@eddyskywalker/dsh-chatgpt-subscription 0.36.2 → 0.37.0

package/lib/index.js

@@ -803,7 +803,7 @@ async function rehydrateSnapshot(key) {
 * so a backend that flattens the envelope does not read as an empty catalog.
 */
 function parseListing(payload) {
-	const record = asRecord$16(payload);
+	const record = asRecord$18(payload);
 	const models = Array.isArray(payload) ? payload : record?.models;
 	if (!Array.isArray(models)) return [];
 	return models.flatMap((item) => parseListingEntry$1(item));
@@ -817,11 +817,11 @@ function parseListing(payload) {
 * back to a conservative answer rather than to a guess.
 */
 function parseListingEntry$1(value) {
-	const record = asRecord$16(value);
+	const record = asRecord$18(value);
 	if (record === void 0) return [];
 	const id = asString$25(record.slug) ?? asString$25(record.id);
 	if (id === void 0) return [];
-	const contextWindow = asNumber$6(record.context_window) ?? asNumber$6(record.contextWindow);
+	const contextWindow = asNumber$7(record.context_window) ?? asNumber$7(record.contextWindow);
 	const modalities = parseModalities(record.input_modalities);
 	const efforts = parseEfforts(record.supported_reasoning_levels);
 	const fallback = CODEX_MODEL_CATALOG.find((entry) => entry.id === id);
@@ -853,7 +853,7 @@ function parseEfforts(value) {
 	if (!Array.isArray(value)) return null;
 	const out = [];
 	for (const item of value) {
-		const effort = asString$25(item) ?? asString$25(asRecord$16(item)?.effort);
+		const effort = asString$25(item) ?? asString$25(asRecord$18(item)?.effort);
 		if (effort !== void 0 && !out.includes(effort)) out.push(effort);
 	}
 	return out.length > 0 ? out : null;
@@ -868,13 +868,13 @@ function parseEfforts(value) {
 function accountKeyFor$1(credentials) {
 	return credentials.accountId || "default";
 }
-function asRecord$16(value) {
+function asRecord$18(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
 function asString$25(value) {
 	return typeof value === "string" && value !== "" ? value : void 0;
 }
-function asNumber$6(value) {
+function asNumber$7(value) {
 	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
 //#endregion
@@ -8675,7 +8675,143 @@ function parseEnvProxy(env = process.env, options = {}) {
 	} catch {}
 	return null;
 }
-function detectSystemProxy(platform = process.platform, env = process.env) {
+/**
+* The raw `NO_PROXY` list, or an empty string when none is configured.
+*
+* Read next to the proxy itself on purpose: a proxy that a line is *told* to use
+* and a bypass list that lives somewhere else are how "the local gateway
+* suddenly goes through Clash" happens.
+*/
+function parseNoProxy(env = process.env, options = {}) {
+	const direct = env.NO_PROXY ?? env.no_proxy;
+	if (direct && direct.trim()) return direct.trim();
+	if (options.envFile === null) return "";
+	try {
+		const dshHome = env.DSH_HOME || path.join(os.homedir(), ".dsh");
+		const envFile = options.envFile ?? path.join(dshHome, ".env");
+		if (fs$1.existsSync(envFile)) {
+			const match = fs$1.readFileSync(envFile, "utf8").match(/^(?:export\s+)?(?:NO_PROXY|no_proxy)\s*=\s*["']?([^"'\r\n]*)["']?/m);
+			if (match) return (match[1] ?? "").trim();
+		}
+	} catch {}
+	return "";
+}
+/** {@link shouldBypassProxy} needs a port to honor a `host:port` entry. */
+function defaultPortFor(protocol) {
+	if (protocol === "http:") return "80";
+	if (protocol === "https:") return "443";
+	return "";
+}
+function normalizeHostForMatch(hostname) {
+	return hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+}
+/**
+* Whether a host is loopback, and therefore never worth a proxy hop.
+*
+* The whole `127.0.0.0/8` block, not just `127.0.0.1`: a second loopback alias
+* is a normal way to run a local gateway, and a proxy cannot reach it any
+* better than the process itself can.
+*/
+function isLoopbackHostname$1(hostname) {
+	const host = normalizeHostForMatch(hostname);
+	if (host === "localhost" || host.endsWith(".localhost")) return true;
+	if (host === "::1") return true;
+	const v4 = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+	return v4 !== null && v4[1] === "127";
+}
+/**
+* Standard `NO_PROXY` matching: `*`, exact hosts, domain suffixes, `host:port`.
+*
+* Deliberately not CIDR: a proxy configured for this plugin is a local GUI
+* proxy, and the entries that matter are the ones a user types.
+*/
+function noProxyBypasses(hostname, port, list) {
+	const host = normalizeHostForMatch(hostname);
+	for (const raw of list.split(",")) {
+		const entry = raw.trim().toLowerCase();
+		if (!entry) continue;
+		if (entry === "*") return true;
+		const withoutScheme = entry.replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/\/.*$/, "");
+		let entryHost = withoutScheme;
+		let entryPort = "";
+		const bracketed = withoutScheme.match(/^\[([^\]]+)\](?::(\d+))?$/);
+		if (bracketed) {
+			entryHost = bracketed[1];
+			entryPort = bracketed[2] ?? "";
+		} else if (withoutScheme.split(":").length === 2) {
+			const [name, candidate] = withoutScheme.split(":");
+			if (/^\d+$/.test(candidate)) {
+				entryHost = name;
+				entryPort = candidate;
+			}
+		}
+		const suffix = entryHost.replace(/^\./, "").replace(/\.$/, "");
+		if (!suffix) continue;
+		if (entryPort && entryPort !== port) continue;
+		if (host === suffix || host.endsWith("." + suffix)) return true;
+	}
+	return false;
+}
+/**
+* Whether a request target must skip the proxy.
+*
+* Loopback first: a local gateway behind a proxy hop is a request the proxy has
+* to refuse (or worse, forwards to itself), and the plugin's own loopback reads
+* already use a bare fetch for the same reason.
+*/
+function shouldBypassProxy(target, noProxyList = "") {
+	let url;
+	try {
+		url = typeof target === "string" ? new URL(target) : target;
+	} catch {
+		return false;
+	}
+	if (isLoopbackHostname$1(url.hostname)) return true;
+	if (!noProxyList) return false;
+	return noProxyBypasses(url.hostname, url.port || defaultPortFor(url.protocol), noProxyList);
+}
+/**
+* Read one GNOME proxy setting; `null` when `gsettings` is absent or the key is
+* unreadable (headless box, no dconf session).
+*/
+function readGsettings(key) {
+	try {
+		return execSync(`gsettings get ${key}`, {
+			timeout: 1500,
+			encoding: "utf-8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+	} catch {
+		return null;
+	}
+}
+/** gsettings prints strings single-quoted, ports bare, and absent keys as ''. */
+function gsettingsString(value) {
+	if (value === null) return "";
+	return value.replace(/^['"]|['"]$/g, "").trim();
+}
+/**
+* GNOME's manual proxy, the Linux equivalent of the Windows registry read.
+*
+* `auto` is a PAC URL, which cannot be applied by posting through an agent, and
+* `none` means no system proxy; both fall through to the environment.
+*/
+function parseLinuxSystemProxy(read) {
+	if (gsettingsString(read("org.gnome.system.proxy mode")).toLowerCase() !== "manual") return null;
+	const scheme = (name) => {
+		const host = gsettingsString(read(`org.gnome.system.proxy.${name} host`));
+		const port = Number(gsettingsString(read(`org.gnome.system.proxy.${name} port`)));
+		if (!host || !Number.isInteger(port) || port <= 0 || port > 65535) return null;
+		const authority = host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+		return `${name === "socks" ? "socks5" : "http"}://${authority}:${port}`;
+	};
+	return scheme("https") ?? scheme("http") ?? scheme("socks");
+}
+function detectSystemProxy(platform = process.platform, env = process.env, readSettings = readGsettings) {
 	try {
 		if (platform === "win32") {
 			const detected = parseWindowsProxyRegistry(execSync("reg query \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\"", {
@@ -8699,17 +8835,33 @@ function detectSystemProxy(platform = process.platform, env = process.env) {
 				]
 			}));
 			if (detected) return detected;
+		} else if (platform === "linux") {
+			const detected = parseLinuxSystemProxy(readSettings);
+			if (detected) return detected;
 		}
 	} catch {}
 	return parseEnvProxy(env);
 }
+/**
+* The URL a fetch call targets, for the bypass decision.
+*
+* A `Request` exposes its URL without consuming the body, so reading it here
+* costs the request nothing.
+*/
+function requestTarget(input) {
+	if (typeof input === "string" || input instanceof URL) return input;
+	return input.url;
+}
 var ProxyManager = class {
 	getPreferences;
 	baseFetch;
 	systemProxyDetector;
+	noProxyReader;
 	logger;
 	cachedSystemProxy = null;
 	lastSystemProxyCheck = 0;
+	cachedNoProxy = "";
+	lastNoProxyCheck = 0;
 	detected = false;
 	proxyListeners = /* @__PURE__ */ new Set();
 	agents = /* @__PURE__ */ new Map();
@@ -8717,6 +8869,7 @@ var ProxyManager = class {
 		this.getPreferences = options.getPreferences;
 		this.baseFetch = options.baseFetch ?? fetch;
 		this.systemProxyDetector = options.systemProxyDetector ?? (() => detectSystemProxy());
+		this.noProxyReader = options.noProxyReader ?? (() => parseNoProxy());
 		this.logger = options.logger;
 	}
 	getSystemProxy(force = false) {
@@ -8738,6 +8891,24 @@ var ProxyManager = class {
 		return this.cachedSystemProxy;
 	}
 	/**
+	* The active `NO_PROXY` list, re-read at most once per TTL.
+	*
+	* A reader that throws (an unreadable `$DSH_HOME/.env`) reads as "no bypass
+	* list", never as "bypass everything": the wrong guess in that direction would
+	* take an active proxy away from every line at once.
+	*/
+	getNoProxyList(force = false) {
+		const now = Date.now();
+		if (!force && now - this.lastNoProxyCheck < SYSTEM_PROXY_CACHE_TTL_MS) return this.cachedNoProxy;
+		this.lastNoProxyCheck = now;
+		try {
+			this.cachedNoProxy = this.noProxyReader().trim();
+		} catch {
+			this.cachedNoProxy = "";
+		}
+		return this.cachedNoProxy;
+	}
+	/**
 	* Observe the system proxy becoming known.
 	*
 	* A proxy that appears after startup — or a first detection that failed — otherwise leaves every
@@ -8775,6 +8946,7 @@ var ProxyManager = class {
 		return async (input, init) => {
 			const activeProxy = this.resolveActiveProxyUrl();
 			if (!activeProxy) return this.baseFetch(input, init);
+			if (shouldBypassProxy(requestTarget(input), this.getNoProxyList())) return this.baseFetch(input, init);
 			try {
 				const agent = this.getOrCreateAgent(activeProxy);
 				return await fetch$1(input, {
@@ -12962,6 +13134,2295 @@ function startWebProviderReconciler(options) {
 	};
 }
 //#endregion
+//#region src/host/widget-board/line-contracts.ts
+/**
+* Provider name this plugin registers under: the BARE package id, without the
+* `@eddyskywalker/` scope.
+*
+* A manifest names a data source or a capability as `<provider>:<id>`, and that
+* whole string has to match the board's id regular expression
+* `^[a-z][a-z0-9.-]{1,39}(?::[a-z][a-z0-9.-]{1,39})?$` — which accepts neither
+* `@` nor `/`. A scoped provider name would therefore be registrable on the host
+* and unreachable from every manifest, so the registration and the manifests
+* must agree on this literal.
+*/
+const WIDGET_BOARD_PROVIDER = "dsh-chatgpt-subscription";
+/** Data source: shape C for the line named by \`props.line\`. */
+const LINE_CARD_DATA_SOURCE_ID = "line-card";
+/** Capability: refresh one line's quota, then answer shape C. */
+const LINE_REFRESH_CAPABILITY_ID = "line-refresh";
+/** Capability: pin one pooled account of one line, then answer shape C. */
+const LINE_ACCOUNT_SWITCH_CAPABILITY_ID = "line-account-switch";
+/** Capability: change one line's rotation strategy, then answer shape C. */
+const LINE_ACCOUNT_STRATEGY_CAPABILITY_ID = "line-account-strategy";
+/** A list of those windows. */
+const LINE_CARD_WINDOWS_SCHEMA = {
+	type: "array",
+	items: {
+		type: "object",
+		additionalProperties: false,
+		required: [
+			"label",
+			"usedPercent",
+			"windowMinutes",
+			"resetsAt"
+		],
+		properties: {
+			label: { type: "string" },
+			usedPercent: {
+				type: "number",
+				minimum: 0,
+				maximum: 100
+			},
+			windowMinutes: { type: ["number", "null"] },
+			resetsAt: { type: ["number", "null"] }
+		}
+	}
+};
+/**
+* The JSON Schema a capability's return value is validated against.
+*
+* Capability outputs only, like the two older shapes: the DATA SOURCE's answer
+* is validated against the \`data\` schema of the card that reads it, which
+* lives in \`widgets/<id>/widget.json\` and is therefore a second declaration of
+* this shape (kept aligned by a test that compares their key sets literally).
+*/
+const LINE_CARD_SCHEMA = {
+	type: "object",
+	additionalProperties: false,
+	required: [
+		"line",
+		"label",
+		"signedIn",
+		"installed",
+		"planLabel",
+		"accountLabel",
+		"accounts",
+		"activeAccountId",
+		"strategy",
+		"quota",
+		"error"
+	],
+	properties: {
+		line: {
+			type: "string",
+			minLength: 1
+		},
+		label: { type: "string" },
+		signedIn: { type: "boolean" },
+		installed: { type: "boolean" },
+		planLabel: { type: ["string", "null"] },
+		accountLabel: { type: ["string", "null"] },
+		accounts: {
+			type: "array",
+			items: {
+				type: "object",
+				additionalProperties: false,
+				required: [
+					"id",
+					"label",
+					"email",
+					"primary",
+					"plan",
+					"cooldownUntil",
+					"authStatus",
+					"usedPercent",
+					"resetsAt"
+				],
+				properties: {
+					id: { type: "string" },
+					label: { type: "string" },
+					email: { type: ["string", "null"] },
+					primary: { type: "boolean" },
+					plan: { type: ["string", "null"] },
+					cooldownUntil: { type: ["number", "null"] },
+					authStatus: { enum: [
+						"ok",
+						"expired",
+						"invalid",
+						null
+					] },
+					usedPercent: {
+						type: ["number", "null"],
+						minimum: 0,
+						maximum: 100
+					},
+					resetsAt: { type: ["number", "null"] },
+					windows: LINE_CARD_WINDOWS_SCHEMA
+				}
+			}
+		},
+		activeAccountId: { type: ["string", "null"] },
+		strategy: { enum: [
+			"sequential",
+			"round-robin",
+			"sticky"
+		] },
+		quota: { anyOf: [{
+			type: "object",
+			additionalProperties: false,
+			required: [
+				"windows",
+				"credits",
+				"resetCredits",
+				"fetchedAt",
+				"refreshing",
+				"error"
+			],
+			properties: {
+				windows: LINE_CARD_WINDOWS_SCHEMA,
+				credits: { anyOf: [{
+					type: "object",
+					additionalProperties: false,
+					required: ["unlimited", "balance"],
+					properties: {
+						unlimited: { type: "boolean" },
+						balance: { type: ["string", "null"] }
+					}
+				}, { type: "null" }] },
+				resetCredits: { anyOf: [{
+					type: "object",
+					additionalProperties: false,
+					required: ["available", "expiresAt"],
+					properties: {
+						available: {
+							type: "integer",
+							minimum: 0
+						},
+						expiresAt: { type: ["number", "null"] }
+					}
+				}, { type: "null" }] },
+				fetchedAt: { type: ["number", "null"] },
+				refreshing: { type: "boolean" },
+				error: { type: ["string", "null"] }
+			}
+		}, { type: "null" }] },
+		error: { type: ["string", "null"] }
+	}
+};
+/** The \`line\` argument every line capability takes. */
+const LINE_ARGUMENT_PROPERTIES = { line: {
+	type: "string",
+	minLength: 1
+} };
+/** Arguments of the quota-refresh capability. */
+const LINE_REFRESH_INPUT_SCHEMA = {
+	type: "object",
+	additionalProperties: false,
+	required: ["line"],
+	properties: LINE_ARGUMENT_PROPERTIES
+};
+/** Arguments of the account-switch capability. */
+const LINE_ACCOUNT_SWITCH_INPUT_SCHEMA = {
+	type: "object",
+	additionalProperties: false,
+	required: ["line", "accountId"],
+	properties: {
+		...LINE_ARGUMENT_PROPERTIES,
+		accountId: {
+			type: "string",
+			minLength: 1
+		}
+	}
+};
+/** Arguments of the account-strategy capability. */
+const LINE_ACCOUNT_STRATEGY_INPUT_SCHEMA = {
+	type: "object",
+	additionalProperties: false,
+	required: ["line", "strategy"],
+	properties: {
+		...LINE_ARGUMENT_PROPERTIES,
+		strategy: { enum: [
+			"sequential",
+			"round-robin",
+			"sticky"
+		] }
+	}
+};
+//#endregion
+//#region src/host/widget-board/line-quota.ts
+/**
+* Anything past this instant is treated as "no reset stated".
+*
+* The lines are inconsistent about sentinels, not about arithmetic: qoder
+* reports `expiresAt: 253402214400000`, which is 9999-12-31 and means "never",
+* and a card that rendered it would print a reset date eight thousand years
+* out. No real window reopens after 2100, so that is the ceiling — applied when
+* a window is built, so every line inherits it rather than each one having to
+* remember.
+*/
+const SANE_TIMESTAMP_CEILING_MS = 41024448e5;
+/**
+* The payload as a JSON object, or null.
+*
+* @param value - Candidate.
+* @returns The object, or null for anything else (arrays included).
+*/
+function asRecord$17(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+/**
+* The payload as a list of JSON objects, dropping anything that is not one.
+*
+* @param value - Candidate.
+* @returns The objects; empty for a non-array.
+*/
+function asRecords(value) {
+	if (!Array.isArray(value)) return [];
+	const records = [];
+	for (const entry of value) {
+		const record = asRecord$17(entry);
+		if (record !== null) records.push(record);
+	}
+	return records;
+}
+/**
+* A trimmed non-empty string, or null.
+*
+* @param value - Candidate.
+* @returns The trimmed text, or null.
+*/
+function asText$4(value) {
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	return trimmed === "" ? null : trimmed;
+}
+/**
+* A finite number, or null.
+*
+* @param value - Candidate.
+* @returns The number, or null.
+*/
+function asNumber$6(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+/**
+* A boolean as stated, or null when the payload said something else.
+*
+* @param value - Candidate.
+* @returns The boolean, or null.
+*/
+function asBoolean$2(value) {
+	return typeof value === "boolean" ? value : null;
+}
+/**
+* A Unix MILLISECONDS instant, when the payload already states one.
+*
+* @param value - Candidate.
+* @returns Milliseconds rounded to a whole number, or null.
+*/
+function asMs(value) {
+	const number = asNumber$6(value);
+	if (number === null || number <= 0) return null;
+	return Math.round(number);
+}
+/**
+* A Unix SECONDS instant as milliseconds.
+*
+* @param value - Candidate.
+* @returns Milliseconds, or null when nothing usable was stated.
+*/
+function asSecondsToMs(value) {
+	const number = asNumber$6(value);
+	if (number === null || number <= 0) return null;
+	return Math.round(number * 1e3);
+}
+/**
+* An ISO 8601 instant as Unix milliseconds.
+*
+* @param value - Candidate.
+* @returns Milliseconds, or null for an absent or unparseable string.
+*/
+function asIsoToMs(value) {
+	const text = asText$4(value);
+	if (text === null) return null;
+	const parsed = Date.parse(text);
+	return Number.isFinite(parsed) && parsed > 0 ? parsed : null;
+}
+/**
+* A reset instant, with the sentinel ceiling applied.
+*
+* @param value - Milliseconds, or null.
+* @returns The instant, or null when absent or implausible.
+*/
+function asResetAt(value) {
+	if (value === null || value <= 0) return null;
+	return value > SANE_TIMESTAMP_CEILING_MS ? null : value;
+}
+/**
+* A share in percent, clamped into the bar it is drawn as.
+*
+* @param value - Candidate.
+* @returns The share between 0 and 100, or null when there was none.
+*/
+function asPercent(value) {
+	const number = asNumber$6(value);
+	if (number === null) return null;
+	return Math.min(100, Math.max(0, number));
+}
+/**
+* A fraction in [0, 1] as percent.
+*
+* @param value - Candidate.
+* @returns Percent, or null when there was none.
+*/
+function asFractionPercent(value) {
+	const number = asNumber$6(value);
+	if (number === null) return null;
+	return Math.min(100, Math.max(0, number * 100));
+}
+/**
+* A percent still available, inverted into the used share.
+*
+* @param value - Candidate.
+* @returns The used share, or null when there was none.
+*/
+function remainingPercentToUsed(value) {
+	const remaining = asPercent(value);
+	return remaining === null ? null : 100 - remaining;
+}
+/**
+* A remaining fraction in [0, 1] inverted into percent used.
+*
+* @param value - Candidate.
+* @returns The used share, or null when there was none.
+*/
+function remainingFractionToUsed(value) {
+	const remaining = asFractionPercent(value);
+	return remaining === null ? null : 100 - remaining;
+}
+/**
+* The conventional name of a window length.
+*
+* Used when the line itself states no label (minimax keys its windows as
+* `interval` / `weekly`, deliberately leaving the wording to the client) and as
+* a fallback under a label the line left blank. Only lengths that are
+* unambiguous get a name; anything else stays unnamed rather than mislabelled.
+*
+* @param minutes - Nominal window length.
+* @returns The label, or null when the length is not a conventional one.
+*/
+function standardWindowLabel(minutes) {
+	switch (minutes) {
+		case 300: return "5 小时";
+		case 1440: return "每日";
+		case 10080: return "每周";
+		case 43200: return "每月";
+		default: return null;
+	}
+}
+/** The window length each named window of the lines that name one stands for. */
+const NAMED_WINDOW_MINUTES = {
+	"5h": 300,
+	five_hour: 300,
+	"five-hour": 300,
+	interval: 300,
+	daily: 1440,
+	monthly: 43200,
+	week: 10080,
+	weekly: 10080,
+	seven_day: 10080,
+	"7d": 10080
+};
+/**
+* The window length a line's own window key stands for.
+*
+* @param key - The line's key (`5h`, `five-hour`, `weekly`, …).
+* @returns Minutes, or null when the key is not one this module knows.
+*/
+function namedWindowMinutes(key) {
+	const text = asText$4(key);
+	if (text === null) return null;
+	return NAMED_WINDOW_MINUTES[text.toLowerCase()] ?? null;
+}
+/**
+* One window, or null when nothing measured its consumption.
+*
+* A window with no used share is dropped rather than drawn as a full bar: the
+* lines say null for "the source told us nothing", and painting that as 100%
+* would report a limit nobody measured.
+*
+* @param seed - The mapped fields.
+* @returns The window, or null.
+*/
+function windowOf(seed) {
+	const usedPercent = seed.usedPercent === null || seed.usedPercent === void 0 ? null : Math.min(100, Math.max(0, seed.usedPercent));
+	if (usedPercent === null) return null;
+	const windowMinutes = seed.windowMinutes === null || seed.windowMinutes === void 0 ? null : seed.windowMinutes;
+	return {
+		label: asText$4(seed.label) ?? standardWindowLabel(windowMinutes) ?? "",
+		usedPercent,
+		windowMinutes,
+		resetsAt: asResetAt(seed.resetsAt ?? null)
+	};
+}
+/**
+* Every window the seeds offered, dropping the ones that measured nothing.
+*
+* @param seeds - Candidate windows.
+* @returns The windows that survived.
+*/
+function windowsFrom(seeds) {
+	const windows = [];
+	for (const seed of seeds) {
+		const window = windowOf(seed);
+		if (window !== null) windows.push(window);
+	}
+	return windows;
+}
+/**
+* Shortest window first, unstated lengths last.
+*
+* @param left - First window.
+* @param right - Second window.
+* @returns The comparator result.
+*/
+function byWindowLength(left, right) {
+	if (left.windowMinutes === right.windowMinutes) return 0;
+	if (left.windowMinutes === null) return 1;
+	if (right.windowMinutes === null) return -1;
+	return left.windowMinutes - right.windowMinutes;
+}
+/**
+* A quota, or null when the line answered nothing a card could draw.
+*
+* "Nothing to draw" is exactly: no window, no credit figure, no reset credit,
+* and no fetch instant. A payload in that state is reported as `quota: null`
+* so a card shows its placeholder instead of an empty frame that looks like a
+* measured zero.
+*
+* @param seed - The mapped fields.
+* @returns The quota, or null.
+*/
+function quotaOf(seed) {
+	const windows = [...seed.windows ?? []].sort(byWindowLength);
+	const credits = seed.credits ?? null;
+	const resetCredits = seed.resetCredits ?? null;
+	const fetchedAt = asMs(seed.fetchedAt ?? null);
+	if (windows.length === 0 && credits === null && resetCredits === null && fetchedAt === null) return null;
+	return {
+		windows,
+		credits,
+		resetCredits,
+		fetchedAt,
+		refreshing: seed.refreshing === true,
+		error: asText$4(seed.error)
+	};
+}
+/**
+* The facts one payload yields.
+*
+* A line's own failure message lands in `quota.error` when there IS a quota to
+* annotate, and in the card-level `error` when there is not — the same sentence
+* either way, placed where the card can actually render it.
+*
+* @param seed - The mapped fields.
+* @returns The facts.
+*/
+function factsOf(seed) {
+	const error = asText$4(seed.error);
+	const quota = quotaOf(seed);
+	return {
+		quota: quota === null ? null : {
+			...quota,
+			error
+		},
+		planLabel: asText$4(seed.planLabel),
+		accountLabel: asText$4(seed.accountLabel),
+		signedIn: asBoolean$2(seed.signedIn),
+		error: quota === null ? error : null
+	};
+}
+/**
+* The facts of a payload that could not be read at all.
+*
+* @param error - Why the payload was unusable.
+* @returns The facts, with nothing measured.
+*/
+function unavailableFacts(error) {
+	return {
+		quota: null,
+		planLabel: null,
+		accountLabel: null,
+		signedIn: null,
+		error
+	};
+}
+/**
+* The first non-null text of a candidate list.
+*
+* @param values - Candidates, most specific first.
+* @returns The first text that was stated, or null.
+*/
+function firstText(values) {
+	for (const value of values) {
+		const text = asText$4(value);
+		if (text !== null) return text;
+	}
+	return null;
+}
+/**
+* A balance as a string, keeping its unit.
+*
+* @param balance - The line's own figure.
+* @param unit - Unit to append, when the line states one.
+* @returns The balance, or null when there was none.
+*/
+function balanceOf(balance, unit) {
+	const number = asNumber$6(balance);
+	const suffix = unit === null || unit === void 0 ? "" : " " + unit;
+	if (number === null) {
+		const text = asText$4(balance);
+		return text === null ? null : text + suffix;
+	}
+	return String(number) + suffix;
+}
+/**
+* The display name of one Qoder allowance.
+*
+* @param kind - The line's bucket kind.
+* @returns The label, or null when the kind is not one this module knows.
+*/
+function bucketLabel(kind) {
+	switch (asText$4(kind)) {
+		case "personal": return "个人额度";
+		case "add-on": return "加购额度";
+		case "org": return "组织额度";
+		default: return null;
+	}
+}
+/**
+* The ChatGPT line's quota, as `GET /status` answers it.
+*
+* Units: `QuotaWindowDto.resetsAt`, `resetCredits.expiresAt` and
+* `quota.fetchedAt` are Unix SECONDS here (that line's own quota service
+* multiplies them by 1000 further out), while everything else on the payload is
+* already milliseconds. The bucket list also carries an older
+* `primary`/`secondary` pair that some payload generations state instead of
+* `windows`; both are read, so the card shows the same bars the settings card
+* does.
+*
+* @param status - The route's `value`.
+* @returns The facts.
+*/
+function normalizeCodexQuota(status) {
+	const root = asRecord$17(status);
+	if (root === null) return unavailableFacts(null);
+	const quotaBody = asRecord$17(root.quota);
+	const account = asRecord$17(root.account);
+	const buckets = asRecords(quotaBody?.buckets);
+	const seeds = [];
+	for (const bucket of buckets) {
+		const stated = asRecords(bucket.windows);
+		const source = stated.length > 0 ? stated : [asRecord$17(bucket.primary), asRecord$17(bucket.secondary)];
+		for (const window of source) {
+			if (window === null) continue;
+			seeds.push({
+				label: asText$4(window.label),
+				usedPercent: asPercent(window.usedPercent),
+				windowMinutes: asNumber$6(window.windowDurationMins),
+				resetsAt: asSecondsToMs(window.resetsAt)
+			});
+		}
+	}
+	const creditsBody = asRecord$17(quotaBody?.credits);
+	const credits = creditsBody === null ? null : {
+		unlimited: creditsBody.unlimited === true,
+		balance: asText$4(creditsBody.balance)
+	};
+	const resetBody = asRecord$17(quotaBody?.resetCredits);
+	const resetCredits = resetBody === null ? null : {
+		available: Math.max(0, Math.trunc(asNumber$6(resetBody.availableCount) ?? 0)),
+		expiresAt: asResetAt(asSecondsToMs(resetBody.expiresAt))
+	};
+	const planLabel = firstText([...buckets.map((bucket) => bucket.planType), account?.planType]);
+	const state = asText$4(quotaBody?.state);
+	return factsOf({
+		windows: windowsFrom(seeds),
+		credits,
+		resetCredits,
+		fetchedAt: asSecondsToMs(quotaBody?.fetchedAt),
+		refreshing: root.quotaRefreshing === true,
+		error: firstText([asRecord$17(quotaBody?.error)?.message]),
+		planLabel,
+		accountLabel: account?.email,
+		signedIn: asBoolean$2(root.authenticated) ?? (state === null ? null : state !== "signed-out")
+	});
+}
+/**
+* The Kimi Code line's quota.
+*
+* Units: `resetsAt` and `fetchedAt` are already milliseconds. The fallback
+* wallet (`extraUsage`) is stated in the currency's minor unit, so it is
+* divided once and kept with its currency: a bare "75.00" would be read as
+* provider credits by every other card on the board.
+*
+* @param status - The route's `value`.
+* @returns The facts.
+*/
+function normalizeKimiCodeQuota(status) {
+	const root = asRecord$17(status);
+	if (root === null) return unavailableFacts(null);
+	const quotaBody = asRecord$17(root.quota);
+	const account = asRecord$17(root.account);
+	const extra = asRecord$17(quotaBody?.extraUsage);
+	const balanceCents = asNumber$6(extra?.balanceCents);
+	const currency = asText$4(extra?.currency);
+	const credits = balanceCents === null ? null : {
+		unlimited: false,
+		balance: (balanceCents / 100).toFixed(2) + (currency === null ? "" : " " + currency)
+	};
+	return factsOf({
+		windows: windowsFrom(asRecords(quotaBody?.windows).map((window) => ({
+			label: asText$4(window.label),
+			usedPercent: asPercent(window.usedPercent),
+			windowMinutes: asNumber$6(window.windowDurationMins),
+			resetsAt: asMs(window.resetsAt)
+		}))),
+		credits,
+		resetCredits: null,
+		fetchedAt: asMs(quotaBody?.fetchedAt),
+		refreshing: root.quotaRefreshing === true,
+		error: firstText([root.quotaError]),
+		planLabel: firstText([quotaBody?.planName, account?.planName]),
+		accountLabel: firstText([account?.email, account?.nickname]),
+		signedIn: root.authenticated
+	});
+}
+/**
+* The MiniMax Code line's quota.
+*
+* Units: milliseconds throughout (`resetsAtMs`, `fetchedAtMs`). The windows are
+* keyed (`interval` / `weekly`) rather than labelled — the line leaves the
+* wording to the client — and carry a REMAINING percent, sometimes only a
+* remaining one; both are inverted into the used share here.
+*
+* @param status - The route's `value`.
+* @returns The facts.
+*/
+function normalizeMinimaxCodeQuota(status) {
+	const root = asRecord$17(status);
+	if (root === null) return unavailableFacts(null);
+	const quotaBody = asRecord$17(root.quota);
+	const seeds = asRecords(quotaBody?.windows).map((window) => ({
+		label: null,
+		usedPercent: asPercent(window.usedPercent) ?? remainingPercentToUsed(window.remainingPercent),
+		windowMinutes: namedWindowMinutes(window.key),
+		resetsAt: asMs(window.resetsAtMs)
+	}));
+	if (seeds.length === 0) {
+		const headline = asPercent(quotaBody?.usedPercent);
+		if (headline !== null) seeds.push({
+			label: null,
+			usedPercent: headline,
+			windowMinutes: 300,
+			resetsAt: asMs(quotaBody?.resetsAtMs)
+		});
+	}
+	const accounts = asRecords(root.accounts);
+	const activeId = asText$4(root.activeAccountId);
+	const active = accounts.find((account) => asText$4(account.id) === activeId) ?? accounts.find((account) => asText$4(account.email) !== null);
+	return factsOf({
+		windows: windowsFrom(seeds),
+		credits: null,
+		resetCredits: null,
+		fetchedAt: asMs(quotaBody?.fetchedAtMs),
+		refreshing: root.quotaRefreshing === true,
+		error: firstText([root.quotaError]),
+		planLabel: firstText([quotaBody?.label]),
+		accountLabel: firstText([active?.email]),
+		signedIn: root.authenticated
+	});
+}
+/**
+* The Antigravity line's quota.
+*
+* Units: the harder one of the set. Each allowance is stated as
+* `remainingFraction` in [0, 1] (null when the service measured nothing, and
+* NOT zero), named windows arrive as `window: '5h' | 'weekly'`, and reset
+* instants as ISO 8601. Windows are grouped (Gemini models, third-party
+* models); each bucket's label is prefixed with its group once there is more
+* than one group, because "Weekly" twice on one card says nothing about which
+* allowance it is.
+*
+* @param status - The route's `value`.
+* @returns The facts.
+*/
+function normalizeAntigravityQuota(status) {
+	const root = asRecord$17(status);
+	if (root === null) return unavailableFacts(null);
+	const quotaBody = asRecord$17(root.quota);
+	const groups = asRecords(quotaBody?.groups);
+	const seeds = [];
+	for (const group of groups) {
+		const groupName = groups.length > 1 ? asText$4(group.displayName) : null;
+		for (const bucket of asRecords(group.buckets)) {
+			const minutes = namedWindowMinutes(bucket.window);
+			const windowName = standardWindowLabel(minutes) ?? asText$4(bucket.displayName);
+			seeds.push({
+				label: groupName === null || windowName === null ? windowName : groupName + " · " + windowName,
+				usedPercent: remainingFractionToUsed(bucket.remainingFraction),
+				windowMinutes: minutes,
+				resetsAt: asIsoToMs(bucket.resetTime)
+			});
+		}
+	}
+	const paidTier = asRecord$17(quotaBody?.paidTier);
+	const productTier = asRecord$17(quotaBody?.productTier);
+	return factsOf({
+		windows: windowsFrom(seeds),
+		credits: null,
+		resetCredits: null,
+		fetchedAt: asMs(quotaBody?.fetchedAt) ?? asMs(root.lastFetchedAt),
+		refreshing: root.quotaRefreshing === true,
+		error: firstText([root.quotaError]),
+		planLabel: firstText([
+			quotaBody?.planLabel,
+			paidTier?.name,
+			productTier?.name
+		]),
+		accountLabel: firstText([root.email]),
+		signedIn: root.authenticated
+	});
+}
+/**
+* The Command Code line's quota.
+*
+* Units: two different meter shapes, and both are needed. `windows[]` is
+* already normalized (`usedPercent`, `windowDurationMins`, milliseconds);
+* `meters[]` states a used FRACTION that is null whenever the service reports a
+* spend meter instead of a bounded allowance, and only the ones that did state
+* a fraction become bars. The credit balance is that line's own string, kept
+* verbatim.
+*
+* @param status - The route's `value`.
+* @returns The facts.
+*/
+function normalizeCommandCodeQuota(status) {
+	const root = asRecord$17(status);
+	if (root === null) return unavailableFacts(null);
+	const quotaBody = asRecord$17(root.quota);
+	const windows = windowsFrom(asRecords(quotaBody?.windows).map((window) => ({
+		label: asText$4(window.label),
+		usedPercent: asPercent(window.usedPercent),
+		windowMinutes: asNumber$6(window.windowDurationMins),
+		resetsAt: asMs(window.resetsAt)
+	})));
+	if (windows.length === 0) for (const meter of asRecords(quotaBody?.meters)) windows.push(...windowsFrom([{
+		label: asText$4(meter.label),
+		usedPercent: asFractionPercent(meter.usedFraction),
+		windowMinutes: null,
+		resetsAt: asMs(meter.resetsAt)
+	}]));
+	const account = asRecord$17(root.account) ?? asRecord$17(quotaBody?.account);
+	return factsOf({
+		windows,
+		credits: quotaBody === null ? null : {
+			unlimited: quotaBody.unlimited === true,
+			balance: asText$4(quotaBody.creditBalance)
+		},
+		resetCredits: null,
+		fetchedAt: asMs(quotaBody?.fetchedAt) ?? asMs(root.lastFetchedAt),
+		refreshing: root.quotaRefreshing === true,
+		error: firstText([root.quotaError]),
+		planLabel: firstText([quotaBody?.planName, account?.planLabel]),
+		accountLabel: firstText([account?.email]),
+		signedIn: root.authenticated
+	});
+}
+/**
+* The Claude line's quota.
+*
+* Units: millisecond `fetchedAt` / `observedAt`, ISO 8601 `resetsAt`, and a
+* used share that may be stated as percent or as a fraction in [0, 1] — the
+* three numeric fields are null together when the source said nothing, so the
+* fraction is only consulted when the percent is absent.
+*
+* The line answers `quota: null` on a first read and only fills it after its
+* own `POST /quota`; that is what the refresh capability exists for, so an
+* empty first read is reported as-is rather than as an error.
+*
+* @param status - The route's `value`.
+* @returns The facts.
+*/
+function normalizeClaudeQuota(status) {
+	const root = asRecord$17(status);
+	if (root === null) return unavailableFacts(null);
+	const quotaBody = asRecord$17(root.quota);
+	const account = asRecord$17(root.account);
+	return factsOf({
+		windows: windowsFrom(asRecords(quotaBody?.windows).map((window) => {
+			const minutes = asNumber$6(window.windowMinutes) ?? namedWindowMinutes(window.id);
+			return {
+				label: asText$4(window.label) ?? standardWindowLabel(minutes),
+				usedPercent: asPercent(window.usedPercent) ?? asFractionPercent(window.usedFraction),
+				windowMinutes: minutes,
+				resetsAt: asIsoToMs(window.resetsAt)
+			};
+		})),
+		credits: null,
+		resetCredits: null,
+		fetchedAt: asMs(quotaBody?.fetchedAt) ?? asMs(quotaBody?.observedAt),
+		refreshing: root.quotaRefreshing === true,
+		error: firstText([root.quotaError]),
+		planLabel: firstText([account?.subscriptionType]),
+		accountLabel: firstText([account?.email]),
+		signedIn: root.authenticated
+	});
+}
+/**
+* The GLM Coding Plan line's quota.
+*
+* Units: milliseconds (`resetsAt`, `fetchedAt`). Windows are keyed
+* (`five-hour` / `weekly` / `monthly`) and their used percent is null when the
+* upstream reported no bounded allowance — an unlimited plan states no
+* fraction, and drawing that as 0% used would invent a measurement.
+*
+* @param status - The route's `value`.
+* @returns The facts.
+*/
+function normalizeGlmCodingPlanQuota(status) {
+	const root = asRecord$17(status);
+	if (root === null) return unavailableFacts(null);
+	const quotaBody = asRecord$17(root.quota);
+	return factsOf({
+		windows: windowsFrom(asRecords(quotaBody?.windows).map((window) => {
+			const minutes = namedWindowMinutes(window.key);
+			return {
+				label: standardWindowLabel(minutes),
+				usedPercent: asPercent(window.usedPercent),
+				windowMinutes: minutes,
+				resetsAt: asMs(window.resetsAt)
+			};
+		})),
+		credits: null,
+		resetCredits: null,
+		fetchedAt: asMs(quotaBody?.fetchedAt),
+		refreshing: root.quotaRefreshing === true,
+		error: firstText([root.quotaError]),
+		planLabel: firstText([quotaBody?.planName, quotaBody?.planLevel]),
+		signedIn: root.authenticated
+	});
+}
+/**
+* The Step Code line's quota.
+*
+* Units: milliseconds. Two payload generations share one snapshot: an older
+* account has 5-hour and weekly windows, a newer one has `creditBuckets` — an
+* absolute amount per bucket, with no percentage at all. The buckets become the
+* card's credit figure (their remaining amounts summed) rather than being
+* squeezed into a progress bar nobody measured; the `credit` window key, which
+* names the same thing, is deliberately left without a bar for the same reason.
+*
+* @param status - The route's `value`.
+* @returns The facts.
+*/
+function normalizeStepCodeQuota(status) {
+	const root = asRecord$17(status);
+	if (root === null) return unavailableFacts(null);
+	const quotaBody = asRecord$17(root.quota);
+	let remaining = 0;
+	let hasRemaining = false;
+	for (const bucket of asRecords(quotaBody?.creditBuckets)) {
+		const amount = asNumber$6(bucket.remaining);
+		if (amount === null) continue;
+		remaining += amount;
+		hasRemaining = true;
+	}
+	const credits = hasRemaining ? {
+		unlimited: false,
+		balance: String(Math.round(remaining * 100) / 100)
+	} : null;
+	const account = asRecord$17(root.account) ?? asRecord$17(asRecord$17(root.quotaCredential)?.account);
+	return factsOf({
+		windows: windowsFrom(asRecords(quotaBody?.windows).map((window) => {
+			const minutes = window.key === "credit" ? null : namedWindowMinutes(window.key);
+			return {
+				label: standardWindowLabel(minutes) ?? (window.key === "credit" ? "Credits" : null),
+				usedPercent: asPercent(window.usedPercent),
+				windowMinutes: minutes,
+				resetsAt: asMs(window.resetsAt)
+			};
+		})),
+		credits,
+		resetCredits: null,
+		fetchedAt: asMs(quotaBody?.fetchedAt),
+		refreshing: root.quotaRefreshing === true,
+		error: firstText([root.quotaError]),
+		planLabel: firstText([quotaBody?.planName]),
+		accountLabel: firstText([account?.email]),
+		signedIn: root.authenticated
+	});
+}
+/**
+* The Qoder line's quota.
+*
+* Units: milliseconds, with one sentinel: the account period ends at
+* `253402214400000` (year 9999) for a subscription that never expires, and a
+* card would print that as a real date, so the shared ceiling drops it.
+*
+* Qoder states ABSOLUTE amounts (total / used / remaining + unit), not windows.
+* A ratio is derived only when both total and used are stated AND total is
+* positive; anything else is reported as a credit balance instead of a bar.
+*
+* @param status - The route's `value`.
+* @returns The facts.
+*/
+function normalizeQoderQuota(status) {
+	const root = asRecord$17(status);
+	if (root === null) return unavailableFacts(null);
+	const quotaBody = asRecord$17(root.quota);
+	const expiresAt = asResetAt(asMs(quotaBody?.expiresAt));
+	const seeds = [];
+	let credits = null;
+	for (const bucket of asRecords(quotaBody?.buckets)) {
+		const total = asNumber$6(bucket.total);
+		const remaining = asNumber$6(bucket.remaining);
+		const used = asNumber$6(bucket.used) ?? (total !== null && remaining !== null ? total - remaining : null);
+		if (total !== null && total > 0 && used !== null) seeds.push({
+			label: bucketLabel(bucket.kind),
+			usedPercent: used / total * 100,
+			windowMinutes: null,
+			resetsAt: expiresAt
+		});
+		if (credits === null && remaining !== null) credits = {
+			unlimited: false,
+			balance: balanceOf(remaining, asText$4(bucket.unit))
+		};
+	}
+	const account = asRecord$17(root.account);
+	return factsOf({
+		windows: windowsFrom(seeds),
+		credits,
+		resetCredits: null,
+		fetchedAt: asMs(quotaBody?.fetchedAt),
+		refreshing: root.quotaRefreshing === true,
+		error: firstText([root.quotaError]),
+		planLabel: null,
+		accountLabel: firstText([account?.email]),
+		signedIn: root.authenticated
+	});
+}
+/**
+* The Cline Pass line's quota.
+*
+* Units: `percentUsed` is a percent, `resetsAt` is an ISO 8601 string, and the
+* window's length is only stated as a gateway token (`five_hour` / `weekly` /
+* `monthly`). The payload carries one reading PER ACCOUNT, so the row shown is
+* the pool's active account when it has a reading, else the first account that
+* did read something. An account that failed states its own reason, which is
+* what the card shows instead of an empty frame.
+*
+* @param status - The route's `value`.
+* @returns The facts.
+*/
+function normalizeClinePassQuota(status) {
+	const root = asRecord$17(status);
+	if (root === null) return unavailableFacts(null);
+	const usage = asRecord$17(root.usage);
+	const readings = asRecords(usage?.accounts);
+	const activeId = asText$4(asRecord$17(root.pool)?.activeAccountId);
+	const reading = readings.find((entry) => asText$4(entry.accountId) === activeId) ?? readings.find((entry) => asRecords(entry.windows).length > 0) ?? readings[0];
+	return factsOf({
+		windows: windowsFrom(asRecords(reading?.windows).map((window) => {
+			const minutes = namedWindowMinutes(window.type);
+			return {
+				label: asText$4(window.label) ?? standardWindowLabel(minutes),
+				usedPercent: asPercent(window.percentUsed),
+				windowMinutes: minutes,
+				resetsAt: asIsoToMs(window.resetsAt)
+			};
+		})),
+		credits: null,
+		resetCredits: null,
+		fetchedAt: asMs(reading?.fetchedAt) ?? asMs(usage?.fetchedAt),
+		refreshing: root.quotaRefreshing === true,
+		error: firstText([root.quotaError, reading?.error]),
+		planLabel: null,
+		accountLabel: null,
+		signedIn: root.authenticated
+	});
+}
+/**
+* An integer credit amount the service states as a STRING.
+*
+* `/billing/coding-plan-usage` strings its amounts (`"1000"`), and a number-shaped
+* field of any other type is not one: reading a float as credits would let a
+* rounded value become a denominator.
+*
+* @param value - Candidate.
+* @returns The amount, or null when it is not an integer string.
+*/
+function asCreditAmount(value) {
+	const text = asText$4(value);
+	if (text === null || !/^\d+$/.test(text)) return null;
+	const amount = Number(text);
+	return Number.isFinite(amount) ? amount : null;
+}
+/**
+* The used share of one window, from the two amounts that bound it.
+*
+* `(limit − remaining) / limit` in percent, rounded to the one decimal the bar is
+* drawn at and clamped into 0-100. A remainder larger than the limit (a top-up
+* rides outside the window upstream) clamps to 0 rather than reporting a bar
+* running backwards, and nothing left is exactly a full bar. The REMAINING
+* percentage the console shows is `100 − this`; no second derivation exists.
+*
+* @param limit - Credits the window grants; positive, which the caller checks.
+* @param remaining - Credits the window still has.
+* @returns The used share in 0-100 with one decimal.
+*/
+function usedSharePercent(limit, remaining) {
+	const share = (limit - remaining) / limit * 100;
+	return Math.min(100, Math.max(0, Math.round(share * 10) / 10));
+}
+/**
+* Every Design Plan window one account stated, in the card's own vocabulary.
+*
+* Two amounts and one length make a bar; a window that states less is dropped
+* rather than patched, because a guessed denominator is a progress bar claiming
+* a limit nobody measured. `durationSeconds` is the service's own unit (18000 is
+* the 5-hour window, 604800 the 7-day one) and becomes minutes here because that
+* is what every other line's card already reads.
+*
+* The LABEL stays empty on purpose: the length is the fact, and the card words it
+* (`5 小时` / `7 天`). Writing that wording here would put a second, competing
+* vocabulary in the host for the same window.
+*
+* @param codingPlan - The account's `codingPlan` object, when it had one.
+* @returns The windows, shortest first; empty when the read stated none.
+*/
+function codingPlanWindows(codingPlan) {
+	const windows = [];
+	for (const window of asRecords(codingPlan?.windows)) {
+		const limit = asCreditAmount(window.limitCredits);
+		const remaining = asCreditAmount(window.remainingCredits);
+		if (limit === null || limit <= 0 || remaining === null) continue;
+		const seconds = asNumber$6(window.durationSeconds);
+		windows.push({
+			label: "",
+			usedPercent: usedSharePercent(limit, remaining),
+			windowMinutes: seconds === null || seconds <= 0 ? null : Math.round(seconds / 60),
+			resetsAt: asIsoToMs(window.resetsAt)
+		});
+	}
+	return windows.sort(byWindowLength);
+}
+/**
+* The OpenDesign line's quota.
+*
+* Units: this line's REAL allowance is the "Design Plan" window pair the console
+* renders as a remaining percentage — a 5-hour window and a 7-day one, each
+* stating an integer credit LIMIT and what is LEFT of it, plus an ISO reset
+* instant. A bar is therefore the USED share, `(limit − remaining) / limit`;
+* the remaining percentage is `100 − used` and is derived by whoever prints it.
+*
+* `quota.credits` keeps the WALLET balance, and only that: the spendable USD
+* figure is a different quantity from a window's allowance, and folding one into
+* the other is how a card ends up stating a percentage of the wrong thing.
+*
+* Absence is the honest half of this reader. The endpoint is only known to accept
+* a browser session, so a control-key read may be refused; `codingPlan.error`
+* then carries the reason and `windows` is empty. An empty list is reported as
+* exactly that — never padded with a 0 % bar, which would claim a limit nobody
+* observed — and the reason rides along so the card can say why.
+*
+* @param status - The route's `value`.
+* @returns The facts.
+*/
+function normalizeOpenDesignQuota(status) {
+	const root = asRecord$17(status);
+	if (root === null) return unavailableFacts(null);
+	const usage = asRecord$17(root.usage);
+	const readings = asRecords(usage?.accounts);
+	const activeId = asText$4(asRecord$17(root.pool)?.activeAccountId);
+	const reading = readings.find((entry) => asText$4(entry.accountId) === activeId) ?? readings.find((entry) => asText$4(entry.balanceUsd) !== null) ?? readings[0];
+	const balance = asText$4(reading?.balanceUsd);
+	const credits = balance === null ? null : {
+		unlimited: false,
+		balance: balance + " USD"
+	};
+	const codingPlan = asRecord$17(reading?.codingPlan);
+	return factsOf({
+		windows: codingPlanWindows(codingPlan),
+		credits,
+		resetCredits: null,
+		fetchedAt: asMs(reading?.fetchedAt) ?? asMs(usage?.fetchedAt),
+		refreshing: root.quotaRefreshing === true,
+		error: firstText([
+			root.quotaError,
+			reading?.error,
+			codingPlan?.error
+		]),
+		planLabel: firstText([asRecord$17(reading?.billing)?.plan, codingPlan?.tier]),
+		accountLabel: null,
+		signedIn: root.authenticated
+	});
+}
+/**
+* The Qoder account's own reading, from one `quota/usage` snapshot.
+*
+* Qoder states ABSOLUTE amounts per bucket (total / used / remaining), never a
+* percentage, so a share is derived here only under the same rule
+* {@link normalizeQoderQuota} already applies to the line-level card: BOTH a
+* total (positive) and a used figure must be stated. A bucket that states
+* amounts without a bounded allowance — a top-up balance, an org cap nobody
+* measured — is not turned into a bar, and a snapshot with no such bucket
+* answers null rather than a made-up zero.
+*
+* No window list accompanies it: this line has no percentage windows at all
+* (its buckets are absolute amounts, and its only instant is the snapshot's own
+* expiry), so `windows` is `[]` — the honest answer rather than a manufactured
+* one-window list nobody measured.
+*
+* @param snapshot - The account's quota snapshot (`{ buckets, expiresAt }`).
+* @returns The reading, or null when nothing bounded was measured.
+*/
+function qoderAccountQuotaReading(snapshot) {
+	const root = asRecord$17(snapshot);
+	if (root === null) return null;
+	const resetsAt = asResetAt(asMs(root.expiresAt));
+	for (const bucket of asRecords(root.buckets)) {
+		const total = asNumber$6(bucket.total);
+		const remaining = asNumber$6(bucket.remaining);
+		const used = asNumber$6(bucket.used) ?? (total !== null && remaining !== null ? total - remaining : null);
+		if (total === null || total <= 0 || used === null) continue;
+		return {
+			usedPercent: asPercent(used / total * 100),
+			resetsAt,
+			windows: []
+		};
+	}
+	return null;
+}
+/**
+* The MiniMax Code account's own reading, from one Token Plan snapshot.
+*
+* The window the row's BAR draws is the rolling 5-hour one — the line's own
+* headline, and the tightest limit the plan has: its machine key is `interval`,
+* and a payload that named no key is placed by its nominal length instead. The
+* weekly window is deliberately NOT substituted (a row saying 5% while the
+* 5-hour window is spent is worse than a row saying nothing), and an `unlimited`
+* window states no share at all, so nothing becomes a bar.
+*
+* `windows` carries the WHOLE list all the same: this line states it — `interval`
+* and `weekly`, each with a share and a reset instant — so an account can be
+* opened up and show both of its limits instead of only the bar.
+*
+* @param quota - The parsed `MinimaxCodeQuota`.
+* @returns The reading, or null when the 5-hour window measured nothing.
+*/
+function minimaxAccountQuotaReading(quota) {
+	const root = asRecord$17(quota);
+	if (root === null) return null;
+	const stated = asRecords(root.windows);
+	const fiveHour = stated.find((window) => asText$4(window.key) === "interval") ?? stated.find((window) => namedWindowMinutes(window.key) === 300);
+	const usedPercent = (fiveHour === void 0 ? null : asPercent(fiveHour.usedPercent) ?? remainingPercentToUsed(fiveHour.remainingPercent)) ?? asPercent(root.usedPercent);
+	if (usedPercent === null) return null;
+	const resetsAtMs = fiveHour === void 0 ? asMs(root.resetsAtMs) : asMs(fiveHour.resetsAtMs);
+	return {
+		usedPercent,
+		resetsAt: asResetAt(resetsAtMs),
+		windows: minimaxWindowList(stated, usedPercent, resetsAtMs)
+	};
+}
+/**
+* Every window one Token Plan snapshot stated, in the card's own vocabulary.
+*
+* Mapped exactly the way `normalizeMinimaxCodeQuota` maps the line-level list, so
+* the per-account list and the line list can never disagree about what a window
+* is called: the key is a machine token that stands for a length, and the length
+* names the window (`interval` → 300 → 「5 小时」, `weekly` → 10080 → 「每周」).
+* One derived rule, not a second one beside it.
+*
+* @param stated - The payload's own `windows`.
+* @param headlineUsedPercent - The share the row's bar draws.
+* @param headlineResetsAtMs - The reset instant that goes with it.
+* @returns The windows, shortest first; one derived from the headline when the
+*   payload stated no window at all, `[]` only when it said nothing usable.
+*/
+function minimaxWindowList(stated, headlineUsedPercent, headlineResetsAtMs) {
+	const windows = windowsFrom(stated.map((window) => ({
+		label: null,
+		usedPercent: asPercent(window.usedPercent) ?? remainingPercentToUsed(window.remainingPercent),
+		windowMinutes: namedWindowMinutes(window.key),
+		resetsAt: asMs(window.resetsAtMs)
+	}))).sort(byWindowLength);
+	if (windows.length > 0) return windows;
+	return windowsFrom([{
+		label: null,
+		usedPercent: headlineUsedPercent,
+		windowMinutes: 300,
+		resetsAt: headlineResetsAtMs
+	}]);
+}
+/**
+* Every normalizer, keyed by the line id a card names.
+*
+* The registry looks a line up here; a line that is registered but has no entry
+* falls back to nothing measured, so adding a pool without a normalizer
+* degrades to "no quota window" instead of to a thrown error.
+*/
+const LINE_QUOTA_NORMALIZERS = {
+	codex: normalizeCodexQuota,
+	claude: normalizeClaudeQuota,
+	"glm-coding-plan": normalizeGlmCodingPlanQuota,
+	"step-code": normalizeStepCodeQuota,
+	qoder: normalizeQoderQuota,
+	"cline-pass": normalizeClinePassQuota,
+	opendesign: normalizeOpenDesignQuota,
+	"kimi-code": normalizeKimiCodeQuota,
+	"minimax-code": normalizeMinimaxCodeQuota,
+	antigravity: normalizeAntigravityQuota,
+	"command-code": normalizeCommandCodeQuota
+};
+/** The three rotation strategies, in the pool's own vocabulary. */
+const ROTATION_STRATEGIES$1 = [
+	"sequential",
+	"round-robin",
+	"sticky"
+];
+/**
+* Every line this plugin can serve a card for.
+*
+* The routes are the lines' own, verbatim: this module is not allowed to invent
+* a prefix, because a prefix is what a line owns.
+*/
+const LINE_DEFINITIONS = [
+	{
+		id: "codex",
+		label: "ChatGPT",
+		statusPath: "/api/dsh-chatgpt-subscription/status",
+		refreshPath: "/api/dsh-chatgpt-subscription/quota/refresh",
+		normalize: LINE_QUOTA_NORMALIZERS.codex
+	},
+	{
+		id: "claude",
+		label: "Claude",
+		statusPath: "/claude/api/status",
+		refreshPath: "/claude/api/quota",
+		normalize: LINE_QUOTA_NORMALIZERS.claude
+	},
+	{
+		id: "glm-coding-plan",
+		label: "GLM Coding Plan",
+		statusPath: "/glm-coding-plan/api/status",
+		refreshPath: "/glm-coding-plan/api/quota",
+		normalize: LINE_QUOTA_NORMALIZERS["glm-coding-plan"]
+	},
+	{
+		id: "step-code",
+		label: "Step Code",
+		statusPath: "/step-code/api/status",
+		refreshPath: "/step-code/api/quota",
+		normalize: LINE_QUOTA_NORMALIZERS["step-code"]
+	},
+	{
+		id: "qoder",
+		label: "Qoder",
+		statusPath: "/qoder/api/status",
+		refreshPath: "/qoder/api/quota",
+		normalize: LINE_QUOTA_NORMALIZERS.qoder
+	},
+	{
+		id: "cline-pass",
+		label: "Cline Pass",
+		statusPath: "/cline-pass/api/status",
+		refreshPath: "/cline-pass/api/usage",
+		normalize: LINE_QUOTA_NORMALIZERS["cline-pass"]
+	},
+	{
+		id: "opendesign",
+		label: "OpenDesign",
+		statusPath: "/opendesign/api/status",
+		refreshPath: "/opendesign/api/usage",
+		normalize: LINE_QUOTA_NORMALIZERS.opendesign
+	},
+	{
+		id: "kimi-code",
+		label: "Kimi Code",
+		statusPath: "/kimi-code/api/status",
+		refreshPath: "/kimi-code/api/quota",
+		normalize: LINE_QUOTA_NORMALIZERS["kimi-code"]
+	},
+	{
+		id: "minimax-code",
+		label: "MiniMax Code",
+		statusPath: "/minimax-code/api/status",
+		refreshPath: "/minimax-code/api/quota",
+		normalize: LINE_QUOTA_NORMALIZERS["minimax-code"]
+	},
+	{
+		id: "antigravity",
+		label: "Antigravity",
+		statusPath: "/antigravity/api/status",
+		refreshPath: "/antigravity/api/quota",
+		normalize: LINE_QUOTA_NORMALIZERS.antigravity
+	},
+	{
+		id: "command-code",
+		label: "Command Code",
+		statusPath: "/command-code/api/status",
+		refreshPath: "/command-code/api/quota",
+		normalize: LINE_QUOTA_NORMALIZERS["command-code"]
+	}
+];
+/**
+* THE per-account quota hook table: line id → how that line's readings are made.
+*
+* Keying it by line id is the whole point: a card names a line, a row names an
+* account, and a line with no entry here keeps EXACTLY the behaviour it had
+* before this table existed. That is not a fallback nobody exercised — it is the
+* default for nine of the eleven lines.
+*
+* Nothing in this table imports a line. Each entry needs that line's client and
+* receives it ({@link LineAccountQuotaClient}); a future line adds one entry
+* here plus one injected client, and no other module has to learn about it.
+*
+* What justified the two entries:
+*
+* - `qoder` — the line's `quota/usage` snapshot states absolute buckets, not a
+*   percentage; {@link qoderAccountQuotaReading} derives a share only when a
+*   bucket bounded it (total > 0) AND stated what was used. No bounded bucket,
+*   no bar.
+* - `minimax-code` — the Token Plan states a 5-hour (`interval`) and a weekly
+*   window; the row draws the 5-hour one, because that is the tightest limit the
+*   plan has ({@link minimaxAccountQuotaReading}). The weekly window is never
+*   substituted for it.
+*/
+const LINE_ACCOUNT_QUOTA_READERS = {
+	qoder: (client) => async (credentials, context) => qoderAccountQuotaReading(await client(credentials, context)),
+	"minimax-code": (client) => async (credentials, context) => minimaxAccountQuotaReading(await client(credentials, context))
+};
+/**
+* The readers in force, built from the clients the composition injected.
+*
+* A line whose client was not injected gets NO reader, which is what keeps the
+* hook optional in practice and not merely on paper: a composition that hands
+* over none of these reads every card exactly as it did before.
+*
+* @param clients - Line id → that line's quota client. Omitted or partial is the
+*   normal case, not an error.
+* @returns Line id → the reader for it; lines without both halves are absent.
+*/
+function createAccountQuotaReaders(clients) {
+	const readers = {};
+	if (clients === void 0) return readers;
+	for (const [line, factory] of Object.entries(LINE_ACCOUNT_QUOTA_READERS)) {
+		const client = clients[line];
+		if (client === void 0 || factory === void 0) continue;
+		readers[line] = factory(client);
+	}
+	return readers;
+}
+/**
+* The payload as a JSON object, or null.
+*
+* @param value - Candidate.
+* @returns The object, or null.
+*/
+function asRecord$16(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+/**
+* A trimmed non-empty string, or null.
+*
+* @param value - Candidate.
+* @returns The trimmed text, or null.
+*/
+function nonEmpty$2(value) {
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	return trimmed === "" ? null : trimmed;
+}
+/**
+* A rotation strategy, with the pool kernel's own fallback.
+*
+* @param value - Candidate.
+* @returns The strategy, defaulting to `sequential`.
+*/
+function normalizeStrategy(value) {
+	return value === "round-robin" || value === "sticky" ? value : "sequential";
+}
+/**
+* A consumed share, clamped into the bar it is drawn as.
+*
+* @param value - Share in percent.
+* @returns The share between 0 and 100.
+*/
+function clampPercent$1(value) {
+	if (!Number.isFinite(value)) return 0;
+	return Math.min(100, Math.max(0, value));
+}
+/**
+* One error as the sentence a card can show.
+*
+* @param error - The caught value.
+* @param label - The line it happened on.
+* @param timeoutMs - The budget that may have expired.
+* @returns A short, user-facing reason.
+*/
+function reasonOf(error, label, timeoutMs) {
+	if (error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError")) return label + " 的接口在 " + timeoutMs + " 毫秒内没有响应。 (Timed out.)";
+	return error instanceof Error ? error.message : String(error);
+}
+/**
+* A deadline, combined with the caller's cancellation when one was passed.
+*
+* @param timeoutMs - The budget in milliseconds.
+* @param caller - The capability's own signal, when it has one.
+* @returns The signal to hand to fetch, and the disposer that clears the timer.
+*/
+function budgetOf(timeoutMs, caller) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => {
+		controller.abort(/* @__PURE__ */ new Error("timeout"));
+	}, timeoutMs);
+	timer.unref?.();
+	const forward = () => {
+		controller.abort(caller?.reason);
+	};
+	if (caller !== void 0) if (caller.aborted) forward();
+	else caller.addEventListener("abort", forward, { once: true });
+	return {
+		signal: controller.signal,
+		dispose: () => {
+			clearTimeout(timer);
+			caller?.removeEventListener("abort", forward);
+		}
+	};
+}
+/**
+* A promise that rejects once the budget expires.
+*
+* Applied to the LOCAL pool read as well as to HTTP: a credential store that
+* hangs (a stuck keychain, a locked file) must not hold the card either.
+*
+* @param promise - The work.
+* @param timeoutMs - The budget.
+* @param label - The line it belongs to.
+* @returns The work's value.
+*/
+function bounded(promise, timeoutMs, label) {
+	if (timeoutMs <= 0) return promise;
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			reject(/* @__PURE__ */ new Error(label + " 的本地读取超过 " + timeoutMs + " 毫秒。 (Local read timed out.)"));
+		}, timeoutMs);
+		timer.unref?.();
+		promise.then((value) => {
+			clearTimeout(timer);
+			resolve(value);
+		}, (error) => {
+			clearTimeout(timer);
+			reject(error instanceof Error ? error : new Error(String(error)));
+		});
+	});
+}
+/**
+* The reason a failed response states, when it states one.
+*
+* The routes answer their own failures in the same envelope
+* (`{ ok: false, error: '…' }`), and that sentence is what tells a user what to
+* do ("every account is disabled", "not signed in"). Reporting only the status
+* code would throw it away.
+*
+* @param response - The failed response.
+* @returns The stated reason, or null when the body states none.
+*/
+async function failureDetail(response) {
+	try {
+		const body = asRecord$16(await response.json());
+		const detail = body?.error;
+		if (typeof detail === "string" && detail.trim() !== "") return detail.trim();
+		const message = body?.message;
+		return typeof message === "string" && message.trim() !== "" ? message.trim() : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Read one line's status route over loopback.
+*
+* @param definition - The line.
+* @param options - Where to reach the host and with what.
+* @param timeoutMs - The budget.
+* @param signal - The caller's cancellation.
+* @returns The payload, or the reason it could not be read.
+*/
+async function readStatus(definition, options, timeoutMs, signal) {
+	const budget = budgetOf(timeoutMs, signal);
+	const client = options.fetchFn ?? fetch;
+	try {
+		const response = await client(originOf(options) + definition.statusPath, {
+			method: "GET",
+			headers: { accept: "application/json" },
+			signal: budget.signal
+		});
+		if (!response.ok) {
+			const detail = await failureDetail(response);
+			return { error: definition.label + " 的 status 路由返回 HTTP " + response.status + (detail === null ? "。" : "：" + detail + "。") + " (Status route failed.)" };
+		}
+		const body = asRecord$16(await response.json());
+		if (body === null) return { error: definition.label + " 的 status 响应不是 JSON 对象。 (Status payload is not an object.)" };
+		if (body.ok !== true) {
+			const detail = nonEmpty$2(typeof body.error === "string" ? body.error : null);
+			return { error: definition.label + " 的 status 路由报告失败：" + (detail ?? "ok 不是 true") + "。 (Status route reported a failure.)" };
+		}
+		return { value: body.value };
+	} catch (error) {
+		return { error: reasonOf(error, definition.label, timeoutMs) };
+	} finally {
+		budget.dispose();
+	}
+}
+/**
+* The origin, resolved at call time.
+*
+* Lazy on purpose: the web server may not have bound a port when this provider
+* registers, and an origin resolved then would be a guess that outlives the
+* fact. A failure here is reported per card, not thrown at load.
+*
+* @param options - The registry options.
+* @returns The origin, without a trailing slash.
+*/
+function originOf(options) {
+	const origin = options.origin();
+	return origin.endsWith("/") ? origin.slice(0, -1) : origin;
+}
+/**
+* POST one line's own refresh route.
+*
+* The body is an empty JSON object rather than nothing: several of these routes
+* parse a JSON body before dispatching, and a request stating `content-length:
+* 0` is one they would refuse. The `origin` header is what the routes'
+* same-origin check compares against the `Host` they were addressed to — this
+* call is the host asking itself, so the two agree.
+*
+* @param definition - The line.
+* @param options - Where to reach the host and with what.
+* @param timeoutMs - The budget.
+* @param signal - The caller's cancellation.
+* @returns The outcome when the refresh failed, or null when it landed.
+*/
+async function postRefresh(definition, options, timeoutMs, signal) {
+	const path = definition.refreshPath;
+	if (path === null) return null;
+	const budget = budgetOf(timeoutMs, signal);
+	const client = options.fetchFn ?? fetch;
+	let origin;
+	try {
+		origin = originOf(options);
+	} catch (error) {
+		budget.dispose();
+		return {
+			message: reasonOf(error, definition.label, timeoutMs),
+			stillRunning: false
+		};
+	}
+	try {
+		const response = await client(origin + path, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				origin
+			},
+			body: "{}",
+			signal: budget.signal
+		});
+		if (!response.ok) {
+			const detail = await failureDetail(response);
+			return {
+				message: definition.label + " 的刷新路由返回 HTTP " + response.status + (detail === null ? "。" : "：" + detail + "。") + " (Refresh route failed.)",
+				stillRunning: false
+			};
+		}
+		return null;
+	} catch (error) {
+		if (budget.signal.aborted && !(signal?.aborted ?? false)) return {
+			message: definition.label + " 的刷新在 " + timeoutMs + " 毫秒内没有返回；线路仍在刷新，卡片读到的是它上一次的快照。 (The refresh did not answer within the budget; the line is still refreshing.)",
+			stillRunning: true
+		};
+		return {
+			message: reasonOf(error, definition.label, timeoutMs),
+			stillRunning: false
+		};
+	} finally {
+		budget.dispose();
+	}
+}
+/**
+* One deadline applied to every request a fetch makes.
+*
+* The per-account readers are handed a client, not a signal, so the budget has
+* to travel inside the client: a reader that keeps the `fetch` it was given is
+* then cancelled at the deadline instead of merely being ignored while its
+* socket stays open. A caller's own signal is respected when it already carries
+* one — this ADDS a deadline, it never loosens one.
+*
+* @param fetchFn - The client to wrap.
+* @param signal - The deadline to attach.
+* @returns A client whose requests carry it.
+*/
+function withDeadline(fetchFn, signal) {
+	const boundedFetch = async (input, init) => await fetchFn(input, init === void 0 ? { signal } : {
+		...init,
+		signal: init.signal ?? signal
+	});
+	return boundedFetch;
+}
+/**
+* A counting gate: at most `limit` callers run `work` at the same time.
+*
+* The slot is handed straight to the next waiter rather than released and
+* re-taken, so `active` can never exceed the limit by one in the window between
+* two arrivals — the reason a naive decrement-then-increment leaks.
+*
+* @param limit - How many may run at once.
+* @returns The gated runner.
+*/
+function gateOf(limit) {
+	let active = 0;
+	const waiting = [];
+	return async function run(work) {
+		if (active < limit) active += 1;
+		else await new Promise((resolve) => waiting.push(resolve));
+		try {
+			return await work();
+		} finally {
+			const next = waiting.shift();
+			if (next === void 0) active -= 1;
+			else next();
+		}
+	};
+}
+/**
+* How long one cached entry stays fresh.
+*
+* The two tiers are the point: a good reading waits out the poll interval, a
+* failed one is retried soon (see the two TTL constants).
+*
+* @param entry - The cached entry.
+* @param runtime - Where the two TTLs live.
+* @returns Its lifetime in milliseconds.
+*/
+function lifetimeOf(entry, runtime) {
+	return entry.reading === null ? runtime.failureCacheMs : runtime.cacheMs;
+}
+/**
+* Read ONE account's own quota, absorbing every failure.
+*
+* The two steps — the credential, then the upstream answer — share one budget,
+* because the row is one question: a credential that took two of the five
+* seconds must not buy the read a second full allowance.
+*
+* @param definition - The line, for the label a diagnostic would state.
+* @param accountId - The account being read.
+* @param credentialFor - The pool's per-account credential resolver.
+* @param reader - The line's reader.
+* @param fetchFn - The client to read through.
+* @param runtime - The budgets, and the caller's cancellation.
+* @param signal - The card's own cancellation, when it has one.
+* @returns The reading, or null for "nothing measured, one way or another".
+*/
+async function readOneAccountQuota(definition, accountId, credentialFor, reader, fetchFn, runtime, signal) {
+	const budget = budgetOf(runtime.timeoutMs, signal);
+	const client = withDeadline(fetchFn, budget.signal);
+	try {
+		return await bounded((async () => {
+			const reading = await reader(await credentialFor(accountId, client), {
+				accountId,
+				fetchFn: client
+			});
+			if (reading === null || reading.usedPercent === null || !Number.isFinite(reading.usedPercent)) return null;
+			const resetsAt = reading.resetsAt !== null && Number.isFinite(reading.resetsAt) ? reading.resetsAt : null;
+			return {
+				usedPercent: clampPercent$1(reading.usedPercent),
+				resetsAt,
+				windows: Array.isArray(reading.windows) ? reading.windows : []
+			};
+		})(), runtime.timeoutMs, definition.label);
+	} catch {
+		return null;
+	} finally {
+		budget.dispose();
+	}
+}
+/**
+* The accounts one read spends its requests on, in the order it spends them.
+*
+* Primary first, then most recently used, because a cap has to drop SOMETHING and
+* the rows it drops should be the ones a reader is least likely to be looking at.
+* The sort is stable on purpose: rows that tie on both keys keep the pool's own
+* order, so two reads of an unchanged pool pick the same eight and the window
+* does not flicker between polls.
+*
+* @param accounts - Every pooled account, as the pool stated them.
+* @param limit - How many may be read at most; zero or less means no cap.
+* @returns The accounts to read, in the order their requests should start.
+*/
+function accountsForReading(accounts, limit) {
+	const ordered = [...accounts].sort((left, right) => {
+		const primary = (right.isPrimary ? 1 : 0) - (left.isPrimary ? 1 : 0);
+		if (primary !== 0) return primary;
+		return (right.lastUsedAt ?? 0) - (left.lastUsedAt ?? 0);
+	});
+	return limit > 0 ? ordered.slice(0, limit) : ordered;
+}
+/**
+* The value a per-account read settles to when the stage budget expired first.
+*
+* A sentinel rather than `null` on purpose: `null` means "this account WAS asked
+* and measured nothing", which the row draws as an empty window list and the cache
+* remembers as a failure. A row the stage budget never reached was never asked, so
+* remembering it would be wrong — and not remembering it is exactly what keeps the
+* promise that the next read tries it again.
+*/
+const STAGE_BUDGET_SPENT = Symbol("per-account stage budget spent");
+/**
+* A promise that settles the moment `signal` aborts, and never rejects.
+*
+* Racing a read against this is how the stage budget cuts a row off: the row stops
+* being awaited, while the read itself is cancelled through the same signal it was
+* handed ({@link readOneAccountQuota}), so no gate slot is held afterwards.
+*
+* @param signal - The stage's own deadline.
+* @returns The sentinel, once the deadline passes.
+*/
+function whenSpent(signal) {
+	return new Promise((resolve) => {
+		if (signal.aborted) {
+			resolve(STAGE_BUDGET_SPENT);
+			return;
+		}
+		signal.addEventListener("abort", () => resolve(STAGE_BUDGET_SPENT), { once: true });
+	});
+}
+/**
+* Every account's own reading this card can afford.
+*
+* Two bounds decide "can afford", and they answer different questions: HOW MANY
+* rows are worth a request ({@link LINE_ACCOUNT_QUOTA_MAX_ACCOUNTS}, primary and
+* most-recently-used first) and HOW LONG the stage may hold the card
+* ({@link LINE_ACCOUNT_QUOTA_WHOLE_BUDGET_MS}). Neither replaces the per-account
+* budget, which still stops one hanging row from spending the stage's whole
+* allowance alone.
+*
+* @param definition - The line.
+* @param pool - The account half, already read.
+* @param source - The line's pool, for its per-account credential resolver.
+* @param runtime - Readers, cache, gate and budgets.
+* @param fetchFn - The client the pool and the readers use.
+* @param signal - The card's own cancellation.
+* @returns The readings per account id (null included, so a remembered failure
+*   is distinguishable from an absent entry), and whether the line is hooked;
+*   both empty/false for a line that did not opt in, in which case every row
+*   keeps the pool's own snapshot and states no window list.
+*/
+async function readAccountQuotas(definition, pool, source, runtime, fetchFn, signal) {
+	const readings = /* @__PURE__ */ new Map();
+	const reader = runtime.readers[definition.id];
+	const credentialFor = source?.getFreshCredential;
+	const hooked = reader !== void 0 && credentialFor !== void 0;
+	if (reader === void 0 || credentialFor === void 0 || pool.accounts.length === 0) return {
+		hooked,
+		readings
+	};
+	const now = Date.now();
+	for (const [key, entry] of runtime.cache) if (now - entry.at >= lifetimeOf(entry, runtime)) runtime.cache.delete(key);
+	const selected = accountsForReading(pool.accounts, runtime.maxAccounts);
+	const stage = runtime.wholeBudgetMs > 0 ? budgetOf(runtime.wholeBudgetMs, signal) : null;
+	const spent = stage === null ? null : whenSpent(stage.signal);
+	const credentialed = credentialFor.bind(source);
+	try {
+		await Promise.all(selected.map(async (account) => {
+			const key = definition.id + "\0" + account.id;
+			const cached = runtime.cache.get(key);
+			if (cached !== void 0 && now - cached.at < lifetimeOf(cached, runtime)) {
+				readings.set(account.id, cached.reading);
+				return;
+			}
+			let flight = runtime.pending.get(key);
+			if (flight === void 0) {
+				flight = runtime.gate(async () => await readOneAccountQuota(definition, account.id, credentialed, reader, fetchFn, runtime, stage?.signal ?? signal));
+				runtime.pending.set(key, flight);
+				const settle = () => {
+					if (runtime.pending.get(key) === flight) runtime.pending.delete(key);
+				};
+				flight.then(settle, settle);
+			}
+			const reading = spent === null ? await flight : await Promise.race([flight, spent]);
+			if (reading === STAGE_BUDGET_SPENT) return;
+			runtime.cache.set(key, {
+				at: Date.now(),
+				reading
+			});
+			readings.set(account.id, reading);
+		}));
+	} finally {
+		stage?.dispose();
+	}
+	return {
+		hooked,
+		readings
+	};
+}
+/**
+* The account half of a card, from the pool itself.
+*
+* Both calls are attempted even when one fails: listAccounts and read read the
+* same document through different paths, and a pool that answers rows but not
+* its document (or the reverse) still describes most of itself.
+*
+* @param pool - The line's pool, if it has one.
+* @param definition - The line.
+* @param timeoutMs - The budget.
+* @returns The facts.
+*/
+async function readPool(pool, definition, timeoutMs) {
+	if (pool === void 0) return {
+		installed: false,
+		accounts: [],
+		activeAccountId: null,
+		strategy: "sequential",
+		error: null
+	};
+	const listTask = bounded(pool.listAccounts(), timeoutMs, definition.label);
+	const documentTask = pool.read === void 0 ? Promise.resolve(void 0) : bounded(pool.read(), timeoutMs, definition.label);
+	const [list, document] = await Promise.allSettled([listTask, documentTask]);
+	const accounts = list.status === "fulfilled" ? list.value : [];
+	const failure = list.status === "rejected" ? reasonOf(list.reason, definition.label, timeoutMs) : document.status === "rejected" ? reasonOf(document.reason, definition.label, timeoutMs) : null;
+	const record = document.status === "fulfilled" ? asRecord$16(document.value) : null;
+	const primary = accounts.find((account) => account.isPrimary === true);
+	return {
+		installed: true,
+		accounts,
+		activeAccountId: nonEmpty$2(typeof record?.activeAccountId === "string" ? record.activeAccountId : null) ?? primary?.id ?? null,
+		strategy: normalizeStrategy(record?.rotationStrategy),
+		error: failure
+	};
+}
+/**
+* One pooled account as the card renders it.
+*
+* @param account - The pool's own summary.
+* @param reading - This account's own newest reading, when the line produced
+*   one; null/absent means the line has no hook, the read failed, or it measured
+*   nothing — and all three leave the pool's own snapshot standing.
+* @param hooked - Whether a per-account read is in force for this line at all,
+*   which is what decides whether the row states a window list. Defaults to
+*   false so a caller with no hook knowledge omits it rather than inventing an
+*   empty list.
+* @returns The row.
+*/
+function accountRow(account, reading, hooked = false) {
+	const window = account.quota?.windows[0];
+	const own = reading === null || reading === void 0 ? null : reading;
+	const ownUsed = own === null || own.usedPercent === null ? null : clampPercent$1(own.usedPercent);
+	return {
+		id: account.id,
+		label: nonEmpty$2(account.alias) ?? nonEmpty$2(account.email) ?? account.id,
+		email: account.email ?? null,
+		primary: account.isPrimary === true,
+		plan: account.planLabel ?? null,
+		cooldownUntil: account.cooldownUntil ?? null,
+		authStatus: account.authStatus ?? null,
+		usedPercent: ownUsed ?? (window === void 0 ? null : clampPercent$1(window.usedPercent)),
+		resetsAt: ownUsed === null ? window?.resetsAt ?? null : own?.resetsAt ?? window?.resetsAt ?? null,
+		...hooked ? { windows: own?.windows ?? [] } : {}
+	};
+}
+/**
+* One line's whole card: the halves read and merged.
+*
+* The quota half starts first because the per-account readings need the account
+* rows to know which accounts exist; both then run while it answers, so the card
+* still costs one budget rather than two.
+*
+* @param definition - The line.
+* @param options - The registry options.
+* @param quota - The per-account hook state (readers, cache, gate, budgets).
+* @param timeoutMs - The budget.
+* @param signal - The caller's cancellation.
+* @returns Shape C.
+*/
+async function readCard(definition, options, quota, timeoutMs, signal) {
+	const source = options.pools[definition.id];
+	const statusTask = readStatus(definition, options, timeoutMs, signal);
+	const pool = await readPool(source, definition, timeoutMs);
+	const [status, accountQuotas] = await Promise.all([statusTask, readAccountQuotas(definition, pool, source, quota, options.fetchFn ?? fetch, signal)]);
+	const facts = "error" in status ? null : definition.normalize(status.value);
+	const transportError = "error" in status ? status.error : null;
+	const primary = pool.accounts.find((account) => account.id === pool.activeAccountId) ?? pool.accounts.find((account) => account.isPrimary === true) ?? pool.accounts[0];
+	return {
+		line: definition.id,
+		label: definition.label,
+		signedIn: facts?.signedIn === true || pool.accounts.some((account) => account.authStatus === void 0 || account.authStatus === "ok"),
+		installed: pool.installed,
+		planLabel: facts?.planLabel ?? null,
+		accountLabel: facts?.accountLabel ?? nonEmpty$2(primary?.email) ?? null,
+		accounts: pool.accounts.map((account) => accountRow(account, accountQuotas.readings.get(account.id), accountQuotas.hooked)),
+		activeAccountId: pool.activeAccountId ?? primary?.id ?? null,
+		strategy: pool.strategy,
+		quota: facts?.quota ?? null,
+		error: transportError ?? facts?.error ?? pool.error
+	};
+}
+/**
+* Build a registry over the injected line → pool mapping.
+*
+* @param options - The mapping, the origin and the seams.
+* @returns The registry.
+*/
+function createLineRegistry(options) {
+	const definitions = options.definitions ?? LINE_DEFINITIONS;
+	const timeoutMs = options.timeoutMs ?? 5e3;
+	const accountQuota = {
+		readers: createAccountQuotaReaders(options.accountQuotaClients),
+		cache: /* @__PURE__ */ new Map(),
+		pending: /* @__PURE__ */ new Map(),
+		gate: gateOf(2),
+		cacheMs: options.accountQuotaCacheMs ?? 6e4,
+		failureCacheMs: options.accountQuotaFailureCacheMs ?? 15e3,
+		timeoutMs: options.accountQuotaTimeoutMs ?? 5e3,
+		wholeBudgetMs: options.accountQuotaWholeBudgetMs ?? 6e3,
+		maxAccounts: options.accountQuotaMaxAccounts ?? 8
+	};
+	const byId = new Map(definitions.map((definition) => [definition.id, definition]));
+	const definitionOf = (line) => {
+		const found = byId.get(line);
+		if (found !== void 0) return found;
+		throw new Error("未知线路「" + line + "」：这个注册表里没有它。 (Unknown line \"" + line + "\"; known lines: " + definitions.map((entry) => entry.id).join(", ") + ".)");
+	};
+	const poolOf = (definition) => options.pools[definition.id];
+	return {
+		definitions,
+		ids: () => definitions.map((definition) => definition.id),
+		read: async (line, signal) => await readCard(definitionOf(line), options, accountQuota, timeoutMs, signal),
+		refresh: async (line, signal) => {
+			const definition = definitionOf(line);
+			const outcome = await postRefresh(definition, options, timeoutMs, signal);
+			const card = await readCard(definition, options, accountQuota, timeoutMs, signal);
+			if (outcome === null) return card;
+			if (outcome.stillRunning && card.quota !== null) return {
+				...card,
+				quota: {
+					...card.quota,
+					refreshing: true
+				}
+			};
+			return card.quota !== null || card.error !== null ? card : {
+				...card,
+				error: outcome.message
+			};
+		},
+		switchAccount: async (line, accountId, signal) => {
+			const definition = definitionOf(line);
+			const pool = poolOf(definition);
+			if (pool === void 0) throw new Error("「" + definition.label + "」的账号池未安装，没有可切换的账号。 (This line has no account pool.)");
+			if (!(await pool.listAccounts()).some((account) => account.id === accountId)) throw new Error("未知账号「" + accountId + "」：「" + definition.label + "」的号池里没有这个 id。 (Unknown account.)");
+			await pool.setPrimary(accountId);
+			return await readCard(definition, options, accountQuota, timeoutMs, signal);
+		},
+		changeStrategy: async (line, strategy, signal) => {
+			const definition = definitionOf(line);
+			const pool = poolOf(definition);
+			if (pool === void 0) throw new Error("「" + definition.label + "」的账号池未安装，没有可调整的轮换策略。 (This line has no account pool.)");
+			const match = ROTATION_STRATEGIES$1.find((candidate) => candidate === strategy);
+			if (match === void 0) throw new Error("轮换策略只能是 " + ROTATION_STRATEGIES$1.join(" / ") + " 之一，收到的不是其中之一。 (The rotation strategy must be one of " + ROTATION_STRATEGIES$1.join(", ") + ".)");
+			await pool.setStrategy(match);
+			return await readCard(definition, options, accountQuota, timeoutMs, signal);
+		}
+	};
+}
+/**
+* The line a card names, from its props.
+*
+* @param props - The card's props.
+* @returns The line id.
+*/
+function lineOfProps(props) {
+	const record = asRecord$16(props);
+	const line = nonEmpty$2(typeof record?.line === "string" ? record.line : null);
+	if (line === null) throw new Error("这张卡片没有 line 属性：line-card 数据源需要 props.line 指明读哪条线路。 (This card states no \"line\" prop; the line-card data source needs one.)");
+	return line;
+}
+//#endregion
+//#region src/host/widget-board/provider.ts
+/**
+* The `widgetBoard` provider: this plugin's board contribution.
+*
+* What it publishes (all under one handle, so unloading this plugin takes all
+* of it with it):
+*
+* - one widget-type directory — the `widgets` folder that ships in this package;
+* - one data source, `line-card`, which answers one card per subscription line;
+* - three capabilities: force one line's quota read, pin one of its pooled
+*   accounts, and change that line's rotation strategy.
+*
+* The two ChatGPT-only cards this provider used to publish (one for quota, one
+* for the account pool) are gone: `widgets/line-flip` replaced both with a single
+* card that names its line in `props.line`, so the old per-subject data sources,
+* their shapes and their unit conversion were deleted rather than left unused.
+*
+* The service is optional. A host without a board never reaches the inject
+* callback at all, and everything below is sized to make that true even when
+* the board IS present: nothing here may fail the plugin's load, so the
+* registration runs off the load path and every failure is a warn.
+*/
+/**
+* The package name the widget directory is looked up by.
+*
+* Deliberately the SCOPED id, unlike {@link WIDGET_BOARD_PROVIDER}: this string
+* never reaches a manifest, it only identifies which `package.json` found by
+* walking up from this file is this package's own.
+*/
+const PACKAGE_NAME = "@eddyskywalker/dsh-chatgpt-subscription";
+/** How many directories to climb while looking for this package's root. */
+const MAX_ROOT_WALK = 8;
+/**
+* Subdirectory of this package that holds the widget types.
+*
+* The board reads every child directory of it as one widget, so it ships as
+* part of the package (`files` in package.json) rather than being generated.
+*/
+const WIDGET_DIRECTORY_NAME = "widgets";
+/**
+* Register this plugin's board contribution, if the host has a board.
+*
+* @param ctx - The host context; only `inject` is used.
+* @param options - The line registry to publish through, and the widget directory override.
+*/
+function registerWidgetBoard(ctx, options) {
+	ctx.inject(["widgetBoard"], (scope) => {
+		const service = scope.get("widgetBoard");
+		if (service === void 0 || service === null) return;
+		const apiVersion = service.apiVersion;
+		if (typeof apiVersion !== "number" || !Number.isFinite(apiVersion) || apiVersion < 2) {
+			scope.logger.warn(`[dsh-chatgpt-subscription] widget board provider skipped: the board reports apiVersion ${String(apiVersion)}, which this provider cannot serve (it needs a number >= 2).`);
+			return;
+		}
+		if (typeof service.registerWidgetType !== "function") {
+			scope.logger.warn("[dsh-chatgpt-subscription] widget board provider skipped: the board service has no registerWidgetType.");
+			return;
+		}
+		scope.effect(() => {
+			let closed = false;
+			let handle;
+			const lines = options.lines === void 0 ? void 0 : createLineRegistry(options.lines);
+			const publish = async () => {
+				const directory = options.widgetsDirectory ?? widgetsDirectory();
+				if (directory === void 0) {
+					scope.logger.warn("[dsh-chatgpt-subscription] widget board provider skipped: this package's own package.json could not be found from the loaded module, so the widget directory is unknown.");
+					return;
+				}
+				const registered = await service.registerWidgetType({
+					apiVersion,
+					provider: WIDGET_BOARD_PROVIDER,
+					directory
+				});
+				if (closed) {
+					await registered.dispose().catch(() => void 0);
+					return;
+				}
+				handle = registered;
+				registered.register({
+					dataSources: lineDataSources(apiVersion, lines),
+					...typeof service.registerCapability === "function" ? { capabilities: lineCapabilities(apiVersion, lines) } : {}
+				});
+			};
+			publish().catch((error) => {
+				scope.logger.warn(`[dsh-chatgpt-subscription] widget board registration failed: ${error instanceof Error ? error.message : String(error)}`);
+			});
+			return () => {
+				closed = true;
+				const current = handle;
+				handle = void 0;
+				if (current === void 0) return;
+				current.dispose().catch(() => void 0);
+			};
+		}, "dsh-chatgpt-subscription: widget board provider");
+	});
+}
+/**
+* This package's widget directory, resolved from the loaded module.
+*
+* `import.meta.url` points at `lib/index.js` in a built package and at a source
+* file under `src/` in a test run, so the root is found by walking up to the
+* `package.json` that names THIS package rather than by assuming a depth.
+*
+* @returns The absolute directory, or undefined when no such manifest was found.
+*/
+function widgetsDirectory() {
+	const root = findPackageRoot(path.dirname(fileURLToPath(import.meta.url)));
+	return root === void 0 ? void 0 : path.join(root, WIDGET_DIRECTORY_NAME);
+}
+/**
+* Walk up from a directory to the package root of this plugin.
+*
+* @param start - Directory to start from.
+* @returns The directory holding this package's `package.json`, or undefined.
+*/
+function findPackageRoot(start) {
+	let directory = start;
+	for (let depth = 0; depth < MAX_ROOT_WALK; depth += 1) {
+		try {
+			if (JSON.parse(readFileSync(path.join(directory, "package.json"), "utf8")).name === PACKAGE_NAME) return directory;
+		} catch {}
+		const parent = path.dirname(directory);
+		if (parent === directory) break;
+		directory = parent;
+	}
+}
+/**
+* The three rotation strategies every line pool accepts, in the pool own
+* vocabulary.
+*
+* The registry re-checks the same list inside its own changeStrategy; this copy
+* is what lets the capability refuse a bad argument before any pool is touched,
+* naming the mistake the way the other capability arguments do.
+*/
+const ROTATION_STRATEGIES = [
+	"sequential",
+	"round-robin",
+	"sticky"
+];
+/**
+* The `accountId` argument, or a refusal.
+*
+* @param args - Capability arguments.
+* @returns The account id.
+*/
+function readAccountId(args) {
+	const accountId = (typeof args === "object" && args !== null ? args : {}).accountId;
+	if (typeof accountId !== "string" || accountId.trim() === "") throw new Error("切换账号需要 accountId 参数。 (Switching accounts needs a non-empty \"accountId\" argument.)");
+	return accountId;
+}
+/**
+* The `strategy` argument, or a refusal.
+*
+* @param args - Capability arguments.
+* @returns The strategy.
+*/
+function readStrategy(args) {
+	const strategy = (typeof args === "object" && args !== null ? args : {}).strategy;
+	const match = ROTATION_STRATEGIES.find((candidate) => candidate === strategy);
+	if (match === void 0) throw new Error(`轮换策略只能是 ${ROTATION_STRATEGIES.join(" / ")} 之一，收到的不是其中之一。 (The rotation strategy must be one of ${ROTATION_STRATEGIES.join(", ")}.)`);
+	return match;
+}
+/**
+* The `line-card` data source, when a line registry was handed over.
+*
+* This is the whole data side of the board contribution: one source, read per
+* card, with each card naming its own line. A composition with no registry
+* registers nothing here rather than falling back to a ChatGPT-only source.
+*
+* @param apiVersion - The board's own version, passed through verbatim.
+* @param lines - The registry, when the composition has one.
+* @returns The registrations; empty without a registry.
+*/
+function lineDataSources(apiVersion, lines) {
+	if (lines === void 0) return [];
+	return [{
+		apiVersion,
+		provider: WIDGET_BOARD_PROVIDER,
+		id: LINE_CARD_DATA_SOURCE_ID,
+		read: (instance) => lines.read(lineOfProps(instance.props))
+	}];
+}
+/**
+* The three line capabilities, when a line registry was handed over.
+*
+* Like the data source they declare no `permission`: they force one line's own
+* quota read or write one line's own pool document, both of which the user is
+* already looking at on the card they clicked.
+*
+* @param apiVersion - The board's own version, passed through verbatim.
+* @param lines - The registry, when the composition has one.
+* @returns The registrations; empty without a registry.
+*/
+function lineCapabilities(apiVersion, lines) {
+	if (lines === void 0) return [];
+	return [
+		{
+			apiVersion,
+			provider: WIDGET_BOARD_PROVIDER,
+			id: LINE_REFRESH_CAPABILITY_ID,
+			title: {
+				zh: "刷新该线路额度",
+				en: "Refresh this line quota"
+			},
+			description: {
+				zh: "先让这条线路自己向上游读一次额度，再把读到的结果作为整张卡交回。",
+				en: "Ask the line to read its quota upstream, then answer with the refreshed card."
+			},
+			input: LINE_REFRESH_INPUT_SCHEMA,
+			output: LINE_CARD_SCHEMA,
+			call: (_instance, args, signal) => withLine(lines, args, (line) => lines.refresh(line, signal))
+		},
+		{
+			apiVersion,
+			provider: WIDGET_BOARD_PROVIDER,
+			id: LINE_ACCOUNT_SWITCH_CAPABILITY_ID,
+			title: {
+				zh: "切换线路账号",
+				en: "Switch line account"
+			},
+			description: {
+				zh: "把这条线路号池里的某个账号设为主账号，之后的下一次请求就由它来发。",
+				en: "Pin one account of this line as the primary; the next request is spent on it."
+			},
+			input: LINE_ACCOUNT_SWITCH_INPUT_SCHEMA,
+			output: LINE_CARD_SCHEMA,
+			call: (_instance, args, signal) => withLine(lines, args, (line) => lines.switchAccount(line, readAccountId(args), signal))
+		},
+		{
+			apiVersion,
+			provider: WIDGET_BOARD_PROVIDER,
+			id: LINE_ACCOUNT_STRATEGY_CAPABILITY_ID,
+			title: {
+				zh: "线路轮换策略",
+				en: "Line rotation strategy"
+			},
+			description: {
+				zh: "改这条线路号池的选择策略：顺序、轮询或粘住当前账号。",
+				en: "Change how this line s pool picks its next account: sequential, round-robin or sticky."
+			},
+			input: LINE_ACCOUNT_STRATEGY_INPUT_SCHEMA,
+			output: LINE_CARD_SCHEMA,
+			call: (_instance, args, signal) => withLine(lines, args, (line) => lines.changeStrategy(line, readStrategy(args), signal))
+		}
+	];
+}
+/**
+* The `line` argument of one line capability.
+*
+* @param args - Capability arguments, already schema-checked by the board.
+* @returns The line id.
+*/
+function readLine(args) {
+	const line = (typeof args === "object" && args !== null ? args : {}).line;
+	if (typeof line !== "string" || line.trim() === "") throw new Error("这条能力需要 line 参数，指明作用在哪条线路上。 (This capability needs a non-empty \"line\" argument.)");
+	return line.trim();
+}
+/**
+* Run one line action, resolving its `line` argument first.
+*
+* The check runs before the action so an unknown line fails on the argument
+* rather than halfway through a write, and so every capability reports the same
+* sentence for the same mistake.
+*
+* @param lines - The registry.
+* @param args - Capability arguments.
+* @param run - The action, given the resolved line id.
+* @returns The refreshed card.
+*/
+async function withLine(lines, args, run) {
+	const line = readLine(args);
+	if (!lines.ids().includes(line)) throw new Error("未知线路「" + line + "」：已知的是 " + lines.ids().join(" / ") + "。 (Unknown line; known lines: " + lines.ids().join(", ") + ".)");
+	return await run(line);
+}
+//#endregion
 //#region src/host/common/quota-refresh.ts
 /**
 * One quota refresh that runs behind an already-answered status call.
@@ -66530,6 +68991,37 @@ const WALLET_BALANCE_PATH = "/wallet/balance";
 */
 const BILLING_SUMMARY_PATH = "/billing/summary";
 /**
+* The workspace the signed-in account is CURRENTLY on.
+*
+* This is what the console itself reads to pick "the active workspace": its
+* response object carries `activeWorkspaceId` beside `workspaceType` and `role`.
+* It is the first place the coding-plan read looks for an id, because it answers
+* "where is this account right now" rather than "where could it go".
+*/
+const CURRENT_WORKSPACE_PATH = "/workspaces/current";
+/**
+* The workspace list: the FALLBACK source of that id.
+*
+* `GET {amr}/workspaces` with the same control key answers every workspace the
+* account can see. It is only consulted when {@link CURRENT_WORKSPACE_PATH} does
+* not state an id — a listing describes what the account could switch to, while
+* the coding-plan read needs the one workspace it is on. The device flow returns
+* neither, so these two reads are the only way to learn an id at all.
+*/
+const WORKSPACES_PATH = "/workspaces";
+/**
+* The Design Plan's real allowance, per workspace: the 5-hour and 7-day windows
+* the console draws.
+*
+* Appended to `{WORKSPACES_PATH}/{workspaceId}`. It is the only surface of this
+* line that states a bounded window — `/billing/summary` states credits and the
+* tier but never a rolling allowance — and it authenticates with the control key
+* as a Bearer token plus `x-vela-workspace-id`, exactly like the wallet read.
+* The console itself calls it with a browser session, so a control-key Bearer is
+* unverified: a refusal is reported as data, never as a reason to guess.
+*/
+const CODING_PLAN_USAGE_SUFFIX = "/billing/coding-plan-usage";
+/**
 * What the create call says about this client. The service stores host /
 * profile / cliVersion per authorization (its console lists devices by them);
 * the profile vocabulary is 'prod' | 'test' | 'feature-test' | 'local' per the
@@ -68080,6 +70572,391 @@ async function fetchBillingSummary({ fetchFn, controlKey, apiBase = AMR_API_BASE
 		};
 	}
 }
+/**
+* The refusal one endpoint stated, as one line.
+*
+* The machine `code` comes first because that is the only part a caller can act
+* on — `coding_plan_configuration_unavailable` means "this workspace has no
+* coding plan", which is a fact about the account rather than a fault. Both
+* `{ code }` and `{ error: { code } }` are read (the control plane uses both
+* spellings across its surfaces), then the usual `error`/`message` prose, then
+* the raw body. Nothing is invented when the body says nothing: that case stays
+* empty and the caller prints the status alone.
+*/
+function refusalDetail(json, text) {
+	if (isRecord$2(json)) {
+		const code = pickString(json, ["code"]);
+		if (code !== void 0) return code;
+		if (isRecord$2(json.error)) {
+			const nested = pickString(json.error, ["code", "message"]);
+			if (nested !== void 0) return nested;
+		}
+		const message = firstMessage(json);
+		if (message !== "") return message;
+	}
+	return text.trim().slice(0, 120);
+}
+/** `HTTP <status>: <code or first message>`, or the bare status when nothing was said. */
+function httpRefusal(status, json, text) {
+	const detail = refusalDetail(json, text);
+	return detail === "" ? `HTTP ${status}` : `HTTP ${status}: ${detail}`;
+}
+/**
+* The keys a workspace id travels under, in the order the console's payloads
+* spell them.
+*
+* `activeWorkspaceId` is what the current-workspace read answers; `workspaceId`
+* and `id` are how a listing entry or a nested `workspace` object names the same
+* fact.
+*/
+const WORKSPACE_ID_KEYS = [
+	"activeWorkspaceId",
+	"workspaceId",
+	"id"
+];
+/**
+* One id out of one object: the direct keys first, then a nested `workspace`.
+*
+* @param record - Candidate object.
+* @returns The id, or null when nothing in it states one.
+*/
+function workspaceIdIn(record) {
+	const direct = pickString(record, WORKSPACE_ID_KEYS);
+	if (direct !== void 0) return direct;
+	const nested = record.workspace;
+	if (isRecord$2(nested)) return pickString(nested, WORKSPACE_ID_KEYS) ?? null;
+	return null;
+}
+/**
+* The entries a listing endpoint answered, whatever wrapper it used.
+*
+* The wrapper is not worth trusting: the same control-plane family answers a bare
+* array, `{ workspaces }`, `{ items }`, `{ data }` and `{ data: { items | workspaces } }`
+* on its own different surfaces, and a lookup that guesses one of them reports
+* "no workspace" on a response that carried several.
+*
+* @param body - The decoded response.
+* @returns The candidate entries; empty when none of the shapes matched.
+*/
+function listedWorkspaces(body) {
+	if (Array.isArray(body)) return body;
+	if (!isRecord$2(body)) return [];
+	if (Array.isArray(body.workspaces)) return body.workspaces;
+	if (Array.isArray(body.items)) return body.items;
+	if (Array.isArray(body.data)) return body.data;
+	if (isRecord$2(body.data)) {
+		if (Array.isArray(body.data.items)) return body.data.items;
+		if (Array.isArray(body.data.workspaces)) return body.data.workspaces;
+	}
+	return [];
+}
+/**
+* The first id a listing states.
+*
+* @param body - The decoded response.
+* @returns The id, or null when no entry states one.
+*/
+function listedWorkspaceId(body) {
+	for (const entry of listedWorkspaces(body)) {
+		if (!isRecord$2(entry)) continue;
+		const direct = pickString(entry, ["id", "workspaceId"]);
+		if (direct !== void 0) return direct;
+		const nested = isRecord$2(entry.workspace) ? pickString(entry.workspace, ["id", "workspaceId"]) : void 0;
+		if (nested !== void 0) return nested;
+	}
+	return null;
+}
+/**
+* The SHAPE of a response body — never its content.
+*
+* Diagnostic only. A failed lookup has to say what the endpoint actually answered
+* without leaking a single value: the top-level keys, sorted and capped, are the
+* one thing that makes the next live attempt debuggable while an id, a workspace
+* name or a token stays out of the log and out of the card.
+*
+* @param json - The decoded response.
+* @returns A key summary such as `keys: activeWorkspaceId, role, workspaceType`.
+*/
+function bodyShape(json) {
+	if (Array.isArray(json)) return `a bare array of ${json.length}`;
+	if (!isRecord$2(json)) return "no object body";
+	const keys = Object.keys(json).sort().slice(0, 8);
+	return keys.length === 0 ? "an empty object" : `keys: ${keys.join(", ")}`;
+}
+/**
+* Read the workspace id the coding-plan endpoint is addressed by.
+*
+* TWO READS, in this order, because the console itself does not use one:
+*
+* 1. `GET {amr}/workspaces/current` — the workspace this account is on right now,
+*    the object the console's own switcher starts from. The id is read from
+*    `activeWorkspaceId`, then `workspaceId`, then `id`, then the same keys under
+*    a nested `workspace`, then the same order again under a `data` wrapper.
+* 2. Only when that states NO id, `GET {amr}/workspaces` — the listing, which
+*    answers what the account could switch to rather than where it is. Its
+*    first entry with an id wins, and every wrapper shape it has been seen in is
+*    accepted (bare array, `{ workspaces }`, `{ items }`, `{ data }`,
+*    `{ data: { items | workspaces } }`).
+*
+* The listing used to be the ONLY read here, and on a live account it answered
+* 200 with a body whose entries carried no id: the lookup must therefore say
+* WHICH endpoint failed and what it looked like, or the next attempt is blind.
+* A failure reports the endpoint, its HTTP status (or the transport error) and a
+* keys-only shape summary; no value and no id ever appears in it.
+*
+* Pure data in, data out: a refusal, a timeout or a malformed body is returned as
+* `error`, never thrown, and a transport failure on the first read does not stop
+* the second from answering. The caller composes the result into the account
+* reading, so one unreadable surface cannot take the whole quota read down.
+*
+* @param options.fetchFn - Injected fetch (tests never reach the network).
+* @param options.controlKey - The OAuth account's `vela_ctrl_…` key.
+* @param options.apiBase - Control-plane base; overridable for a deployment.
+* @param options.signal - Caller cancellation.
+* @param options.timeoutMs - Per-request budget.
+* @returns The id, or the reason neither endpoint stated one.
+*/
+async function fetchWorkspaceId({ fetchFn, controlKey, apiBase = AMR_API_BASE, signal, timeoutMs = 15e3 }) {
+	const base = trimBase$1(apiBase);
+	const notes = [];
+	/** One read, with its outcome kept as a NOTE: a throw here must not hide the next one. */
+	const probe = async (path) => {
+		try {
+			return await sendJSON$1(fetchFn, `${base}${path}`, {
+				apiKey: controlKey,
+				signal,
+				timeoutMs
+			});
+		} catch (error) {
+			notes.push(`GET ${path} failed: ${error instanceof Error ? error.message : String(error)}`);
+			return null;
+		}
+	};
+	/** One endpoint's diagnostic line: what was called, what it answered, what shape. */
+	const noteOf = (path, result) => result.ok ? `GET ${path} HTTP ${result.status}, ${bodyShape(result.json)}` : `GET ${path} ${httpRefusal(result.status, result.json, result.text)}, ${bodyShape(result.json)}`;
+	try {
+		const current = await probe(CURRENT_WORKSPACE_PATH);
+		if (current !== null) {
+			if (current.ok) {
+				const body = current.json;
+				const id = isRecord$2(body) ? workspaceIdIn(body) ?? (isRecord$2(body.data) ? workspaceIdIn(body.data) : null) : null;
+				if (id !== null) return {
+					ok: true,
+					id,
+					error: ""
+				};
+			}
+			notes.push(noteOf(CURRENT_WORKSPACE_PATH, current));
+		}
+		const list = await probe(WORKSPACES_PATH);
+		if (list !== null) {
+			if (list.ok) {
+				const id = listedWorkspaceId(list.json);
+				if (id !== null) return {
+					ok: true,
+					id,
+					error: ""
+				};
+			}
+			notes.push(noteOf(WORKSPACES_PATH, list));
+		}
+		return {
+			ok: false,
+			id: null,
+			error: `the workspaces endpoint listed no workspace id (${notes.join("; ")})`
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			id: null,
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+/** The tiers this line knows how to name; anything else is "unknown", never a guess. */
+const CODING_PLAN_TIERS = [
+	"go",
+	"plus",
+	"pro",
+	"max"
+];
+/**
+* One window read strictly: a field that does not state what the card needs
+* makes the whole window unreadable, and an unreadable window is dropped rather
+* than patched with a plausible default. A guessed `limitCredits` is a made-up
+* denominator on a progress bar, which is precisely the failure this contract
+* exists to prevent.
+*
+* @param raw - One entry of the response's `windows`.
+* @returns The window, or null when any field it needs was not stated.
+*/
+function codingPlanWindowOf(raw) {
+	if (!isRecord$2(raw)) return null;
+	const policyId = pickString(raw, ["policyId"]);
+	if (policyId === void 0) return null;
+	const durationSeconds = raw.durationSeconds;
+	if (typeof durationSeconds !== "number" || !Number.isSafeInteger(durationSeconds) || durationSeconds <= 0) return null;
+	const remainingCredits = raw.remainingCredits;
+	if (typeof remainingCredits !== "string" || !/^\d+$/.test(remainingCredits)) return null;
+	const limitCredits = raw.limitCredits;
+	if (typeof limitCredits !== "string" || !/^\d+$/.test(limitCredits)) return null;
+	const limit = Number(limitCredits);
+	if (!Number.isFinite(limit) || limit <= 0) return null;
+	if (!Number.isFinite(Number(remainingCredits))) return null;
+	const reset = codingPlanResetOf(raw.resetsAt);
+	if (reset === void 0) return null;
+	return {
+		policyId,
+		durationSeconds,
+		remainingCredits,
+		limitCredits,
+		resetsAt: reset
+	};
+}
+/**
+* A window's reset instant as the DTO states it.
+*
+* Absent and `null` both mean "the service stated no reset" and are kept as
+* null; a string has to parse as an instant, and anything else (a number, a
+* sentence) is `undefined` — the sentinel that makes the window unreadable.
+*
+* @param value - The raw field.
+* @returns The ISO string, null for "not stated", or undefined for "unreadable".
+*/
+function codingPlanResetOf(value) {
+	if (value === null || value === void 0) return null;
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	return Number.isFinite(Date.parse(trimmed)) ? trimmed : void 0;
+}
+/**
+* The credential shapes to try, in order, for one coding-plan read.
+*
+* The console signs this call with a browser SESSION (`credentials: "include"`),
+* so which of this line's two keys the endpoint accepts is not public: a control
+* key returned 401 live, which is exactly the ambiguity this list settles by
+* trying rather than by guessing. The order is "most likely intended first":
+* the control key already reads the rest of the control plane, the runtime key is
+* the gateway's own, and `x-api-key` is the spelling some routes use instead of
+* a Bearer.
+*
+* A runtime key of `''` (a pasted key account, or a credential that never got
+* one) leaves the first shape alone rather than sending an empty header.
+*
+* @param controlKey - The account's `vela_ctrl_…` key.
+* @param runtimeKey - The account's `sk-amr-…` key, or ''.
+* @returns The shapes to try, one to three.
+*/
+function codingPlanAttempts(controlKey, runtimeKey) {
+	const attempts = [{
+		label: "bearer control key",
+		apiKey: controlKey,
+		headers: {}
+	}];
+	const runtime = runtimeKey.trim();
+	if (runtime === "") return attempts;
+	attempts.push({
+		label: "bearer runtime key",
+		apiKey: runtime,
+		headers: {}
+	});
+	attempts.push({
+		label: "x-api-key runtime key",
+		apiKey: "",
+		headers: { "x-api-key": runtime }
+	});
+	return attempts;
+}
+/**
+* A successful response body as the DTO.
+*
+* @param json - The decoded body.
+* @returns The plan, with `error` empty and only the windows that survived.
+*/
+function codingPlanOf(json) {
+	const body = isRecord$2(json) ? json : {};
+	const windows = [];
+	for (const row of Array.isArray(body.windows) ? body.windows : []) {
+		const window = codingPlanWindowOf(row);
+		if (window !== null) windows.push(window);
+	}
+	const tierText = typeof body.tier === "string" ? body.tier.trim().toLowerCase() : "";
+	return {
+		tier: CODING_PLAN_TIERS.includes(tierText) ? tierText : null,
+		windows,
+		error: ""
+	};
+}
+/**
+* Read one account's Design Plan allowance.
+*
+* This is the line's REAL quota surface — the 5-hour and 7-day windows the
+* console draws as "剩余 90% / 81%" — and it is the only endpoint that states a
+* bounded window at all: `/billing/summary` states credits and a tier, never a
+* rolling allowance.
+*
+* `GET {amr}/workspaces/{id}/billing/coding-plan-usage`, always the same URL with
+* the same `x-vela-workspace-id`, tried once per credential SHAPE (see
+* {@link codingPlanAttempts}). The retry rule is the important half: only
+* `401` / `403` — "these credentials are not accepted" — moves on to the next
+* shape, because that is the only verdict a different key could change. A `404` or
+* a `500`, and in particular `coding_plan_configuration_unavailable`, is the
+* endpoint's own verdict about the WORKSPACE, so it stops the search and travels
+* out verbatim.
+*
+* Exhausting every shape yields one sentence a user can act on: the last refusal
+* plus the shapes that were tried. A success carries NO trace of which credential
+* worked — the shape of a credential is not the card's business.
+*
+* It never throws and never fills a window nobody measured.
+*
+* @param options.fetchFn - Injected fetch.
+* @param options.controlKey - The account's `vela_ctrl_…` key.
+* @param options.runtimeKey - The account's `sk-amr-…` key; `''` skips the two
+*   shapes that need one.
+* @param options.workspaceId - From {@link fetchWorkspaceId}.
+* @param options.apiBase - Control-plane base.
+* @param options.signal - Caller cancellation.
+* @param options.timeoutMs - Per-request budget.
+* @returns The plan, or the reason every shape it knew failed.
+*/
+async function fetchCodingPlanUsage({ fetchFn, controlKey, runtimeKey, workspaceId, apiBase = AMR_API_BASE, signal, timeoutMs = 15e3 }) {
+	const url = `${trimBase$1(apiBase)}${WORKSPACES_PATH}/${encodeURIComponent(workspaceId)}${CODING_PLAN_USAGE_SUFFIX}`;
+	const tried = [];
+	let refusal = "";
+	try {
+		for (const attempt of codingPlanAttempts(controlKey, runtimeKey)) {
+			const result = await sendJSON$1(fetchFn, url, {
+				apiKey: attempt.apiKey,
+				signal,
+				timeoutMs,
+				headers: {
+					"x-vela-workspace-id": workspaceId,
+					...attempt.headers
+				}
+			});
+			if (result.ok) return codingPlanOf(result.json);
+			refusal = httpRefusal(result.status, result.json, result.text);
+			if (result.status !== 401 && result.status !== 403) return {
+				tier: null,
+				windows: [],
+				error: refusal
+			};
+			tried.push(attempt.label);
+		}
+		return {
+			tier: null,
+			windows: [],
+			error: (refusal === "" ? "the coding plan could not be read" : refusal) + ` (tried: ${tried.join("; ")})`
+		};
+	} catch (error) {
+		return {
+			tier: null,
+			windows: [],
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
 //#endregion
 //#region src/host/opendesign/mapper.ts
 /**
@@ -69800,10 +72677,45 @@ function registerOpenDesignRoutes(ctx, options) {
 						ok: false,
 						error: "No OAuth-signed-in account can be read. Plan, credits and wallet balances come from the control key a browser sign-in issues; a pasted API key has none."
 					});
+					/**
+					* The workspace id, resolved ONCE for this request and reused.
+					*
+					* Every account here asks the same control-plane question — "which
+					* workspace is this key signed into" — and the coding-plan read needs
+					* the answer only as an address. The first account to need it settles
+					* the lookup; the rest await that same promise, so a request with four
+					* readable accounts makes one `/workspaces/current` call rather than four.
+					*
+					* The settled answer is reused even when it FAILED: every account then
+					* carries the same `error` in its own `codingPlan`, which is what a
+					* user needs to see ("the workspace cannot be resolved") instead of
+					* four identical timeouts. A failure never reaches the reading itself —
+					* the wallet and billing halves are unaffected.
+					*/
+					let workspaceLookup = null;
+					const readCodingPlan = async (controlKey, runtimeKey) => {
+						if (workspaceLookup === null) workspaceLookup = fetchWorkspaceId({
+							fetchFn,
+							controlKey
+						});
+						const workspace = await workspaceLookup;
+						if (!workspace.ok || workspace.id === null) return {
+							tier: null,
+							windows: [],
+							error: workspace.error === "" ? "no workspace id for the coding-plan read" : workspace.error
+						};
+						return await fetchCodingPlanUsage({
+							fetchFn,
+							controlKey,
+							runtimeKey,
+							workspaceId: workspace.id
+						});
+					};
 					const readings = await Promise.all(readable.map(async (account) => {
 						const fetchedAt = Date.now();
 						try {
-							const controlKey = controlKeyFor(await accountPool.getFreshCredential(account.id, fetchFn));
+							const credentials = await accountPool.getFreshCredential(account.id, fetchFn);
+							const controlKey = controlKeyFor(credentials);
 							if (controlKey === void 0) return {
 								accountId: account.id,
 								alias: account.alias,
@@ -69811,15 +72723,24 @@ function registerOpenDesignRoutes(ctx, options) {
 								balanceUsd: null,
 								updatedAt: null,
 								error: "no control key on this account",
-								fetchedAt
+								fetchedAt,
+								codingPlan: {
+									tier: null,
+									windows: [],
+									error: "no control key on this account"
+								}
 							};
-							const [wallet, billing] = await Promise.all([fetchWalletBalance({
-								fetchFn,
-								controlKey
-							}), fetchBillingSummary({
-								fetchFn,
-								controlKey
-							})]);
+							const [wallet, billing, codingPlan] = await Promise.all([
+								fetchWalletBalance({
+									fetchFn,
+									controlKey
+								}),
+								fetchBillingSummary({
+									fetchFn,
+									controlKey
+								}),
+								readCodingPlan(controlKey, bearerFor(credentials))
+							]);
 							const balanceUsd = wallet.balanceUsd ?? billing.billing?.totalAvailableCreditsUsd ?? null;
 							return {
 								accountId: account.id,
@@ -69829,7 +72750,8 @@ function registerOpenDesignRoutes(ctx, options) {
 								updatedAt: wallet.updatedAt,
 								error: wallet.error,
 								fetchedAt,
-								...billing.billing === null ? {} : { billing: billing.billing }
+								...billing.billing === null ? {} : { billing: billing.billing },
+								codingPlan
 							};
 						} catch (error) {
 							return {
@@ -69839,7 +72761,12 @@ function registerOpenDesignRoutes(ctx, options) {
 								balanceUsd: null,
 								updatedAt: null,
 								error: firstLine(error instanceof Error ? error.message : error, 240),
-								fetchedAt
+								fetchedAt,
+								codingPlan: {
+									tier: null,
+									windows: [],
+									error: "the account could not be read, so its coding plan was not read either"
+								}
 							};
 						}
 					}));
@@ -73741,7 +76668,8 @@ const DISABLED_OUTPUT_TEXT = "Progress updates are disabled; the update was not
 /** 工具描述的最终全文。 */
 const PROGRESS_UPDATE_DESCRIPTION = [
 	"Report progress to the user without ending your turn.",
-	"Use it during multi-step work so the user can follow along and correct course early:",
+	"Two updates are part of the job, not optional narration: send one BEFORE your first tool call of a multi-step task (the plan), and one BEFORE your final answer (what was done and what was verified).",
+	"Use it during the rest of the work so the user can follow along and correct course early:",
 	"state your plan near the beginning of the task (what you will do, and in what order);",
 	"report a meaningful conclusion the moment you have it (a key fact, the root cause, a verified assumption) rather than narrating every step;",
 	"give a stage judgement when one phase ends and the next begins (where things stand, what happens next);",
@@ -73894,6 +76822,13 @@ function stringOf$1(value) {
 * 文本用函数形式提供（而不是静态字符串）：开关关闭时返回空串，装配期就地
 * 抹掉引导，不需要重启会话、也不需要重挂插件行。
 *
+* ## 为什么是英文
+*
+* 提示词是写给模型看的，不是写给用户看的：同一段要求在英文下最短、歧义最少，
+* 也和工具描述（`tool.ts` 的 `PROGRESS_UPDATE_DESCRIPTION`，本来就是英文）保持
+* 同一套措辞。用户看到的语言由 {@link progressLanguageDirective} 单独钉住——
+* 「指令用英文」与「输出用中文」是两件事，不要混在一起。
+*
 * @module dsh-chatgpt-subscription/host/progress-updates/prompt
 */
 /**
@@ -73903,38 +76838,70 @@ function stringOf$1(value) {
 * 而变成第二个分节。
 */
 const PROGRESS_SECTION_NAME = "plugin:progress-updates";
+/** 允许的取值，供设置解析做白名单校验（配置里写错就等于没写）。 */
+const PROGRESS_UPDATE_LANGUAGES = [
+	"auto",
+	"zh",
+	"en"
+];
 /**
 * 引导词正文。写法对齐 Kimi 的「进展更新」：先说清多步任务早期的思路，再报
 * 有意义的结论、阶段判断、长等待与阻塞；每条给一行标题，细节放正文；不重复
-* 没有变化的状态。
+* 没有变化的状态。开头与结尾两条被提成硬要求——没有它们，面板在任务的两端
+* 都是空的。
 */
 const PROGRESS_GUIDANCE = [
-	"## 进展更新",
+	"## Progress updates",
+	"",
+	"During multi-step work you can call `progress_update` to report progress without ending your turn and without spending a question: report, then keep working.",
+	"",
+	"**Two updates are mandatory — missing either one means the job is not finished:**",
 	"",
-	"在多步任务里，你可以调用 `progress_update` 向用户主动汇报进展。它不会结束你的回合，也不消耗一次问答：报告完继续干活即可。",
+	"- **Opening**: before the first tool call of the task, send one update stating the plan (which steps, what you touch first). The user must be able to redirect you before you disappear into execution.",
+	"- **Closing**: after the work is done and before your final answer, send one update stating the result (what changed, what was verified, what is left). The panel and the conversation both close on this line.",
 	"",
-	"什么时候用：",
-	"- **任务早期**：先说清你打算怎么做（拆成哪几步、先动哪里），让用户在你埋头执行之前就能纠正方向。",
-	"- **有意义的结论**：查到关键事实、定位到根因、验证了一个假设——报结论本身，不要报「我刚读了一个文件」。",
-	"- **阶段判断**：一步做完、进入下一步之前，用一句话说明现在的状态和接下来要做什么。",
-	"- **长等待之前**：跑测试、装依赖、等构建这类要花上一阵子的操作，先说清你在等什么、大概要等多久。",
-	"- **被阻塞时**：缺信息、缺权限、外部依赖失败——说清卡在哪、你打算怎么绕过去，或者需要用户做什么。",
+	"Beyond those two, these moments are worth a report:",
+	"- **Early planning**: the opening update covers it; report again only when the plan really changes (different approach, smaller scope, a broken premise).",
+	"- **A meaningful conclusion**: a key fact, a root cause, a verified assumption — report the conclusion itself, not \"I just read a file\".",
+	"- **A stage judgement**: one phase ends and the next begins — one line on where things stand and what happens next.",
+	"- **Before a long wait**: a test run, an install, a build — say what you are waiting for and roughly how long.",
+	"- **When blocked**: missing information, missing permission, an external failure — say where you are stuck, what you will try next, or what you need from the user.",
 	"",
-	"怎么写：",
-	"- 每条给一行短标题（title，纯文本，不带 Markdown，不加结尾句号），细节放进正文（message）。",
-	"- 正文用轻 Markdown：一段话说清发生了什么，必要时跟少量 bullet 列出要点。**有几行数据要对照时，用 GFM 管道符表格**（表头行 + `| --- |` 分隔行），不要写成排成一列的纯文本。",
-	"- 不要重复没有变化的状态：上一条报过的还在进行中，就不用再报一遍。",
-	"- 进展更新是给用户看的，不是给日志看的：写人话，别复述工具调用参数。",
+	"How to write one:",
+	"- One short title line (plain text, no Markdown, no trailing period); the details go in the message body.",
+	"- The body uses light Markdown: one paragraph of prose plus a few bullets. **When several rows share fields, use a GFM pipe table** (header row plus a `| --- |` separator row) instead of one item per line.",
+	"- Do not repeat a status that has not changed: if the last update already said it is running, it needs no second report.",
+	"- A progress update is for the user, not for the log: write it in human words, do not restate tool arguments.",
 	"",
-	"作为 subagent 运行时：只描述你自己的子任务进展。你的子任务完成不等于整体任务完成，不要把整体进度写成已完成。"
+	"When you run as a subagent: describe only your own subtask progress. Finishing your subtask is not the same as finishing the overall task — do not report the overall progress as done."
 ].join("\n");
 /**
+* 每个语言档位对应的一句指令。
+*
+* 只约束输出的标题与正文，不约束引导词本身；三条都必须自洽——`auto` 不许在
+* 用户说中文时滑回英文，`zh`/`en` 则明确压过对话语言。
+*/
+const PROGRESS_LANGUAGE_DIRECTIVES = {
+	auto: "Write the title and the message of every progress update in the language the user is writing in, whatever it is. Follow the conversation; do not fall back to English unless the user does.",
+	zh: "Write the title and the message of every progress update in Simplified Chinese, even when the conversation is in another language.",
+	en: "Write the title and the message of every progress update in English, even when the conversation is in another language."
+};
+/**
+* 取一个语言档位的指令文本；未知取值按 `auto` 处理。
+* @param language - 配置里读到的语言档位。
+* @returns 追加到引导词末尾的一句指令。
+*/
+function progressLanguageDirective(language) {
+	return PROGRESS_LANGUAGE_DIRECTIVES[language] ?? PROGRESS_LANGUAGE_DIRECTIVES.auto;
+}
+/**
 * 生成提示词分节的文本提供者。
 * @param isEnabled - 读取当前开关状态的函数（每次装配重新求值）。
-* @returns 开关打开时返回引导词，关闭时返回空串。
+* @param language - 读取当前输出语言的函数；缺省按 `auto` 处理。
+* @returns 开关打开时返回引导词加语言指令，关闭时返回空串。
 */
-function progressSectionText(isEnabled) {
-	return () => isEnabled() ? PROGRESS_GUIDANCE : "";
+function progressSectionText(isEnabled, language = () => "auto") {
+	return () => isEnabled() ? PROGRESS_GUIDANCE + "\n\n" + progressLanguageDirective(language()) : "";
 }
 //#endregion
 //#region src/host/progress-updates/projection.ts
@@ -74261,9 +77228,11 @@ function readProgressConfigField(field) {
 function resolveProgressUpdatesSettings(config) {
 	const enabled = readProgressConfigField(config?.progressUpdates);
 	const threshold = readProgressConfigField(config?.progressUpdatesNudgeThreshold);
+	const language = readProgressConfigField(config?.progressUpdatesLanguage);
 	return {
 		enabled: enabled !== false,
-		nudgeThreshold: typeof threshold === "number" && Number.isSafeInteger(threshold) && threshold > 0 ? threshold : 8
+		nudgeThreshold: typeof threshold === "number" && Number.isSafeInteger(threshold) && threshold > 0 ? threshold : 8,
+		language: language !== void 0 && PROGRESS_UPDATE_LANGUAGES.includes(language) ? language : "auto"
 	};
 }
 /** 血缘回溯的深度上限：与 `nudge.ts` 的 `counterSessionIdOf` 同一个数。 */
@@ -74521,7 +77490,7 @@ function installProgressUpdates(ctx, options) {
 		return systemPrompt.section({
 			name: PROGRESS_SECTION_NAME,
 			order: 220,
-			text: progressSectionText(() => options.settings().enabled)
+			text: progressSectionText(() => options.settings().enabled, () => options.settings().language)
 		});
 	}, "dsh-chatgpt-subscription: progress update prompt section");
 	track(() => {
@@ -74577,7 +77546,12 @@ const Config = z.object({
 	noAnswerResume: z.union([z.object({}), z.const(false)]).default({}),
 	codexStreamIdleTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS).step(1).default(DEFAULT_STREAM_IDLE_TIMEOUT_MS$2),
 	progressUpdates: z.boolean().default(true).volatile().description("启用进展更新：允许 agent 用 progress_update 工具主动汇报多步任务的进展，并在侧栏展示。"),
-	progressUpdatesNudgeThreshold: z.number().step(1).min(1).max(50).default(8).volatile().description("催促阈值：连续这么多轮带工具调用却没有进展更新时，提醒 agent 发一条进展。")
+	progressUpdatesNudgeThreshold: z.number().step(1).min(1).max(50).default(8).volatile().description("催促阈值：连续这么多轮带工具调用却没有进展更新时，提醒 agent 发一条进展。"),
+	progressUpdatesLanguage: z.union([
+		z.const("auto"),
+		z.const("zh"),
+		z.const("en")
+	]).default("auto").volatile().description("进展更新的输出语言：auto 跟随对话语言，zh 中文，en 英文。")
 });
 const inject = [
 	"webServer",
@@ -74873,6 +77847,35 @@ function apply(ctx, pluginConfig = {}) {
 			const snapshot = usage.snapshotFor(account.id, account.credentials);
 			return snapshot === void 0 ? void 0 : codexAccountQuota(snapshot);
 		});
+		registerWidgetBoard(ctx, { lines: {
+			origin: () => webServerOrigin(ctx.webServer),
+			pools: {
+				codex: codexAccountPool,
+				claude: claudeAccountPool,
+				"glm-coding-plan": glmCodingPlanAccountPool,
+				"step-code": stepCodeAccountPool,
+				qoder: qoderAccountPool,
+				"cline-pass": clinePassLine.accountPool,
+				opendesign: openDesignLine.accountPool,
+				"kimi-code": kimiCodeAccountPool,
+				"minimax-code": minimaxCodeAccountPool,
+				antigravity: antigravityAccountPool,
+				"command-code": commandCodeAccountPool
+			},
+			accountQuotaClients: {
+				qoder: async (credentials, { fetchFn, accountId }) => {
+					const read = await loadQoderQuota(credentials, {
+						fetchFn,
+						cacheKey: accountId
+					});
+					return read.ok ? read.snapshot : null;
+				},
+				"minimax-code": async (credentials, { fetchFn, accountId }) => await fetchTokenPlanQuota(credentials, {
+					fetchFn,
+					accountId
+				})
+			}
+		} });
 		const adapter = new CodexChatGptAdapter(new ResponsesClient(oauth, ctx.attachments, {
 			fetchFn: modelFetch["codex-chatgpt"],
 			accountPool: codexAccountPool,