feat: align bridge with CommandCode 1.3.1

Author: yelixir-dev

.env.example

@@ -15,7 +15,7 @@ COMMANDCODE_API_BASE=https://api.commandcode.ai
 COMMANDCODE_DEFAULT_MODEL=deepseek/deepseek-v4-pro
 COMMANDCODE_ALLOWED_MODELS=deepseek/deepseek-v4-pro,deepseek/deepseek-v4-flash
 COMMANDCODE_ALLOW_UNKNOWN_MODELS=false
-COMMANDCODE_CLI_VERSION=0.40.3
+COMMANDCODE_CLI_VERSION=1.3.1
 COMMANDCODE_TIMEOUT_MS=300000
 COMMANDCODE_EMPTY_VISIBLE_RESPONSE_POLICY=error_on_length
 

README.ko.md

@@ -67,18 +67,18 @@ curl -fsS "$BRIDGE/v1/models" | head -c 400
 
 ## 버전
 
-현재 bridge version: **v0.40.3**.
+현재 bridge version: **v1.3.1**.
 
 버전은 `/health` 응답과 웹 대시보드 오른쪽 위에 표시됩니다.
 
-### v0.40.3 CommandCode 호환성 업데이트
+### v1.3.1 CommandCode 호환성 업데이트
 
-이번 bridge release는 공식 `command-code` npm package `0.40.3`에 맞췄습니다.
+이번 bridge release는 공식 `command-code` npm package `1.3.1`에 맞췄습니다.
 
-- 기본 upstream `x-command-code-version` header는 `COMMANDCODE_CLI_VERSION`으로 덮어쓰지 않는 한 `0.40.3`를 보냅니다.
-- bridge package/runtime version도 `0.40.3`라 `/health`, dashboard, npm metadata가 대상 CommandCode CLI version과 일치합니다.
-- `command-code@0.40.3` bundle을 직접 확인한 결과 bridge 핵심 API path(`/alpha/generate`, `/alpha/whoami`, `/alpha/billing/credits`, `/alpha/billing/subscriptions`, `/alpha/usage/summary`)는 기존 bridge 경로와 호환됩니다. 새 `/alpha/web-search`, `/alpha/web-fetch`, `/alpha/fingerprint/record`, `update-status` surface는 이번 release에서 OpenAI-compatible bridge API로 노출하지 않습니다.
-- model catalog를 `0.40.3` CLI bundle 기준으로 확인했습니다. 기존 enabled default는 보수적으로 유지하고, MiniMax M3 Free, Qwen 3.7 Plus, GLM-5.2, Kimi K2.7 Code/HighSpeed, Step 3.7 Flash, Claude Fable 5 및 기존 preview/frontier 항목은 config에서 명시적으로 켜기 전까지 disabled-by-default입니다.
+- 기본 upstream `x-command-code-version` header는 `COMMANDCODE_CLI_VERSION`으로 덮어쓰지 않는 한 `1.3.1`를 보냅니다.
+- bridge package/runtime version도 `1.3.1`라 `/health`, dashboard, npm metadata가 대상 CommandCode CLI version과 일치합니다.
+- `command-code@1.3.1` bundle을 정적으로 확인한 결과 bridge 핵심 API path(`/alpha/generate`, `/alpha/whoami`, `/alpha/billing/credits`, `/alpha/billing/subscriptions`, `/alpha/usage/summary`)가 유지됩니다. v1 CLI 전체 재작성 표면은 의도적으로 OpenAI-compatible bridge API로 노출하지 않습니다.
+- 기존 enabled model default는 보수적으로 유지하고, 새로 발견되었거나 preview·미승인인 항목은 config에서 명시적으로 켜기 전까지 disabled-by-default입니다.
 
 ## 구조
 
@@ -322,7 +322,7 @@ http://<host-or-tailnet-ip>:9992/dashboard
 
 - **Header**
   - bridge online/offline 상태 표시.
-  - `v0.40.3` 같은 bridge version 표시.
+  - `v1.3.1` 같은 bridge version 표시.
 - **Server Bind**
   - local-only면 `127.0.0.1`.
   - LAN/Tailscale/VPN/reverse proxy 뒤에서만 `0.0.0.0`.
@@ -534,7 +534,7 @@ x-api-key: <BRIDGE_API_KEY>
 | `COMMANDCODE_DEFAULT_MODEL`                  | `deepseek/deepseek-v4-pro`   | `default`가 사용할 model.                                                                                  |
 | `COMMANDCODE_ALLOWED_MODELS`                 | Pro + Flash/catalog defaults | comma-separated allowlist.                                                                                 |
 | `COMMANDCODE_ALLOW_UNKNOWN_MODELS`           | `false`                      | 임의 model ID를 upstream으로 통과. 운영 비권장.                                                            |
-| `COMMANDCODE_CLI_VERSION`                    | `0.40.3`                     | upstream으로 보내는 version header.                                                                        |
+| `COMMANDCODE_CLI_VERSION`                    | `1.3.1`                      | upstream으로 보내는 version header.                                                                        |
 | `COMMANDCODE_TIMEOUT_MS`                     | `300000`                     | upstream request timeout.                                                                                  |
 | `COMMANDCODE_EMPTY_VISIBLE_RESPONSE_POLICY`  | `error_on_length`            | empty visible `finish_reason: length`를 fail-closed. `allow`는 legacy blank success 유지.                  |
 | `REQUEST_BODY_LIMIT_BYTES`                   | `1048576`                    | Fastify body limit.                                                                                        |

README.md

@@ -67,18 +67,18 @@ A healthy bridge returns JSON health/version data and a non-empty OpenAI-compati
 
 ## Version
 
-Current bridge version: **v0.40.3**.
+Current bridge version: **v1.3.1**.
 
 The version is also returned from `/health` and shown in the top-right of the web dashboard.
 
-### v0.40.3 CommandCode compatibility update
+### v1.3.1 CommandCode compatibility update
 
-This bridge release is aligned with the official `command-code` npm package `0.40.3`:
+This bridge release is aligned with the official `command-code` npm package `1.3.1`:
 
-- The default upstream `x-command-code-version` header now advertises `0.40.3` unless `COMMANDCODE_CLI_VERSION` overrides it.
-- The bridge package/runtime version is also `0.40.3` so `/health`, the dashboard, and the npm metadata match the CommandCode CLI version being targeted.
-- Direct inspection of the `command-code@0.40.3` bundle confirmed that the bridge-critical API paths remain compatible: `/alpha/generate`, `/alpha/whoami`, `/alpha/billing/credits`, `/alpha/billing/subscriptions`, and `/alpha/usage/summary`. The newer `/alpha/web-search`, `/alpha/web-fetch`, `/alpha/fingerprint/record`, and `update-status` surfaces are not exposed as OpenAI-compatible bridge APIs in this release.
-- The model catalog was checked against the `0.40.3` CLI bundle. Existing enabled defaults stay conservative, while additional discovered entries such as MiniMax M3 Free, Qwen 3.7 Plus, GLM-5.2, Kimi K2.7 Code/HighSpeed, Step 3.7 Flash, Claude Fable 5, and prior preview/frontier entries remain disabled by default unless explicitly enabled in config.
+- The default upstream `x-command-code-version` header now advertises `1.3.1` unless `COMMANDCODE_CLI_VERSION` overrides it.
+- The bridge package/runtime version is also `1.3.1` so `/health`, the dashboard, and the npm metadata match the CommandCode CLI version being targeted.
+- Static inspection of the `command-code@1.3.1` bundle confirmed that the bridge-critical API paths remain present: `/alpha/generate`, `/alpha/whoami`, `/alpha/billing/credits`, `/alpha/billing/subscriptions`, and `/alpha/usage/summary`. Its v1 CLI rewrite is intentionally not exposed as an OpenAI-compatible bridge API surface.
+- Existing enabled model defaults remain conservative; discovered, preview, and unapproved entries stay disabled unless explicitly enabled in config.
 
 ## Architecture
 
@@ -322,7 +322,7 @@ The dashboard is intentionally mobile-first. It is useful from a phone on the sa
 
 - **Header**
   - Shows bridge online/offline state.
-  - Shows bridge version, for example `v0.40.3`.
+  - Shows bridge version, for example `v1.3.1`.
 - **Server Bind**
   - Choose `127.0.0.1` for local-only use.
   - Choose `0.0.0.0` only for LAN/Tailscale/VPN/reverse-proxy use.
@@ -534,7 +534,7 @@ x-api-key: <BRIDGE_API_KEY>
 | `COMMANDCODE_DEFAULT_MODEL`                  | `deepseek/deepseek-v4-pro`   | Model used for `default`.                                                                                                    |
 | `COMMANDCODE_ALLOWED_MODELS`                 | Pro + Flash/catalog defaults | Comma-separated allowlist.                                                                                                   |
 | `COMMANDCODE_ALLOW_UNKNOWN_MODELS`           | `false`                      | Pass arbitrary model IDs upstream. Not recommended.                                                                          |
-| `COMMANDCODE_CLI_VERSION`                    | `0.40.3`                     | Version header sent upstream.                                                                                                |
+| `COMMANDCODE_CLI_VERSION`                    | `1.3.1`                      | Version header sent upstream.                                                                                                |
 | `COMMANDCODE_TIMEOUT_MS`                     | `300000`                     | Upstream request timeout.                                                                                                    |
 | `COMMANDCODE_EMPTY_VISIBLE_RESPONSE_POLICY`  | `error_on_length`            | `error_on_length` fails closed on empty visible `finish_reason: length`; `allow` preserves legacy blank success behavior.    |
 | `REQUEST_BODY_LIMIT_BYTES`                   | `1048576`                    | Fastify body limit.                                                                                                          |

README.zh.md

@@ -67,18 +67,18 @@ curl -fsS "$BRIDGE/v1/models" | head -c 400
 
 ## 版本
 
-当前 bridge version：**v0.40.3**。
+当前 bridge version：**v1.3.1**。
 
 版本也会从 `/health` 返回，并显示在 web dashboard 右上角。
 
-### v0.40.3 CommandCode 兼容性更新
+### v1.3.1 CommandCode 兼容性更新
 
-此 bridge release 已对齐官方 `command-code` npm package `0.40.3`：
+此 bridge release 已对齐官方 `command-code` npm package `1.3.1`：
 
-- 默认上游 `x-command-code-version` header 现在发送 `0.40.3`，除非用 `COMMANDCODE_CLI_VERSION` 覆盖。
-- bridge package/runtime version 也是 `0.40.3`，因此 `/health`、dashboard 和 npm metadata 与目标 CommandCode CLI version 对齐。
-- 直接检查 `command-code@0.40.3` bundle 后确认，bridge-critical API paths 仍兼容：`/alpha/generate`、`/alpha/whoami`、`/alpha/billing/credits`、`/alpha/billing/subscriptions`、`/alpha/usage/summary`。新的 `/alpha/web-search`、`/alpha/web-fetch`、`/alpha/fingerprint/record` 和 `update-status` surfaces 在本 release 中不会作为 OpenAI-compatible bridge APIs 暴露。
-- model catalog 已按 `0.40.3` CLI bundle 检查。现有 enabled defaults 保持保守；额外发现的 MiniMax M3 Free、Qwen 3.7 Plus、GLM-5.2、Kimi K2.7 Code/HighSpeed、Step 3.7 Flash、Claude Fable 5，以及既有 preview/frontier 条目默认禁用，除非在 config 中显式启用。
+- 默认上游 `x-command-code-version` header 现在发送 `1.3.1`，除非用 `COMMANDCODE_CLI_VERSION` 覆盖。
+- bridge package/runtime version 也是 `1.3.1`，因此 `/health`、dashboard 和 npm metadata 与目标 CommandCode CLI version 对齐。
+- 静态检查 `command-code@1.3.1` bundle 后确认 bridge-critical API paths 仍然存在：`/alpha/generate`、`/alpha/whoami`、`/alpha/billing/credits`、`/alpha/billing/subscriptions`、`/alpha/usage/summary`。v1 CLI 的完整重写 surface 不会作为 OpenAI-compatible bridge APIs 暴露。
+- 现有 enabled defaults 保持保守；新发现、preview 或未批准的 model entries 默认禁用，除非在 config 中显式启用。
 
 ## 架构
 
@@ -206,7 +206,7 @@ dashboard 有意采用 mobile-first 设计，适合在同一可信 tailnet 上
 
 - **Header**
   - 显示 bridge online/offline state。
-  - 显示 bridge version，例如 `v0.40.3`。
+  - 显示 bridge version，例如 `v1.3.1`。
   - 标题旁提供 Korean/English/Chinese flag language selector。
 - **Server Bind**
   - 本机专用选择 `127.0.0.1`。
@@ -373,7 +373,7 @@ x-api-key: <BRIDGE_API_KEY>
 | `COMMANDCODE_MAX_IN_FLIGHT_PER_CREDENTIAL`  | `4`                          | Per-key concurrency cap。                                                                                        |
 | `COMMANDCODE_API_BASE`                      | `https://api.commandcode.ai` | Upstream API base。除非测试明确的 alternate upstream，否则不要更改。                                             |
 | `COMMANDCODE_DEFAULT_MODEL`                 | `deepseek/deepseek-v4-pro`   | `default` 使用的 model。                                                                                         |
-| `COMMANDCODE_CLI_VERSION`                   | `0.40.3`                     | 发送给 upstream 的 version header。                                                                              |
+| `COMMANDCODE_CLI_VERSION`                   | `1.3.1`                      | 发送给 upstream 的 version header。                                                                              |
 | `COMMANDCODE_EMPTY_VISIBLE_RESPONSE_POLICY` | `error_on_length`            | `error_on_length` 对空 visible `finish_reason: length` fail closed；`allow` 保留 legacy blank success behavior。 |
 | `LOG_LEVEL`                                 | `info`                       | Fastify/Pino log level。                                                                                         |
 | `INCLUDE_REASONING`                         | `false`                      | 是否把 reasoning deltas 附加到 visible output。常规 clients 保持 false。                                         |

docs/DEPLOYMENT.ko.md

@@ -398,7 +398,7 @@ npm run smoke
 | `COMMANDCODE_DEFAULT_MODEL`        | `deepseek/deepseek-v4-pro`   | `model: "default"` 요청이 실제로 사용할 upstream model입니다.                                                            |
 | `COMMANDCODE_ALLOWED_MODELS`       | Pro + Flash                  | 허용할 model ID 목록입니다. 이 목록 밖 요청은 unknown model 허용 옵션을 켜지 않는 한 거부됩니다.                         |
 | `COMMANDCODE_ALLOW_UNKNOWN_MODELS` | `false`                      | 임의 model ID를 upstream으로 통과시킵니다. 운영에서는 권장하지 않습니다.                                                 |
-| `COMMANDCODE_CLI_VERSION`          | `0.40.3`                     | 테스트된 CommandCode CLI 동작과 맞추기 위해 upstream에 보내는 version header입니다.                                      |
+| `COMMANDCODE_CLI_VERSION`          | `1.3.1`                      | 테스트된 CommandCode CLI 동작과 맞추기 위해 upstream에 보내는 version header입니다.                                      |
 | `COMMANDCODE_TIMEOUT_MS`           | `300000`                     | upstream generation timeout입니다.                                                                                       |
 
 Credential JSON 파일 예시:

docs/DEPLOYMENT.md

@@ -399,7 +399,7 @@ npm run smoke
 | `COMMANDCODE_DEFAULT_MODEL`        | `deepseek/deepseek-v4-pro`   | Upstream model used by `model: "default"`.                                                                               |
 | `COMMANDCODE_ALLOWED_MODELS`       | Pro + Flash                  | Comma-separated allowlist. Requests outside this list are rejected unless unknown models are allowed.                    |
 | `COMMANDCODE_ALLOW_UNKNOWN_MODELS` | `false`                      | Allows arbitrary model IDs to pass through. Not recommended for production.                                              |
-| `COMMANDCODE_CLI_VERSION`          | `0.40.3`                     | Version header sent upstream to match the tested CommandCode CLI behavior.                                               |
+| `COMMANDCODE_CLI_VERSION`          | `1.3.1`                      | Version header sent upstream to match the tested CommandCode CLI behavior.                                               |
 | `COMMANDCODE_TIMEOUT_MS`           | `300000`                     | Upstream generation timeout.                                                                                             |
 
 Credential file shape:

install.sh

@@ -382,7 +382,7 @@ fi
   write_env_line COMMANDCODE_DEFAULT_MODEL deepseek/deepseek-v4-pro
   write_env_line COMMANDCODE_ALLOWED_MODELS "$DEFAULT_ALLOWED_MODELS"
   write_env_line COMMANDCODE_ALLOW_UNKNOWN_MODELS false
-  write_env_line COMMANDCODE_CLI_VERSION 0.40.3
+  write_env_line COMMANDCODE_CLI_VERSION 1.3.1
   write_env_line COMMANDCODE_TIMEOUT_MS 300000
   write_env_line COMMANDCODE_EMPTY_VISIBLE_RESPONSE_POLICY error_on_length
   write_env_line COMMANDCODE_BALANCE_ALERT_ENABLED false

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "commandcode-bridge",
-  "version": "0.40.3",
+  "version": "1.3.1",
   "description": "OpenAI-compatible HTTP bridge for CommandCode's DeepSeek V4 Pro API path.",
   "type": "module",
   "license": "MIT",

package.json

@@ -15,7 +15,7 @@ COMMANDCODE_CREDENTIAL_COOLDOWN_MS=60000
 COMMANDCODE_DEFAULT_MODEL=deepseek/deepseek-v4-pro
 COMMANDCODE_ALLOWED_MODELS=deepseek/deepseek-v4-pro,deepseek/deepseek-v4-flash
 COMMANDCODE_ALLOW_UNKNOWN_MODELS=false
-COMMANDCODE_CLI_VERSION=0.40.3
+COMMANDCODE_CLI_VERSION=1.3.1
 COMMANDCODE_TIMEOUT_MS=300000
 COMMANDCODE_EMPTY_VISIBLE_RESPONSE_POLICY=error_on_length
 # Balance alerts are opt-in and disabled by default.