@eddyskywalker/dsh-chatgpt-subscription 0.13.2 → 0.15.0

package/lib/index.js

@@ -993,7 +993,7 @@ function parseStoredCredentials(value) {
 		if (typeof candidate !== "string") throw new Error(`${key} is invalid`);
 		return candidate;
 	};
-	return {
+	const credentials = {
 		accessToken: record.accessToken,
 		refreshToken: record.refreshToken,
 		expiresAt: record.expiresAt,
@@ -1002,6 +1002,16 @@ function parseStoredCredentials(value) {
 		email: optional("email"),
 		planType: optional("planType")
 	};
+	if (record.adopted === true) {
+		const source = optional("source");
+		if (source !== void 0) {
+			credentials.adopted = true;
+			credentials.source = source;
+			const sourcePath = optional("sourcePath");
+			if (sourcePath !== void 0) credentials.sourcePath = sourcePath;
+		}
+	}
+	return credentials;
 }
 //#endregion
 //#region src/host/token-store-windows.ts
@@ -2895,7 +2905,433 @@ function poolQuota(fetchedAt, windows) {
 	};
 }
 //#endregion
+//#region src/host/codex-adopt.ts
+/**
+* OPT-IN adoption of a pre-existing Codex CLI sign-in.
+*
+* WHAT THIS IS FOR. A user who already runs the unmodified Codex CLI is already
+* signed in to the very subscription this provider serves. Asking them to sign in
+* a second time is pure friction, so this module offers the one thing that
+* removes it: reading back the credential the CLI itself stored in
+* `$CODEX_HOME/auth.json` (`~/.codex/auth.json` when the variable is unset). It
+* is opt-in — nothing here runs until the user asks for it.
+*
+* ---------------------------------------------------------------------------
+* RULE 1 — THIS MODULE NEVER WRITES. IT IS A READER, AND ONLY A READER.
+* ---------------------------------------------------------------------------
+* It must not create, modify, move or delete any file belonging to the Codex CLI.
+* No file this module touches is ever opened for writing, no directory is
+* created, nothing is renamed and nothing is unlinked. The guarantee is
+* structural rather than a promise in prose: the module imports exactly two
+* functions BY NAME from 'node:fs/promises' — readFile and stat — instead of the
+* whole namespace, so introducing a write would require a visible change to the
+* import list, which is the line a reviewer reads first. Nothing exported here
+* writes. The tests assert the stronger, observable form of the rule: a
+* credential file's bytes, size and mtime are identical before and after both
+* entry points run, and its directory gains no entries.
+*
+* ---------------------------------------------------------------------------
+* RULE 2 — PRESENCE AND CONTENT ARE TWO SEPARATE FUNCTIONS
+* ---------------------------------------------------------------------------
+* codexCliCredentialPresence() is cheap enough to call on plugin startup and
+* answers only yes/no: it stats the candidate and never opens it for reading. It
+* exists so the settings card can offer the import before the user has agreed to
+* it, and so a user who never opts in never has their token read at all.
+*
+* readCodexCliCredentials() is the full read, and it is called only AFTER the
+* user explicitly opts in. Keeping the two apart is the whole point: a startup
+* path that slurped the file "just in case" would make the opt-in decorative.
+*
+* ---------------------------------------------------------------------------
+* RULE 3 — AN ADOPTED CREDENTIAL IS A SNAPSHOT, AND THIS PLUGIN NEVER REFRESHES IT
+* ---------------------------------------------------------------------------
+* An adopted credential is used only while its own accessToken is still valid.
+* Once it is expired the pool reports it as expired and tells the user to sign in
+* again in the Codex CLI and re-adopt. That is deliberate, not a gap: the
+* ChatGPT refresh token the CLI stores ROTATES, and the CLI refreshes its own
+* file in place. Two processes refreshing the same grant therefore invalidate
+* each other — whoever loses the race holds a token the server has already
+* retired, and the user ends up signed OUT of the Codex CLI by this plugin's good
+* intentions. An in-process single-flight cannot fix that, because the race is
+* across PROCESSES: this plugin and the CLI are separate programs with separate
+* memories, and the only shared state between them is the file — which this
+* module must not write back into (Rule 1).
+*
+* So the honest contract is: borrow the access token for as long as the CLI itself
+* vouched for it, and never touch the refresh token. Expiry is therefore part of
+* the adoption decision rather than a detail — see
+* {@link isAdoptedCodexCredentialExpired}.
+*
+* The marker the pool chunk must honour is the literal 'adopted: true' plus
+* {@link isAdoptedCodexCredential}; an account carrying it must be treated as
+* read-only, non-refreshable and disposable. There is deliberately no refresh
+* function in this module to find in the first place.
+*
+* ---------------------------------------------------------------------------
+* RULE 4 — AN UNRECOGNISED SHAPE YIELDS undefined, NEVER AN EXCEPTION
+* ---------------------------------------------------------------------------
+* The card shows 'unrecognised local sign-in format' for undefined, which is a far
+* better outcome than a thrown error escaping into the settings route. Nothing is
+* guessed: a document in another auth_mode, a missing or non-object tokens
+* block, a missing access or refresh token, an access token that is not a JWT
+* with a usable 'exp', an unreadable or unparsable file — all of them are
+* undefined. Extra and unknown fields are ignored rather than rejected, so a
+* future CLI that adds one does not break adoption.
+*
+* THE TRAP THIS PARSER EXISTS TO AVOID. A Codex auth.json is NOT a flat bag of
+* tokens. It is a document that may carry an API key alongside the OAuth tokens,
+* and a "find the first accessToken anywhere in the JSON" scan would pick
+* whichever one the serializer happened to emit first — which is how an API key
+* or an unrelated token ends up presented to the Responses API as the user's
+* subscription credential. The read is therefore a direct, specific lookup of
+* tokens.access_token and its siblings — never a tree walk — and the test suite
+* holds a fixture carrying an unrelated token beside the real one and asserts
+* which comes back.
+*
+* ---------------------------------------------------------------------------
+* THE CLAIMS ARE DERIVED LOCALLY, NEVER ASKED OF ANYBODY
+* ---------------------------------------------------------------------------
+* expiresAt comes from the access token's own 'exp' claim, email and planType
+* from the id token's claims. The JWT payload is decoded in process; no token is
+* ever sent anywhere to be inspected, and no token value is logged or returned
+* from anything but the credential object the caller asked for.
+*
+* WHY EXPIRY IS REFUSED RATHER THAN DEFAULTED. A snapshot whose validity cannot
+* be established must not be used. Rather than stamping "now" or "never" and
+* hoping, this module yields undefined: the card then says the local sign-in
+* format is unrecognised, which is true, instead of importing a credential that
+* would 401 on the first request.
+*/
+/**
+* Environment variable that relocates the Codex CLI's home directory.
+*
+* Highest precedence, and honoured exactly as the CLI honours it: when it is set
+* to a non-blank value it names the home that holds auth.json, whatever the
+* platform's conventional location happens to be. This is also what makes the
+* whole module testable without touching a developer's real profile.
+*/
+const CODEX_HOME_ENV = "CODEX_HOME";
+/** File name of the credential document inside the Codex home. */
+const CODEX_CLI_CREDENTIAL_FILE = "auth.json";
+/**
+* Top-level key holding the OAuth tokens.
+*
+* Named as a constant because the specificity of this key IS the defence
+* described in the module comment: the read addresses this key, not the first
+* token it can find anywhere in the document.
+*/
+const CODEX_CLI_TOKENS_KEY = "tokens";
+/** Where an adopted snapshot came from, for the card and for the pool record. */
+const CODEX_CLI_CREDENTIAL_SOURCE = "codex";
+/** Namespace the id token carries the ChatGPT account claims under. */
+const CODEX_AUTH_CLAIMS_KEY = "https://api.openai.com/auth";
+/**
+* What the user is told when an adopted credential has aged out.
+*
+* Exported so the pool report and the settings card say the same sentence, and
+* so the instruction is stated once: the re-sign-in happens in the CODEX CLI, not
+* here, and the import has to be repeated afterwards.
+*/
+const ADOPTED_CODEX_CREDENTIAL_EXPIRED_HINT = "The sign-in imported from the Codex CLI has expired. Sign in again in the Codex CLI, then import it again from this settings card.";
+function isRecord$31(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** A trimmed, non-empty string, or nothing. */
+function nonEmptyString$5(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	return trimmed === "" ? void 0 : trimmed;
+}
+/**
+* The Codex CLI's home directory.
+*
+* The environment override wins whenever it is set to a non-blank value — a blank
+* or whitespace-only variable is treated as unset rather than as "the directory
+* whose name is empty", which on Windows would resolve to a drive-relative path.
+* Otherwise the conventional home/.codex directory is used, os.homedir() being
+* the same %USERPROFILE% on Windows and ~ on POSIX that the CLI itself uses.
+*
+* Read at CALL time rather than captured in a module constant: a test (or an
+* embedder) that sets the variable after import must see the change.
+*/
+function codexHomeDir() {
+	const override = process.env[CODEX_HOME_ENV]?.trim();
+	if (override) return override;
+	return path.join(os.homedir(), ".codex");
+}
+/**
+* Every path this module will look at, most authoritative first.
+*
+* A single candidate, which is a judgement call stated plainly. The Claude reader
+* in this package also falls back to the conventional home when the environment
+* override points somewhere else; here the override IS the user's own statement of
+* where this CLI keeps its sign-in, and honouring a stale scratch directory is
+* more dangerous than reporting nothing: a snapshot belonging to a profile the CLI
+* is not currently using would be adopted silently. The path actually consulted is
+* returned and printed by the caller, so "not found" is always accompanied by the
+* exact place that was looked at.
+*
+* A pure function — no filesystem access at all — so it is safe to call just to
+* render the card, and so its precedence is testable without touching a disk.
+*/
+function codexCliCredentialPaths() {
+	return [path.join(codexHomeDir(), CODEX_CLI_CREDENTIAL_FILE)];
+}
+/**
+* Whether a plain file exists at one path.
+*
+* stat, not lstat: a credential file reached through a symlink is a legitimate
+* layout — a user may keep profiles behind links — and the question asked here is
+* whether the client has a file there, not how it is reached.
+*
+* Any error (ENOENT, EACCES, ENOTDIR, an unsupported path shape) answers "no". A
+* failure to establish existence is not evidence of existence, and this path runs
+* on startup where throwing would take the plugin down over a missing file.
+*/
+async function existsAsFile$1(candidate) {
+	try {
+		return (await stat(candidate)).isFile();
+	} catch {
+		return false;
+	}
+}
+/**
+* Is there a local Codex CLI sign-in to offer?
+*
+* Safe on plugin startup: this NEVER opens a candidate for reading, so a user who
+* never opts in never has the credential's contents touched — not by this
+* function, not by the route that renders the card. Only stat runs, which reveals
+* existence and timestamps and nothing else.
+*
+* Deliberately NOT reported here: whether the file is valid, expired, or even
+* JSON. Answering that would require the read this function exists to avoid, and
+* the card does not need it — validity is answered by the read, after opt-in, and
+* lands on the card as either a credential or 'unrecognised local sign-in
+* format'.
+*
+* A boolean, rather than the record the Claude reader returns, because the two
+* callers want different things and neither needs the other's shape: the status
+* route wants a flag, and reports the path it consulted beside it. paths
+* is injectable so tests drive it against fixtures instead of a real profile;
+* production callers take the default.
+*/
+async function codexCliCredentialPresence(paths = codexCliCredentialPaths()) {
+	for (const candidate of paths) if (await existsAsFile$1(candidate)) return true;
+	return false;
+}
+/**
+* The claims of a JWT, decoded in process, or nothing.
+*
+* The payload is the second base64url segment; the signature is never touched and
+* the result is used only for the three non-secret facts below. Never sent
+* anywhere: a token handed to a decoder service is a token handed away.
+*
+* No verification is claimed and none is possible here — the signing key is the
+* issuer's, and this module has no business holding it. What it does instead is
+* refuse to invent: a token that does not decode is treated as stating nothing.
+*/
+function decodeJwtClaims(token) {
+	const parts = token.split(".");
+	if (parts.length !== 3) return void 0;
+	try {
+		const value = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+		return isRecord$31(value) ? value : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* The access token's expiry, in EPOCH MILLISECONDS, or nothing.
+*
+* RFC 7519 states 'exp' in SECONDS since the epoch, and the store's
+* StoredOAuthCredentials states milliseconds — a thousand-fold difference that is
+* silent when it goes the wrong way (a credential stamped a thousand times too
+* late reads as unexpired for centuries) and catastrophic the other. The
+* conversion is therefore done here, once, with a comment on it.
+*
+* Only a finite, non-negative number is accepted. A string, null, NaN, a
+* negative value or a missing claim are all "this document states no usable
+* expiry", and the caller's answer to that is to refuse the whole document rather
+* than import a credential whose validity nothing established.
+*/
+function expiryFromAccessToken(accessToken) {
+	const claims = decodeJwtClaims(accessToken);
+	if (claims === void 0) return void 0;
+	const exp = claims.exp;
+	if (typeof exp !== "number" || !Number.isFinite(exp) || exp < 0) return void 0;
+	return Math.round(exp * 1e3);
+}
+/**
+* Map one parsed credential document onto the store's credential shape.
+*
+* Pure and exported so the format rules can be tested without a filesystem, and
+* so a later chunk that reads the document from somewhere else (a backup, a pasted
+* blob) reuses the one set of rules instead of growing a second, drifting copy.
+*
+* Returns undefined for every shape it does not recognise, and never throws — see
+* Rule 4 in the module comment. The gate is deliberately narrow: the document must
+* be a JSON object in the ChatGPT auth mode, its tokens block must be an object,
+* and it must carry BOTH a non-empty access token and a non-empty refresh token.
+* An access token alone is not adopted because the store's record is a sign-in,
+* not a bare token, and a record with an empty one could never be re-recognised.
+*
+* The unrelated-token trap is handled by construction: value.tokens is addressed
+* directly and no other key of the document is ever traversed, so whatever else
+* the file carries cannot reach the result.
+*/
+function parseAdoptedCodexCredential(value, sourcePath) {
+	if (!isRecord$31(value)) return void 0;
+	if (value.auth_mode !== "chatgpt") return void 0;
+	const tokens = value[CODEX_CLI_TOKENS_KEY];
+	if (!isRecord$31(tokens)) return void 0;
+	const accessToken = nonEmptyString$5(tokens.access_token);
+	if (accessToken === void 0) return void 0;
+	const refreshToken = nonEmptyString$5(tokens.refresh_token);
+	if (refreshToken === void 0) return void 0;
+	const expiresAt = expiryFromAccessToken(accessToken);
+	if (expiresAt === void 0) return void 0;
+	const credentials = {
+		accessToken,
+		refreshToken,
+		expiresAt
+	};
+	const idToken = nonEmptyString$5(tokens.id_token);
+	if (idToken !== void 0) {
+		credentials.idToken = idToken;
+		const claims = decodeJwtClaims(idToken);
+		const email = claims === void 0 ? void 0 : nonEmptyString$5(claims.email);
+		if (email !== void 0) credentials.email = email;
+		const authClaims = claims === void 0 ? void 0 : claims[CODEX_AUTH_CLAIMS_KEY];
+		const planType = isRecord$31(authClaims) ? nonEmptyString$5(authClaims.chatgpt_plan_type) : void 0;
+		if (planType !== void 0) credentials.planType = planType;
+	}
+	const accountId = nonEmptyString$5(tokens.account_id);
+	if (accountId !== void 0) credentials.accountId = accountId;
+	return {
+		adopted: true,
+		source: CODEX_CLI_CREDENTIAL_SOURCE,
+		sourcePath,
+		credentials
+	};
+}
+/**
+* Read the local Codex CLI sign-in; the first usable candidate wins.
+*
+* ONLY call this after the user has explicitly opted in — see the module comment.
+*
+* Never throws and never rejects: an absent file, an unreadable file, a file that
+* is not JSON, and a JSON document of an unrecognised shape all produce undefined,
+* which the card renders as 'unrecognised local sign-in format'. A settings route
+* must not be able to fail because a user's file was mid-write.
+*/
+async function readCodexCliCredentials(paths = codexCliCredentialPaths()) {
+	for (const candidate of paths) try {
+		const raw = await readFile(candidate, "utf8");
+		const adopted = parseAdoptedCodexCredential(JSON.parse(raw), candidate);
+		if (adopted !== void 0) return adopted;
+	} catch {}
+}
+/**
+* Whether an adopted credential's access token is already unusable.
+*
+* A structural mirror of the expiry test the OAuth module applies to its own
+* credentials (expiresAt - Date.now() > 0), asked of a pooled credential so the
+* pool can refuse it WITHOUT ever reaching for a refresh this module deliberately
+* does not perform. A non-finite expiresAt counts as expired, matching the
+* refusal in the reader: no established validity, no use.
+*
+* now is injectable so a test can reason about a fixed clock.
+*/
+function isAdoptedCodexCredentialExpired(credential, now = Date.now()) {
+	const expiresAt = credential.expiresAt;
+	return !(typeof expiresAt === "number" && Number.isFinite(expiresAt) && expiresAt > now);
+}
+//#endregion
 //#region src/host/codex-account-pool.ts
+/**
+* The ChatGPT account pool.
+*
+* TWO KINDS OF ACCOUNT, AND ONLY ONE OF THEM MAY BE REFRESHED.
+*
+* - managed — signed in through this plugin. Its credential lives in the pool's
+*   encrypted storage AND in the pre-pool credential document beside it, it is
+*   refreshable, and deleting it is this plugin's business.
+* - adopted — a SNAPSHOT read out of a local Codex CLI sign-in by 'codex-adopt.ts'
+*   (marker 'adopted: true', source 'codex'). It is used only while its own access
+*   token is still valid.
+*
+* An adopted snapshot is NEVER refreshed, and the reason is not an optimisation:
+* the ChatGPT refresh token the CLI stores rotates, and the CLI refreshes its own
+* file in place. Two processes spending one grant invalidate each other, and
+* whoever loses the race holds a token the server has already retired — which
+* leaves the user signed OUT of the Codex CLI by this plugin's good intentions. An
+* in-process single-flight cannot fix that, because the race is across PROCESSES
+* and the only state they share is a file 'codex-adopt.ts' must never write. Once
+* such a snapshot has expired the pool takes it out of rotation and surfaces
+* ADOPTED_CODEX_CREDENTIAL_EXPIRED_HINT — sign in again in the CODEX CLI and
+* re-import, not here.
+*
+* The rule is enforced twice on purpose: the needsRefresh hook answers false for
+* an adopted credential no matter what its expiry says, and the refresh hook
+* itself refuses one, so a future caller that forgets the first fails loudly
+* instead of silently spending a grant that is not ours to spend.
+*
+* MANAGED BEATS ADOPTED on a conflict, and the marker is therefore written on
+* EVERY account this file creates, including the explicit false case: the core
+* merges a re-authorization as { ...existing, ...created }, so an omitted key
+* would leave a stored 'adopted: true' — and its never-refresh consequence — on a
+* record that is now plugin-owned.
+*/
+/**
+* Whether a pooled credential is an adopted snapshot.
+*
+* The two fields, and only those two: a plain credential carries no 'adopted'
+* field and must never be mistaken for a snapshot, because treating a
+* plugin-owned account as a disposable one would freeze it out of refreshing and
+* make deleteAccount refuse to remove an account the user signed in here.
+*/
+function isAdoptedCodexPoolCredential(credentials) {
+	return credentials.adopted === true && credentials.source === "codex";
+}
+/**
+* Whether a credential must be refreshed before the next request.
+*
+* FALSE for every adopted snapshot, valid or expired. That is this pool's core
+* rule: an adopted credential is borrowed for exactly as long as the Codex CLI
+* vouched for it, and this pool has no business rotating a token another process
+* is rotating too. See the module comment.
+*/
+function codexNeedsRefresh(credentials, now) {
+	if (isAdoptedCodexPoolCredential(credentials)) return false;
+	return credentials.expiresAt - now <= TOKEN_REFRESH_MARGIN_MS;
+}
+/**
+* Why a stored credential is already known to be unusable, or nothing.
+*
+* Reported purely — nothing is written here — and consulted by the core for both
+* routing eligibility and credential usability, which is what makes an expired
+* snapshot non-routable WITHOUT a write on every read. The hint names the remedy
+* in the Codex CLI, because that is where the user has to go: re-adopting here is
+* only possible after the CLI itself signed in again.
+*/
+function codexAuthRejectedReason(credentials) {
+	if (!isAdoptedCodexPoolCredential(credentials)) return void 0;
+	return isAdoptedCodexCredentialExpired(credentials) ? ADOPTED_CODEX_CREDENTIAL_EXPIRED_HINT : void 0;
+}
+/**
+* Message raised if a refresh of a still-valid adopted snapshot were attempted.
+*
+* Unreachable through this pool's own paths (see the module comment); it exists
+* because 'unreachable' is a claim the guard has to be able to make good on.
+*/
+const ADOPTED_NEVER_REFRESHED_MESSAGE$1 = "The sign-in imported from the Codex CLI is never refreshed by this plugin: the Codex CLI refreshes the same rotating token, and two refreshers would invalidate each other. Sign in again in the Codex CLI, then import the new sign-in from this settings card.";
+/** Raised when a refresh of an adopted snapshot is attempted. Never a 401. */
+var CodexAdoptedCredentialError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "CodexAdoptedCredentialError";
+	}
+};
 /** Encrypted pool file the ChatGPT line owns; the single-credential store stays the mirror. */
 function codexPoolPath() {
 	return path.join(dshHomeDir(), "storages", "codex-pool.json");
@@ -2916,13 +3352,18 @@ function parseCodexPoolData(value) {
 		const raw = item;
 		if (typeof raw.id !== "string") continue;
 		const credentials = parseStoredCredentials(raw.credentials);
+		const adopted = isAdoptedCodexPoolCredential(credentials);
 		const account = {
 			id: raw.id,
 			alias: typeof raw.alias === "string" ? raw.alias : credentials.email || "账号",
 			credentials,
 			addedAt: typeof raw.addedAt === "number" ? raw.addedAt : Date.now(),
-			isPrimary: raw.isPrimary === true
+			isPrimary: raw.isPrimary === true,
+			adopted,
+			source: adopted ? CODEX_CLI_CREDENTIAL_SOURCE : "managed"
 		};
+		const sourcePath = optionalString$9(raw, "sourcePath") ?? credentials.sourcePath;
+		if (adopted && sourcePath !== void 0) account.sourcePath = sourcePath;
 		const email = optionalString$9(raw, "email") ?? credentials.email;
 		if (email !== void 0) account.email = email;
 		const planType = optionalString$9(raw, "planType") ?? credentials.planType;
@@ -2945,14 +3386,6 @@ function parseCodexPoolData(value) {
 	return result;
 }
 /**
-* ChatGPT's account pool.
-*
-* Thin wrapper over {@link AccountPoolCore}: it only supplies the credential
-* shape, the identity a duplicate sign-in collapses onto, and the two provider
-* hooks the core cannot know — how to refresh one account's tokens and which
-* accounts a cached quota window already rules out.
-*/
-/**
 * Per-account in-flight requests, shared by every ChatGPT request this host
 * makes. A fan-out of subagents is what reaches a plan's concurrency bound, so
 * the bound is enforced here rather than discovered by cooling every account at
@@ -2997,23 +3430,31 @@ var CodexAccountPool = class extends AccountPoolCore {
 			parsePoolData: parseCodexPoolData,
 			dedupeKey: (credentials) => credentials.accountId ?? credentials.email,
 			defaultAlias: (credentials, position) => credentials.email ?? `账号 ${position}`,
-			createAccount: ({ id, alias, credentials, addedAt, isPrimary }) => ({
-				id,
-				alias,
-				credentials,
-				addedAt,
-				isPrimary,
-				...credentials.email === void 0 ? {} : { email: credentials.email },
-				...credentials.planType === void 0 ? {} : { planType: credentials.planType },
-				...credentials.accountId === void 0 ? {} : { accountId: credentials.accountId }
-			}),
+			createAccount: ({ id, alias, credentials, addedAt, isPrimary }) => {
+				const adopted = isAdoptedCodexPoolCredential(credentials);
+				return {
+					id,
+					alias,
+					credentials,
+					addedAt,
+					isPrimary,
+					adopted,
+					source: adopted ? CODEX_CLI_CREDENTIAL_SOURCE : "managed",
+					sourcePath: adopted ? credentials.sourcePath : void 0,
+					...credentials.email === void 0 ? {} : { email: credentials.email },
+					...credentials.planType === void 0 ? {} : { planType: credentials.planType },
+					...credentials.accountId === void 0 ? {} : { accountId: credentials.accountId }
+				};
+			},
 			expiresAt: (credentials) => credentials.expiresAt,
-			needsRefresh: (credentials, now) => credentials.expiresAt - now <= TOKEN_REFRESH_MARGIN_MS,
+			needsRefresh: (credentials, now) => codexNeedsRefresh(credentials, now),
 			refresh: async (credentials) => {
+				if (isAdoptedCodexPoolCredential(credentials)) throw new CodexAdoptedCredentialError(isAdoptedCodexCredentialExpired(credentials) ? ADOPTED_CODEX_CREDENTIAL_EXPIRED_HINT : ADOPTED_NEVER_REFRESHED_MESSAGE$1);
 				const refresher = ref.current;
 				if (refresher === void 0) throw new Error("ChatGPT 凭据刷新服务尚未就绪");
 				return refresher.refreshAccount(credentials);
 			},
+			authRejectedReason: (credentials) => codexAuthRejectedReason(credentials),
 			refreshFailureStatus: (error) => error instanceof OAuthServiceError && (error.status === 400 || error.status === 401) ? "expired" : void 0,
 			legacyAccount: async () => {
 				const stored = await store.load();
@@ -3024,6 +3465,8 @@ var CodexAccountPool = class extends AccountPoolCore {
 					credentials: stored,
 					addedAt: Date.now(),
 					isPrimary: true,
+					adopted: false,
+					source: "managed",
 					...stored.email === void 0 ? {} : { email: stored.email },
 					...stored.planType === void 0 ? {} : { planType: stored.planType },
 					...stored.accountId === void 0 ? {} : { accountId: stored.accountId }
@@ -3034,17 +3477,30 @@ var CodexAccountPool = class extends AccountPoolCore {
 					await store.clear();
 					return;
 				}
+				if (isAdoptedCodexPoolCredential(credentials)) return;
 				await store.save(credentials);
 			},
-			extendSummary: (account, base) => ({
-				...base,
-				...account.email === void 0 ? {} : { email: account.email },
-				...account.planType === void 0 ? {} : { planLabel: account.planType },
-				...(() => {
-					const quota = quotaSnapshotRef.current?.(account);
-					return quota === void 0 ? {} : { quota };
-				})()
-			}),
+			extendSummary: (account, base) => {
+				const adopted = account.adopted === true;
+				const expired = adopted && isAdoptedCodexCredentialExpired(account.credentials);
+				return {
+					...base,
+					...account.email === void 0 ? {} : { email: account.email },
+					...account.planType === void 0 ? {} : { planLabel: account.planType },
+					adopted,
+					source: account.source,
+					removable: !adopted,
+					...account.sourcePath === void 0 ? {} : { sourcePath: account.sourcePath },
+					...(() => {
+						const quota = quotaSnapshotRef.current?.(account);
+						return quota === void 0 ? {} : { quota };
+					})(),
+					...expired ? {
+						authStatus: "expired",
+						authFailedReason: ADOPTED_CODEX_CREDENTIAL_EXPIRED_HINT
+					} : {}
+				};
+			},
 			emptyMessage: "未登录 ChatGPT 账号，请在「设置 → 订阅服务 → ChatGPT」中添加并登录账号。",
 			...options.backend === void 0 ? {} : { backend: options.backend },
 			...options.maxAccounts === void 0 ? {} : { maxAccounts: options.maxAccounts }
@@ -3098,6 +3554,35 @@ var CodexAccountPool = class extends AccountPoolCore {
 		if (this.refresherRef.current === void 0) throw new Error("ChatGPT 凭据刷新服务尚未就绪");
 		return this.renewCredential(accountId, fetch, account.credentials);
 	}
+	/**
+	* Remove one account inside a transaction, refusing a borrowed snapshot.
+	*
+	* The check lives HERE rather than in the public delete method so it cannot be
+	* separated from the removal by a concurrent change, and so every caller of the
+	* core's own deletion inherits it. The remedy is a separate action
+	* ({@link removeImportedAccount}): a card must not destroy an account this plugin
+	* did not create with the same button that deletes its own.
+	*/
+	deleteAccountFromPool(data, accountId) {
+		if (data.accounts.find((account) => account.id === accountId)?.adopted === true) throw new Error("The sign-in imported from the Codex CLI is not an account this plugin owns; remove the import instead.");
+		super.deleteAccountFromPool(data, accountId);
+	}
+	/**
+	* Drop an imported snapshot from the pool — the card's 'remove import' action.
+	*
+	* Separate from {@link deleteAccount} because that refuses one, and because the
+	* user is asking to stop borrowing a sign-in, not to sign out of an account. The
+	* Codex CLI's own file is touched by neither path: not deleted, not rewritten,
+	* not moved. This only forgets the copy.
+	*/
+	async removeImportedAccount(accountId) {
+		return this.updatePool((data) => {
+			const target = data.accounts.find((account) => account.id === accountId);
+			if (target === void 0) return;
+			if (target.adopted !== true) throw new Error("That account was signed in through this plugin; delete it instead of removing an import.");
+			super.deleteAccountFromPool(data, accountId);
+		});
+	}
 	/** The single-credential store this pool mirrors its primary account into. */
 	mirrorStore() {
 		return this.store;
@@ -7147,12 +7632,16 @@ function identityKey(credentials) {
 //#endregion
 //#region src/host/routes.ts
 const MAX_BODY_BYTES$6 = 64 * 1024;
-function registerRoutes(ctx, oauth, usage, preferences, proxyManager, searchSwitcher, routeAudit, accountPool, fetchConfiguration) {
+function registerRoutes(ctx, oauth, usage, preferences, proxyManager, searchSwitcher, routeAudit, accountPool, fetchConfiguration, adopt) {
+	const adoptPaths = adopt?.adoptPaths;
 	const handler = async (request, response) => {
 		const url = new URL(request.url ?? "/", "http://dsh.local");
 		if (request.method === "GET" && url.pathname === `/api/dsh-chatgpt-subscription/status`) {
 			const oauthStatus = await oauth.status();
 			const quota = await usage.status(oauthStatus.authenticated, false, { backgroundRefresh: true });
+			const codexCliPaths = adoptPaths ?? codexCliCredentialPaths();
+			const codexCliSignInAvailable = await codexCliCredentialPresence(codexCliPaths).catch(() => false);
+			const codexCliSignInPath = codexCliPaths[0];
 			json(response, {
 				ok: true,
 				value: {
@@ -7160,6 +7649,8 @@ function registerRoutes(ctx, oauth, usage, preferences, proxyManager, searchSwit
 					quota,
 					quotaRefreshing: usage.refreshing,
 					preferences: preferences.status(),
+					codexCliSignInAvailable,
+					codexCliSignInPath,
 					detectedProxy: proxyManager?.getSystemProxy() ?? null,
 					activeProxy: proxyManager?.resolveActiveProxyUrl() ?? null,
 					switcher: searchSwitcher?.status() ?? null,
@@ -7238,6 +7729,14 @@ function registerRoutes(ctx, oauth, usage, preferences, proxyManager, searchSwit
 			});
 			return;
 		}
+		const refreshedStatus = async () => {
+			const afterAction = await oauth.status();
+			return {
+				...afterAction,
+				quota: await usage.status(afterAction.authenticated),
+				preferences: preferences.status()
+			};
+		};
 		try {
 			switch (url.pathname) {
 				case `${ROUTE_PREFIX$5}/login/start`:
@@ -7267,14 +7766,60 @@ function registerRoutes(ctx, oauth, usage, preferences, proxyManager, searchSwit
 					else if (action === "clear-cooldown" && accountId !== null) await accountPool.clearCooldown(accountId);
 					else if (action === "strategy" && (body.strategy === "sequential" || body.strategy === "round-robin" || body.strategy === "sticky")) await accountPool.setStrategy(body.strategy);
 					else if (action === "relogin" && accountId !== null) await accountPool.clearAuthFailed(accountId);
-					const afterAction = await oauth.status();
 					json(response, {
 						ok: true,
-						value: {
-							...afterAction,
-							quota: await usage.status(afterAction.authenticated),
-							preferences: preferences.status()
-						}
+						value: await refreshedStatus()
+					});
+					return;
+				}
+				case `${ROUTE_PREFIX$5}/adopt`: {
+					if (accountPool === void 0) {
+						jsonError(response, 400, {
+							code: "bad-request",
+							message: "Importing a local Codex CLI sign-in needs the account pool, which is not installed."
+						});
+						return;
+					}
+					if (field(body, "source") !== "codex") {
+						jsonError(response, 400, {
+							code: "bad-request",
+							message: "That local sign-in is not imported here. Claude Code and MiniMax Code are imported from their own provider settings."
+						});
+						return;
+					}
+					const adopted = await readCodexCliCredentials(adoptPaths ?? codexCliCredentialPaths());
+					if (adopted === void 0) {
+						jsonError(response, 400, {
+							code: "bad-request",
+							message: "No usable local Codex CLI sign-in was found (unrecognised local sign-in format)."
+						});
+						return;
+					}
+					await accountPool.addAccount({
+						...adopted.credentials,
+						adopted: true,
+						source: CODEX_CLI_CREDENTIAL_SOURCE,
+						sourcePath: adopted.sourcePath
+					});
+					json(response, {
+						ok: true,
+						value: await refreshedStatus()
+					});
+					return;
+				}
+				case `${ROUTE_PREFIX$5}/adopt/disable`: {
+					if (accountPool === void 0) {
+						jsonError(response, 400, {
+							code: "bad-request",
+							message: "The ChatGPT account pool is not installed."
+						});
+						return;
+					}
+					const imported = ((await accountPool.read().catch(() => null))?.accounts ?? []).filter((account) => account.adopted === true);
+					for (const account of imported) await accountPool.removeImportedAccount(account.id);
+					json(response, {
+						ok: true,
+						value: await refreshedStatus()
 					});
 					return;
 				}
@@ -29731,6 +30276,94 @@ function convergeWorkBuddyEffort(effort, ladder) {
 //#endregion
 //#region src/host/workbuddy/model-catalog.ts
 /**
+* Models the gateway serves but does not publish in `/v3/config`.
+*
+* The catalog is a published list, not the served one: measured on the
+* international backend, `gpt-6-sol`, `gpt-6-luna` and `gemini-3.8-flash` all
+* answer a normal streaming completion with 200 while being absent from
+* `/v3/config` entirely, and a reachable gateway *replaces* the shipped table
+* with that list. Without these rows the picker would simply never show them, so
+* they are declared here and merged into a live catalog too
+* ({@link withUnpublishedModels}) rather than living in the fallback alone.
+*
+* What each row records, and how it was established, differs by field:
+*
+* - **Existence, the reasoning ladder, image support** were measured against the
+*   live endpoint, not inferred from the name. A rejected level answers 400
+*   `code 11133` with `extError` `400002`; `gpt-6-sol` takes exactly the ladder
+*   `gpt-6-astra` publishes (`minimal` refused, `low`/`medium`/`high`/`xhigh`/
+*   `max` accepted) and both accept a 1x1 PNG.
+* - **Context window, output cap and `canDisableThinking` are inherited from the
+*   published sibling in the same family** — `gpt-6-astra` for `gpt-6-sol` and
+*   `gpt-6-luna`, `gemini-3.5-flash` for `gemini-3.8-flash`. They are marked
+*   here rather than measured because the gateway publishes nothing for these
+*   ids and offers no cheap way to read the real figure: it accepts a
+*   `max_tokens` larger than any published window (even for `gpt-6-astra`, whose
+*   own catalog caps at 128000), so the number is neither enforced nor
+*   discoverable from the request side.
+*
+* Every field stays overridable per model from the settings card, and an
+* inherited window errs low rather than high: over-declaring overflows the
+* gateway mid-session, while under-declaring only compresses earlier.
+*/
+const UNPUBLISHED_MODELS = [
+	{
+		id: "gpt-6-sol",
+		name: "GPT-6-Sol",
+		contextWindow: 4e5,
+		maxContextWindow: 1e6,
+		maxTokens: 128e3,
+		regions: ["intl"],
+		supportsImage: true,
+		reasoningEfforts: [
+			"low",
+			"medium",
+			"high",
+			"xhigh",
+			"max"
+		],
+		defaultReasoningEffort: "high",
+		canDisableThinking: true,
+		description: "OpenAI 旗舰模型，擅长复杂推理与长程任务"
+	},
+	{
+		id: "gpt-6-luna",
+		name: "GPT-6-Luna",
+		contextWindow: 4e5,
+		maxContextWindow: 1e6,
+		maxTokens: 128e3,
+		regions: ["intl"],
+		supportsImage: true,
+		reasoningEfforts: [
+			"low",
+			"medium",
+			"high",
+			"xhigh",
+			"max"
+		],
+		defaultReasoningEffort: "high",
+		canDisableThinking: true,
+		description: "OpenAI 轻量模型，响应快速，适合日常任务"
+	},
+	{
+		id: "gemini-3.8-flash",
+		name: "Gemini-3.8-Flash",
+		contextWindow: 1e6,
+		maxContextWindow: 1e6,
+		maxTokens: 65536,
+		regions: ["intl"],
+		supportsImage: true,
+		reasoningEfforts: [
+			"low",
+			"high",
+			"max"
+		],
+		defaultReasoningEffort: "medium",
+		canDisableThinking: false,
+		description: "能力均衡，适合日常使用"
+	}
+];
+/**
 * Offline fallback catalog, transcribed from a live `/v3/config` read.
 *
 * Used when the gateway cannot be reached (first run before sign-in, or a
@@ -29827,6 +30460,7 @@ const FALLBACK_MODELS$1 = [
 		canDisableThinking: false,
 		description: "深度推理，适合深度分析与难题"
 	},
+	...UNPUBLISHED_MODELS.filter((model) => model.id === "gpt-6-sol" || model.id === "gpt-6-luna"),
 	{
 		id: "gpt-6-astra",
 		name: "GPT-6-Astra",
@@ -29944,7 +30578,7 @@ const FALLBACK_MODELS$1 = [
 		name: "GLM-5.3",
 		contextWindow: 1e6,
 		maxContextWindow: 1e6,
-		maxTokens: 64e3,
+		maxTokens: 48e3,
 		regions: ["intl", "cn"],
 		supportsImage: true,
 		reasoningEfforts: [
@@ -29959,10 +30593,10 @@ const FALLBACK_MODELS$1 = [
 	{
 		id: "glm-5.3-flash",
 		name: "GLM-5.3-Flash",
-		contextWindow: 1e6,
+		contextWindow: 3e5,
 		maxContextWindow: 1e6,
 		maxTokens: 32e3,
-		regions: ["cn"],
+		regions: ["intl", "cn"],
 		supportsImage: true,
 		reasoningEfforts: [
 			"low",
@@ -29978,7 +30612,7 @@ const FALLBACK_MODELS$1 = [
 		name: "GLM-5.2",
 		contextWindow: 1e6,
 		maxContextWindow: 1e6,
-		maxTokens: 64e3,
+		maxTokens: 48e3,
 		regions: ["intl", "cn"],
 		supportsImage: true,
 		reasoningEfforts: ["high", "xhigh"],
@@ -30132,7 +30766,7 @@ const FALLBACK_MODELS$1 = [
 		name: "Kimi-K2.8-Preview",
 		contextWindow: 3e5,
 		maxContextWindow: 1e6,
-		maxTokens: 64e3,
+		maxTokens: 32e3,
 		regions: ["intl", "cn"],
 		supportsImage: true,
 		reasoningEfforts: [
@@ -30311,7 +30945,7 @@ const FALLBACK_MODELS$1 = [
 		description: "混元思考模型，具有增强的推理能力"
 	},
 	{
-		id: "hy4-preview-x",
+		id: "hy4-preview-f",
 		name: "Hy4 preview",
 		contextWindow: 1e6,
 		maxContextWindow: 1e6,
@@ -30366,6 +31000,25 @@ const FALLBACK_MODELS$1 = [
 		canDisableThinking: false,
 		description: ""
 	},
+	{
+		id: "space-bunny",
+		name: "Space-Bunny",
+		contextWindow: 1e6,
+		maxContextWindow: 1e6,
+		maxTokens: 128e3,
+		regions: ["cn"],
+		supportsImage: true,
+		reasoningEfforts: [
+			"low",
+			"medium",
+			"high",
+			"xhigh",
+			"max"
+		],
+		defaultReasoningEffort: "max",
+		canDisableThinking: false,
+		description: "推理速度极快，编码能力强劲，并支持原生多模态输入的匿名大模型"
+	},
 	{
 		id: "minimax-m3",
 		name: "MiniMax-M3",
@@ -30417,6 +31070,7 @@ const FALLBACK_MODELS$1 = [
 		canDisableThinking: false,
 		description: ""
 	},
+	...UNPUBLISHED_MODELS.filter((model) => model.id === "gemini-3.8-flash"),
 	{
 		id: "gemini-3.5-flash",
 		name: "Gemini-3.5-Flash",
@@ -30452,6 +31106,21 @@ const DEFAULT_VISIBLE_MODEL_IDS$1 = [
 /** Every id the fallback knows, in declaration order. */
 const WORKBUDDY_MODEL_IDS = FALLBACK_MODELS$1.map((model) => model.id);
 /**
+* Add the served-but-unpublished models to a live `/v3/config` catalog.
+*
+* A reachable gateway replaces the shipped table with the list it publishes, so
+* a model it serves without listing ({@link UNPUBLISHED_MODELS}) would drop out
+* of the picker the moment the catalog loads. Merging here keeps it offered.
+*
+* A published entry always wins: the gateway is the authority on anything it
+* does describe, so these rows only fill ids the payload is silent about.
+*/
+function withUnpublishedModels(catalog, region) {
+	const known = new Set(catalog.map((model) => model.id));
+	const extra = UNPUBLISHED_MODELS.filter((model) => model.regions.includes(region) && !known.has(model.id));
+	return extra.length > 0 ? [...catalog, ...extra] : [...catalog];
+}
+/**
 * Resolve one entry from a catalog.
 *
 * An unknown id resolves to a synthetic text-only entry rather than the first
@@ -30483,9 +31152,131 @@ function resolveWorkBuddyModel(id, catalog = FALLBACK_MODELS$1) {
 		description: ""
 	};
 }
-/** Models an account in `region` can actually call, in catalog order. */
+/**
+* Vendor families, resolved from a model id.
+*
+* The gateway orders `/v3/config` the way it feels like, which interleaves
+* vendors: a DeepSeek row, then a GPT row, then two Hunyuan rows, then a Kimi
+* row, then three more GPT rows. In a picker that reads as noise — the eye
+* cannot tell that the GPT entries belong together — so the list is grouped by
+* family before it is shown.
+*
+* The rules are ordered, first match wins. Only families this subscription
+* actually serves are listed: a rule for a model that cannot appear would be a
+* guess about a future catalog.
+*
+* An id no rule claims is its own family rather than a shared `other` bucket, so
+* an unrecognised model keeps its place in the order instead of being swept into
+* a pile of models it has nothing to do with.
+*/
+const WORKBUDDY_VENDOR_RULES = [
+	{
+		re: /^(default|fast|balanced|primary|deep)(-model)?$/,
+		family: "alias"
+	},
+	{
+		re: /^gpt-/,
+		family: "openai"
+	},
+	{
+		re: /^gemini-/,
+		family: "google"
+	},
+	{
+		re: /^glm-/,
+		family: "zhipu"
+	},
+	{
+		re: /^kimi-/,
+		family: "moonshot"
+	},
+	{
+		re: /^deepseek-/,
+		family: "deepseek"
+	},
+	{
+		re: /^hy[0-9]/,
+		family: "tencent"
+	},
+	{
+		re: /^hunyuan/,
+		family: "tencent"
+	},
+	{
+		re: /^minimax-/,
+		family: "minimax"
+	},
+	{
+		re: /^space-bunny$/,
+		family: "space-bunny"
+	}
+];
+/** The vendor family one model belongs to. */
+function workBuddyModelVendor(id) {
+	const value = id.toLowerCase();
+	for (const rule of WORKBUDDY_VENDOR_RULES) if (rule.re.test(value)) return rule.family;
+	return id;
+}
+/**
+* Numeric segments of a model id, e.g. `gpt-6-astra` → [6].
+*
+* Version numbers are compared as numbers, so GPT-6.0 sorts below GPT-6.6 rather
+* than above it as it would if the strings were compared.
+*/
+function versionSegments$1(id) {
+	return [...id.toLowerCase().matchAll(/\d+/g)].map((match) => Number(match[0]));
+}
+/**
+* Order two models of one family, newest generation first.
+*
+* Catalog order alone is not good enough. The models served but not published
+* are appended after the published list, which left `gpt-6-sol` below
+* `gpt-5.4` — the newest models at the bottom of their own group. Comparing the
+* numeric segments puts every GPT-6 row together and ahead of every GPT-5 one,
+* and leaves an id whose version cannot be read (an alias, a nickname) in the
+* catalog's own order rather than guessing where it belongs.
+*
+* Ties keep catalog order, so `deepseek-v4.1-flash` still leads its
+* `-flash-sg` sibling.
+*/
+function compareWithinFamily(a, b) {
+	const left = versionSegments$1(a.id);
+	const right = versionSegments$1(b.id);
+	for (let index = 0; index < Math.max(left.length, right.length); index += 1) {
+		const x = left[index];
+		const y = right[index];
+		if (x === void 0) return 1;
+		if (y === void 0) return -1;
+		if (x !== y) return y - x;
+	}
+	return 0;
+}
+/**
+* Group a list so every vendor's models sit together.
+*
+* Families appear in the order their first model does — the catalog decides
+* which vendor leads, not this function — and each family is ordered newest
+* generation first.
+*/
+function groupWorkBuddyModelsByVendor(models) {
+	const families = /* @__PURE__ */ new Map();
+	for (const model of models) {
+		const family = workBuddyModelVendor(model.id);
+		const bucket = families.get(family);
+		if (bucket === void 0) families.set(family, [model]);
+		else bucket.push(model);
+	}
+	return [...families.values()].map((bucket) => [...bucket].sort(compareWithinFamily)).flat();
+}
+/**
+* Models an account in `region` can actually call, grouped by vendor.
+*
+* Grouped here rather than in the settings card because this is also what the
+* request path resolves against: one ordering rule, so the picker and the
+* adapter can never disagree about which models a region offers.
+*/
 function modelsForRegion(region, catalog = FALLBACK_MODELS$1) {
-	return catalog.filter((model) => model.regions.includes(region));
+	return groupWorkBuddyModelsByVendor(catalog.filter((model) => model.regions.includes(region)));
 }
 /** Whether one model accepts image input. */
 function workBuddyModelSupportsImage(id, catalog = FALLBACK_MODELS$1) {
@@ -31435,7 +32226,7 @@ async function fetchConfigCatalog(credentials, options = {}) {
 		signal: timeoutSignal$1(options.signal, DISCOVERY_TIMEOUT_MS$1)
 	});
 	if (!response.ok) throw new Error(`${PROVIDER_NAME$1} model catalog failed: ${response.status}`);
-	return parseConfigModels(await response.json(), credentials.region);
+	return withUnpublishedModels(parseConfigModels(await response.json(), credentials.region), credentials.region);
 }
 /** Cached catalog with a TTL; a failed refresh keeps the previous snapshot.
 *
@@ -31469,7 +32260,7 @@ async function loadConfigCatalog(credentials, options = {}) {
 		}, (fetchedAt, models) => {
 			cachedCatalog = {
 				region: credentials.region,
-				models,
+				models: withUnpublishedModels(models, credentials.region),
 				fetchedAt
 			};
 		}, 0) > 0) {
@@ -31995,7 +32786,13 @@ function resolveEnabledModelIds$2(stored, available, enabled = true) {
 	const known = new Set(available);
 	return stored.filter((id) => known.has(id));
 }
-/** Build the model options the settings card renders, in catalog order. */
+/**
+* Build the model options the settings card renders.
+*
+* Order comes from the caller, which passes a vendor-grouped list so a family
+* is not interleaved with the next one; this preserves whatever order it is
+* given rather than imposing a second one.
+*/
 function buildModelOptions(catalog, available, enabledModelIds, overrides) {
 	const enabled = new Set(enabledModelIds);
 	return available.map((id) => {
@@ -33974,14 +34771,19 @@ const ANTHROPIC_VERSION = "2023-06-01";
 * table, whether or not a floor for that model has been observed: upstream has
 * so far gated a new model on the release that added it (Opus 5.5 arrived in
 * 2.1.280 and is refused below 2.1.280). Claude Sonnet 5.5 arrived in 2.1.284,
-* so 2.1.283 could not be relied on to reach it; 2.1.285 is npm `latest`.
+* so 2.1.283 could not be relied on to reach it. Claude Haiku 5.5 arrived in
+* 2.1.293, so 2.1.292 could not be relied on to reach it either — and that is
+* not hypothetical: when this row was added, npm's `stable` dist-tag was STILL
+* sitting at 2.1.285, five releases below the one that ships the model, while
+* `latest` was already 2.1.293. The warning above about reading `stable` is
+* therefore about this table's own newest model, not a hypothetical.
 *
 * It is still not a literal that only moves when this package is republished: a
 * user whose installed baseline has aged past the server's floor has to be able
 * to raise it without waiting for a release. Read the effective value with
 * {@link claudeCliVersion}, pin one with {@link setClaudeCliVersion}.
 */
-const CLAUDE_CLI_VERSION = "2.1.285";
+const CLAUDE_CLI_VERSION = "2.1.293";
 /**
 * Loopback callback port the subscription flow defaults to.
 *
@@ -34342,10 +35144,11 @@ function loopbackRedirectUri(port = DEFAULT_CALLBACK_PORT) {
 * TWO KINDS OF ROW ARE NOT FULLY TRANSCRIBED, and they are different things.
 * Do not collapse them.
 *
-* 1. `claude-sonnet-5-5` — the snapshot this table was copied from has no
-*    entry for it, so the whole row is CURATED: every value below comes from
-*    the vendor's own documentation and no snapshot field can check it. The
-*    mirror list in the test is `LOCALLY_CURATED_MODEL_IDS`.
+* 1. `claude-sonnet-5-5` and `claude-haiku-5-5` — the snapshot this table
+*    was copied from has no entry for either, so each whole row is CURATED:
+*    every value below comes from the vendor's own documentation and no
+*    snapshot field can check it. The mirror list in the test is
+*    `LOCALLY_CURATED_MODEL_IDS`.
 *
 * 2. `claude-opus-5-5` — a NEWER snapshot (pi-ai >= 0.87.1) does carry it, so
 *    the row sits in the snapshot's own position and EVERY field is checked
@@ -34358,22 +35161,35 @@ function loopbackRedirectUri(port = DEFAULT_CALLBACK_PORT) {
 *    stands. The test asserts the row still disagrees with the snapshot, so a
 *    future snapshot that agrees fails loudly and retires the entry.
 *
-* Both must be changed together with the mirror list in the test. An invented
-* row that mimics the format of a checked one is worse than a missing row: it
-* is unverifiable and it looks verified. So each row is marked at the row
-* itself, the test asserts the id is on the curated list, and the test
+* 3. `claude-haiku-5-5` (released 2026-10-07) is the second fully curated
+*    row, and the first one whose documented `canDisableThinking` is TRUE. That
+*    flag is not a free choice here and the row's own comment records why the
+*    documented answer is safe to send: `thinking: { type: 'disabled' }` is
+*    accepted at `low`/`medium`/`high` and is a 400 at `xhigh`/`max`, and this
+*    line only sends that form when the caller asked for thinking OFF, in which
+*    case it names no effort at all and the server's own default (`medium`) is
+*    what the request runs at. Its documented default effort is MEDIUM, so it is
+*    'adaptive' rather than 'mid-convo' for exactly the reason Opus 5.5 is —
+*    'mid-convo' would force `high` — and it runs the preserved-thinking prefix
+*    check, so `bindsThinkingToPrefix` is set even though the form is adaptive.
+*
+* All three must be changed together with the mirror list in the test. An
+* invented row that mimics the format of a checked one is worse than a missing
+* row: it is unverifiable and it looks verified. So each row is marked at the
+* row itself, the test asserts the id is on the curated list, and the test
 * asserts the curated list is exactly the ids the snapshot lacks — which keeps
 * the lock narrow instead of merely weaker.
 *
-* Its fields come from the vendor's own published documentation for the model
-* (the model overview page plus the extended-thinking effort page), NOT from the
-* snapshot, and they are the values a person read off those pages. That is a
+* `claude-sonnet-5-5`'s fields come from the vendor's own published
+* documentation for the model (the model overview page plus the extended-thinking
+* effort page), NOT from the snapshot, and they are the values a person read off
+* those pages. That is a
 * weaker source than the snapshot and it is labelled as such: nothing here
 * proves the account is entitled to the model, and the server's own
 * `GET /v1/models` still outranks it.
 *
-* Two of its fields are the ones worth recording a WHY for, because both look
-* like mistakes against their neighbours:
+* Two of that row's fields are the ones worth recording a WHY for, because both
+* look like mistakes against their neighbours:
 *
 * 1. `canDisableThinking: false`. The vendor documents that thinking cannot be
 *    turned off on this model at all: sending `thinking: { type: 'disabled' }`
@@ -34399,17 +35215,18 @@ function loopbackRedirectUri(port = DEFAULT_CALLBACK_PORT) {
 * A future reader who notices the shared `supportsTemperature: false` and
 * "fixes" item 2 to 'mid-convo' has reintroduced exactly that bug.
 *
-* One more field on that row comes from neither source: its `minCliVersion`
-* floor is the number upstream itself states when it refuses the model
-* (`claude_code_version_too_old`, "version 2.1.280 or newer is required"). That
+* One more field on `claude-opus-5-5` comes from neither source: its
+* `minCliVersion` floor is the number upstream itself states when it refuses
+* the model (`claude_code_version_too_old`, "version 2.1.280 or newer is
+* required"). That
 * is a stronger witness than a documentation page — the server said it — and it
 * is recorded here so a claim below it is refused locally, before the request is
 * sent, instead of as an upstream 400 that names neither the model nor the number
 * the user has to reach.
 */
 /**
-* Sixteen rows: the snapshot's own 15, in the snapshot's own declaration order,
-* followed by the one row the snapshot still predates (see LOCAL ADDITIONS above).
+* Seventeen rows: the snapshot's own 15, in the snapshot's own declaration order,
+* followed by the two rows the snapshot still predates (see LOCAL ADDITIONS above).
 *
 * The order matters and is not cosmetic. The test asserts the snapshot's ids
 * appear in the table as a SUBSEQUENCE, so a curated row may be appended or
@@ -34697,6 +35514,24 @@ const CLAUDE_MODELS = Object.freeze([
 		],
 		canDisableThinking: false,
 		bindsThinkingToPrefix: true
+	},
+	{
+		id: "claude-haiku-5-5",
+		name: "Claude Haiku 5.5",
+		contextWindow: 1e6,
+		maxTokens: 128e3,
+		supportsImage: true,
+		supportsTemperature: false,
+		thinkingMode: "adaptive",
+		reasoningEfforts: [
+			"low",
+			"medium",
+			"high",
+			"xhigh",
+			"max"
+		],
+		canDisableThinking: true,
+		bindsThinkingToPrefix: true
 	}
 ]);
 /** Every id the fallback table knows, in declaration order. */
@@ -34721,6 +35556,13 @@ const FALLBACK_MODELS = CLAUDE_MODELS;
 * than one that leads with the general-purpose ids. The rest stay selectable
 * from the model card and are one click away.
 *
+* The list tracks ONE current model per family rather than the newest of each,
+* so a slot follows its family's newest release in place instead of growing: the
+* Haiku slot is `claude-haiku-5-5`, which replaced `claude-haiku-4-5` when that
+* model shipped. That is a deliberate swap and not a silent append — a list that
+* offered both generations of every family would be longer than the picker it
+* feeds, and the older Haiku stays one click away in the card.
+*
 * This list is the SHIPPED DEFAULT, and edits to it are a deliberate onboarding
 * decision rather than a no-op: a stored list that still equals the shipped
 * default counts as "never edited", and the routes and adapter read it that way
@@ -34734,7 +35576,7 @@ const DEFAULT_VISIBLE_MODEL_IDS = [
 	"claude-opus-5-5",
 	"claude-opus-4-6",
 	"claude-sonnet-4-6",
-	"claude-haiku-4-5",
+	"claude-haiku-5-5",
 	"claude-opus-4-5"
 ];
 new Map(CLAUDE_MODELS.map((model) => [model.id, model]));
@@ -44960,6 +45802,22 @@ function installRelayProbe(ctx, options) {
 * degenerate stream scores near one. On a hit it stops yielding chunks, so the
 * in-flight request ends, and lets the turn resume on a fresh step.
 *
+* Uniqueness alone only sees verbatim repetition. A stream can restate one
+* conclusion over and over in fresh words, score 0.48 where the threshold is
+* 0.85, and run to the output ceiling untouched. So a second, independent
+* signal scores the same window for recurrence: how strongly each sentence
+* repeats something the model already said at least `semanticLag` sentences
+* earlier. Enumerative reasoning repeats itself too, but adjacently — each item
+* borrows the previous item's frame — and recurrence ignores adjacency, which
+* is what separates the two.
+*
+* Neither signal stops anything on its own. A break needs both over their
+* thresholds in the same window, and then `semanticConfirmations` consecutive
+* such windows: one signal alone, or a single anomalous window, is logged and
+* released. That gradient is the whole design. A guard that cuts a healthy
+* answer is worse than one that lets a runaway finish, because the user sees a
+* turn stop mid-sentence with no explanation, and the fix costs a whole turn.
+*
 * Seam choice: the guard wraps `llm/stream`, not `agent/assistant-stream`.
 * `agent/assistant-stream` is emit-mode — it can observe but cannot stop a
 * stream — and it does not exist before harness 0.1.5, which would make the
@@ -44996,6 +45854,15 @@ const DEFAULT_GUARD_OPTIONS = {
 	maxBreaksPerTurn: 3,
 	cooldownMs: 3e4,
 	includeModels: [],
+	semanticThreshold: .35,
+	semanticLag: 6,
+	semanticMinChars: 360,
+	semanticMinSentences: 8,
+	semanticConfirmations: 3,
+	semanticLiteralFloor: .6,
+	semanticStrictThreshold: .45,
+	semanticDistinctCeiling: .47,
+	semanticStrictConfirmations: 5,
 	now: () => Date.now()
 };
 function pruneUndefined(options) {
@@ -45021,8 +45888,21 @@ function resolveGuardOptions(options = {}) {
 	if (!Number.isFinite(resolved.threshold) || resolved.threshold <= 0 || resolved.threshold >= 1) throw new Error(`reasoning-collapse-guard: invalid threshold ${String(resolved.threshold)} — must be strictly between 0 and 1`);
 	if (!Number.isInteger(resolved.maxBreaksPerTurn) || resolved.maxBreaksPerTurn < 1) throw new Error(`reasoning-collapse-guard: invalid maxBreaksPerTurn ${String(resolved.maxBreaksPerTurn)} — must be an integer >= 1`);
 	if (!Number.isInteger(resolved.cooldownMs) || resolved.cooldownMs < 0) throw new Error(`reasoning-collapse-guard: invalid cooldownMs ${String(resolved.cooldownMs)} — must be an integer >= 0`);
+	if (!Number.isFinite(resolved.semanticThreshold) || resolved.semanticThreshold <= 0 || resolved.semanticThreshold >= 1) throw new Error(`reasoning-collapse-guard: invalid semanticThreshold ${String(resolved.semanticThreshold)} — must be strictly between 0 and 1`);
+	if (!Number.isInteger(resolved.semanticLag) || resolved.semanticLag < 1) throw new Error(`reasoning-collapse-guard: invalid semanticLag ${String(resolved.semanticLag)} — must be an integer >= 1`);
+	if (!Number.isInteger(resolved.semanticMinChars) || resolved.semanticMinChars < 1) throw new Error(`reasoning-collapse-guard: invalid semanticMinChars ${String(resolved.semanticMinChars)} — must be an integer >= 1`);
+	if (resolved.semanticMinChars > resolved.windowChars) throw new Error(`reasoning-collapse-guard: invalid semanticMinChars ${resolved.semanticMinChars} — must not exceed windowChars ${resolved.windowChars}`);
+	if (!Number.isInteger(resolved.semanticMinSentences) || resolved.semanticMinSentences < 2) throw new Error(`reasoning-collapse-guard: invalid semanticMinSentences ${String(resolved.semanticMinSentences)} — must be an integer >= 2`);
+	if (!Number.isInteger(resolved.semanticConfirmations) || resolved.semanticConfirmations < 1) throw new Error(`reasoning-collapse-guard: invalid semanticConfirmations ${String(resolved.semanticConfirmations)} — must be an integer >= 1`);
+	if (!Number.isFinite(resolved.semanticLiteralFloor) || resolved.semanticLiteralFloor <= 0 || resolved.semanticLiteralFloor >= 1) throw new Error(`reasoning-collapse-guard: invalid semanticLiteralFloor ${String(resolved.semanticLiteralFloor)} — must be strictly between 0 and 1`);
+	if (!Number.isFinite(resolved.semanticStrictThreshold) || resolved.semanticStrictThreshold <= 0 || resolved.semanticStrictThreshold >= 1) throw new Error(`reasoning-collapse-guard: invalid semanticStrictThreshold ${String(resolved.semanticStrictThreshold)} — must be strictly between 0 and 1`);
+	if (!Number.isFinite(resolved.semanticDistinctCeiling) || resolved.semanticDistinctCeiling <= 0 || resolved.semanticDistinctCeiling >= 1) throw new Error(`reasoning-collapse-guard: invalid semanticDistinctCeiling ${String(resolved.semanticDistinctCeiling)} — must be strictly between 0 and 1`);
+	if (!Number.isInteger(resolved.semanticStrictConfirmations) || resolved.semanticStrictConfirmations < 1) throw new Error(`reasoning-collapse-guard: invalid semanticStrictConfirmations ${String(resolved.semanticStrictConfirmations)} — must be an integer >= 1`);
 	if (!Array.isArray(resolved.includeModels) || resolved.includeModels.some((entry) => typeof entry !== "string")) throw new Error("reasoning-collapse-guard: includeModels must be an array of strings");
 	if (typeof resolved.now !== "function") throw new Error("reasoning-collapse-guard: now must be a function");
+	resolved.semanticStrictThreshold = Math.max(resolved.semanticStrictThreshold, resolved.semanticThreshold);
+	resolved.semanticStrictConfirmations = Math.max(resolved.semanticStrictConfirmations, resolved.semanticConfirmations + 1);
+	resolved.semanticLiteralFloor = Math.min(resolved.semanticLiteralFloor, resolved.threshold);
 	return resolved;
 }
 /**
@@ -45045,6 +45925,92 @@ function collapseScore(window, n) {
 	if (total === 0) return 0;
 	return 1 - grams.size / total;
 }
+/**
+* Split reasoning text into sentences, for mixed CJK and Latin streams.
+*
+* A Chinese full stop ends a sentence whatever follows it. An ASCII `.!?` only
+* ends one when whitespace or the end of the text follows, because the same
+* characters carry out decimals, file names and version numbers
+* (`selectors.test.ts:745`, `3.14`) that must not become sentence
+* edges. Whitespace runs collapse and case folds, so a difference in spacing
+* or capitalisation cannot read as a difference in wording.
+*
+* @param text - reasoning text, typically one trailing window.
+* @returns non-empty normalized sentences, in order.
+*/
+function splitSentences(text) {
+	const parts = [];
+	let start = 0;
+	for (let i = 0; i < text.length; i++) {
+		const char = text[i];
+		const next = text[i + 1];
+		const cjk = CJK_TERMINATORS.has(char);
+		const latin = LATIN_TERMINATORS.has(char) && (next === void 0 || TRAILING_SPACE.test(next));
+		if (!cjk && !latin) continue;
+		parts.push(text.slice(start, i + 1));
+		start = i + 1;
+	}
+	parts.push(text.slice(start));
+	const sentences = [];
+	for (const part of parts) {
+		const normalized = part.replace(WHITESPACE_RUN, " ").trim().toLowerCase();
+		if (normalized.length > 0) sentences.push(normalized);
+	}
+	return sentences;
+}
+/** The three Chinese sentence terminators, which need no trailing space. */
+const CJK_TERMINATORS = /* @__PURE__ */ new Set([
+	"。",
+	"！",
+	"？"
+]);
+/** The three ASCII terminators, which only close a sentence before whitespace. */
+const LATIN_TERMINATORS = /* @__PURE__ */ new Set([
+	".",
+	"!",
+	"?"
+]);
+const TRAILING_SPACE = /\s/;
+const WHITESPACE_RUN = /\s+/g;
+/** Character n-grams of one normalized sentence, as a set. */
+function sentenceGrams(sentence) {
+	const grams = /* @__PURE__ */ new Set();
+	for (let i = 0; i + SEMANTIC_NGRAM_SIZE <= sentence.length; i++) grams.add(sentence.slice(i, i + SEMANTIC_NGRAM_SIZE));
+	return grams;
+}
+function gramJaccard(a, b) {
+	if (a.size === 0 || b.size === 0) return 0;
+	let shared = 0;
+	for (const gram of a) if (b.has(gram)) shared++;
+	return shared / (a.size + b.size - shared);
+}
+/** {@link semanticRecurrence} over sentences the caller has already split. */
+function sentenceRecurrence(sentences, lag) {
+	const grams = sentences.map(sentenceGrams);
+	if (grams.length <= lag) return 0;
+	let total = 0;
+	let counted = 0;
+	for (let i = lag; i < grams.length; i++) {
+		const current = grams[i];
+		let best = 0;
+		for (let j = 0; j <= i - lag; j++) {
+			const earlier = grams[j];
+			if (Math.min(current.size, earlier.size) / Math.max(current.size, earlier.size) <= best) continue;
+			const similarity = gramJaccard(current, earlier);
+			if (similarity > best) best = similarity;
+		}
+		total += best;
+		counted++;
+	}
+	return counted === 0 ? 0 : total / counted;
+}
+/** Character n-gram size both halves of the semantic signal are built on. */
+const SEMANTIC_NGRAM_SIZE = 3;
+/** {@link distinctSentenceRatio} over sentences the caller already split. */
+function distinctRatioOf(sentences) {
+	if (sentences.length < 2) return 1;
+	return new Set(sentences).size / sentences.length;
+}
 const RESUME_HINT = "Your previous reasoning became repetitive and was stopped before it finished. Resume from what you already established instead of restarting the analysis, and keep the rest of this response short.";
 /** The second resume message, used once a resume has also collapsed. */
 const RESUME_HINT_STRICT = "Your reasoning has now repeated across two attempts. Do not re-derive the analysis a third time. Either state the conclusion you already reached, or make the single next tool call that moves the task forward. Keep this response to a few sentences.";
@@ -45053,7 +46019,11 @@ function createBreakerState() {
 		breaksThisTurn: 0,
 		lastBreakAt: -Infinity,
 		exhausted: false,
-		resuming: false
+		resuming: false,
+		dualStreak: 0,
+		lowStreak: 0,
+		notedLiteralOnly: false,
+		notedSemanticOnly: false
 	};
 }
 /**
@@ -45208,10 +46178,12 @@ function installReasoningCollapseGuard(ctx, options = {}) {
 	* point — and the log says so, because a break that cannot resume is
 	* indistinguishable from a broken turn to the user.
 	*/
-	function breakOff(state, score, agent, sessionId) {
+	function breakOff(state, literal, semantic, path, agent, sessionId) {
 		state.breaksThisTurn++;
 		state.lastBreakAt = resolved.now();
-		ctx.logger?.warn(`reasoning-collapse-guard: stopped degenerate reasoning (score ${score.toFixed(3)}, break ${state.breaksThisTurn}/${resolved.maxBreaksPerTurn}, session ${sessionId ?? "unidentified"}${agent === void 0 ? ", no agent to resume" : ""})`);
+		state.dualStreak = 0;
+		state.lowStreak = 0;
+		ctx.logger?.warn(`reasoning-collapse-guard: stopped degenerate reasoning on the ${path} path after ${path === "high-literal" ? resolved.semanticConfirmations : resolved.semanticStrictConfirmations} confirmed windows (literal ${literal.toFixed(3)}, semantic ${semantic.toFixed(3)}, break ${state.breaksThisTurn}/${resolved.maxBreaksPerTurn}, session ${sessionId ?? "unidentified"}${agent === void 0 ? ", no agent to resume" : ""})`);
 		if (agent === void 0) return;
 		agent.cancel?.({
 			kind: "hook",
@@ -45229,6 +46201,48 @@ function installReasoningCollapseGuard(ctx, options = {}) {
 			}
 		});
 	}
+	/**
+	* Report one signal holding without the other.
+	*
+	* Reported once per kind per turn, not once per window: a runaway can hold
+	* one signal for hundreds of windows, and a line each would bury the report
+	* of the one that mattered. This is the diagnostic half of the gradient —
+	* the reason a near miss is still diagnosable after the fact.
+	*/
+	function noteLoneSignal(state, kind, literal, semantic, sessionId) {
+		if (kind === "literal" ? state.notedLiteralOnly : state.notedSemanticOnly) return;
+		if (kind === "literal") state.notedLiteralOnly = true;
+		else state.notedSemanticOnly = true;
+		ctx.logger?.warn(`reasoning-collapse-guard: observed the ${kind} signal alone (literal ${literal === void 0 ? "not scored" : literal.toFixed(3)}, semantic ${semantic === void 0 ? "not scored" : semantic.toFixed(3)}, session ${sessionId ?? "unidentified"}) — the other signal has not agreed, not acting`);
+	}
+	/**
+	* Report a run of agreeing windows that ended before it reached the count.
+	*
+	* Without this, two short runs of agreeing windows look in the log exactly
+	* like one long one that simply stopped short, and the confirmation count
+	* becomes impossible to reason about after the fact.
+	*/
+	function noteStreakCleared(state, reached, sessionId) {
+		ctx.logger?.warn(`reasoning-collapse-guard: the signals stopped agreeing after ${reached} of ${resolved.semanticConfirmations} windows (session ${sessionId ?? "unidentified"}) — streak cleared, not acting`);
+	}
+	/** Report the low-literal run that ended before it reached its longer count. */
+	function noteLowStreakCleared(reached, sessionId) {
+		ctx.logger?.warn(`reasoning-collapse-guard: the low-literal bars stopped holding after ${reached} of ${resolved.semanticStrictConfirmations} windows (session ${sessionId ?? "unidentified"}) — streak cleared, not acting`);
+	}
+	/** Report a low-literal window that qualifies but has not been confirmed enough. */
+	function notePendingLowConfirmation(state, literal, semantic, distinct, sessionId) {
+		ctx.logger?.warn(`reasoning-collapse-guard: low-literal bars hold in window ${state.lowStreak}/${resolved.semanticStrictConfirmations} (literal ${literal.toFixed(3)} >= ${resolved.semanticLiteralFloor}, semantic ${semantic.toFixed(3)} >= ${resolved.semanticStrictThreshold}, distinct ${distinct.toFixed(3)} <= ${resolved.semanticDistinctCeiling}, session ${sessionId ?? "unidentified"}) — not acting yet`);
+	}
+	/**
+	* Report a window where both signals held but the streak is still short.
+	*
+	* `semanticConfirmations` is what makes a break a decision rather than a
+	* reflex, so each pending confirmation is named, and the log then says how
+	* close a stream came to being cut by a guard that did not cut it.
+	*/
+	function notePendingConfirmation(state, literal, semantic, sessionId) {
+		ctx.logger?.warn(`reasoning-collapse-guard: both signals hold in window ${state.dualStreak}/${resolved.semanticConfirmations} (literal ${literal.toFixed(3)}, semantic ${semantic.toFixed(3)}, session ${sessionId ?? "unidentified"}) — not acting yet`);
+	}
 	function guardStream(request, next) {
 		const state = breakerFor(request.signal ?? STATIC_KEY);
 		if (state.exhausted || !watchedModel(request.model) || !conversationCall(request)) return next();
@@ -45239,13 +46253,33 @@ function installReasoningCollapseGuard(ctx, options = {}) {
 				if (chunk.type === "block-start") window = "";
 				if (chunk.type === "reasoning-delta" && typeof chunk.text === "string") {
 					window = appendWindow(window, chunk.text, resolved.windowChars);
-					if (window.length >= resolved.minWindowChars && resolved.now() - state.lastBreakAt >= resolved.cooldownMs) {
-						const score = collapseScore(window, resolved.ngramSize);
-						if (score >= resolved.threshold) if (state.breaksThisTurn >= resolved.maxBreaksPerTurn) state.exhausted = true;
+					if (resolved.now() - state.lastBreakAt >= resolved.cooldownMs) {
+						const literal = window.length >= resolved.minWindowChars ? collapseScore(window, resolved.ngramSize) : void 0;
+						const sentences = window.length >= resolved.semanticMinChars ? splitSentences(window) : [];
+						const semantic = sentences.length >= resolved.semanticMinSentences ? sentenceRecurrence(sentences, resolved.semanticLag) : void 0;
+						const distinct = sentences.length >= resolved.semanticMinSentences ? distinctRatioOf(sentences) : void 0;
+						const high = literal !== void 0 && literal >= resolved.threshold && semantic !== void 0 && semantic >= resolved.semanticThreshold;
+						const low = literal !== void 0 && literal >= resolved.semanticLiteralFloor && literal < resolved.threshold && semantic !== void 0 && semantic >= resolved.semanticStrictThreshold && distinct !== void 0 && distinct <= resolved.semanticDistinctCeiling;
+						const reachedHigh = state.dualStreak;
+						const reachedLow = state.lowStreak;
+						state.dualStreak = high ? reachedHigh + 1 : 0;
+						state.lowStreak = low ? reachedLow + 1 : 0;
+						if (reachedHigh !== 0 && state.dualStreak === 0) noteStreakCleared(state, reachedHigh, request.sessionId);
+						if (reachedLow !== 0 && state.lowStreak === 0) noteLowStreakCleared(reachedLow, request.sessionId);
+						if (high && state.dualStreak >= resolved.semanticConfirmations) if (state.breaksThisTurn >= resolved.maxBreaksPerTurn) state.exhausted = true;
+						else {
+							breakOff(state, literal, semantic, "high-literal", agent, request.sessionId);
+							return;
+						}
+						else if (low && state.lowStreak >= resolved.semanticStrictConfirmations) if (state.breaksThisTurn >= resolved.maxBreaksPerTurn) state.exhausted = true;
 						else {
-							breakOff(state, score, agent, request.sessionId);
+							breakOff(state, literal, semantic, "low-literal", agent, request.sessionId);
 							return;
 						}
+						else if (high) notePendingConfirmation(state, literal, semantic, request.sessionId);
+						else if (low) notePendingLowConfirmation(state, literal, semantic, distinct, request.sessionId);
+						else if (literal !== void 0 && literal >= resolved.threshold) noteLoneSignal(state, "literal", literal, semantic, request.sessionId);
+						else if (semantic !== void 0 && semantic >= resolved.semanticThreshold) noteLoneSignal(state, "semantic", literal, semantic, request.sessionId);
 					}
 				}
 				yield chunk;