@eddyskywalker/dsh-chatgpt-subscription 0.10.11 → 0.10.12

package/lib/index.js

@@ -905,6 +905,16 @@ function poolCredentialAccount$1(filePath) {
 	return createHash("sha256").update(path.resolve(filePath)).digest("hex");
 }
 const poolOperations = /* @__PURE__ */ new Map();
+const poolIdentityRevisions = /* @__PURE__ */ new Map();
+const poolRefreshes = /* @__PURE__ */ new Map();
+/**
+* A selected row was deleted, or became unusable, while a caller awaited it.
+*
+* Distinct from every other credential error because a MODEL REQUEST can still
+* be served by another account: routing excludes the row and tries the next
+* one, while a caller that named the account still gets the plain refusal.
+*/
+var PoolAccountUnavailableError = class extends LlmError {};
 /**
 * The shared multi-account pool: encrypted storage, eligibility filtering,
 * rotation strategy, 429 cooldowns and per-account auth failures.
@@ -926,11 +936,14 @@ var AccountPoolCore = class {
 	* can therefore invalidate on identity change without paying a credential read
 	* to discover it.
 	*/
-	identityRevision = 0;
+	/** Pool-file identity of this instance: locks, revisions and flights key on it. */
+	operationKey;
 	constructor(hooks) {
 		this.hooks = hooks;
 		this.filePath = hooks.poolFile;
 		this.backend = hooks.backend ?? createPoolBackend(hooks);
+		const resolved = path.resolve(this.filePath);
+		this.operationKey = process.platform === "win32" ? resolved.toLowerCase() : resolved;
 	}
 	/**
 	* A cheap, in-memory revision of the pool's serving identity.
@@ -946,15 +959,21 @@ var AccountPoolCore = class {
 	* would report one account's usage under another account's name.
 	*/
 	currentIdentityRevision() {
-		return this.identityRevision;
+		return poolIdentityRevisions.get(this.operationKey) ?? 0;
 	}
 	/** Human description of where this pool's credentials live. */
 	path() {
 		if (process.platform === "win32") return `${this.filePath}.dpapi`;
 		return `${process.platform === "darwin" ? "Keychain" : "Secret Service"}: ${this.hooks.keychainService}/${poolCredentialAccount$1(this.filePath)}`;
 	}
+	/**
+	* Queue one storage transaction for this pool file.
+	*
+	* NOT reentrant: a transaction must use {@link loadPoolData} and
+	* {@link updatePool} rather than calling the public read/write methods.
+	*/
 	serialize(operation) {
-		const key = path.resolve(this.filePath);
+		const key = this.operationKey;
 		const result = (poolOperations.get(key) || Promise.resolve()).then(operation);
 		const settled = result.then(() => void 0, () => void 0);
 		poolOperations.set(key, settled);
@@ -978,31 +997,74 @@ var AccountPoolCore = class {
 	* getter write to disk.
 	*/
 	read() {
-		return this.serialize(async () => {
-			let current = null;
-			try {
-				current = await this.backend.load();
-			} catch {}
-			if (current !== null && Array.isArray(current.accounts) && current.accounts.length > 0) return current;
-			try {
-				const legacy = await this.hooks.legacyAccount?.();
-				if (legacy) return {
-					version: 1,
-					activeAccountId: legacy.id,
-					rotationStrategy: current?.rotationStrategy || "sequential",
-					accounts: [legacy]
-				};
-			} catch {}
-			return current || {
+		return this.serialize(() => this.loadPoolData());
+	}
+	/**
+	* Load the pool without holding the file lock.
+	*
+	* Providers override this to maintain their own in-memory indexes, so every
+	* load — including one inside {@link updatePool} — refreshes them.
+	*/
+	async loadPoolData() {
+		let current = null;
+		try {
+			current = await this.backend.load();
+		} catch {}
+		if (current !== null && Array.isArray(current.accounts) && current.accounts.length > 0) return current;
+		try {
+			const legacy = await this.hooks.legacyAccount?.();
+			if (legacy) return {
 				version: 1,
-				rotationStrategy: "sequential",
-				accounts: []
+				activeAccountId: legacy.id,
+				rotationStrategy: current?.rotationStrategy || "sequential",
+				accounts: [legacy]
 			};
-		});
+		} catch {}
+		return current || {
+			version: 1,
+			rotationStrategy: "sequential",
+			accounts: []
+		};
+	}
+	async persistPoolData(data) {
+		poolIdentityRevisions.set(this.operationKey, this.currentIdentityRevision() + 1);
+		await this.saveVerified(data);
 	}
+	/**
+	* Replace the whole document (initialization, import), NOT a read-modify-write.
+	* Prefer {@link updatePool} for mutations so the draft is read under the lock.
+	*/
 	write(data) {
-		this.identityRevision += 1;
-		return this.serialize(() => this.saveVerified(this.hooks.parsePoolData(data)));
+		return this.serialize(() => this.persistPoolData(data));
+	}
+	/**
+	* Read the LATEST document, mutate it and persist it as one file transaction.
+	*
+	* This is the whole fix for the read-modify-write race: the old shape read a
+	* snapshot, awaited (a token refresh, a settings write, an encrypted round
+	* trip) and then wrote that whole stale snapshot back, erasing whatever landed
+	* in between — including another account's freshly rotated token.
+	*
+	* The callback runs under the file lock, so it must not call read, write or
+	* updatePool (the lock is not reentrant) and must not do network I/O.
+	* Provider-local stores belong in `afterCommit`, which runs only once the
+	* pool write is verified, and must not re-enter the pool either.
+	*/
+	updatePool(mutate, afterCommit) {
+		return this.serialize(async () => {
+			const data = await this.loadPoolData();
+			const before = structuredClone(data);
+			const result = await mutate(data);
+			if (!isDeepStrictEqual(before, data)) {
+				await this.persistPoolData(data);
+				await afterCommit?.(data, result).catch(() => void 0);
+				for (const account of data.accounts) if (!isDeepStrictEqual(before.accounts.find((entry) => entry.id === account.id)?.credentials, account.credentials)) await this.hooks.credentialsCommitted?.(account).catch(() => void 0);
+				const previousPrimary = before.accounts.find((account) => account.isPrimary);
+				const primary = data.accounts.find((account) => account.isPrimary);
+				if (previousPrimary?.id !== primary?.id || !isDeepStrictEqual(previousPrimary?.credentials, primary?.credentials)) await this.hooks.mirrorPrimary?.(primary?.credentials ?? null).catch(() => void 0);
+			}
+			return result;
+		});
 	}
 	/** Public summaries, with cooldowns that already expired reported as absent. */
 	async listAccounts() {
@@ -1031,8 +1093,17 @@ var AccountPoolCore = class {
 		return this.hooks.extendSummary ? this.hooks.extendSummary(account, summary, now) : summary;
 	}
 	/** Add or re-authorize one account; an existing dedupe key updates in place. */
-	async addAccount(credentials, alias) {
-		const data = await this.read();
+	addAccount(credentials, alias) {
+		return this.updatePool((data) => this.addAccountToPool(data, credentials, alias));
+	}
+	/**
+	* Add or re-authorize inside an existing transaction.
+	*
+	* Capacity, dedupe and the primary decision are all taken against the live
+	* document, so two simultaneous sign-ins cannot each pass a check the other
+	* has already invalidated.
+	*/
+	addAccountToPool(data, credentials, alias) {
 		const key = this.hooks.dedupeKey?.(credentials);
 		const existingIndex = key === void 0 ? -1 : data.accounts.findIndex((account) => this.hooks.dedupeKey?.(account.credentials) === key);
 		const maxAccounts = this.hooks.maxAccounts ?? 20;
@@ -1058,77 +1129,79 @@ var AccountPoolCore = class {
 		if (existingIndex >= 0) data.accounts[existingIndex] = account;
 		else data.accounts.push(account);
 		if (!data.activeAccountId || account.isPrimary) data.activeAccountId = account.id;
-		await this.write(data);
-		if (account.isPrimary) this.hooks.mirrorPrimary?.(credentials).catch(() => void 0);
 		return account;
 	}
-	async setPrimary(accountId) {
-		const data = await this.read();
-		for (const account of data.accounts) account.isPrimary = account.id === accountId;
-		const primary = data.accounts.find((account) => account.isPrimary);
-		if (primary) {
-			data.activeAccountId = primary.id;
-			this.hooks.mirrorPrimary?.(primary.credentials).catch(() => void 0);
-		}
-		await this.write(data);
+	setPrimary(accountId) {
+		return this.updatePool((data) => {
+			for (const account of data.accounts) account.isPrimary = account.id === accountId;
+			const primary = data.accounts.find((account) => account.isPrimary);
+			if (primary) data.activeAccountId = primary.id;
+		});
 	}
 	/**
 	* Persist a refreshed credential for one account.
 	*
+	* `expected` makes this a conditional write: when the stored credential is
+	* no longer the one the caller started from, something newer won the race (a
+	* re-login, a rotation committed while this call was in flight) and the
+	* latest row is returned WITHOUT being overwritten. A deleted account is
+	* never brought back.
+	*
 	* Used by a forced refresh (a 401 mid-request) rather than by the rotating
-	* getEffectiveAccount path, which already writes back what it refreshed.
+	* getEffectiveAccount path, which refreshes through its own single-flight.
 	*/
-	async updateAccountCredentials(accountId, credentials) {
-		const data = await this.read();
-		const target = data.accounts.find((account) => account.id === accountId);
-		if (target === void 0) return void 0;
-		target.credentials = credentials;
-		await this.write(data);
-		if (target.isPrimary) this.hooks.mirrorPrimary?.(credentials).catch(() => void 0);
-		return target;
+	updateAccountCredentials(accountId, credentials, expected) {
+		return this.updatePool((data) => {
+			const target = data.accounts.find((account) => account.id === accountId);
+			if (target && (expected === void 0 || isDeepStrictEqual(target.credentials, expected))) target.credentials = credentials;
+			return target;
+		});
 	}
-	async setAlias(accountId, alias) {
-		const data = await this.read();
-		const target = data.accounts.find((account) => account.id === accountId);
-		if (target && alias.trim()) {
-			target.alias = alias.trim();
-			await this.write(data);
-		}
+	setAlias(accountId, alias) {
+		return this.updatePool((data) => {
+			const target = data.accounts.find((account) => account.id === accountId);
+			if (target && alias.trim()) target.alias = alias.trim();
+		});
 	}
-	async deleteAccount(accountId) {
-		const data = await this.read();
+	deleteAccount(accountId) {
+		return this.updatePool((data) => this.deleteAccountFromPool(data, accountId));
+	}
+	/**
+	* Remove one account inside a transaction.
+	*
+	* Provider refusal rules (a snapshot this plugin does not own, a desktop
+	* account it may only hide) belong in an override of this, so the check and
+	* the removal cannot be separated by a concurrent change.
+	*/
+	deleteAccountFromPool(data, accountId) {
 		const wasPrimary = data.accounts.find((account) => account.id === accountId)?.isPrimary;
 		data.accounts = data.accounts.filter((account) => account.id !== accountId);
-		if (wasPrimary && data.accounts.length > 0) {
-			data.accounts[0].isPrimary = true;
-			this.hooks.mirrorPrimary?.(data.accounts[0].credentials).catch(() => void 0);
-		} else if (data.accounts.length === 0) this.hooks.mirrorPrimary?.(null).catch(() => void 0);
+		if (wasPrimary && data.accounts.length > 0) data.accounts[0].isPrimary = true;
 		if (data.activeAccountId === accountId) data.activeAccountId = data.accounts.find((account) => account.isPrimary)?.id ?? data.accounts[0]?.id;
-		await this.write(data);
 	}
-	async setStrategy(strategy) {
-		const data = await this.read();
-		data.rotationStrategy = strategy;
-		await this.write(data);
+	setStrategy(strategy) {
+		return this.updatePool((data) => {
+			data.rotationStrategy = strategy;
+		});
 	}
 	/** Cool one account down after an upstream 429. */
-	async markCooldown(accountId, durationMs, reason) {
-		const data = await this.read();
-		const target = data.accounts.find((account) => account.id === accountId);
-		if (target) {
-			target.cooldownUntil = Date.now() + Math.max(MIN_COOLDOWN_MS, durationMs);
-			target.cooldownReason = reason;
-			await this.write(data);
-		}
+	markCooldown(accountId, durationMs, reason) {
+		return this.updatePool((data) => {
+			const target = data.accounts.find((account) => account.id === accountId);
+			if (target) {
+				target.cooldownUntil = Date.now() + Math.max(MIN_COOLDOWN_MS, durationMs);
+				target.cooldownReason = reason;
+			}
+		});
 	}
-	async clearCooldown(accountId) {
-		const data = await this.read();
-		const target = data.accounts.find((account) => account.id === accountId);
-		if (target) {
-			target.cooldownUntil = void 0;
-			target.cooldownReason = void 0;
-			await this.write(data);
-		}
+	clearCooldown(accountId) {
+		return this.updatePool((data) => {
+			const target = data.accounts.find((account) => account.id === accountId);
+			if (target) {
+				target.cooldownUntil = void 0;
+				target.cooldownReason = void 0;
+			}
+		});
 	}
 	/**
 	* Record that an account can no longer authenticate.
@@ -1136,23 +1209,23 @@ var AccountPoolCore = class {
 	* The account stays in the pool: signing in again is what restores it, and a
 	* deleted account would take the user's alias and ordering with it.
 	*/
-	async markAuthFailed(accountId, reason, status = "expired") {
-		const data = await this.read();
-		const target = data.accounts.find((account) => account.id === accountId);
-		if (target) {
-			target.authStatus = status;
-			target.authFailedReason = reason;
-			await this.write(data);
-		}
+	markAuthFailed(accountId, reason, status = "expired") {
+		return this.updatePool((data) => {
+			const target = data.accounts.find((account) => account.id === accountId);
+			if (target) {
+				target.authStatus = status;
+				target.authFailedReason = reason;
+			}
+		});
 	}
-	async clearAuthFailed(accountId) {
-		const data = await this.read();
-		const target = data.accounts.find((account) => account.id === accountId);
-		if (target) {
-			target.authStatus = void 0;
-			target.authFailedReason = void 0;
-			await this.write(data);
-		}
+	clearAuthFailed(accountId) {
+		return this.updatePool((data) => {
+			const target = data.accounts.find((account) => account.id === accountId);
+			if (target) {
+				target.authStatus = void 0;
+				target.authFailedReason = void 0;
+			}
+		});
 	}
 	/** Whether an account may serve a request right now. */
 	isEligible(account, now, triedAccountIds) {
@@ -1192,24 +1265,16 @@ var AccountPoolCore = class {
 	*
 	* @param fetchFn - fetch used if the credential is close to expiry.
 	*/
-	async getCredentialAccount(fetchFn = fetch) {
+	async getCredentialAccount(fetchFn = fetch, forceRefresh = false) {
 		const data = await this.read();
 		if (data.accounts.length === 0) throw new Error(this.hooks.emptyMessage ?? `未登录 ${this.hooks.displayName} 账号，请先在设置页添加账号。`);
-		const now = Date.now();
 		const usable = data.accounts.filter((account) => this.isCredentialUsable(account));
 		if (usable.length === 0) throw new LlmError(`全部 ${data.accounts.length} 个 ${this.hooks.displayName} 账号均需要重新登录。`, "AUTH", { status: 401 });
 		const selected = this.selectAccount(usable, data);
-		if (this.shouldRefreshCredential(selected, now) && this.hooks.refresh) {
-			const refreshed = await this.hooks.refresh(selected.credentials, fetchFn);
-			await this.updateAccountCredentials(selected.id, refreshed);
-			return {
-				account: selected,
-				credentials: refreshed
-			};
-		}
+		const account = await this.freshAccount(selected, fetchFn, forceRefresh);
 		return {
-			account: selected,
-			credentials: selected.credentials
+			account,
+			credentials: account.credentials
 		};
 	}
 	/**
@@ -1244,8 +1309,8 @@ var AccountPoolCore = class {
 	* looks unexpired, and only the service's own refusal says so. Renewing it is
 	* what separates that from a credential that genuinely needs a new sign-in.
 	*/
-	async renewCredential(accountId, fetchFn = fetch) {
-		return this.credentialFor(accountId, fetchFn, true);
+	async renewCredential(accountId, fetchFn = fetch, expected) {
+		return this.credentialFor(accountId, fetchFn, true, expected);
 	}
 	/**
 	* Resolve, and if needed renew, one account's credential.
@@ -1255,29 +1320,106 @@ var AccountPoolCore = class {
 	* not name an account (the catalog loader) still has to present the
 	* credential that is actually in play.
 	*/
-	async credentialFor(accountId, fetchFn, force) {
+	async credentialFor(accountId, fetchFn, force, expected) {
 		const data = await this.read();
 		const target = accountId === void 0 ? data.accounts.find((account) => account.id === data.activeAccountId) ?? data.accounts.find((account) => account.isPrimary) ?? data.accounts[0] : data.accounts.find((account) => account.id === accountId);
 		if (target === void 0) throw new LlmError(this.hooks.emptyMessage ?? `未登录 ${this.hooks.displayName} 账号，请先在设置页添加账号。`, "AUTH");
 		if (!this.isCredentialUsable(target)) throw new LlmError(`${this.hooks.displayName} 账号的凭据已被拒绝，需要重新登录。`, "AUTH", { status: 401 });
-		if (!force && (!this.shouldRefreshCredential(target, Date.now()) || !this.hooks.refresh)) return target.credentials;
-		if (!this.hooks.refresh) return target.credentials;
+		if (expected !== void 0 && !isDeepStrictEqual(expected, target.credentials)) return target.credentials;
+		return (await this.freshAccount(target, fetchFn, force)).credentials;
+	}
+	/**
+	* Return one account's current row, refreshing it at most once per generation.
+	*
+	* Shared by every entry point — routing, auxiliary tools, the settings card
+	* and forced renewals — across all instances of the pool file, because a
+	* rotating refresh token may be spent once: two parallel exchanges both fail,
+	* and the losing one gets recorded as a dead sign-in.
+	*
+	* Reading the current generation and registering/joining its flight happen in
+	* one short transaction, so a commit cannot slip between the two decisions.
+	* The network call is fired AFTER the lock is released, and the plan returned
+	* from the lock is a plain value: awaiting a flight while holding the lock
+	* would deadlock that flight's own commit.
+	*/
+	async freshAccount(target, fetchFn, force = false) {
+		let launch;
+		const plan = await this.serialize(async () => {
+			const current = (await this.loadPoolData()).accounts.find((account) => account.id === target.id);
+			if (current === void 0 || !this.isCredentialUsable(current)) throw new PoolAccountUnavailableError(this.hooks.emptyMessage ?? "未登录 " + this.hooks.displayName + " 账号，请先在设置页添加账号。", "AUTH");
+			if (!isDeepStrictEqual(current.credentials, target.credentials)) return { account: current };
+			if (!this.hooks.refresh || !force && !this.shouldRefreshCredential(current, Date.now())) return { account: current };
+			const key = JSON.stringify([this.operationKey, current.id]);
+			const pending = poolRefreshes.get(key);
+			if (pending !== void 0 && isDeepStrictEqual(pending.credentials, current.credentials)) return { result: pending.result };
+			const result = new Promise((resolve, reject) => {
+				launch = () => {
+					this.refreshAccount(current, fetchFn).then(resolve, reject);
+				};
+			});
+			const flight = {
+				credentials: structuredClone(current.credentials),
+				result
+			};
+			poolRefreshes.set(key, flight);
+			const release = () => {
+				if (poolRefreshes.get(key) === flight) poolRefreshes.delete(key);
+			};
+			result.then(release, release);
+			return { result };
+		});
+		launch?.();
+		return plan.result ?? plan.account;
+	}
+	/**
+	* Refresh one account: network outside the lock, then a conditional commit.
+	*
+	* Every write-back is checked against the credential the refresh started from,
+	* which is what keeps a late response from restoring a spent token over a
+	* re-login, and keeps a deleted account from coming back.
+	*/
+	async refreshAccount(target, fetchFn) {
+		const expected = structuredClone(target.credentials);
 		const live = await this.hooks.liveCredentialsFor?.(target).catch(() => null);
 		if (live !== null && live !== void 0 && live.advanced) {
-			target.credentials = live.credentials;
-			await this.write(data).catch(() => void 0);
-			return live.credentials;
+			const account = await this.updateAccountCredentials(target.id, live.credentials, expected).catch(() => ({
+				...target,
+				credentials: live.credentials
+			}));
+			this.assertUsableAccount(account);
+			return account;
 		}
 		let refreshed;
 		try {
 			refreshed = await this.hooks.refresh(target.credentials, fetchFn);
 		} catch (error) {
 			const status = this.hooks.refreshFailureStatus?.(error);
-			if (status !== void 0) await this.markAuthFailed(target.id, error instanceof Error ? error.message : String(error), status).catch(() => void 0);
+			let superseded;
+			await this.updatePool((data) => {
+				const current = data.accounts.find((account) => account.id === target.id);
+				if (current === void 0) return;
+				if (!isDeepStrictEqual(current.credentials, expected)) {
+					superseded = current;
+					return;
+				}
+				if (status !== void 0) {
+					current.authStatus = status;
+					current.authFailedReason = error instanceof Error ? error.message : String(error);
+				}
+			}).catch(() => void 0);
+			if (superseded !== void 0) {
+				this.assertUsableAccount(superseded);
+				return superseded;
+			}
 			throw error;
 		}
-		await this.updateAccountCredentials(target.id, refreshed);
-		return refreshed;
+		const account = await this.updateAccountCredentials(target.id, refreshed, expected);
+		this.assertUsableAccount(account);
+		return account;
+	}
+	assertUsableAccount(account) {
+		if (account === void 0) throw new PoolAccountUnavailableError(this.hooks.emptyMessage ?? "未登录 " + this.hooks.displayName + " 账号，请先在设置页添加账号。", "AUTH");
+		if (!this.isCredentialUsable(account)) throw new PoolAccountUnavailableError(this.hooks.displayName + " 账号的凭据已被拒绝，需要重新登录。", "AUTH", { status: 401 });
 	}
 	/** Whether one account's credential must be refreshed before it is handed out. */
 	shouldRefreshCredential(account, now) {
@@ -1321,37 +1463,34 @@ var AccountPoolCore = class {
 	* @param fetchFn - fetch used by the provider's token refresh.
 	* @throws LlmError with `RATE_LIMIT` when every account is cooling down.
 	*/
-	async getEffectiveAccount(excludeIds, fetchFn = fetch) {
+	async getEffectiveAccount(excludeIds, fetchFn = fetch, forceRefresh = false) {
 		const data = await this.read();
 		if (data.accounts.length === 0) throw new Error(this.hooks.emptyMessage ?? `未登录 ${this.hooks.displayName} 账号，请先在设置页添加账号。`);
 		const now = Date.now();
 		const eligible = data.accounts.filter((account) => this.isEligible(account, now, excludeIds));
 		if (eligible.length === 0) throw this.allUnavailableError(data, now);
 		const selected = this.selectAccount(eligible, data);
-		if (this.shouldRefreshCredential(selected, now) && this.hooks.refresh) {
-			let refreshed;
-			try {
-				refreshed = await this.hooks.refresh(selected.credentials, fetchFn);
-			} catch (error) {
-				const status = this.hooks.refreshFailureStatus?.(error);
-				if (status === void 0) throw error;
-				await this.markAuthFailed(selected.id, error instanceof Error ? error.message : String(error), status);
-				const nextExclude = new Set(excludeIds ?? []);
-				nextExclude.add(selected.id);
-				if (await this.hasAnotherAvailableAccount(nextExclude)) return this.getEffectiveAccount(nextExclude, fetchFn);
-				throw error;
-			}
-			selected.credentials = refreshed;
-			const index = data.accounts.findIndex((account) => account.id === selected.id);
-			if (index >= 0) data.accounts[index] = selected;
-			if (selected.isPrimary) this.hooks.mirrorPrimary?.(refreshed).catch(() => void 0);
-		}
-		selected.lastUsedAt = now;
-		data.activeAccountId = selected.id;
-		await this.write(data).catch(() => void 0);
+		let refreshed;
+		try {
+			refreshed = await this.freshAccount(selected, fetchFn, forceRefresh);
+		} catch (error) {
+			if (this.hooks.refreshFailureStatus?.(error) === void 0 && !(error instanceof PoolAccountUnavailableError)) throw error;
+			const nextExclude = new Set(excludeIds ?? []);
+			nextExclude.add(selected.id);
+			if (await this.hasAnotherAvailableAccount(nextExclude)) return this.getEffectiveAccount(nextExclude, fetchFn, forceRefresh);
+			throw error;
+		}
+		const account = await this.updatePool((current) => {
+			const latest = current.accounts.find((entry) => entry.id === refreshed.id);
+			if (latest === void 0 || !isDeepStrictEqual(latest.credentials, refreshed.credentials)) return latest;
+			latest.lastUsedAt = now;
+			if (current.activeAccountId === data.activeAccountId) current.activeAccountId = latest.id;
+			return latest;
+		}).catch(() => refreshed);
+		this.assertUsableAccount(account);
 		return {
-			account: selected,
-			credentials: selected.credentials
+			account,
+			credentials: account.credentials
 		};
 	}
 };
@@ -1724,8 +1863,7 @@ var OAuthService = class {
 	async refresh() {
 		this.assertAvailable();
 		if (this.pool !== null) {
-			const { account, credentials } = await this.pool.getEffectiveAccount(void 0, this.fetchFn);
-			await this.refreshAccount(credentials).then((refreshed) => this.pool.updateAccountCredentials(account.id, refreshed));
+			await this.pool.getEffectiveAccount(void 0, this.fetchFn, true);
 			return this.status();
 		}
 		const stored = await this.loadAuthenticated();
@@ -1787,18 +1925,8 @@ var OAuthService = class {
 	*/
 	async credentials(forceRefresh = false, access = {}) {
 		if (this.pool !== null) {
-			if (access.purpose === "tool") {
-				const { account, credentials } = await this.pool.getCredentialAccount(this.fetchFn);
-				if (!forceRefresh) return credentials;
-				const refreshed = await this.refreshAccount(credentials, this.fetchFn);
-				await this.pool.updateAccountCredentials(account.id, refreshed);
-				return refreshed;
-			}
-			const { account, credentials } = await this.pool.getEffectiveAccount(void 0, this.fetchFn);
-			if (!forceRefresh) return credentials;
-			const refreshed = await this.refreshAccount(credentials, this.fetchFn);
-			await this.pool.updateAccountCredentials(account.id, refreshed);
-			return refreshed;
+			if (access.purpose === "tool") return (await this.pool.getCredentialAccount(this.fetchFn, forceRefresh)).credentials;
+			return (await this.pool.getEffectiveAccount(void 0, this.fetchFn, forceRefresh)).credentials;
 		}
 		const stored = await this.loadAuthenticated();
 		if (forceRefresh || stored.expiresAt - this.now() <= 6e4) return this.refreshCredentials(stored);
@@ -2251,11 +2379,8 @@ var CodexAccountPool = class extends AccountPoolCore {
 	async refreshAccountNow(accountId) {
 		const account = (await this.read()).accounts.find((entry) => entry.id === accountId);
 		if (account === void 0) throw new Error("ChatGPT 账号已不在号池中");
-		const refresher = this.refresherRef.current;
-		if (refresher === void 0) throw new Error("ChatGPT 凭据刷新服务尚未就绪");
-		const refreshed = await refresher.refreshAccount(account.credentials);
-		await this.updateAccountCredentials(accountId, refreshed);
-		return refreshed;
+		if (this.refresherRef.current === void 0) throw new Error("ChatGPT 凭据刷新服务尚未就绪");
+		return this.renewCredential(accountId, fetch, account.credentials);
 	}
 	/** The single-credential store this pool mirrors its primary account into. */
 	mirrorStore() {
@@ -21552,23 +21677,30 @@ var MinimaxCodeAccountPool = class extends AccountPoolCore {
 	* because that one genuinely needs a sign-in.
 	*/
 	async healStaleAuthFailures(current) {
-		const data = current ?? await this.read();
-		if (!data.accounts.some(isMarkedFailed)) return false;
+		const failedAccounts = (current ?? await this.read()).accounts.filter(isMarkedFailed);
+		if (failedAccounts.length === 0) return false;
+		const targets = new Map(failedAccounts.map((account) => [account.id, {
+			credentials: account.credentials,
+			authStatus: account.authStatus
+		}]));
 		const live = await this.store.read().catch(() => null);
 		if (live === null) return false;
-		let changed = false;
-		for (const account of data.accounts) {
-			if (account.authStatus === void 0 || account.authStatus === "ok") continue;
-			if (!minimaxCodeSameCredentialSession(live, account.credentials)) continue;
-			if (!minimaxCodeCredentialAdvancedPast(live, account.credentials)) continue;
-			account.authStatus = void 0;
-			account.authFailedReason = void 0;
-			account.credentials = live;
-			changed = true;
-		}
-		if (!changed) return false;
-		await this.write(data).catch(() => void 0);
-		return true;
+		return await this.updatePool((draft) => {
+			let changed = false;
+			for (const account of draft.accounts) {
+				const expected = targets.get(account.id);
+				if (!expected) continue;
+				if (account.authStatus !== expected.authStatus) continue;
+				if (!isDeepStrictEqual(account.credentials, expected.credentials)) continue;
+				if (!minimaxCodeSameCredentialSession(live, account.credentials)) continue;
+				if (!minimaxCodeCredentialAdvancedPast(live, account.credentials)) continue;
+				account.authStatus = void 0;
+				account.authFailedReason = void 0;
+				account.credentials = live;
+				changed = true;
+			}
+			return changed;
+		});
 	}
 	/**
 	* Pick the account for the next request.
@@ -21582,7 +21714,13 @@ var MinimaxCodeAccountPool = class extends AccountPoolCore {
 		const effective = await this.getEffectiveAccount(excludeIds, fetchFn);
 		const live = await this.liveNativeCredential(effective.account);
 		if (live === null) return effective;
-		if (live.accessToken !== effective.credentials.accessToken) await this.updateAccountCredentials(effective.account.id, live).catch(() => void 0);
+		if (live.accessToken !== effective.credentials.accessToken) {
+			const updated = await this.updateAccountCredentials(effective.account.id, live, effective.credentials).catch(() => void 0);
+			if (updated) return {
+				account: updated,
+				credentials: updated.credentials
+			};
+		}
 		return {
 			account: effective.account,
 			credentials: live
@@ -21644,7 +21782,7 @@ var MinimaxCodeAccountPool = class extends AccountPoolCore {
 		return this.addAccount(credentials, alias);
 	}
 	/**
-	* Delete one account.
+	* Remove one account inside a transaction.
 	*
 	* An account whose credential is the desktop app's own \`auth.json\` is refused:
 	* this plugin does not own that file, and removing the account would either
@@ -21652,9 +21790,9 @@ var MinimaxCodeAccountPool = class extends AccountPoolCore {
 	* file — sign the user out of MiniMax Code itself. Signing out there is the
 	* supported way to end it, and the card is told so by \`removable: false\`.
 	*/
-	async deleteAccount(accountId) {
-		if ((await this.read()).accounts.find((account) => account.id === accountId)?.source === "minimax-native") throw new Error("该账号来自 MiniMax Code 桌面端（~/.minimax/auth），本插件只能读取和续期，不能删除。请在 MiniMax Code 应用中退出登录。");
-		await super.deleteAccount(accountId);
+	deleteAccountFromPool(data, accountId) {
+		if (data.accounts.find((account) => account.id === accountId)?.source === "minimax-native") throw new Error("该账号来自 MiniMax Code 桌面端（~/.minimax/auth），本插件只能读取和续期，不能删除。请在 MiniMax Code 应用中退出登录。");
+		super.deleteAccountFromPool(data, accountId);
 	}
 	/** The credential store this pool mirrors its primary account into. */
 	mirrorStore() {
@@ -26157,15 +26295,15 @@ var WorkBuddyAccountPool = class extends AccountPoolCore {
 		this.options_selection = options.selection;
 	}
 	/**
-	* Read the pool, refreshing the legacy-key index on the way.
+	* Load the pool, refreshing the legacy-key index on the way.
 	*
-	* Every routing decision goes through this method before it consults the
-	* settings selection, so building the index here is what keeps a pin written
-	* before the identity fix resolvable when {@link resolveSelectionId} is asked
-	* for it.
+	* Every routing decision and mutation goes through this method before it
+	* consults the settings selection, so building the index here is what keeps
+	* a pin written before the identity fix resolvable when
+	* {@link resolveSelectionId} is asked for it.
 	*/
-	async read() {
-		const data = await super.read();
+	async loadPoolData() {
+		const data = await super.loadPoolData();
 		this.legacyIds.clear();
 		for (const account of data.accounts) for (const alias of workBuddyAccountIdAliases(account.credentials)) if (alias !== account.id) this.legacyIds.set(alias, account.id);
 		return data;
@@ -26185,20 +26323,34 @@ var WorkBuddyAccountPool = class extends AccountPoolCore {
 	*/
 	async syncDesktopAccounts() {
 		const discovered = await this.store.discoverDesktopCredentials();
-		if (discovered.length > 0) {
-			const data = await this.read();
-			const known = new Set(data.accounts.map((account) => workBuddyAccountId(account.credentials)));
-			const seen = /* @__PURE__ */ new Set();
-			for (const credentials of discovered) {
-				const id = workBuddyAccountId(credentials);
-				if (known.has(id) || seen.has(id)) continue;
-				seen.add(id);
-				await this.addAccount({
-					...credentials,
-					source: "desktop"
-				});
+		const candidates = [];
+		const seen = /* @__PURE__ */ new Set();
+		for (const raw of discovered) {
+			const credentials = withResolvedIdentity({
+				...raw,
+				source: "desktop"
+			});
+			const id = workBuddyAccountId(credentials);
+			if (seen.has(id)) continue;
+			seen.add(id);
+			candidates.push(credentials);
+		}
+		if (candidates.length > 0) await this.updatePool((data) => {
+			const existingKeys = /* @__PURE__ */ new Set();
+			for (const account of data.accounts) {
+				existingKeys.add(account.id);
+				const key = this.hooks.dedupeKey?.(account.credentials);
+				if (key !== void 0) existingKeys.add(key);
 			}
-		}
+			for (const credentials of candidates) {
+				const key = this.hooks.dedupeKey?.(credentials);
+				const id = this.hooks.accountId?.(credentials);
+				if (key !== void 0 && existingKeys.has(key) || id !== void 0 && existingKeys.has(id)) continue;
+				this.addAccountToPool(data, credentials);
+				if (key !== void 0) existingKeys.add(key);
+				if (id !== void 0) existingKeys.add(id);
+			}
+		});
 		return this.listAccounts();
 	}
 	/**
@@ -26214,7 +26366,13 @@ var WorkBuddyAccountPool = class extends AccountPoolCore {
 		const live = await this.store.readDesktopFile(effective.account.sourceFile);
 		if (live === null) return effective;
 		if (isExpired(live)) return effective;
-		if (live.accessToken !== effective.credentials.accessToken) await this.updateAccountCredentials(effective.account.id, live).catch(() => void 0);
+		if (live.accessToken !== effective.credentials.accessToken) {
+			const updated = await this.updateAccountCredentials(effective.account.id, live, effective.credentials).catch(() => void 0);
+			if (updated) return {
+				account: updated,
+				credentials: updated.credentials
+			};
+		}
 		return {
 			account: effective.account,
 			credentials: live
@@ -26251,15 +26409,15 @@ var WorkBuddyAccountPool = class extends AccountPoolCore {
 		return super.addAccount(withResolvedIdentity(credentials), alias);
 	}
 	/**
-	* Delete one account.
+	* Remove one account inside a transaction.
 	*
 	* A desktop account is refused: the plugin does not own that credential file,
 	* so removing it from the pool would strand the IDE's session while telling
 	* the user their account was deleted. Hiding is the supported action there.
 	*/
-	async deleteAccount(accountId) {
-		if ((await this.read()).accounts.find((account) => account.id === accountId)?.source === "desktop") throw new Error("桌面账号由 CodeBuddy 客户端所有，只能隐藏，不能删除。");
-		await super.deleteAccount(accountId);
+	deleteAccountFromPool(data, accountId) {
+		if (data.accounts.find((account) => account.id === accountId)?.source === "desktop") throw new Error("桌面账号由 CodeBuddy 客户端所有，只能隐藏，不能删除。");
+		super.deleteAccountFromPool(data, accountId);
 	}
 };
 //#endregion
@@ -32577,7 +32735,7 @@ function isAdoptedCredentialExpired(credential, now = Date.now()) {
 * caller in the process, so with a pool it would hand the second account the
 * first account's freshly rotated credential — and, through the adapter above,
 * write it into the second account's record. The pool therefore keeps its OWN
-* single-flight, per account (see the inFlight map), which preserves the property
+* single-flight, per pool file and account, which preserves the property
 * the frozen module wanted (one rotation per expiry, no two callers spending the
 * same rotating token) without the cross-account contamination.
 *
@@ -32963,7 +33121,6 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 	* marked expired immediately after a refresh that in fact succeeded. Keyed by
 	* the record's id — never by a token — so it cannot mix two accounts up.
 	*/
-	inFlight = /* @__PURE__ */ new Map();
 	constructor(options = {}) {
 		const store = options.store ?? new FileCredentialStore();
 		const refreshSeam = options.refreshCredentials ?? ((credentials, fetchFn) => refreshClaudeCredential(credentials, fetchFn));
@@ -33010,6 +33167,10 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 				if (record === void 0) return null;
 				return poolAccountForRecord(record, true);
 			},
+			credentialsCommitted: async (account) => {
+				if (isAdoptedPoolCredential(account.credentials)) return;
+				await store.saveAccount(account.credentials, { internalId: account.id });
+			},
 			mirrorPrimary: async (credentials) => {
 				if (credentials === null) {
 					await store.delete();
@@ -33071,8 +33232,8 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 	* {@link recordIdsFor} reads is kept in step with the rows that actually exist.
 	* See the recordIds field for why entries are not pruned.
 	*/
-	async read() {
-		const data = await super.read();
+	async loadPoolData() {
+		const data = await super.loadPoolData();
 		for (const account of data.accounts) this.indexAccount(account);
 		return data;
 	}
@@ -33085,10 +33246,27 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 	* 'one account, one key' section.
 	*/
 	async addAccount(credentials, alias) {
-		const data = await this.read();
+		return this.updatePool((data) => this.addManagedAccount(data, credentials, alias)).catch((error) => {
+			this.recordIds.clear();
+			throw error;
+		});
+	}
+	async addManagedAccount(data, credentials, alias) {
 		if (isAdoptedPoolCredential(credentials)) return this.addAdoptedAccount(credentials, data, alias);
+		parseClaudeCredentials(credentials);
 		const knownId = await this.recordIdFor(credentials);
-		const record = await this.store.saveAccount(credentials);
+		const document = await this.store.read();
+		const keys = identityKeysFor(credentials);
+		const stored = document?.accounts.find((record) => record.identityKeys.some((key) => keys.includes(key)));
+		const record = stored === void 0 ? {
+			internalId: data.accounts.find((account) => account.id === knownId)?.adopted === false ? knownId ?? createInternalId() : createInternalId(),
+			identityKeys: keys,
+			credentials
+		} : {
+			...stored,
+			identityKeys: mergeIdentityKeys(stored.identityKeys, keys),
+			credentials
+		};
 		this.indexRecord(record);
 		if (knownId !== void 0 && knownId !== record.internalId) {
 			const row = data.accounts.find((account) => account.id === knownId);
@@ -33100,10 +33278,9 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 				delete row.sourcePath;
 				row.identityKeys = mergeIdentityKeys(row.identityKeys, record.identityKeys);
 				if (data.activeAccountId === knownId) data.activeAccountId = record.internalId;
-				await this.write(data);
 			}
 		}
-		return super.addAccount(credentials, alias);
+		return this.addAccountToPool(data, credentials, alias);
 	}
 	/**
 	* Add, or re-import, one borrowed Claude Code snapshot.
@@ -33132,9 +33309,7 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 		const candidateId = byIdentity ?? this.recordIds.get(sourceKey);
 		const existing = candidateId === void 0 ? void 0 : data.accounts.find((account) => account.id === candidateId);
 		if (existing !== void 0 && existing.adopted !== true) {
-			const before = existing.identityKeys.length;
 			existing.identityKeys = mergeIdentityKeys(existing.identityKeys, identityKeysFor(credentials));
-			if (existing.identityKeys.length !== before) await this.write(data);
 			return existing;
 		}
 		if (candidateId === void 0) {
@@ -33145,7 +33320,7 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 			this.recordIds.set(sourceKey, candidateId);
 			this.indexCredential(credentials, candidateId);
 		}
-		return super.addAccount(credentials, alias);
+		return this.addAccountToPool(data, credentials, alias);
 	}
 	/**
 	* Merge two rows that are one account.
@@ -33168,7 +33343,21 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 	*/
 	async mergeAccounts(keepAccountId, dropAccountId) {
 		if (keepAccountId === dropAccountId) throw new Error("A Claude pool merge needs two different accounts.");
-		const data = await this.read();
+		let originals;
+		return await this.updatePool(async (data) => {
+			const keep = data.accounts.find((account) => account.id === keepAccountId);
+			const drop = data.accounts.find((account) => account.id === dropAccountId);
+			if (keep === void 0 || drop === void 0) throw new Error("The Claude pool merge addressed an account the pool does not have.");
+			originals = {
+				keep,
+				drop
+			};
+			return this.mergeAccountsInPool(data, keepAccountId, dropAccountId);
+		}, async (_data, result) => {
+			if (originals !== void 0) await this.reconcileMergedDocument(originals.keep, originals.drop, result);
+		});
+	}
+	async mergeAccountsInPool(data, keepAccountId, dropAccountId) {
 		const keep = data.accounts.find((account) => account.id === keepAccountId);
 		const drop = data.accounts.find((account) => account.id === dropAccountId);
 		if (keep === void 0 || drop === void 0) throw new Error("The Claude pool merge addressed an account the pool does not have.");
@@ -33217,9 +33406,6 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 		data.accounts[index] = merged;
 		data.accounts = data.accounts.filter((account) => account.id !== dropAccountId);
 		if (data.activeAccountId === dropAccountId) data.activeAccountId = merged.id;
-		await this.write(data);
-		if (merged.isPrimary) this.hooks.mirrorPrimary?.(merged.credentials).catch(() => void 0);
-		await this.reconcileMergedDocument(keep, drop, merged);
 		return merged;
 	}
 	/**
@@ -33259,10 +33445,12 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 	* neither path.
 	*/
 	async removeImportedAccount(accountId) {
-		const target = (await this.read()).accounts.find((account) => account.id === accountId);
-		if (target === void 0) return;
-		if (target.adopted !== true) throw new Error("That account was signed in through this plugin; delete it instead of removing an import.");
-		await super.deleteAccount(accountId);
+		return this.updatePool((data) => {
+			const target = data.accounts.find((account) => account.id === accountId);
+			if (target === void 0) return;
+			if (target.adopted !== true) throw new Error("That account was signed in through this plugin; delete it instead of removing an import.");
+			super.deleteAccountFromPool(data, accountId);
+		});
 	}
 	/**
 	* Delete one plugin-owned account.
@@ -33275,9 +33463,12 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 	* back a credential the user just deleted.
 	*/
 	async deleteAccount(accountId) {
-		if ((await this.read()).accounts.find((account) => account.id === accountId)?.adopted === true) throw new Error("The sign-in imported from Claude Code is not an account this plugin owns; remove the import instead.");
-		await super.deleteAccount(accountId);
-		await this.store.deleteAccount(accountId);
+		return this.updatePool((data) => {
+			if (data.accounts.find((account) => account.id === accountId)?.adopted === true) throw new Error("The sign-in imported from Claude Code is not an account this plugin owns; remove the import instead.");
+			super.deleteAccountFromPool(data, accountId);
+		}, async () => {
+			await this.store.deleteAccount(accountId);
+		});
 	}
 	/**
 	* The immutable id of the record that owns a credential, or nothing.
@@ -33357,44 +33548,7 @@ var ClaudeAccountPool = class extends AccountPoolCore {
 	*/
 	refreshCredentials(credentials, fetchFn) {
 		if (isAdoptedPoolCredential(credentials)) return Promise.reject(new ClaudeAdoptedCredentialError(adoptedCredentialExpired(credentials) ? ADOPTED_CREDENTIAL_EXPIRED_HINT : ADOPTED_NEVER_REFRESHED_MESSAGE));
-		return this.singleFlightRefresh(credentials, fetchFn);
-	}
-	/**
-	* The per-account single-flight, resolving the account's id first.
-	*
-	* Separated from the hook above only because resolving the id consults the
-	* credential document, and a hook cannot await: the guard stays synchronous so
-	* it can never be skipped by a caller that forgets to wait.
-	*/
-	async singleFlightRefresh(credentials, fetchFn) {
-		const key = await this.recordIdFor(credentials);
-		if (key !== void 0) {
-			const shared = this.inFlight.get(key);
-			if (shared !== void 0) return shared;
-		}
-		const pending = this.performRefresh(credentials, fetchFn);
-		if (key !== void 0) {
-			this.inFlight.set(key, pending);
-			pending.then(() => void 0, () => void 0).then(() => {
-				if (this.inFlight.get(key) === pending) this.inFlight.delete(key);
-			});
-		}
-		return pending;
-	}
-	/**
-	* Rotate one managed credential and keep the credential document in step.
-	*
-	* The document write is what stops the pre-pool projection from handing out a
-	* token the rotation has already spent. Its failure is swallowed on purpose:
-	* the credential WAS refreshed, the pool's own record holds it, and a mirror
-	* that could not be written must not fail a request that can still be served —
-	* the same rule the core applies to its own bookkeeping writes.
-	*/
-	async performRefresh(credentials, fetchFn) {
-		const recordId = await this.recordIdFor(credentials);
-		const refreshed = await this.refreshSeam(credentials, fetchFn);
-		if (recordId !== void 0) await new ClaudeCredentialStoreAdapter(this.store, recordId).write(refreshed).catch(() => void 0);
-		return refreshed;
+		return this.refreshSeam(credentials, fetchFn);
 	}
 };
 //#endregion
@@ -37112,9 +37266,9 @@ function appendWindow(current, addition, limit) {
 /**
 * Install the reasoning-collapse guard on a Context.
 *
-* The guard is inert unless the host exposes the `llm/stream` seam, so a
-* harness without it keeps the built-in behaviour instead of failing this
-* plugin's load.
+* The guard is inert unless the host exposes the event bus, so a harness
+* without it keeps the built-in behaviour instead of failing this plugin's
+* load.
 *
 * Resuming needs the live Agent for `cancel` and `steer`, and no supported
 * generation hands the agent to `llm/stream`. `agent/created` reports it on
@@ -37124,19 +37278,19 @@ function appendWindow(current, addition, limit) {
 *
 * @param ctx - plugin context.
 * @param options - see {@link GuardOptions}; validated fail-loud.
-* @returns a disposer, or undefined when the seam is unavailable.
+* @returns a disposer removing both listeners, or undefined when the host
+* exposes no event bus.
 */
 function installReasoningCollapseGuard(ctx, options = {}) {
 	const resolved = resolveGuardOptions(options);
-	const runtime = ctx.llm;
-	if (runtime === void 0 || typeof runtime.stream !== "function") return void 0;
-	const original = runtime.stream;
+	if (typeof ctx.on !== "function") return void 0;
 	const watched = new Set(resolved.includeModels);
 	const breakers = /* @__PURE__ */ new WeakMap();
 	let currentAgent;
-	const releaseAgent = typeof ctx.on === "function" ? ctx.on("agent/created", ({ agent }) => {
-		currentAgent = agent;
-	}) : void 0;
+	const releaseAgent = ctx.on("agent/created", (payload) => {
+		currentAgent = payload.agent;
+	});
+	const releaseStream = ctx.on("llm/stream", guardStream, { global: true });
 	function breakerFor(key) {
 		let state = breakers.get(key);
 		if (state === void 0) {
@@ -37174,7 +37328,7 @@ function installReasoningCollapseGuard(ctx, options = {}) {
 			agent.steer?.(createResumeMessage(text));
 		});
 	}
-	runtime.stream = function reasoningCollapseGuardStream(request, next) {
+	function guardStream(request, next) {
 		const state = breakerFor(request.signal ?? STATIC_KEY);
 		if (state.exhausted || !watchedModel(request.model)) return next();
 		async function* guarded() {
@@ -37196,9 +37350,9 @@ function installReasoningCollapseGuard(ctx, options = {}) {
 			}
 		}
 		return guarded();
-	};
+	}
 	return () => {
-		runtime.stream = original;
+		releaseListener(releaseStream);
 		releaseListener(releaseAgent);
 	};
 }
@@ -37290,7 +37444,7 @@ function apply(ctx, pluginConfig = {}) {
 		ctx.effect(() => {
 			const dispose = installReasoningCollapseGuard(ctx, guardOptions);
 			if (dispose === void 0) {
-				ctx.logger.warn("[dsh-chatgpt-subscription] reasoning-collapse guard skipped: this harness exposes no llm/stream seam");
+				ctx.logger.warn("[dsh-chatgpt-subscription] reasoning-collapse guard skipped: this harness exposes no event bus");
 				return () => void 0;
 			}
 			return dispose;