@eddyskywalker/dsh-chatgpt-subscription 0.13.1 → 0.14.0

package/lib/index.js

@@ -993,7 +993,7 @@ function parseStoredCredentials(value) {
 		if (typeof candidate !== "string") throw new Error(`${key} is invalid`);
 		return candidate;
 	};
-	return {
+	const credentials = {
 		accessToken: record.accessToken,
 		refreshToken: record.refreshToken,
 		expiresAt: record.expiresAt,
@@ -1002,6 +1002,16 @@ function parseStoredCredentials(value) {
 		email: optional("email"),
 		planType: optional("planType")
 	};
+	if (record.adopted === true) {
+		const source = optional("source");
+		if (source !== void 0) {
+			credentials.adopted = true;
+			credentials.source = source;
+			const sourcePath = optional("sourcePath");
+			if (sourcePath !== void 0) credentials.sourcePath = sourcePath;
+		}
+	}
+	return credentials;
 }
 //#endregion
 //#region src/host/token-store-windows.ts
@@ -2895,7 +2905,433 @@ function poolQuota(fetchedAt, windows) {
 	};
 }
 //#endregion
+//#region src/host/codex-adopt.ts
+/**
+* OPT-IN adoption of a pre-existing Codex CLI sign-in.
+*
+* WHAT THIS IS FOR. A user who already runs the unmodified Codex CLI is already
+* signed in to the very subscription this provider serves. Asking them to sign in
+* a second time is pure friction, so this module offers the one thing that
+* removes it: reading back the credential the CLI itself stored in
+* `$CODEX_HOME/auth.json` (`~/.codex/auth.json` when the variable is unset). It
+* is opt-in — nothing here runs until the user asks for it.
+*
+* ---------------------------------------------------------------------------
+* RULE 1 — THIS MODULE NEVER WRITES. IT IS A READER, AND ONLY A READER.
+* ---------------------------------------------------------------------------
+* It must not create, modify, move or delete any file belonging to the Codex CLI.
+* No file this module touches is ever opened for writing, no directory is
+* created, nothing is renamed and nothing is unlinked. The guarantee is
+* structural rather than a promise in prose: the module imports exactly two
+* functions BY NAME from 'node:fs/promises' — readFile and stat — instead of the
+* whole namespace, so introducing a write would require a visible change to the
+* import list, which is the line a reviewer reads first. Nothing exported here
+* writes. The tests assert the stronger, observable form of the rule: a
+* credential file's bytes, size and mtime are identical before and after both
+* entry points run, and its directory gains no entries.
+*
+* ---------------------------------------------------------------------------
+* RULE 2 — PRESENCE AND CONTENT ARE TWO SEPARATE FUNCTIONS
+* ---------------------------------------------------------------------------
+* codexCliCredentialPresence() is cheap enough to call on plugin startup and
+* answers only yes/no: it stats the candidate and never opens it for reading. It
+* exists so the settings card can offer the import before the user has agreed to
+* it, and so a user who never opts in never has their token read at all.
+*
+* readCodexCliCredentials() is the full read, and it is called only AFTER the
+* user explicitly opts in. Keeping the two apart is the whole point: a startup
+* path that slurped the file "just in case" would make the opt-in decorative.
+*
+* ---------------------------------------------------------------------------
+* RULE 3 — AN ADOPTED CREDENTIAL IS A SNAPSHOT, AND THIS PLUGIN NEVER REFRESHES IT
+* ---------------------------------------------------------------------------
+* An adopted credential is used only while its own accessToken is still valid.
+* Once it is expired the pool reports it as expired and tells the user to sign in
+* again in the Codex CLI and re-adopt. That is deliberate, not a gap: the
+* ChatGPT refresh token the CLI stores ROTATES, and the CLI refreshes its own
+* file in place. Two processes refreshing the same grant therefore invalidate
+* each other — whoever loses the race holds a token the server has already
+* retired, and the user ends up signed OUT of the Codex CLI by this plugin's good
+* intentions. An in-process single-flight cannot fix that, because the race is
+* across PROCESSES: this plugin and the CLI are separate programs with separate
+* memories, and the only shared state between them is the file — which this
+* module must not write back into (Rule 1).
+*
+* So the honest contract is: borrow the access token for as long as the CLI itself
+* vouched for it, and never touch the refresh token. Expiry is therefore part of
+* the adoption decision rather than a detail — see
+* {@link isAdoptedCodexCredentialExpired}.
+*
+* The marker the pool chunk must honour is the literal 'adopted: true' plus
+* {@link isAdoptedCodexCredential}; an account carrying it must be treated as
+* read-only, non-refreshable and disposable. There is deliberately no refresh
+* function in this module to find in the first place.
+*
+* ---------------------------------------------------------------------------
+* RULE 4 — AN UNRECOGNISED SHAPE YIELDS undefined, NEVER AN EXCEPTION
+* ---------------------------------------------------------------------------
+* The card shows 'unrecognised local sign-in format' for undefined, which is a far
+* better outcome than a thrown error escaping into the settings route. Nothing is
+* guessed: a document in another auth_mode, a missing or non-object tokens
+* block, a missing access or refresh token, an access token that is not a JWT
+* with a usable 'exp', an unreadable or unparsable file — all of them are
+* undefined. Extra and unknown fields are ignored rather than rejected, so a
+* future CLI that adds one does not break adoption.
+*
+* THE TRAP THIS PARSER EXISTS TO AVOID. A Codex auth.json is NOT a flat bag of
+* tokens. It is a document that may carry an API key alongside the OAuth tokens,
+* and a "find the first accessToken anywhere in the JSON" scan would pick
+* whichever one the serializer happened to emit first — which is how an API key
+* or an unrelated token ends up presented to the Responses API as the user's
+* subscription credential. The read is therefore a direct, specific lookup of
+* tokens.access_token and its siblings — never a tree walk — and the test suite
+* holds a fixture carrying an unrelated token beside the real one and asserts
+* which comes back.
+*
+* ---------------------------------------------------------------------------
+* THE CLAIMS ARE DERIVED LOCALLY, NEVER ASKED OF ANYBODY
+* ---------------------------------------------------------------------------
+* expiresAt comes from the access token's own 'exp' claim, email and planType
+* from the id token's claims. The JWT payload is decoded in process; no token is
+* ever sent anywhere to be inspected, and no token value is logged or returned
+* from anything but the credential object the caller asked for.
+*
+* WHY EXPIRY IS REFUSED RATHER THAN DEFAULTED. A snapshot whose validity cannot
+* be established must not be used. Rather than stamping "now" or "never" and
+* hoping, this module yields undefined: the card then says the local sign-in
+* format is unrecognised, which is true, instead of importing a credential that
+* would 401 on the first request.
+*/
+/**
+* Environment variable that relocates the Codex CLI's home directory.
+*
+* Highest precedence, and honoured exactly as the CLI honours it: when it is set
+* to a non-blank value it names the home that holds auth.json, whatever the
+* platform's conventional location happens to be. This is also what makes the
+* whole module testable without touching a developer's real profile.
+*/
+const CODEX_HOME_ENV = "CODEX_HOME";
+/** File name of the credential document inside the Codex home. */
+const CODEX_CLI_CREDENTIAL_FILE = "auth.json";
+/**
+* Top-level key holding the OAuth tokens.
+*
+* Named as a constant because the specificity of this key IS the defence
+* described in the module comment: the read addresses this key, not the first
+* token it can find anywhere in the document.
+*/
+const CODEX_CLI_TOKENS_KEY = "tokens";
+/** Where an adopted snapshot came from, for the card and for the pool record. */
+const CODEX_CLI_CREDENTIAL_SOURCE = "codex";
+/** Namespace the id token carries the ChatGPT account claims under. */
+const CODEX_AUTH_CLAIMS_KEY = "https://api.openai.com/auth";
+/**
+* What the user is told when an adopted credential has aged out.
+*
+* Exported so the pool report and the settings card say the same sentence, and
+* so the instruction is stated once: the re-sign-in happens in the CODEX CLI, not
+* here, and the import has to be repeated afterwards.
+*/
+const ADOPTED_CODEX_CREDENTIAL_EXPIRED_HINT = "The sign-in imported from the Codex CLI has expired. Sign in again in the Codex CLI, then import it again from this settings card.";
+function isRecord$31(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** A trimmed, non-empty string, or nothing. */
+function nonEmptyString$5(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	return trimmed === "" ? void 0 : trimmed;
+}
+/**
+* The Codex CLI's home directory.
+*
+* The environment override wins whenever it is set to a non-blank value — a blank
+* or whitespace-only variable is treated as unset rather than as "the directory
+* whose name is empty", which on Windows would resolve to a drive-relative path.
+* Otherwise the conventional home/.codex directory is used, os.homedir() being
+* the same %USERPROFILE% on Windows and ~ on POSIX that the CLI itself uses.
+*
+* Read at CALL time rather than captured in a module constant: a test (or an
+* embedder) that sets the variable after import must see the change.
+*/
+function codexHomeDir() {
+	const override = process.env[CODEX_HOME_ENV]?.trim();
+	if (override) return override;
+	return path.join(os.homedir(), ".codex");
+}
+/**
+* Every path this module will look at, most authoritative first.
+*
+* A single candidate, which is a judgement call stated plainly. The Claude reader
+* in this package also falls back to the conventional home when the environment
+* override points somewhere else; here the override IS the user's own statement of
+* where this CLI keeps its sign-in, and honouring a stale scratch directory is
+* more dangerous than reporting nothing: a snapshot belonging to a profile the CLI
+* is not currently using would be adopted silently. The path actually consulted is
+* returned and printed by the caller, so "not found" is always accompanied by the
+* exact place that was looked at.
+*
+* A pure function — no filesystem access at all — so it is safe to call just to
+* render the card, and so its precedence is testable without touching a disk.
+*/
+function codexCliCredentialPaths() {
+	return [path.join(codexHomeDir(), CODEX_CLI_CREDENTIAL_FILE)];
+}
+/**
+* Whether a plain file exists at one path.
+*
+* stat, not lstat: a credential file reached through a symlink is a legitimate
+* layout — a user may keep profiles behind links — and the question asked here is
+* whether the client has a file there, not how it is reached.
+*
+* Any error (ENOENT, EACCES, ENOTDIR, an unsupported path shape) answers "no". A
+* failure to establish existence is not evidence of existence, and this path runs
+* on startup where throwing would take the plugin down over a missing file.
+*/
+async function existsAsFile$1(candidate) {
+	try {
+		return (await stat(candidate)).isFile();
+	} catch {
+		return false;
+	}
+}
+/**
+* Is there a local Codex CLI sign-in to offer?
+*
+* Safe on plugin startup: this NEVER opens a candidate for reading, so a user who
+* never opts in never has the credential's contents touched — not by this
+* function, not by the route that renders the card. Only stat runs, which reveals
+* existence and timestamps and nothing else.
+*
+* Deliberately NOT reported here: whether the file is valid, expired, or even
+* JSON. Answering that would require the read this function exists to avoid, and
+* the card does not need it — validity is answered by the read, after opt-in, and
+* lands on the card as either a credential or 'unrecognised local sign-in
+* format'.
+*
+* A boolean, rather than the record the Claude reader returns, because the two
+* callers want different things and neither needs the other's shape: the status
+* route wants a flag, and reports the path it consulted beside it. paths
+* is injectable so tests drive it against fixtures instead of a real profile;
+* production callers take the default.
+*/
+async function codexCliCredentialPresence(paths = codexCliCredentialPaths()) {
+	for (const candidate of paths) if (await existsAsFile$1(candidate)) return true;
+	return false;
+}
+/**
+* The claims of a JWT, decoded in process, or nothing.
+*
+* The payload is the second base64url segment; the signature is never touched and
+* the result is used only for the three non-secret facts below. Never sent
+* anywhere: a token handed to a decoder service is a token handed away.
+*
+* No verification is claimed and none is possible here — the signing key is the
+* issuer's, and this module has no business holding it. What it does instead is
+* refuse to invent: a token that does not decode is treated as stating nothing.
+*/
+function decodeJwtClaims(token) {
+	const parts = token.split(".");
+	if (parts.length !== 3) return void 0;
+	try {
+		const value = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+		return isRecord$31(value) ? value : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* The access token's expiry, in EPOCH MILLISECONDS, or nothing.
+*
+* RFC 7519 states 'exp' in SECONDS since the epoch, and the store's
+* StoredOAuthCredentials states milliseconds — a thousand-fold difference that is
+* silent when it goes the wrong way (a credential stamped a thousand times too
+* late reads as unexpired for centuries) and catastrophic the other. The
+* conversion is therefore done here, once, with a comment on it.
+*
+* Only a finite, non-negative number is accepted. A string, null, NaN, a
+* negative value or a missing claim are all "this document states no usable
+* expiry", and the caller's answer to that is to refuse the whole document rather
+* than import a credential whose validity nothing established.
+*/
+function expiryFromAccessToken(accessToken) {
+	const claims = decodeJwtClaims(accessToken);
+	if (claims === void 0) return void 0;
+	const exp = claims.exp;
+	if (typeof exp !== "number" || !Number.isFinite(exp) || exp < 0) return void 0;
+	return Math.round(exp * 1e3);
+}
+/**
+* Map one parsed credential document onto the store's credential shape.
+*
+* Pure and exported so the format rules can be tested without a filesystem, and
+* so a later chunk that reads the document from somewhere else (a backup, a pasted
+* blob) reuses the one set of rules instead of growing a second, drifting copy.
+*
+* Returns undefined for every shape it does not recognise, and never throws — see
+* Rule 4 in the module comment. The gate is deliberately narrow: the document must
+* be a JSON object in the ChatGPT auth mode, its tokens block must be an object,
+* and it must carry BOTH a non-empty access token and a non-empty refresh token.
+* An access token alone is not adopted because the store's record is a sign-in,
+* not a bare token, and a record with an empty one could never be re-recognised.
+*
+* The unrelated-token trap is handled by construction: value.tokens is addressed
+* directly and no other key of the document is ever traversed, so whatever else
+* the file carries cannot reach the result.
+*/
+function parseAdoptedCodexCredential(value, sourcePath) {
+	if (!isRecord$31(value)) return void 0;
+	if (value.auth_mode !== "chatgpt") return void 0;
+	const tokens = value[CODEX_CLI_TOKENS_KEY];
+	if (!isRecord$31(tokens)) return void 0;
+	const accessToken = nonEmptyString$5(tokens.access_token);
+	if (accessToken === void 0) return void 0;
+	const refreshToken = nonEmptyString$5(tokens.refresh_token);
+	if (refreshToken === void 0) return void 0;
+	const expiresAt = expiryFromAccessToken(accessToken);
+	if (expiresAt === void 0) return void 0;
+	const credentials = {
+		accessToken,
+		refreshToken,
+		expiresAt
+	};
+	const idToken = nonEmptyString$5(tokens.id_token);
+	if (idToken !== void 0) {
+		credentials.idToken = idToken;
+		const claims = decodeJwtClaims(idToken);
+		const email = claims === void 0 ? void 0 : nonEmptyString$5(claims.email);
+		if (email !== void 0) credentials.email = email;
+		const authClaims = claims === void 0 ? void 0 : claims[CODEX_AUTH_CLAIMS_KEY];
+		const planType = isRecord$31(authClaims) ? nonEmptyString$5(authClaims.chatgpt_plan_type) : void 0;
+		if (planType !== void 0) credentials.planType = planType;
+	}
+	const accountId = nonEmptyString$5(tokens.account_id);
+	if (accountId !== void 0) credentials.accountId = accountId;
+	return {
+		adopted: true,
+		source: CODEX_CLI_CREDENTIAL_SOURCE,
+		sourcePath,
+		credentials
+	};
+}
+/**
+* Read the local Codex CLI sign-in; the first usable candidate wins.
+*
+* ONLY call this after the user has explicitly opted in — see the module comment.
+*
+* Never throws and never rejects: an absent file, an unreadable file, a file that
+* is not JSON, and a JSON document of an unrecognised shape all produce undefined,
+* which the card renders as 'unrecognised local sign-in format'. A settings route
+* must not be able to fail because a user's file was mid-write.
+*/
+async function readCodexCliCredentials(paths = codexCliCredentialPaths()) {
+	for (const candidate of paths) try {
+		const raw = await readFile(candidate, "utf8");
+		const adopted = parseAdoptedCodexCredential(JSON.parse(raw), candidate);
+		if (adopted !== void 0) return adopted;
+	} catch {}
+}
+/**
+* Whether an adopted credential's access token is already unusable.
+*
+* A structural mirror of the expiry test the OAuth module applies to its own
+* credentials (expiresAt - Date.now() > 0), asked of a pooled credential so the
+* pool can refuse it WITHOUT ever reaching for a refresh this module deliberately
+* does not perform. A non-finite expiresAt counts as expired, matching the
+* refusal in the reader: no established validity, no use.
+*
+* now is injectable so a test can reason about a fixed clock.
+*/
+function isAdoptedCodexCredentialExpired(credential, now = Date.now()) {
+	const expiresAt = credential.expiresAt;
+	return !(typeof expiresAt === "number" && Number.isFinite(expiresAt) && expiresAt > now);
+}
+//#endregion
 //#region src/host/codex-account-pool.ts
+/**
+* The ChatGPT account pool.
+*
+* TWO KINDS OF ACCOUNT, AND ONLY ONE OF THEM MAY BE REFRESHED.
+*
+* - managed — signed in through this plugin. Its credential lives in the pool's
+*   encrypted storage AND in the pre-pool credential document beside it, it is
+*   refreshable, and deleting it is this plugin's business.
+* - adopted — a SNAPSHOT read out of a local Codex CLI sign-in by 'codex-adopt.ts'
+*   (marker 'adopted: true', source 'codex'). It is used only while its own access
+*   token is still valid.
+*
+* An adopted snapshot is NEVER refreshed, and the reason is not an optimisation:
+* the ChatGPT refresh token the CLI stores rotates, and the CLI refreshes its own
+* file in place. Two processes spending one grant invalidate each other, and
+* whoever loses the race holds a token the server has already retired — which
+* leaves the user signed OUT of the Codex CLI by this plugin's good intentions. An
+* in-process single-flight cannot fix that, because the race is across PROCESSES
+* and the only state they share is a file 'codex-adopt.ts' must never write. Once
+* such a snapshot has expired the pool takes it out of rotation and surfaces
+* ADOPTED_CODEX_CREDENTIAL_EXPIRED_HINT — sign in again in the CODEX CLI and
+* re-import, not here.
+*
+* The rule is enforced twice on purpose: the needsRefresh hook answers false for
+* an adopted credential no matter what its expiry says, and the refresh hook
+* itself refuses one, so a future caller that forgets the first fails loudly
+* instead of silently spending a grant that is not ours to spend.
+*
+* MANAGED BEATS ADOPTED on a conflict, and the marker is therefore written on
+* EVERY account this file creates, including the explicit false case: the core
+* merges a re-authorization as { ...existing, ...created }, so an omitted key
+* would leave a stored 'adopted: true' — and its never-refresh consequence — on a
+* record that is now plugin-owned.
+*/
+/**
+* Whether a pooled credential is an adopted snapshot.
+*
+* The two fields, and only those two: a plain credential carries no 'adopted'
+* field and must never be mistaken for a snapshot, because treating a
+* plugin-owned account as a disposable one would freeze it out of refreshing and
+* make deleteAccount refuse to remove an account the user signed in here.
+*/
+function isAdoptedCodexPoolCredential(credentials) {
+	return credentials.adopted === true && credentials.source === "codex";
+}
+/**
+* Whether a credential must be refreshed before the next request.
+*
+* FALSE for every adopted snapshot, valid or expired. That is this pool's core
+* rule: an adopted credential is borrowed for exactly as long as the Codex CLI
+* vouched for it, and this pool has no business rotating a token another process
+* is rotating too. See the module comment.
+*/
+function codexNeedsRefresh(credentials, now) {
+	if (isAdoptedCodexPoolCredential(credentials)) return false;
+	return credentials.expiresAt - now <= TOKEN_REFRESH_MARGIN_MS;
+}
+/**
+* Why a stored credential is already known to be unusable, or nothing.
+*
+* Reported purely — nothing is written here — and consulted by the core for both
+* routing eligibility and credential usability, which is what makes an expired
+* snapshot non-routable WITHOUT a write on every read. The hint names the remedy
+* in the Codex CLI, because that is where the user has to go: re-adopting here is
+* only possible after the CLI itself signed in again.
+*/
+function codexAuthRejectedReason(credentials) {
+	if (!isAdoptedCodexPoolCredential(credentials)) return void 0;
+	return isAdoptedCodexCredentialExpired(credentials) ? ADOPTED_CODEX_CREDENTIAL_EXPIRED_HINT : void 0;
+}
+/**
+* Message raised if a refresh of a still-valid adopted snapshot were attempted.
+*
+* Unreachable through this pool's own paths (see the module comment); it exists
+* because 'unreachable' is a claim the guard has to be able to make good on.
+*/
+const ADOPTED_NEVER_REFRESHED_MESSAGE$1 = "The sign-in imported from the Codex CLI is never refreshed by this plugin: the Codex CLI refreshes the same rotating token, and two refreshers would invalidate each other. Sign in again in the Codex CLI, then import the new sign-in from this settings card.";
+/** Raised when a refresh of an adopted snapshot is attempted. Never a 401. */
+var CodexAdoptedCredentialError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "CodexAdoptedCredentialError";
+	}
+};
 /** Encrypted pool file the ChatGPT line owns; the single-credential store stays the mirror. */
 function codexPoolPath() {
 	return path.join(dshHomeDir(), "storages", "codex-pool.json");
@@ -2916,13 +3352,18 @@ function parseCodexPoolData(value) {
 		const raw = item;
 		if (typeof raw.id !== "string") continue;
 		const credentials = parseStoredCredentials(raw.credentials);
+		const adopted = isAdoptedCodexPoolCredential(credentials);
 		const account = {
 			id: raw.id,
 			alias: typeof raw.alias === "string" ? raw.alias : credentials.email || "账号",
 			credentials,
 			addedAt: typeof raw.addedAt === "number" ? raw.addedAt : Date.now(),
-			isPrimary: raw.isPrimary === true
+			isPrimary: raw.isPrimary === true,
+			adopted,
+			source: adopted ? CODEX_CLI_CREDENTIAL_SOURCE : "managed"
 		};
+		const sourcePath = optionalString$9(raw, "sourcePath") ?? credentials.sourcePath;
+		if (adopted && sourcePath !== void 0) account.sourcePath = sourcePath;
 		const email = optionalString$9(raw, "email") ?? credentials.email;
 		if (email !== void 0) account.email = email;
 		const planType = optionalString$9(raw, "planType") ?? credentials.planType;
@@ -2945,14 +3386,6 @@ function parseCodexPoolData(value) {
 	return result;
 }
 /**
-* ChatGPT's account pool.
-*
-* Thin wrapper over {@link AccountPoolCore}: it only supplies the credential
-* shape, the identity a duplicate sign-in collapses onto, and the two provider
-* hooks the core cannot know — how to refresh one account's tokens and which
-* accounts a cached quota window already rules out.
-*/
-/**
 * Per-account in-flight requests, shared by every ChatGPT request this host
 * makes. A fan-out of subagents is what reaches a plan's concurrency bound, so
 * the bound is enforced here rather than discovered by cooling every account at
@@ -2997,23 +3430,31 @@ var CodexAccountPool = class extends AccountPoolCore {
 			parsePoolData: parseCodexPoolData,
 			dedupeKey: (credentials) => credentials.accountId ?? credentials.email,
 			defaultAlias: (credentials, position) => credentials.email ?? `账号 ${position}`,
-			createAccount: ({ id, alias, credentials, addedAt, isPrimary }) => ({
-				id,
-				alias,
-				credentials,
-				addedAt,
-				isPrimary,
-				...credentials.email === void 0 ? {} : { email: credentials.email },
-				...credentials.planType === void 0 ? {} : { planType: credentials.planType },
-				...credentials.accountId === void 0 ? {} : { accountId: credentials.accountId }
-			}),
+			createAccount: ({ id, alias, credentials, addedAt, isPrimary }) => {
+				const adopted = isAdoptedCodexPoolCredential(credentials);
+				return {
+					id,
+					alias,
+					credentials,
+					addedAt,
+					isPrimary,
+					adopted,
+					source: adopted ? CODEX_CLI_CREDENTIAL_SOURCE : "managed",
+					sourcePath: adopted ? credentials.sourcePath : void 0,
+					...credentials.email === void 0 ? {} : { email: credentials.email },
+					...credentials.planType === void 0 ? {} : { planType: credentials.planType },
+					...credentials.accountId === void 0 ? {} : { accountId: credentials.accountId }
+				};
+			},
 			expiresAt: (credentials) => credentials.expiresAt,
-			needsRefresh: (credentials, now) => credentials.expiresAt - now <= TOKEN_REFRESH_MARGIN_MS,
+			needsRefresh: (credentials, now) => codexNeedsRefresh(credentials, now),
 			refresh: async (credentials) => {
+				if (isAdoptedCodexPoolCredential(credentials)) throw new CodexAdoptedCredentialError(isAdoptedCodexCredentialExpired(credentials) ? ADOPTED_CODEX_CREDENTIAL_EXPIRED_HINT : ADOPTED_NEVER_REFRESHED_MESSAGE$1);
 				const refresher = ref.current;
 				if (refresher === void 0) throw new Error("ChatGPT 凭据刷新服务尚未就绪");
 				return refresher.refreshAccount(credentials);
 			},
+			authRejectedReason: (credentials) => codexAuthRejectedReason(credentials),
 			refreshFailureStatus: (error) => error instanceof OAuthServiceError && (error.status === 400 || error.status === 401) ? "expired" : void 0,
 			legacyAccount: async () => {
 				const stored = await store.load();
@@ -3024,6 +3465,8 @@ var CodexAccountPool = class extends AccountPoolCore {
 					credentials: stored,
 					addedAt: Date.now(),
 					isPrimary: true,
+					adopted: false,
+					source: "managed",
 					...stored.email === void 0 ? {} : { email: stored.email },
 					...stored.planType === void 0 ? {} : { planType: stored.planType },
 					...stored.accountId === void 0 ? {} : { accountId: stored.accountId }
@@ -3034,17 +3477,30 @@ var CodexAccountPool = class extends AccountPoolCore {
 					await store.clear();
 					return;
 				}
+				if (isAdoptedCodexPoolCredential(credentials)) return;
 				await store.save(credentials);
 			},
-			extendSummary: (account, base) => ({
-				...base,
-				...account.email === void 0 ? {} : { email: account.email },
-				...account.planType === void 0 ? {} : { planLabel: account.planType },
-				...(() => {
-					const quota = quotaSnapshotRef.current?.(account);
-					return quota === void 0 ? {} : { quota };
-				})()
-			}),
+			extendSummary: (account, base) => {
+				const adopted = account.adopted === true;
+				const expired = adopted && isAdoptedCodexCredentialExpired(account.credentials);
+				return {
+					...base,
+					...account.email === void 0 ? {} : { email: account.email },
+					...account.planType === void 0 ? {} : { planLabel: account.planType },
+					adopted,
+					source: account.source,
+					removable: !adopted,
+					...account.sourcePath === void 0 ? {} : { sourcePath: account.sourcePath },
+					...(() => {
+						const quota = quotaSnapshotRef.current?.(account);
+						return quota === void 0 ? {} : { quota };
+					})(),
+					...expired ? {
+						authStatus: "expired",
+						authFailedReason: ADOPTED_CODEX_CREDENTIAL_EXPIRED_HINT
+					} : {}
+				};
+			},
 			emptyMessage: "未登录 ChatGPT 账号，请在「设置 → 订阅服务 → ChatGPT」中添加并登录账号。",
 			...options.backend === void 0 ? {} : { backend: options.backend },
 			...options.maxAccounts === void 0 ? {} : { maxAccounts: options.maxAccounts }
@@ -3098,6 +3554,35 @@ var CodexAccountPool = class extends AccountPoolCore {
 		if (this.refresherRef.current === void 0) throw new Error("ChatGPT 凭据刷新服务尚未就绪");
 		return this.renewCredential(accountId, fetch, account.credentials);
 	}
+	/**
+	* Remove one account inside a transaction, refusing a borrowed snapshot.
+	*
+	* The check lives HERE rather than in the public delete method so it cannot be
+	* separated from the removal by a concurrent change, and so every caller of the
+	* core's own deletion inherits it. The remedy is a separate action
+	* ({@link removeImportedAccount}): a card must not destroy an account this plugin
+	* did not create with the same button that deletes its own.
+	*/
+	deleteAccountFromPool(data, accountId) {
+		if (data.accounts.find((account) => account.id === accountId)?.adopted === true) throw new Error("The sign-in imported from the Codex CLI is not an account this plugin owns; remove the import instead.");
+		super.deleteAccountFromPool(data, accountId);
+	}
+	/**
+	* Drop an imported snapshot from the pool — the card's 'remove import' action.
+	*
+	* Separate from {@link deleteAccount} because that refuses one, and because the
+	* user is asking to stop borrowing a sign-in, not to sign out of an account. The
+	* Codex CLI's own file is touched by neither path: not deleted, not rewritten,
+	* not moved. This only forgets the copy.
+	*/
+	async removeImportedAccount(accountId) {
+		return this.updatePool((data) => {
+			const target = data.accounts.find((account) => account.id === accountId);
+			if (target === void 0) return;
+			if (target.adopted !== true) throw new Error("That account was signed in through this plugin; delete it instead of removing an import.");
+			super.deleteAccountFromPool(data, accountId);
+		});
+	}
 	/** The single-credential store this pool mirrors its primary account into. */
 	mirrorStore() {
 		return this.store;
@@ -7147,12 +7632,16 @@ function identityKey(credentials) {
 //#endregion
 //#region src/host/routes.ts
 const MAX_BODY_BYTES$6 = 64 * 1024;
-function registerRoutes(ctx, oauth, usage, preferences, proxyManager, searchSwitcher, routeAudit, accountPool, fetchConfiguration) {
+function registerRoutes(ctx, oauth, usage, preferences, proxyManager, searchSwitcher, routeAudit, accountPool, fetchConfiguration, adopt) {
+	const adoptPaths = adopt?.adoptPaths;
 	const handler = async (request, response) => {
 		const url = new URL(request.url ?? "/", "http://dsh.local");
 		if (request.method === "GET" && url.pathname === `/api/dsh-chatgpt-subscription/status`) {
 			const oauthStatus = await oauth.status();
 			const quota = await usage.status(oauthStatus.authenticated, false, { backgroundRefresh: true });
+			const codexCliPaths = adoptPaths ?? codexCliCredentialPaths();
+			const codexCliSignInAvailable = await codexCliCredentialPresence(codexCliPaths).catch(() => false);
+			const codexCliSignInPath = codexCliPaths[0];
 			json(response, {
 				ok: true,
 				value: {
@@ -7160,6 +7649,8 @@ function registerRoutes(ctx, oauth, usage, preferences, proxyManager, searchSwit
 					quota,
 					quotaRefreshing: usage.refreshing,
 					preferences: preferences.status(),
+					codexCliSignInAvailable,
+					codexCliSignInPath,
 					detectedProxy: proxyManager?.getSystemProxy() ?? null,
 					activeProxy: proxyManager?.resolveActiveProxyUrl() ?? null,
 					switcher: searchSwitcher?.status() ?? null,
@@ -7238,6 +7729,14 @@ function registerRoutes(ctx, oauth, usage, preferences, proxyManager, searchSwit
 			});
 			return;
 		}
+		const refreshedStatus = async () => {
+			const afterAction = await oauth.status();
+			return {
+				...afterAction,
+				quota: await usage.status(afterAction.authenticated),
+				preferences: preferences.status()
+			};
+		};
 		try {
 			switch (url.pathname) {
 				case `${ROUTE_PREFIX$5}/login/start`:
@@ -7267,14 +7766,60 @@ function registerRoutes(ctx, oauth, usage, preferences, proxyManager, searchSwit
 					else if (action === "clear-cooldown" && accountId !== null) await accountPool.clearCooldown(accountId);
 					else if (action === "strategy" && (body.strategy === "sequential" || body.strategy === "round-robin" || body.strategy === "sticky")) await accountPool.setStrategy(body.strategy);
 					else if (action === "relogin" && accountId !== null) await accountPool.clearAuthFailed(accountId);
-					const afterAction = await oauth.status();
 					json(response, {
 						ok: true,
-						value: {
-							...afterAction,
-							quota: await usage.status(afterAction.authenticated),
-							preferences: preferences.status()
-						}
+						value: await refreshedStatus()
+					});
+					return;
+				}
+				case `${ROUTE_PREFIX$5}/adopt`: {
+					if (accountPool === void 0) {
+						jsonError(response, 400, {
+							code: "bad-request",
+							message: "Importing a local Codex CLI sign-in needs the account pool, which is not installed."
+						});
+						return;
+					}
+					if (field(body, "source") !== "codex") {
+						jsonError(response, 400, {
+							code: "bad-request",
+							message: "That local sign-in is not imported here. Claude Code and MiniMax Code are imported from their own provider settings."
+						});
+						return;
+					}
+					const adopted = await readCodexCliCredentials(adoptPaths ?? codexCliCredentialPaths());
+					if (adopted === void 0) {
+						jsonError(response, 400, {
+							code: "bad-request",
+							message: "No usable local Codex CLI sign-in was found (unrecognised local sign-in format)."
+						});
+						return;
+					}
+					await accountPool.addAccount({
+						...adopted.credentials,
+						adopted: true,
+						source: CODEX_CLI_CREDENTIAL_SOURCE,
+						sourcePath: adopted.sourcePath
+					});
+					json(response, {
+						ok: true,
+						value: await refreshedStatus()
+					});
+					return;
+				}
+				case `${ROUTE_PREFIX$5}/adopt/disable`: {
+					if (accountPool === void 0) {
+						jsonError(response, 400, {
+							code: "bad-request",
+							message: "The ChatGPT account pool is not installed."
+						});
+						return;
+					}
+					const imported = ((await accountPool.read().catch(() => null))?.accounts ?? []).filter((account) => account.adopted === true);
+					for (const account of imported) await accountPool.removeImportedAccount(account.id);
+					json(response, {
+						ok: true,
+						value: await refreshedStatus()
 					});
 					return;
 				}
@@ -9272,17 +9817,17 @@ function base64Length$4(bytes) {
 	return Math.ceil(bytes / 3) * 4;
 }
 /** Request payload one inline image block occupies, when it can be measured. */
-function requestImageBytes$4(block) {
+function requestImageBytes$3(block) {
 	const attachment = attachmentOf$5(block);
 	if (attachment) return base64Length$4(attachment.bytes);
 	const inline = asString$17(block.data) || asString$17(block.base64);
 	return inline ? inline.length : void 0;
 }
-function collectRequestImageBytes$4(content, lengths) {
+function collectRequestImageBytes$3(content, lengths) {
 	if (!Array.isArray(content)) return;
 	for (const block of content) {
 		if (!isRecord$27(block) || block.type !== "image") continue;
-		const bytes = requestImageBytes$4(block);
+		const bytes = requestImageBytes$3(block);
 		if (bytes !== void 0) lengths.push(bytes);
 	}
 }
@@ -9301,7 +9846,7 @@ function collectRequestImageBytes$4(content, lengths) {
 */
 function offloadOldestRequestImages$4(options) {
 	const lengths = [];
-	for (const message of options.messages) collectRequestImageBytes$4(message.content, lengths);
+	for (const message of options.messages) collectRequestImageBytes$3(message.content, lengths);
 	const excess = lengths.reduce((sum, bytes) => sum + bytes, 0) - MAX_REQUEST_IMAGE_BYTES$4;
 	if (excess <= 0) return options;
 	let omitted = 0;
@@ -9317,7 +9862,7 @@ function offloadOldestRequestImages$4(options) {
 		let replaced = false;
 		const content = message.content.map((block) => {
 			if (remaining.count === 0 || !isRecord$27(block) || block.type !== "image") return block;
-			if (requestImageBytes$4(block) === void 0) return block;
+			if (requestImageBytes$3(block) === void 0) return block;
 			remaining.count -= 1;
 			replaced = true;
 			return {
@@ -13216,17 +13761,17 @@ function collectImageRefs$3(content, refs) {
 function base64Length$3(bytes) {
 	return Math.ceil(bytes / 3) * 4;
 }
-function requestImageBytes$3(block) {
+function requestImageBytes$2(block) {
 	const attachment = attachmentOf$4(block);
 	if (attachment) return base64Length$3(attachment.bytes);
 	const inline = asString$15(block.data) || asString$15(block.base64);
 	return inline ? inline.length : void 0;
 }
-function collectRequestImageBytes$3(content, lengths) {
+function collectRequestImageBytes$2(content, lengths) {
 	if (!Array.isArray(content)) return;
 	for (const block of content) {
 		if (!isRecord$25(block) || block.type !== "image") continue;
-		const bytes = requestImageBytes$3(block);
+		const bytes = requestImageBytes$2(block);
 		if (bytes !== void 0) lengths.push(bytes);
 	}
 }
@@ -13237,7 +13782,7 @@ function collectRequestImageBytes$3(content, lengths) {
 */
 function offloadOldestRequestImages$3(options) {
 	const lengths = [];
-	for (const message of options.messages) collectRequestImageBytes$3(message.content, lengths);
+	for (const message of options.messages) collectRequestImageBytes$2(message.content, lengths);
 	const excess = lengths.reduce((sum, bytes) => sum + bytes, 0) - MAX_REQUEST_IMAGE_BYTES$3;
 	if (excess <= 0) return options;
 	let omitted = 0;
@@ -13253,7 +13798,7 @@ function offloadOldestRequestImages$3(options) {
 		let replaced = false;
 		const content = message.content.map((block) => {
 			if (remaining.count === 0 || !isRecord$25(block) || block.type !== "image") return block;
-			if (requestImageBytes$3(block) === void 0) return block;
+			if (requestImageBytes$2(block) === void 0) return block;
 			remaining.count -= 1;
 			replaced = true;
 			return {
@@ -20612,19 +21157,135 @@ function collectImageRefs$2(content, refs) {
 function base64Length$2(bytes) {
 	return Math.ceil(bytes / 3) * 4;
 }
-function requestImageBytes$2(block) {
+/**
+* Base64 payload one image block contributes to the wire, or undefined when it
+* contributes none.
+*
+* This is the length of what is SENT, which is not the length of what is
+* STORED. Kimi's own client downsamples and re-encodes an oversized image before
+* delivery "to avoid the supplier erroring on an oversized image", and this route
+* does the same through `requestImageTarget`: a 5 MB screenshot reaches the
+* wire as a ~256 KiB request version. Measuring `attachment.bytes` therefore
+* over-counts every image that was scaled, and an image that fits comfortably
+* after scaling was reported as several megabytes over budget and dropped.
+*
+* With `images` supplied the measurement is exact. Without it the stored size is
+* the only estimate available, so it stays the fallback and every call site that
+* has no resolved map behaves exactly as before.
+*/
+function requestImagePayloadLength(block, images) {
+	let data = asString$11(block.data) || asString$11(block.base64);
+	const source = isRecord$19(block.source) ? block.source : void 0;
+	if (!data && source) data = asString$11(source.data) || asString$11(source.base64);
+	if (data?.startsWith("data:")) {
+		const matched = data.match(/^data:([^;,]+);base64,(.*)$/s);
+		if (matched) data = matched[2] ?? "";
+	}
+	if (data) return data.length;
 	const attachment = attachmentOf$3(block);
-	if (attachment) return base64Length$2(attachment.bytes);
-	const inline = asString$11(block.data) || asString$11(block.base64);
-	return inline ? inline.length : void 0;
+	if (!attachment) return void 0;
+	if (images === void 0) return base64Length$2(attachment.bytes);
+	const resolved = images.get(attachment.attachmentId);
+	return resolved?.kind === "inline" ? resolved.data.length : void 0;
 }
-function collectRequestImageBytes$2(content, lengths) {
+/**
+* Collect every image occurrence in model request order, recursing into tool
+* results the way `collectImageRefs` does.
+*
+* RECURSION IS NOT OPTIONAL. A `read_image` result or a screenshot inside a tool
+* result carries its pixels to the wire — `toolResultBlocks` sends them — so an
+* earlier version that only looked at top-level blocks under-counted exactly the
+* images a tool-using session produces most of. The budget has to describe the
+* body that is actually built.
+*/
+function collectRequestImagePayloads(content, images, lengths) {
 	if (!Array.isArray(content)) return;
 	for (const block of content) {
-		if (!isRecord$19(block) || block.type !== "image") continue;
-		const bytes = requestImageBytes$2(block);
-		if (bytes !== void 0) lengths.push(bytes);
+		if (!isRecord$19(block)) continue;
+		if (block.type === "image") {
+			const bytes = requestImagePayloadLength(block, images);
+			if (bytes !== void 0) lengths.push(bytes);
+			continue;
+		}
+		if (block.type === "tool-result") collectRequestImagePayloads(block.content, images, lengths);
+	}
+}
+/**
+* Wire-level base64 payload of each image occurrence one request carries, in the
+* order the request sends them, so index N is the Nth oldest image.
+*/
+function requestImagePayloadLengths(options, images) {
+	const lengths = [];
+	for (const message of options.messages) collectRequestImagePayloads(message.content, images, lengths);
+	return lengths;
+}
+/** How many of the oldest occurrences must go to bring the total under `maxBytes`. */
+function imagesToOffloadCount(lengths, maxBytes) {
+	const excess = lengths.reduce((sum, bytes) => sum + bytes, 0) - maxBytes;
+	if (excess <= 0) return 0;
+	let freed = 0;
+	let omitted = 0;
+	for (const bytes of lengths) {
+		if (freed >= excess) break;
+		freed += bytes;
+		omitted += 1;
 	}
+	return omitted;
+}
+/**
+* Replace the first `count` image occurrences with a visible placeholder,
+* recursing into tool results. Durable history is untouched; only the request
+* about to be sent changes.
+*/
+function replaceOldestRequestImages(options, count) {
+	if (count <= 0) return options;
+	const remaining = { count };
+	const replaceIn = (content) => {
+		if (!Array.isArray(content) || remaining.count === 0) return {
+			content,
+			replaced: false
+		};
+		let replaced = false;
+		return {
+			content: content.map((block) => {
+				if (remaining.count === 0 || !isRecord$19(block)) return block;
+				if (block.type === "image") {
+					if (requestImagePayloadLength(block) === void 0) return block;
+					remaining.count -= 1;
+					replaced = true;
+					return {
+						type: "text",
+						text: OMITTED_IMAGE_TEXT$2
+					};
+				}
+				if (block.type === "tool-result" && Array.isArray(block.content)) {
+					const inner = replaceIn(block.content);
+					if (!inner.replaced) return block;
+					replaced = true;
+					return {
+						...block,
+						content: inner.content
+					};
+				}
+				return block;
+			}),
+			replaced
+		};
+	};
+	let changed = false;
+	const messages = options.messages.map((message) => {
+		const result = replaceIn(message.content);
+		if (!result.replaced) return message;
+		changed = true;
+		return {
+			...message,
+			content: result.content
+		};
+	});
+	return changed ? {
+		...options,
+		messages
+	} : options;
 }
 /**
 * Longest edge any image of this request may keep.
@@ -20684,41 +21345,22 @@ function requestImageTarget(ref, edge = REQUEST_IMAGE_MAX_EDGE) {
 *
 * Durable history is untouched; only the request about to be sent changes.
 */
-function offloadOldestRequestImages$2(options, maxBytes = MAX_REQUEST_IMAGE_BYTES$2) {
-	const lengths = [];
-	for (const message of options.messages) collectRequestImageBytes$2(message.content, lengths);
-	const excess = lengths.reduce((sum, bytes) => sum + bytes, 0) - maxBytes;
-	if (excess <= 0) return options;
-	let omitted = 0;
-	let freed = 0;
-	for (const bytes of lengths) {
-		if (freed >= excess) break;
-		freed += bytes;
-		omitted += 1;
-	}
-	const remaining = { count: omitted };
-	const messages = options.messages.map((message) => {
-		if (remaining.count === 0 || !Array.isArray(message.content)) return message;
-		let replaced = false;
-		const content = message.content.map((block) => {
-			if (remaining.count === 0 || !isRecord$19(block) || block.type !== "image") return block;
-			if (requestImageBytes$2(block) === void 0) return block;
-			remaining.count -= 1;
-			replaced = true;
-			return {
-				type: "text",
-				text: OMITTED_IMAGE_TEXT$2
-			};
-		});
-		return replaced ? {
-			...message,
-			content
-		} : message;
+function offloadOldestRequestImages$2(options, maxBytes = MAX_REQUEST_IMAGE_BYTES$2, images) {
+	return replaceOldestRequestImages(options, imagesToOffloadCount(requestImagePayloadLengths(options, images), maxBytes));
+}
+/**
+* Whether a request still carries at least one image the mapper can send.
+*
+* A request whose images have all been replaced by placeholders can no longer
+* shrink, which is what separates "drop more images" from "this body is too
+* large for a reason no image budget can fix".
+*/
+function requestHasSendableImage(options) {
+	return options.messages.some((message) => {
+		const content = message.content;
+		if (!Array.isArray(content)) return false;
+		return content.some((block) => isRecord$19(block) && block.type === "image");
 	});
-	return {
-		...options,
-		messages
-	};
 }
 /**
 * Read every durable `{ type: 'image', attachment }` block one request carries.
@@ -21917,7 +22559,48 @@ function assertRequestBodyFits$1(body, carriesVideo = false) {
 	const bytes = Buffer.byteLength(serialized, "utf8");
 	const limit = carriesVideo ? MAX_VIDEO_MESSAGE_BODY_BYTES : MAX_MESSAGE_BODY_BYTES;
 	if (bytes <= limit) return serialized;
-	throw new LlmError$1(`Kimi Code rejected the request before sending: the serialized body is ${bytes} bytes, above the ${limit}-byte limit this route enforces. Compact the conversation or start a new session, and check for large tool results or attached media.`, "PROVIDER_ERROR");
+	throw new LlmError$1(oversizedBodyMessage(bytes, limit, body), "PROVIDER_ERROR");
+}
+function walkJson(value, visit) {
+	if (Array.isArray(value)) {
+		for (const item of value) walkJson(item, visit);
+		return;
+	}
+	if (!isRecord$17(value)) return;
+	visit(value);
+	for (const nested of Object.values(value)) walkJson(nested, visit);
+}
+/**
+* Measure one already-serialized body by composition.
+*
+* Image payload is found structurally (a base64 `data:` URL or an Anthropic
+* base64 source) rather than by searching for a marker substring, so a user
+* message that happens to contain that text cannot inflate the image share.
+*/
+function requestBodyBreakdown(body, carriesVideo = false) {
+	const serialized = JSON.stringify(body);
+	const totalBytes = Buffer.byteLength(serialized, "utf8");
+	let imageBytes = 0;
+	walkJson(body, (node) => {
+		const url = isRecord$17(node.image_url) ? asString$9(node.image_url.url) : void 0;
+		if (url?.startsWith("data:")) {
+			imageBytes += Buffer.byteLength(url, "utf8");
+			return;
+		}
+		const source = isRecord$17(node.source) ? node.source : void 0;
+		if (source && asString$9(source.data) !== void 0 && asString$9(source.media_type) !== void 0) imageBytes += Buffer.byteLength(asString$9(source.data) ?? "", "utf8");
+	});
+	const toolSchemaBytes = Buffer.byteLength(JSON.stringify(body.tools ?? []), "utf8");
+	return {
+		totalBytes,
+		imageBytes,
+		toolSchemaBytes,
+		otherBytes: Math.max(0, totalBytes - imageBytes - toolSchemaBytes)
+	};
+}
+function oversizedBodyMessage(bytes, limit, body) {
+	const parts = requestBodyBreakdown(body);
+	return `Kimi Code rejected the request before sending: the serialized body is ${bytes} bytes, above the ${limit}-byte limit this route enforces. Composition: ${`images ${parts.imageBytes} bytes, tool schemas ${parts.toolSchemaBytes} bytes, conversation text and system prompt ${parts.otherBytes} bytes`}. ${parts.imageBytes >= parts.otherBytes ? "Older images are omitted first; drop or re-attach fewer images, or start a new session." : "The conversation text and tool schemas dominate, so no image budget can fix this: compact the conversation or start a new session."}`;
 }
 function createStreamState$3(wire, sessionId) {
 	return {
@@ -22509,6 +23192,34 @@ function assertStreamComplete$3(state) {
 //#endregion
 //#region src/host/kimi-code/adapter.ts
 /**
+* Rebuild attempts allowed while shrinking a request into its body ceiling.
+*
+* Each attempt drops at least one image, so the loop is bounded by the number of
+* images the request carries; this cap only exists so a future change that fails
+* to make progress fails fast instead of spinning.
+*/
+const MAX_BODY_FIT_ATTEMPTS = 64;
+/**
+* Drop the fewest oldest images that free at least `excessBytes`.
+*
+* `current` is the options the over-large body was built from, and `resolved`
+* supplies the post-scaling payload length of each occurrence, so the arithmetic
+* is made of the bytes the wire actually carries rather than of stored sizes.
+*/
+function dropOldestImagesUntilFits(current, resolved, excessBytes, baseline) {
+	const lengths = requestImagePayloadLengths(baseline, resolved);
+	const alreadyDropped = countOmitted(current, baseline);
+	const additional = imagesToOffloadCount(lengths.slice(alreadyDropped), excessBytes);
+	if (additional === 0) return current;
+	return replaceOldestRequestImages(current, additional);
+}
+/** How many image occurrences `current` has already had replaced, versus `baseline`. */
+function countOmitted(current, baseline) {
+	const before = requestImagePayloadLengths(baseline).length;
+	const after = requestImagePayloadLengths(current).length;
+	return Math.max(0, before - after);
+}
+/**
 * Transient-failure retry policy for the `kimi-code` route.
 *
 * Kimi Code fronts the model providers, so a call can fail with a 502/503/504
@@ -22846,8 +23557,10 @@ var KimiCodeAdapter = class extends LlmAdapter {
 		const catalog = await this.catalog().catch(() => []);
 		const wire = wireForCatalogEntry(options.model, catalog);
 		const entry = catalog.find((model) => model.id === options.model);
-		const requestOptions = offloadOldestRequestVideos(offloadOldestRequestImages$2(normalizeGenerateOptions(options)), MAX_REQUEST_VIDEO_BYTES$1);
-		const [images, videos] = await Promise.all([resolveRequestImages$2(requestOptions, this.options.attachments, signal), resolveRequestVideos(requestOptions, this.options.videos, signal)]);
+		const normalized = normalizeGenerateOptions(options);
+		const images = await resolveRequestImages$2(normalized, this.options.attachments, signal);
+		const requestOptions = offloadOldestRequestVideos(offloadOldestRequestImages$2(normalized, MAX_REQUEST_IMAGE_BYTES$2, images), MAX_REQUEST_VIDEO_BYTES$1);
+		const videos = await resolveRequestVideos(requestOptions, this.options.videos, signal);
 		const settings = await this.settings();
 		const media = {
 			videos,
@@ -22859,10 +23572,25 @@ var KimiCodeAdapter = class extends LlmAdapter {
 		const requestedMax = options.maxTokens ?? maxOutputTokensFor$3(options.model, contextWindow);
 		const inputCap = maxInputTokensForEntry(options.model, catalog);
 		const promptLimit = inputCap === void 0 ? contextWindow : Math.min(contextWindow, inputCap);
-		const body = assertRequestBodyFits$1(buildRequest({
+		const boundedOptions = {
 			...requestOptions,
 			maxTokens: clampOutputToContext$1(requestedMax, promptLimit, estimatedInputTokens(requestOptions))
-		}, wire, images, void 0, media), requestHasVideo(requestOptions));
+		};
+		const carriesVideo = requestHasVideo(requestOptions);
+		const bodyLimit = carriesVideo ? MAX_VIDEO_MESSAGE_BODY_BYTES : MAX_MESSAGE_BODY_BYTES;
+		let buildOptions = boundedOptions;
+		let body = "";
+		for (let attempt = 0;; attempt++) {
+			const built = buildRequest(buildOptions, wire, images, void 0, media);
+			body = JSON.stringify(built);
+			const bytes = Buffer.byteLength(body, "utf8");
+			if (bytes <= bodyLimit) break;
+			if (attempt > MAX_BODY_FIT_ATTEMPTS || !requestHasSendableImage(buildOptions)) {
+				assertRequestBodyFits$1(built, carriesVideo);
+				throw new Error("unreachable: assertRequestBodyFits returns or throws");
+			}
+			buildOptions = dropOldestImagesUntilFits(buildOptions, images, bytes - bodyLimit, requestOptions);
+		}
 		const pool = this.accountPool;
 		const tried = /* @__PURE__ */ new Set();
 		let servedByAccountId;
@@ -33791,14 +34519,19 @@ const ANTHROPIC_VERSION = "2023-06-01";
 * table, whether or not a floor for that model has been observed: upstream has
 * so far gated a new model on the release that added it (Opus 5.5 arrived in
 * 2.1.280 and is refused below 2.1.280). Claude Sonnet 5.5 arrived in 2.1.284,
-* so 2.1.283 could not be relied on to reach it; 2.1.285 is npm `latest`.
+* so 2.1.283 could not be relied on to reach it. Claude Haiku 5.5 arrived in
+* 2.1.293, so 2.1.292 could not be relied on to reach it either — and that is
+* not hypothetical: when this row was added, npm's `stable` dist-tag was STILL
+* sitting at 2.1.285, five releases below the one that ships the model, while
+* `latest` was already 2.1.293. The warning above about reading `stable` is
+* therefore about this table's own newest model, not a hypothetical.
 *
 * It is still not a literal that only moves when this package is republished: a
 * user whose installed baseline has aged past the server's floor has to be able
 * to raise it without waiting for a release. Read the effective value with
 * {@link claudeCliVersion}, pin one with {@link setClaudeCliVersion}.
 */
-const CLAUDE_CLI_VERSION = "2.1.285";
+const CLAUDE_CLI_VERSION = "2.1.293";
 /**
 * Loopback callback port the subscription flow defaults to.
 *
@@ -34159,10 +34892,11 @@ function loopbackRedirectUri(port = DEFAULT_CALLBACK_PORT) {
 * TWO KINDS OF ROW ARE NOT FULLY TRANSCRIBED, and they are different things.
 * Do not collapse them.
 *
-* 1. `claude-sonnet-5-5` — the snapshot this table was copied from has no
-*    entry for it, so the whole row is CURATED: every value below comes from
-*    the vendor's own documentation and no snapshot field can check it. The
-*    mirror list in the test is `LOCALLY_CURATED_MODEL_IDS`.
+* 1. `claude-sonnet-5-5` and `claude-haiku-5-5` — the snapshot this table
+*    was copied from has no entry for either, so each whole row is CURATED:
+*    every value below comes from the vendor's own documentation and no
+*    snapshot field can check it. The mirror list in the test is
+*    `LOCALLY_CURATED_MODEL_IDS`.
 *
 * 2. `claude-opus-5-5` — a NEWER snapshot (pi-ai >= 0.87.1) does carry it, so
 *    the row sits in the snapshot's own position and EVERY field is checked
@@ -34175,22 +34909,35 @@ function loopbackRedirectUri(port = DEFAULT_CALLBACK_PORT) {
 *    stands. The test asserts the row still disagrees with the snapshot, so a
 *    future snapshot that agrees fails loudly and retires the entry.
 *
-* Both must be changed together with the mirror list in the test. An invented
-* row that mimics the format of a checked one is worse than a missing row: it
-* is unverifiable and it looks verified. So each row is marked at the row
-* itself, the test asserts the id is on the curated list, and the test
+* 3. `claude-haiku-5-5` (released 2026-10-07) is the second fully curated
+*    row, and the first one whose documented `canDisableThinking` is TRUE. That
+*    flag is not a free choice here and the row's own comment records why the
+*    documented answer is safe to send: `thinking: { type: 'disabled' }` is
+*    accepted at `low`/`medium`/`high` and is a 400 at `xhigh`/`max`, and this
+*    line only sends that form when the caller asked for thinking OFF, in which
+*    case it names no effort at all and the server's own default (`medium`) is
+*    what the request runs at. Its documented default effort is MEDIUM, so it is
+*    'adaptive' rather than 'mid-convo' for exactly the reason Opus 5.5 is —
+*    'mid-convo' would force `high` — and it runs the preserved-thinking prefix
+*    check, so `bindsThinkingToPrefix` is set even though the form is adaptive.
+*
+* All three must be changed together with the mirror list in the test. An
+* invented row that mimics the format of a checked one is worse than a missing
+* row: it is unverifiable and it looks verified. So each row is marked at the
+* row itself, the test asserts the id is on the curated list, and the test
 * asserts the curated list is exactly the ids the snapshot lacks — which keeps
 * the lock narrow instead of merely weaker.
 *
-* Its fields come from the vendor's own published documentation for the model
-* (the model overview page plus the extended-thinking effort page), NOT from the
-* snapshot, and they are the values a person read off those pages. That is a
+* `claude-sonnet-5-5`'s fields come from the vendor's own published
+* documentation for the model (the model overview page plus the extended-thinking
+* effort page), NOT from the snapshot, and they are the values a person read off
+* those pages. That is a
 * weaker source than the snapshot and it is labelled as such: nothing here
 * proves the account is entitled to the model, and the server's own
 * `GET /v1/models` still outranks it.
 *
-* Two of its fields are the ones worth recording a WHY for, because both look
-* like mistakes against their neighbours:
+* Two of that row's fields are the ones worth recording a WHY for, because both
+* look like mistakes against their neighbours:
 *
 * 1. `canDisableThinking: false`. The vendor documents that thinking cannot be
 *    turned off on this model at all: sending `thinking: { type: 'disabled' }`
@@ -34216,17 +34963,18 @@ function loopbackRedirectUri(port = DEFAULT_CALLBACK_PORT) {
 * A future reader who notices the shared `supportsTemperature: false` and
 * "fixes" item 2 to 'mid-convo' has reintroduced exactly that bug.
 *
-* One more field on that row comes from neither source: its `minCliVersion`
-* floor is the number upstream itself states when it refuses the model
-* (`claude_code_version_too_old`, "version 2.1.280 or newer is required"). That
+* One more field on `claude-opus-5-5` comes from neither source: its
+* `minCliVersion` floor is the number upstream itself states when it refuses
+* the model (`claude_code_version_too_old`, "version 2.1.280 or newer is
+* required"). That
 * is a stronger witness than a documentation page — the server said it — and it
 * is recorded here so a claim below it is refused locally, before the request is
 * sent, instead of as an upstream 400 that names neither the model nor the number
 * the user has to reach.
 */
 /**
-* Sixteen rows: the snapshot's own 15, in the snapshot's own declaration order,
-* followed by the one row the snapshot still predates (see LOCAL ADDITIONS above).
+* Seventeen rows: the snapshot's own 15, in the snapshot's own declaration order,
+* followed by the two rows the snapshot still predates (see LOCAL ADDITIONS above).
 *
 * The order matters and is not cosmetic. The test asserts the snapshot's ids
 * appear in the table as a SUBSEQUENCE, so a curated row may be appended or
@@ -34514,6 +35262,24 @@ const CLAUDE_MODELS = Object.freeze([
 		],
 		canDisableThinking: false,
 		bindsThinkingToPrefix: true
+	},
+	{
+		id: "claude-haiku-5-5",
+		name: "Claude Haiku 5.5",
+		contextWindow: 1e6,
+		maxTokens: 128e3,
+		supportsImage: true,
+		supportsTemperature: false,
+		thinkingMode: "adaptive",
+		reasoningEfforts: [
+			"low",
+			"medium",
+			"high",
+			"xhigh",
+			"max"
+		],
+		canDisableThinking: true,
+		bindsThinkingToPrefix: true
 	}
 ]);
 /** Every id the fallback table knows, in declaration order. */
@@ -34538,6 +35304,13 @@ const FALLBACK_MODELS = CLAUDE_MODELS;
 * than one that leads with the general-purpose ids. The rest stay selectable
 * from the model card and are one click away.
 *
+* The list tracks ONE current model per family rather than the newest of each,
+* so a slot follows its family's newest release in place instead of growing: the
+* Haiku slot is `claude-haiku-5-5`, which replaced `claude-haiku-4-5` when that
+* model shipped. That is a deliberate swap and not a silent append — a list that
+* offered both generations of every family would be longer than the picker it
+* feeds, and the older Haiku stays one click away in the card.
+*
 * This list is the SHIPPED DEFAULT, and edits to it are a deliberate onboarding
 * decision rather than a no-op: a stored list that still equals the shipped
 * default counts as "never edited", and the routes and adapter read it that way
@@ -34551,7 +35324,7 @@ const DEFAULT_VISIBLE_MODEL_IDS = [
 	"claude-opus-5-5",
 	"claude-opus-4-6",
 	"claude-sonnet-4-6",
-	"claude-haiku-4-5",
+	"claude-haiku-5-5",
 	"claude-opus-4-5"
 ];
 new Map(CLAUDE_MODELS.map((model) => [model.id, model]));