fix: harden Command Code capabilities

Author: hanbinnoh

gui/src/i18n/de.ts

@@ -37,6 +37,7 @@ export const de: Record<TKey, string> = {
   "theme.dark": "Dunkel",
   "theme.system": "System",
   "lang.label": "Sprache",
+  "provider.name.commandCode": "Command Code",
   "provider.name.volcengine": "Volcengine Ark",
   "provider.name.volcengineCodingPlan": "Volcengine Ark Coding-Tarif",
   "provider.name.volcengineAgentPlan": "Volcengine Ark Agent-Tarif",

gui/src/i18n/en.ts

@@ -44,6 +44,7 @@ export const en = {
   "theme.dark": "Dark",
   "theme.system": "System",
   "lang.label": "Language",
+  "provider.name.commandCode": "Command Code",
   "provider.name.volcengine": "Volcengine Ark",
   "provider.name.volcengineCodingPlan": "Volcengine Ark Coding Plan",
   "provider.name.volcengineAgentPlan": "Volcengine Ark Agent Plan",

gui/src/i18n/ja.ts

@@ -42,6 +42,7 @@ export const ja: Record<TKey, string> = {
   "theme.dark": "ダーク",
   "theme.system": "システム",
   "lang.label": "言語",
+  "provider.name.commandCode": "Command Code",
   "provider.name.volcengine": "Volcengine Ark",
   "provider.name.volcengineCodingPlan": "Volcengine Ark コーディングプラン",
   "provider.name.volcengineAgentPlan": "Volcengine Ark エージェントプラン",

gui/src/i18n/ko.ts

@@ -37,6 +37,7 @@ export const ko: Record<TKey, string> = {
   "theme.dark": "다크",
   "theme.system": "시스템",
   "lang.label": "언어",
+  "provider.name.commandCode": "Command Code",
   "provider.name.volcengine": "Volcengine Ark",
   "provider.name.volcengineCodingPlan": "Volcengine Ark 코딩 플랜",
   "provider.name.volcengineAgentPlan": "Volcengine Ark 에이전트 플랜",

gui/src/i18n/ru.ts

@@ -42,6 +42,7 @@ export const ru: Record<TKey, string> = {
   "theme.dark": "Тёмная",
   "theme.system": "Системная",
   "lang.label": "Язык",
+  "provider.name.commandCode": "Command Code",
   "provider.name.volcengine": "Volcengine Ark",
   "provider.name.volcengineCodingPlan": "Volcengine Ark — тариф Coding",
   "provider.name.volcengineAgentPlan": "Volcengine Ark — тариф Agent",

gui/src/i18n/zh.ts

@@ -37,6 +37,7 @@ export const zh: Record<TKey, string> = {
   "theme.dark": "深色",
   "theme.system": "跟随系统",
   "lang.label": "语言",
+  "provider.name.commandCode": "Command Code",
   "provider.name.volcengine": "火山方舟",
   "provider.name.volcengineCodingPlan": "火山方舟编程套餐",
   "provider.name.volcengineAgentPlan": "火山方舟智能体套餐",

gui/src/provider-icons.ts

@@ -63,8 +63,6 @@ const PROVIDER_DISPLAY_NAMES: Record<string, string> = {
   "cloudflare-workers-ai": "Cloudflare Workers AI",
   cline: "Cline",
   "cline-pass": "ClinePass",
-  "command-code": "Command Code",
-  commandcode: "Command Code",
   nvidia: "NVIDIA NIM",
   ollama: "Ollama",
   "ollama-cloud": "Ollama Cloud",
@@ -101,6 +99,8 @@ const PROVIDER_DISPLAY_NAMES: Record<string, string> = {
 };
 
 const PROVIDER_DISPLAY_NAME_KEYS: Record<string, TKey> = {
+  "command-code": "provider.name.commandCode",
+  commandcode: "provider.name.commandCode",
   volcengine: "provider.name.volcengine",
   "volcengine-coding-plan": "provider.name.volcengineCodingPlan",
   "volcengine-agent-plan": "provider.name.volcengineAgentPlan",

src/adapters/command-code.ts

@@ -1,9 +1,14 @@
 import { randomUUID } from "node:crypto";
 import { readdirSync } from "node:fs";
 import type { AdapterEvent, OcxContentPart, OcxMessage, OcxParsedRequest, OcxProviderConfig, OcxTool, OcxUsage } from "../types";
-import { namespacedToolName } from "../types";
-import type { AdapterRequest, ProviderAdapter } from "./base";
+import { isAllowedToolChoice, namespacedToolName, toolAllowedByChoice } from "../types";
+import type { AdapterFetchContext, AdapterRequest, ProviderAdapter } from "./base";
 import type { TranslatorBudget } from "../lib/translator-budget";
+import { readBoundedResponseBody } from "../lib/bounded-body";
+import { configuredReasoningEfforts } from "../reasoning-effort";
+import { commandCodeReasoningEfforts, refreshCommandCodeReasoningEfforts } from "../providers/command-code-efforts";
+import { identifyRoutedModel } from "./identity";
+import { buildNonOpenAIToolCatalogNudgeForTools } from "./tool-catalog-nudge";
 
 // Retain the short ids emitted by the first local integration. New requests use the live catalog's
 // provider-native IDs directly; this map is compatibility-only and is not a model fallback list.
@@ -50,19 +55,50 @@ function wireMessages(messages: OcxMessage[]): Array<Record<string, unknown>> {
   return out;
 }
 
-function wireTools(tools: OcxTool[] | undefined): Array<Record<string, unknown>> {
-  return (tools ?? []).map(tool => ({
+function visibleTools(parsed: OcxParsedRequest): OcxTool[] {
+  const choice = parsed.options.toolChoice;
+  if (choice === "none") return [];
+  const tools = parsed.context.tools ?? [];
+  if (isAllowedToolChoice(choice)) {
+    const allowed = new Set(choice.allowedTools);
+    return tools.filter(tool => toolAllowedByChoice(tool, allowed));
+  }
+  if (choice && typeof choice !== "string") {
+    return tools.filter(tool => tool.name === choice.name || namespacedToolName(tool.namespace, tool.name) === choice.name);
+  }
+  return tools;
+}
+
+function toolChoiceInstruction(parsed: OcxParsedRequest): string | undefined {
+  const choice = parsed.options.toolChoice;
+  if (choice === "required" || (isAllowedToolChoice(choice) && choice.mode === "required")) {
+    return "Tool choice is required for this turn. Make at least one call from the advertised tool catalog before answering.";
+  }
+  if (choice && typeof choice !== "string" && !isAllowedToolChoice(choice)) {
+    return `Tool choice is required for this turn. Call the advertised tool named ${namespacedToolName(undefined, choice.name)} before answering.`;
+  }
+  return undefined;
+}
+
+function wireTools(tools: OcxTool[]): Array<Record<string, unknown>> {
+  return tools.map(tool => ({
     name: namespacedToolName(tool.namespace, tool.name),
     description: tool.description,
     input_schema: tool.parameters,
   }));
 }
 
-function commandCodeConfig(): Record<string, unknown> {
+function currentWorkingDirectory(): string | undefined {
+  try { return process.cwd(); } catch { return undefined; }
+}
+
+function commandCodeConfig(cwd: string | undefined): Record<string, unknown> {
   let structure: string[] = [];
-  try { structure = readdirSync(process.cwd()).filter(name => !name.startsWith(".")); } catch { /* cwd may disappear */ }
+  if (cwd) {
+    try { structure = readdirSync(cwd).filter(name => !name.startsWith(".")); } catch { /* workspace metadata is optional */ }
+  }
   return {
-    workingDir: process.cwd(),
+    ...(cwd ? { workingDir: cwd } : {}),
     date: new Date().toISOString().slice(0, 10),
     environment: process.platform,
     structure,
@@ -99,74 +135,179 @@ function eventError(value: unknown): string {
   return "Command Code stream error";
 }
 
-async function*ndjson(response: Response): AsyncGenerator<Record<string, unknown>> {
+async function*ndjson(response: Response, budget: TranslatorBudget): AsyncGenerator<Record<string, unknown>> {
   if (!response.body) throw new Error("Command Code response body missing");
   const reader = response.body.getReader();
   const decoder = new TextDecoder();
+  const encoder = new TextEncoder();
   let buffer = "";
-  for (;;) {
-    const { value, done } = await reader.read();
-    buffer += decoder.decode(value, { stream: !done });
-    let newline = buffer.indexOf("\n");
-    while (newline >= 0) {
-      const line = buffer.slice(0, newline).trim(); buffer = buffer.slice(newline + 1);
-      if (line) { try { yield JSON.parse(line) as Record<string, unknown>; } catch { /* ignore non-events */ } }
-      newline = buffer.indexOf("\n");
+  let bufferBytes = 0;
+  try {
+    for (;;) {
+      const { value, done } = await reader.read();
+      const next = buffer + decoder.decode(value, { stream: !done });
+      const nextBytes = encoder.encode(next).byteLength;
+      const reservation = budget.reserveTransient(nextBytes, { kind: "live_transient" });
+      buffer = next;
+      reservation.commitRetained();
+      budget.releaseRetained(bufferBytes, { kind: "live_transient" });
+      bufferBytes = nextBytes;
+      let newline = buffer.indexOf("\n");
+      while (newline >= 0) {
+        const line = buffer.slice(0, newline).trim(); buffer = buffer.slice(newline + 1);
+        if (line) { try { yield JSON.parse(line) as Record<string, unknown>; } catch { /* ignore non-events */ } }
+        newline = buffer.indexOf("\n");
+      }
+      const residualBytes = encoder.encode(buffer).byteLength;
+      const residualReservation = budget.reserveTransient(residualBytes, { kind: "live_transient" });
+      residualReservation.commitRetained();
+      budget.releaseRetained(bufferBytes, { kind: "live_transient" });
+      bufferBytes = residualBytes;
+      if (done) break;
     }
-    if (done) break;
+    const final = buffer.trim();
+    if (final) { try { yield JSON.parse(final) as Record<string, unknown>; } catch { /* ignore */ } }
+  } finally {
+    budget.releaseRetained(bufferBytes, { kind: "live_transient" });
+    reader.releaseLock();
   }
-  const final = buffer.trim();
-  if (final) { try { yield JSON.parse(final) as Record<string, unknown>; } catch { /* ignore */ } }
+}
+
+function isReasoningEffortRejection(status: number, payload: string): boolean {
+  return (status === 400 || status === 422) && /reasoning[_ -]?effort|unsupported effort|invalid effort/i.test(payload);
+}
+
+function requestWithoutReasoningEffort(request: AdapterRequest): AdapterRequest | undefined {
+  try {
+    const body = JSON.parse(request.body) as { params?: Record<string, unknown> };
+    if (!body.params?.reasoning_effort) return undefined;
+    delete body.params.reasoning_effort;
+    return { ...request, body: JSON.stringify(body), reasoningLog: undefined };
+  } catch {
+    return undefined;
+  }
+}
+
+async function fetchCommandCode(request: AdapterRequest, ctx: AdapterFetchContext | undefined, executor: typeof globalThis.fetch): Promise<Response> {
+  const timeout = new AbortController();
+  const timer = setTimeout(() => timeout.abort(new DOMException("Timeout elapsed", "TimeoutError")), ctx?.timeoutMs ?? 200_000);
+  const callerSignal = ctx?.abortSignal ?? new AbortController().signal;
+  try {
+    return await executor(request.url, {
+      method: request.method,
+      headers: request.headers,
+      body: request.body,
+      redirect: "manual",
+      signal: AbortSignal.any([callerSignal, timeout.signal]),
+    });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function supportedCommandCodeEffort(provider: OcxProviderConfig, modelId: string, requested: string | undefined): string | undefined {
+  if (!requested || requested === "none") return undefined;
+  const supported = commandCodeReasoningEfforts(modelId) ?? configuredReasoningEfforts(provider, modelId);
+  if (!supported) return undefined;
+  // Command Code's official profiles describe xhigh as the CLI label that maps to
+  // the wire value `max`; preserve that mapping without advertising a synthetic tier.
+  const wire = requested === "xhigh" && supported.includes("max") ? "max" : requested;
+  return supported.includes(wire) ? wire : undefined;
 }
 
 export function createCommandCodeAdapter(provider: OcxProviderConfig): ProviderAdapter {
+  const executor = (provider as OcxProviderConfig & { fetch?: typeof globalThis.fetch }).fetch ?? globalThis.fetch;
   return {
     name: "command-code",
     buildRequest(parsed: OcxParsedRequest): AdapterRequest {
       if (!provider.apiKey) throw new Error("Command Code credential missing — run ocx login command-code");
-      const system = parsed.context.systemPrompt?.join("\n\n") ?? "";
+      const cwd = currentWorkingDirectory();
+      const tools = visibleTools(parsed);
+      const toolNudge = buildNonOpenAIToolCatalogNudgeForTools(tools, parsed.options.toolChoice);
+      const choiceInstruction = toolChoiceInstruction(parsed);
+      const system = identifyRoutedModel([
+        ...(parsed.context.systemPrompt ?? []),
+        ...(toolNudge ? [toolNudge] : []),
+        ...(choiceInstruction ? [choiceInstruction] : []),
+      ].join("\n\n"), parsed.modelId);
+      const reasoningEffort = supportedCommandCodeEffort(provider, parsed.modelId, parsed.options.reasoning);
       const body = {
-        config: commandCodeConfig(), memory: null, taste: null, skills: null,
+        config: commandCodeConfig(cwd), memory: null, taste: null, skills: null,
         permissionMode: "standard", mode: "agent",
         params: {
           model: COMMAND_CODE_MODEL_ALIASES[parsed.modelId] ?? parsed.modelId,
           messages: wireMessages(parsed.context.messages),
-          tools: wireTools(parsed.context.tools),
+          tools: wireTools(tools),
           system,
           max_tokens: parsed.options.maxOutputTokens ?? provider.defaultMaxOutputTokens ?? 64_000,
           stream: true,
           ...(parsed.options.temperature !== undefined ? { temperature: parsed.options.temperature } : {}),
-          ...(parsed.options.reasoning && parsed.options.reasoning !== "none" ? { reasoning_effort: parsed.options.reasoning } : {}),
+          ...(reasoningEffort ? { reasoning_effort: reasoningEffort } : {}),
         },
       };
+      const headers: Record<string, string> = {
+        Authorization: `Bearer ${provider.apiKey}`,
+        "Content-Type": "application/json",
+        "User-Agent": "cli",
+        "x-command-code-version": "1.12.0",
+        "x-cli-environment": "production",
+        "x-taste-learning": "false",
+        "x-co-flag": "false",
+        "x-session-id": randomUUID(),
+      };
+      if (cwd) headers["x-project-slug"] = cwd.replace(/[^a-zA-Z0-9]+/g, "-").replace(/^-|-$/g, "").toLowerCase();
       return {
         url: `${provider.baseUrl.replace(/\/$/, "")}/alpha/generate`, method: "POST",
-        headers: {
-          Authorization: `Bearer ${provider.apiKey}`,
-          "Content-Type": "application/json",
-          "User-Agent": "cli",
-          "x-command-code-version": "1.12.0",
-          "x-cli-environment": "production",
-          "x-project-slug": process.cwd().replace(/[^a-zA-Z0-9]+/g, "-").replace(/^-|-$/g, "").toLowerCase(),
-          "x-taste-learning": "false",
-          "x-co-flag": "false",
-          "x-session-id": randomUUID(),
-        },
+        headers,
         body: JSON.stringify(body),
+        ...(reasoningEffort ? { reasoningLog: { effectiveEffort: reasoningEffort, wireField: "reasoning_effort" as const, wireValue: reasoningEffort } } : {}),
       };
     },
-    async *parseStream(response: Response, _budget: TranslatorBudget): AsyncGenerator<AdapterEvent> {
-      for await (const event of ndjson(response)) {
+    async fetchResponse(request: AdapterRequest, ctx?: AdapterFetchContext): Promise<Response> {
+      const response = await fetchCommandCode(request, ctx, executor);
+      if (response.ok) return response;
+      const currentEffort = (() => {
+        try { return (JSON.parse(request.body) as { params?: { reasoning_effort?: unknown } }).params?.reasoning_effort; } catch { return undefined; }
+      })();
+      if (typeof currentEffort !== "string") return response;
+      let body = "";
+      try {
+        const observed = await readBoundedResponseBody(response.clone(), { signal: ctx?.abortSignal, maxBytes: 8 * 1024 });
+        if (!observed.displaySafe) return response;
+        body = observed.text;
+      } catch { return response; }
+      if (!isReasoningEffortRejection(response.status, body)) return response;
+      const modelId = (() => {
+        try { return (JSON.parse(request.body) as { params?: { model?: unknown } }).params?.model; } catch { return undefined; }
+      })();
+      if (typeof modelId !== "string") return response;
+      const refreshed = await refreshCommandCodeReasoningEfforts(modelId, executor);
+      if (!refreshed || refreshed.includes(currentEffort)) return response;
+      const retry = requestWithoutReasoningEffort(request);
+      if (!retry) return response;
+      try { void response.body?.cancel(); } catch { /* already closed */ }
+      return fetchCommandCode(retry, ctx, executor);
+    },
+    async *parseStream(response: Response, budget: TranslatorBudget): AsyncGenerator<AdapterEvent> {
+      for await (const event of ndjson(response, budget)) {
         switch (event.type) {
           case "text-delta": if (typeof event.text === "string") yield { type: "text_delta", text: event.text }; break;
           case "reasoning-delta": if (typeof event.text === "string") yield { type: "thinking_delta", thinking: event.text }; break;
           case "tool-call": {
             const id = typeof event.toolCallId === "string" ? event.toolCallId : randomUUID();
             const name = typeof event.toolName === "string" ? event.toolName : "tool";
             const input = event.input ?? event.args ?? {};
+            const argumentsText = typeof input === "string" ? input : JSON.stringify(input);
             yield { type: "tool_call_start", id, name };
-            yield { type: "tool_call_delta", arguments: typeof input === "string" ? input : JSON.stringify(input) };
-            yield { type: "tool_call_end" };
+            budget.openCall(id);
+            try {
+              const reservation = budget.reserveTransient(new TextEncoder().encode(argumentsText).byteLength, { kind: "tool_args", callId: id });
+              reservation.commitRetained();
+              yield { type: "tool_call_delta", arguments: argumentsText };
+              yield { type: "tool_call_end" };
+            } finally {
+              budget.closeCall(id);
+            }
             break;
           }
           case "finish": yield { type: "done", usage: usage(event.totalUsage), stopReason: typeof event.rawFinishReason === "string" ? event.rawFinishReason : undefined }; break;

src/oauth/command-code.ts

@@ -110,6 +110,9 @@ function createCallbackServer(state: string): {
 }
 
 export async function loginCommandCode(ctrl: OAuthController, options: CommandCodeLoginOptions = {}): Promise<OAuthCredentials> {
+  if (ctrl.signal?.aborted) {
+    throw ctrl.signal.reason ?? new DOMException("Command Code login aborted", "AbortError");
+  }
   if (shouldImportLocalCommandCodeAuth(options)) {
     const local = await importLocalCommandCodeAuth();
     if (local) {
@@ -119,7 +122,7 @@ export async function loginCommandCode(ctrl: OAuthController, options: CommandCo
   }
   const state = randomState();
   const { server, callback } = createCallbackServer(state);
-  const callbackUrl = `http://localhost:${server.port}/callback`;
+  const callbackUrl = `http://127.0.0.1:${server.port}/callback`;
   const authUrl = `${COMMAND_CODE_STUDIO_URL}/studio/auth/cli?callback=${encodeURIComponent(callbackUrl)}&state=${encodeURIComponent(state)}`;
   ctrl.onAuth?.({ url: authUrl, instructions: "Sign in with Command Code in the browser." });
   ctrl.onProgress?.("Waiting for Command Code authentication...");