@eddyskywalker/dsh-chatgpt-subscription 0.10.10 → 0.10.12

package/lib/index.js

@@ -905,6 +905,16 @@ function poolCredentialAccount$1(filePath) {
 	return createHash("sha256").update(path.resolve(filePath)).digest("hex");
 }
 const poolOperations = /* @__PURE__ */ new Map();
+const poolIdentityRevisions = /* @__PURE__ */ new Map();
+const poolRefreshes = /* @__PURE__ */ new Map();
+/**
+* A selected row was deleted, or became unusable, while a caller awaited it.
+*
+* Distinct from every other credential error because a MODEL REQUEST can still
+* be served by another account: routing excludes the row and tries the next
+* one, while a caller that named the account still gets the plain refusal.
+*/
+var PoolAccountUnavailableError = class extends LlmError {};
 /**
 * The shared multi-account pool: encrypted storage, eligibility filtering,
 * rotation strategy, 429 cooldowns and per-account auth failures.
@@ -926,11 +936,14 @@ var AccountPoolCore = class {
 	* can therefore invalidate on identity change without paying a credential read
 	* to discover it.
 	*/
-	identityRevision = 0;
+	/** Pool-file identity of this instance: locks, revisions and flights key on it. */
+	operationKey;
 	constructor(hooks) {
 		this.hooks = hooks;
 		this.filePath = hooks.poolFile;
 		this.backend = hooks.backend ?? createPoolBackend(hooks);
+		const resolved = path.resolve(this.filePath);
+		this.operationKey = process.platform === "win32" ? resolved.toLowerCase() : resolved;
 	}
 	/**
 	* A cheap, in-memory revision of the pool's serving identity.
@@ -946,15 +959,21 @@ var AccountPoolCore = class {
 	* would report one account's usage under another account's name.
 	*/
 	currentIdentityRevision() {
-		return this.identityRevision;
+		return poolIdentityRevisions.get(this.operationKey) ?? 0;
 	}
 	/** Human description of where this pool's credentials live. */
 	path() {
 		if (process.platform === "win32") return `${this.filePath}.dpapi`;
 		return `${process.platform === "darwin" ? "Keychain" : "Secret Service"}: ${this.hooks.keychainService}/${poolCredentialAccount$1(this.filePath)}`;
 	}
+	/**
+	* Queue one storage transaction for this pool file.
+	*
+	* NOT reentrant: a transaction must use {@link loadPoolData} and
+	* {@link updatePool} rather than calling the public read/write methods.
+	*/
 	serialize(operation) {
-		const key = path.resolve(this.filePath);
+		const key = this.operationKey;
 		const result = (poolOperations.get(key) || Promise.resolve()).then(operation);
 		const settled = result.then(() => void 0, () => void 0);
 		poolOperations.set(key, settled);
@@ -978,31 +997,74 @@ var AccountPoolCore = class {
 	* getter write to disk.
 	*/
 	read() {
-		return this.serialize(async () => {
-			let current = null;
-			try {
-				current = await this.backend.load();
-			} catch {}
-			if (current !== null && Array.isArray(current.accounts) && current.accounts.length > 0) return current;
-			try {
-				const legacy = await this.hooks.legacyAccount?.();
-				if (legacy) return {
-					version: 1,
-					activeAccountId: legacy.id,
-					rotationStrategy: current?.rotationStrategy || "sequential",
-					accounts: [legacy]
-				};
-			} catch {}
-			return current || {
+		return this.serialize(() => this.loadPoolData());
+	}
+	/**
+	* Load the pool without holding the file lock.
+	*
+	* Providers override this to maintain their own in-memory indexes, so every
+	* load — including one inside {@link updatePool} — refreshes them.
+	*/
+	async loadPoolData() {
+		let current = null;
+		try {
+			current = await this.backend.load();
+		} catch {}
+		if (current !== null && Array.isArray(current.accounts) && current.accounts.length > 0) return current;
+		try {
+			const legacy = await this.hooks.legacyAccount?.();
+			if (legacy) return {
 				version: 1,
-				rotationStrategy: "sequential",
-				accounts: []
+				activeAccountId: legacy.id,
+				rotationStrategy: current?.rotationStrategy || "sequential",
+				accounts: [legacy]
 			};
-		});
+		} catch {}
+		return current || {
+			version: 1,
+			rotationStrategy: "sequential",
+			accounts: []
+		};
 	}
+	async persistPoolData(data) {
+		poolIdentityRevisions.set(this.operationKey, this.currentIdentityRevision() + 1);
+		await this.saveVerified(data);
+	}
+	/**
+	* Replace the whole document (initialization, import), NOT a read-modify-write.
+	* Prefer {@link updatePool} for mutations so the draft is read under the lock.
+	*/
 	write(data) {
-		this.identityRevision += 1;
-		return this.serialize(() => this.saveVerified(this.hooks.parsePoolData(data)));
+		return this.serialize(() => this.persistPoolData(data));
+	}
+	/**
+	* Read the LATEST document, mutate it and persist it as one file transaction.
+	*
+	* This is the whole fix for the read-modify-write race: the old shape read a
+	* snapshot, awaited (a token refresh, a settings write, an encrypted round
+	* trip) and then wrote that whole stale snapshot back, erasing whatever landed
+	* in between — including another account's freshly rotated token.
+	*
+	* The callback runs under the file lock, so it must not call read, write or
+	* updatePool (the lock is not reentrant) and must not do network I/O.
+	* Provider-local stores belong in `afterCommit`, which runs only once the
+	* pool write is verified, and must not re-enter the pool either.
+	*/
+	updatePool(mutate, afterCommit) {
+		return this.serialize(async () => {
+			const data = await this.loadPoolData();
+			const before = structuredClone(data);
+			const result = await mutate(data);
+			if (!isDeepStrictEqual(before, data)) {
+				await this.persistPoolData(data);
+				await afterCommit?.(data, result).catch(() => void 0);
+				for (const account of data.accounts) if (!isDeepStrictEqual(before.accounts.find((entry) => entry.id === account.id)?.credentials, account.credentials)) await this.hooks.credentialsCommitted?.(account).catch(() => void 0);
+				const previousPrimary = before.accounts.find((account) => account.isPrimary);
+				const primary = data.accounts.find((account) => account.isPrimary);
+				if (previousPrimary?.id !== primary?.id || !isDeepStrictEqual(previousPrimary?.credentials, primary?.credentials)) await this.hooks.mirrorPrimary?.(primary?.credentials ?? null).catch(() => void 0);
+			}
+			return result;
+		});
 	}
 	/** Public summaries, with cooldowns that already expired reported as absent. */
 	async listAccounts() {
@@ -1031,8 +1093,17 @@ var AccountPoolCore = class {
 		return this.hooks.extendSummary ? this.hooks.extendSummary(account, summary, now) : summary;
 	}
 	/** Add or re-authorize one account; an existing dedupe key updates in place. */
-	async addAccount(credentials, alias) {
-		const data = await this.read();
+	addAccount(credentials, alias) {
+		return this.updatePool((data) => this.addAccountToPool(data, credentials, alias));
+	}
+	/**
+	* Add or re-authorize inside an existing transaction.
+	*
+	* Capacity, dedupe and the primary decision are all taken against the live
+	* document, so two simultaneous sign-ins cannot each pass a check the other
+	* has already invalidated.
+	*/
+	addAccountToPool(data, credentials, alias) {
 		const key = this.hooks.dedupeKey?.(credentials);
 		const existingIndex = key === void 0 ? -1 : data.accounts.findIndex((account) => this.hooks.dedupeKey?.(account.credentials) === key);
 		const maxAccounts = this.hooks.maxAccounts ?? 20;
@@ -1058,77 +1129,79 @@ var AccountPoolCore = class {
 		if (existingIndex >= 0) data.accounts[existingIndex] = account;
 		else data.accounts.push(account);
 		if (!data.activeAccountId || account.isPrimary) data.activeAccountId = account.id;
-		await this.write(data);
-		if (account.isPrimary) this.hooks.mirrorPrimary?.(credentials).catch(() => void 0);
 		return account;
 	}
-	async setPrimary(accountId) {
-		const data = await this.read();
-		for (const account of data.accounts) account.isPrimary = account.id === accountId;
-		const primary = data.accounts.find((account) => account.isPrimary);
-		if (primary) {
-			data.activeAccountId = primary.id;
-			this.hooks.mirrorPrimary?.(primary.credentials).catch(() => void 0);
-		}
-		await this.write(data);
+	setPrimary(accountId) {
+		return this.updatePool((data) => {
+			for (const account of data.accounts) account.isPrimary = account.id === accountId;
+			const primary = data.accounts.find((account) => account.isPrimary);
+			if (primary) data.activeAccountId = primary.id;
+		});
 	}
 	/**
 	* Persist a refreshed credential for one account.
 	*
+	* `expected` makes this a conditional write: when the stored credential is
+	* no longer the one the caller started from, something newer won the race (a
+	* re-login, a rotation committed while this call was in flight) and the
+	* latest row is returned WITHOUT being overwritten. A deleted account is
+	* never brought back.
+	*
 	* Used by a forced refresh (a 401 mid-request) rather than by the rotating
-	* getEffectiveAccount path, which already writes back what it refreshed.
+	* getEffectiveAccount path, which refreshes through its own single-flight.
 	*/
-	async updateAccountCredentials(accountId, credentials) {
-		const data = await this.read();
-		const target = data.accounts.find((account) => account.id === accountId);
-		if (target === void 0) return void 0;
-		target.credentials = credentials;
-		await this.write(data);
-		if (target.isPrimary) this.hooks.mirrorPrimary?.(credentials).catch(() => void 0);
-		return target;
+	updateAccountCredentials(accountId, credentials, expected) {
+		return this.updatePool((data) => {
+			const target = data.accounts.find((account) => account.id === accountId);
+			if (target && (expected === void 0 || isDeepStrictEqual(target.credentials, expected))) target.credentials = credentials;
+			return target;
+		});
 	}
-	async setAlias(accountId, alias) {
-		const data = await this.read();
-		const target = data.accounts.find((account) => account.id === accountId);
-		if (target && alias.trim()) {
-			target.alias = alias.trim();
-			await this.write(data);
-		}
+	setAlias(accountId, alias) {
+		return this.updatePool((data) => {
+			const target = data.accounts.find((account) => account.id === accountId);
+			if (target && alias.trim()) target.alias = alias.trim();
+		});
 	}
-	async deleteAccount(accountId) {
-		const data = await this.read();
+	deleteAccount(accountId) {
+		return this.updatePool((data) => this.deleteAccountFromPool(data, accountId));
+	}
+	/**
+	* Remove one account inside a transaction.
+	*
+	* Provider refusal rules (a snapshot this plugin does not own, a desktop
+	* account it may only hide) belong in an override of this, so the check and
+	* the removal cannot be separated by a concurrent change.
+	*/
+	deleteAccountFromPool(data, accountId) {
 		const wasPrimary = data.accounts.find((account) => account.id === accountId)?.isPrimary;
 		data.accounts = data.accounts.filter((account) => account.id !== accountId);
-		if (wasPrimary && data.accounts.length > 0) {
-			data.accounts[0].isPrimary = true;
-			this.hooks.mirrorPrimary?.(data.accounts[0].credentials).catch(() => void 0);
-		} else if (data.accounts.length === 0) this.hooks.mirrorPrimary?.(null).catch(() => void 0);
+		if (wasPrimary && data.accounts.length > 0) data.accounts[0].isPrimary = true;
 		if (data.activeAccountId === accountId) data.activeAccountId = data.accounts.find((account) => account.isPrimary)?.id ?? data.accounts[0]?.id;
-		await this.write(data);
 	}
-	async setStrategy(strategy) {
-		const data = await this.read();
-		data.rotationStrategy = strategy;
-		await this.write(data);
+	setStrategy(strategy) {
+		return this.updatePool((data) => {
+			data.rotationStrategy = strategy;
+		});
 	}
 	/** Cool one account down after an upstream 429. */
-	async markCooldown(accountId, durationMs, reason) {
-		const data = await this.read();
-		const target = data.accounts.find((account) => account.id === accountId);
-		if (target) {
-			target.cooldownUntil = Date.now() + Math.max(MIN_COOLDOWN_MS, durationMs);
-			target.cooldownReason = reason;
-			await this.write(data);
-		}
+	markCooldown(accountId, durationMs, reason) {
+		return this.updatePool((data) => {
+			const target = data.accounts.find((account) => account.id === accountId);
+			if (target) {
+				target.cooldownUntil = Date.now() + Math.max(MIN_COOLDOWN_MS, durationMs);
+				target.cooldownReason = reason;
+			}
+		});
 	}
-	async clearCooldown(accountId) {
-		const data = await this.read();
-		const target = data.accounts.find((account) => account.id === accountId);
-		if (target) {
-			target.cooldownUntil = void 0;
-			target.cooldownReason = void 0;
-			await this.write(data);
-		}
+	clearCooldown(accountId) {
+		return this.updatePool((data) => {
+			const target = data.accounts.find((account) => account.id === accountId);
+			if (target) {
+				target.cooldownUntil = void 0;
+				target.cooldownReason = void 0;
+			}
+		});
 	}
 	/**
 	* Record that an account can no longer authenticate.
@@ -1136,23 +1209,23 @@ var AccountPoolCore = class {
 	* The account stays in the pool: signing in again is what restores it, and a
 	* deleted account would take the user's alias and ordering with it.
 	*/
-	async markAuthFailed(accountId, reason, status = "expired") {
-		const data = await this.read();
-		const target = data.accounts.find((account) => account.id === accountId);
-		if (target) {
-			target.authStatus = status;
-			target.authFailedReason = reason;
-			await this.write(data);
-		}
+	markAuthFailed(accountId, reason, status = "expired") {
+		return this.updatePool((data) => {
+			const target = data.accounts.find((account) => account.id === accountId);
+			if (target) {
+				target.authStatus = status;
+				target.authFailedReason = reason;
+			}
+		});
 	}
-	async clearAuthFailed(accountId) {
-		const data = await this.read();
-		const target = data.accounts.find((account) => account.id === accountId);
-		if (target) {
-			target.authStatus = void 0;
-			target.authFailedReason = void 0;
-			await this.write(data);
-		}
+	clearAuthFailed(accountId) {
+		return this.updatePool((data) => {
+			const target = data.accounts.find((account) => account.id === accountId);
+			if (target) {
+				target.authStatus = void 0;
+				target.authFailedReason = void 0;
+			}
+		});
 	}
 	/** Whether an account may serve a request right now. */
 	isEligible(account, now, triedAccountIds) {
@@ -1192,24 +1265,16 @@ var AccountPoolCore = class {
 	*
 	* @param fetchFn - fetch used if the credential is close to expiry.
 	*/
-	async getCredentialAccount(fetchFn = fetch) {
+	async getCredentialAccount(fetchFn = fetch, forceRefresh = false) {
 		const data = await this.read();
 		if (data.accounts.length === 0) throw new Error(this.hooks.emptyMessage ?? `未登录 ${this.hooks.displayName} 账号，请先在设置页添加账号。`);
-		const now = Date.now();
 		const usable = data.accounts.filter((account) => this.isCredentialUsable(account));
 		if (usable.length === 0) throw new LlmError(`全部 ${data.accounts.length} 个 ${this.hooks.displayName} 账号均需要重新登录。`, "AUTH", { status: 401 });
 		const selected = this.selectAccount(usable, data);
-		if (this.shouldRefreshCredential(selected, now) && this.hooks.refresh) {
-			const refreshed = await this.hooks.refresh(selected.credentials, fetchFn);
-			await this.updateAccountCredentials(selected.id, refreshed);
-			return {
-				account: selected,
-				credentials: refreshed
-			};
-		}
+		const account = await this.freshAccount(selected, fetchFn, forceRefresh);
 		return {
-			account: selected,
-			credentials: selected.credentials
+			account,
+			credentials: account.credentials
 		};
 	}
 	/**
@@ -1244,8 +1309,8 @@ var AccountPoolCore = class {
 	* looks unexpired, and only the service's own refusal says so. Renewing it is
 	* what separates that from a credential that genuinely needs a new sign-in.
 	*/
-	async renewCredential(accountId, fetchFn = fetch) {
-		return this.credentialFor(accountId, fetchFn, true);
+	async renewCredential(accountId, fetchFn = fetch, expected) {
+		return this.credentialFor(accountId, fetchFn, true, expected);
 	}
 	/**
 	* Resolve, and if needed renew, one account's credential.
@@ -1255,29 +1320,106 @@ var AccountPoolCore = class {
 	* not name an account (the catalog loader) still has to present the
 	* credential that is actually in play.
 	*/
-	async credentialFor(accountId, fetchFn, force) {
+	async credentialFor(accountId, fetchFn, force, expected) {
 		const data = await this.read();
 		const target = accountId === void 0 ? data.accounts.find((account) => account.id === data.activeAccountId) ?? data.accounts.find((account) => account.isPrimary) ?? data.accounts[0] : data.accounts.find((account) => account.id === accountId);
 		if (target === void 0) throw new LlmError(this.hooks.emptyMessage ?? `未登录 ${this.hooks.displayName} 账号，请先在设置页添加账号。`, "AUTH");
 		if (!this.isCredentialUsable(target)) throw new LlmError(`${this.hooks.displayName} 账号的凭据已被拒绝，需要重新登录。`, "AUTH", { status: 401 });
-		if (!force && (!this.shouldRefreshCredential(target, Date.now()) || !this.hooks.refresh)) return target.credentials;
-		if (!this.hooks.refresh) return target.credentials;
+		if (expected !== void 0 && !isDeepStrictEqual(expected, target.credentials)) return target.credentials;
+		return (await this.freshAccount(target, fetchFn, force)).credentials;
+	}
+	/**
+	* Return one account's current row, refreshing it at most once per generation.
+	*
+	* Shared by every entry point — routing, auxiliary tools, the settings card
+	* and forced renewals — across all instances of the pool file, because a
+	* rotating refresh token may be spent once: two parallel exchanges both fail,
+	* and the losing one gets recorded as a dead sign-in.
+	*
+	* Reading the current generation and registering/joining its flight happen in
+	* one short transaction, so a commit cannot slip between the two decisions.
+	* The network call is fired AFTER the lock is released, and the plan returned
+	* from the lock is a plain value: awaiting a flight while holding the lock
+	* would deadlock that flight's own commit.
+	*/
+	async freshAccount(target, fetchFn, force = false) {
+		let launch;
+		const plan = await this.serialize(async () => {
+			const current = (await this.loadPoolData()).accounts.find((account) => account.id === target.id);
+			if (current === void 0 || !this.isCredentialUsable(current)) throw new PoolAccountUnavailableError(this.hooks.emptyMessage ?? "未登录 " + this.hooks.displayName + " 账号，请先在设置页添加账号。", "AUTH");
+			if (!isDeepStrictEqual(current.credentials, target.credentials)) return { account: current };
+			if (!this.hooks.refresh || !force && !this.shouldRefreshCredential(current, Date.now())) return { account: current };
+			const key = JSON.stringify([this.operationKey, current.id]);
+			const pending = poolRefreshes.get(key);
+			if (pending !== void 0 && isDeepStrictEqual(pending.credentials, current.credentials)) return { result: pending.result };
+			const result = new Promise((resolve, reject) => {
+				launch = () => {
+					this.refreshAccount(current, fetchFn).then(resolve, reject);
+				};
+			});
+			const flight = {
+				credentials: structuredClone(current.credentials),
+				result
+			};
+			poolRefreshes.set(key, flight);
+			const release = () => {
+				if (poolRefreshes.get(key) === flight) poolRefreshes.delete(key);
+			};
+			result.then(release, release);
+			return { result };
+		});
+		launch?.();
+		return plan.result ?? plan.account;
+	}
+	/**
+	* Refresh one account: network outside the lock, then a conditional commit.
+	*
+	* Every write-back is checked against the credential the refresh started from,
+	* which is what keeps a late response from restoring a spent token over a
+	* re-login, and keeps a deleted account from coming back.
+	*/
+	async refreshAccount(target, fetchFn) {
+		const expected = structuredClone(target.credentials);
 		const live = await this.hooks.liveCredentialsFor?.(target).catch(() => null);
 		if (live !== null && live !== void 0 && live.advanced) {
-			target.credentials = live.credentials;
-			await this.write(data).catch(() => void 0);
-			return live.credentials;
+			const account = await this.updateAccountCredentials(target.id, live.credentials, expected).catch(() => ({
+				...target,
+				credentials: live.credentials
+			}));
+			this.assertUsableAccount(account);
+			return account;
 		}
 		let refreshed;
 		try {
 			refreshed = await this.hooks.refresh(target.credentials, fetchFn);
 		} catch (error) {
 			const status = this.hooks.refreshFailureStatus?.(error);
-			if (status !== void 0) await this.markAuthFailed(target.id, error instanceof Error ? error.message : String(error), status).catch(() => void 0);
+			let superseded;
+			await this.updatePool((data) => {
+				const current = data.accounts.find((account) => account.id === target.id);
+				if (current === void 0) return;
+				if (!isDeepStrictEqual(current.credentials, expected)) {
+					superseded = current;
+					return;
+				}
+				if (status !== void 0) {
+					current.authStatus = status;
+					current.authFailedReason = error instanceof Error ? error.message : String(error);
+				}
+			}).catch(() => void 0);
+			if (superseded !== void 0) {
+				this.assertUsableAccount(superseded);
+				return superseded;
+			}
 			throw error;
 		}
-		await this.updateAccountCredentials(target.id, refreshed);
-		return refreshed;
+		const account = await this.updateAccountCredentials(target.id, refreshed, expected);
+		this.assertUsableAccount(account);
+		return account;
+	}
+	assertUsableAccount(account) {
+		if (account === void 0) throw new PoolAccountUnavailableError(this.hooks.emptyMessage ?? "未登录 " + this.hooks.displayName + " 账号，请先在设置页添加账号。", "AUTH");
+		if (!this.isCredentialUsable(account)) throw new PoolAccountUnavailableError(this.hooks.displayName + " 账号的凭据已被拒绝，需要重新登录。", "AUTH", { status: 401 });
 	}
 	/** Whether one account's credential must be refreshed before it is handed out. */
 	shouldRefreshCredential(account, now) {
@@ -1321,37 +1463,34 @@ var AccountPoolCore = class {
 	* @param fetchFn - fetch used by the provider's token refresh.
 	* @throws LlmError with `RATE_LIMIT` when every account is cooling down.
 	*/
-	async getEffectiveAccount(excludeIds, fetchFn = fetch) {
+	async getEffectiveAccount(excludeIds, fetchFn = fetch, forceRefresh = false) {
 		const data = await this.read();
 		if (data.accounts.length === 0) throw new Error(this.hooks.emptyMessage ?? `未登录 ${this.hooks.displayName} 账号，请先在设置页添加账号。`);
 		const now = Date.now();
 		const eligible = data.accounts.filter((account) => this.isEligible(account, now, excludeIds));
 		if (eligible.length === 0) throw this.allUnavailableError(data, now);
 		const selected = this.selectAccount(eligible, data);
-		if (this.shouldRefreshCredential(selected, now) && this.hooks.refresh) {
-			let refreshed;
-			try {
-				refreshed = await this.hooks.refresh(selected.credentials, fetchFn);
-			} catch (error) {
-				const status = this.hooks.refreshFailureStatus?.(error);
-				if (status === void 0) throw error;
-				await this.markAuthFailed(selected.id, error instanceof Error ? error.message : String(error), status);
-				const nextExclude = new Set(excludeIds ?? []);
-				nextExclude.add(selected.id);
-				if (await this.hasAnotherAvailableAccount(nextExclude)) return this.getEffectiveAccount(nextExclude, fetchFn);
-				throw error;
-			}
-			selected.credentials = refreshed;
-			const index = data.accounts.findIndex((account) => account.id === selected.id);
-			if (index >= 0) data.accounts[index] = selected;
-			if (selected.isPrimary) this.hooks.mirrorPrimary?.(refreshed).catch(() => void 0);
-		}
-		selected.lastUsedAt = now;
-		data.activeAccountId = selected.id;
-		await this.write(data).catch(() => void 0);
+		let refreshed;
+		try {
+			refreshed = await this.freshAccount(selected, fetchFn, forceRefresh);
+		} catch (error) {
+			if (this.hooks.refreshFailureStatus?.(error) === void 0 && !(error instanceof PoolAccountUnavailableError)) throw error;
+			const nextExclude = new Set(excludeIds ?? []);
+			nextExclude.add(selected.id);
+			if (await this.hasAnotherAvailableAccount(nextExclude)) return this.getEffectiveAccount(nextExclude, fetchFn, forceRefresh);
+			throw error;
+		}
+		const account = await this.updatePool((current) => {
+			const latest = current.accounts.find((entry) => entry.id === refreshed.id);
+			if (latest === void 0 || !isDeepStrictEqual(latest.credentials, refreshed.credentials)) return latest;
+			latest.lastUsedAt = now;
+			if (current.activeAccountId === data.activeAccountId) current.activeAccountId = latest.id;
+			return latest;
+		}).catch(() => refreshed);
+		this.assertUsableAccount(account);
 		return {
-			account: selected,
-			credentials: selected.credentials
+			account,
+			credentials: account.credentials
 		};
 	}
 };
@@ -1724,8 +1863,7 @@ var OAuthService = class {
 	async refresh() {
 		this.assertAvailable();
 		if (this.pool !== null) {
-			const { account, credentials } = await this.pool.getEffectiveAccount(void 0, this.fetchFn);
-			await this.refreshAccount(credentials).then((refreshed) => this.pool.updateAccountCredentials(account.id, refreshed));
+			await this.pool.getEffectiveAccount(void 0, this.fetchFn, true);
 			return this.status();
 		}
 		const stored = await this.loadAuthenticated();
@@ -1787,18 +1925,8 @@ var OAuthService = class {
 	*/
 	async credentials(forceRefresh = false, access = {}) {
 		if (this.pool !== null) {
-			if (access.purpose === "tool") {
-				const { account, credentials } = await this.pool.getCredentialAccount(this.fetchFn);
-				if (!forceRefresh) return credentials;
-				const refreshed = await this.refreshAccount(credentials, this.fetchFn);
-				await this.pool.updateAccountCredentials(account.id, refreshed);
-				return refreshed;
-			}
-			const { account, credentials } = await this.pool.getEffectiveAccount(void 0, this.fetchFn);
-			if (!forceRefresh) return credentials;
-			const refreshed = await this.refreshAccount(credentials, this.fetchFn);
-			await this.pool.updateAccountCredentials(account.id, refreshed);
-			return refreshed;
+			if (access.purpose === "tool") return (await this.pool.getCredentialAccount(this.fetchFn, forceRefresh)).credentials;
+			return (await this.pool.getEffectiveAccount(void 0, this.fetchFn, forceRefresh)).credentials;
 		}
 		const stored = await this.loadAuthenticated();
 		if (forceRefresh || stored.expiresAt - this.now() <= 6e4) return this.refreshCredentials(stored);
@@ -2251,11 +2379,8 @@ var CodexAccountPool = class extends AccountPoolCore {
 	async refreshAccountNow(accountId) {
 		const account = (await this.read()).accounts.find((entry) => entry.id === accountId);
 		if (account === void 0) throw new Error("ChatGPT 账号已不在号池中");
-		const refresher = this.refresherRef.current;
-		if (refresher === void 0) throw new Error("ChatGPT 凭据刷新服务尚未就绪");
-		const refreshed = await refresher.refreshAccount(account.credentials);
-		await this.updateAccountCredentials(accountId, refreshed);
-		return refreshed;
+		if (this.refresherRef.current === void 0) throw new Error("ChatGPT 凭据刷新服务尚未就绪");
+		return this.renewCredential(accountId, fetch, account.credentials);
 	}
 	/** The single-credential store this pool mirrors its primary account into. */
 	mirrorStore() {
@@ -21552,23 +21677,30 @@ var MinimaxCodeAccountPool = class extends AccountPoolCore {
 	* because that one genuinely needs a sign-in.
 	*/
 	async healStaleAuthFailures(current) {
-		const data = current ?? await this.read();
-		if (!data.accounts.some(isMarkedFailed)) return false;
+		const failedAccounts = (current ?? await this.read()).accounts.filter(isMarkedFailed);
+		if (failedAccounts.length === 0) return false;
+		const targets = new Map(failedAccounts.map((account) => [account.id, {
+			credentials: account.credentials,
+			authStatus: account.authStatus
+		}]));
 		const live = await this.store.read().catch(() => null);
 		if (live === null) return false;
-		let changed = false;
-		for (const account of data.accounts) {
-			if (account.authStatus === void 0 || account.authStatus === "ok") continue;
-			if (!minimaxCodeSameCredentialSession(live, account.credentials)) continue;
-			if (!minimaxCodeCredentialAdvancedPast(live, account.credentials)) continue;
-			account.authStatus = void 0;
-			account.authFailedReason = void 0;
-			account.credentials = live;
-			changed = true;
-		}
-		if (!changed) return false;
-		await this.write(data).catch(() => void 0);
-		return true;
+		return await this.updatePool((draft) => {
+			let changed = false;
+			for (const account of draft.accounts) {
+				const expected = targets.get(account.id);
+				if (!expected) continue;
+				if (account.authStatus !== expected.authStatus) continue;
+				if (!isDeepStrictEqual(account.credentials, expected.credentials)) continue;
+				if (!minimaxCodeSameCredentialSession(live, account.credentials)) continue;
+				if (!minimaxCodeCredentialAdvancedPast(live, account.credentials)) continue;
+				account.authStatus = void 0;
+				account.authFailedReason = void 0;
+				account.credentials = live;
+				changed = true;
+			}
+			return changed;
+		});
 	}
 	/**
 	* Pick the account for the next request.
@@ -21582,7 +21714,13 @@ var MinimaxCodeAccountPool = class extends AccountPoolCore {
 		const effective = await this.getEffectiveAccount(excludeIds, fetchFn);
 		const live = await this.liveNativeCredential(effective.account);
 		if (live === null) return effective;
-		if (live.accessToken !== effective.credentials.accessToken) await this.updateAccountCredentials(effective.account.id, live).catch(() => void 0);
+		if (live.accessToken !== effective.credentials.accessToken) {
+			const updated = await this.updateAccountCredentials(effective.account.id, live, effective.credentials).catch(() => void 0);
+			if (updated) return {
+				account: updated,
+				credentials: updated.credentials
+			};
+		}
 		return {
 			account: effective.account,
 			credentials: live
@@ -21644,7 +21782,7 @@ var MinimaxCodeAccountPool = class extends AccountPoolCore {
 		return this.addAccount(credentials, alias);
 	}
 	/**
-	* Delete one account.
+	* Remove one account inside a transaction.
 	*
 	* An account whose credential is the desktop app's own \`auth.json\` is refused:
 	* this plugin does not own that file, and removing the account would either
@@ -21652,9 +21790,9 @@ var MinimaxCodeAccountPool = class extends AccountPoolCore {
 	* file — sign the user out of MiniMax Code itself. Signing out there is the
 	* supported way to end it, and the card is told so by \`removable: false\`.
 	*/
-	async deleteAccount(accountId) {
-		if ((await this.read()).accounts.find((account) => account.id === accountId)?.source === "minimax-native") throw new Error("该账号来自 MiniMax Code 桌面端（~/.minimax/auth），本插件只能读取和续期，不能删除。请在 MiniMax Code 应用中退出登录。");
-		await super.deleteAccount(accountId);
+	deleteAccountFromPool(data, accountId) {
+		if (data.accounts.find((account) => account.id === accountId)?.source === "minimax-native") throw new Error("该账号来自 MiniMax Code 桌面端（~/.minimax/auth），本插件只能读取和续期，不能删除。请在 MiniMax Code 应用中退出登录。");
+		super.deleteAccountFromPool(data, accountId);
 	}
 	/** The credential store this pool mirrors its primary account into. */
 	mirrorStore() {
@@ -26157,15 +26295,15 @@ var WorkBuddyAccountPool = class extends AccountPoolCore {
 		this.options_selection = options.selection;
 	}
 	/**
-	* Read the pool, refreshing the legacy-key index on the way.
+	* Load the pool, refreshing the legacy-key index on the way.
 	*
-	* Every routing decision goes through this method before it consults the
-	* settings selection, so building the index here is what keeps a pin written
-	* before the identity fix resolvable when {@link resolveSelectionId} is asked
-	* for it.
+	* Every routing decision and mutation goes through this method before it
+	* consults the settings selection, so building the index here is what keeps
+	* a pin written before the identity fix resolvable when
+	* {@link resolveSelectionId} is asked for it.
 	*/
-	async read() {
-		const data = await super.read();
+	async loadPoolData() {
+		const data = await super.loadPoolData();
 		this.legacyIds.clear();
 		for (const account of data.accounts) for (const alias of workBuddyAccountIdAliases(account.credentials)) if (alias !== account.id) this.legacyIds.set(alias, account.id);
 		return data;
@@ -26185,20 +26323,34 @@ var WorkBuddyAccountPool = class extends AccountPoolCore {
 	*/
 	async syncDesktopAccounts() {
 		const discovered = await this.store.discoverDesktopCredentials();
-		if (discovered.length > 0) {
-			const data = await this.read();
-			const known = new Set(data.accounts.map((account) => workBuddyAccountId(account.credentials)));
-			const seen = /* @__PURE__ */ new Set();
-			for (const credentials of discovered) {
-				const id = workBuddyAccountId(credentials);
-				if (known.has(id) || seen.has(id)) continue;
-				seen.add(id);
-				await this.addAccount({
-					...credentials,
-					source: "desktop"
-				});
+		const candidates = [];
+		const seen = /* @__PURE__ */ new Set();
+		for (const raw of discovered) {
+			const credentials = withResolvedIdentity({
+				...raw,
+				source: "desktop"
+			});
+			const id = workBuddyAccountId(credentials);
+			if (seen.has(id)) continue;
+			seen.add(id);
+			candidates.push(credentials);
+		}
+		if (candidates.length > 0) await this.updatePool((data) => {
+			const existingKeys = /* @__PURE__ */ new Set();
+			for (const account of data.accounts) {
+				existingKeys.add(account.id);
+				const key = this.hooks.dedupeKey?.(account.credentials);
+				if (key !== void 0) existingKeys.add(key);
 			}
-		}
+			for (const credentials of candidates) {
+				const key = this.hooks.dedupeKey?.(credentials);
+				const id = this.hooks.accountId?.(credentials);
+				if (key !== void 0 && existingKeys.has(key) || id !== void 0 && existingKeys.has(id)) continue;
+				this.addAccountToPool(data, credentials);
+				if (key !== void 0) existingKeys.add(key);
+				if (id !== void 0) existingKeys.add(id);
+			}
+		});
 		return this.listAccounts();
 	}
 	/**
@@ -26214,7 +26366,13 @@ var WorkBuddyAccountPool = class extends AccountPoolCore {
 		const live = await this.store.readDesktopFile(effective.account.sourceFile);
 		if (live === null) return effective;
 		if (isExpired(live)) return effective;
-		if (live.accessToken !== effective.credentials.accessToken) await this.updateAccountCredentials(effective.account.id, live).catch(() => void 0);
+		if (live.accessToken !== effective.credentials.accessToken) {
+			const updated = await this.updateAccountCredentials(effective.account.id, live, effective.credentials).catch(() => void 0);
+			if (updated) return {
+				account: updated,
+				credentials: updated.credentials
+			};
+		}
 		return {
 			account: effective.account,
 			credentials: live
@@ -26251,15 +26409,15 @@ var WorkBuddyAccountPool = class extends AccountPoolCore {
 		return super.addAccount(withResolvedIdentity(credentials), alias);
 	}
 	/**
-	* Delete one account.
+	* Remove one account inside a transaction.
 	*
 	* A desktop account is refused: the plugin does not own that credential file,
 	* so removing it from the pool would strand the IDE's session while telling
 	* the user their account was deleted. Hiding is the supported action there.
 	*/
-	async deleteAccount(accountId) {
-		if ((await this.read()).accounts.find((account) => account.id === accountId)?.source === "desktop") throw new Error("桌面账号由 CodeBuddy 客户端所有，只能隐藏，不能删除。");
-		await super.deleteAccount(accountId);
+	deleteAccountFromPool(data, accountId) {
+		if (data.accounts.find((account) => account.id === accountId)?.source === "desktop") throw new Error("桌面账号由 CodeBuddy 客户端所有，只能隐藏，不能删除。");
+		super.deleteAccountFromPool(data, accountId);
 	}
 };
 //#endregion
@@ -26351,6 +26509,17 @@ const OAUTH_BETA = "oauth-2025-04-20";
 const CLAUDE_CODE_BETA = "claude-code-20250219";
 /** Lets thinking blocks interleave with tool use across a multi-turn loop. */
 const INTERLEAVED_THINKING_BETA = "interleaved-thinking-2025-05-14";
+/**
+* Licenses `thinking.block_binding` in a request body.
+*
+* The field is not optional to license: the vendor documents that a body
+* carrying `block_binding` WITHOUT this beta is a 400 whose message ends
+* `block_binding: Extra inputs are not permitted` — every request, every turn.
+* The mid-convo thinking form always sends `block_binding`, so a request that
+* uses that form must carry this value. The reference sends it for exactly those
+* models (`THINKING_BINDING_CONTROLS_BETA`, pushed when `supportsMidConvoEffort`).
+*/
+const THINKING_BINDING_CONTROLS_BETA = "thinking-binding-controls-2026-08-01";
 /** Anthropic protocol revision sent as `anthropic-version`. */
 const ANTHROPIC_VERSION = "2023-06-01";
 /**
@@ -26380,12 +26549,18 @@ const ANTHROPIC_VERSION = "2023-06-01";
 * trades a clear refusal for an unpredictable one. Note that npm's `stable`
 * dist-tag can itself sit below a model's floor, so `latest` is the tag to read.
 *
+* It must also be at or above the release that FIRST SHIPPED each model in the
+* table, whether or not a floor for that model has been observed: upstream has
+* so far gated a new model on the release that added it (Opus 5.5 arrived in
+* 2.1.280 and is refused below 2.1.280). Claude Sonnet 5.5 arrived in 2.1.284,
+* so 2.1.283 could not be relied on to reach it; 2.1.285 is npm `latest`.
+*
 * It is still not a literal that only moves when this package is republished: a
 * user whose installed baseline has aged past the server's floor has to be able
 * to raise it without waiting for a release. Read the effective value with
 * {@link claudeCliVersion}, pin one with {@link setClaudeCliVersion}.
 */
-const CLAUDE_CLI_VERSION = "2.1.283";
+const CLAUDE_CLI_VERSION = "2.1.285";
 /**
 * Loopback callback port the subscription flow defaults to.
 *
@@ -26743,8 +26918,10 @@ function loopbackRedirectUri(port = DEFAULT_CALLBACK_PORT) {
 * LOCAL ADDITIONS — the rows the reference snapshot predates
 * ---------------------------------------------------------------------------
 *
-* `claude-opus-5-5` is the only such row today. The mirror list in the test is
-* `LOCALLY_CURATED_MODEL_IDS`; the two must be changed together.
+* `claude-opus-5-5` and `claude-sonnet-5-5` are the two such rows today. The
+* mirror list in the test is `LOCALLY_CURATED_MODEL_IDS`; the two must be
+* changed together. Sonnet 5.5's own reasons are recorded at its row; what
+* follows below is Opus 5.5's.
 *
 * It is CURATED rather than transcribed because the snapshot this table copies
 * has no entry for it, and the one thing a transcription table must never do is
@@ -26796,8 +26973,8 @@ function loopbackRedirectUri(port = DEFAULT_CALLBACK_PORT) {
 * the user has to reach.
 */
 /**
-* Fifteen rows: the snapshot's own 14, in the snapshot's own declaration order,
-* followed by the curated row the snapshot predates (see LOCAL ADDITIONS above).
+* Sixteen rows: the snapshot's own 14, in the snapshot's own declaration order,
+* followed by the curated rows the snapshot predates (see LOCAL ADDITIONS above).
 *
 * The order matters and is not cosmetic. The test asserts the snapshot's ids
 * appear in the table as a SUBSEQUENCE, so a curated row may be appended or
@@ -27065,7 +27242,26 @@ const CLAUDE_MODELS = Object.freeze([
 			"max"
 		],
 		canDisableThinking: false,
-		minCliVersion: "2.1.280"
+		minCliVersion: "2.1.280",
+		bindsThinkingToPrefix: true
+	},
+	{
+		id: "claude-sonnet-5-5",
+		name: "Claude Sonnet 5.5",
+		contextWindow: 1e6,
+		maxTokens: 128e3,
+		supportsImage: true,
+		supportsTemperature: false,
+		thinkingMode: "mid-convo",
+		reasoningEfforts: [
+			"low",
+			"medium",
+			"high",
+			"xhigh",
+			"max"
+		],
+		canDisableThinking: false,
+		bindsThinkingToPrefix: true
 	}
 ]);
 /** Every id the fallback table knows, in declaration order. */
@@ -27165,6 +27361,10 @@ function claudeThinkingMode(modelId, catalog) {
 function claudeModelSupportsTemperature(modelId, catalog) {
 	return resolveClaudeModel(modelId, catalog ?? CLAUDE_MODELS).supportsTemperature;
 }
+/** Whether one model runs the documented preserved-thinking prefix check. */
+function claudeModelBindsThinkingToPrefix(modelId, catalog) {
+	return resolveClaudeModel(modelId, catalog ?? CLAUDE_MODELS).bindsThinkingToPrefix === true;
+}
 /** Whether thinking can be turned off for one model. */
 function claudeModelCanDisableThinking(modelId, catalog) {
 	return resolveClaudeModel(modelId, catalog ?? CLAUDE_MODELS).canDisableThinking;
@@ -27990,6 +28190,7 @@ function claudeBetas(options = {}) {
 	if (options.model === void 0 || !isHaikuModel(options.model)) betas.push(CLAUDE_CODE_BETA);
 	betas.push(OAUTH_BETA);
 	if (options.thinking === true) betas.push(INTERLEAVED_THINKING_BETA);
+	if (options.thinkingBinding === true) betas.push(THINKING_BINDING_CONTROLS_BETA);
 	return betas;
 }
 /** The `User-Agent` value this line reports for one surface. */
@@ -28136,7 +28337,7 @@ async function performCatalogLoad(credentials, options) {
 	let models;
 	let live = false;
 	try {
-		const response = await fetchFn("https://api.anthropic.com/v1/models", {
+		const response = await fetchFn("https://api.anthropic.com/v1/models?limit=1000", {
 			method: "GET",
 			headers: buildClaudeHeaders(credentials.accessToken, { method: "GET" }),
 			signal: timeoutSignal(options.signal, DISCOVERY_TIMEOUT_MS)
@@ -28603,8 +28804,15 @@ function classifyFailure(status, bodyText, headers = {}) {
 		retryAfterMs: retryAfter
 	};
 	switch (envelope.type) {
-		case ERROR_TYPE.AUTHENTICATION:
 		case ERROR_TYPE.PERMISSION: return {
+			...base,
+			kind: "request",
+			message: envelope.message ?? "This Claude account is not permitted to use the requested resource.",
+			retryable: false,
+			accountScoped: false,
+			resetsAt: null
+		};
+		case ERROR_TYPE.AUTHENTICATION: return {
 			...base,
 			kind: "credential",
 			message: envelope.message ?? "Claude rejected the stored credential. Sign in again.",
@@ -28762,7 +28970,9 @@ function classifyFailure(status, bodyText, headers = {}) {
 *                everything, including a caller asking for thinking off: the
 *                block_binding exists so a prefix mismatch is dropped instead of
 *                surfacing as a persistent 400, and suppressing it is exactly
-*                how that 400 comes back.
+*                how that 400 comes back. The field is itself a 400 unless the
+*                request carries the thinking-binding-controls beta, so the
+*                adapter reads claudeBodyBindsThinking(body) to add it.
 *   adaptive  -> { type: 'adaptive', display: 'summarized' }, plus
 *                output_config = { effort } when an effort was named. The budget
 *                form is rejected by these models.
@@ -28855,11 +29065,12 @@ function classifyFailure(status, bodyText, headers = {}) {
 * 'error' event THROWS, because a severed reply flushed as a clean stop is a
 * wrong answer rather than a visible failure.
 *
-* Reasoning deltas are BUFFERED and emitted as one block at content_block_stop
-* (CHOICE, see emitPendingThinking): the signature that decides whether the
-* block may be replayed at all arrives at the END of the block, so a signed
-* block cannot be recognized before then, and a reasoning block that cannot be
-* replayed is not content the caller should be told it received.
+* Reasoning deltas are STREAMED as they arrive (see openThinkingBlock); only the
+* replay entry waits for content_block_stop, because the signature that decides
+* whether the block may be replayed arrives at the END of the block. They used
+* to be buffered until the stop, which made DSH start the step's first-token
+* clock after all thinking was done - so TPS divided every thinking token by the
+* answer's time alone, and TTFT absorbed the whole thinking phase.
 *
 * ---------------------------------------------------------------------------
 * 7. PROMPT CACHING IS ON BY DEFAULT, AND IT IS THE REQUEST THAT TURNS IT ON
@@ -28958,9 +29169,17 @@ function jsonSafeValue(value, seen = /* @__PURE__ */ new WeakSet()) {
 		seen.delete(value);
 	}
 }
-/** Strip a NUL that would truncate the string inside a JSON encoder. */
+/**
+* Strip what the wire cannot carry: a NUL, which would truncate the string
+* inside a JSON encoder, and an UNPAIRED surrogate. JSON.stringify writes the
+* latter as a lone `\uD83D` escape, which upstream rejects as invalid JSON ("no
+* low surrogate in string") - and since the text sits in history, every later
+* request fails the same way. A tool output sliced mid-emoji is enough to
+* produce one. Paired surrogates (emoji) are untouched. Same rule as the
+* reference's sanitizeSurrogates.
+*/
 function sanitizeText(text) {
-	return text.replace(/\0/g, "");
+	return text.replace(/\0|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g, "");
 }
 /**
 * Whether one failure is a cancellation rather than a real read failure.
@@ -29175,7 +29394,8 @@ function claudeThinking(model, effort, level, maxTokens, customBudgets) {
 	if (mode === "adaptive") return {
 		thinking: {
 			type: "adaptive",
-			display: "summarized"
+			display: "summarized",
+			...claudeModelBindsThinkingToPrefix(model) ? { block_binding: { prefix_mismatch_behavior: "drop_block" } } : {}
 		},
 		...namedEffort === void 0 ? {} : { outputConfig: { effort: namedEffort } }
 	};
@@ -29738,9 +29958,10 @@ function toolResultContent(blocks, images) {
 	for (const block of blocks) {
 		if (!isRecord$5(block)) continue;
 		if (block.type === "text" && typeof block.text === "string") {
-			out.push({
+			const text = sanitizeText(block.text);
+			if (text !== "") out.push({
 				type: "text",
-				text: sanitizeText(block.text)
+				text
 			});
 			continue;
 		}
@@ -29760,7 +29981,7 @@ function toolResultContent(blocks, images) {
 	if (!hasImage) return void 0;
 	if (out[0]?.type !== "text") out.unshift({
 		type: "text",
-		text: ""
+		text: "(see attached image)"
 	});
 	return out;
 }
@@ -29889,6 +30110,17 @@ function buildClaudeRequestBody(options, images = NO_RESOLVED_IMAGES, request =
 	return body;
 }
 /**
+* Whether one built body carries `thinking.block_binding`.
+*
+* Read off the BODY rather than re-derived from the catalog, because the header
+* this answers for (THINKING_BINDING_CONTROLS_BETA) exists to license that one
+* field: sent without it the field is a 400 on every request, so the header must
+* follow the bytes, not a second copy of the rule that produced them.
+*/
+function claudeBodyBindsThinking(body) {
+	return isRecord$5(body.thinking) && body.thinking.block_binding !== void 0;
+}
+/**
 * Fresh stream state.
 *
 * @param toolNames - the SAME ClaudeToolNames the request was built with, so a
@@ -29913,6 +30145,7 @@ function createStreamState$1(toolNames) {
 		cacheReadTokens: 0,
 		cacheWriteTokens: 0,
 		reasoningTokens: 0,
+		reportedReasoningTokens: void 0,
 		sawUsage: false,
 		finished: false
 	};
@@ -30009,14 +30242,15 @@ function closeToolCall(state, contentIndex) {
 	}];
 }
 /**
-* Emit one buffered thinking block.
+* Close one thinking block: end it for the caller and record its replay entry.
 *
-* A signed block is emitted as DSH reasoning and replayed verbatim afterwards.
-* An unsigned one is emitted WITHOUT a replay entry: it is still shown to the
-* caller (the model did think, and hiding it would misreport the turn) but it
-* cannot be sent back, and the request builder drops it on the next turn.
+* Its text already reached the caller as it streamed (see openThinkingBlock);
+* what waits for the close is the replay entry, because the signature arrives
+* last. A signed block is replayed verbatim afterwards. An unsigned one is
+* still shown (the model did think) but the request builder drops it on the
+* next turn, since it cannot be sent back.
 */
-function emitPendingThinking(state, contentIndex) {
+function closeThinkingBlock(state, contentIndex) {
 	const pending = state.pending.get(contentIndex);
 	if (pending === void 0) return [];
 	state.pending.delete(contentIndex);
@@ -30036,20 +30270,45 @@ function emitPendingThinking(state, contentIndex) {
 		...pending.signature === "" ? {} : { signature: pending.signature }
 	};
 	state.reasoningTokens += estimateReasoningTokens(text);
+	return [{
+		type: "block-end",
+		index: pending.index,
+		block
+	}];
+}
+/**
+* Open one thinking block and stream whatever text its start already carries.
+*
+* STREAMED, not held to content_block_stop: DSH times a step's first token from
+* the first non-empty delta, and the usage it divides by that window counts every
+* thinking token. Holding the text until the block closed started the clock
+* after all the thinking was done - inflating TPS and TTFT alike - and kept the
+* UI blank for the whole thinking phase. Only the replay entry waits for the
+* close, because the signature arrives last.
+*/
+function openThinkingBlock(state, contentIndex, block, kind) {
+	const index = state.blocks.length;
+	state.blocks.push({
+		type: "reasoning",
+		text: ""
+	});
+	const seed = kind === "thinking" ? asString$2(block.thinking) ?? "" : "";
+	state.pending.set(contentIndex, {
+		index,
+		kind,
+		text: seed,
+		signature: asString$2(block.signature) ?? "",
+		data: asString$2(block.data) ?? ""
+	});
 	const out = [{
 		type: "block-start",
-		index: pending.index,
+		index,
 		blockType: "reasoning"
 	}];
-	if (text !== "") out.push({
+	if (seed !== "") out.push({
 		type: "reasoning-delta",
-		index: pending.index,
-		text
-	});
-	out.push({
-		type: "block-end",
-		index: pending.index,
-		block
+		index,
+		text: seed
 	});
 	return out;
 }
@@ -30066,7 +30325,7 @@ function flushOpenBlocks(state) {
 	});
 	for (const [contentIndex, pending] of state.pending) closers.push({
 		index: pending.index,
-		close: () => emitPendingThinking(state, contentIndex)
+		close: () => closeThinkingBlock(state, contentIndex)
 	});
 	closers.sort((left, right) => left.index - right.index);
 	const out = [];
@@ -30085,17 +30344,25 @@ function flushOpenBlocks(state) {
 * the billed-input total unaccountable.
 */
 function tokenUsage(state) {
+	const reasoningTokens = Math.min(state.reportedReasoningTokens ?? state.reasoningTokens, state.outputTokens);
 	return {
 		inputTokens: state.inputTokens,
 		outputTokens: state.outputTokens,
 		...state.cacheReadTokens > 0 ? { cacheReadTokens: state.cacheReadTokens } : {},
 		...state.cacheWriteTokens > 0 ? { cacheWriteTokens: state.cacheWriteTokens } : {},
-		...state.reasoningTokens > 0 ? { reasoningTokens: state.reasoningTokens } : {}
+		...reasoningTokens > 0 ? { reasoningTokens } : {}
 	};
 }
 function finishReasonFor(state) {
 	const reason = state.finishReason ?? "";
-	if (reason === "max_tokens") return { kind: "max-tokens" };
+	if (reason === "refusal" || reason === "sensitive") return {
+		kind: "error",
+		failure: {
+			message: state.stopExplanation ?? "Claude declined to respond (stop_reason: " + reason + ").",
+			code: "PROVIDER_ERROR"
+		}
+	};
+	if (reason === "max_tokens" || reason === "model_context_window_exceeded") return { kind: "max-tokens" };
 	if (state.hasToolCall || reason === "tool_use") return { kind: "tool-calls" };
 	return { kind: "stop" };
 }
@@ -30143,6 +30410,8 @@ function applyUsage(state, usage, cumulativeOutput) {
 	if (usage.cache_creation_input_tokens !== void 0) state.cacheWriteTokens = numberOr(usage.cache_creation_input_tokens, state.cacheWriteTokens);
 	if (usage.cache_read_input_tokens !== void 0) state.cacheReadTokens = numberOr(usage.cache_read_input_tokens, state.cacheReadTokens);
 	if (usage.output_tokens !== void 0) state.outputTokens = cumulativeOutput ? numberOr(usage.output_tokens, state.outputTokens) : state.outputTokens + numberOr(usage.output_tokens, 0);
+	const details = isRecord$5(usage.output_tokens_details) ? usage.output_tokens_details : void 0;
+	if (details !== void 0 && details.thinking_tokens !== void 0) state.reportedReasoningTokens = numberOr(details.thinking_tokens, state.reportedReasoningTokens ?? 0);
 }
 /**
 * Feed one SSE line of a Messages response into the state.
@@ -30213,19 +30482,8 @@ function processStreamLine(line, state) {
 			return out;
 		}
 		if (blockType === "thinking" || blockType === "redacted_thinking") {
-			if (state.pending.get(contentIndex) !== void 0) out.push(...emitPendingThinking(state, contentIndex));
-			const index = state.blocks.length;
-			state.blocks.push({
-				type: "reasoning",
-				text: ""
-			});
-			state.pending.set(contentIndex, {
-				index,
-				kind: blockType === "redacted_thinking" ? "redacted_thinking" : "thinking",
-				text: asString$2(block.thinking) ?? "",
-				signature: asString$2(block.signature) ?? "",
-				data: asString$2(block.data) ?? ""
-			});
+			out.push(...closeThinkingBlock(state, contentIndex));
+			out.push(...openThinkingBlock(state, contentIndex, block, blockType));
 			return out;
 		}
 		out.push(...openTextAt(state, contentIndex).chunks);
@@ -30258,8 +30516,14 @@ function processStreamLine(line, state) {
 		}
 		if (deltaType === "thinking_delta") {
 			const pending = state.pending.get(contentIndex);
-			const text = asString$2(delta.thinking) ?? "";
-			if (pending !== void 0 && text !== "") pending.text += sanitizeText(text);
+			const text = sanitizeText(asString$2(delta.thinking) ?? "");
+			if (pending === void 0 || pending.kind !== "thinking" || text === "") return out;
+			pending.text += text;
+			out.push({
+				type: "reasoning-delta",
+				index: pending.index,
+				text
+			});
 			return out;
 		}
 		const text = asString$2(delta.text) ?? "";
@@ -30278,13 +30542,16 @@ function processStreamLine(line, state) {
 	if (type === "content_block_stop") {
 		const contentIndex = numberOr(event.index, -1);
 		if (state.toolCalls.has(contentIndex)) return closeToolCall(state, contentIndex);
-		if (state.pending.has(contentIndex)) return emitPendingThinking(state, contentIndex);
+		if (state.pending.has(contentIndex)) return closeThinkingBlock(state, contentIndex);
 		return closeTextBlock(state, contentIndex);
 	}
 	if (type === "message_delta") {
 		const delta = isRecord$5(event.delta) ? event.delta : void 0;
 		const stop = delta === void 0 ? void 0 : asString$2(delta.stop_reason);
 		if (stop !== void 0 && stop !== "") state.finishReason = stop;
+		const details = delta !== void 0 && isRecord$5(delta.stop_details) ? delta.stop_details : void 0;
+		const explanation = details === void 0 ? void 0 : asString$2(details.explanation);
+		if (explanation !== void 0 && explanation !== "") state.stopExplanation = explanation;
 		const usage = isRecord$5(event.usage) ? event.usage : void 0;
 		if (usage !== void 0) applyUsage(state, usage, true);
 		return out;
@@ -30719,7 +30986,7 @@ async function refreshAccessToken(refreshToken, options = {}) {
 		try {
 			return await postTokenGrant(body, options, false, [refreshToken]);
 		} catch (error) {
-			if (error instanceof ClaudeUnauthorizedError) throw error;
+			if (!(error instanceof ClaudeRetryableError)) throw error;
 			lastError = error;
 		}
 		if (attempt < REFRESH_MAX_ATTEMPTS - 1) await sleep(REFRESH_BACKOFF_BASE_MS * 2 ** attempt, options.signal);
@@ -31804,19 +32071,20 @@ var ClaudeAdapter = class extends LlmAdapter {
 	* no credentials were resolved for it.
 	*/
 	async attemptRequest(credentials, requestOptions, images, toolNames, thinking, signal, fetchFn) {
-		const body = JSON.stringify(buildClaudeRequestBody(requestOptions, images, {
+		const payload = buildClaudeRequestBody(requestOptions, images, {
 			toolNames,
 			cacheControl: true
-		}));
+		});
 		try {
 			return await fetchFn("https://api.anthropic.com/v1/messages?beta=true", {
 				method: "POST",
 				headers: buildClaudeHeaders(credentials.accessToken, {
 					model: requestOptions.model,
 					thinking,
+					thinkingBinding: claudeBodyBindsThinking(payload),
 					method: "POST"
 				}),
-				body,
+				body: JSON.stringify(payload),
 				signal
 			});
 		} catch (error) {
@@ -32467,7 +32735,7 @@ function isAdoptedCredentialExpired(credential, now = Date.now()) {
 * caller in the process, so with a pool it would hand the second account the
 * first account's freshly rotated credential — and, through the adapter above,
 * write it into the second account's record. The pool therefore keeps its OWN
-* single-flight, per account (see the inFlight map), which preserves the property
+* single-flight, per pool file and account, which preserves the property
 * the frozen module wanted (one rotation per expiry, no two callers spending the
 * same rotating token) without the cross-account contamination.
 *
@@ -32853,7 +33121,6 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 	* marked expired immediately after a refresh that in fact succeeded. Keyed by
 	* the record's id — never by a token — so it cannot mix two accounts up.
 	*/
-	inFlight = /* @__PURE__ */ new Map();
 	constructor(options = {}) {
 		const store = options.store ?? new FileCredentialStore();
 		const refreshSeam = options.refreshCredentials ?? ((credentials, fetchFn) => refreshClaudeCredential(credentials, fetchFn));
@@ -32900,6 +33167,10 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 				if (record === void 0) return null;
 				return poolAccountForRecord(record, true);
 			},
+			credentialsCommitted: async (account) => {
+				if (isAdoptedPoolCredential(account.credentials)) return;
+				await store.saveAccount(account.credentials, { internalId: account.id });
+			},
 			mirrorPrimary: async (credentials) => {
 				if (credentials === null) {
 					await store.delete();
@@ -32961,8 +33232,8 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 	* {@link recordIdsFor} reads is kept in step with the rows that actually exist.
 	* See the recordIds field for why entries are not pruned.
 	*/
-	async read() {
-		const data = await super.read();
+	async loadPoolData() {
+		const data = await super.loadPoolData();
 		for (const account of data.accounts) this.indexAccount(account);
 		return data;
 	}
@@ -32975,10 +33246,27 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 	* 'one account, one key' section.
 	*/
 	async addAccount(credentials, alias) {
-		const data = await this.read();
+		return this.updatePool((data) => this.addManagedAccount(data, credentials, alias)).catch((error) => {
+			this.recordIds.clear();
+			throw error;
+		});
+	}
+	async addManagedAccount(data, credentials, alias) {
 		if (isAdoptedPoolCredential(credentials)) return this.addAdoptedAccount(credentials, data, alias);
+		parseClaudeCredentials(credentials);
 		const knownId = await this.recordIdFor(credentials);
-		const record = await this.store.saveAccount(credentials);
+		const document = await this.store.read();
+		const keys = identityKeysFor(credentials);
+		const stored = document?.accounts.find((record) => record.identityKeys.some((key) => keys.includes(key)));
+		const record = stored === void 0 ? {
+			internalId: data.accounts.find((account) => account.id === knownId)?.adopted === false ? knownId ?? createInternalId() : createInternalId(),
+			identityKeys: keys,
+			credentials
+		} : {
+			...stored,
+			identityKeys: mergeIdentityKeys(stored.identityKeys, keys),
+			credentials
+		};
 		this.indexRecord(record);
 		if (knownId !== void 0 && knownId !== record.internalId) {
 			const row = data.accounts.find((account) => account.id === knownId);
@@ -32990,10 +33278,9 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 				delete row.sourcePath;
 				row.identityKeys = mergeIdentityKeys(row.identityKeys, record.identityKeys);
 				if (data.activeAccountId === knownId) data.activeAccountId = record.internalId;
-				await this.write(data);
 			}
 		}
-		return super.addAccount(credentials, alias);
+		return this.addAccountToPool(data, credentials, alias);
 	}
 	/**
 	* Add, or re-import, one borrowed Claude Code snapshot.
@@ -33022,9 +33309,7 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 		const candidateId = byIdentity ?? this.recordIds.get(sourceKey);
 		const existing = candidateId === void 0 ? void 0 : data.accounts.find((account) => account.id === candidateId);
 		if (existing !== void 0 && existing.adopted !== true) {
-			const before = existing.identityKeys.length;
 			existing.identityKeys = mergeIdentityKeys(existing.identityKeys, identityKeysFor(credentials));
-			if (existing.identityKeys.length !== before) await this.write(data);
 			return existing;
 		}
 		if (candidateId === void 0) {
@@ -33035,7 +33320,7 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 			this.recordIds.set(sourceKey, candidateId);
 			this.indexCredential(credentials, candidateId);
 		}
-		return super.addAccount(credentials, alias);
+		return this.addAccountToPool(data, credentials, alias);
 	}
 	/**
 	* Merge two rows that are one account.
@@ -33058,7 +33343,21 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 	*/
 	async mergeAccounts(keepAccountId, dropAccountId) {
 		if (keepAccountId === dropAccountId) throw new Error("A Claude pool merge needs two different accounts.");
-		const data = await this.read();
+		let originals;
+		return await this.updatePool(async (data) => {
+			const keep = data.accounts.find((account) => account.id === keepAccountId);
+			const drop = data.accounts.find((account) => account.id === dropAccountId);
+			if (keep === void 0 || drop === void 0) throw new Error("The Claude pool merge addressed an account the pool does not have.");
+			originals = {
+				keep,
+				drop
+			};
+			return this.mergeAccountsInPool(data, keepAccountId, dropAccountId);
+		}, async (_data, result) => {
+			if (originals !== void 0) await this.reconcileMergedDocument(originals.keep, originals.drop, result);
+		});
+	}
+	async mergeAccountsInPool(data, keepAccountId, dropAccountId) {
 		const keep = data.accounts.find((account) => account.id === keepAccountId);
 		const drop = data.accounts.find((account) => account.id === dropAccountId);
 		if (keep === void 0 || drop === void 0) throw new Error("The Claude pool merge addressed an account the pool does not have.");
@@ -33107,9 +33406,6 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 		data.accounts[index] = merged;
 		data.accounts = data.accounts.filter((account) => account.id !== dropAccountId);
 		if (data.activeAccountId === dropAccountId) data.activeAccountId = merged.id;
-		await this.write(data);
-		if (merged.isPrimary) this.hooks.mirrorPrimary?.(merged.credentials).catch(() => void 0);
-		await this.reconcileMergedDocument(keep, drop, merged);
 		return merged;
 	}
 	/**
@@ -33149,10 +33445,12 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 	* neither path.
 	*/
 	async removeImportedAccount(accountId) {
-		const target = (await this.read()).accounts.find((account) => account.id === accountId);
-		if (target === void 0) return;
-		if (target.adopted !== true) throw new Error("That account was signed in through this plugin; delete it instead of removing an import.");
-		await super.deleteAccount(accountId);
+		return this.updatePool((data) => {
+			const target = data.accounts.find((account) => account.id === accountId);
+			if (target === void 0) return;
+			if (target.adopted !== true) throw new Error("That account was signed in through this plugin; delete it instead of removing an import.");
+			super.deleteAccountFromPool(data, accountId);
+		});
 	}
 	/**
 	* Delete one plugin-owned account.
@@ -33165,9 +33463,12 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 	* back a credential the user just deleted.
 	*/
 	async deleteAccount(accountId) {
-		if ((await this.read()).accounts.find((account) => account.id === accountId)?.adopted === true) throw new Error("The sign-in imported from Claude Code is not an account this plugin owns; remove the import instead.");
-		await super.deleteAccount(accountId);
-		await this.store.deleteAccount(accountId);
+		return this.updatePool((data) => {
+			if (data.accounts.find((account) => account.id === accountId)?.adopted === true) throw new Error("The sign-in imported from Claude Code is not an account this plugin owns; remove the import instead.");
+			super.deleteAccountFromPool(data, accountId);
+		}, async () => {
+			await this.store.deleteAccount(accountId);
+		});
 	}
 	/**
 	* The immutable id of the record that owns a credential, or nothing.
@@ -33247,44 +33548,7 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 	*/
 	refreshCredentials(credentials, fetchFn) {
 		if (isAdoptedPoolCredential(credentials)) return Promise.reject(new ClaudeAdoptedCredentialError(adoptedCredentialExpired(credentials) ? ADOPTED_CREDENTIAL_EXPIRED_HINT : ADOPTED_NEVER_REFRESHED_MESSAGE));
-		return this.singleFlightRefresh(credentials, fetchFn);
-	}
-	/**
-	* The per-account single-flight, resolving the account's id first.
-	*
-	* Separated from the hook above only because resolving the id consults the
-	* credential document, and a hook cannot await: the guard stays synchronous so
-	* it can never be skipped by a caller that forgets to wait.
-	*/
-	async singleFlightRefresh(credentials, fetchFn) {
-		const key = await this.recordIdFor(credentials);
-		if (key !== void 0) {
-			const shared = this.inFlight.get(key);
-			if (shared !== void 0) return shared;
-		}
-		const pending = this.performRefresh(credentials, fetchFn);
-		if (key !== void 0) {
-			this.inFlight.set(key, pending);
-			pending.then(() => void 0, () => void 0).then(() => {
-				if (this.inFlight.get(key) === pending) this.inFlight.delete(key);
-			});
-		}
-		return pending;
-	}
-	/**
-	* Rotate one managed credential and keep the credential document in step.
-	*
-	* The document write is what stops the pre-pool projection from handing out a
-	* token the rotation has already spent. Its failure is swallowed on purpose:
-	* the credential WAS refreshed, the pool's own record holds it, and a mirror
-	* that could not be written must not fail a request that can still be served —
-	* the same rule the core applies to its own bookkeeping writes.
-	*/
-	async performRefresh(credentials, fetchFn) {
-		const recordId = await this.recordIdFor(credentials);
-		const refreshed = await this.refreshSeam(credentials, fetchFn);
-		if (recordId !== void 0) await new ClaudeCredentialStoreAdapter(this.store, recordId).write(refreshed).catch(() => void 0);
-		return refreshed;
+		return this.refreshSeam(credentials, fetchFn);
 	}
 };
 //#endregion
@@ -33586,24 +33850,18 @@ function registerClaudeRoutes(ctx, store, modelSettings, preferences, options =
 	* is addressed at THAT account, which is what makes a re-login repair the row
 	* the user clicked instead of adding a second one.
 	*/
-	const loginStore = (accountId) => {
-		const base = pool !== void 0 && accountId !== void 0 ? pool.credentialStoreFor(accountId) : {
-			read: async () => (await activeAccount()).credentials ?? null,
-			write: async (credentials) => {
-				if (pool !== void 0) await pool.addAccount(credentials);
-				else await store.saveAccount(credentials);
-			}
-		};
-		return {
-			read: () => base.read(),
-			write: async (credentials) => {
-				await base.write(credentials);
-				if (pool !== void 0 && accountId !== void 0) await pool.clearAuthFailed(accountId).catch(() => void 0);
-				clearCachedQuota$1();
-				clearCachedCatalog();
+	const loginStore = (accountId) => ({
+		read: async () => pool !== void 0 && accountId !== void 0 ? pool.credentialStoreFor(accountId).read() : (await activeAccount()).credentials ?? null,
+		write: async (credentials) => {
+			if (pool === void 0) await store.saveAccount(credentials);
+			else {
+				const landed = await pool.addAccount(credentials);
+				if (accountId !== void 0 && landed.id === accountId) await pool.clearAuthFailed(accountId).catch(() => void 0);
 			}
-		};
-	};
+			clearCachedQuota$1();
+			clearCachedCatalog();
+		}
+	});
 	const readStatus = (quotaError = null) => activeAccount().then((active) => getClaudeWebStatus(store, modelSettings, preferences, options, quotaError, active));
 	return ctx.webServer.register({
 		kind: "prefix",
@@ -37008,9 +37266,9 @@ function appendWindow(current, addition, limit) {
 /**
 * Install the reasoning-collapse guard on a Context.
 *
-* The guard is inert unless the host exposes the `llm/stream` seam, so a
-* harness without it keeps the built-in behaviour instead of failing this
-* plugin's load.
+* The guard is inert unless the host exposes the event bus, so a harness
+* without it keeps the built-in behaviour instead of failing this plugin's
+* load.
 *
 * Resuming needs the live Agent for `cancel` and `steer`, and no supported
 * generation hands the agent to `llm/stream`. `agent/created` reports it on
@@ -37020,19 +37278,19 @@ function appendWindow(current, addition, limit) {
 *
 * @param ctx - plugin context.
 * @param options - see {@link GuardOptions}; validated fail-loud.
-* @returns a disposer, or undefined when the seam is unavailable.
+* @returns a disposer removing both listeners, or undefined when the host
+* exposes no event bus.
 */
 function installReasoningCollapseGuard(ctx, options = {}) {
 	const resolved = resolveGuardOptions(options);
-	const runtime = ctx.llm;
-	if (runtime === void 0 || typeof runtime.stream !== "function") return void 0;
-	const original = runtime.stream;
+	if (typeof ctx.on !== "function") return void 0;
 	const watched = new Set(resolved.includeModels);
 	const breakers = /* @__PURE__ */ new WeakMap();
 	let currentAgent;
-	const releaseAgent = typeof ctx.on === "function" ? ctx.on("agent/created", ({ agent }) => {
-		currentAgent = agent;
-	}) : void 0;
+	const releaseAgent = ctx.on("agent/created", (payload) => {
+		currentAgent = payload.agent;
+	});
+	const releaseStream = ctx.on("llm/stream", guardStream, { global: true });
 	function breakerFor(key) {
 		let state = breakers.get(key);
 		if (state === void 0) {
@@ -37070,7 +37328,7 @@ function installReasoningCollapseGuard(ctx, options = {}) {
 			agent.steer?.(createResumeMessage(text));
 		});
 	}
-	runtime.stream = function reasoningCollapseGuardStream(request, next) {
+	function guardStream(request, next) {
 		const state = breakerFor(request.signal ?? STATIC_KEY);
 		if (state.exhausted || !watchedModel(request.model)) return next();
 		async function* guarded() {
@@ -37092,9 +37350,9 @@ function installReasoningCollapseGuard(ctx, options = {}) {
 			}
 		}
 		return guarded();
-	};
+	}
 	return () => {
-		runtime.stream = original;
+		releaseListener(releaseStream);
 		releaseListener(releaseAgent);
 	};
 }
@@ -37186,7 +37444,7 @@ function apply(ctx, pluginConfig = {}) {
 		ctx.effect(() => {
 			const dispose = installReasoningCollapseGuard(ctx, guardOptions);
 			if (dispose === void 0) {
-				ctx.logger.warn("[dsh-chatgpt-subscription] reasoning-collapse guard skipped: this harness exposes no llm/stream seam");
+				ctx.logger.warn("[dsh-chatgpt-subscription] reasoning-collapse guard skipped: this harness exposes no event bus");
 				return () => void 0;
 			}
 			return dispose;