugin ls
 
 You can also paste `npm:paseo-plugin-zcode-provider` into **Settings → Plugins → Plugin source**. npm packages require Paseo 0.9.0 or later and npm on the daemon host. Paseo installs the released version and compiles the plugin. Update with `paseo plugin update zcode-provider`. Plugins execute with the daemon user's permissions.
 
-To follow the `main` branch instead, install the Git repository with `paseo plugin add supermomonga/paseo-plugin-zcode-provider`. Paseo prepares the checkout with `npm ci`.
+To follow the `main` branch instead, install the Git repository with `paseo plugin add github:supermomonga/paseo-plugin-zcode-provider` (Paseo 0.9.0 or later). Since Paseo 0.11.0, the form without `github:` looks the plugin up in Paseo's plugin registry, which does not list it. Paseo prepares the checkout with `npm ci`.
 
 ## Setup
 
@@ -35,7 +35,7 @@ Open **Settings → Plugins → zcode-provider → Settings**. The screen has tw
 On the **Runtime** tab, choose **Download and install**. The screen lists every download, its SHA-256, size and license before you start. Setup runs on the machine hosting the daemon:
 
 - Node.js 24.21.0 from nodejs.org.
-- The ZCode runtime 3.14.3 from this repository's [releases](https://github.com/supermomonga/paseo-plugin-zcode-provider/releases/tag/zcode-runtime-v3.14.3-paseo.1) (`3.14.3-paseo.1`). ZCode does not publish its integrated CLI, so this is an **unofficial build** of the public source with the patches in [patches/zcode](patches/zcode) applied (ADR 19), made and verified by CI. The patches hide Computer Use and Browser Use, which cannot run here. It is not endorsed or maintained by ZCode or Z.ai.
+- The ZCode runtime 3.16.2 from this repository's [releases](https://github.com/supermomonga/paseo-plugin-zcode-provider/releases/tag/zcode-runtime-v3.16.2-paseo.1) (`3.16.2-paseo.1`). ZCode does not publish its integrated CLI, so this is an **unofficial build** of the public source with the patches in [patches/zcode](patches/zcode) applied (ADR 19), made and verified by CI. The patches hide Computer Use, Browser Use and Visualize, which cannot run or render here. It is not endorsed or maintained by ZCode or Z.ai.
 
 Both archives are verified against SHA-256 values pinned in the plugin and extracted to the daemon user's data directory:
 
@@ -59,7 +59,7 @@ API keys are sent to ZCode, which stores them as Desktop does, and are never sho
 
 ### Coding Plan usage
 
-On Paseo 0.11 and later, Paseo's **Usage** screen and sidebar usage summary show a **ZCode** card for the signed-in account's Individual Coding Plan (Z.ai or BigModel). It lists the 5-hour, weekly, monthly tool-call and ZCode MCP quotas with their reset times, as ZCode Desktop does. The plugin asks ZCode's official usage service for this plan only, on the same ZCode Server as the Account tab. The service never uses an API key from the environment. Team Plan and Start Plan are not shown. Paseo 0.11.0-beta.5 does not yet show usage in a ZCode agent's popover.
+On Paseo 0.11 and later, Paseo's **Usage** screen and sidebar usage summary show a **ZCode** card for the signed-in account's Individual Coding Plan (Z.ai or BigModel). It lists the 5-hour, weekly, monthly tool-call and ZCode MCP quotas with their reset times, as ZCode Desktop does. The plugin asks ZCode's official usage service for this plan only, on the same ZCode Server as the Account tab. The service never uses an API key from the environment. Team Plan and Start Plan are not shown. Paseo 0.12.0 does not yet show usage in a ZCode agent's popover.
 
 ### Using your own runtime
 
@@ -74,11 +74,11 @@ export PASEO_ZCODE_NODE=/absolute/path/to/node       # ordinary Node.js 24.14.0
 
 Session environment variables are forwarded, subject to ZCode's own proxy, certificate and runtime environment handling.
 
-The source baseline is `29628c9acdb81b703bbd4080c207a0e7ce5e276e` (ZCode `v3.14.3`). The managed runtime passed the stdio runtime contract on all five managed platforms in CI. See the [verification record](docs/verification.md) for exact coverage.
+The source baseline is `3c5b227649371507ddc4eb46ac5133afe6db1cab` (ZCode 3.16.2, an untagged upstream `main` commit; see ADR 20). The managed runtime passed the stdio runtime contract on all five managed platforms in CI. See the [verification record](docs/verification.md) for exact coverage.
 
 ## Behavior
 
-- Models and reasoning options come from ZCode. Editing modes are `build`, `edit`, and `yolo`; `settings.plan_mode` is independent.
+- Models and reasoning options come from ZCode. Editing modes are `build`, `edit`, `guarded` and `yolo`; `settings.plan_mode` is independent. `guarded` (ZCode's Autonomous mode, Server 3.15.1 or later) runs tools without approval but asks once, each time, before a command that ZCode's safety rules consider risky; it is not offered on older runtimes.
 - Text, thoughts, tools, subagent progress, usage and history use V4 snapshots and deltas. Tool output is marked when ZCode truncates it. Usage is cumulative; repeated snapshots do not add it again.
 - Text submitted during generation uses native guidance. Attachments use the native queue. Paseo reports one run across these native turns and completes it only after all accepted input has been consumed and foreground work has ended.
 - Acceptance is reported once, after the native acknowledgement. Unknown delivery results are never automatically resent. Stop identifies the current native execution, disables automatic queue execution and removes pending input. A new explicit run enables the queue again.
@@ -86,7 +86,7 @@ The source baseline is `29628c9acdb81b703bbd4080c207a0e7ce5e276e` (ZCode `v3.14.
 - Native permission IDs, option values, questions and Plan approval retain their meanings. Question auto-resolution is disabled for each owned Server. Workspace hook trust is reviewed through the official CLI; it is not represented as “allow once.”
 - Each session owns its Server process and environment. Metadata requests use temporary Servers. Closing stdin gives ZCode time to clean up before process termination.
 
-The plugin uses ZCode's own skills, MCP configuration and tools. Browser Use and Computer Use cannot run in the plugin's ZCode, even when ZCode Desktop has them enabled: the Computer Use helper accepts only the signed Desktop app, and only Desktop provides browsers. The plugin therefore hides them from the model (ADR 19); Desktop is not affected. Generic rewind, independent Paseo child agents, hook-review UI and Goal/Workflow controls are outside this migration. `prompt.output_schema`, custom system prompts and `persist:false` are unsupported. MCP `alwaysLoad` is unsupported; stdio MCP commands must be absolute paths. Provider options are unsupported: in Paseo 0.11 and later, `agents.providers.zcode.options` in Paseo's `config.json` makes sessions fail with `INVALID_CONFIGURATION`, and the `command` and `env` overrides there are not applied. Paseo does not show context usage reported before the first turn, and the plugin adds no substitute display; Coding Plan quota appears in Paseo 0.11's Usage screen (see [Coding Plan usage](#coding-plan-usage)).
+The plugin uses ZCode's own skills, MCP configuration and tools. Browser Use and Computer Use cannot run in the plugin's ZCode, even when ZCode Desktop has them enabled: the Computer Use helper accepts only the signed Desktop app, and only Desktop provides browsers. ZCode's Visualize (interactive views in the conversation) renders only in Desktop. The plugin therefore hides all three from the model (ADR 19, ADR 21); Desktop is not affected. Generic rewind, independent Paseo child agents, hook-review UI and Goal/Workflow controls are outside this migration. `prompt.output_schema`, custom system prompts and `persist:false` are unsupported. MCP `alwaysLoad` is unsupported; stdio MCP commands must be absolute paths. Provider options are unsupported: in Paseo 0.11 and later, `agents.providers.zcode.options` in Paseo's `config.json` makes sessions fail with `INVALID_CONFIGURATION`, and the `command` and `env` overrides there are not applied. Paseo does not show context usage reported before the first turn, and the plugin adds no substitute display; Coding Plan quota appears in Paseo 0.11's Usage screen (see [Coding Plan usage](#coding-plan-usage)).
 
 ## Persistence
 
@@ -94,7 +94,7 @@ New handles use **version 3**. Versions 1 and 2 are rejected without migration o
 
 Unsent conversations are deferred drafts. Before the first prompt, the plugin atomically saves the logical-to-native ID mapping under `$XDG_STATE_HOME/paseo-plugin-zcode-provider/sessions-v3`, or `~/.local/state/paseo-plugin-zcode-provider/sessions-v3`. It stores identifiers and workspace paths, not message bodies. Preserve this directory for backup. A mapping write failure prevents sending. Corrupt mappings and missing native conversations fail explicitly; no replacement conversation is created.
 
-New conversations support listing, resume and paged V4 history. Mode/Plan restoration requires both `mode` and `settings.plan_mode` saved by Paseo. The plugin applies them after native restore and confirms the resulting state before reporting the session ready. Omitted settings retain whatever ZCode returns, which can be stale on the pinned source; restoration of those values is not guaranteed. There is no private Plan restoration store. [ADR 14](docs/adr/0014-paseoの保存設定を再適用する復元を保証範囲とする.md) limits the guarantee to this supported path; settings-free restoration is checked separately with `npm run test:native-restore`. Existing ZCode databases may be migrated by ZCode itself on startup; the native tests isolate the home, configuration and database.
+New conversations support listing, resume and paged V4 history. From ZCode 3.16, archiving belongs to Desktop's task list, so the listing also contains conversations archived in Desktop. Mode/Plan restoration requires both `mode` and `settings.plan_mode` saved by Paseo. The plugin applies them after native restore and confirms the resulting state before reporting the session ready. Omitted settings retain whatever ZCode returns, which can be stale on the pinned source; restoration of those values is not guaranteed. There is no private Plan restoration store. [ADR 14](docs/adr/0014-paseoの保存設定を再適用する復元を保証範囲とする.md) limits the guarantee to this supported path; settings-free restoration is checked separately with `npm run test:native-restore`. Existing ZCode databases may be migrated by ZCode itself on startup; the native tests isolate the home, configuration and database.
 
 ## Diagnostics
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paseo-plugin-zcode-provider",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Unofficial Paseo provider plugin for ZCode, using the official stdio Services Server of the integrated ZCode CLI.",
   "keywords": [
     "paseo",
@@ -60,9 +60,9 @@
     "semver": "7.8.5"
   },
   "devDependencies": {
-    "@getpaseo/client": "0.11.0-beta.5",
-    "@getpaseo/plugin": "0.11.0-beta.5",
-    "@getpaseo/protocol": "0.11.0-beta.5",
+    "@getpaseo/client": "0.12.0",
+    "@getpaseo/plugin": "0.12.0",
+    "@getpaseo/protocol": "0.12.0",
     "@types/node": "22.18.3",
     "@types/react": "~19.2.0",
     "@types/semver": "7.8.0",

package/server/account.ts

@@ -127,6 +127,7 @@ export const sessionStateSchema = z.discriminatedUnion("status", [
 export const familySchema = z.enum(["zai", "bigmodel"]).nullable();
 export const accountSettingsSchema = z.object({
   providerFamilyDomain: z.string().optional(),
+  providerFamilyDomainUpdatedAt: z.number().optional(),
   providerFamilyConnectionSelections: record.optional(),
 });
 const startedSchema = z.object({
@@ -749,6 +750,8 @@ export class AccountService {
   // Desktop's completion: select the signed-in family and its individual
   // Coding Plan unless a plan is already chosen, then refresh entitlements.
   // Without the family the Server does not offer the account's models.
+  // Writing the selections requires the settings read here as the expected
+  // state (compare-and-set), as Desktop's setProviderFamilyDomain passes them.
   private async completeSignIn(
     host: SettingsHost,
     family: AccountFamily,
@@ -773,6 +776,13 @@ export class AccountService {
             [family]: selections[family] ?? { kind: "individual-coding-plan" },
           },
         },
+        {
+          providerFamilyDomain: settings.providerFamilyDomain,
+          providerFamilyConnectionSelections:
+            settings.providerFamilyConnectionSelections,
+          providerFamilyDomainUpdatedAt:
+            settings.providerFamilyDomainUpdatedAt ?? 0,
+        },
       ],
       z.unknown(),
     );

package/server/build-info.ts

@@ -1,2 +1,2 @@
 // Generated from package.json by npm prepare / prebuild.
-export const PROVIDER_VERSION = "0.3.0";
+export const PROVIDER_VERSION = "0.4.1";

package/server/discovery/manifest.ts

@@ -1,7 +1,7 @@
 import { gte, parse } from "semver";
 import type { RuntimeIdentity } from "./types.js";
 
-export const ZCODE_SOURCE_COMMIT = "29628c9acdb81b703bbd4080c207a0e7ce5e276e";
+export const ZCODE_SOURCE_COMMIT = "3c5b227649371507ddc4eb46ac5133afe6db1cab";
 export const MINIMUM_ZCODE_VERSION = { app: "3.14.0", cli: "0.16.9" } as const;
 export const MINIMUM_NODE_VERSION = "24.14.0";
 
@@ -33,4 +33,4 @@ export function assessCompatibility(identity: RuntimeIdentity): {
 }
 
 // Last reviewed public changelog release; source versions are not releases.
-export const LAST_REVIEWED_ZCODE_RELEASE = "3.14.4";
+export const LAST_REVIEWED_ZCODE_RELEASE = "3.16.2";

package/server/mapping.ts

@@ -1,6 +1,7 @@
 import type { NativePromptInput } from "./session-types.js";
 import { realpath, stat } from "node:fs/promises";
 import { basename, isAbsolute, relative } from "node:path";
+import { gte, valid } from "semver";
 import { z } from "zod";
 
 import type {
@@ -23,12 +24,42 @@ export const ZCODE_MODES: ProviderMode[] = [
     label: "Edit Automatically",
     description: "Edit files automatically while keeping other approvals",
   },
+  {
+    id: "guarded",
+    label: "Autonomous",
+    description: "Run tools without approval, but ask before risky commands",
+  },
   {
     id: "yolo",
     label: "Full Access",
     description: "Run tools without approval",
   },
 ];
+// ZCode 3.15.1 added guarded ("Autonomous mode"); older Servers reject it.
+const GUARDED_MINIMUM_APP_VERSION = "3.15.1";
+
+// The modes the runtime with this Server version supports.
+export function zcodeModes(appVersion: string | undefined): ProviderMode[] {
+  const guarded =
+    appVersion !== undefined &&
+    valid(appVersion) !== null &&
+    gte(appVersion, GUARDED_MINIMUM_APP_VERSION);
+  return guarded ? ZCODE_MODES : ZCODE_MODES.filter((m) => m.id !== "guarded");
+}
+
+export function requireConfigurableMode(
+  mode: string | null | undefined,
+  modes: readonly ProviderMode[] = ZCODE_MODES,
+): void {
+  if (
+    mode === null ||
+    (mode !== undefined && !modes.some((m) => m.id === mode))
+  )
+    throw new AdapterError(
+      "INVALID_CONFIGURATION",
+      `ZCode editing mode must be ${modes.map((m) => m.id).join(", ")}`,
+    );
+}
 
 export function requireMode(mode: string): string {
   if (

package/server/provider.ts

@@ -41,7 +41,8 @@ import {
   decodeModel,
   encodeModel,
   mapMcpServers,
-  ZCODE_MODES,
+  requireConfigurableMode,
+  zcodeModes,
 } from "./mapping.js";
 import {
   ZCodeSession,
@@ -316,7 +317,7 @@ export class ZCodeConnection implements ProviderConnection {
             requestId: input.requestId,
             catalog: {
               models,
-              modes: ZCODE_MODES,
+              modes: zcodeModes(host.diagnostic.appVersion),
               defaultModel: models.find((model) => model.isDefault)?.id,
               defaultMode: presentation.mode,
             },
@@ -453,14 +454,7 @@ export class ZCodeConnection implements ProviderConnection {
       }
       case "session.configure": {
         const settings = settingsSchema.parse(input.changes.settings ?? {});
-        if (
-          input.changes.mode !== undefined &&
-          !ZCODE_MODES.some((mode) => mode.id === input.changes.mode)
-        )
-          throw new AdapterError(
-            "INVALID_CONFIGURATION",
-            "ZCode editing mode must be build, edit, or yolo",
-          );
+        requireConfigurableMode(input.changes.mode);
         if (input.changes.model !== undefined)
           await entry.native.setModel(input.changes.model);
         if (input.changes.thinkingOption !== undefined)
@@ -499,14 +493,7 @@ export class ZCodeConnection implements ProviderConnection {
     const config = input.config;
     optionsSchema.parse(config.providerOptions ?? {});
     const settings = settingsSchema.parse(config.settings);
-    if (
-      config.mode !== undefined &&
-      !ZCODE_MODES.some((mode) => mode.id === config.mode)
-    )
-      throw new AdapterError(
-        "INVALID_CONFIGURATION",
-        "ZCode editing mode must be build, edit, or yolo",
-      );
+    requireConfigurableMode(config.mode);
     if (config.systemPrompt?.trim())
       throw new AdapterError(
         "INVALID_CONFIGURATION",

package/server/runtime/pins.ts

@@ -55,12 +55,12 @@ export const MANAGED_NODE_ARCHIVES: Readonly<
 // Published by .github/workflows/zcode-runtime-release.yml from the pinned
 // source with patches/zcode applied (ADR 19). The same archive serves every
 // managed platform.
-export const MANAGED_ZCODE_VERSION = "3.14.3";
+export const MANAGED_ZCODE_VERSION = "3.16.2";
 const MANAGED_ZCODE_RELEASE = `${MANAGED_ZCODE_VERSION}-paseo.1`;
 export const MANAGED_ZCODE_ARCHIVE: PinnedArchive = {
   url: `https://github.com/supermomonga/paseo-plugin-zcode-provider/releases/download/zcode-runtime-v${MANAGED_ZCODE_RELEASE}/zcode-runtime-${MANAGED_ZCODE_RELEASE}.tar.gz`,
-  sha256: "c51e4547dc804894fd7d62766ab0ce3d759948b8b56cb515528691d75a8e09f9",
-  size: 79_883_611,
+  sha256: "01f3ee802f4c0b24c4023e366485120416a6acc92ec899a9edf7f2fc76eaa17d",
+  size: 82_516_181,
 };
 
 export function managedPlatform(

package/server/session.ts

@@ -29,8 +29,9 @@ import {
   decodeModel,
   encodeModel,
   mapPrompt,
+  requireConfigurableMode,
   requireMode,
-  ZCODE_MODES,
+  zcodeModes,
 } from "./mapping.js";
 import {
   InitializeResultSchema,
@@ -436,7 +437,7 @@ export class ZCodeSession {
       mode: c.mode,
       thinkingOption: c.thought,
       models: catalogModels(this.modelCatalog, c.modelSelection),
-      modes: ZCODE_MODES,
+      modes: zcodeModes(this.bridge.diagnostic.appVersion),
       thinkingOptions: c.thoughtLevels.map((id) => ({ id, label: id })),
       settings: [
         {
@@ -461,14 +462,10 @@ export class ZCodeSession {
   }
   async configureMode(mode?: string | null, plan?: boolean): Promise<void> {
     this.assertIdle();
-    if (
-      mode === null ||
-      (mode !== undefined && !ZCODE_MODES.some((m) => m.id === mode))
-    )
-      throw new AdapterError(
-        "INVALID_CONFIGURATION",
-        "Mode must be build, edit, or yolo",
-      );
+    requireConfigurableMode(
+      mode,
+      zcodeModes(this.bridge.diagnostic.appVersion),
+    );
     const nextMode = mode ?? this.state.config.mode,
       nextPlan = plan ?? this.state.config.planEnabled === true;
     if (

package/server/unsupported-capabilities.ts

@@ -1,9 +1,12 @@
 // Official ZCode capabilities that cannot run in the provider's standalone Server
 // (ADR 19). Computer Use needs the code-signed Desktop to start its Helper, and
-// only the Desktop host supplies browsers to Browser Use.
+// only the Desktop host supplies browsers to Browser Use. Visualize (3.15.1+)
+// needs Desktop's inline view host: ZCode gives its output directory only to
+// Desktop-surface Agents and hides it from terminal sessions for that reason.
 export const SUPPRESSED_OFFICIAL_PLUGINS = [
   "computer-use@zcode-plugins-official",
   "browser-use@zcode-plugins-official",
+  "visualize@zcode-plugins-official",
 ] as const;
 
 // Both capabilities run through this shared tool. Hiding it per turn covers

package/server/vendor/zcode/NOTICE.md

@@ -46,7 +46,10 @@ AI 生成的代码、命令、解释、文件和建议可能存在错误、遗
 | 会话分享、浏览与导入                     | 分享操作可向分享服务提交选中会话行的公开投影及可物化附件，包含用户文本、模型回复与推理文本、工具输入输出和相关元数据。选择阶段可先查询分享服务能力，该能力请求不发送会话投影正文。正常 UI 发布流程要求先确认披露，服务也先校验调用方提交的确认时间，再创建准备记录、上传附件，最后提交发布确认；因此附件可在最终发布成功前已发送，但准备／上传步骤位于服务的披露校验之后。当前 UI 默认公开可导入，浏览与导入不以发布勾选为前提。确认时间字段不能证明任意调用方都经过 UI 勾选。浏览与导入会发送分享码和可用认证信息，并访问附件下载地址；导入还会发送请求标识。投影过滤和文本处理不是全面秘密检测；本地删除或取消不保证外部已上传副本或接收者副本被删除。 |
 | 闲时任务票据与状态同步                   | 可用性查询、取号排队、票据状态同步及核销会发送任务标识、票据标识、来源／请求标识、Coding Plan 身份及认证信息。存在待处理票据等条件时，后台同步可持续请求；这类请求不等于发送完整任务提示词，实际模型内容另走模型链路。                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | 主动反馈、补充消息与诊断附件             | 用户通过反馈表单提交时，可发送正文、联系方式、账号和客户端信息、截图及文件名；服务仍提供补充消息和附件上传接口，后台任务也会用消息接口报告上传结果，接口存在不代表当前界面提供后续补充编辑入口。工单创建成功后可收起表单，已提交的截图和勾选的日志由后台任务继续上传；工单创建成功前退出表单会请求取消创建。附件先向反馈服务申请上传凭证，再向返回的对象存储地址直传文件。桌面日志选项默认不勾选；勾选后按本地当天修改时间和归档规则选取诊断日志文件，并处理文件全文，不保证仅含当天产生的条目。未勾选日志不影响正文或其他附件，文本处理规则也不保证截图和任意文件已脱敏。                                                                               |
-| 安装、插件获取、远端部署与更新           | 安装、发现、认证、部署和更新会访问仓库、包服务、插件市场、CDN 或更新服务器；统一 CLI 安装脚本会从配置的分发源读取版本清单并下载发行包。桌面自动更新受发行形态和运行条件控制，启用后可在启动及周期检查时请求更新清单，携带平台、渠道、设备等信息；平台取值可区分架构，版本信息还会影响更新选择。打包版会忽略 `ZCODE_UPDATE_FEED_URL` 环境变量及 `--zcode-update-feed-url` 启动参数的更新源覆盖；这两个覆盖入口仅供开发构建使用。下载的代码可能随后被安装或执行，远端部署还可能将本地已有或下载的组件上传／复制到目标环境。下载检查、实际安装及运行组件的控制条件不同，不能统一描述成每步都先弹出确认。                                                    |
+| 手机远程控制 | 启用远程控制并完成配对后，桌面与手机网页经外部 relay 交换会话内容、输入、任务状态、权限请求与附件预览等协议消息；relay 负责鉴权、配对、心跳与消息透传，不运行任务。配对与连接会发送设备、窗口与会话标识。relay 地址随发行配置确定，可由 `ZCODE_WEB_REMOTE_CONTROL_RELAY_WS_URL` 覆盖。 |
+| Bots 第三方聊天接入 | 配置 Bot 后，所选第三方聊天平台（如 Telegram、飞书／Lark）的消息可驱动任务；Bot 按回复模式把助手回复、工具调用、文件变更摘要及权限请求发送到该平台，平台方可获得这些内容。Bot 凭据保存在本地凭据服务，配置文件只保存引用。 |
+| 营销触达与奖励中心 | 登录后可从业务服务获取营销 Banner／弹窗配置及资源包并展示；点击、关闭等操作会上报确认／取消事件，领取类操作会调用套餐领取接口。奖励中心以内嵌网页打开，桥接接口向该页面提供主题、语言和登录状态。 |
+| 安装、插件获取、远端部署与更新           | 安装、发现、认证、部署和更新会访问仓库、包服务、插件市场、CDN 或更新服务器；统一 CLI 安装脚本会从配置的分发源读取版本清单并下载发行包。桌面自动更新受发行形态和运行条件控制，启用后可在启动及周期检查时请求更新清单，携带平台、渠道、设备等信息；平台取值可区分架构，版本信息还会影响更新选择。开源构建默认不启用自动更新（构建期可选能力）；启用时，开发构建与打包版都接受 `ZCODE_UPDATE_FEED_URL` 环境变量及 `--zcode-update-feed-url` 启动参数覆盖更新源，用于诊断与应急。下载的代码可能随后被安装或执行，远端部署还可能将本地已有或下载的组件上传／复制到目标环境。下载检查、实际安装及运行组件的控制条件不同，不能统一描述成每步都先弹出确认。                                                    |
 | 工具、Hook、工作流与自动任务的交付或发布 | Shell、终端、Git、Node REPL、浏览器、插件、MCP 或工作流可以读取任务涉及的数据、向相应目标服务上传文件或生成物，并改变外部服务状态；生命周期 Hook 和已配置的定时／后台任务也可触发程序。权限规则、模式、插件配置及系统账号决定执行范围，不能保证每份外发内容都由用户逐项选择或每次外发都有独立确认。发布、发送、购买或部署完成后，本地取消或撤销不一定能恢复外部状态；权限边界见第二节。                                                                                                                                                                                                                                                                  |
 | 开发测试、调试与请求录制                 | 显式运行相关开发工具时，可向配置的真实模型或工具服务发送测试提示、样例资料及认证头；配置为真实上游的录制代理可转发请求，不能因名称含测试／录制就认为完全离线。请求轨迹和调试文件还可能在本地保存模型内容；这些工具的触发入口与普通产品运行不同。                                                                                                                                                                                                                                                                                                                                                                                                         |
 | 构建、签名与维护者发布                   | 显式运行安装、构建或发布脚本时，可下载依赖、原生二进制和运行时，将构建材料复制到发布共享目录、推送 Git，或交给签名工具、Apple 公证服务处理。外部签名工具及另行配置的 CI、存储和分发服务具有自己的网络行为；本仓未展开的流程不能仅凭脚本名称推定已核验。相关调用具有不同的启动入口、环境和凭据要求。CLI SEA 共享目录发布与上传会先校验第三方声明材料，校验失败会阻断该发布流程。当前 native-search 准备步骤按目标平台校验并解包仓库内置归档，本步骤不下载这些归档；Node 等其他组件有各自的下载链路。                                                                                                                                                      |

package/server/vendor/zcode/packages/rpc/src/channelClient.ts

@@ -98,6 +98,7 @@ export class ChannelClient implements IChannelClient, IDisposable {
                 "details",
                 "taskId",
                 "traceId",
+                "retryable",
               ] as const;
               for (const key of passthroughKeys) {
                 const value = response.data[key];

package/server/vendor/zcode/packages/rpc/src/channelServer.ts

@@ -146,6 +146,7 @@ export class ChannelServer<TContext = string> implements IChannelServer<TContext
               details?: unknown;
               taskId?: unknown;
               traceId?: unknown;
+              retryable?: unknown;
             } = {
               message: error.message,
               name: error.name,
@@ -162,6 +163,7 @@ export class ChannelServer<TContext = string> implements IChannelServer<TContext
               "details",
               "taskId",
               "traceId",
+              "retryable",
             ] as const;
             for (const key of passthroughKeys) {
               const value = errorRecord[key];

package/server/vendor/zcode/packages/rpc/src/channels.shared.ts

@@ -49,6 +49,7 @@ export type IRawResponse =
         details?: unknown;
         taskId?: unknown;
         traceId?: unknown;
+        retryable?: unknown;
       };
     }
   | { type: ResponseType.PromiseErrorObj; id: number; data: any }

package/server/vendor/zcode/packages/rpc/src/protocol.ts

@@ -51,9 +51,10 @@ function isMessagePortFlowControl(value: unknown): value is MessagePortFlowContr
   if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
   const record = value as Record<string, unknown>;
   return (
-    Object.keys(record).length === 2 &&
+    // 二进制载荷可能有数百万字节；先看控制标记，避免为排除普通消息逐字节枚举。
     record.__zcodeRpcControl === "connection-flow-v1" &&
-    (record.state === "saturated" || record.state === "drained")
+    (record.state === "saturated" || record.state === "drained") &&
+    Object.keys(record).length === 2
   );
 }
 

package/server/vendor/zcode/packages/shared/src/app-runtime-preferences.ts

@@ -0,0 +1,18 @@
+import { z } from "zod";
+
+export const appToolSearchModeSchema = z.enum(["auto", "local", "off"]);
+export type AppToolSearchMode = z.infer<typeof appToolSearchModeSchema>;
+
+export const APP_RUNTIME_PREFERENCES_CHANGED_BROADCAST_CHANNEL = "settings:app-runtime-preferences";
+export const ASK_USER_QUESTION_E2E_CLOCK_SCALE_ENV = "ZCODE_E2E_ASK_USER_QUESTION_CLOCK_SCALE";
+
+export const appRuntimePreferencesChangedBroadcastPayloadSchema = z
+  .object({
+    askUserQuestionAutoResolutionEnabled: z.boolean(),
+    modelIoFullRetentionEnabled: z.boolean().default(false),
+  })
+  .strict();
+
+export type AppRuntimePreferencesChangedBroadcastPayload = z.infer<
+  typeof appRuntimePreferencesChangedBroadcastPayloadSchema
+>;

package/server/vendor/zcode/packages/shared/src/attachment-source.ts

@@ -0,0 +1,5 @@
+import { z } from "zod";
+
+/** 文本材料只传递文件引用，不能因跨端上传而退回自动全文注入。 */
+export const attachmentSourceKindSchema = z.enum(["clipboard-text", "topic-history"]);
+export type AttachmentSourceKind = z.infer<typeof attachmentSourceKindSchema>;