{"slug": "command-code-1-58-0-taken-apart-the-taste-subsystem-end-to-end-every-system-wire", "title": "Command Code 1.58.0 taken apart: the taste subsystem end to end, every system prompt, tools, wire protocol, telemetry", "summary": "A developer's teardown of the command-code@1.58.0 npm package found that its marketed \"taste-1\" feature is not a \"meta neuro-symbolic AI model with continuous reinforcement learning\" but a prompt sent to whichever ordinary model the user has selected, with output written to a markdown file prepended to later prompts. The analysis of dist/cli.mjs also found taste learning defaults to on, mines up to 200 git commits without applying the package's own secret-filename filter, and uploads code to vendor servers for processing despite in-product privacy text saying learning data is stored locally.", "body_md": "Everything recovered from reading the published `command-code` npm package: the taste subsystem\nend to end, every system prompt, the tool catalogue, the wire protocol, the model catalogue, and\nthe telemetry.\n\nRead as shipped on 19 September 2026, pinned to one version. Later releases may differ.\n\n| package | [`command-code@1.58.0`](https://www.npmjs.com/package/command-code/v/1.58.0) | \n| file | [`dist/cli.mjs`](https://unpkg.com/command-code@1.58.0/dist/cli.mjs) , 2,635,431 bytes | \n| sha256 | `aab2bec800371953112d18472bb7383992ef264cca22558bdcda77e7d0dc0f14` | \n\nLine numbers below refer to `dist/cli.mjs` after `npx prettier --parser babel`, which produces\n115,067 lines. See [reproducing this](#reproducing-this).\n\n1. `taste-1` is marketed as a \"meta neuro-symbolic AI model with continuous reinforcement\nlearning.\" No such model exists in the package. Taste is a prompt sent to whichever ordinary\nmodel you have selected, and the output is a markdown file that gets prepended to later\nprompts.\n2. Taste feeds on three sources: your git history, your live conversation, and your saved transcripts from Claude Code, Codex and Cursor.\n3. The git path mines up to 200 commits and applies no secret-filename filter, although the\npackage ships one and uses it in six other places. See\n[below](#no-secret-filter-on-the-git-path) .\n4. Taste learning defaults to on.\n5. The in-product privacy text says taste \"stores learning data in your project and on your local machine only.\" Storage is local. Processing happens on the vendor's servers and your code is uploaded to reach it.\n\nFrom [commandcode.ai/docs/taste](https://commandcode.ai/docs/taste), archived\n[2026-09-07](https://web.archive.org/web/20260907191124/https://commandcode.ai/docs/taste),\n[2026-03-13](https://web.archive.org/web/20260313174739/https://commandcode.ai/docs/taste),\n[2025-12-09](https://web.archive.org/web/20251209084020/https://commandcode.ai/docs/taste):\n\nTaste is powered by our meta neuro-symbolic AI model **taste-1** with continuous reinforcement\nlearning (RL). We combine reasoning with neural intuition to create an invisible architecture of\nyour choices, structures, patterns and tooling preferences.\n\nBullets on the same page: \"Meta Neuro-Symbolic AI model taste-1 enforces the invisible logic of\nyour choices\" and \"Reflective Context Engineering of a self-aware RL feedback loop to build\nskills.\" The page embeds an architecture diagram at `/docs/mns.png` whose alt text is\n`meta neuro-symbolic ai model taste-1`.\n\nThe string `taste-1` occurs five times in the shipped bundle, across four locations:\n\n| Location | Line | Kind | \n|---|---|---|\n| FAQ string (twice in one string) | 9371 | marketing copy | \n| `/taste` help text | 64741 | marketing copy | \n| billing text | 64749 | pricing label | \n| TUI status bar | 97801 | UI string literal | \n\nThere is no model ID, routing entry or catalogue record named `taste-1`. The same bundle carries\nabout eighty real model IDs with context windows and provider routing. The runtime occurrence is:\n\n```\ny = Boolean(o && byokProviderId({ model: o })) ? \"\" : \" · taste-1\",\n```\n\nThe badge is appended when you are not using your own API key. Supply your own provider key and it disappears while taste behaves identically.\n\nThe billing text at line 64749 reads: \"Premium requests: Any request that uses a premium model (like taste-1) during your coding session.\" Calling it a premium model is what sets the rate.\n\n`runTasteLearningAgent` (55352), `extractAllSignals` (55392), `compileTasteContext` (55686).\n\n```\ngit show --format= -U3 --diff-algorithm=histogram -b --ignore-blank-lines -M <hash>\n```\n\nCaps recovered from the constants:\n\n| Constant | Value | Meaning | \n|---|---|---|\n| `maxCommits` | 200 | commits cloned and scanned | \n| `Bx` | 50 | maximum signals extracted | \n| `Wx` | 50 | maximum commits with usable diffs | \n| `Hx` | 10 | commit batch size | \n| `Gx` | 5 | diff concurrency | \n| `Vx` | 5 | grouped patterns kept per commit | \n| `zx` | 200 | maximum lines per side of a hunk | \n| `Jx` /`Yx` | 3 / 5 | snippet line budget | \n\nEach surviving hunk goes through `buildSnippet2` (55612), which emits your source verbatim:\n\n```\nSnippet:\n  <context line, indented two spaces>\n→ <changed line, verbatim>\n  <context line, indented two spaces>\n```\n\n`compileTasteContext` concatenates these under two headings, quoted verbatim:\n\n```\n# Dynamic Taste Analysis — Code Change Patterns\n## Correction Diffs — What Wrong→Right Looks Like\n```\n\nIt appends the instruction block quoted [below](#the-git-history-prompt) and posts the result to\n`https://api.commandcode.ai/alpha/generate`.\n\nIt also accepts a GitHub URL or `owner/repo` and will `git clone --depth 200 --single-branch` a\npublic repository to mine it.\n\nThe package ships a sensitive-filename denylist (68900):\n\n```\n.env   .env.*   *.pem   *.key   *.crt   .npmrc   .pypirc   .netrc\nid_rsa   id_rsa.*   id_ed25519   id_ed25519.*   id_ecdsa   id_ecdsa.*\ncredentials   credentials.*\n```\n\n`hasSensitiveBasename()` consumes that list at six call sites:\n\n| Line | Call site | \n|---|---|\n| 17640 | `isGuardedWritePath` , tool write guarding | \n| 17728 | path-safety set | \n| 17773 | path-safety check | \n| 74588 | telemetry file list filter | \n| 74600 | IDE active-file filter | \n| 74606 | IDE file list filter | \n\nThe taste extractor is not among them. The only filter applied while mining diffs is\n`isNoiseFile` (called once, at 55556; list at 77172):\n\n```\npackage-lock.json   pnpm-lock.yaml   yarn.lock   CHANGELOG.*\n.versionbot/   *.min.js   *.min.css   dist/   *.map\n```\n\nThat is a relevance filter, which excludes lockfiles and build output because they make poor style signals. It excludes no secret-bearing filename.\n\nTwo details make this worse than a missing check on the working tree:\n\n1. **Taste reads history, not HEAD.** It runs`git show` across up to 200 commits. A`.env` or\nprivate key that was committed once and deleted later is still inside that range. Removing a\nsecret from the current tree does not remove it from what taste reads.\n2. **`.gitignore` is irrelevant here.** Ignoring a file today does nothing about the commit that\nadded it before it was ignored, which is the common way secrets enter a repository at all.\n\nSo a repository that ever committed a `.env`, `*.pem`, `id_rsa` or `credentials` file will have\nthose hunks extracted verbatim by `buildSnippet2` and uploaded to `api.commandcode.ai` with\neverything else, on a feature that is enabled by default.\n\nThe filter is applied to six paths and missing from the one path that ships historical file contents off the machine.\n\n`createLearner` / `runLearningLoop` (72820 onward), system prompt `mS` at 72872.\n\nYour conversation messages are JSON-serialized and sent to the model:\n\n```\n`Current taste structure:\\n${m}\\n\\n` +\n`Previously analyzed conversation (context only — already processed in earlier passes, ` +\n`do NOT learn from it again):\\n${JSON.stringify(k, null, 2)}\\n\\n` +\n`NEW messages to analyze (learn ONLY from these):\\n${JSON.stringify(C, null, 2)}`\n```\n\n`stripInjectedMetaForLearning` and `stripReasoningPartsForLearning` remove injected metadata and\nreasoning blocks first. The loop runs up to `dS = 20` model turns, with a window of `uS = 20`\nmessages, calling `read_taste_file`, `write_taste_file` and `edit_taste_file` to write results.\n\nThe model reaches this path through the `taste` tool, described to the model at 20801 as:\n\nRecord or update the user's coding preferences and taste. Use this whenever the user states a preference or asks you to remember something.\n\nThe base system prompt instructs the model to call it (73838):\n\n**TO RECORD OR UPDATE A PREFERENCE, USE THE `taste` TOOL**: When the user states a preference or\nasks you to remember/save something (\"prefer X over Y\", \"always do Z\", \"save this to my taste\"),\ncall the `taste` tool with the instruction in the user's words.\n\nThe model decides when your conversation gets mined during a normal session.\n\n`createSessionImporter` (40333), agent table `uC`:\n\n```\n[ { agent: \"claude-code\", find: findClaudeCodeSessions, extract: extractClaudeCodePrompts },\n  { agent: \"codex\",       find: findCodexSessions,      extract: extractCodexPrompts },\n  { agent: \"cursor\",      find: findCursorSessions,     extract: extractCursorPrompts } ]\n```\n\nLocations read from disk:\n\n| Agent | Path | \n|---|---|\n| Claude Code | `~/.claude/projects/<encoded-project-dir>/*.jsonl` | \n| Codex | `~/.codex/sessions/**` rollout files | \n| Cursor | Cursor transcripts directory, `<id>/<id>.jsonl` | \n\n`extractClaudeCodePrompts` pulls every entry with `type === \"user\"` and a string\n`message.content`, which is your prompt text. The same shape applies to the Codex and Cursor\nextractors. The prompts are batched by `splitPromptsIntoLearnBatches` and each batch is sent\nthrough `learn()` to `/alpha/generate`.\n\nThe UI string for this, at 64521, is:\n\nLearn taste from sessions with other coding agents (Claude Code, Cursor, etc)\n\nand at 86541:\n\nLearn from your previous sessions - updates your taste profile\n\nCommand Code reads your saved conversations with competing coding agents and uploads them to its own API.\n\n| Location | Contents | \n|---|---|\n| `.commandcode/taste/taste.md` | project taste, category headings, bullets with confidence scores | \n| `.commandcode/taste/<category>/taste.md` | a category once it exceeds 5 learnings | \n| `~/.commandcode/taste/` | global taste, `-g` flag | \n| `commandcode.ai/<username>/taste` | remote taste packages, `npx taste push` | \n\nRemote package upload is a multipart POST built by `prepareUpload` (56570), with fields `name`,\n`description`, `type`, `isPublic`, `overwrite` and file parts `files[taste.md]` and\n`files[<category>/taste.md]`. Endpoints: `/beta/taste/packages/:namespace` and\n`/alpha/taste/:projectSlug`.\n\nTaste reaches the model through the system prompt rather than the request body. The `taste` field\nin the `/alpha/generate` body is always `null` on the model-client path; the content is injected by\n`renderTasteSection2` into the cached system section instead.\n\n`getTasteLearningSettings` (19650 onward):\n\n``` js\nconst s = n.tasteLearning ?? !0,          // global default: ON\n      i = resolveProjectOverride(r, o),\n      a = i?.value;\nreturn { global: s, project: a, effective: a ?? s };\n```\n\nTaste learning is on unless turned off. Controls:\n\n| Control | Effect | \n|---|---|\n| `/taste` in session, or`cmd taste disable` | toggle taste learning | \n| `tasteLearning: false` in`~/.commandcode/config.json` | global off | \n| project shared or local settings | per-project override | \n| `DO_NOT_TRACK=1` | disables telemetry and fingerprinting, not taste | \n| `CMD_ZDR` | zero data retention header, pauses title generation and taste onboarding | \n\nThe onboarding scan is gated behind `checkOnboardingConditions` and presents a banner with a skip\noption, so the transcript import is offered rather than silent. Taking no action leaves it\nenabled.\n\nLine 55706. `${a}` interpolates  `for <author>` when an author is targeted.\n\n```\n## Instructions for Taste Learning\n\nYou are analyzing code change patterns from a real repository${a}. Based on the correction diffs above, generate deeply personal and opinionated coding taste.\n\n**Critical guidelines:**\n\n1. **Be specific, not generic.** Instead of \"Use TypeScript\", write \"Use branded types for IDs and explicit return types on every function. Prefer `readonly` arrays and objects by default.\"\n\n2. **Extract the WHY from patterns.** If you see verbose names being replaced with concise ones, don't just say \"use short names\" — say \"Prefer concise variable names that derive meaning from context rather than encoding type information.\"\n\n3. **Look for recurring themes.** If multiple substitutions show the same pattern (e.g., nested if→guard clauses), that's a strong taste signal worth capturing.\n\n4. **Make it actionable.** Every taste entry should be specific enough that another developer could follow it and produce code that looks like it belongs in this repository.\n\n5. **Prioritize quality corrections** — these are the purest taste signals (wrong→right pairs with explicit WHY context from commit messages).\n\n6. **Capture anti-patterns too.** If you see code being removed in refactors, note what the developer avoids: \"Never nest deeper than 2 levels — flatten with early returns.\"\n\n7. **Don't repeat generic tool preferences** like \"Use pnpm\" or \"Use TypeScript\" unless the substitutions show something specific about HOW they use those tools.\n\n8. **Prioritize opinionated preferences.** The goal is taste that makes someone's code distinctly theirs — not industry best practices.\n\nWrite the taste entries to the taste.md file using the standard format with confidence scores.\n```\n\nHeader prepended to the diffs, line 55692:\n\n```\n# Dynamic Taste Analysis — Code Change Patterns\n\nRepository: ${n}\n${s}Commits analyzed: ${o}\nSignals extracted: ${t.length}\n\nThis analysis was generated by examining actual code changes (diffs, substitutions, refactoring patterns) rather than static file contents. Every signal below comes from real commits.\n```\n\nLine 72872, used as the `system` parameter.\n\n```\nYou are the taste-learning agent for Command Code. Review the NEW messages and the user's current taste files, then record DURABLE, generalizable preferences the user revealed — coding style, tooling, workflow, and communication preferences — not one-off task details.\n\nLearn ONLY from the NEW messages. The previously analyzed conversation was already mined by earlier passes — it is provided so you can resolve references, never to be re-learned. Do NOT re-record a preference that already exists in the taste files, and do NOT raise or lower an existing learning's confidence unless the NEW messages themselves contain fresh evidence for it. Seeing the same preference again in the previously analyzed context is not evidence.\n\nUse the tools to update taste files. A taste file path MUST be either \"taste.md\" (the root file) or \"{category}/taste.md\" (a single category folder) — never any other name or nesting:\n- write_taste_file to create/replace a file.\n- edit_taste_file to amend an existing file.\n- read_taste_file to inspect a file before editing.\n\nRecord each learning as a markdown bullet ending in a confidence score, e.g.\n  - Prefers tabs over spaces. Confidence: 0.9\nOnly record clear, repeated, or explicitly-stated preferences. Prefer amending existing files over creating near-duplicates. When the new messages reveal nothing durable, make no tool calls and reply \"no changes\".\n```\n\nLine 73841, injected into the system prompt of every session that has taste enabled.\n\n```\n<taste_guidance>\nIMPORTANT - Taste System (Learned Preferences):\n\nWHAT IS TASTE:\nTaste is a system of continuously learned preferences that captures how the user wants code written in this specific project. These preferences are learned automatically from past interactions and corrections, covering areas like:\n- Technology choices (e.g., \"Use TypeScript\", \"Use Commander.js for CLIs\")\n- Code style (e.g., \"Use const instead of let\", \"Use object parameters for functions with 2+ params\")\n- Workflow patterns (e.g., \"Always run tests before committing\")\n- Project-specific conventions\n\nWHERE TASTE IS STORED:\nAll taste preferences are stored in the .commandcode/taste/ directory in the project root:\n- Main file: .commandcode/taste/taste.md - Contains all learnings organized by category headings (# Category Name)\n- Category files: .commandcode/taste/{category}/taste.md - When a category grows beyond 5 learnings, it's moved to its own subdirectory\n\nHOW TASTE IS ORGANIZED:\nThe main taste.md file contains category sections with H1 headings (# Category Name). Each category can be in two states:\n\n1. INLINE (≤5 learnings): Category heading followed by bullet points with learnings\n   Example:\n   # JavaScript\n   - Use const instead of let for non-reassigned variables. Confidence: 0.90\n   - Use object parameters for functions with 2+ params. Confidence: 0.85\n\n2. REFERENCED (>5 learnings): Category heading with a reference link to category file\n   Example:\n   # CLI\n   See [cli/taste.md](./cli/taste.md)\n\nWHY TASTE MATTERS:\nThese preferences represent the user's actual requirements learned from real interactions. When a user corrects you (e.g., \"use TypeScript not JavaScript\", \"use Commander.js for CLIs\"), that correction is captured as taste. Following taste prevents you from making the same mistakes repeatedly and ensures consistency across the project.\n\nHOW TO USE TASTE:\n1. Your learned preferences are provided in the <taste> section below\n2. BEFORE starting ANY work, carefully read the taste content\n3. If you see a category reference like \"See [category/taste.md]\", you MUST use read_file to read .commandcode/taste/{category}/taste.md to get the full preferences\n4. Apply ALL relevant preferences to your work - these are REQUIREMENTS, not suggestions\n5. If working on a specific domain (e.g., CLI, TypeScript, testing), check if there's a category for it and read the full preferences\n6. Taste preferences override general best practices - if taste says \"Use X\", you use X even if you would normally prefer Y\n\nCRITICAL RULES:\n- When you see \"See [cli/taste.md]\" for a CLI task, IMMEDIATELY read .commandcode/taste/cli/taste.md before writing any code\n- NEVER ignore taste preferences - they represent explicit user requirements\n- If a taste preference conflicts with the user's current request, follow the current request (it may be updating the preference)\n- The same applies to any other domain-specific category - ALWAYS read referenced taste files before starting work in that domain\n- **NEVER EDIT OR WRITE TO TASTE FILES**: Do not use edit_file or write_file on any files in .commandcode/taste/ or ~/.commandcode/taste/. These files are managed automatically by the learning system. You can READ them, but never modify them.\n</taste_guidance>\n```\n\nLine 35886, populated, and 35887, empty.\n\n```\n<taste>\nBelow is the complete content of the .commandcode/taste/taste.md file.\nThis shows you what preferences are available and which categories might have additional details in separate files.\nIf you see references like \"See [category/taste.md]\", you MUST read that file using read_file to get the full preferences.\n\n--- Content of .commandcode/taste/taste.md ---\n\n${t}\n\n--- End of .commandcode/taste/taste.md ---\n</taste>\n<taste>\nNo preferences learned yet for this project. The .commandcode/taste/taste.md file is empty or doesn't exist yet. Preferences will be learned automatically as you work.\n</taste>\n```\n\nLine 20801, with its one parameter at 20808.\n\n```\nRecord or update the user's coding preferences and taste. Use this whenever the user states a preference or asks you to remember something.\nThe preference or taste change to record, in the user's words.\n```\n\nLine 64741, the text behind `/taste`.\n\n```\nTaste is powered by the meta neuro-symbolic AI model taste-1 with continuous reinforcement learning (RL). It combines reasoning with neural intuition to learn your coding preferences.\n\nHow taste works:\n- Learns from you — every accept, reject, and edit becomes a signal\n- Thinks like you — learns patterns and micro-decisions you'd never document\n- Grows with you — continuous learning loop that never goes stale\n\nEnable taste: Use /taste in a session or run npx taste from the command line.\n\nTaste packages (three types):\n- Project: Stored in .commandcode/taste/ — learnings unique to this codebase\n- Global: Stored in ~/.commandcode/taste/ — personal taste across all projects (use -g flag)\n- Remote: Stored at commandcode.ai/username/taste — team sharing, backup, sync across machines\n\nPrivacy: Taste processing runs on your codebase and stores learning data locally only.\n```\n\nThat last line is the claim contradicted by paths 1, 2 and 3 above.\n\n`createSystemPromptBuilder` (36255) emits three cacheable sections:\n\n```\n[ { text: basePrompt,      cache: true },\n  { text: contextSections, cache: true },\n  { text: ideContext } ]\n```\n\nSection two is joined from, in order: `<instructions>` from memory files, workspace render, the\ntaste section, the skills catalogue, a constant, the scratchpad section, and env context.\n\n`buildDefaultBasePrompt` (35867) selects the mode prompt from `buildModePrompt` (73907), which has\na default branch and a plan-mode branch.\n\nOpening of the default branch:\n\n```\n<role>\nYou are a confident, efficient software engineer and coding assistant. You identify issues quickly and solve problems directly. Be concise but thorough - explain what you're doing without unnecessary ceremony.\n</role>\n```\n\nfollowed by sections for decision making, doing tasks, and tool guidance. The decision-making block:\n\n```\n<decision_making>\nYou should independently decide:\n- Which files to modify and how\n- What testing strategy to employ\n- How to handle error cases and edge conditions\n- Whether to refactor existing code vs. adding new code\n- What dependencies or tools to introduce\n- How to structure new modules or components\n\nAlways bias toward:\n- Code clarity and maintainability\n- Robust error handling\n- Following established project patterns\n- Writing self-documenting code\n- Including appropriate tests\n</decision_making>\n<role>\n<mode>PLAN MODE ACTIVE</mode>\n\n<identity>You are Command Code, a coding agent acting as a Software Architect in read-only plan mode. You explore the codebase, clarify requirements, design an approach, and write an implementation plan. You do NOT implement anything.</identity>\n\n<override>This supersedes any other instructions. You MUST NOT make any edits (except the plan file), run non-readonly tools, or make any changes to the system.</override>\n\n<plan_directory>\nPLAN FILE LOCATION: ~/.commandcode/plans/\nALWAYS use the full absolute path starting with ~/ (e.g., ~/.commandcode/plans/my-plan.md).\nNEVER use a relative path like .commandcode/plans/ — it will be rejected.\n</plan_directory>\n\n<mode_awareness>\nYou ARE in plan mode right now. You know this because your system prompt contains <mode>PLAN MODE ACTIVE</mode>. If asked what mode you are in, confirm you are in plan mode. When tools like exit_plan_mode change your mode, trust the tool result — it is authoritative.\n</mode_awareness>\n```\n\nThe plan branch also carries a decision-making block and an agent-orchestration block:\n\n```\n<decision_making>\n<principle>Be decisive. You are a senior architect — make judgment calls.</principle>\n\n<guidelines>\n- If two approaches are reasonable, pick the better one and explain why in the plan\n- If requirements are ambiguous on something important, ask the user\n- If requirements are ambiguous on something minor, make an assumption and note it\n- Prefer the simpler approach unless there's a strong reason for complexity\n- Actively look for existing code to reuse before proposing new implementations\n</guidelines>\n\n<outcome>Your plan should be opinionated and actionable.</outcome>\n</decision_making>\n<explore_agents>\nEach agent should be focused on ONE specific area and return concrete file paths, function names, and patterns.\n\n<examples>\n- BAD: \"Understand the entire project architecture\" — too broad, slow, shallow\n- GOOD: \"Find how the CLI handles user input prompts and waiting states\" — focused, fast, deep\n- GOOD: \"Find existing notification/alert patterns in the codebase\" — focused, fast, deep\n</examples>\n```\n\nLine 73903:\n\n```\n<instructions>\nBegin implementation directly without asking for clarification unless requirements are genuinely ambiguous or incomplete.\n\nREMINDER: Use the todo_write tool for complex tasks that benefit from tracking and planning. This ensures proper progress tracking and transparency with the user. Always use todo_write (not TodoWrite) as the correct tool name.\n</instructions>\n```\n\nLine 71966:\n\n```\nYou compress a Command Code conversation into a handoff brief so a fresh assistant can pick up the work without rereading the original transcript.\n```\n\n38 built-in tools. `builtinTools` at 71076; several are registered through `deferred(...)`, which\nsupplies a one-line description and fetches the full schema on demand.\n\n| Group | Tools | \n|---|---|\n| Files | `read_file` ,`write_file` ,`edit_file` ,`read_directory` ,`glob` ,`grep` | \n| Shell | `shell_command` ,`run_command` ,`powershell` ,`shell_output` ,`shell_tasks` ,`kill_shell` | \n| Agents | `agent` ,`task` ,`agent_output` ,`task_create` ,`task_update` ,`task_list` ,`task_get` ,`task_stop` ,`task_output` | \n| Planning | `todo_write` ,`exit_plan_mode` ,`plan_review` | \n| Web | `web_search` ,`web_fetch` (server-side, metered) | \n| Skills | `activate_skill` ,`search_tools` /`tool_search` | \n| Taste | `taste` ,`read_taste_file` ,`write_taste_file` ,`edit_taste_file` | \n| Other | `vision` ,`ask_user_question` ,`monitor_command` ,`monitor_events` ,`schedule_wakeup` ,`cron_create` ,`cron_delete` | \n\nTools serialize as `{name, description, input_schema}`. `tool_search` is renamed to `search_tools`\nin transit by `toWireToolName` (37569). `defangMonitorOutput` wraps monitor output in an\n`UNTRUSTED_MONITOR_OUTPUT` marker. Writes into the taste directory are denied by `isTasteDirWrite`.\n\nSeven Agent Skills ship as markdown under `dist/bundled/`: `agent-browser`,\n`command-code-knowledge`, `config`, `design`, `loop`, `mod-builder`, `skill-builder`.\n\n`resolveApiBaseUrl` (2632), table at 62528.\n\n| Env | URL | \n|---|---|\n| prod | `https://api.commandcode.ai` | \n| staging | `https://staging-api.commandcode.ai` | \n| local | `http://localhost:9090` | \n\nSelection: `--local` / `--staging` argv, then `COMMANDCODE_API_ENV`, else prod.\n`COMMANDCODE_API_URL` overrides everything **only** when `COMMANDCODE_SANDBOX=true`, which is the\nsupported way to point the client at your own server.\n\nOne opaque bearer token with a `user_` prefix, in `~/.commandcode/auth.json`, mode 0600. The token\ncarries no expiry and the client performs no refresh, request signing or proof of work. Validated\nagainst `GET /alpha/whoami`.\n\nConstants at 72706.\n\n| Header | Required | \n|---|---|\n| `Authorization: Bearer user_…` | yes | \n| `Content-Type: application/json` | yes | \n| `x-command-code-version` | **yes on `/alpha/generate`** | \n| `x-cli-environment` ,`x-session-id` ,`x-project-slug` ,`x-taste-learning` ,`x-oss-primary-provider` ,`traceparent` ,`User-Agent` | no | \n| `x-cmd-zdr: 1` when`CMD_ZDR` is set | no | \n| `x-cmd-provider-deepseek-internal: 1` when`CMD_PROVIDER_DEEPSEEK_INTERNAL=1` | no | \n| `x-oauth-token` /`x-oauth-provider` | no | \n\nOmitting `x-command-code-version`, or sending an unparseable value, returns\n`403 \"Your Command Code CLI is out of date.\"` Tested live: `1.58.0`, `1.57.0`, `1.0.0` and\n`99.0.0` all pass, `garbage` and absence both fail. The gate checks that the header is present and\nversion-shaped, not that it is recent.\n\n| Endpoint | Purpose | \n|---|---|\n| `/alpha/whoami` | validate key, identity | \n| `/alpha/generate` | inference, streaming | \n| `/alpha/agent/generate` | sub-agent generation | \n| `/alpha/learn` | taste learning | \n| `/alpha/taste/:projectSlug` (+`/update` ) | remote taste | \n| `/beta/taste/packages/…` | taste package registry | \n| `/alpha/web-search` ,`/alpha/web-fetch` | server-side tools, metered | \n| `/alpha/billing/credits` ,`/alpha/billing/subscriptions` ,`/alpha/usage/summary` | billing | \n| `/alpha/fingerprint/record` | machine fingerprint | \n| `/alpha/lifecycle-events` | telemetry | \n| `/alpha/sandbox/start` ,`/alpha/sandbox/stream` | remote sandbox | \n| `/alpha/share/{create,append,delete}` | session sharing | \n\nBuilt at 37946. Every `config` field is required; the server returns full zod paths on a bad body.\n\n```\n{\n  \"config\": {\n    \"workingDir\": \"/abs/path\", \"date\": \"2026-09-19\", \"environment\": \"cli\",\n    \"structure\": [], \"isGitRepo\": false,\n    \"currentBranch\": \"\", \"mainBranch\": \"\", \"gitStatus\": \"\", \"recentCommits\": []\n  },\n  \"memory\": null, \"taste\": null, \"skills\": null,\n  \"permissionMode\": \"standard\",            // standard | auto-accept | plan\n  \"threadId\": \"<uuid, optional>\",\n  \"mode\": \"agent\",                         // optional, enum-validated when present:\n                                           // agent|learning|custom-agent|custom-agent-create\n                                           // |title-gen|tool-desc|compact|vision\n  \"promptCache\": true,\n  \"params\": {\n    \"model\": \"deepseek/deepseek-v4-pro\",\n    \"messages\": [ /* Vercel AI SDK ModelMessage */ ],\n    \"tools\":   [ { \"name\", \"description\", \"input_schema\" } ],   // Anthropic shape\n    \"system\":  [ { \"type\":\"text\", \"text\":\"…\",\n                   \"cache_control\": {\"type\":\"ephemeral\"} } ],   // Anthropic blocks\n    \"max_tokens\": 64000, \"stream\": true,\n    \"temperature\": 0.0,                    // optional\n    \"reasoning_effort\": \"high\"             // optional\n  }\n}\n```\n\nThe dialect is mixed: `messages` follow the Vercel AI SDK, while `tools` and `system` follow\nAnthropic. `toWireMessages` (37572) maps `tool_use` to `{type:\"tool-call\", toolCallId, toolName, input}`, `tool_result` into a separate `role:\"tool\"` message, `thinking` to `reasoning`, and images\nto `data:` URLs.\n\nNDJSON, one JSON object per line, with no `data:` prefix and no `[DONE]` terminator. Consumed by\n`consumeStream` (37731).\n\n| `type` | Payload | \n|---|---|\n| `text-delta` | `{text}` | \n| `reasoning-start` /`reasoning-delta` /`reasoning-end` | `{text}` on delta | \n| `tool-call` | `{toolCallId, toolName, input, providerExecuted?}` | \n| `tool-result` | `{toolCallId, toolName, output, isError?}` | \n| `provider-metadata` | `{providerMetadata:{anthropic:{usage:{cache_creation:…}}}}` | \n| `finish` | `{finishReason, rawFinishReason, totalUsage:{…}, systemPromptTokens}` | \n| `error` | `{error: string \\| {message, statusCode, isRetryable}}` | \n| `abort` | none | \n\nA stream that ends with no `finish` event is treated as truncated and raises a retryable 502.\n`rawFinishReason === \"pause_turn\"` makes the client re-issue and continue.\n\nAbout eighty models, all routed through `/alpha/generate`. Upstream routing shows in ID prefixes\nsuch as `baseten:`, `novita:`, `anthropic:` and `openai:`. The service resells Baseten, Novita and\nfirst-party APIs.\n\n| Family | Examples | \n|---|---|\n| DeepSeek | `deepseek/deepseek-v4-pro` ,`-v4-flash` ,`-v4-flash-fast` ,`-v4-flash-vision-exp` ,`-v4.1-flash` | \n| Moonshot | `moonshotai/Kimi-K3` ,`Kimi-K2.7-Code` ,`-Code-Highspeed` ,`Kimi-K2.6` ,`Kimi-K2.5` | \n| Z.ai | `zai-org/GLM-5.3` ,`GLM-5.2` ,`GLM-5.2-Fast` ,`GLM-5.1` ,`GLM-5` | \n| MiniMax | `MiniMaxAI/MiniMax-M3` ,`-M2.7` ,`-M2.5` | \n| Qwen | `Qwen/Qwen3.8-Max` ,`3.8-Flash` ,`3.8-27B` ,`3.8-Omni-Flash` ,`3.7-*` ,`3.6-*` | \n| OpenAI | `gpt-6-astra` ,`gpt-5.6-{luna,sol,terra}` ,`gpt-5.5` ,`gpt-5.4` ,`gpt-5.3-codex` | \n| Anthropic | `claude-opus-5` ,`claude-sonnet-5` ,`claude-fable-5` ,`claude-opus-4-8/4-7/4-6` ,`claude-haiku-4-5` | \n|  | `google/gemini-3.8-flash` down to`gemini-3.1-flash-lite` | \n| xAI | `xai/grok-4.6` ,`grok-4.5` | \n| Other | `meta/muse-spark-1.*` ,`tencent/Hy3` ,`stepfun/Step-3.7-Flash` ,`xiaomi/mimo-v2.5` ,`nvidia/nemotron-3-ultra-550b-a55b` ,`sakana/fugu-ultra` ,`thinkingmachines/inkling` ,`meituan/LongCat-2.0` ,`poolside/laguna-s-2.1` | \n\nEight models carry `badge: \"free\"`, most with `hidden: true`. All of them return\n`403 \"the free … tier has been retired\"` when called.\n\nBackground requests billed to the user, on fixed models (63536):\n\n| Feature | Model | \n|---|---|\n| title generation | `deepseek/deepseek-v4-flash` | \n| compaction | `deepseek/deepseek-v4.1-flash` | \n| tool descriptions | `deepseek/deepseek-v4-flash` | \n| taste onboarding | `deepseek/deepseek-v4-flash` | \n| branch summarization | `deepseek/deepseek-v4-pro` | \n| vision | `xiaomi/mimo-v2.5` | \n\n`applyPremiumCreditsFallback` silently switches to `moonshotai/Kimi-K2.5` when premium requests run\nout, with the message \"Auto switched model to Kimi K2. Plan Premium requests used.\"\n\n`gatherRawSignals` / `buildMachineFingerprint` / `recordCliFingerprint` (44694 to 44836). Runs once\nper process in the background, `POST /alpha/fingerprint/record`, only when an auth key exists.\n\nSalted SHA-256 of: `/etc/machine-id` or `/var/lib/dbus/machine-id`, every MAC address, OS username,\nhostname, and **git email**.\n\nPlaintext: `platform`, `arch`, `osRelease`, `cpuModel`, `cpuCount`, `memGiB`, `isContainer`,\n`timezone`.\n\nA stable `thumbmark` derives from machine ID plus sorted MACs, falling back to hostname plus CPU\nmodel.\n\nThe salt is a constant shipped in the package:\n\n``` js\nFb = \"command-code:device-fingerprint:v1\"\n\nfunction hashSignal(e) {\n  const t = e.trim();\n  if (t) return E(\"sha256\").update(Fb).update(\"\\0\").update(t.toLowerCase()).digest(\"hex\");\n}\n```\n\nBecause the salt is published, testing a candidate value against an observed hash costs one sha256 call. A git email is guessable and a MAC address space is enumerable, so the hashing pseudonymizes these values against a casual reader rather than against anyone holding the package.\n\nDisable with `DO_NOT_TRACK=1` or `\"telemetry\": false` in `~/.commandcode/config.json`.\n\nThe published package also hardcodes (62785) three Axiom ingest tokens for the\n`command_code_cli_tracing` dataset at `https://api.axiom.co/v1/traces`, and an OTLP token for\n`https://ingestion.claicode.com/v1/inference-events`. A redaction list strips `apikey`, `api_key`,\n`token`, `secret` and `authorization` from span attributes. The token values are in the public\npackage and are deliberately not reproduced here.\n\n`~/.commandcode/`:\n\n| File | Mode | Contents | \n|---|---|---|\n| `auth.json` | 0600 | vendor `user_` API key and user ID | \n| `credentials.json` | 0600 | BYOK provider keys and OAuth tokens | \n| `providers.json` | 0644 | custom provider declarations | \n| `config.json` |  | global config, `telemetry` ,`tasteLearning` | \n| `settings.json` ,`settings.local.json` |  | settings and hooks | \n| `mcp.json` ,`projects/*/mcp.json` |  | MCP servers | \n| `keybindings.json` |  | key rebinding | \n| `plans/` ,`skills/` ,`taste/` |  | plan output, user skills, global taste | \n| `telemetry-install-id` |  | install UUID | \n\n`providers.json` accepts an arbitrary `baseURL` in three dialects, `openai-completions` (default),\n`openai-responses` and `anthropic-messages`, so the whole CLI runs against any endpoint with no\npatching:\n\n```\n{ \"provider\": { \"mine\": {\n    \"api\": \"openai-completions\",\n    \"baseURL\": \"http://localhost:8080/v1\",\n    \"apiKey\": \"$MY_KEY\",\n    \"models\": { \"some-model\": { \"contextWindow\": 200000 } } } } }\n```\n\nThe parser rejects literal secrets in `providers.json` and accepts only `\"$ENV_VAR\"`,\n`\"{env:VAR}\"` or `\"!command\"` references. `npm:` provider packages are not loaded.\n\n```\nnpm pack command-code@1.58.0\n\n# confirm the same bytes\ncurl -s https://unpkg.com/command-code@1.58.0/dist/cli.mjs | shasum -a 256\n# aab2bec800371953112d18472bb7383992ef264cca22558bdcda77e7d0dc0f14\n\n# make it readable: minified, not obfuscated, and esbuild --keep-names is on,\n# so every function is wrapped in __name(fn,\"originalName\")\nnpx prettier --parser babel cli.mjs > cli.pretty.mjs    # 115,067 lines\n```\n\nGreps that land on the claims above:\n\n```\ngrep -n 'taste-1' cli.pretty.mjs                          # 4 locations, 0 model ids\ngrep -n 'runTasteLearningAgent' cli.pretty.mjs            # git history path\ngrep -n 'Instructions for Taste Learning' cli.pretty.mjs  # the mining prompt\ngrep -n 'taste-learning agent for Command Code' cli.pretty.mjs  # conversation path\ngrep -n 'findClaudeCodeSessions\\|findCodexSessions\\|findCursorSessions' cli.pretty.mjs\ngrep -n 'hasSensitiveBasename' cli.pretty.mjs             # 6 sites, none in taste\ngrep -n 'isNoiseFile' cli.pretty.mjs                      # the only taste filter\ngrep -n 'tasteLearning ?? !0' cli.pretty.mjs              # default on\ngrep -n 'buildMachineFingerprint' cli.pretty.mjs\n```\n\nQuotations from vendor material are reproduced for identification and commentary. Archive links are given so the originals can be read in full.\n\nThis documents what the package does. Whether the gap between the marketing and the implementation is deliberate is not something a bundle read can establish, so this sticks to what the code shows.\n\nCorrections welcome. Anything here that a counter-grep contradicts gets fixed.\n\nShorter writeup focused on `taste-1` alone:\n[https://gist.github.com/safzanpirani/5bd7a77ce304edb16f768982bb26bcc0](https://gist.github.com/safzanpirani/5bd7a77ce304edb16f768982bb26bcc0)", "url": "https://wpnews.pro/news/command-code-1-58-0-taken-apart-the-taste-subsystem-end-to-end-every-system-wire", "canonical_source": "https://gist.github.com/safzanpirani/26170636512c0b50494d6a70acfece8d", "published_at": "2026-09-19 11:25:41+00:00", "updated_at": "2026-09-19 18:24:30.067692+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "large-language-models", "ai-products"], "entities": ["command-code", "taste-1", "npm", "Claude Code", "Codex", "Cursor", "commandcode.ai"], "alternates": {"html": "https://wpnews.pro/news/command-code-1-58-0-taken-apart-the-taste-subsystem-end-to-end-every-system-wire", "markdown": "https://wpnews.pro/news/command-code-1-58-0-taken-apart-the-taste-subsystem-end-to-end-every-system-wire.md", "text": "https://wpnews.pro/news/command-code-1-58-0-taken-apart-the-taste-subsystem-end-to-end-every-system-wire.txt", "jsonld": "https://wpnews.pro/news/command-code-1-58-0-taken-apart-the-taste-subsystem-end-to-end-every-system-wire.jsonld"}}