@eddyskywalker/dsh-chatgpt-subscription 0.26.0 → 0.27.0

package/lib/index.js

@@ -1,7 +1,7 @@
 import { createRequire } from "node:module";
 import z from "@deepseek-ai/schemastery";
 import * as LlmModule from "@deepseek-ai/dsh-llm";
-import { HarnessError, LlmAdapter, LlmError, LlmError as LlmError$1, ProviderRequestId, ReasoningEffortId, attributionHeaders, errorChain, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
+import { HarnessError, LlmAdapter, LlmError, LlmError as LlmError$1, ProviderRequestId, ReasoningEffortId, attributionHeaders, createUserMessage, errorChain, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import fs, { chmod, lstat, mkdir, open, readFile, rename, stat, unlink } from "node:fs/promises";
 import path, { basename, dirname, join, relative, resolve } from "node:path";
 import os, { homedir, platform, userInfo } from "node:os";
@@ -14,7 +14,7 @@ import { WebError } from "@deepseek-ai/dsh-web";
 import { lookup } from "node:dns/promises";
 import { isIP } from "node:net";
 import { MAX_TIMER_DELAY_MS, idleWatchdog, timeoutOf } from "@deepseek-ai/dsh-timeout";
-import { boundContextSummary, createUserMessage } from "@deepseek-ai/dsh-llm/message";
+import { boundContextSummary, createUserMessage as createUserMessage$1 } from "@deepseek-ai/dsh-llm/message";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import * as SettingsModule from "@deepseek-ai/dsh-settings";
 import { URL as URL$1, URLSearchParams as URLSearchParams$1, fileURLToPath } from "node:url";
@@ -1361,14 +1361,14 @@ const SHARD_PAYLOAD_SIZE = 7e3;
 */
 const MAX_SHARDS = 128;
 /** Property that marks a primary entry as the envelope of a chunked value. */
-const ENVELOPE_KEY = "__dshChunked";
+const ENVELOPE_KEY$1 = "__dshChunked";
 /**
 * Read the envelope of a stored primary entry, or null when the entry holds a
 * plain value. A malformed envelope is invalid stored data, not a plain value.
 */
 function envelopeFrom(parsed) {
 	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
-	const marker = parsed[ENVELOPE_KEY];
+	const marker = parsed[ENVELOPE_KEY$1];
 	if (marker === void 0) return null;
 	if (typeof marker !== "object" || marker === null) throw new Error(INVALID);
 	const { gen, chunks, bytes } = marker;
@@ -1489,7 +1489,7 @@ var SecretServiceCredentialStore = class {
 			"store",
 			"--label=DSH Antigravity OAuth",
 			...this.attributes()
-		], JSON.stringify({ [ENVELOPE_KEY]: envelope }))).code !== 0) {
+		], JSON.stringify({ [ENVELOPE_KEY$1]: envelope }))).code !== 0) {
 			await this.clearShards(gen, chunks);
 			throw new Error(UNAVAILABLE);
 		}
@@ -4348,7 +4348,7 @@ function createCodexImageTool(oauth, attachments, options = {}) {
 					...image.name !== void 0 ? { name: image.name } : {}
 				}
 			};
-			if (exec.parent !== void 0) exec.deferContext(createUserMessage({
+			if (exec.parent !== void 0) exec.deferContext(createUserMessage$1({
 				content: [{
 					type: "image",
 					attachment: image
@@ -8293,7 +8293,7 @@ function createAntigravityImageTool(accountPool, store, attachments, options = {
 					...image.name !== void 0 ? { name: image.name } : {}
 				}))
 			};
-			if (exec.parent !== void 0) exec.deferContext(createUserMessage({
+			if (exec.parent !== void 0) exec.deferContext(createUserMessage$1({
 				content: saved.map((attachment) => ({
 					type: "image",
 					attachment
@@ -12256,6 +12256,24 @@ function runningProviderValue(value) {
 function providerId(value) {
 	return typeof value === "string" && /^[a-zA-Z0-9_-]{1,80}$/.test(value) ? value : null;
 }
+/**
+* Start reconciling the web provider selection on a timer.
+*
+* @param options - the reconcile callback and an optional interval.
+* @returns the disposer that stops the timer.
+*/
+function startWebProviderReconciler(options) {
+	const intervalMs = options.intervalMs ?? 3e4;
+	const timer = setInterval(() => {
+		try {
+			options.reconcile();
+		} catch {}
+	}, intervalMs);
+	timer.unref?.();
+	return () => {
+		clearInterval(timer);
+	};
+}
 //#endregion
 //#region src/host/common/quota-refresh.ts
 /**
@@ -26783,7 +26801,7 @@ function createKimiVideoTool(ctx, options = {}) {
 				throw error;
 			}
 			const question = typeof args.question === "string" ? args.question.trim() : "";
-			exec.deferContext(createUserMessage({
+			exec.deferContext(createUserMessage$1({
 				content: [{
 					type: "video",
 					attachment: ref
@@ -31336,7 +31354,7 @@ function projectAccount$2(input) {
 * Takes the summary shape as well as the pool row, because both the card's list
 * and the routing read ask the same question about it.
 */
-function isMarkedFailed(account) {
+function isMarkedFailed$1(account) {
 	return account.authStatus !== void 0 && account.authStatus !== "ok";
 }
 /** The alias an account is labelled with when the user has not named it. */
@@ -31575,7 +31593,7 @@ var MinimaxCodeAccountPool = class extends AccountPoolCore {
 	*/
 	async listAccounts() {
 		const summaries = await super.listAccounts();
-		if (!summaries.some(isMarkedFailed)) return summaries;
+		if (!summaries.some(isMarkedFailed$1)) return summaries;
 		await this.healStaleAuthFailures().catch(() => void 0);
 		return await super.listAccounts();
 	}
@@ -31591,7 +31609,7 @@ var MinimaxCodeAccountPool = class extends AccountPoolCore {
 	*/
 	async getEffectiveAccount(excludeIds, fetchFn = fetch) {
 		const data = await this.read();
-		if (data.accounts.some(isMarkedFailed)) await this.healStaleAuthFailures(data).catch(() => void 0);
+		if (data.accounts.some(isMarkedFailed$1)) await this.healStaleAuthFailures(data).catch(() => void 0);
 		return await super.getEffectiveAccount(excludeIds, fetchFn);
 	}
 	/**
@@ -31610,7 +31628,7 @@ var MinimaxCodeAccountPool = class extends AccountPoolCore {
 	* because that one genuinely needs a sign-in.
 	*/
 	async healStaleAuthFailures(current) {
-		const failedAccounts = (current ?? await this.read()).accounts.filter(isMarkedFailed);
+		const failedAccounts = (current ?? await this.read()).accounts.filter(isMarkedFailed$1);
 		if (failedAccounts.length === 0) return false;
 		const targets = new Map(failedAccounts.map((account) => [account.id, {
 			credentials: account.credentials,
@@ -32720,8 +32738,17 @@ function parseWorkBuddyCreditMultiplier(raw) {
 	if (!Number.isFinite(value) || value < 0) return null;
 	return stripped;
 }
-/** Every level this route can name, in escalating order (the card's sort key). */
+/**
+* Every level this route can name, in escalating order (the card's sort key).
+*
+* `none` is the one level that is not a rung of any ladder: it is the measured
+* spelling that turns the reasoning trace OFF upstream (`reasoning_effort:
+* "none"`, the value the sibling gateway sends on its own cheap calls). It is
+* only ever offered on a model the catalog marks `canDisableThinking`, so it
+* sorts below everything and is never used to converge a level onto a ladder.
+*/
 const WORKBUDDY_REASONING_EFFORTS = [
+	"none",
 	"minimal",
 	"low",
 	"medium",
@@ -33853,9 +33880,18 @@ function modelsForRegion$1(region, catalog = FALLBACK_MODELS$1) {
 function workBuddyModelSupportsImage(id, catalog = FALLBACK_MODELS$1) {
 	return resolveWorkBuddyModel(id, catalog).supportsImage;
 }
-/** Reasoning ladder one model accepts. */
+/**
+* Reasoning ladder one model accepts, plus `none` when its trace can be turned off.
+*
+* The ladder in the catalog is what the model ACCEPTS, so `none` never appears
+* in it; `canDisableThinking` is the separate statement that switching thinking
+* off is allowed, and this is the single place that turns it into the one level
+* the picker can offer. Callers that need the ladder alone read the entry.
+*/
 function workBuddyReasoningEfforts(id, catalog = FALLBACK_MODELS$1) {
-	return resolveWorkBuddyModel(id, catalog).reasoningEfforts;
+	const entry = resolveWorkBuddyModel(id, catalog);
+	if (!entry.canDisableThinking || entry.reasoningEfforts.length === 0) return entry.reasoningEfforts;
+	return entry.reasoningEfforts.includes("none") ? entry.reasoningEfforts : ["none", ...entry.reasoningEfforts];
 }
 /** Output cap requested when the caller omits one. */
 function maxOutputTokensFor$3(id, catalog = FALLBACK_MODELS$1) {
@@ -33972,6 +34008,547 @@ function withResolvedIdentity(credentials) {
 	return changed ? next : credentials;
 }
 //#endregion
+//#region src/host/workbuddy/guardrails.ts
+/**
+* Local quota guardrails for the WorkBuddy line.
+*
+* The subscription meters an account × model over a 24h window (429 `code
+* 6004`), but it only says so AFTER the window is gone — and on the shared
+* account that window is minutes of a large model or a day of a small one. These
+* guardrails stop serving BEFORE that happens, so an exhausted window never has
+* to be discovered by a user staring at a 429.
+*
+* Three of the four guardrails workbuddy2api-hub ships are reproduced here, and
+* all three are EXACT — they read numbers this plugin already has:
+*
+*   reserveCredits    stop the account when its remaining credits fall below N
+*                     (the billing snapshot already reports the remainder)
+*   dailyTokens       stop the account for the rest of the local day at N tokens
+*   modelDailyTokens  stop ONE model for the rest of the local day at N tokens
+*
+* The fourth one there — a daily CREDITS budget — is deliberately NOT
+* reproduced: a request's credit cost is not on the wire this route reads, and
+* deriving it from the catalog multiplier × tokens would invent a number that
+* silently diverges from the bill. A guardrail that lies is worse than none.
+*
+* `0` means OFF for every field, and the default is all-off: an install that
+* never opens this setting behaves exactly as before.
+*/
+/** Shipped default: every guardrail off. */
+const DEFAULT_GUARDRAILS = {
+	reserveCredits: 0,
+	dailyTokens: 0,
+	modelDailyTokens: 0
+};
+function positiveOrZero(value) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return 0;
+	return Math.floor(value);
+}
+/** Narrow a stored or patched value into guardrails; anything unusable means off. */
+function normalizeGuardrails(value) {
+	if (typeof value !== "object" || value === null) return { ...DEFAULT_GUARDRAILS };
+	const record = value;
+	return {
+		reserveCredits: positiveOrZero(record.reserveCredits),
+		dailyTokens: positiveOrZero(record.dailyTokens),
+		modelDailyTokens: positiveOrZero(record.modelDailyTokens)
+	};
+}
+/** Whether any guardrail is armed; a no-op check must stay cheap. */
+function guardrailsArmed(guardrails) {
+	return guardrails.reserveCredits > 0 || guardrails.dailyTokens > 0 || guardrails.modelDailyTokens > 0;
+}
+/**
+* The local calendar day a counter belongs to.
+*
+* Local, not UTC, because the reset the user reasons about is their own
+* midnight — the same choice this line makes for the CN check-in day.
+*/
+function localDayKey(now = Date.now()) {
+	const date = new Date(now);
+	const month = String(date.getMonth() + 1).padStart(2, "0");
+	const day = String(date.getDate()).padStart(2, "0");
+	return `${date.getFullYear()}-${month}-${day}`;
+}
+/** Where the local usage counters live. */
+function usageLedgerPath() {
+	return path.join(dshHomeDir(), "storages", "workbuddy-usage.json");
+}
+/**
+* Token counters per account per local day.
+*
+* Deliberately a small persisted document rather than an accounting system: it
+* exists to answer one question ("has this account / model used its day?") and a
+* restart must not forget it, or a guardrail would reset by restarting DSH.
+*/
+var WorkBuddyUsageLedger = class {
+	filePath;
+	now;
+	document = {
+		version: 1,
+		day: localDayKey(),
+		accounts: {}
+	};
+	loaded = false;
+	writing = Promise.resolve();
+	constructor(filePath = usageLedgerPath(), now = () => Date.now()) {
+		this.filePath = filePath;
+		this.now = now;
+	}
+	/** Read the counters once; a missing or unreadable file starts a fresh day. */
+	async load() {
+		if (this.loaded) return;
+		this.loaded = true;
+		try {
+			const raw = JSON.parse(await fs.readFile(this.filePath, "utf8"));
+			if (typeof raw !== "object" || raw === null) return;
+			const record = raw;
+			const accounts = typeof record.accounts === "object" && record.accounts !== null ? record.accounts : {};
+			const entries = {};
+			for (const [accountId, value] of Object.entries(accounts)) {
+				if (typeof value !== "object" || value === null) continue;
+				const entry = value;
+				const perModel = {};
+				if (typeof entry.perModel === "object" && entry.perModel !== null) {
+					for (const [model, tokens] of Object.entries(entry.perModel)) if (typeof tokens === "number" && Number.isFinite(tokens) && tokens > 0) perModel[model] = tokens;
+				}
+				entries[accountId] = {
+					tokens: typeof entry.tokens === "number" && Number.isFinite(entry.tokens) ? entry.tokens : 0,
+					perModel
+				};
+			}
+			this.document = {
+				version: 1,
+				day: typeof record.day === "string" ? record.day : localDayKey(this.now()),
+				accounts: entries
+			};
+			this.rollIfNewDay();
+		} catch {}
+	}
+	/** Drop yesterday's counters the moment a read notices the day changed. */
+	rollIfNewDay() {
+		const today = localDayKey(this.now());
+		if (this.document.day === today) return;
+		this.document = {
+			version: 1,
+			day: today,
+			accounts: {}
+		};
+	}
+	/** Tokens one account has used today, across models. */
+	tokensToday(accountId) {
+		this.rollIfNewDay();
+		return this.document.accounts[accountId]?.tokens ?? 0;
+	}
+	/** Tokens one account has used today on one model. */
+	modelTokensToday(accountId, model) {
+		this.rollIfNewDay();
+		return this.document.accounts[accountId]?.perModel[model] ?? 0;
+	}
+	/** Today's counters, for the settings card and for tests. */
+	snapshot() {
+		this.rollIfNewDay();
+		return this.document.accounts;
+	}
+	/**
+	* Add one request's tokens.
+	*
+	* Serialized through a promise chain: two concurrent requests on different
+	* accounts would otherwise read the same document, add their own counts and
+	* write, losing one of them.
+	*/
+	async record(accountId, model, tokens) {
+		if (!Number.isFinite(tokens) || tokens <= 0) return;
+		this.rollIfNewDay();
+		const entry = this.document.accounts[accountId] ?? {
+			tokens: 0,
+			perModel: {}
+		};
+		entry.tokens += Math.floor(tokens);
+		entry.perModel[model] = (entry.perModel[model] ?? 0) + Math.floor(tokens);
+		this.document.accounts[accountId] = entry;
+		const write = this.writing.then(() => this.persist());
+		this.writing = write.catch(() => void 0);
+		await write.catch(() => void 0);
+	}
+	async persist() {
+		await fs.mkdir(path.dirname(this.filePath), { recursive: true });
+		const tmp = `${this.filePath}.tmp.${Date.now()}`;
+		await fs.writeFile(tmp, JSON.stringify(this.document, null, 2), "utf8");
+		await fs.rename(tmp, this.filePath);
+	}
+};
+/**
+* Decide whether one account may serve one model right now.
+*
+* Pure on purpose: every number it reads is passed in, so the decision can be
+* tested without a pool, a clock or a network.
+*/
+function evaluateGuardrails(input) {
+	const { guardrails, tokensToday, modelTokensToday, remainingCredits } = input;
+	if (guardrails.reserveCredits > 0 && typeof remainingCredits === "number" && Number.isFinite(remainingCredits) && remainingCredits < guardrails.reserveCredits) return {
+		allowed: false,
+		reason: "reserve-credits",
+		detail: `${remainingCredits.toFixed(2)} credits left, below the reserved ${guardrails.reserveCredits}`
+	};
+	if (guardrails.dailyTokens > 0 && tokensToday >= guardrails.dailyTokens) return {
+		allowed: false,
+		reason: "daily-tokens",
+		detail: `${tokensToday} tokens today, at the ${guardrails.dailyTokens} daily cap`
+	};
+	if (guardrails.modelDailyTokens > 0 && modelTokensToday >= guardrails.modelDailyTokens) return {
+		allowed: false,
+		reason: "model-daily-tokens",
+		detail: `${modelTokensToday} tokens today on this model, at the ${guardrails.modelDailyTokens} cap`
+	};
+	return { allowed: true };
+}
+//#endregion
+//#region src/host/workbuddy/outbound-identity.ts
+/**
+* Outbound client identities this route can present.
+*
+* The subscription gateway gates on client identity, and it gates DIFFERENTLY
+* per surface: measured on this route, `CodeBuddyIDE` is rejected by
+* `/v3/config` with 400 `code 12403` ("check ua") and 401'd outright by the
+* international chat endpoint, which is why the CLI identity is what the line
+* ships and has always used.
+*
+* Two more identities exist on the same backend, and workbuddy2api-hub has
+* captured what the real clients send (their `wb_identity.py`, measured
+* 2026-10-16 with mitmproxy against the international desktop build 5.8.4):
+*
+*   desktop   `WorkBuddy/5.8.4 workbuddy-ai/5.8.4 CLI/2.161.0`
+*             + `X-IDE-Type/Name: WorkBuddy`, `X-IDE-Version`, `X-Agent-Intent: craft`
+*             + `X-Agent-Purpose: conversation`, `X-Agent-Type: main`, trace headers
+*   vscode    `VSCode/1.119.0 WorkBuddy/4.9.29177644`
+*             + `X-IDE-Type/Name: VSCode`, `X-IDE-Version`, `X-Product-Version`, `X-Env-ID`
+*   cli       `CLI/<v> CodeBuddy/<v>` + `X-IDE-Type/Name: CLI`
+*
+* `cli` is deliberately kept byte-identical to what this line sends today
+* (including the `CodeBuddyIDE` IDE name, which is what was actually measured
+* to work here) so the default cannot regress; the other two are opt-in
+* attempts.
+*
+* Quota is NOT per identity: the subscription meters an account × model over a
+* 24h window (429 `code 6004`), so switching identity cannot create allowance.
+* What it can do is give each account a stable, plausible client — the same
+* reason the gateway projects one device per account.
+*/
+/** Everything the settings card may offer, in display order. */
+const OUTBOUND_PRODUCTS = [
+	"cli",
+	"workbuddy",
+	"vscode"
+];
+/** Narrow a stored or patched value into a supported preference. */
+function normalizeOutboundSetting(value) {
+	if (value === "auto") return "auto";
+	return typeof value === "string" && OUTBOUND_PRODUCTS.includes(value) ? value : "cli";
+}
+/**
+* Which identity one account uses.
+*
+* `auto` assigns by hashing the account key, so an account keeps the same
+* client for its whole life — the one property that matters for a device
+* fingerprint — while a pool as a whole spreads over the available clients.
+*/
+function resolveOutboundProduct(setting, accountKey) {
+	if (setting !== "auto") return setting;
+	const pick = (createHash("sha256").update(accountKey).digest()[0] ?? 0) % OUTBOUND_PRODUCTS.length;
+	return OUTBOUND_PRODUCTS[pick];
+}
+const DESKTOP_VERSION_INTL = "5.8.4";
+const DESKTOP_VERSION_CN = "5.5.6";
+const DESKTOP_UA_INTL = `WorkBuddy/${DESKTOP_VERSION_INTL} workbuddy-ai/${DESKTOP_VERSION_INTL} CLI/2.161.0`;
+const DESKTOP_UA_CN = `WorkBuddy/${DESKTOP_VERSION_CN} WorkBuddy/${DESKTOP_VERSION_CN} CLI/2.137.1`;
+const VSCODE_IDE_VERSION = "1.119.0";
+const VSCODE_PRODUCT_VERSION = "4.9.29177644";
+const VSCODE_UA = `VSCode/${VSCODE_IDE_VERSION} WorkBuddy/${VSCODE_PRODUCT_VERSION}`;
+/**
+* The CLI identity this line has always presented.
+*
+* Kept as a literal rather than rebuilt, because it is the one string measured
+* to be accepted by chat, `/v3/config` and billing on both regions.
+*/
+const CLI_UA = "CLI/2.63.2 CodeBuddy/2.63.2";
+/**
+* A stable pseudo-device id for one account.
+*
+* Same derivation as the measured clients (`derive_id`: md5 of `salt:uid`
+* reshaped into a UUID), so the value is a well-formed v4-shaped machine id
+* that never changes for an account and never collides between accounts. A
+* per-PROCESS id would be worse than none here: it would present every account
+* in the pool as the same machine.
+*/
+function deriveMachineId(uid) {
+	const digest = createHash("md5").update(`machine:${uid.trim() === "" ? "anonymous" : uid}`).digest("hex");
+	const shaped = `${digest.slice(0, 12)}4${digest.slice(13, 16)}a${digest.slice(17)}`;
+	return [
+		shaped.slice(0, 8),
+		shaped.slice(8, 12),
+		shaped.slice(12, 16),
+		shaped.slice(16, 20),
+		shaped.slice(20, 32)
+	].join("-");
+}
+function hexId() {
+	return createHash("sha256").update(`${Date.now()}${Math.random()}`).digest("hex").slice(0, 32);
+}
+/** One conversation request's trace chain, as the desktop client emits it. */
+function traceHeaders() {
+	const trace = hexId();
+	const span = hexId().slice(0, 16);
+	return {
+		"X-Trace-ID": trace,
+		traceparent: `00-${trace}-${span}-01`,
+		b3: `${trace}-${span}-1`,
+		"X-B3-TraceId": trace,
+		"X-B3-SpanId": span,
+		"X-B3-Sampled": "1"
+	};
+}
+/** Resolve the identity block for one product on one region. */
+function outboundIdentity(product, region, uid) {
+	if (product === "workbuddy") {
+		const version = region === "cn" ? DESKTOP_VERSION_CN : DESKTOP_VERSION_INTL;
+		return {
+			product,
+			userAgent: region === "cn" ? DESKTOP_UA_CN : DESKTOP_UA_INTL,
+			headers: (conversation) => ({
+				"X-Agent-Intent": "craft",
+				"X-Agent-Purpose": "conversation",
+				"X-Agent-Type": "main",
+				"X-IDE-Name": "WorkBuddy",
+				"X-IDE-Type": "WorkBuddy",
+				"X-IDE-Version": version,
+				"X-Private-Data": "true",
+				"X-Machine-ID": deriveMachineId(uid),
+				...conversation["X-Conversation-Request-ID"] === void 0 ? {} : { "X-Root-Request-ID": conversation["X-Conversation-Request-ID"] },
+				...traceHeaders()
+			})
+		};
+	}
+	if (product === "vscode") return {
+		product,
+		userAgent: VSCODE_UA,
+		headers: (conversation) => ({
+			"X-Agent-Intent": "craft",
+			"X-IDE-Name": "VSCode",
+			"X-IDE-Type": "VSCode",
+			"X-IDE-Version": VSCODE_IDE_VERSION,
+			"X-Product-Version": VSCODE_PRODUCT_VERSION,
+			"X-Env-ID": "production",
+			"X-Machine-ID": deriveMachineId(uid),
+			...conversation["X-Conversation-Request-ID"] === void 0 ? {} : { "X-Root-Request-ID": conversation["X-Conversation-Request-ID"] }
+		})
+	};
+	return {
+		product: "cli",
+		userAgent: CLI_UA,
+		headers: () => ({})
+	};
+}
+/** Framing kinds and the code each carries in the AAD. */
+const FRAMING = {
+	file: {
+		magic: "WBEF1",
+		code: 1
+	},
+	field: {
+		magic: "WBEV1",
+		code: 2
+	}
+};
+/** Suite number this build speaks; the envelope may override it. */
+const DEFAULT_SUITE = 1;
+/** Hash scheme marker inside the AAD. */
+const SCHEME = "sym-v1";
+/** Every failure the at-rest path can report to a user. */
+var AtRestError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "AtRestError";
+	}
+};
+function lengthPrefixed(text) {
+	const raw = Buffer.from(text, "utf8");
+	const prefix = Buffer.alloc(4);
+	prefix.writeUInt32BE(raw.length, 0);
+	return Buffer.concat([prefix, raw]);
+}
+function uint32(value) {
+	const raw = Buffer.alloc(4);
+	raw.writeUInt32BE(value, 0);
+	return raw;
+}
+/** The GCM associated data, byte-identical to the client's. */
+function associatedData(keyId, suite, framing) {
+	const spec = FRAMING[framing];
+	return Buffer.concat([
+		Buffer.from("WB-AAD\0", "utf8"),
+		Buffer.from([1]),
+		lengthPrefixed(spec.magic),
+		lengthPrefixed(SCHEME),
+		uint32(suite),
+		lengthPrefixed(keyId),
+		Buffer.from([
+			spec.code,
+			0,
+			0
+		])
+	]);
+}
+/** `protectorKeyId` / `envelope.keyId`: the first 16 hex characters of sha256(key). */
+function deriveKeyId(key) {
+	return createHash("sha256").update(key).digest("hex").slice(0, 16);
+}
+/**
+* Whether a value is a sealed envelope rather than plaintext.
+*
+* Older clients sometimes stored the whole envelope as a JSON STRING in the
+* field, so that shape is recognised too.
+*/
+function isSealedValue(value) {
+	if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+		const record = value;
+		return typeof record.envelope === "string" && "$wbEncrypted" in record;
+	}
+	if (typeof value === "string") {
+		const trimmed = value.trimStart();
+		return trimmed.startsWith("{") && trimmed.slice(0, 64).includes("$wbEncrypted");
+	}
+	return false;
+}
+function base64(value, label) {
+	if (typeof value !== "string" || value === "") throw new AtRestError(`sealed envelope is missing ${label}`);
+	return Buffer.from(value, "base64");
+}
+/** Split one envelope into its GCM parts. */
+function parseEnvelope(value) {
+	const encoded = typeof value === "object" && value !== null ? value.envelope : value;
+	if (typeof encoded !== "string") throw new AtRestError("sealed envelope is not a string");
+	let parsed;
+	try {
+		parsed = JSON.parse(Buffer.from(encoded, "base64").toString("utf8"));
+	} catch (error) {
+		throw new AtRestError(`sealed envelope is not base64 JSON: ${error.message}`);
+	}
+	if (typeof parsed !== "object" || parsed === null) throw new AtRestError("sealed envelope is not an object");
+	const record = parsed;
+	return {
+		suite: typeof record.suite === "number" && Number.isFinite(record.suite) ? record.suite : DEFAULT_SUITE,
+		keyId: typeof record.keyId === "string" ? record.keyId : "",
+		nonce: base64(record.nonce, "nonce"),
+		authTag: base64(record.authTag, "authTag"),
+		ciphertext: base64(record.ciphertext, "ciphertext")
+	};
+}
+/** Open one envelope with the protector key, returning the plaintext bytes. */
+function openEnvelope(key, value, framing) {
+	const envelope = parseEnvelope(value);
+	const expected = deriveKeyId(key);
+	if (envelope.keyId !== "" && envelope.keyId !== expected) throw new AtRestError(`sealed value was written by a different key (envelope ${envelope.keyId}, this key ${expected})`);
+	const decipher = createDecipheriv("aes-256-gcm", key, envelope.nonce);
+	decipher.setAAD(associatedData(envelope.keyId || expected, envelope.suite, framing));
+	decipher.setAuthTag(envelope.authTag);
+	try {
+		return Buffer.concat([decipher.update(envelope.ciphertext), decipher.final()]);
+	} catch {
+		throw new AtRestError("sealed value could not be authenticated — the pasted key does not match this file");
+	}
+}
+/** Decrypt a field that may be sealed, leaving plaintext values untouched. */
+function openSealedField(key, value) {
+	if (value === null || value === void 0) return "";
+	if (typeof value === "string" && !isSealedValue(value)) return value;
+	if (typeof value !== "string" && !isSealedValue(value)) return "";
+	return openEnvelope(key, value, "field").toString("utf8");
+}
+const HEX_KEY = /^[0-9a-f]{64}$/i;
+const BASE64_SECRET = /^[A-Za-z0-9+/]{43}=$/;
+/**
+* Normalise a pasted secret into the 32-byte protector key.
+*
+* Two spellings are accepted, neither requiring the user to compute anything:
+* a 64-character hex protector key (used as-is), or the 44-character base64
+* `atRestSecretKey` the client carries in its payload — that one is hashed as
+* the STRING, which is what produces the protector key.
+*/
+function parseKeyText(text) {
+	let raw = text.trim();
+	if (raw.slice(0, 2).toLowerCase() === "0x") raw = raw.slice(2).trim();
+	if (HEX_KEY.test(raw)) return Buffer.from(raw, "hex");
+	if (BASE64_SECRET.test(raw)) return createHash("sha256").update(raw, "ascii").digest();
+	throw new AtRestError("unrecognised key format: paste the 64-character hex protector key or the 44-character base64 atRestSecretKey");
+}
+/** Directories the desktop client may keep its `keyblob` in. */
+function configDirCandidates() {
+	const override = process.env["WORKBUDDY_CONFIG_DIR"] ?? process.env["CODEBUDDY_CONFIG_DIR"];
+	if (override !== void 0 && override.trim() !== "") return [path.resolve(override.trim())];
+	const home = os.homedir();
+	return [
+		"CodeBuddy",
+		"WorkBuddy",
+		".workbuddy-ai",
+		".codebuddy"
+	].map((name) => path.join(home, name));
+}
+/** Path of the client's keyblob, or null when the client is not installed here. */
+function keyBlobPath() {
+	for (const dir of configDirCandidates()) {
+		const candidate = path.join(dir, "keyblob");
+		if (existsSync(candidate)) return candidate;
+	}
+	return null;
+}
+async function loadKeyBlob() {
+	const file = keyBlobPath();
+	if (file === null) return null;
+	try {
+		const parsed = JSON.parse(await readFile(file, "utf8"));
+		return typeof parsed === "object" && parsed !== null ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Validate a protector key against the client's own keyblob.
+*
+* This is the check that turns a typo into an error instead of a mystery: the
+* key must match the `static-v1` slot's `protectorKeyId` and must unwrap a
+* 32-byte master whose derived id matches the blob's own `keyId`. Returns
+* `false` when there is no keyblob to check against (the desktop client is not
+* installed on this machine) — absence of evidence, not evidence of a bad key.
+*/
+async function verifyKeyAgainstKeyBlob(key) {
+	const blob = await loadKeyBlob();
+	if (blob === null) return false;
+	const slots = Array.isArray(blob.slots) ? blob.slots : [];
+	const expected = deriveKeyId(key);
+	for (const slot of slots) {
+		if (slot.type !== "static-v1" || slot.wrapped === void 0) continue;
+		if ((typeof slot.protectorKeyId === "string" ? slot.protectorKeyId.toLowerCase() : "") !== expected) throw new AtRestError("this key does not match the desktop client keyblob (protectorKeyId differs)");
+		const master = openEnvelope(key, slot.wrapped, "file");
+		if (master.length !== 32 || deriveKeyId(master) !== String(blob.keyId ?? "")) throw new AtRestError("the keyblob did not unwrap to a valid master key");
+		return true;
+	}
+	throw new AtRestError("the desktop client keyblob has no usable static-v1 slot");
+}
+let activeKey = null;
+/** Install the protector key for this process (already persisted by the caller). */
+function setActiveAtRestKey(key) {
+	activeKey = key;
+}
+/** The protector key this process holds, if any. */
+function activeAtRestKey() {
+	return activeKey;
+}
+/** Whether sealed credentials can be opened right now. */
+function hasAtRestKey() {
+	return activeKey !== null;
+}
+//#endregion
 //#region src/host/workbuddy/token-store.ts
 const WORKBUDDY_PREFERENCES_NAMESPACE = "dsh-workbuddy";
 /** Runtime membership test for one stored effort value. */
@@ -34005,7 +34582,9 @@ function registerWorkBuddyPreferenceStore(settings, fallbackStore = new FileMode
 			defaultReasoningEffort: null,
 			selectedAccountId: null,
 			hiddenAccountIds: [],
-			checkin: { ...DEFAULT_CHECKIN_SETTINGS }
+			checkin: { ...DEFAULT_CHECKIN_SETTINGS },
+			outboundIdentity: "cli",
+			guardrails: { ...DEFAULT_GUARDRAILS }
 		};
 		const warmed = fallbackStore.read().then((stored) => {
 			snapshot = stored;
@@ -34026,7 +34605,18 @@ function registerWorkBuddyPreferenceStore(settings, fallbackStore = new FileMode
 		defaultReasoningEffort: z.union([...WORKBUDDY_REASONING_EFFORTS.map((effort) => z.const(effort)), z.const(null)]).default(null),
 		selectedAccountId: z.union([z.string(), z.const(null)]).default(null),
 		hiddenAccountIds: z.array(z.string()).default([]),
-		checkin: z.object({ enabled: z.boolean().default(true) }).default({ enabled: true })
+		checkin: z.object({ enabled: z.boolean().default(true) }).default({ enabled: true }),
+		outboundIdentity: z.union([
+			z.const("auto"),
+			z.const("cli"),
+			z.const("workbuddy"),
+			z.const("vscode")
+		]).default("cli"),
+		guardrails: z.object({
+			reserveCredits: z.number().min(0).default(0),
+			dailyTokens: z.number().min(0).default(0),
+			modelDailyTokens: z.number().min(0).default(0)
+		}).default({ ...DEFAULT_GUARDRAILS })
 	}));
 	return {
 		ready: async () => void 0,
@@ -34039,7 +34629,9 @@ function registerWorkBuddyPreferenceStore(settings, fallbackStore = new FileMode
 				defaultReasoningEffort: value.defaultReasoningEffort,
 				selectedAccountId: value.selectedAccountId,
 				hiddenAccountIds: value.hiddenAccountIds,
-				checkin: normalizeCheckinSettings(value.checkin)
+				checkin: normalizeCheckinSettings(value.checkin),
+				outboundIdentity: normalizeOutboundSetting(value.outboundIdentity),
+				guardrails: normalizeGuardrails(value.guardrails)
 			};
 		},
 		update: async (patch) => {
@@ -34054,7 +34646,12 @@ function registerWorkBuddyPreferenceStore(settings, fallbackStore = new FileMode
 				checkin: patch.checkin !== void 0 ? normalizeCheckinSettings({
 					...normalizeCheckinSettings(current.checkin),
 					...patch.checkin
-				}) : normalizeCheckinSettings(current.checkin)
+				}) : normalizeCheckinSettings(current.checkin),
+				outboundIdentity: patch.outboundIdentity !== void 0 ? normalizeOutboundSetting(patch.outboundIdentity) : normalizeOutboundSetting(current.outboundIdentity),
+				guardrails: patch.guardrails !== void 0 ? normalizeGuardrails({
+					...normalizeGuardrails(current.guardrails),
+					...patch.guardrails
+				}) : normalizeGuardrails(current.guardrails)
 			};
 			await scope.update(normalized);
 			fallbackStore.updateSettings(patch).catch(() => void 0);
@@ -34089,6 +34686,85 @@ function modelSettingsPath$7() {
 function managedCredentialsPath() {
 	return path.join(dshHomeDir(), "storages", "workbuddy-accounts.json");
 }
+/** Platform-encrypted storage for the pasted at-rest key (never plaintext on disk). */
+function atRestKeyPath() {
+	return path.join(dshHomeDir(), "storages", "workbuddy-atrest-key.json");
+}
+function createAtRestKeyBackend(filePath) {
+	const parse = (value) => {
+		const record = isRecord$23(value) ? value : {};
+		return {
+			version: 1,
+			keyHex: typeof record.keyHex === "string" ? record.keyHex : ""
+		};
+	};
+	if (process.platform === "win32") return new WindowsDpapiCredentialStore(`${filePath}.dpapi`, parse);
+	if (process.platform === "darwin") return new MacKeychainCredentialStore("dsh-workbuddy-atrest", managedCredentialAccount(filePath), parse);
+	if (process.platform === "linux") return new SecretServiceCredentialStore("dsh-workbuddy-atrest", managedCredentialAccount(filePath), parse);
+	throw new Error("WorkBuddy encrypted key storage requires Windows, macOS, or Linux.");
+}
+/**
+* Storage for the `$wbEncrypted` protector key.
+*
+* The key is the one secret that unlocks the desktop client's tokens, so it goes
+* through the same platform store the managed pool uses (DPAPI / Keychain /
+* Secret Service) and is installed into the process only after the client's own
+* keyblob accepts it. A pasted value that fails that check never displaces a
+* working key.
+*/
+var WorkBuddyAtRestKeyStore = class {
+	filePath;
+	backend;
+	cached = null;
+	constructor(filePath = atRestKeyPath(), backend = createAtRestKeyBackend(filePath)) {
+		this.filePath = filePath;
+		this.backend = backend;
+	}
+	/** Human-readable storage description, mirroring the managed pool's. */
+	path() {
+		if (process.platform === "win32") return `${this.filePath}.dpapi`;
+		return `${process.platform === "darwin" ? "Keychain" : "Secret Service"}: dsh-workbuddy-atrest/${managedCredentialAccount(this.filePath)}`;
+	}
+	/**
+	* Load the stored key into the process.
+	*
+	* Called once at startup: the credential readers consult the module-level
+	* slot, so a key that is only on disk would otherwise leave every sealed
+	* account unreadable until something else triggered a load.
+	*/
+	async load() {
+		if (this.cached !== null) {
+			setActiveAtRestKey(this.cached);
+			return this.cached;
+		}
+		const hex = (await this.backend.load().catch(() => null))?.keyHex ?? "";
+		if (!/^[0-9a-f]{64}$/i.test(hex)) {
+			setActiveAtRestKey(null);
+			return null;
+		}
+		this.cached = Buffer.from(hex, "hex");
+		setActiveAtRestKey(this.cached);
+		return this.cached;
+	}
+	/** Validate and persist a pasted secret; returns the key id for display. */
+	async adopt(text) {
+		const key = parseKeyText(text);
+		await verifyKeyAgainstKeyBlob(key);
+		await this.backend.save({
+			version: 1,
+			keyHex: key.toString("hex")
+		});
+		this.cached = key;
+		setActiveAtRestKey(key);
+		return deriveKeyId(key);
+	}
+	/** Forget the key, both on disk and in this process. */
+	async clear() {
+		this.cached = null;
+		setActiveAtRestKey(null);
+		await this.backend.clear().catch(() => void 0);
+	}
+};
 function isRecord$23(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -34110,15 +34786,24 @@ function parseCredentialFile(value, sourceFile, sourceMtimeMs = 0) {
 	if (!isRecord$23(value)) throw new Error("WorkBuddy credential file is not an object");
 	const auth = isRecord$23(value.auth) ? value.auth : void 0;
 	if (auth === void 0) throw new Error("WorkBuddy credential file has no auth block");
-	const accessToken = readString$2(auth, "accessToken");
-	if (accessToken === void 0) throw new Error("WorkBuddy credential file has no access token");
+	const rawAccess = auth.accessToken;
+	const sealedAccess = isSealedValue(rawAccess) ? rawAccess : void 0;
+	const plainAccess = sealedAccess === void 0 ? readString$2(auth, "accessToken") : void 0;
+	if (sealedAccess === void 0 && plainAccess === void 0) throw new Error("WorkBuddy credential file has no access token");
+	const accessToken = plainAccess ?? "";
+	const rawRefresh = auth.refreshToken;
+	const sealedRefresh = isSealedValue(rawRefresh) ? rawRefresh : void 0;
 	const account = isRecord$23(value.account) ? value.account : {};
 	const domain = readString$2(auth, "domain") ?? "www.codebuddy.cn";
 	const expiresAtRaw = auth.expiresAt;
 	const expiresAt = typeof expiresAtRaw === "number" && Number.isFinite(expiresAtRaw) ? expiresAtRaw : 0;
 	return withResolvedIdentity({
 		accessToken,
-		refreshToken: readString$2(auth, "refreshToken") ?? "",
+		refreshToken: sealedRefresh === void 0 ? readString$2(auth, "refreshToken") ?? "" : "",
+		...sealedAccess === void 0 && sealedRefresh === void 0 ? {} : { sealed: {
+			...sealedAccess === void 0 ? {} : { accessToken: sealedAccess },
+			...sealedRefresh === void 0 ? {} : { refreshToken: sealedRefresh }
+		} },
 		expiresAt,
 		region: regionForDomain(domain),
 		domain,
@@ -34208,16 +34893,56 @@ function parseManagedCredentials(value) {
 		});
 	});
 }
+let sealedDiagnostics = {
+	sealedFiles: 0,
+	opened: 0,
+	missingKey: false,
+	lastError: null
+};
+/** Snapshot of the last scan's sealed-credential observations. */
+function sealedCredentialDiagnostics() {
+	return { ...sealedDiagnostics };
+}
+/** Start a fresh scan window; the settings card reads what the last scan left. */
+function resetSealedDiagnostics() {
+	sealedDiagnostics = {
+		sealedFiles: 0,
+		opened: 0,
+		missingKey: false,
+		lastError: null
+	};
+}
 /**
-* Candidate ordering for the scanned credential files.
+* Resolve a credential's sealed tokens into usable plaintext.
 *
-* A user's auth directory accumulates timestamped snapshots beside the live
-* file, and the live one is not always the newest. Preference order is: the
-* plain `workbuddy-desktop.info` / `codebuddy-desktop.info` files first, then
-* the newest `expiresAt` among the timestamped snapshots. Picking purely by
-* mtime selected a stale snapshot during development, so the token's own
-* expiry is what decides.
+* Returns `null` when the credential is sealed and this process holds no key
+* that opens it: such a file is not an error the caller can act on per-file, it
+* is a missing key the settings card reports once.
 */
+function unsealCredentials(credentials) {
+	if (credentials.sealed === void 0) return credentials;
+	sealedDiagnostics.sealedFiles += 1;
+	const key = activeAtRestKey();
+	if (key === null) {
+		sealedDiagnostics.missingKey = true;
+		return null;
+	}
+	try {
+		const accessToken = openSealedField(key, credentials.sealed.accessToken);
+		if (accessToken === "") throw new AtRestError("sealed access token opened to an empty string");
+		const refreshToken = credentials.sealed.refreshToken === void 0 ? credentials.refreshToken : openSealedField(key, credentials.sealed.refreshToken);
+		sealedDiagnostics.opened += 1;
+		return withResolvedIdentity({
+			...credentials,
+			accessToken,
+			refreshToken,
+			sealed: void 0
+		});
+	} catch (error) {
+		sealedDiagnostics.lastError = error instanceof Error ? error.message : String(error);
+		return null;
+	}
+}
 function isCanonicalFile(name) {
 	return /^(workbuddy|codebuddy)-desktop(-\w+)?\.info$/i.test(name);
 }
@@ -34236,6 +34961,7 @@ async function scanCredentials(dir = codeBuddyAuthDir()) {
 		if (error.code === "ENOENT") return [];
 		throw new Error(`WorkBuddy credential directory could not be read: ${dir}`);
 	}
+	resetSealedDiagnostics();
 	const found = [];
 	for (const name of names) {
 		if (!name.endsWith(".info")) continue;
@@ -34244,7 +34970,8 @@ async function scanCredentials(dir = codeBuddyAuthDir()) {
 			const stats = await fs.stat(file);
 			if (!stats.isFile()) continue;
 			const raw = await fs.readFile(file, "utf8");
-			found.push(parseCredentialFile(JSON.parse(raw), file, stats.mtimeMs));
+			const unsealed = unsealCredentials(parseCredentialFile(JSON.parse(raw), file, stats.mtimeMs));
+			if (unsealed !== null) found.push(unsealed);
 		} catch {
 			continue;
 		}
@@ -34423,7 +35150,7 @@ var FileCredentialStore$4 = class {
 			const stats = await fs.stat(filePath);
 			if (!stats.isFile()) return null;
 			const raw = await fs.readFile(filePath, "utf8");
-			return parseCredentialFile(JSON.parse(raw), filePath, stats.mtimeMs);
+			return unsealCredentials(parseCredentialFile(JSON.parse(raw), filePath, stats.mtimeMs));
 		} catch {
 			return null;
 		}
@@ -34527,7 +35254,9 @@ var FileModelSettingsStore$4 = class {
 					defaultReasoningEffort,
 					selectedAccountId: typeof parsed.selectedAccountId === "string" && parsed.selectedAccountId !== "" ? parsed.selectedAccountId : null,
 					hiddenAccountIds: Array.isArray(parsed.hiddenAccountIds) ? parsed.hiddenAccountIds.filter((id) => typeof id === "string") : [],
-					checkin: normalizeCheckinSettings(parsed.checkin)
+					checkin: normalizeCheckinSettings(parsed.checkin),
+					outboundIdentity: normalizeOutboundSetting(parsed.outboundIdentity),
+					guardrails: normalizeGuardrails(parsed.guardrails)
 				};
 			}
 		} catch {}
@@ -34538,7 +35267,9 @@ var FileModelSettingsStore$4 = class {
 			defaultReasoningEffort: null,
 			selectedAccountId: null,
 			hiddenAccountIds: [],
-			checkin: { ...DEFAULT_CHECKIN_SETTINGS }
+			checkin: { ...DEFAULT_CHECKIN_SETTINGS },
+			outboundIdentity: "cli",
+			guardrails: { ...DEFAULT_GUARDRAILS }
 		};
 	}
 	async write(settings) {
@@ -34560,6 +35291,11 @@ var FileModelSettingsStore$4 = class {
 			...patch.checkin !== void 0 ? { checkin: normalizeCheckinSettings({
 				...current.checkin,
 				...patch.checkin
+			}) } : {},
+			...patch.outboundIdentity !== void 0 ? { outboundIdentity: normalizeOutboundSetting(patch.outboundIdentity) } : {},
+			...patch.guardrails !== void 0 ? { guardrails: normalizeGuardrails({
+				...normalizeGuardrails(current.guardrails),
+				...patch.guardrails
 			}) } : {}
 		};
 		await this.write(next);
@@ -34638,6 +35374,8 @@ function conversationHeaders(sessionId) {
 function workBuddyHeaders(credentials, extra = {}, channel) {
 	const domain = credentials.domain || "www.codebuddy.cn";
 	const intl = isIntlDomain(domain);
+	const conversation = intl && channel !== void 0 ? conversationHeaders(channel.sessionId) : {};
+	const identity = outboundIdentity(channel?.product ?? "cli", intl ? "intl" : "cn", credentials.uid ?? "");
 	return {
 		"content-type": "application/json",
 		accept: "application/json",
@@ -34649,12 +35387,13 @@ function workBuddyHeaders(credentials, extra = {}, channel) {
 		[HEADER_PRODUCT]: CLIENT_PRODUCT,
 		[HEADER_IDE_NAME]: "CodeBuddyIDE",
 		[HEADER_REQUESTED_WITH]: "XMLHttpRequest",
-		"user-agent": CLIENT_USER_AGENT,
+		"user-agent": identity.userAgent,
 		...intl ? {
 			origin: credentials.backend,
 			referer: `${credentials.backend}/`
 		} : {},
-		...intl && channel !== void 0 ? conversationHeaders(channel.sessionId) : {},
+		...conversation,
+		...identity.headers(conversation),
 		...extra
 	};
 }
@@ -35158,7 +35897,7 @@ function resetWebLogin() {
 function isRecord$21(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function stringOf(record, key) {
+function stringOf$1(record, key) {
 	const value = record[key];
 	if (typeof value === "string" && value.trim() !== "") return value.trim();
 	if (typeof value === "number" && Number.isFinite(value)) return String(value);
@@ -35207,9 +35946,9 @@ async function requestLoginState(region, fetchFn = fetch, signal) {
 	} catch {
 		root = void 0;
 	}
-	if (!response.ok || root?.code !== 0 || !isRecord$21(root.data)) throw new Error(`${PROVIDER_NAME$3} 登录初始化失败（HTTP ${response.status}）：${stringOf(root ?? {}, "msg") ?? text.slice(0, 160)}`);
-	const state = stringOf(root.data, "state");
-	const authUrl = stringOf(root.data, "authUrl");
+	if (!response.ok || root?.code !== 0 || !isRecord$21(root.data)) throw new Error(`${PROVIDER_NAME$3} 登录初始化失败（HTTP ${response.status}）：${stringOf$1(root ?? {}, "msg") ?? text.slice(0, 160)}`);
+	const state = stringOf$1(root.data, "state");
+	const authUrl = stringOf$1(root.data, "authUrl");
 	if (!state || !authUrl) throw new Error(`${PROVIDER_NAME$3} 登录响应缺少 state 或 authUrl`);
 	return {
 		state,
@@ -35223,27 +35962,27 @@ function parseLoginCredential(payload, attempt) {
 	if (!isRecord$21(payload)) throw new Error(`${PROVIDER_NAME$3} 登录轮询响应无效`);
 	const code = numberOf(payload, "code");
 	if (code === 11217) return null;
-	if (code !== 0) throw new Error(`${PROVIDER_NAME$3} 登录失败：${stringOf(payload, "msg") ?? `code ${String(code)}`}`);
+	if (code !== 0) throw new Error(`${PROVIDER_NAME$3} 登录失败：${stringOf$1(payload, "msg") ?? `code ${String(code)}`}`);
 	const data = isRecord$21(payload.data) ? payload.data : payload;
 	const auth = isRecord$21(data.auth) ? data.auth : data;
 	const account = isRecord$21(data.account) ? data.account : isRecord$21(auth.account) ? auth.account : isRecord$21(data.user) ? data.user : isRecord$21(auth.user) ? auth.user : {};
-	const accessToken = stringOf(auth, "accessToken") ?? stringOf(auth, "access_token") ?? stringOf(data, "token");
+	const accessToken = stringOf$1(auth, "accessToken") ?? stringOf$1(auth, "access_token") ?? stringOf$1(data, "token");
 	if (!accessToken) throw new Error(`${PROVIDER_NAME$3} 登录成功响应缺少 access token`);
-	const domain = stringOf(auth, "domain") ?? attempt.domain;
+	const domain = stringOf$1(auth, "domain") ?? attempt.domain;
 	const expiresIn = numberOf(auth, "expiresIn") ?? numberOf(auth, "expires_in");
 	const expiresAt = numberOf(auth, "expiresAt") ?? numberOf(auth, "expires_at") ?? (expiresIn === void 0 ? Date.now() + 3600 * 1e3 : Date.now() + expiresIn * 1e3);
 	return {
 		accessToken,
-		refreshToken: stringOf(auth, "refreshToken") ?? stringOf(auth, "refresh_token") ?? stringOf(data, "refreshToken") ?? stringOf(data, "refresh_token") ?? "",
+		refreshToken: stringOf$1(auth, "refreshToken") ?? stringOf$1(auth, "refresh_token") ?? stringOf$1(data, "refreshToken") ?? stringOf$1(data, "refresh_token") ?? "",
 		expiresAt,
 		region: regionForDomain(domain),
 		domain,
 		backend: backendForDomain(domain),
-		uid: stringOf(account, "uid") ?? stringOf(data, "uid"),
-		nickname: stringOf(account, "nickname") ?? stringOf(account, "name") ?? stringOf(data, "nickname"),
-		uin: stringOf(account, "uin") ?? stringOf(data, "uin"),
-		accountType: stringOf(account, "type") ?? stringOf(data, "accountType"),
-		enterpriseId: stringOf(account, "enterpriseId") ?? stringOf(data, "enterpriseId"),
+		uid: stringOf$1(account, "uid") ?? stringOf$1(data, "uid"),
+		nickname: stringOf$1(account, "nickname") ?? stringOf$1(account, "name") ?? stringOf$1(data, "nickname"),
+		uin: stringOf$1(account, "uin") ?? stringOf$1(data, "uin"),
+		accountType: stringOf$1(account, "type") ?? stringOf$1(data, "accountType"),
+		enterpriseId: stringOf$1(account, "enterpriseId") ?? stringOf$1(data, "enterpriseId"),
 		sourceFile: "",
 		sourceMtimeMs: 0,
 		source: "managed"
@@ -35452,6 +36191,7 @@ async function getWorkBuddyWebStatus(store, modelSettings, preferences, options
 		accountId: settings.selectedAccountId,
 		hiddenAccountIds: settings.hiddenAccountIds
 	});
+	const sealedDiagnostics = sealedCredentialDiagnostics();
 	const enabled = settings.enabled !== false;
 	const fetchFn = options.fetchFn ?? fetch;
 	const live = credentials === null ? [] : await loadConfigCatalog(credentials, { fetchFn }).catch(() => []);
@@ -35491,7 +36231,12 @@ async function getWorkBuddyWebStatus(store, modelSettings, preferences, options
 		})),
 		activeAccountId: poolData?.activeAccountId,
 		rotationStrategy: poolData?.rotationStrategy ?? "sequential",
-		checkin
+		checkin,
+		outboundIdentity: normalizeOutboundSetting(settings.outboundIdentity),
+		guardrails: normalizeGuardrails(settings.guardrails),
+		atRestKeySet: hasAtRestKey(),
+		sealedAccounts: sealedDiagnostics.sealedFiles,
+		sealedAccountsError: sealedDiagnostics.missingKey ? "The CodeBuddy desktop client seals its tokens; paste its at-rest key to read them." : sealedDiagnostics.lastError
 	};
 }
 /** Register the WorkBuddy settings routes under `/workbuddy/api`. */
@@ -35507,6 +36252,7 @@ function registerWorkBuddyRoutes(ctx, store, modelSettings, preferences, options
 			try {
 				if (path === "" || path === "status") {
 					if (method !== "GET") return sendMethodNotAllowed$3(response);
+					await options.atRestKey?.load().catch(() => null);
 					const settings = preferences ? preferences.status() : await modelSettings.read();
 					await store.read({
 						force: true,
@@ -35808,6 +36554,32 @@ function registerWorkBuddyRoutes(ctx, store, modelSettings, preferences, options
 						const raw = body.checkin;
 						if (typeof raw.enabled === "boolean") patch.checkin = { enabled: raw.enabled };
 					}
+					if (typeof body.guardrails === "object" && body.guardrails !== null) {
+						const raw = body.guardrails;
+						const guardrails = {};
+						for (const field of [
+							"reserveCredits",
+							"dailyTokens",
+							"modelDailyTokens"
+						]) {
+							const value = raw[field];
+							if (value === void 0) continue;
+							if (typeof value !== "number" || !Number.isFinite(value) || value < 0) return sendJson$3(response, 400, {
+								ok: false,
+								error: `${field} must be a non-negative number.`
+							});
+							guardrails[field] = Math.floor(value);
+						}
+						patch.guardrails = guardrails;
+					}
+					if (body.outboundIdentity !== void 0) {
+						const requested = normalizeOutboundSetting(body.outboundIdentity);
+						if (requested !== body.outboundIdentity) return sendJson$3(response, 400, {
+							ok: false,
+							error: "Unsupported outbound identity."
+						});
+						patch.outboundIdentity = requested;
+					}
 					if (body.selectedAccountId !== void 0) {
 						const selected = body.selectedAccountId;
 						if (selected === null || typeof selected === "string") {
@@ -35860,6 +36632,53 @@ function registerWorkBuddyRoutes(ctx, store, modelSettings, preferences, options
 						value: await getWorkBuddyWebStatus(store, modelSettings, preferences, options)
 					});
 				}
+				if (path === "at-rest-key") {
+					if (!isSameOriginMutation(request)) return sendJson$3(response, 403, {
+						ok: false,
+						error: "Cross-origin request rejected."
+					});
+					const keyStore = options.atRestKey;
+					if (keyStore === void 0) return sendJson$3(response, 400, {
+						ok: false,
+						error: "At-rest key storage is not installed."
+					});
+					if (method === "DELETE") {
+						await keyStore.clear();
+						store.invalidate();
+						clearCachedQuota$5();
+						clearCachedCatalog$1();
+						return sendJson$3(response, 200, {
+							ok: true,
+							value: await getWorkBuddyWebStatus(store, modelSettings, preferences, options)
+						});
+					}
+					if (method !== "POST") return sendMethodNotAllowed$3(response);
+					const body = await readRequestJson$3(request);
+					const secret = typeof body.key === "string" ? body.key : "";
+					if (secret.trim() === "") return sendJson$3(response, 400, {
+						ok: false,
+						error: "A key is required."
+					});
+					let keyId;
+					try {
+						keyId = await keyStore.adopt(secret);
+					} catch (error) {
+						return sendJson$3(response, 400, {
+							ok: false,
+							error: error instanceof Error ? error.message : String(error)
+						});
+					}
+					store.invalidate();
+					clearCachedQuota$5();
+					clearCachedCatalog$1();
+					return sendJson$3(response, 200, {
+						ok: true,
+						value: {
+							...await getWorkBuddyWebStatus(store, modelSettings, preferences, options),
+							atRestKeyId: keyId
+						}
+					});
+				}
 				if (path === "accounts/strategy") {
 					if (method !== "POST") return sendMethodNotAllowed$3(response);
 					if (!isSameOriginMutation(request)) return sendJson$3(response, 403, {
@@ -35937,6 +36756,234 @@ function registerWorkBuddyRoutes(ctx, store, modelSettings, preferences, options
 	};
 }
 //#endregion
+//#region src/host/workbuddy/dsml.ts
+/**
+* Recovery of tool calls the model PRINTED instead of emitting structurally.
+*
+* Measured upstream behaviour (and the reason workbuddy2api-hub has the same
+* recovery, `wb_proxy.py` "Printed tool calls on the Chat Completions path"):
+* a tools request sometimes answers with the call spelled out inside `content`
+* — either the full-width DSML form
+*
+*     <||DSML|| calls><||DSML|| invoke name="run_code">
+*       <||DSML|| parameter name="code">print(1)</||DSML|| parameter>
+*     </||DSML|| invoke></||DSML|| calls>
+*
+* or a hybrid the model mixes on its own: a plain opening tag closed by DSML
+* tags, with the first parameter's close tag swallowed. Forwarded verbatim the
+* client sees prose, finds no call, and the turn simply ends — reported by
+* users as "it keeps stopping by itself".
+*
+* A structured `tool_calls` delta always wins; this only runs for text, which
+* is why the recovery is a pure function over the accumulated content.
+*/
+const TAG_START = "<[^>]*DSML[^>]*";
+const CALLS_RE = new RegExp(`${TAG_START}calls>(.*?)</[^>]*DSML[^>]*calls>`, "s");
+const INVOKE_RE = new RegExp(`${TAG_START}invoke\\s+name=["']([^"']+)["']>(.*?)</[^>]*invoke>`, "s");
+const DSML_PARAM_RE = new RegExp(`${TAG_START}parameter\\s+name=["']([^"']+)["'][^>]*>(.*?)</[^>]*parameter>`, "s");
+const PARAM_TAGS = "parameter|param|arg|argument";
+const LEAK_PARAM_RE = new RegExp(`<\\s*(?:\\|\\s*DSML\\s*\\|\\s*)?(${PARAM_TAGS})\\b([^>]*)>(.*?)</\\s*(?:\\|\\s*DSML\\s*\\|\\s*)?(?:parameter|param|arg|argument)\\s*>`, "gis");
+const LEAK_TAG_RE = /<\s*\/?\s*(?:\|\s*DSML\s*\|\s*)?([A-Za-z_][A-Za-z0-9_]*)([^>]*)>/g;
+const LEAK_NAME_ATTR_RE = /name\s*=\s*["']([^"']*)["']/;
+const WRAPPER_TAGS = /* @__PURE__ */ new Set([
+	"calls",
+	"tool_calls",
+	"function_calls",
+	"function_call"
+]);
+/** Fold the full-width spelling of the DSML token back to ASCII bars. */
+function normalizeDsmlBars(text) {
+	return text.replace(/\uff5c+\s*DSML\s*\uff5c+/g, "|DSML|");
+}
+function callId() {
+	return `call_${randomUUID().replace(/-/g, "").slice(0, 24)}`;
+}
+function argumentsOf(params) {
+	return JSON.stringify(params);
+}
+function stripSpans(text, spans) {
+	if (spans.length === 0) return text;
+	const sorted = [...spans].sort((a, b) => a[0] - b[0]);
+	const kept = [];
+	let last = 0;
+	for (const [start, end] of sorted) {
+		if (start < last) continue;
+		kept.push(text.slice(last, start));
+		last = end;
+	}
+	kept.push(text.slice(last));
+	return kept.join("").trim();
+}
+/** Recover the full-width `<||DSML|| …>` spelling. */
+function parseDsmlToolCalls(text) {
+	if (text === "" || !text.includes("DSML")) return null;
+	const block = CALLS_RE.exec(text);
+	if (block === null) return null;
+	const callsBlock = block[1] ?? "";
+	const calls = [];
+	for (const invoke of callsBlock.matchAll(new RegExp(INVOKE_RE.source, "gs"))) {
+		const params = {};
+		for (const param of (invoke[2] ?? "").matchAll(new RegExp(DSML_PARAM_RE.source, "gs"))) params[param[1] ?? ""] = (param[2] ?? "").trim();
+		calls.push({
+			id: callId(),
+			name: invoke[1] ?? "",
+			arguments: argumentsOf(params)
+		});
+	}
+	if (calls.length === 0) return null;
+	return {
+		calls,
+		clean: `${text.slice(0, block.index).trim()} ${text.slice(block.index + block[0].length).trim()}`.trim()
+	};
+}
+/**
+* Recover the hybrid spelling, driven by the `<parameter>` elements.
+*
+* Parameter elements are spelled the same way in both shapes and a parameter
+* name is the one thing a call cannot do without, so they are the anchor; the
+* nearest preceding opening tag that is neither a wrapper nor a parameter names
+* the tool.
+*/
+function parseLeakedToolCalls(text) {
+	if (text === "" || !text.includes("<")) return null;
+	const normalized = normalizeDsmlBars(text);
+	const params = [];
+	for (const match of normalized.matchAll(LEAK_PARAM_RE)) {
+		const attrs = match[2] ?? "";
+		const name = LEAK_NAME_ATTR_RE.exec(attrs)?.[1] ?? "";
+		if (name === "" || match.index === void 0) continue;
+		params.push({
+			start: match.index,
+			name,
+			value: (match[3] ?? "").trim(),
+			end: match.index + match[0].length
+		});
+	}
+	if (params.length === 0) return null;
+	const tags = [];
+	for (const match of normalized.matchAll(LEAK_TAG_RE)) {
+		if (match.index === void 0) continue;
+		tags.push({
+			start: match.index,
+			end: match.index + match[0].length,
+			name: (match[1] ?? "").toLowerCase(),
+			closing: match[0].trimStart().startsWith("</"),
+			attrs: match[2] ?? ""
+		});
+	}
+	const groups = [];
+	for (const site of params) {
+		let owner = null;
+		for (const tag of tags) {
+			if (tag.start >= site.start) break;
+			if (tag.closing) continue;
+			if (WRAPPER_TAGS.has(tag.name)) continue;
+			if (new RegExp(`^(${PARAM_TAGS})$`, "i").test(tag.name)) continue;
+			owner = tag;
+		}
+		const nameAttr = owner === null ? null : LEAK_NAME_ATTR_RE.exec(owner.attrs);
+		if ((owner === null ? "" : (nameAttr?.[1] ?? owner.name).trim()) === "") continue;
+		const last = groups[groups.length - 1];
+		if (last !== void 0 && owner !== null && last.owner !== null && last.owner.start === owner.start) {
+			last.params[site.name] = site.value;
+			last.spans.push([site.start, site.end]);
+		} else groups.push({
+			owner,
+			params: { [site.name]: site.value },
+			spans: [[site.start, site.end]]
+		});
+	}
+	if (groups.length === 0) return null;
+	const regions = [];
+	const calls = [];
+	for (const group of groups) {
+		const first = group.owner?.start ?? Math.min(...group.spans.map((span) => span[0]));
+		let last = Math.max(...group.spans.map((span) => span[1]));
+		for (;;) {
+			let next = last;
+			while (next < normalized.length && " 	\r\n".includes(normalized[next] ?? "")) next += 1;
+			const tag = /^<\s*\/\s*(?:\|\s*DSML\s*\|\s*)?[A-Za-z_][A-Za-z0-9_]*[^>]*>/i.exec(normalized.slice(next));
+			if (tag === null) break;
+			last = next + tag[0].length;
+		}
+		regions.push([first, last]);
+		calls.push({
+			id: callId(),
+			name: (group.owner === null ? "" : LEAK_NAME_ATTR_RE.exec(group.owner.attrs)?.[1] ?? group.owner.name).trim(),
+			arguments: argumentsOf(group.params)
+		});
+	}
+	if (calls.length === 0) return null;
+	let clean = stripSpans(normalized, regions);
+	const leftover = [];
+	for (const match of clean.matchAll(LEAK_TAG_RE)) {
+		if (match.index === void 0) continue;
+		const tagText = normalizeDsmlBars(match[0]).toUpperCase();
+		const name = (match[1] ?? "").toLowerCase();
+		if (tagText.includes("DSML") || WRAPPER_TAGS.has(name)) leftover.push([match.index, match.index + match[0].length]);
+	}
+	clean = stripSpans(clean, leftover);
+	return {
+		calls,
+		clean
+	};
+}
+/** Recover a printed call under either spelling. */
+function recoverPrintedToolCalls(text) {
+	return parseLeakedToolCalls(text) ?? parseDsmlToolCalls(text);
+}
+const TAG_NAMES = "run_code|run_shell|invoke|parameter|param|arg|argument|calls|tool_calls|function_calls|function_call";
+const OPENER_RE = new RegExp(`^<\\s*/?\\s*(?:\\|\\s*DSML\\s*\\||(?:${TAG_NAMES})\\b)`, "i");
+const CLOSER_RE = new RegExp(`<\\s*/\\s*(?:\\|\\s*DSML\\s*\\|\\s*)?(?:${TAG_NAMES})(?:\\s+[^>]*)?>`, "i");
+const OPENERS = [
+	"<run_code",
+	"<run_shell",
+	"<invoke",
+	"<parameter",
+	"<param",
+	"<arg",
+	"<argument",
+	"<calls",
+	"<tool_calls",
+	"<function_calls",
+	"<function_call",
+	"</run_code",
+	"</run_shell",
+	"</invoke",
+	"</parameter",
+	"</param",
+	"</arg",
+	"</argument",
+	"</calls",
+	"</tool_calls",
+	"</function_calls",
+	"</function_call",
+	"<|dsml|",
+	"</|dsml|",
+	"<||dsml",
+	"</||dsml"
+];
+/**
+* Index from which a streaming text buffer must be held back.
+*
+* The earliest `<` that either opens a recognisable tag or could still grow
+* into one (a delta may split `<parameter` across frames), or -1 when the
+* whole buffer is safe to emit as prose.
+*/
+function printedCallHoldIndex(text) {
+	for (let index = text.indexOf("<"); index !== -1; index = text.indexOf("<", index + 1)) {
+		const rest = text.slice(index);
+		if (OPENER_RE.test(rest)) return index;
+		const head = rest.replace(/\s+/g, "").toLowerCase().slice(0, 18);
+		if (OPENERS.some((opener) => opener.startsWith(head))) return index;
+	}
+	return -1;
+}
+/** Whether a held buffer has already reached a closing tag. */
+function printedCallLooksComplete(text) {
+	return CLOSER_RE.test(text);
+}
+//#endregion
 //#region src/host/workbuddy/mapper.ts
 /**
 * Wire mapping for the WorkBuddy / CodeBuddy subscription chat endpoint.
@@ -36283,6 +37330,121 @@ function openAIAssistantContent$2(message) {
 		toolCalls
 	};
 }
+/** Whether one wire message is an assistant turn. */
+function isAssistantTurn(message) {
+	return message.role === "assistant";
+}
+/**
+* The text of one assistant turn, or `undefined` when the message is not an
+* assistant turn or does not carry plain text.
+*/
+function assistantTextOf(message) {
+	if (!isAssistantTurn(message)) return void 0;
+	return typeof message.content === "string" ? message.content : void 0;
+}
+/** The tool calls one wire message declares, which may be none. */
+function toolCallsOf(message) {
+	return Array.isArray(message.tool_calls) ? message.tool_calls : [];
+}
+/**
+* Concatenate one assistant turn's text onto another.
+*
+* A concatenation that would merge two words is separated by a single space: a
+* batch split across turns ends its first turn mid-sentence, so `"let me"` +
+* `"look"` has to leave as `"let me look"` and not `"let melook"`.
+*/
+function appendAssistantText(base, extra) {
+	if (extra === "") return base;
+	if (base === "") return extra;
+	if (/\s$/.test(base) || /^\s/.test(extra) || /[\u3000-\u9fff\uff00-\uff9f]/.test(base + extra)) return base + extra;
+	return `${base} ${extra}`;
+}
+/**
+* Fold adjacent assistant turns that each carry tool calls into one turn.
+*
+* A parallel batch the harness serialized as two assistant messages is one
+* batch to the upstream, and only one assistant turn may declare it: a gateway
+* that sees the batch split rejects every later turn of that conversation. Text
+* is concatenated and the calls are appended in order, ids untouched. A tool
+* result between two assistant turns is what proves they are separate turns,
+* so only the immediately adjacent run is merged — the following tool results
+* keep their own order.
+*/
+function mergeSplitToolCallBatches(messages) {
+	const repaired = [];
+	for (const message of messages) {
+		const text = assistantTextOf(message);
+		const calls = toolCallsOf(message);
+		const previous = repaired.length > 0 ? repaired[repaired.length - 1] : void 0;
+		const previousText = previous === void 0 ? void 0 : assistantTextOf(previous);
+		if (text !== void 0 && previous !== void 0 && previousText !== void 0 && (calls.length > 0 || toolCallsOf(previous).length > 0)) {
+			repaired[repaired.length - 1] = {
+				...previous,
+				content: appendAssistantText(previousText, text),
+				tool_calls: [...toolCallsOf(previous), ...calls]
+			};
+			continue;
+		}
+		repaired.push(message);
+	}
+	return repaired;
+}
+/**
+* The text an assistant tool call is answered with when its result never came.
+*
+* This text is invented on purpose, exactly as the sibling gateway invents it:
+* an interrupted run leaves the call declared with no `role: "tool"` reply, and
+* the upstream rejects the whole turn rather than the missing result. Sending a
+* sentence the model can read beats both alternatives — dropping the call
+* silently rewrites history the model already saw (and leaves the *next*
+* assistant turn referring to a call that is no longer there), while dropping
+* the turn throws away the rest of the conversation's context. The wording is
+* deliberately unlike a real tool output: it is short, says it failed, and
+* carries no content that could be mistaken for a result.
+*/
+const NO_TOOL_RESULT_TEXT = "[no result: the tool call did not complete]";
+/**
+* Answer every declared tool call that has no `role: "tool"` message.
+*
+* The window is the stretch before the next assistant turn: call ids are only
+* meaningful inside one turn's batch, and a later turn's results may reuse none
+* of them. Calls that were answered are left alone, and the invented replies go
+* after the results that did arrive so the real ones keep their position.
+*/
+function fillMissingToolResults(messages) {
+	const repaired = [];
+	let index = 0;
+	while (index < messages.length) {
+		const message = messages[index];
+		repaired.push(message);
+		index += 1;
+		if (!isAssistantTurn(message)) continue;
+		const calls = toolCallsOf(message);
+		if (calls.length === 0) continue;
+		const answered = /* @__PURE__ */ new Set();
+		const results = [];
+		while (index < messages.length && !isAssistantTurn(messages[index])) {
+			const result = messages[index];
+			if (result.role === "tool" && typeof result.tool_call_id === "string") answered.add(result.tool_call_id);
+			results.push(result);
+			index += 1;
+		}
+		const invented = [];
+		for (const call of calls) {
+			const id = typeof call.id === "string" ? call.id : "";
+			if (id === "" || answered.has(id)) continue;
+			invented.push({
+				role: "tool",
+				tool_call_id: id,
+				content: NO_TOOL_RESULT_TEXT
+			});
+		}
+		let insertAt = results.length;
+		while (insertAt > 0 && results[insertAt - 1].role === "user") insertAt -= 1;
+		repaired.push(...results.slice(0, insertAt), ...invented, ...results.slice(insertAt));
+	}
+	return repaired;
+}
 /**
 * Build one `/v2/chat/completions` body.
 *
@@ -36337,12 +37499,13 @@ function buildChatRequest$2(options, images = NO_RESOLVED_IMAGES$2) {
 		});
 	}
 	const effort = options.reasoningEffort === void 0 ? void 0 : String(options.reasoningEffort);
+	const repairedMessages = fillMissingToolResults(mergeSplitToolCallBatches(messages));
 	return {
 		model: options.model,
-		messages,
+		messages: repairedMessages,
 		stream: true,
 		stream_options: { include_usage: true },
-		max_tokens: options.maxTokens ?? maxOutputTokensFor$3(options.model),
+		max_tokens: clampMinimumOutput(options.model, options.maxTokens ?? maxOutputTokensFor$3(options.model)),
 		...options.temperature === void 0 ? {} : { temperature: options.temperature },
 		...options.stop && options.stop.length > 0 ? { stop: options.stop } : {},
 		...options.tools && options.tools.length > 0 ? {
@@ -36374,9 +37537,122 @@ function createStreamState$4() {
 		cacheReadTokens: 0,
 		cacheWriteTokens: 0,
 		reasoningTokens: 0,
-		sawUsage: false
+		sawUsage: false,
+		printed: {
+			pending: "",
+			holding: false
+		}
 	};
 }
+/**
+* Smallest output request the GPT-family upstreams accept.
+*
+* Measured upstream behaviour (also pinned by workbuddy2api-hub as #364/#252):
+* a `gpt-*` model rejects `max_tokens` below 16 with 400
+* `integer_below_min_value`, while every other family accepts a small value.
+* This route only ever asks for a small cap on purpose — the connection probe and
+* an output-limit probe both do — so the floor is applied here rather than left
+* for each caller to remember.
+*/
+const MINIMUM_GPT_MAX_TOKENS = 16;
+/** Raise a GPT-family output request to the floor that family enforces. */
+function clampMinimumOutput(model, maxTokens) {
+	if (!model.trimStart().toLowerCase().startsWith("gpt-")) return maxTokens;
+	return Math.max(maxTokens, MINIMUM_GPT_MAX_TOKENS);
+}
+/** Longest printed-call region held before it is written out as prose anyway. */
+const PRINTED_CALL_LIMIT = 64 * 1024;
+/** Append prose to the open text block, opening one when needed. */
+function emitProse(state, text) {
+	if (text === "") return [];
+	const out = closeToolCalls$2(state);
+	if (state.current === null || state.current.type !== "text") out.push(...openTextBlock$2(state, "text"));
+	state.current.text += text;
+	state.hasContent = true;
+	out.push({
+		type: "text-delta",
+		index: state.current.index,
+		text
+	});
+	return out;
+}
+/** Emit recovered calls as settled tool-call blocks. */
+function emitPrintedCalls(state, calls) {
+	const out = closeCurrent$2(state);
+	for (const call of calls) {
+		const index = state.blocks.length;
+		const id = toToolCallId(call.id);
+		const block = {
+			type: "tool-call",
+			id,
+			name: call.name,
+			arguments: call.arguments
+		};
+		state.blocks.push(block);
+		out.push({
+			type: "block-start",
+			index,
+			blockType: "tool-call"
+		});
+		out.push({
+			type: "tool-call-delta",
+			index,
+			id,
+			name: call.name,
+			argumentsDelta: call.arguments
+		});
+		out.push({
+			type: "block-end",
+			index,
+			block
+		});
+		state.hasToolCall = true;
+		state.hasContent = true;
+	}
+	return out;
+}
+/**
+* Release held text, resolving it into prose or calls.
+*
+* `force` is what the end of a turn passes: whatever is still held must be
+* written out rather than dropped, even when it never closed.
+*/
+function drainPrinted(state, force) {
+	const out = [];
+	for (;;) {
+		const pending = state.printed.pending;
+		if (pending === "") return out;
+		if (!state.printed.holding) {
+			const hold = printedCallHoldIndex(pending);
+			if (hold === -1) {
+				out.push(...emitProse(state, pending));
+				state.printed.pending = "";
+				return out;
+			}
+			if (hold > 0) out.push(...emitProse(state, pending.slice(0, hold)));
+			state.printed.pending = pending.slice(hold);
+			state.printed.holding = true;
+		}
+		const buffer = state.printed.pending;
+		if (!force && !printedCallLooksComplete(buffer) && buffer.length < PRINTED_CALL_LIMIT) return out;
+		state.printed.holding = false;
+		state.printed.pending = "";
+		const recovered = recoverPrintedToolCalls(buffer);
+		if (recovered === null) {
+			out.push(...emitProse(state, buffer));
+			return out;
+		}
+		if (recovered.clean !== "") out.push(...emitProse(state, recovered.clean));
+		out.push(...emitPrintedCalls(state, recovered.calls));
+		return out;
+	}
+}
+/** Append chat text, recovering a call the model printed instead of emitting. */
+function feedText(state, text) {
+	if (text === "") return [];
+	state.printed.pending += text;
+	return drainPrinted(state, false);
+}
 function closeCurrent$2(state) {
 	if (state.current === null) return [];
 	const { index, type, text } = state.current;
@@ -36478,17 +37754,7 @@ function processStreamLine$3(line, state) {
 			});
 		}
 		const content = asString$11(delta.content);
-		if (content !== void 0 && content !== "") {
-			out.push(...closeToolCalls$2(state));
-			if (state.current === null || state.current.type !== "text") out.push(...openTextBlock$2(state, "text"));
-			state.current.text += sanitizeText$4(content);
-			state.hasContent = true;
-			out.push({
-				type: "text-delta",
-				index: state.current.index,
-				text: sanitizeText$4(content)
-			});
-		}
+		if (content !== void 0 && content !== "") out.push(...feedText(state, sanitizeText$4(content)));
 		const toolDeltas = Array.isArray(delta.tool_calls) ? delta.tool_calls : [];
 		for (const entry of toolDeltas) {
 			if (!isRecord$20(entry)) continue;
@@ -36498,6 +37764,7 @@ function processStreamLine$3(line, state) {
 	const finish = asString$11(choice?.finish_reason);
 	if (finish !== void 0 && finish !== "") {
 		state.finishReason = finish;
+		out.push(...drainPrinted(state, true));
 		out.push(...closeCurrent$2(state));
 		out.push(...closeToolCalls$2(state));
 	}
@@ -36572,7 +37839,11 @@ function finishReasonFor$4(state) {
 function closeStream$3(state) {
 	if (state.finished) return [];
 	state.finished = true;
-	const out = [...closeCurrent$2(state), ...closeToolCalls$2(state)];
+	const out = [
+		...drainPrinted(state, true),
+		...closeCurrent$2(state),
+		...closeToolCalls$2(state)
+	];
 	if (state.sawUsage) out.push({
 		type: "usage",
 		usage: tokenUsage$3(state)
@@ -36758,6 +38029,27 @@ var WorkBuddyAdapter = class extends LlmAdapter {
 	* A candidate the model does not accept is discarded rather than sent, since
 	* the endpoint rejects an unsupported level with `code 11150`.
 	*/
+	/**
+	* Accounts the LOCAL guardrails refuse for this model right now.
+	*
+	* Reads only numbers this plugin already owns — the billing snapshot's
+	* remaining credits and this line's own token counters — so it never becomes a
+	* second, disagreeing source of truth about the upstream allowance.
+	*/
+	async guardrailBlockedAccounts(settings, model) {
+		const blocked = /* @__PURE__ */ new Set();
+		const ledger = this.options.usageLedger;
+		const pool = this.accountPool;
+		if (pool === null) return blocked;
+		if (ledger === void 0 || !guardrailsArmed(settings.guardrails)) return blocked;
+		for (const account of await pool.listAccounts()) if (!evaluateGuardrails({
+			guardrails: settings.guardrails,
+			tokensToday: ledger.tokensToday(account.id),
+			modelTokensToday: ledger.modelTokensToday(account.id, model),
+			remainingCredits: getCachedQuotaFor$1(account.id)?.remainingCredits
+		}).allowed) blocked.add(account.id);
+		return blocked;
+	}
 	async effortFor(options) {
 		const settings = await this.settings();
 		const credentials = await this.credentials(settings);
@@ -36784,7 +38076,9 @@ var WorkBuddyAdapter = class extends LlmAdapter {
 		const pool = this.accountPool;
 		const tried = /* @__PURE__ */ new Set();
 		let response;
-		while (true) {
+		let servedAccountId;
+		if (pool !== null) for (const blockedId of await this.guardrailBlockedAccounts(settings, options.model)) tried.add(blockedId);
+		rotation: while (true) {
 			let credentials;
 			let accountId;
 			if (pool === null) {
@@ -36795,36 +38089,58 @@ var WorkBuddyAdapter = class extends LlmAdapter {
 			} else {
 				let effective;
 				try {
-					effective = await pool.getEffectiveCredential(tried, fetchFn);
+					effective = await pool.getEffectiveCredential(tried, fetchFn, options.model);
 				} catch (error) {
 					if (error instanceof LlmError) throw error;
 					throw new LlmError(error instanceof Error ? error.message : `Not signed in to ${PROVIDER_NAME$3}.`, "MISSING_CREDENTIAL", { cause: error });
 				}
 				accountId = effective.account.id;
+				servedAccountId = accountId;
 				tried.add(accountId);
 				credentials = effective.credentials;
 			}
-			try {
-				response = await fetchWithContextBudgetRecovery(fetchFn)(`${credentials.backend}${CHAT_PATH}`, {
-					method: "POST",
-					headers: workBuddyHeaders(credentials, { accept: "text/event-stream" }, { ...requestOptions.sessionId === void 0 ? {} : { sessionId: String(requestOptions.sessionId) } }),
-					body,
-					signal
-				});
-			} catch (error) {
-				if (signal.aborted) throw new LlmError("WorkBuddy request aborted", "ABORTED", { cause: error });
-				throw new LlmError(`WorkBuddy request failed: ${error instanceof Error ? error.message : String(error)}`, "TRANSPORT", { cause: error });
+			let renewed = false;
+			let refusedDetail = "";
+			while (true) {
+				try {
+					response = await fetchWithContextBudgetRecovery(fetchFn)(`${credentials.backend}${CHAT_PATH}`, {
+						method: "POST",
+						headers: workBuddyHeaders(credentials, { accept: "text/event-stream" }, {
+							...requestOptions.sessionId === void 0 ? {} : { sessionId: String(requestOptions.sessionId) },
+							product: resolveOutboundProduct(settings.outboundIdentity, accountId ?? credentials.uid ?? "")
+						}),
+						body,
+						signal
+					});
+				} catch (error) {
+					if (signal.aborted) throw new LlmError("WorkBuddy request aborted", "ABORTED", { cause: error });
+					throw new LlmError(`WorkBuddy request failed: ${error instanceof Error ? error.message : String(error)}`, "TRANSPORT", { cause: error });
+				}
+				if (response.ok) break;
+				refusedDetail = (await response.text().catch(() => "")).slice(0, 600);
+				if (renewed || response.status !== 401 || pool === null || accountId === void 0) break;
+				renewed = true;
+				const refusedAccount = accountId;
+				try {
+					credentials = await pool.renewCredential(refusedAccount, fetchFn, credentials);
+				} catch (error) {
+					const verdict = error instanceof LlmError ? error : new LlmError(`${PROVIDER_NAME$3} credential could not be renewed after the service refused it: ${error instanceof Error ? error.message : String(error)}`, "INVALID_CREDENTIAL", { cause: error });
+					if (await pool.hasAnotherAvailableAccount(tried)) continue rotation;
+					throw verdict;
+				}
 			}
 			if (response.ok) break;
-			const detail = (await response.text().catch(() => "")).slice(0, 600);
-			const failure = classifyFailure$1(response.status, detail, response.headers);
+			const failure = classifyFailure$1(response.status, refusedDetail, response.headers);
 			if (pool !== null && accountId !== void 0) {
-				const after = retryAfterMs$1(response.headers);
-				if (failure.code === "RATE_LIMIT") {
+				const after = failure.failure.providerRetryAfterMs ?? retryAfterMs$1(response.headers);
+				if (failure.code === "RATE_LIMIT") if (after !== void 0 && after > 3e5) {
+					if (accountId !== void 0) pool.markModelCooldown(accountId, options.model, after);
+					if (await pool.hasAnotherAvailableAccountFor(tried, options.model)) continue;
+				} else {
 					await pool.markCooldown(accountId, after ?? 3e5, `${PROVIDER_NAME$3} 429`).catch(() => void 0);
 					if (await pool.hasAnotherAvailableAccount(tried)) continue;
-				} else if (failure.code === "INVALID_CREDENTIAL") {
-					await pool.markAuthFailed(accountId, failure.message).catch(() => void 0);
+				}
+				else if (failure.code === "INVALID_CREDENTIAL") {
 					if (await pool.hasAnotherAvailableAccount(tried)) continue;
 				}
 			}
@@ -36836,6 +38152,7 @@ var WorkBuddyAdapter = class extends LlmAdapter {
 		const decoder = new TextDecoder();
 		const state = createStreamState$4();
 		let buffer = "";
+		let recordedTokens = 0;
 		try {
 			while (true) {
 				const { done, value } = await reader.read();
@@ -36846,16 +38163,23 @@ var WorkBuddyAdapter = class extends LlmAdapter {
 				buffer = lines.pop() ?? "";
 				for (const line of lines) {
 					activity?.pulse();
-					for (const chunk of processStreamLine$3(line, state)) yield chunk;
+					for (const chunk of processStreamLine$3(line, state)) {
+						if (chunk.type === "usage") recordedTokens = chunk.usage.inputTokens + chunk.usage.outputTokens + (chunk.usage.cacheReadTokens ?? 0) + (chunk.usage.cacheWriteTokens ?? 0);
+						yield chunk;
+					}
 					if (state.finished) return;
 				}
 			}
 			buffer += decoder.decode();
-			if (buffer.trim() !== "") for (const line of buffer.split("\n")) for (const chunk of processStreamLine$3(line, state)) yield chunk;
+			if (buffer.trim() !== "") for (const line of buffer.split("\n")) for (const chunk of processStreamLine$3(line, state)) {
+				if (chunk.type === "usage") recordedTokens = chunk.usage.inputTokens + chunk.usage.outputTokens + (chunk.usage.cacheReadTokens ?? 0) + (chunk.usage.cacheWriteTokens ?? 0);
+				yield chunk;
+			}
 			if (state.finished) return;
 			assertStreamComplete$4(state);
 			for (const chunk of closeStream$3(state)) yield chunk;
 		} finally {
+			if (servedAccountId !== void 0 && recordedTokens > 0) this.options.usageLedger?.record(servedAccountId, options.model, recordedTokens);
 			reader.cancel().catch(() => void 0);
 		}
 	}
@@ -36875,7 +38199,7 @@ function classifyFailure$1(status, detail, headers) {
 		return new LlmError(`${PROVIDER_NAME$3} rejected the stored credential (${status}). Sign in again with the CodeBuddy desktop client.${detail ? ` ${detail}` : ""}`, "INVALID_CREDENTIAL", { status });
 	}
 	if (status === 429 || code === 6004 || code === 14003) {
-		const after = headers ? retryAfterMs$1(headers) : void 0;
+		const after = (headers ? retryAfterMs$1(headers) : void 0) ?? readRateLimitReset(detail);
 		return new LlmError(`${PROVIDER_NAME$3} rate limit or plan quota reached. Check the quota card in Settings > WorkBuddy.${detail ? ` ${detail}` : ""}`, "RATE_LIMIT", {
 			status: status === 429 ? 429 : void 0,
 			...after === void 0 ? {} : { providerRetryAfterMs: after }
@@ -36931,6 +38255,45 @@ function refusalIsNotCredential(detail) {
 	const type = inner.type ?? envelope.type;
 	return typeof type === "string" && type === "server_error" && hasMessage;
 }
+/** How far out a reset instant may be and still be treated as one. */
+const MAX_RESET_HORIZON_MS = 10080 * 60 * 1e3;
+const RESET_STAMP_RE = /(?:resets?\s+at|reset\s+at|将在)\s*(\d{4}-\d{2}-\d{2})[ T](\d{2}:\d{2}:\d{2})/;
+const RESET_TZ_RE = /UTC([+-])(\d{1,2})(?::?(\d{2}))?/;
+/**
+* The reset instant a quota refusal names, as a delay from now.
+*
+* A 24h allowance that is exhausted answers 429 / `code 6004` with the wall
+* clock it lifts — but only in the MESSAGE, never in a header, and in two
+* realm-specific wordings (measured: intl "… resets at 2026-09-20 10:50:48
+* UTC+8", cn "… 将在 2026-10-09 14:44:59 UTC+8 重置"). Reading the status alone
+* therefore loses the only fact that says how long the account is out, and the
+* pool parks a 24-hour limit for five minutes before trying it again.
+*
+* Deliberately tolerant, in the same direction as their gateway: an unparseable
+* body yields `undefined` (callers keep their default cooldown) rather than an
+* error, because this runs on a failure path. An absent `UTC±h` marker means
+* UTC, which is how the sibling implementation reads it too.
+*/
+function readRateLimitReset(detail, now = Date.now()) {
+	const stamp = RESET_STAMP_RE.exec(detail);
+	if (stamp === null) return void 0;
+	const [, date, clock] = stamp;
+	const parts = `${date} ${clock}`.split(/[- :]/).map((part) => Number(part));
+	const [year, month, day, hour, minute, second] = parts;
+	if (parts.length !== 6 || parts.some((part) => !Number.isFinite(part))) return void 0;
+	const zone = RESET_TZ_RE.exec(detail);
+	let offsetMs = 0;
+	if (zone !== null) {
+		const hours = Number(zone[2] ?? "0");
+		const minutes = Number(zone[3] ?? "0");
+		offsetMs = (zone[1] === "-" ? -1 : 1) * (hours * 60 + minutes) * 6e4;
+	}
+	const at = Date.UTC(year ?? 0, (month ?? 1) - 1, day ?? 1, hour ?? 0, minute ?? 0, second ?? 0) - offsetMs;
+	if (!Number.isFinite(at)) return void 0;
+	const delay = at - now;
+	if (delay <= 0 || delay > MAX_RESET_HORIZON_MS) return void 0;
+	return delay;
+}
 /** Read the subscription's own numeric error code out of a response body. */
 function readErrorCode(detail) {
 	const matched = /"code"\s*:\s*(\d+)/.exec(detail);
@@ -37145,6 +38508,17 @@ var WorkBuddyAccountPool = class extends AccountPoolCore {
 	* decision goes through, so the mapping is never stale when it is consulted.
 	*/
 	legacyIds = /* @__PURE__ */ new Map();
+	/**
+	* Per-model parks, in memory only: account id → model → the instant it lifts.
+	*
+	* The subscription meters an account × MODEL over a 24h window (429 `code
+	* 6004` names when it lifts), so cooling the whole ACCOUNT for one exhausted
+	* model throws away every other model that account can still serve. Process
+	* local on purpose, like the sibling gateway's model cooldowns: the window is
+	* short, and a restart re-measures it with the first request rather than
+	* trusting a stale timestamp.
+	*/
+	modelCooldowns = /* @__PURE__ */ new Map();
 	constructor(options = {}) {
 		const store = options.store ?? new FileCredentialStore$4();
 		const hooks = {
@@ -37262,14 +38636,74 @@ var WorkBuddyAccountPool = class extends AccountPoolCore {
 		return this.listAccounts();
 	}
 	/**
+	* A stale `authStatus` is cleared once the credential in force has moved on.
+	*
+	* The marker records that ONE token was refused; it does not record that the
+	* sign-in is gone. This line can still produce it from a token-endpoint
+	* refusal, and the copy that refusal was about can be replaced afterwards by
+	* whoever owns it — the IDE rotates a desktop account's token on its own
+	* schedule, and the daily check-in renews a managed one and writes it back to
+	* this plugin's store. Nothing else in the system ever revisits an
+	* `authStatus`, so without this a row stays out of rotation for good and the
+	* card keeps saying "需要重新登录" for an account that is signed in.
+	*
+	* The verdict is re-checked against what the store holds NOW: a row whose
+	* account has a DIFFERENT, unexpired token is routable again and adopts it,
+	* while a row still holding the refused token keeps its marker — that one
+	* really does need a sign-in.
+	*/
+	async healStaleAuthFailures(current) {
+		if (!(current ?? await this.read()).accounts.some(isMarkedFailed)) return false;
+		const live = await this.store.list().catch(() => []);
+		if (live.length === 0) return false;
+		const byId = /* @__PURE__ */ new Map();
+		for (const credentials of live) byId.set(workBuddyAccountId(credentials), credentials);
+		return await this.updatePool((draft) => {
+			let changed = false;
+			for (const account of draft.accounts) {
+				if (!isMarkedFailed(account)) continue;
+				const candidate = byId.get(account.id);
+				if (candidate === void 0) continue;
+				if (candidate.accessToken === account.credentials.accessToken) continue;
+				if (isExpired(candidate)) continue;
+				account.authStatus = void 0;
+				account.authFailedReason = void 0;
+				account.credentials = candidate;
+				changed = true;
+			}
+			return changed;
+		});
+	}
+	/** Account summaries, with a marker the credentials have outlived cleared. */
+	async listAccounts() {
+		const summaries = await super.listAccounts();
+		if (!summaries.some(isMarkedFailed)) return summaries;
+		await this.healStaleAuthFailures().catch(() => void 0);
+		return await super.listAccounts();
+	}
+	/**
+	* Pick an account, healing a stale marker first.
+	*
+	* The healing belongs on the request path, not only on the card: an account
+	* marked expired is excluded by the core's eligibility rule, so until the
+	* marker is gone the next request is answered with "全部 N 个账号都需要重新登录"
+	* for a credential the store has already replaced.
+	*/
+	async getEffectiveAccount(excludeIds, fetchFn = fetch, forceRefresh = false) {
+		const data = await this.read();
+		if (data.accounts.some(isMarkedFailed)) await this.healStaleAuthFailures(data).catch(() => void 0);
+		return await super.getEffectiveAccount(excludeIds, fetchFn, forceRefresh);
+	}
+	/**
 	* Pick the account for the next request.
 	*
 	* A desktop account's credential is re-read from the IDE's file first: the IDE
 	* refreshes its own token, so the copy the pool adopted can be older than what
 	* is on disk.
 	*/
-	async getEffectiveCredential(excludeIds, fetchFn = fetch) {
-		const effective = await this.getEffectiveAccount(excludeIds, fetchFn);
+	async getEffectiveCredential(excludeIds, fetchFn = fetch, model) {
+		const parked = model === void 0 ? /* @__PURE__ */ new Set() : this.parkedAccountIds(model);
+		const effective = await this.getEffectiveAccount(parked.size === 0 ? excludeIds : /* @__PURE__ */ new Set([...excludeIds ?? [], ...parked]), fetchFn);
 		if (effective.account.source !== "desktop" || effective.account.sourceFile === void 0) return effective;
 		const live = await this.store.readDesktopFile(effective.account.sourceFile);
 		if (live === null) return effective;
@@ -37287,6 +38721,52 @@ var WorkBuddyAccountPool = class extends AccountPoolCore {
 		};
 	}
 	/**
+	* Park ONE model on one account; every other model keeps serving.
+	*
+	* Returns the instant the park lifts, or undefined for a non-positive
+	* duration (which clears any existing park rather than extending it).
+	*/
+	markModelCooldown(accountId, model, durationMs) {
+		if (!Number.isFinite(durationMs) || durationMs <= 0) {
+			this.modelCooldowns.get(accountId)?.delete(model);
+			return;
+		}
+		const until = Date.now() + durationMs;
+		const forAccount = this.modelCooldowns.get(accountId) ?? /* @__PURE__ */ new Map();
+		forAccount.set(model, until);
+		this.modelCooldowns.set(accountId, forAccount);
+		return until;
+	}
+	/** When this account's park on this model lifts, or undefined when it may serve. */
+	modelCooldownUntil(accountId, model, now = Date.now()) {
+		const until = this.modelCooldowns.get(accountId)?.get(model);
+		return until !== void 0 && until > now ? until : void 0;
+	}
+	/** Accounts currently parked on one model, with lifted entries pruned on the way. */
+	parkedAccountIds(model, now = Date.now()) {
+		const parked = /* @__PURE__ */ new Set();
+		for (const [accountId, models] of this.modelCooldowns) {
+			const until = models.get(model);
+			if (until === void 0) continue;
+			if (until > now) parked.add(accountId);
+			else models.delete(model);
+		}
+		return parked;
+	}
+	/**
+	* Whether another account besides `triedAccountIds` can serve THIS model.
+	*
+	* The plain {@link hasAnotherAvailableAccount} answers for any model, so a
+	* rotation loop that consulted it would keep trying while every remaining
+	* account is parked on the model it is asking for — turning one exhausted
+	* window into a burst of refused requests.
+	*/
+	async hasAnotherAvailableAccountFor(triedAccountIds, model) {
+		const parked = this.parkedAccountIds(model);
+		if (parked.size === 0) return super.hasAnotherAvailableAccount(triedAccountIds);
+		return super.hasAnotherAvailableAccount(/* @__PURE__ */ new Set([...triedAccountIds, ...parked]));
+	}
+	/**
 	* Whether an account may serve a request.
 	*
 	* A hidden account keeps its place, its alias and its history, but the user
@@ -37328,6 +38808,15 @@ var WorkBuddyAccountPool = class extends AccountPoolCore {
 		super.deleteAccountFromPool(data, accountId);
 	}
 };
+/**
+* Whether a row's credential was reported as refused and never cleared.
+*
+* Mirrors the core's own eligibility predicate (`authStatus` present and not
+* `ok`), so the heal agrees with the rule that excluded the row.
+*/
+function isMarkedFailed(account) {
+	return account.authStatus !== void 0 && account.authStatus !== "ok";
+}
 //#endregion
 //#region src/host/claude/types.ts
 /**
@@ -42055,7 +43544,7 @@ function sleep$1(ms, signal) {
 * so that spelling is accepted too — but only for the 127/8 block, never for a
 * v4-mapped public address.
 */
-function isLoopbackAddress(address) {
+function isLoopbackAddress$1(address) {
 	if (address === void 0) return false;
 	if (address === "127.0.0.1" || address === "::1" || address === "::ffff:127.0.0.1") return true;
 	const mapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(address);
@@ -42627,7 +44116,7 @@ const SUCCESS_PAGE = "Claude sign-in completed. You can close this window.";
 */
 function callbackHandler(request, response) {
 	(async () => {
-		if (!isLoopbackAddress(request.socket.remoteAddress)) {
+		if (!isLoopbackAddress$1(request.socket.remoteAddress)) {
 			await writeHtml(response, 403, "This callback only answers on this machine.");
 			return;
 		}
@@ -56721,6 +58210,16 @@ const CHECKIN_PATH = "/billing/meter/daily-checkin";
 */
 const CHECKIN_TICK_MS$1 = 600 * 1e3;
 const CHECKIN_TIMEOUT_MS$1 = 2e4;
+/**
+* Random pause between two accounts in one pass.
+*
+* Sequential accounts already serialise their requests, but they still arrive as
+* one tight cluster from one outbound IP; a dozen-account pool doing that at the
+* same minute is the burst pattern the sibling gateway added jitter for after
+* seeing upstream rate-limit whole pools.
+*/
+const CHECKIN_JITTER_MIN_MS = 2e3;
+const CHECKIN_JITTER_MAX_MS = 5e3;
 /** State document the scheduler keeps beside the other plugin stores. */
 function checkinStatePath$1() {
 	return path.join(dshHomeDir(), "storages", "workbuddy-checkin.json");
@@ -56811,6 +58310,8 @@ var WorkBuddyCheckinService = class {
 	fetchFn;
 	statePath;
 	now;
+	pause;
+	random;
 	logger;
 	state = {};
 	loaded = false;
@@ -56827,6 +58328,10 @@ var WorkBuddyCheckinService = class {
 		this.fetchFn = options.fetchFn ?? fetch;
 		this.statePath = options.statePath ?? checkinStatePath$1();
 		this.now = options.now ?? (() => Date.now());
+		this.pause = options.pause ?? ((ms) => new Promise((resolve) => {
+			setTimeout(resolve, ms);
+		}));
+		this.random = options.random ?? Math.random;
 		this.logger = options.logger;
 	}
 	/**
@@ -56879,6 +58384,7 @@ var WorkBuddyCheckinService = class {
 			this.logger?.warn(`[workbuddy-checkin] account scan failed: ${error instanceof Error ? error.message : String(error)}`);
 			return;
 		}
+		let ranOne = false;
 		for (const credentials of accounts) {
 			if (isIntlDomain(credentials.domain)) continue;
 			const id = workBuddyAccountId(credentials);
@@ -56887,7 +58393,9 @@ var WorkBuddyCheckinService = class {
 			if (sameDay && existing.done) continue;
 			if (!manual && sameDay && existing.attempts >= 3) continue;
 			if (!manual && sameDay && existing.inactive === true && nowMs - (existing.inactiveAt ?? 0) < 36e5) continue;
+			if (ranOne) await this.pause(CHECKIN_JITTER_MIN_MS + Math.floor(this.random() * (CHECKIN_JITTER_MAX_MS - CHECKIN_JITTER_MIN_MS)));
 			await this.checkinOne(id, credentials, today, nowMs);
+			ranOne = true;
 		}
 		this.lastRunAt = nowMs;
 		await this.save();
@@ -59875,6 +61383,11 @@ function installRelayProbe(ctx, options) {
 * already existed when the guard installed was never reported at all. Both
 * cases cut the runaway and then resumed nothing, which reads to the user as a
 * conversation that simply stops mid-answer.
+*
+* Status: **switched off in this line by default**. Everything here still
+* works and is still tested; what changed is the wiring in `src/index.ts`,
+* whose `reasoningCollapseGuard` config now defaults to `false` instead of
+* `{}`. A deployment that wants the break back opts in with an object.
 */
 const DEFAULT_GUARD_OPTIONS = {
 	windowChars: 4096,
@@ -60075,7 +61588,7 @@ function createBreakerState() {
 * instead of impersonating a human turn.
 */
 function createResumeMessage$1(text) {
-	return createUserMessage({
+	return createUserMessage$1({
 		content: [{
 			type: "text",
 			text
@@ -60379,7 +61892,7 @@ function resolveNoAnswerResumeOptions(options = {}) {
 }
 /** The message a resume carries, with this package's own provenance. */
 function createResumeMessage(text) {
-	return createUserMessage({
+	return createUserMessage$1({
 		content: [{
 			type: "text",
 			text
@@ -60595,6 +62108,579 @@ function releaseListener(handle) {
 	}
 	handle?.dispose?.();
 }
+/**
+* 判断是否该催促。达到阈值即触发，注入之后调用方把计数清零。
+* @param rounds - 自上次进展更新以来的连续轮次数。
+* @returns 是否达到 {@link NUDGE_THRESHOLD}。
+*/
+function shouldNudge(rounds) {
+	return rounds >= 8;
+}
+/**
+* 把进展列表截断到环形缓冲上限，保留最新的一批。
+* @param list - 任意长度的进展列表（不会被就地修改）。
+* @returns 截断后的新数组。
+*/
+function capUpdates(list) {
+	return list.length <= 50 ? [...list] : list.slice(list.length - 50);
+}
+/** 进程内自增序号，只用于拼出稳定 id；不含任何运行时依赖。 */
+let sequence = 0;
+/**
+* 生成一条进展的稳定 id。
+* @param at - 产生时刻（Unix 毫秒）。
+* @returns 形如 `pu-<时间戳>-<序号>` 的字符串。
+*/
+function nextUpdateId(at) {
+	sequence += 1;
+	return `pu-${at}-${sequence}`;
+}
+/**
+* 创建一个空的进展更新 store。
+* @returns 新的会话维度 store。
+*/
+function createProgressUpdateStore() {
+	let current = {
+		updates: [],
+		roundsSinceUpdate: 0,
+		nudges: 0
+	};
+	return {
+		state: () => current,
+		push: (update) => {
+			current = {
+				...current,
+				updates: capUpdates([...current.updates, update])
+			};
+			return current;
+		},
+		bumpRound: () => {
+			current = {
+				...current,
+				roundsSinceUpdate: current.roundsSinceUpdate + 1
+			};
+			return current.roundsSinceUpdate;
+		},
+		markUpdated: () => {
+			current = {
+				...current,
+				roundsSinceUpdate: 0
+			};
+			return current;
+		},
+		markNudged: () => {
+			current = {
+				...current,
+				roundsSinceUpdate: 0,
+				nudges: current.nudges + 1
+			};
+			return current;
+		},
+		reset: () => {
+			current = {
+				updates: [],
+				roundsSinceUpdate: 0,
+				nudges: 0
+			};
+			return current;
+		}
+	};
+}
+//#endregion
+//#region src/host/progress-updates/tool.ts
+/** 注册的工具名。冻结契约的一部分，不要改动。 */
+const NOTIFY_USER_TOOL = "progress_update";
+/** 工具关闭时返回给模型的文本（canonical 输出的 render，而不是抛错）。 */
+const DISABLED_OUTPUT_TEXT = "Progress updates are disabled; the update was not displayed.";
+/** 工具描述的最终全文。 */
+const PROGRESS_UPDATE_DESCRIPTION = [
+	"Report progress to the user without ending your turn.",
+	"Use it during multi-step work so the user can follow along and correct course early:",
+	"state your plan near the beginning of the task (what you will do, and in what order);",
+	"report a meaningful conclusion the moment you have it (a key fact, the root cause, a verified assumption) rather than narrating every step;",
+	"give a stage judgement when one phase ends and the next begins (where things stand, what happens next);",
+	"explain what you are waiting for before a long wait such as a test run, an install, or a build;",
+	"and say what blocks you — and what you will try next, or what you need from the user — when you are stuck.",
+	"Each update has one short title line (plain text, no Markdown, no trailing period) with the details in the message body.",
+	"Do not repeat a status that has not changed.",
+	"When you run as a subagent, describe only your own subtask: finishing your subtask is not the same as finishing the overall task."
+].join(" ");
+/**
+* 构造 progress_update 工具。
+* @param deps - 依赖：当前开关与进展接收端。
+* @returns 可注册的工具定义。
+*/
+function createProgressUpdateTool(deps) {
+	return defineTool({
+		name: NOTIFY_USER_TOOL,
+		description: PROGRESS_UPDATE_DESCRIPTION,
+		parameters: {
+			title: {
+				type: "string",
+				description: "One line, about 60 characters at most, in the user's language: plain text, no Markdown, no trailing period."
+			},
+			message: {
+				type: "string",
+				required: true,
+				description: "The details, about 1000 characters at most, in light Markdown: one paragraph of prose plus a few bullets."
+			}
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: { displayed: {
+					type: "boolean",
+					description: "Whether the update was actually shown to the user."
+				} }
+			},
+			render(_args, value) {
+				return [{
+					type: "text",
+					text: value.displayed ? "Progress update displayed." : DISABLED_OUTPUT_TEXT
+				}];
+			}
+		},
+		async execute(args, exec) {
+			if (!deps.isEnabled()) return { displayed: false };
+			const sink = deps.sink?.();
+			if (sink === void 0) return { displayed: false };
+			const at = Date.now();
+			const source = deps.sourceOf?.(exec);
+			const update = {
+				id: nextUpdateId(at),
+				message: args.message,
+				at,
+				...args.title === void 0 || args.title.trim() === "" ? {} : { title: args.title.trim() },
+				...source === void 0 ? {} : { source }
+			};
+			return { displayed: sink.push(update) };
+		}
+	});
+}
+//#endregion
+//#region src/host/progress-updates/nudge.ts
+/** 注入到模型上下文里的催促正文。 */
+const NUDGE_TEXT = [
+	"You have made a run of tool calls without reporting progress to the user.",
+	"If you are still in the middle of multi-step work, send one progress update now with the progress_update tool:",
+	"one short title line and the details in the body — what you have established so far, where things stand, and what you are doing next.",
+	"Skip it when there is genuinely nothing new to report."
+].join(" ");
+/** 催促上下文在消息来源上的 kind（供客户端与日志区分这类注入）。 */
+const NUDGE_SOURCE_KIND = "progress-updates-nudge";
+/**
+* 造一条催促上下文。
+* @param sequence - 本会话第几次催促，写进 notice 摘要便于日志辨认。
+* @returns 可直接放进 `additionalContexts` 的用户角色消息。
+*/
+function createNudgeContext(sequence) {
+	return createUserMessage({
+		content: [{
+			type: "text",
+			text: NUDGE_TEXT
+		}],
+		source: {
+			kind: NUDGE_SOURCE_KIND,
+			form: "notice",
+			summary: `progress update nudge #${sequence}`
+		}
+	});
+}
+/**
+* 找出一次工具调用所属的**计数会话**：子会话归并到最近的顶层祖先，整棵委派
+* 树共用一个计数器。
+* @param agent - 事件里的调用方 agent。
+* @param sessions - 会话查找表，缺省时退化为只认调用方自己的会话。
+* @returns 计数用的会话 id，无法判定时返回 undefined。
+*/
+function counterSessionIdOf(agent, sessions) {
+	const own = stringOf(agent?.session?.header?.id) ?? stringOf(agent?.id);
+	if (own === void 0) return void 0;
+	if (sessions === void 0) return own;
+	let current = own;
+	let header = agent?.session?.header;
+	for (let depth = 0; depth < 16 && current !== void 0; depth += 1) {
+		const resolved = header ?? sessions.get(current)?.header;
+		if (resolved === void 0) return current;
+		const parentId = stringOf(resolved.parentSession);
+		if (parentId === void 0) return current;
+		const parent = sessions.get(parentId);
+		if (parent === void 0) return current;
+		header = parent.header;
+		current = parentId;
+	}
+	return current;
+}
+/**
+* 读一次工具调用所属的「步」标识，用于把同一个模型步里的多条工具结果合并成一轮。
+*
+* 拿不到 turnBoundary（没有 agent-loop，或宿主不是真实会话）时返回 undefined，
+* 调用方退化为按工具结果计数——宁可多计，也不要漏掉催促。
+* @param agent - 事件里的调用方 agent。
+* @param projections - 会话投影服务，可选。
+* @returns 该步的唯一键，或 undefined。
+*/
+function stepKeyOf(agent, projections) {
+	if (projections === void 0) return void 0;
+	const session = agent?.session;
+	if (session === void 0) return void 0;
+	try {
+		const seq = projections.stateOf(session, "turnBoundary")?.lastStepStartSeq;
+		return typeof seq === "number" ? `step:${seq}` : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* 读一个未知字段为字符串。
+* @param value - 候选值。
+* @returns 字符串，或任何其它类型的 undefined。
+*/
+function stringOf(value) {
+	return typeof value === "string" && value !== "" ? value : void 0;
+}
+//#endregion
+//#region src/host/progress-updates/prompt.ts
+/**
+* 系统提示词引导：让模型知道「多步任务里要主动汇报进展」这件事该怎么用。
+*
+* 文本用函数形式提供（而不是静态字符串）：开关关闭时返回空串，装配期就地
+* 抹掉引导，不需要重启会话、也不需要重挂插件行。
+*
+* @module dsh-chatgpt-subscription/host/progress-updates/prompt
+*/
+/**
+* 本模块提示词分节的名称，全局唯一（重复注册会抛错）。
+*
+* 保留原插件的 `plugin:progress-updates` 拼写：会话里已有的分节名不能因为搬家
+* 而变成第二个分节。
+*/
+const PROGRESS_SECTION_NAME = "plugin:progress-updates";
+/**
+* 引导词正文。写法对齐 Kimi 的「进展更新」：先说清多步任务早期的思路，再报
+* 有意义的结论、阶段判断、长等待与阻塞；每条给一行标题，细节放正文；不重复
+* 没有变化的状态。
+*/
+const PROGRESS_GUIDANCE = [
+	"## 进展更新",
+	"",
+	"在多步任务里，你可以调用 `progress_update` 向用户主动汇报进展。它不会结束你的回合，也不消耗一次问答：报告完继续干活即可。",
+	"",
+	"什么时候用：",
+	"- **任务早期**：先说清你打算怎么做（拆成哪几步、先动哪里），让用户在你埋头执行之前就能纠正方向。",
+	"- **有意义的结论**：查到关键事实、定位到根因、验证了一个假设——报结论本身，不要报「我刚读了一个文件」。",
+	"- **阶段判断**：一步做完、进入下一步之前，用一句话说明现在的状态和接下来要做什么。",
+	"- **长等待之前**：跑测试、装依赖、等构建这类要花上一阵子的操作，先说清你在等什么、大概要等多久。",
+	"- **被阻塞时**：缺信息、缺权限、外部依赖失败——说清卡在哪、你打算怎么绕过去，或者需要用户做什么。",
+	"",
+	"怎么写：",
+	"- 每条给一行短标题（title，纯文本，不带 Markdown，不加结尾句号），细节放进正文（message）。",
+	"- 正文用轻 Markdown：一段话说清发生了什么，必要时跟少量 bullet 列出要点。",
+	"- 不要重复没有变化的状态：上一条报过的还在进行中，就不用再报一遍。",
+	"- 进展更新是给用户看的，不是给日志看的：写人话，别复述工具调用参数。",
+	"",
+	"作为 subagent 运行时：只描述你自己的子任务进展。你的子任务完成不等于整体任务完成，不要把整体进度写成已完成。"
+].join("\n");
+/**
+* 生成提示词分节的文本提供者。
+* @param isEnabled - 读取当前开关状态的函数（每次装配重新求值）。
+* @returns 开关打开时返回引导词，关闭时返回空串。
+*/
+function progressSectionText(isEnabled) {
+	return () => isEnabled() ? PROGRESS_GUIDANCE : "";
+}
+//#endregion
+//#region src/host/progress-updates/routes.ts
+/** 进展读取路由的完整路径。 */
+const PROGRESS_UPDATES_PATH = "/api/dsh-progress-updates/updates";
+/** 路由默认的 JSON 响应头。 */
+const JSON_HEADERS = {
+	"content-type": "application/json; charset=utf-8",
+	"referrer-policy": "no-referrer"
+};
+/**
+* 断言本次请求来自本机。
+*
+* 进展内容会包含用户在会话里做的事，属于个人数据，所以只有 loopback（桌面端
+* 自己）能读：socket 地址是权威判断，Host 头必须也是 loopback 权威（挡住 DNS
+* 重绑定），`X-Forwarded-For` 永远不信任。
+* @param request - 进来的 HTTP 请求。
+* @returns 是否放行。
+*/
+function isLoopbackRequest(request) {
+	if (!isLoopbackAddress(request.socket.remoteAddress)) return false;
+	const host = request.headers.host;
+	if (typeof host !== "string" || host === "") return false;
+	let hostname;
+	try {
+		hostname = new URL("http://" + host).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	if (!isLoopbackHostname(hostname)) return false;
+	return request.headers["sec-fetch-site"] !== "cross-site";
+}
+/** socket 远端地址是否落在 loopback 范围（127/8、::1、IPv4-mapped）。 */
+function isLoopbackAddress(address) {
+	if (address === void 0) return false;
+	const normalized = address.toLowerCase();
+	if (normalized === "::1") return true;
+	if (normalized.startsWith("::ffff:")) return isIPv4Loopback(normalized.slice(7));
+	return isIPv4Loopback(normalized);
+}
+/** IPv4 127/8 判定（四段十进制，首段为 127）。 */
+function isIPv4Loopback(v4) {
+	const parts = v4.split(".");
+	return parts.length === 4 && parts[0] === "127" && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255);
+}
+/** 主机名是否指向 loopback 权威（localhost、[::1]、127/8）。 */
+function isLoopbackHostname(hostname) {
+	if (hostname === "localhost" || hostname === "[::1]") return true;
+	return isIPv4Loopback(hostname);
+}
+/**
+* 写一个 JSON 响应。
+* @param res - 响应对象。
+* @param status - HTTP 状态码。
+* @param body - 要序列化的值。
+* @param headers - 追加或覆盖的头。
+*/
+function writeJson(res, status, body, headers = {}) {
+	res.writeHead(status, {
+		...JSON_HEADERS,
+		...headers
+	});
+	res.end(JSON.stringify(body));
+}
+/**
+* 进展读取路由：`GET /api/dsh-progress-updates/updates?session=<id>`。
+*
+* 返回 `{ updates: ProgressUpdate[] }`。响应带 no-store：这个列表随 agent 干活
+* 实时变化，缓存住就等于展示过期进展。
+* @param reader - 进展读取面。
+* @returns 可注册的 route。
+*/
+function makeProgressUpdatesRoute(reader) {
+	return {
+		kind: "exact",
+		path: PROGRESS_UPDATES_PATH,
+		handler: (req, res) => {
+			if (!isLoopbackRequest(req)) {
+				writeJson(res, 403, {
+					ok: false,
+					error: "forbidden: loopback-only"
+				});
+				return;
+			}
+			const session = new URL(req.url ?? "/", "http://127.0.0.1").searchParams.get("session") ?? "";
+			writeJson(res, 200, { updates: reader.updatesOf(session) }, { "cache-control": "no-store" });
+		}
+	};
+}
+//#endregion
+//#region src/host/progress-updates/index.ts
+/**
+* 读取一个配置字段，沿着 volatile 活引用取当前值。
+* @param field - 字段本身。
+* @returns 当前值，或字段缺失时的 undefined。
+*/
+function readProgressConfigField(field) {
+	if (field === void 0 || field === null) return void 0;
+	if (typeof field === "object" && typeof field.get === "function") return field.get();
+	return field;
+}
+/**
+* 解析一次读取的有效设置：每次调用都重读活引用，因此设置保存后立刻生效。
+* @param config - 主入口收到的插件配置（活引用或普通值）。
+* @returns 生效的开关与催促阈值。
+*/
+function resolveProgressUpdatesSettings(config) {
+	const enabled = readProgressConfigField(config?.progressUpdates);
+	const threshold = readProgressConfigField(config?.progressUpdatesNudgeThreshold);
+	return {
+		enabled: enabled === true,
+		nudgeThreshold: typeof threshold === "number" && Number.isSafeInteger(threshold) && threshold > 0 ? threshold : 8
+	};
+}
+/**
+* 已挂载的模块登记表，走一个 global symbol：同一个包的两份模块实例（npm 拷贝与
+* 仓库 link）仍然共享一次判定，而重复注册同名工具或同名提示词分节会让宿主启动
+* 失败。
+*/
+const MOUNTED = Symbol.for("dsh-chatgpt-subscription.mounted-modules");
+/** 本模块在登记表里的名字。 */
+const MODULE_ID = "progress-updates";
+/**
+* 把一条催促挂到一个 post-execute 决策上，同时保住该决策原有的附加上下文。
+* @param decision - `next()` 交回来的决策。
+* @param context - 要追加的催促上下文。
+* @returns 追加后的决策（形状不变）。
+*/
+function withNudge(decision, context) {
+	const additionalContexts = [...decision.additionalContexts ?? [], context];
+	if (decision.kind === "block") return {
+		kind: "block",
+		feedback: decision.feedback,
+		additionalContexts
+	};
+	if (decision.value !== void 0) return {
+		kind: "accept",
+		value: decision.value,
+		additionalContexts
+	};
+	if (decision.content !== void 0) return {
+		kind: "accept",
+		content: decision.content,
+		additionalContexts
+	};
+	return {
+		kind: "accept",
+		additionalContexts
+	};
+}
+/**
+* 单实例守卫：本模块已挂载时放弃本次安装。
+* @param ctx - 宿主上下文。
+* @returns 释放函数（交出挂载权）；已经挂载过时返回 undefined。
+*/
+function claimMount(ctx) {
+	const registry = globalThis;
+	const existing = registry[MOUNTED];
+	const mounted = existing instanceof Set ? existing : /* @__PURE__ */ new Set();
+	if (existing !== mounted) registry[MOUNTED] = mounted;
+	if (mounted.has(MODULE_ID)) return void 0;
+	mounted.add(MODULE_ID);
+	const release = () => {
+		mounted.delete(MODULE_ID);
+	};
+	if (typeof ctx.effect === "function") ctx.effect(() => release, "dsh-chatgpt-subscription: progress updates mount");
+	return release;
+}
+/**
+* 挂载「进展更新」的宿主半边。
+* @param ctx - 宿主插件上下文。
+* @param options - 挂载选项（设置读取器）。
+* @returns 卸载函数；重复挂载时返回一个空操作。
+*/
+function installProgressUpdates(ctx, options) {
+	const release = claimMount(ctx);
+	if (release === void 0) return () => void 0;
+	/** 每次调用重新读服务：宿主树可能在本模块挂载之后才 settle，读一次存下来会漏。 */
+	const serviceOf = (name) => {
+		const read = ctx.get;
+		return typeof read === "function" ? read.call(ctx, name) : void 0;
+	};
+	/** 登记一个副作用；上下文没有 effect 时立即执行（测试用假上下文）。 */
+	const track = (execute, label) => {
+		if (typeof ctx.effect === "function") ctx.effect(execute, label);
+		else execute();
+	};
+	/** 会话查找表：够把子会话回溯到顶层祖先即可。 */
+	const sessionsOf = () => serviceOf("sessions");
+	/** 会话投影服务：只用来读 turnBoundary，把同一个模型步里的多条工具结果合并成一轮。 */
+	const projectionsOf = () => serviceOf("sessionProjections");
+	/** 会话维度状态；键是计数会话 id（子会话已归并到顶层祖先）。 */
+	const stores = /* @__PURE__ */ new Map();
+	/** 已经计过数的「步」：同一个模型步里的后续工具结果不再重复计数。 */
+	const countedSteps = /* @__PURE__ */ new Map();
+	/**
+	* 取一个计数会话的 store，按需创建。
+	* @param key - 计数会话 id。
+	* @returns 该会话的 store。
+	*/
+	const storeOf = (key) => {
+		let store = stores.get(key);
+		if (store === void 0) {
+			store = createProgressUpdateStore();
+			stores.set(key, store);
+		}
+		return store;
+	};
+	/**
+	* 一次工具调用归属的计数会话 id。
+	* @param exec - 工具执行上下文（或任意带 agent 的对象）。
+	* @returns 计数会话 id；判定不出来时归入 `session` 这一桶。
+	*/
+	const counterKeyOf = (exec) => counterSessionIdOf(exec?.agent, sessionsOf()) ?? "session";
+	/**
+	* 浏览器半边的读取面：给定会话 id 就交出那个会话的进展快照。
+	*
+	* 请求不带 session（或带一个本进程没见过的 id）时，回退到那个"合成会话桶"：
+	* 这是单会话部署里的常态，也是插件第一次被调用、祖先血缘还没建立时的落点。
+	*/
+	const reader = { updatesOf: (sessionId) => {
+		const direct = stores.get(sessionId);
+		if (direct !== void 0) return direct.state().updates;
+		if (sessionId !== "") {
+			const merged = counterSessionIdOf({ id: sessionId }, sessionsOf());
+			const parent = merged === void 0 ? void 0 : stores.get(merged);
+			if (parent !== void 0) return parent.state().updates;
+			return [];
+		}
+		const fallback = stores.get("session");
+		return fallback === void 0 ? [] : fallback.state().updates;
+	} };
+	track(() => {
+		const tools = serviceOf("tools");
+		if (tools === void 0) {
+			serviceOf("logger")?.warn("[dsh-chatgpt-subscription] progress updates tool skipped: no tools service");
+			return () => void 0;
+		}
+		const tool = createProgressUpdateTool({
+			isEnabled: () => options.settings().enabled,
+			sink: () => ({ push: (update) => {
+				if (!options.settings().enabled) return false;
+				storeOf(update.source ?? "session").push(update);
+				return true;
+			} }),
+			sourceOf: (exec) => counterKeyOf(exec)
+		});
+		return tools.register(tool);
+	}, "dsh-chatgpt-subscription: progress update tool");
+	track(() => {
+		const systemPrompt = serviceOf("systemPrompt");
+		if (systemPrompt === void 0) return () => void 0;
+		return systemPrompt.section({
+			name: PROGRESS_SECTION_NAME,
+			order: 220,
+			text: progressSectionText(() => options.settings().enabled)
+		});
+	}, "dsh-chatgpt-subscription: progress update prompt section");
+	track(() => {
+		const webServer = serviceOf("webServer");
+		if (webServer === void 0) return () => void 0;
+		return webServer.register(makeProgressUpdatesRoute(reader));
+	}, "dsh-chatgpt-subscription: progress update route");
+	const disposeListener = ctx.on?.("tools/post-execute", (async (exec, _result, next) => {
+		const decision = await next();
+		const current = options.settings();
+		if (!current.enabled) return decision;
+		const key = counterKeyOf(exec);
+		const store = storeOf(key);
+		if (exec.name === "progress_update") {
+			store.markUpdated();
+			const reportedStep = stepKeyOf(exec.agent, projectionsOf());
+			if (reportedStep !== void 0) countedSteps.set(key, reportedStep);
+			return decision;
+		}
+		const step = stepKeyOf(exec.agent, projectionsOf());
+		if (step !== void 0) {
+			if (countedSteps.get(key) === step) return decision;
+			countedSteps.set(key, step);
+		}
+		const rounds = store.bumpRound();
+		if (!(current.nudgeThreshold === 8 ? shouldNudge(rounds) : rounds >= current.nudgeThreshold)) return decision;
+		const nudges = store.markNudged().nudges;
+		return withNudge(decision, createNudgeContext(nudges));
+	}));
+	return () => {
+		disposeListener?.();
+		stores.clear();
+		countedSteps.clear();
+		release();
+	};
+}
 //#endregion
 //#region src/index.ts
 const Config = z.object({
@@ -60610,9 +62696,11 @@ const Config = z.object({
 	subagentModelTools: z.array(z.string()).default([]),
 	subagentModelInheritTools: z.array(z.string()).default(DEFAULT_SUBAGENT_INHERIT_TOOLS),
 	subagentModelScope: z.union([z.const("session"), z.const("preference")]).default("session"),
-	reasoningCollapseGuard: z.union([z.object({}), z.const(false)]).default({}),
+	reasoningCollapseGuard: z.union([z.object({}), z.const(false)]).default(false),
 	noAnswerResume: z.union([z.object({}), z.const(false)]).default({}),
-	codexStreamIdleTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS).step(1).default(DEFAULT_STREAM_IDLE_TIMEOUT_MS)
+	codexStreamIdleTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS).step(1).default(DEFAULT_STREAM_IDLE_TIMEOUT_MS),
+	progressUpdates: z.boolean().default(false).volatile().description("启用进展更新：允许 agent 用 progress_update 工具主动汇报多步任务的进展，并在侧栏展示。"),
+	progressUpdatesNudgeThreshold: z.number().step(1).min(1).max(50).default(8).volatile().description("催促阈值：连续这么多轮带工具调用却没有进展更新时，提醒 agent 发一条进展。")
 });
 const inject = [
 	"webServer",
@@ -60645,6 +62733,10 @@ function apply(ctx, pluginConfig = {}) {
 	const minimaxCodePreferences = registerMinimaxCodePreferenceStore(ctx.settings, minimaxCodeModelSettings);
 	const minimaxCodeAccountPool = new MinimaxCodeAccountPool({ store: minimaxCodeStore });
 	const workBuddyStore = new FileCredentialStore$4();
+	const workBuddyUsageLedger = new WorkBuddyUsageLedger();
+	workBuddyUsageLedger.load().catch(() => void 0);
+	const workBuddyAtRestKey = new WorkBuddyAtRestKeyStore();
+	workBuddyAtRestKey.load().catch(() => null);
 	const workBuddyModelSettings = new FileModelSettingsStore$4();
 	const workBuddyPreferences = registerWorkBuddyPreferenceStore(ctx.settings, workBuddyModelSettings);
 	const workBuddyAccountPool = new WorkBuddyAccountPool({
@@ -60852,7 +62944,8 @@ function apply(ctx, pluginConfig = {}) {
 			adapter: new WorkBuddyAdapter(workBuddyStore, workBuddyModelSettings, workBuddyPreferences, {
 				fetchFn: modelFetch.workbuddy,
 				attachments: ctx.attachments,
-				accountPool: workBuddyAccountPool
+				accountPool: workBuddyAccountPool,
+				usageLedger: workBuddyUsageLedger
 			})
 		});
 		const workBuddyCheckin = new WorkBuddyCheckinService(workBuddyStore, {
@@ -60873,7 +62966,8 @@ function apply(ctx, pluginConfig = {}) {
 			serving: () => workBuddyClaim.serving(),
 			conflict: () => workBuddyClaim.conflict(),
 			accountPool: workBuddyAccountPool,
-			checkin: workBuddyCheckin
+			checkin: workBuddyCheckin,
+			atRestKey: workBuddyAtRestKey
 		});
 		const claudeClaim = claimProviderRoute(ctx, {
 			providerId: PROVIDER_ID,
@@ -60933,20 +63027,23 @@ function apply(ctx, pluginConfig = {}) {
 		})).catch(() => []));
 		const searchSwitcher = new SearchProviderSwitcher(ctx.loader);
 		let lastFetchDiagnostic;
-		const applyWebProviders = (current = preferences.status()) => {
-			const pluginFetch = proxyManager.resolveActiveProxyUrl() !== null;
-			searchSwitcher.select(current.searchProvider, {
-				pluginFetch,
-				fetchProvider: fetchConfiguration.fetchProvider
-			}).then(() => {
-				const status = searchSwitcher.status();
-				if (status.state === "missing" || status.state === "failed") return;
-				const reason = fetchConfiguration.fetchProvider !== "auto" ? "explicit configuration" : current.searchProvider === "codex" ? "Codex search selected" : pluginFetch ? "active proxy detected" : "no proxy or Codex search";
-				const diagnostic = `${status.configuredFetchProvider ?? "DSH default"} (mode=${fetchConfiguration.fetchProvider}; ${reason}; plugin limits=${fetchConfiguration.fetchMaxBodyChars} chars/${fetchConfiguration.fetchMaxResponseBytes} bytes)`;
-				if (diagnostic !== lastFetchDiagnostic) {
-					lastFetchDiagnostic = diagnostic;
-					ctx.logger.info(`[dsh-chatgpt-subscription] Web fetch provider configured: ${diagnostic}`);
-				}
+		const applyWebProviders = () => {
+			preferences.hydrate().then(() => {
+				const current = preferences.status();
+				const pluginFetch = proxyManager.resolveActiveProxyUrl() !== null;
+				return searchSwitcher.select(current.searchProvider, {
+					pluginFetch,
+					fetchProvider: fetchConfiguration.fetchProvider
+				}).then(() => {
+					const status = searchSwitcher.status();
+					if (status.state === "missing" || status.state === "failed") return;
+					const reason = fetchConfiguration.fetchProvider !== "auto" ? "explicit configuration" : current.searchProvider === "codex" ? "Codex search selected" : pluginFetch ? "active proxy detected" : "no proxy or Codex search";
+					const diagnostic = `${status.configuredFetchProvider ?? "DSH default"} (mode=${fetchConfiguration.fetchProvider}; ${reason}; plugin limits=${fetchConfiguration.fetchMaxBodyChars} chars/${fetchConfiguration.fetchMaxResponseBytes} bytes)`;
+					if (diagnostic !== lastFetchDiagnostic) {
+						lastFetchDiagnostic = diagnostic;
+						ctx.logger.info(`[dsh-chatgpt-subscription] Web fetch provider configured: ${diagnostic}`);
+					}
+				});
 			}).catch((error) => {
 				ctx.logger.warn(`[dsh-chatgpt-subscription] Web provider selection could not be applied: ${error instanceof Error ? error.message : String(error)}`);
 			});
@@ -61154,6 +63251,7 @@ function apply(ctx, pluginConfig = {}) {
 			isEnabled: () => antigravityPreferences.status().enabled !== false
 		}));
 		const disposeVideoTool = ctx.tools.register(createKimiVideoTool(ctx, { fetchFn: proxyFetch }));
+		const disposeProgressUpdates = installProgressUpdates(ctx, { settings: () => resolveProgressUpdatesSettings(pluginConfig) });
 		ctx.inject(["web"], (ctx) => {
 			ctx.web.registerSearchProvider(createCodexSearchProvider(oauth, { fetchFn: proxyFetch }));
 			ctx.web.registerFetchProvider(createCodexFetchProvider({
@@ -61163,19 +63261,22 @@ function apply(ctx, pluginConfig = {}) {
 			}));
 			setTimeout(applyWebProviders, 0);
 		});
-		const disposePreferenceWatch = preferences.watch((next) => applyWebProviders(next));
+		const disposePreferenceWatch = preferences.watch(() => applyWebProviders());
 		const disposeReadyWatch = ctx.get("appReady")?.onReady(() => applyWebProviders());
 		const disposeProxyWatch = proxyManager.onSystemProxyDetected(() => {
 			applyWebProviders();
 		});
+		const disposeWebProviderReconciler = startWebProviderReconciler({ reconcile: () => applyWebProviders() });
 		return () => {
 			searchSwitcher.dispose();
 			disposeReadyWatch?.();
 			disposeProxyWatch();
 			disposePreferenceWatch();
+			disposeWebProviderReconciler();
 			disposeImageTool();
 			disposeAntigravityImageTool();
 			disposeVideoTool();
+			disposeProgressUpdates();
 			disposeAdapter();
 			disposeRoutes();
 			disposeHubOverview();