0sec-cli 0.24.1 → 0.26.0

package/chunks/{chunk-IJ6UPW3H.js → chunk-HS2NQ7K6.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   isAdmittedSmolvmWorkbench
-} from "./chunk-PVJUPIQG.js";
+} from "./chunk-XOVYV7TT.js";
 import {
   MESSAGE_CACHE_BREAKPOINTS,
   planMessageBreakpoints,
@@ -13,7 +13,80 @@ import {
 } from "./chunk-RS4MAN3Q.js";
 import {
   VERSION
-} from "./chunk-GXXX7AGH.js";
+} from "./chunk-GYEYTNHK.js";
+
+// packages/core/dist/runtime/siwc-connection.js
+function captureSiwcConnection(connection) {
+  if (!connection.accountId || !connection.clientId || connection.clientId === "dynamic_agent_client" || !connection.hostId || typeof connection.resolveCredentials !== "function") {
+    throw new Error("ChatGPT plan requires a verified account, issued client ID and stable host ID");
+  }
+  return Object.freeze({ accountId: connection.accountId, clientId: connection.clientId, hostId: connection.hostId, resolveCredentials: connection.resolveCredentials });
+}
+async function abortable(pending, signal) {
+  if (!signal)
+    return pending;
+  signal.throwIfAborted();
+  return new Promise((resolve, reject) => {
+    const abort = () => reject(signal.reason ?? new Error("ChatGPT plan request cancelled"));
+    signal.addEventListener("abort", abort, { once: true });
+    pending.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+    if (signal.aborted)
+      abort();
+  });
+}
+async function siwcHeaders(connection, signal) {
+  signal?.throwIfAborted();
+  const credentials = await abortable(connection.resolveCredentials(signal), signal);
+  signal?.throwIfAborted();
+  if (typeof credentials.accessToken !== "string" || !credentials.accessToken || credentials.accessToken.length > 65536 || /[\s\x00-\x1f\x7f]/.test(credentials.accessToken) || !Array.isArray(credentials.scopes) || !["resource.invoke", "chatgpt.tokens.use.direct"].every((scope) => credentials.scopes.includes(scope))) {
+    throw new Error("ChatGPT plan permission is not enabled; authorize plan usage for this account");
+  }
+  return { Authorization: `Bearer ${credentials.accessToken}`, "Content-Type": "application/json" };
+}
+async function listSiwcModels(connection, fetchImpl = fetch, signal) {
+  const response = await fetchImpl("https://api.openai.com/v1/models", { headers: await siwcHeaders(captureSiwcConnection(connection), signal), signal, redirect: "error" });
+  if (!response.ok)
+    throw new Error(`ChatGPT plan model discovery failed (HTTP ${response.status})`);
+  const data = await response.json();
+  if (!data || typeof data !== "object" || !("models" in data) || !Array.isArray(data.models))
+    throw new Error("Invalid ChatGPT plan model catalog");
+  return data.models.filter((model) => !!model && typeof model === "object" && model.visibility === "list" && typeof model.slug === "string" && !!model.slug && typeof model.display_name === "string").map(({ slug, display_name }) => ({ slug, display_name }));
+}
+
+// packages/core/dist/runtime/request-admission.js
+var LOCAL_ADMISSION_LIMIT = "LOCAL_REQUEST_ADMISSION_LIMIT:";
+var LOCAL_ADMISSION_UNAVAILABLE = "LOCAL_REQUEST_ADMISSION_UNAVAILABLE:";
+function parseRequestAdmission(catalog, model) {
+  const data = catalog?.data;
+  const row = Array.isArray(data) ? data.find((r) => r?.id === model) : void 0;
+  const c = row?.request_admission;
+  const integer = (n) => Number.isSafeInteger(n) && Number(n) >= 0;
+  if (!c || c.schema !== "0-inference-request-admission-v1" || c.counting !== "utf8_json_body_plus_framing" || !integer(c.max_body_bytes) || c.max_body_bytes < 1 || !(c.max_serialized_input_bytes === null || integer(c.max_serialized_input_bytes) && c.max_serialized_input_bytes > 0) || !integer(c.framing?.base_bytes) || !integer(c.framing?.per_message_bytes) || !integer(c.framing?.per_tool_bytes)) {
+    throw new Error("Gateway request admission contract is missing or invalid; no inference request sent");
+  }
+  return {
+    maxBodyBytes: c.max_body_bytes,
+    maxSerializedInputBytes: c.max_serialized_input_bytes,
+    baseBytes: c.framing.base_bytes,
+    perMessageBytes: c.framing.per_message_bytes,
+    perToolBytes: c.framing.per_tool_bytes
+  };
+}
+function assertRequestAdmission(body, contract) {
+  const value = JSON.parse(body);
+  const messages = value.messages ?? value.input;
+  const bytes = Buffer.byteLength(body, "utf8");
+  const inputBytes = bytes + contract.baseBytes + contract.perMessageBytes * (Array.isArray(messages) ? messages.length : 1) + contract.perToolBytes * (Array.isArray(value.tools) ? value.tools.length : 0);
+  if (bytes > contract.maxBodyBytes || contract.maxSerializedInputBytes !== null && inputBytes > contract.maxSerializedInputBytes) {
+    throw new Error(`${LOCAL_ADMISSION_LIMIT} body=${bytes}, input=${inputBytes}; exceeds gateway byte limit before dispatch`);
+  }
+}
+function isLocalAdmissionLimit(error) {
+  return error?.startsWith(LOCAL_ADMISSION_LIMIT) === true;
+}
+function isLocalAdmissionFailure(error) {
+  return isLocalAdmissionLimit(error) || error?.startsWith(LOCAL_ADMISSION_UNAVAILABLE) === true;
+}
 
 // packages/core/dist/agent/feature-presets.js
 var FP_MOAT_FLAGS = [
@@ -115,7 +188,7 @@ var features = {
   },
   /** Allow the agent to search the web for CVE details, docs, and technique references */
   get webSearch() {
-    return env("ZERO_FEATURE_WEB_SEARCH", false);
+    return env("ZERO_FEATURE_WEB_SEARCH", true);
   },
   /** Interactive PTY sessions for exploits requiring interactivity (reverse shells, DB clients, SSH) */
   get ptySession() {
@@ -1238,6 +1311,31 @@ function shouldRetryNativeStream(result) {
     return false;
   return true;
 }
+var RESPONSES_TERMINAL_FAILURE_MARKER = "Responses terminal failure ";
+function isPolicyRefusalResult(result) {
+  if (result.stopReason !== "error" || result.cancelled)
+    return false;
+  const error = result.error ?? "";
+  const at = error.indexOf(RESPONSES_TERMINAL_FAILURE_MARKER);
+  if (at < 0)
+    return false;
+  try {
+    const failure = JSON.parse(error.slice(at + RESPONSES_TERMINAL_FAILURE_MARKER.length));
+    return typeof failure.code === "string" && failure.code.length > 0 && /_policy$/.test(failure.code);
+  } catch {
+    return false;
+  }
+}
+function mergeRuntimeUsage(a, b) {
+  const cached = (a?.cachedInputTokens ?? 0) + (b?.cachedInputTokens ?? 0);
+  const cacheWrites = (a?.cacheWriteTokens ?? 0) + (b?.cacheWriteTokens ?? 0);
+  return {
+    inputTokens: (a?.inputTokens ?? 0) + (b?.inputTokens ?? 0),
+    outputTokens: (a?.outputTokens ?? 0) + (b?.outputTokens ?? 0),
+    ...cached > 0 ? { cachedInputTokens: cached } : {},
+    ...cacheWrites > 0 ? { cacheWriteTokens: cacheWrites } : {}
+  };
+}
 function isRetryableTransportCode(code) {
   return [
     "EAI_AGAIN",
@@ -1474,6 +1572,9 @@ async function logProviderStartup(provider, providerLabel, baseUrl, model, wireA
 var DEFAULT_ANTHROPIC_MODEL = "claude-sonnet-4-6";
 var DEFAULT_OPENROUTER_MODEL = "anthropic/claude-sonnet-4.6";
 var FREE_OPENROUTER_MODEL = "nvidia/nemotron-3-super-120b-a12b:free";
+function openrouterModelId(model) {
+  return model.replace(/^openrouter\//i, "");
+}
 var DEFAULT_OPENAI_MODEL = "gpt-4o";
 var DEEPSEEK_DEFAULT_BASE_URL = "https://api.deepseek.com";
 var DEEPSEEK_DEFAULT_MODEL = "deepseek-flash";
@@ -1924,15 +2025,20 @@ async function refreshChatGptCodexAuthState(state) {
   return { accessToken: state.accessToken, accountId: state.accountId };
 }
 var geminiCodeAssistAuthStates = /* @__PURE__ */ new Map();
-function geminiAuthStateKey(refreshToken, accessToken) {
-  return JSON.stringify([refreshToken, refreshToken ? void 0 : accessToken]);
+function geminiAuthStateKey(refreshToken, accessToken, oauthClient) {
+  return JSON.stringify([refreshToken, refreshToken ? void 0 : accessToken, oauthClient]);
 }
 function readGeminiCodeAssistEnv(env2 = process.env) {
   const access = env2["ZERO_GEMINI_ACCESS_TOKEN"];
   const refresh = env2["ZERO_GEMINI_OAUTH_REFRESH_TOKEN"];
   if ((!access || access.length === 0) && (!refresh || refresh.length === 0))
     return void 0;
+  const clientId = env2["ZERO_GEMINI_OAUTH_CLIENT_ID"]?.trim();
+  const clientSecret = env2["ZERO_GEMINI_OAUTH_CLIENT_SECRET"]?.trim();
+  if (!clientId && clientSecret)
+    throw new Error("Google OAuth client secret requires its matching client ID");
   return {
+    ...clientId ? { oauthClient: { clientId, ...clientSecret ? { clientSecret } : {} } } : {},
     accessToken: access && access.length > 0 ? access : void 0,
     refreshToken: refresh && refresh.length > 0 ? refresh : void 0
   };
@@ -1942,11 +2048,12 @@ function resolveGeminiCodeAssistAuthState(env2) {
   if (!tokens) {
     throw new Error("Google Gemini Code Assist auth: neither ZERO_GEMINI_ACCESS_TOKEN nor ZERO_GEMINI_OAUTH_REFRESH_TOKEN is set. Sign in with your Google account (0 connect) or forward a fresh access token.");
   }
-  const key = geminiAuthStateKey(tokens.refreshToken ?? "", tokens.accessToken);
+  const key = geminiAuthStateKey(tokens.refreshToken ?? "", tokens.accessToken, tokens.oauthClient);
   const existing = geminiCodeAssistAuthStates.get(key);
   if (existing)
     return existing;
   const state = {
+    oauthClient: tokens.oauthClient,
     refreshToken: tokens.refreshToken ?? "",
     accessToken: tokens.accessToken,
     // A forwarded access token with no `exp` we can read: treat as immediately
@@ -1956,15 +2063,15 @@ function resolveGeminiCodeAssistAuthState(env2) {
   geminiCodeAssistAuthStates.set(key, state);
   return state;
 }
-async function refreshGoogleAccessToken(refreshToken) {
+async function refreshGoogleAccessToken(refreshToken, oauthClient) {
   const res = await fetch(GEMINI_OAUTH_TOKEN_URL, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({
       grant_type: "refresh_token",
       refresh_token: refreshToken,
-      client_id: GEMINI_OAUTH_CLIENT_ID,
-      client_secret: GEMINI_OAUTH_CLIENT_SECRET
+      client_id: oauthClient?.clientId ?? GEMINI_OAUTH_CLIENT_ID,
+      ...(oauthClient ? oauthClient.clientSecret : GEMINI_OAUTH_CLIENT_SECRET) ? { client_secret: oauthClient ? oauthClient.clientSecret : GEMINI_OAUTH_CLIENT_SECRET } : {}
     }).toString()
   });
   const bodyText = await res.text().catch(() => "");
@@ -1975,7 +2082,7 @@ async function refreshGoogleAccessToken(refreshToken) {
     parsed = {};
   }
   if (!res.ok) {
-    const err = new Error(`Google token refresh failed: ${res.status} ${bodyText.slice(0, 200)}`);
+    const err = new Error(`Google token refresh failed (HTTP ${res.status}${parsed.error === "invalid_grant" ? ": invalid_grant; reconnect this account" : ""})`);
     err.invalidGrant = parsed.error === "invalid_grant";
     throw err;
   }
@@ -1994,7 +2101,7 @@ async function refreshGeminiCodeAssistAuthState(state) {
       const usedRefresh = state.refreshToken;
       state.inflightRefresh = (async () => {
         try {
-          const tokens = await refreshGoogleAccessToken(usedRefresh);
+          const tokens = await refreshGoogleAccessToken(usedRefresh, state.oauthClient);
           if (!tokens.access_token)
             throw new Error("Google token refresh returned no access_token.");
           state.accessToken = tokens.access_token;
@@ -2005,7 +2112,7 @@ async function refreshGeminiCodeAssistAuthState(state) {
           if (err.invalidGrant) {
             state.accessToken = void 0;
             state.accessTokenExpiresAt = 0;
-            geminiCodeAssistAuthStates.delete(geminiAuthStateKey(state.refreshToken, state.accessToken));
+            geminiCodeAssistAuthStates.delete(geminiAuthStateKey(state.refreshToken, state.accessToken, state.oauthClient));
           }
           throw err;
         } finally {
@@ -2206,6 +2313,7 @@ var DEFAULT_PROVIDER_MODELS = {
   openai: DEFAULT_OPENAI_MODEL,
   azure: void 0,
   deepseek: DEEPSEEK_DEFAULT_MODEL,
+  "chatgpt-plan": void 0,
   "chatgpt-codex": CODEX_DEFAULT_MODEL,
   "z-ai": ZAI_DEFAULT_MODEL,
   kimi: KIMI_DEFAULT_MODEL,
@@ -2253,7 +2361,7 @@ function detectProvider(configApiKey, preferredModel, env2, configProvider) {
       throw new Error(`${source} is unsupported: ${pinnedProviderRaw}`);
     }
     const provider = pinnedProviderRaw;
-    const model = preferredModel ?? env2["ZERO_MODEL"] ?? (provider === "azure" ? env2.AZURE_OPENAI_MODEL ?? parseCodexAzureConfig(env2).model : void 0) ?? (configProvider !== void 0 ? DEFAULT_PROVIDER_MODELS[provider] : void 0);
+    const model = preferredModel ?? env2["ZERO_MODEL"] ?? (provider === "azure" ? env2.AZURE_OPENAI_MODEL ?? parseCodexAzureConfig(env2).model : provider === "openai" ? env2.OPENAI_MODEL : void 0) ?? (configProvider !== void 0 ? DEFAULT_PROVIDER_MODELS[provider] : void 0);
     if (model === void 0 || model === "") {
       if (provider === "azure")
         throw new Error("Choose an Azure deployment model in Connections to finish setup.");
@@ -2291,7 +2399,7 @@ function detectProvider(configApiKey, preferredModel, env2, configProvider) {
       provider: "openai",
       apiKey: configApiKey,
       baseUrl: "https://api.openai.com/v1",
-      defaultModel: DEFAULT_OPENAI_MODEL,
+      defaultModel: env2.OPENAI_MODEL ?? DEFAULT_OPENAI_MODEL,
       wireApi: openAICompatibleWireApi(env2, "OPENAI_WIRE_API")
     };
   }
@@ -2415,7 +2523,7 @@ function detectProvider(configApiKey, preferredModel, env2, configProvider) {
         provider: "openai",
         apiKey: env2.OPENAI_API_KEY,
         baseUrl: env2.OPENAI_BASE_URL ?? "https://api.openai.com/v1",
-        defaultModel: DEFAULT_OPENAI_MODEL,
+        defaultModel: env2.OPENAI_MODEL ?? DEFAULT_OPENAI_MODEL,
         wireApi: openAICompatibleWireApi(env2, "OPENAI_WIRE_API")
       };
     default:
@@ -2477,7 +2585,7 @@ function detectProvider(configApiKey, preferredModel, env2, configProvider) {
       provider: "openai",
       apiKey: openaiKey,
       baseUrl: env2.OPENAI_BASE_URL ?? "https://api.openai.com/v1",
-      defaultModel: DEFAULT_OPENAI_MODEL,
+      defaultModel: env2.OPENAI_MODEL ?? DEFAULT_OPENAI_MODEL,
       wireApi: openAICompatibleWireApi(env2, "OPENAI_WIRE_API")
     };
   }
@@ -2587,9 +2695,14 @@ var LlmApiRuntime = class _LlmApiRuntime {
   config;
   // Not readonly: a live provider switch re-freezes env from the new account.
   env;
+  requestAdmission;
+  requestAdmissionIdentity;
   codexAuthState;
+  grantedProviderTransport;
   workbenchProviderProxy;
   geminiAuthState;
+  siwcConnection;
+  siwcModels;
   provider;
   apiKey;
   baseUrl;
@@ -2616,12 +2729,16 @@ var LlmApiRuntime = class _LlmApiRuntime {
       this.config = {
         type: "api",
         model,
+        siwcConnection: inherited.siwcConnection,
         agentModels: inherited.config.agentModels,
         singleModel: inherited.config.singleModel,
         timeout: Math.min(timeout, inherited.config.timeout || 12e4)
       };
       this.env = inherited.env;
       this.workbenchProviderProxy = inherited.workbenchProviderProxy;
+      this.grantedProviderTransport = inherited.grantedProviderTransport;
+      this.siwcConnection = inherited.siwcConnection;
+      this.siwcModels = inherited.siwcModels;
       this.provider = inherited.provider;
       this.apiKey = inherited.apiKey;
       this.baseUrl = inherited.baseUrl;
@@ -2660,7 +2777,59 @@ var LlmApiRuntime = class _LlmApiRuntime {
       ...config,
       ...config.agentModels ? { agentModels: Object.freeze({ ...config.agentModels }) } : {}
     };
+    this.siwcConnection = void 0;
+    this.siwcModels = void 0;
+    if (config.provider === "chatgpt-plan") {
+      if (!config.siwcConnection || !config.model)
+        throw new Error("ChatGPT plan requires a verified connection and a model selected from its catalog");
+      if (config.providerTransport || config.apiKey)
+        throw new Error("ChatGPT plan cannot use API keys or Codex transport");
+      this.siwcConnection = captureSiwcConnection(config.siwcConnection);
+      this.config = { ...this.config, siwcConnection: this.siwcConnection };
+      this.env = Object.freeze({ ZERO_SKIP_PROVIDER_BANNER: "1" });
+      this.grantedProviderTransport = void 0;
+      this.workbenchProviderProxy = void 0;
+      this.azureConfig = parseCodexAzureConfig({});
+      this.fallbackChain = [];
+      this.fallbackIndex = 0;
+      this.provider = "chatgpt-plan";
+      this.apiKey = "";
+      this.baseUrl = "https://api.openai.com/v1";
+      this.wireApi = "responses";
+      this.model = config.model;
+      this.codexAuthState = void 0;
+      this.geminiAuthState = void 0;
+      this.reasoningEffort = config.env?.["ZERO_REASONING_EFFORT"];
+      this.serverCompactionTokens = void 0;
+      return;
+    }
+    this.grantedProviderTransport = config.providerTransport;
+    if (config.providerTransport) {
+      const grant = config.providerTransport;
+      if (grant.provider !== "chatgpt-codex" || config.provider && config.provider !== grant.provider || !config.model || !grant.models.includes(config.model))
+        throw new Error("Model is outside the explicit provider transport grant");
+      for (const model of Object.values(config.agentModels ?? {}))
+        if (model !== "auto" && !grant.models.includes(model))
+          throw new Error("Worker model is outside the explicit provider transport grant");
+      this.env = Object.freeze({ ZERO_SKIP_PROVIDER_BANNER: "1" });
+      this.workbenchProviderProxy = void 0;
+      this.azureConfig = parseCodexAzureConfig({});
+      this.fallbackChain = [];
+      this.fallbackIndex = 0;
+      this.provider = grant.provider;
+      this.apiKey = "";
+      this.baseUrl = "https://provider-relay.invalid";
+      this.wireApi = "responses";
+      this.model = config.model;
+      this.codexAuthState = void 0;
+      this.geminiAuthState = void 0;
+      this.reasoningEffort = void 0;
+      this.serverCompactionTokens = config.serverCompactionTokens === void 0 ? void 0 : Math.max(1e3, config.serverCompactionTokens);
+      return;
+    }
     this.env = Object.freeze({ ...process.env, ...config.env });
+    this.requestAdmission = void 0;
+    this.requestAdmissionIdentity = void 0;
     this.workbenchProviderProxy = resolveWorkbenchProviderProxy(this.env);
     this.azureConfig = parseCodexAzureConfig(this.env);
     this.fallbackChain = (this.workbenchProviderProxy ? [] : getFallbackChain(this.env)).map((entry) => ({
@@ -2701,6 +2870,8 @@ var LlmApiRuntime = class _LlmApiRuntime {
     }
     if (this.provider === "cline")
       this.model = clineModelId(this.model);
+    if (this.provider === "openrouter")
+      this.model = openrouterModelId(this.model);
     this.applyModelWireApi();
     if (this.apiKey && !this.env["ZERO_SKIP_PROVIDER_BANNER"]) {
       void logProviderStartup(this.provider, this.providerLabel, this.baseUrl, this.model, this.wireApi, this.apiKey).catch(() => {
@@ -2709,6 +2880,10 @@ var LlmApiRuntime = class _LlmApiRuntime {
   }
   /** Non-secret identity for preferences scoped to the captured connection. */
   connectionIdentity() {
+    if (this.siwcConnection)
+      return createHash("sha256").update(JSON.stringify(["chatgpt-plan", this.siwcConnection.accountId, this.siwcConnection.clientId, this.siwcConnection.hostId])).digest("hex");
+    if (this.grantedProviderTransport)
+      return this.grantedProviderTransport.identity;
     let identity;
     if (this.provider === "chatgpt-codex") {
       const state = this.codexAuthState;
@@ -2726,7 +2901,7 @@ var LlmApiRuntime = class _LlmApiRuntime {
       const credential = this.geminiAuthState?.refreshToken || this.geminiAuthState?.accessToken;
       if (!credential)
         return void 0;
-      identity = [this.provider, this.baseUrl, credential, firstNonEmptyEnv(this.env, "GOOGLE_CLOUD_PROJECT", "ZERO_GEMINI_PROJECT") ?? ""];
+      identity = [this.provider, this.baseUrl, credential, firstNonEmptyEnv(this.env, "GOOGLE_CLOUD_PROJECT", "ZERO_GEMINI_PROJECT") ?? "", this.geminiAuthState?.oauthClient?.clientId ?? "legacy"];
     } else {
       if (!this.apiKey)
         return void 0;
@@ -2736,7 +2911,7 @@ var LlmApiRuntime = class _LlmApiRuntime {
   }
   /** Documented effort controls only on routes which send Responses reasoning. */
   reasoningConfiguration() {
-    if (this.wireApi !== "responses" || !["openai", "azure", "chatgpt-codex"].includes(this.provider))
+    if (this.wireApi !== "responses" || !["openai", "azure", "chatgpt-codex", "chatgpt-plan"].includes(this.provider))
       return null;
     const model = this.model.replace(/^openai\//, "");
     let options;
@@ -2765,14 +2940,19 @@ var LlmApiRuntime = class _LlmApiRuntime {
     const state = this.codexAuthState;
     if (this.provider !== "chatgpt-codex" || !state)
       throw new Error("No active Codex subscription");
-    const { loadCodexModelCatalog } = await import("./codex-models-6XVNFRXZ.js");
+    const { loadCodexModelCatalog } = await import("./codex-models-CI22KIHY.js");
     return loadCodexModelCatalog({ signal, resolveCredentials: () => refreshChatGptCodexAuthState(state) });
   }
   /** Discover endpoint inventory; Cline explicitly marks its public catalog provenance. */
   async availableModelCatalog(signal) {
+    if (this.provider === "chatgpt-plan") {
+      if (!this.siwcConnection)
+        throw new Error("ChatGPT plan connection is unavailable");
+      return (await listSiwcModels(this.siwcConnection, fetch, signal)).map((model) => ({ id: model.slug, source: "catalog" }));
+    }
     if (this.provider === "chatgpt-codex")
       return this.codexModelCatalog(signal);
-    const { discoverProviderModels } = await import("./provider-model-discovery-QGUGL3XW.js");
+    const { discoverProviderModels } = await import("./provider-model-discovery-3X6DON3Y.js");
     return discoverProviderModels({
       provider: this.provider,
       baseUrl: this.baseUrl,
@@ -2796,12 +2976,21 @@ var LlmApiRuntime = class _LlmApiRuntime {
    * model / provider / role map with zero session teardown. Undefined fields
    * preserve the current state, except a provider change resets an omitted model.
    */
+  useGrantedProviderTransport(transport, selection = {}) {
+    this.applyConfiguration({ ...this.config, apiKey: void 0, env: {}, providerTransport: transport, provider: transport.provider, model: selection.model ?? this.model, ...selection });
+  }
   reconfigure(sel) {
+    if (this.grantedProviderTransport && (sel.provider && sel.provider !== this.grantedProviderTransport.provider || sel.model && !this.grantedProviderTransport.models.includes(sel.model) || Object.values(sel.agentModels ?? {}).some((model) => model !== "auto" && !this.grantedProviderTransport.models.includes(model))))
+      throw new Error("Selection is outside the explicit provider transport grant");
+    if (this.siwcConnection && sel.siwcConnection && (sel.siwcConnection.accountId !== this.siwcConnection.accountId || sel.siwcConnection.clientId !== this.siwcConnection.clientId || sel.siwcConnection.hostId !== this.siwcConnection.hostId)) {
+      throw new Error("Changing the ChatGPT plan account requires a new chat runtime");
+    }
     const providerChanged = sel.provider !== void 0 && sel.provider !== this.provider;
     if (providerChanged) {
       const merged = {
         ...this.config,
         apiKey: void 0,
+        siwcConnection: sel.provider === "chatgpt-plan" ? sel.siwcConnection : void 0,
         provider: sel.provider ?? this.provider,
         model: sel.model,
         ...sel.agentModels !== void 0 ? { agentModels: sel.agentModels } : {},
@@ -2822,7 +3011,7 @@ var LlmApiRuntime = class _LlmApiRuntime {
       this.config = { ...this.config, autoRoute: sel.autoRoute };
     }
     if (sel.model !== void 0) {
-      const model = this.provider === "opencode" ? opencodeModelId(sel.model) : this.provider === "copilot" ? copilotModelId(sel.model) : this.provider === "cline" ? clineModelId(sel.model) : sel.model;
+      const model = this.provider === "opencode" ? opencodeModelId(sel.model) : this.provider === "copilot" ? copilotModelId(sel.model) : this.provider === "openrouter" ? openrouterModelId(sel.model) : this.provider === "cline" ? clineModelId(sel.model) : sel.model;
       if (model !== this.model) {
         this.model = model;
         this.config = { ...this.config, model };
@@ -2864,6 +3053,10 @@ var LlmApiRuntime = class _LlmApiRuntime {
    * failover chain uses — including auth-only providers (chatgpt-codex OAuth).
    */
   accessibleProviders() {
+    if (this.siwcConnection)
+      return ["chatgpt-plan"];
+    if (this.grantedProviderTransport)
+      return [this.grantedProviderTransport.provider];
     if (this.workbenchProviderProxy)
       return ["chatgpt-codex"];
     const out = [];
@@ -2882,6 +3075,8 @@ var LlmApiRuntime = class _LlmApiRuntime {
    * provider has creds, so this is a helpful starting set, not the whole bound.
    */
   accessibleModels() {
+    if (this.grantedProviderTransport)
+      return [...this.grantedProviderTransport.models];
     if (this.workbenchProviderProxy)
       return [this.workbenchProviderProxy.model];
     const models = /* @__PURE__ */ new Set();
@@ -2901,6 +3096,8 @@ var LlmApiRuntime = class _LlmApiRuntime {
    * accessible defaults as a fallback for ids the router does not pattern-match.
    */
   isModelAccessible(model) {
+    if (this.grantedProviderTransport)
+      return this.grantedProviderTransport.models.includes(model);
     if (this.workbenchProviderProxy)
       return this.accessibleModels().includes(model);
     if (providerForModel(model, this.env) !== void 0)
@@ -2918,7 +3115,7 @@ var LlmApiRuntime = class _LlmApiRuntime {
     if (typeof selectedModel !== "string" || !selectedModel.trim()) {
       throw new Error("Subagent model must be a non-empty model ID");
     }
-    const stripProviderPrefix = (id) => this.provider === "opencode" ? opencodeModelId(id) : this.provider === "copilot" ? copilotModelId(id) : this.provider === "cline" ? clineModelId(id) : id;
+    const stripProviderPrefix = (id) => this.provider === "opencode" ? opencodeModelId(id) : this.provider === "copilot" ? copilotModelId(id) : this.provider === "openrouter" ? openrouterModelId(id) : this.provider === "cline" ? clineModelId(id) : id;
     const model = stripProviderPrefix(selectedModel);
     const approvedByAllowlist = model === this.model || Object.values(this.config.agentModels ?? {}).some((id) => id !== AUTO_MODEL_SENTINEL && stripProviderPrefix(id) === model);
     const approved = approvedByAllowlist || autoInEffect && this.isModelAccessible(selectedModel);
@@ -2934,7 +3131,7 @@ var LlmApiRuntime = class _LlmApiRuntime {
    * contract; callers must fail closed before making a metered comparison call.
    */
   get outputTokenLimit() {
-    return this.provider === "chatgpt-codex" ? void 0 : NATIVE_COMPLETION_TOKEN_LIMIT;
+    return this.provider === "chatgpt-codex" || this.provider === "chatgpt-plan" ? void 0 : NATIVE_COMPLETION_TOKEN_LIMIT;
   }
   /**
    * Whether this provider uses OpenAI-compatible chat/completions format.
@@ -2946,7 +3143,7 @@ var LlmApiRuntime = class _LlmApiRuntime {
    * inert default — it is intentionally unused for these two providers.
    */
   get isOpenAICompat() {
-    return this.provider === "openrouter" || this.provider === "openai" || this.provider === "azure" || this.provider === "deepseek" || this.provider === "qwen" || this.provider === "xai" || this.provider === "copilot" || this.provider === "cline" || this.provider === "opencode" && (this.wireApi === "chat_completions" || this.wireApi === "responses") || // chatgpt-codex always speaks Responses API; treat it as
+    return this.provider === "openrouter" || this.provider === "openai" || this.provider === "chatgpt-plan" || this.provider === "azure" || this.provider === "deepseek" || this.provider === "qwen" || this.provider === "xai" || this.provider === "copilot" || this.provider === "cline" || this.provider === "opencode" && (this.wireApi === "chat_completions" || this.wireApi === "responses") || // chatgpt-codex always speaks Responses API; treat it as
     // OpenAI-compat for body-shape branching purposes (the Responses
     // wire-API code paths below already key on `wireApi === "responses"`
     // and produce a body codex's backend accepts as-is).
@@ -3027,7 +3224,7 @@ var LlmApiRuntime = class _LlmApiRuntime {
     if (this.isGeminiCodeAssist) {
       return {
         "Content-Type": "application/json",
-        "User-Agent": geminiUserAgent(this.model)
+        "User-Agent": this.geminiAuthState?.oauthClient ? `0/${VERSION} (${process.platform}; ${process.arch}) ${this.model}` : geminiUserAgent(this.model)
       };
     }
     if (this.isGoogleWire) {
@@ -3084,8 +3281,13 @@ var LlmApiRuntime = class _LlmApiRuntime {
    * controller process, add a setter on the runtime; for now this
    * matches how the CLI is actually invoked.
    */
-  async ensureFreshHeaders() {
+  async ensureFreshHeaders(signal) {
     const base = this.buildHeaders();
+    if (this.provider === "chatgpt-plan") {
+      if (!this.siwcConnection)
+        throw new Error("ChatGPT plan connection is unavailable");
+      return siwcHeaders(this.siwcConnection, signal);
+    }
     if (this.provider === "google") {
       if (!this.geminiAuthState)
         throw new Error("Google Gemini Code Assist auth: no credential captured for this runtime");
@@ -3183,6 +3385,8 @@ var LlmApiRuntime = class _LlmApiRuntime {
         for (const block of message.content) {
           if (block.type === "text") {
             parts.push({ text: block.text });
+          } else if (block.type === "image") {
+            parts.push({ inlineData: { mimeType: block.mediaType, data: block.data } });
           } else if (block.type === "tool_use") {
             toolNames.set(block.id, block.name);
             upstreamCallIds.set(block.id, block.id);
@@ -3267,6 +3471,8 @@ var LlmApiRuntime = class _LlmApiRuntime {
         return "Azure OpenAI";
       case "deepseek":
         return "DeepSeek";
+      case "chatgpt-plan":
+        return "ChatGPT plan";
       case "chatgpt-codex":
         return "ChatGPT (Codex backend)";
       case "z-ai":
@@ -3291,7 +3497,7 @@ var LlmApiRuntime = class _LlmApiRuntime {
     return "No provider credential found. Set one of:\n  env ZERO_CHATGPT_OAUTH_REFRESH_TOKEN=... 0 <command> (ChatGPT Codex subscription auth)\n  export OPENROUTER_API_KEY=sk-or-...   (OpenRouter \u2014 many models, one key)\n  export DEEPSEEK_API_KEY=...           (DeepSeek \u2014 direct Flash 0731 inference)\n  export ANTHROPIC_API_KEY=sk-ant-...    (Anthropic \u2014 direct Claude access)\n  export AZURE_OPENAI_API_KEY=...        (Azure OpenAI \u2014 reuse your Codex Azure provider)\n  export OPENAI_API_KEY=sk-...           (OpenAI \u2014 direct GPT access)\n  export Z_AI_API_KEY=...                (Z.ai GLM \u2014 flat-rate Coding Plan, Anthropic-compatible)\n  export KIMI_API_KEY=...                (Moonshot Kimi K3 \u2014 flat-rate coding, Anthropic-compatible)\n  export QWEN_API_KEY=...                (Alibaba Qwen \u2014 Token Plan sub, OpenAI-compatible)\n  export XAI_API_KEY=...                 (xAI Grok \u2014 OpenAI-compatible)\n  export CLINE_API_KEY=...               (Cline \u2014 API key; cline-pass/* needs ClinePass)\n  export OPENCODE_API_KEY=...            (OpenCode Zen \u2014 multi-wire gateway)\n  export ZERO_COPILOT_GITHUB_TOKEN=...   (GitHub Copilot \u2014 device-code OAuth token)";
   }
   getConfigurationDiagnostics() {
-    if (!this.apiKey && this.provider !== "chatgpt-codex") {
+    if (!this.apiKey && this.provider !== "chatgpt-codex" && this.provider !== "chatgpt-plan") {
       return {
         valid: false,
         provider: this.provider,
@@ -3401,27 +3607,79 @@ Missing: ${missing.join("; ")}
    * Headers are re-resolved per attempt (via ensureFreshHeaders → OAuth
    * refresh) so a token that rotated during the wait is picked up.
    */
+  async gatewayRequestAdmission(signal) {
+    if (this.workbenchProviderProxy)
+      throw new Error(`${LOCAL_ADMISSION_UNAVAILABLE} gateway admission cannot use a workbench proxy; no inference request sent`);
+    const model = this.model;
+    const baseUrl = this.baseUrl;
+    const identity = JSON.stringify([this.provider, baseUrl, model, this.wireApi]);
+    if (!this.requestAdmission || this.requestAdmissionIdentity !== identity) {
+      this.requestAdmissionIdentity = identity;
+      const pending = (async () => {
+        try {
+          const response = await fetch(`${baseUrl.replace(/\/+$/, "")}/models`, {
+            headers: await this.ensureFreshHeaders(signal),
+            signal,
+            redirect: "error"
+          });
+          if (!response.ok)
+            throw new Error(`${LOCAL_ADMISSION_UNAVAILABLE} catalog HTTP ${response.status}; no inference request sent`);
+          return parseRequestAdmission(await response.json(), model);
+        } catch (error) {
+          if (error instanceof Error && error.message.startsWith(LOCAL_ADMISSION_UNAVAILABLE))
+            throw error;
+          throw new Error(`${LOCAL_ADMISSION_UNAVAILABLE} catalog unavailable or invalid; no inference request sent`);
+        }
+      })();
+      this.requestAdmission = pending;
+      void pending.catch(() => {
+        if (this.requestAdmission === pending && this.requestAdmissionIdentity === identity) {
+          this.requestAdmission = void 0;
+          this.requestAdmissionIdentity = void 0;
+        }
+      });
+    }
+    return this.requestAdmission;
+  }
   async postWithRetry(bodyFactory, signal, abort) {
     let waited429Ms = 0;
     let waitedOtherMs = 0;
     for (let attempt = 0; ; attempt++) {
       abort?.throwIfCancelled();
+      if (this.siwcConnection) {
+        this.siwcModels ??= listSiwcModels(this.siwcConnection, fetch, signal).then((models) => new Set(models.map((model) => model.slug)));
+        try {
+          if (!(await this.siwcModels).has(this.model))
+            throw new Error("Selected model is not in this ChatGPT account's available catalog");
+        } catch (error) {
+          this.siwcModels = void 0;
+          throw error;
+        }
+      }
+      const body = bodyFactory();
+      if (this.env["ZERO_REQUIRE_REQUEST_ADMISSION"] === "1") {
+        assertRequestAdmission(body, await this.gatewayRequestAdmission(signal));
+      }
       let res;
       try {
-        res = this.workbenchProviderProxy ? await fetch(this.workbenchProviderProxy.url, {
+        res = this.grantedProviderTransport ? await this.grantedProviderTransport.request({ provider: "chatgpt-codex", model: this.model, body }, signal) : this.workbenchProviderProxy ? await fetch(this.workbenchProviderProxy.url, {
           method: "POST",
           redirect: "error",
           headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ provider: this.provider, model: this.model, body: bodyFactory() }),
+          body: JSON.stringify({ provider: this.provider, model: this.model, body }),
           signal
         }) : await fetch(this.buildUrl(), {
           method: "POST",
-          headers: await this.ensureFreshHeaders(),
-          body: bodyFactory(),
+          redirect: "error",
+          headers: await this.ensureFreshHeaders(signal),
+          body,
           signal
         });
       } catch (error) {
         abort?.throwIfCancelled();
+        if (this.env["ZERO_REQUIRE_RETRY_SAFE_RECEIPT"] === "1") {
+          throw new Error(`${this.providerLabel} request outcome may be unknown. Automatic replay is disabled`, { cause: error });
+        }
         const cause = error instanceof Error ? error.cause : void 0;
         const causeCode = cause && typeof cause === "object" && "code" in cause && typeof cause.code === "string" ? cause.code : "unknown";
         const causeHost = cause && typeof cause === "object" && "hostname" in cause && typeof cause.hostname === "string" ? `@${cause.hostname}` : "";
@@ -3445,6 +3703,10 @@ Missing: ${missing.join("; ")}
           cause: error
         });
       }
+      if (!res.ok && this.env["ZERO_REQUIRE_RETRY_SAFE_RECEIPT"] === "1" && res.headers.get("x-0-retry-safe") !== "1") {
+        await res.body?.cancel();
+        throw new Error(`${this.providerLabel} gateway HTTP ${res.status}; request outcome may be unknown. Automatic replay is disabled`);
+      }
       if (res.ok || !isRetryableHttpStatus(res.status)) {
         return res;
       }
@@ -3542,20 +3804,20 @@ Missing: ${missing.join("; ")}
     if (context?.signal?.aborted) {
       return { output: "", exitCode: null, timedOut: false, durationMs: 0, error: "API execution cancelled." };
     }
-    if (this.workbenchProviderProxy) {
+    if (this.siwcConnection || this.grantedProviderTransport || this.workbenchProviderProxy) {
       const result = await this.executeNative(context?.systemPrompt ?? "", [
         { role: "user", content: [{ type: "text", text: prompt }] }
       ], [], void 0, context?.signal);
       return {
         output: result.content.filter((block) => block.type === "text").map((block) => block.text).join("\n"),
         exitCode: result.cancelled ? null : result.stopReason === "error" ? 1 : 0,
-        timedOut: false,
+        timedOut: result.timedOut === true,
         durationMs: Date.now() - start,
         usage: result.usage,
         error: result.error
       };
     }
-    if (!this.apiKey && this.provider !== "chatgpt-codex" && this.provider !== "google") {
+    if (!this.apiKey && this.provider !== "chatgpt-codex" && this.provider !== "chatgpt-plan" && this.provider !== "google") {
       return {
         output: "",
         exitCode: 1,
@@ -3602,7 +3864,8 @@ Missing: ${missing.join("; ")}
           res = await this.postWithRetry(() => JSON.stringify({
             model: this.model,
             input,
-            ...isCodex ? { store: false } : { max_output_tokens: NATIVE_COMPLETION_TOKEN_LIMIT }
+            ...isCodex ? { store: false } : { max_output_tokens: NATIVE_COMPLETION_TOKEN_LIMIT },
+            ...this.provider === "chatgpt-plan" ? { store: false, stream: true } : {}
           }), abort.signal, abort);
         } else if (this.isGeminiCodeAssist) {
           const request = {
@@ -3689,7 +3952,7 @@ Missing: ${missing.join("; ")}
         };
       }
       const msg = err instanceof Error ? err.message : String(err);
-      const timedOut = msg.includes("abort") || msg.includes("timeout");
+      const timedOut = controller.signal.aborted || msg.includes("abort") || msg.includes("timeout");
       return {
         output: "",
         exitCode: 1,
@@ -3718,8 +3981,23 @@ Missing: ${missing.join("; ")}
     const maxAttempts = llmStreamMaxAttempts();
     let result;
     let attempt = 0;
-    for (attempt = 1; attempt <= maxAttempts; attempt++) {
+    let refusedUsage;
+    const withRefusedUsage = (outcome) => refusedUsage ? { ...outcome, usage: mergeRuntimeUsage(outcome.usage, refusedUsage) } : outcome;
+    for (; ; ) {
       result = await this.executeNativeAttempt(system, messages, tools, callbacks, signal);
+      if (isLocalAdmissionFailure(result.error))
+        return withRefusedUsage(result);
+      if (this.env["ZERO_REQUIRE_RETRY_SAFE_RECEIPT"] === "1" && (result.stopReason === "error" || result.error)) {
+        return withRefusedUsage({ ...result, error: `${result.error ?? "Incomplete gateway response"}. Request outcome may be unknown. Automatic replay is disabled` });
+      }
+      if (isPolicyRefusalResult(result) && !signal?.aborted) {
+        if (result.usage)
+          refusedUsage = mergeRuntimeUsage(refusedUsage, result.usage);
+        if (this._tryFailover("provider policy refusal"))
+          continue;
+        return refusedUsage ? { ...result, usage: refusedUsage } : result;
+      }
+      attempt++;
       if (attempt >= maxAttempts || !shouldRetryNativeStream(result) || signal?.aborted)
         break;
       const backoff = streamRetryBackoffMs(attempt);
@@ -3729,13 +4007,13 @@ Missing: ${missing.join("; ")}
         break;
     }
     if (attempt >= maxAttempts && maxAttempts > 1 && shouldRetryNativeStream(result)) {
-      return { ...result, error: `${result.error} (retried ${maxAttempts} times)` };
+      return withRefusedUsage({ ...result, error: `${result.error} (retried ${maxAttempts} times)` });
     }
-    return result;
+    return withRefusedUsage(result);
   }
   async executeNativeAttempt(system, messages, tools, callbacks, signal) {
     const start = Date.now();
-    if (!this.apiKey && this.provider !== "chatgpt-codex" && this.provider !== "google") {
+    if (!this.apiKey && this.provider !== "chatgpt-codex" && this.provider !== "chatgpt-plan" && this.provider !== "google") {
       return {
         content: [{ type: "text", text: "" }],
         stopReason: "error",
@@ -3755,6 +4033,10 @@ Missing: ${missing.join("; ")}
           const chatMessages = [];
           chatMessages.push({ role: "system", content: system });
           for (const m of messages) {
+            if (m.role === "user" && m.content.some((block) => block.type === "image") && m.content.every((block) => block.type === "text" || block.type === "image")) {
+              chatMessages.push({ role: "user", content: m.content.map((block) => block.type === "image" ? { type: "image_url", image_url: { url: `data:${block.mediaType};base64,${block.data}` } } : { type: "text", text: block.type === "text" ? block.text : "" }) });
+              continue;
+            }
             const pendingToolCalls = [];
             let pendingAssistantText = null;
             const flushAssistant = () => {
@@ -3779,6 +4061,9 @@ Missing: ${missing.join("; ")}
                   flushAssistant();
                   chatMessages.push({ role: m.role, content: block.text });
                 }
+              } else if (block.type === "image") {
+                flushAssistant();
+                chatMessages.push({ role: m.role, content: [{ type: "image_url", image_url: { url: `data:${block.mediaType};base64,${block.data}` } }] });
               } else if (block.type === "tool_use") {
                 pendingToolCalls.push({
                   id: block.id,
@@ -3818,7 +4103,7 @@ Missing: ${missing.join("; ")}
           }
           res = await this.postWithRetry(() => JSON.stringify({ ...body, model: this.model }), call.signal, call);
         } else if (this.isOpenAICompat && this.wireApi === "responses") {
-          const isCodexProvider = this.provider === "chatgpt-codex";
+          const isCodexProvider = this.provider === "chatgpt-codex" || this.provider === "chatgpt-plan";
           const input = isCodexProvider ? [] : [
             {
               role: "system",
@@ -3836,6 +4121,8 @@ Missing: ${missing.join("; ")}
             for (const block of m.content) {
               if (block.type === "text") {
                 textBlocks.push({ type: textType, text: block.text });
+              } else if (block.type === "image") {
+                textBlocks.push({ type: "input_image", image_url: `data:${block.mediaType};base64,${block.data}` });
               } else if (block.type === "tool_use") {
                 if (textBlocks.length > 0) {
                   input.push({ role: m.role, content: [...textBlocks] });
@@ -3844,6 +4131,7 @@ Missing: ${missing.join("; ")}
                 input.push({
                   type: "function_call",
                   call_id: block.id,
+                  ...this.provider === "chatgpt-plan" ? { namespace: "zero" } : {},
                   name: block.name,
                   arguments: JSON.stringify(block.input)
                 });
@@ -3867,8 +4155,9 @@ Missing: ${missing.join("; ")}
           const isCodex = this.provider === "chatgpt-codex";
           const body = {
             model: this.model,
+            ...this.provider === "chatgpt-plan" ? { store: false, stream: true } : {},
             input,
-            ...isCodex ? { store: false, instructions: system } : { max_output_tokens: NATIVE_COMPLETION_TOKEN_LIMIT },
+            ...isCodex || this.provider === "chatgpt-plan" ? { store: false, instructions: system } : { max_output_tokens: NATIVE_COMPLETION_TOKEN_LIMIT },
             ...reasoningEffort ? {
               reasoning: {
                 effort: reasoningEffort,
@@ -3921,6 +4210,8 @@ Missing: ${missing.join("; ")}
               strict: false,
               parameters: t.input_schema
             }));
+            if (this.provider === "chatgpt-plan")
+              body.tools = [{ type: "namespace", name: "zero", description: "0 local investigation tools", tools: body.tools }];
             if (isCodex) {
               body.tool_choice = "auto";
               body.parallel_tool_calls = true;
@@ -3991,6 +4282,8 @@ Missing: ${missing.join("; ")}
               content: m.content.map((block) => {
                 if (block.type === "text")
                   return { type: "text", text: block.text };
+                if (block.type === "image")
+                  return { type: "image", source: { type: "base64", media_type: block.mediaType, data: block.data } };
                 if (block.type === "tool_use") {
                   return { type: "tool_use", id: block.id, name: block.name, input: block.input };
                 }
@@ -4169,6 +4462,14 @@ Missing: ${missing.join("; ")}
       };
     } catch (err) {
       clearTimeout(timer);
+      if (err instanceof Error && isLocalAdmissionFailure(err.message))
+        return {
+          content: [],
+          stopReason: "error",
+          durationMs: Date.now() - start,
+          error: err.message,
+          ...call.operatorAborted() ? { cancelled: true } : {}
+        };
       if (err instanceof OperatorAbortError || call.operatorAborted()) {
         return this.cancelledResult(start);
       }
@@ -4181,11 +4482,12 @@ Missing: ${missing.join("; ")}
         };
       }
       const msg = err instanceof Error ? err.message : String(err);
-      const timedOut = msg.includes("abort") || msg.includes("timeout");
+      const timedOut = controller.signal.aborted || msg.includes("abort") || msg.includes("timeout");
       return {
         content: [{ type: "text", text: "" }],
         stopReason: "error",
         durationMs: Date.now() - start,
+        ...timedOut ? { timedOut: true } : {},
         error: timedOut ? `${this.providerLabel} API request timed out` : `${this.providerLabel} API error: ${msg}`
       };
     } finally {
@@ -4202,6 +4504,17 @@ Missing: ${missing.join("; ")}
         error: `${this.providerLabel} API error: missing response body`
       };
     }
+    let cancellationRequested = false;
+    const cancelReader = () => {
+      if (cancellationRequested)
+        return;
+      cancellationRequested = true;
+      try {
+        void reader.cancel().catch(() => {
+        });
+      } catch {
+      }
+    };
     const idleTimeoutMs = opts?.idleTimeoutMs ?? llmStreamIdleTimeoutMs();
     const eventIdleTimeoutMs = opts?.eventIdleTimeoutMs ?? llmStreamEventIdleTimeoutMs();
     let lastEventAt = Date.now();
@@ -4240,11 +4553,12 @@ Missing: ${missing.join("; ")}
           // for a body that is buffered, mocked, or already fully delivered.
           ...operatorSignal && detach ? [
             new Promise((_resolve, reject) => {
+              const abortError = () => opts?.abort?.operatorAborted() ? new OperatorAbortError() : new DOMException("Request deadline aborted the stream", "AbortError");
               if (operatorSignal.aborted) {
-                reject(new OperatorAbortError());
+                reject(abortError());
                 return;
               }
-              operatorSignal.addEventListener("abort", () => reject(new OperatorAbortError()), { once: true, signal: detach.signal });
+              operatorSignal.addEventListener("abort", () => reject(abortError()), { once: true, signal: detach.signal });
             })
           ] : []
         ]);
@@ -4295,17 +4609,11 @@ Missing: ${missing.join("; ")}
         chunk = await readBounded();
       } catch (err) {
         if (err instanceof OperatorAbortError || opts?.abort?.operatorAborted()) {
-          try {
-            await reader.cancel();
-          } catch {
-          }
+          cancelReader();
           throw err instanceof OperatorAbortError ? err : new OperatorAbortError();
         }
         if (stalled) {
-          try {
-            await reader.cancel();
-          } catch {
-          }
+          cancelReader();
           const secs = Math.round(stallIdleMs / 1e3);
           diag.warn("stream_stalled", `${this.providerLabel} stream stalled \u2014 no SSE events for ${secs}s (server hold; aborting call)`, {
             provider: this.providerLabel,
@@ -4319,6 +4627,7 @@ Missing: ${missing.join("; ")}
             error: `${this.providerLabel} stream stalled \u2014 no SSE events for ${secs}s (server accepted but held the stream; transient)`
           };
         }
+        cancelReader();
         throw err;
       }
       const { done, value } = chunk;
@@ -4358,6 +4667,10 @@ Missing: ${missing.join("; ")}
         if (eventTypes.size < 32)
           eventTypes.add(identifier(type) ?? "unrecognized");
         const terminal = type === "response.completed" || this.provider === "openrouter" && type === "response.done";
+        if (completedResponse && (type === "response.output_text.delta" || type === "response.content_part.delta" || type === "response.output_item.added" || type === "response.output_item.done" || type === "response.reasoning_summary_text.delta" || type === "response.reasoning_summary_text.done")) {
+          streamFailure = { event: type, status: null, code: "output_after_completion", errorType: null, reason: null };
+          break responses;
+        }
         if (terminal || type === "response.failed" || type === "response.incomplete" || type === "error") {
           const response = event.response && typeof event.response === "object" && !Array.isArray(event.response) ? event.response : void 0;
           const usage = response?.usage;
@@ -4430,11 +4743,22 @@ Missing: ${missing.join("; ")}
           continue;
         }
       }
+      if (completedResponse)
+        break;
     }
+    if (completedResponse || outputCapResponse || streamFailure)
+      cancelReader();
     emitThinking(true);
+    if (!outputCapResponse && opts?.abort?.operatorAborted()) {
+      cancelReader();
+      return { ...this.cancelledResult(start), ...responseUsage ? { usage: responseUsage } : {} };
+    }
+    if (opts?.abort?.signal.aborted && !opts.abort.operatorAborted()) {
+      cancelReader();
+      throw new DOMException("Request deadline aborted the stream", "AbortError");
+    }
     if (outputCapResponse) {
-      void reader.cancel().catch(() => {
-      });
+      cancelReader();
       const finalOutput = Array.isArray(outputCapResponse.output) ? outputCapResponse.output : [];
       const output = finalOutput.length > 0 ? finalOutput : streamedOutputItems;
       let finalText = "";
@@ -4474,8 +4798,7 @@ Missing: ${missing.join("; ")}
     }
     if (!completedResponse || streamFailure) {
       if (streamFailure) {
-        void reader.cancel().catch(() => {
-        });
+        cancelReader();
       }
       appendNativeTrace({
         kind: "native-response-stream-error",
@@ -4558,6 +4881,12 @@ Missing: ${missing.join("; ")}
       thinkingText = reasoningSummaries.join("\n");
       emitThinking(true);
     }
+    if (opts?.abort?.operatorAborted()) {
+      return { ...this.cancelledResult(start), ...responseUsage ? { usage: responseUsage } : {} };
+    }
+    if (opts?.abort?.signal.aborted) {
+      throw new DOMException("Request deadline aborted the stream", "AbortError");
+    }
     return {
       content,
       stopReason: content.some((item) => item.type === "tool_use") ? "tool_use" : "end_turn",
@@ -4578,7 +4907,9 @@ Missing: ${missing.join("; ")}
     };
   }
   async isAvailable() {
-    if (this.workbenchProviderProxy)
+    if (this.provider === "chatgpt-plan")
+      return this.siwcConnection !== void 0;
+    if (this.grantedProviderTransport || this.workbenchProviderProxy)
       return true;
     if (this.provider === "chatgpt-codex") {
       return this.codexAuthState !== void 0;
@@ -4588,6 +4919,10 @@ Missing: ${missing.join("; ")}
 };
 
 export {
+  captureSiwcConnection,
+  listSiwcModels,
+  isLocalAdmissionLimit,
+  isLocalAdmissionFailure,
   FEATURE_PRESETS,
   resolveFeaturePreset,
   applyFeaturePreset,