@eddyskywalker/dsh-chatgpt-subscription 0.38.0 → 0.39.0

package/lib/client.js

@@ -861,6 +861,16 @@ window.__ModuleLoader__.load({
 			startLogin() {
 				return post$5(`${ROUTE_PREFIX}/login/start`, {});
 			}
+			/**
+			* Start a device-code sign-in instead of the browser callback.
+			*
+			* The answer already carries what the panel shows — the code, the page, the
+			* deadline — so the card does not have to ask the status route for it, and the
+			* wait for confirmation arrives on the same event stream as any other login.
+			*/
+			startDeviceLogin() {
+				return post$5(`${ROUTE_PREFIX}/login/device/start`, {});
+			}
 			cancelLogin(loginId) {
 				return post$5(`${ROUTE_PREFIX}/login/cancel`, { loginId });
 			}
@@ -896,6 +906,15 @@ window.__ModuleLoader__.load({
 			disableAdoptedLocalLogins() {
 				return post$5(`${ROUTE_PREFIX}/adopt/disable`, {});
 			}
+			/**
+			* Choose the account-pool store, answering with the refreshed status.
+			*
+			* The host persists the choice before resolving again, so the status that comes
+			* back already names the store the pools will read and write from here on.
+			*/
+			setPoolStorage(mode) {
+				return post$5(`${ROUTE_PREFIX}/storage`, { mode });
+			}
 			refresh() {
 				return post$5(`${ROUTE_PREFIX}/token/refresh`, {});
 			}
@@ -1508,9 +1527,49 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region src/client/CodexSubscriptionSection.tsx
+		/** The grant's deadline, moved onto this browser's clock. */
+		function panelDeadlineMs(login) {
+			return Date.now() + (login.expiresAt - login.now) * 1e3;
+		}
+		/**
+		* The sentence the card shows about where the pool actually lives.
+		*
+		* One key per BACKEND, not per configured value: `keyring` resolves to the Secret
+		* Service on Linux, DPAPI on Windows and the Keychain on macOS, so a user looking
+		* at "saving failed" needs to know which store answered, not which one was asked
+		* for. Every branch is spelled out, so a new backend cannot reach the card as an
+		* untranslated fallback.
+		*/
+		function poolStorageBackendLabel(storage, t) {
+			switch (storage.backend) {
+				case "keyring": return t("poolStorageBackendKeyring");
+				case "credentials": return t("poolStorageBackendCredentials");
+				case "dpapi": return t("poolStorageBackendDpapi");
+				case "keychain": return t("poolStorageBackendKeychain");
+			}
+		}
+		/** Why the configured store is not usable here, in the reader's language. */
+		function poolStorageUnavailableLabel(storage, t) {
+			switch (storage.unavailable) {
+				case void 0: return null;
+				case "keyring-unreachable": return t("poolStorageUnavailableKeyring");
+				case "no-credentials-service": return t("poolStorageUnavailableCredentials");
+				case "store-unreadable": return t("poolStorageUnavailableStore");
+			}
+			return null;
+		}
 		function CodexSubscriptionSection({ t }) {
 			const apiRef = (0, react.useRef)(new SubscriptionApi());
 			const eventSourceRef = (0, react.useRef)(null);
+			/**
+			* The flow the card knows it started.
+			*
+			* Cancel used to read the id from the last status answer, which is a race the
+			* user could lose: the panel is on screen the instant the host answers, and a
+			* Cancel pressed before the status reload finished went nowhere. The id the
+			* start route just returned is the truth about what is running.
+			*/
+			const loginIdRef = (0, react.useRef)(null);
 			/** Follow-up poll owed while the host refreshes the quota behind an answer. */
 			const quotaFollowUp = (0, react.useRef)(null);
 			const [status, setStatus] = (0, react.useState)(null);
@@ -1518,6 +1577,15 @@ window.__ModuleLoader__.load({
 			const [error, setError] = (0, react.useState)(null);
 			const [authUrl, setAuthUrl] = (0, react.useState)(null);
 			const [popupBlocked, setPopupBlocked] = (0, react.useState)(false);
+			/** The device code on screen. Non-null means the device panel is what is open. */
+			const [deviceLogin, setDeviceLogin] = (0, react.useState)(null);
+			const [deviceError, setDeviceError] = (0, react.useState)(null);
+			/** Which of the two panel values was copied a moment ago: the code or the link. */
+			const [copiedField, setCopiedField] = (0, react.useState)(null);
+			/** Cleared on unmount, so a panel closed inside 1.5 s leaves no timer behind. */
+			const copiedTimerRef = (0, react.useRef)(null);
+			/** Ticked once a second, so the panel's countdown is a clock and not a snapshot. */
+			const [now, setNow] = (0, react.useState)(() => Date.now());
 			const [resetCreditNotice, setResetCreditNotice] = (0, react.useState)(null);
 			const [connection, setConnection] = (0, react.useState)(null);
 			const [contextDrafts, setContextDrafts] = (0, react.useState)({});
@@ -1548,18 +1616,23 @@ window.__ModuleLoader__.load({
 					document.removeEventListener("visibilitychange", refreshWhenVisible);
 					quotaFollowUp.current?.cancel();
 					eventSourceRef.current?.close();
+					if (copiedTimerRef.current !== null) window.clearTimeout(copiedTimerRef.current);
 				};
 			}, [load]);
-			const watchLogin = (0, react.useCallback)((loginId) => {
+			const watchLogin = (0, react.useCallback)((loginId, mode = "browser") => {
+				loginIdRef.current = loginId;
 				eventSourceRef.current?.close();
 				const source = apiRef.current.events(loginId);
 				eventSourceRef.current = source;
 				const finish = async (message) => {
 					source.close();
 					eventSourceRef.current = null;
+					loginIdRef.current = null;
 					setBusy(null);
 					setAuthUrl(null);
-					if (message !== void 0) setError(message);
+					if (mode === "device") if (message === void 0) setDeviceLogin(null);
+					else setDeviceError(message);
+					else if (message !== void 0) setError(message);
 					await load(true);
 				};
 				source.addEventListener("completed", (event) => {
@@ -1573,12 +1646,26 @@ window.__ModuleLoader__.load({
 			}, [load]);
 			(0, react.useEffect)(() => {
 				const loginId = status?.login.active ? status.login.loginId : null;
-				if (loginId !== null && loginId !== void 0 && eventSourceRef.current === null) watchLogin(loginId);
+				if (loginId === null || loginId === void 0) return;
+				const device = status?.login.device;
+				loginIdRef.current = loginId;
+				if (eventSourceRef.current === null) watchLogin(loginId, device === void 0 || device === null ? "browser" : "device");
+				if (device !== void 0 && device !== null) setDeviceLogin((current) => current ?? {
+					login: device,
+					deadlineMs: panelDeadlineMs(device)
+				});
 			}, [
 				status?.login.active,
 				status?.login.loginId,
+				status?.login.device,
 				watchLogin
 			]);
+			(0, react.useEffect)(() => {
+				if (deviceLogin === null) return;
+				setNow(Date.now());
+				const timer = window.setInterval(() => setNow(Date.now()), 1e3);
+				return () => window.clearInterval(timer);
+			}, [deviceLogin]);
 			const startLogin = async () => {
 				setBusy("login");
 				setError(null);
@@ -1597,15 +1684,83 @@ window.__ModuleLoader__.load({
 					setError(messageOf$4(cause));
 				}
 			};
+			/**
+			* The third way in: a code the user types on their own machine.
+			*
+			* Nothing is opened and nothing is listened on locally — that is the whole
+			* point of this path on a server — so the answer is immediately shown instead
+			* of being handed to a popup.
+			*/
+			const startDeviceLogin = async () => {
+				setBusy("device-login");
+				setError(null);
+				setDeviceError(null);
+				setCopiedField(null);
+				try {
+					const login = await apiRef.current.startDeviceLogin();
+					setDeviceLogin({
+						login,
+						deadlineMs: panelDeadlineMs(login)
+					});
+					watchLogin(login.loginId, "device");
+					setBusy(null);
+					await load(true);
+				} catch (cause) {
+					if (deviceLogin === null) setError(messageOf$4(cause));
+					else setDeviceError(messageOf$4(cause));
+					setBusy(null);
+				}
+			};
+			/**
+			* Copy one of the panel's two values.
+			*
+			* One handler for both buttons, because they are the same action and must look
+			* and behave identically. The code is stripped of whitespace on the way out:
+			* what the panel renders is a code in a box, and a copied value with a stray
+			* space or line break is refused by the page the user pastes it into.
+			*/
+			const copyDeviceValue = async (field) => {
+				if (deviceLogin === null) return;
+				const value = field === "code" ? deviceLogin.login.userCode.replace(/\s+/g, "") : deviceLogin.login.verificationUrl;
+				if (value === "") return;
+				if (typeof navigator === "undefined" || navigator.clipboard === void 0) return;
+				try {
+					await navigator.clipboard.writeText(value);
+				} catch {
+					return;
+				}
+				if (copiedTimerRef.current !== null) window.clearTimeout(copiedTimerRef.current);
+				setCopiedField(field);
+				copiedTimerRef.current = window.setTimeout(() => {
+					copiedTimerRef.current = null;
+					setCopiedField(null);
+				}, 1500);
+			};
+			/**
+			* Stop the running sign-in, or close a panel that has nothing left to stop.
+			*
+			* A terminal failure ends the flow on the host (`activeLogin` is empty) and the
+			* card forgets the id with it — but the panel stays open on purpose, because
+			* the code is still the only thing that explains what happened. Cancel is the
+			* only control on it, so with nothing to cancel it has to mean "close", or an
+			* expired code could only be got rid of by starting a new sign-in.
+			*/
 			const cancelLogin = async () => {
-				const loginId = status?.login.loginId;
-				if (loginId === null || loginId === void 0) return;
+				const loginId = loginIdRef.current ?? status?.login.loginId;
+				if (loginId === null || loginId === void 0) {
+					setDeviceLogin(null);
+					setDeviceError(null);
+					return;
+				}
 				setBusy("login");
 				try {
 					await apiRef.current.cancelLogin(loginId);
 					eventSourceRef.current?.close();
 					eventSourceRef.current = null;
+					loginIdRef.current = null;
 					setAuthUrl(null);
+					setDeviceLogin(null);
+					setDeviceError(null);
 					await load();
 				} catch (cause) {
 					setError(messageOf$4(cause));
@@ -1785,6 +1940,20 @@ window.__ModuleLoader__.load({
 				});
 			};
 			/**
+			* Move the pool to the other store.
+			*
+			* Nothing is copied: the accounts saved in the store being left stay there and
+			* reappear if the choice is switched back, which is what the warning under the
+			* select says. The route answers with the refreshed status, so the card renames
+			* the store in use in the same render.
+			*/
+			const changePoolStorage = async (mode) => {
+				await run("storage", async () => {
+					const next = await apiRef.current.setPoolStorage(mode);
+					setStatus(next);
+				});
+			};
+			/**
 			* Re-authorize one account.
 			*
 			* The failure marker is cleared first and nothing is deleted: the account
@@ -1819,6 +1988,7 @@ window.__ModuleLoader__.load({
 			const preferences = status?.preferences;
 			const quota = status?.quota;
 			const login = status?.login;
+			const poolStorageUnavailable = status?.poolStorage === void 0 ? null : poolStorageUnavailableLabel(status.poolStorage, t);
 			const visibleModelIds = preferences?.visibleModelIds ?? DEFAULT_VISIBLE_CODEX_MODEL_IDS;
 			const contextModels = CODEX_MODEL_CATALOG.filter((entry) => visibleModelIds.some((id) => id === entry.id));
 			const overrideCount = Object.keys(preferences?.contextWindowOverrides ?? {}).length;
@@ -1860,18 +2030,28 @@ window.__ModuleLoader__.load({
 							showQuota: true,
 							renderLoginActions: () => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								className: "dsha-account-add-actions",
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-									className: "dsha-btn dsha-btn-primary",
-									disabled: busy !== null,
-									onClick: () => void startLogin(),
-									children: login?.active ? t("pending") : t("addAccount")
-								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-									className: "dsha-btn",
-									disabled: busy !== null,
-									"aria-label": t("localCodexLoginImport"),
-									onClick: () => void importLocalSignIn(),
-									children: busy === "adopt" ? t("localCodexLoginImporting") : t("localCodexLoginImport")
-								})]
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										className: "dsha-btn dsha-btn-primary",
+										disabled: busy !== null,
+										onClick: () => void startLogin(),
+										children: login?.active ? t("pending") : t("addAccount")
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										className: "dsha-btn",
+										disabled: busy !== null,
+										"aria-label": t("deviceCodeLogin"),
+										onClick: () => void startDeviceLogin(),
+										children: busy === "device-login" ? t("deviceCodeLoginStarting") : t("deviceCodeLogin")
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										className: "dsha-btn",
+										disabled: busy !== null,
+										"aria-label": t("localCodexLoginImport"),
+										onClick: () => void importLocalSignIn(),
+										children: busy === "adopt" ? t("localCodexLoginImporting") : t("localCodexLoginImport")
+									})
+								]
 							}),
 							renderDetails: (entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(react_jsx_runtime.Fragment, { children: entry.planLabel && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", { children: [
 								t("plan"),
@@ -1879,11 +2059,68 @@ window.__ModuleLoader__.load({
 								entry.planLabel
 							] }) }),
 							children: [
-								login?.active ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								login?.active && deviceLogin === null ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 									className: "dsha-muted",
 									role: "status",
 									children: t("pending")
 								}) : null,
+								deviceLogin !== null ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									className: "dsh-codex-device",
+									role: "group",
+									"aria-label": t("deviceCodeLogin"),
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+											className: "dsha-muted",
+											children: t("deviceCodeHint")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+											className: "dsh-codex-device-row",
+											children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+												className: "dsh-codex-device-value",
+												children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", {
+													className: "dsh-codex-device-code",
+													"aria-label": t("deviceCodeLabel"),
+													children: deviceLogin.login.userCode
+												}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CopyButton, {
+													copied: copiedField === "code",
+													label: t("deviceCodeCopy"),
+													onClick: () => void copyDeviceValue("code")
+												})]
+											}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+												className: "dsh-codex-device-value",
+												children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("a", {
+													className: "dsh-codex-link",
+													href: deviceLogin.login.verificationUrl,
+													target: "_blank",
+													rel: "noreferrer",
+													children: t("deviceCodeOpen")
+												}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CopyButton, {
+													copied: copiedField === "link",
+													label: t("deviceCodeCopy"),
+													onClick: () => void copyDeviceValue("link")
+												})]
+											})]
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+											className: "dsha-muted",
+											role: "status",
+											children: t("deviceCodeWaiting").replace("{time}", formatRemaining(deviceLogin.deadlineMs, now))
+										}),
+										deviceError !== null ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+											className: "dsh-codex-error",
+											role: "alert",
+											children: deviceError
+										}) : null,
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+											className: "dsha-actions",
+											children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Button, {
+												disabled: busy !== null,
+												onClick: cancelLogin,
+												children: t("cancel")
+											})
+										})
+									]
+								}) : null,
 								popupBlocked ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 									className: "dsh-codex-error",
 									children: t("popupBlocked")
@@ -1920,7 +2157,45 @@ window.__ModuleLoader__.load({
 										onClick: () => void stopImporting(),
 										children: busy === "adopt-disable" ? t("stopImportingBusy") : t("stopImporting")
 									})
-								})] }) : null
+								})] }) : null,
+								status?.poolStorage !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									"data-dsh-pool-storage": status.poolStorage.backend,
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+											className: "dsha-pref-row",
+											children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", { children: t("poolStorageTitle") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+												className: "dsha-muted",
+												children: status.poolStorage.mode === "keyring" ? t("poolStorageKeyringHint") : t("poolStorageCredentialsHint")
+											})] }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
+												className: "dsha-select",
+												"aria-label": t("poolStorageTitle"),
+												value: status.poolStorage.mode,
+												disabled: busy !== null,
+												onChange: (event) => void changePoolStorage(event.currentTarget.value),
+												children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+													value: "keyring",
+													children: t("poolStorageKeyring")
+												}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+													value: "credentials",
+													children: t("poolStorageCredentials")
+												})]
+											})]
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+											className: "dsha-muted",
+											children: formatPoolLabel(t("poolStorageEffective"), { storage: poolStorageBackendLabel(status.poolStorage, t) })
+										}),
+										poolStorageUnavailable === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+											className: "dsh-codex-error",
+											role: "status",
+											children: poolStorageUnavailable
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+											className: "dsha-muted",
+											children: t("poolStorageSwitchWarning")
+										})
+									]
+								}) : null
 							]
 						}),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)(Section, {
@@ -2522,6 +2797,79 @@ window.__ModuleLoader__.load({
 			].filter((part) => part !== null);
 			return parts.length > 0 ? parts.join(" · ") : t("unknown");
 		}
+		/**
+		* `m:ss` left on the grant, floored at zero — the panel's countdown.
+		*
+		* Both arguments are on the same clock: `deadlineMs` was derived from the host's
+		* `expiresAt - now` pair when the answer arrived (see {@link panelDeadlineMs}),
+		* so this subtraction never mixes a host timestamp with a browser one.
+		*/
+		function formatRemaining(deadlineMs, nowMs) {
+			const total = Math.max(0, Math.floor(deadlineMs - nowMs) / 1e3);
+			const minutes = Math.floor(total / 60);
+			const seconds = Math.floor(total % 60);
+			return `${minutes}:${String(seconds).padStart(2, "0")}`;
+		}
+		/**
+		* The panel's copy control, used twice.
+		*
+		* One component rather than two buttons with the same classes: the two icons sat
+		* at different sizes in the first version, and the only durable fix is that there
+		* is exactly one of them. The tooltip never changes — the tick is the feedback,
+		* so the affordance keeps saying what it does.
+		*/
+		function CopyButton({ copied, label, onClick }) {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+				type: "button",
+				className: copied ? "dsh-codex-copy dsh-codex-copy-done" : "dsh-codex-copy",
+				title: label,
+				"aria-label": label,
+				"data-copied": copied ? "true" : "false",
+				onClick,
+				children: copied ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CheckIcon, {}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CopyIcon, {})
+			});
+		}
+		function CopyIcon() {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("svg", {
+				viewBox: "0 0 16 16",
+				width: "14",
+				height: "14",
+				"aria-hidden": "true",
+				focusable: "false",
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("rect", {
+					x: "5.6",
+					y: "5.6",
+					width: "8",
+					height: "8",
+					rx: "1.6",
+					fill: "none",
+					stroke: "currentColor",
+					strokeWidth: "1.3"
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
+					d: "M10.4 5.6V4.2A1.6 1.6 0 0 0 8.8 2.6H4.2A1.6 1.6 0 0 0 2.6 4.2v4.6A1.6 1.6 0 0 0 4.2 10.4h1.4",
+					fill: "none",
+					stroke: "currentColor",
+					strokeWidth: "1.3"
+				})]
+			});
+		}
+		function CheckIcon() {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("svg", {
+				viewBox: "0 0 16 16",
+				width: "14",
+				height: "14",
+				"aria-hidden": "true",
+				focusable: "false",
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
+					d: "M3 8.4l3.3 3.3L13 4.8",
+					fill: "none",
+					stroke: "currentColor",
+					strokeWidth: "1.8",
+					strokeLinecap: "round",
+					strokeLinejoin: "round"
+				})
+			});
+		}
 		function formatDate(seconds) {
 			if (seconds === void 0 || seconds === null || typeof seconds !== "number" || !Number.isFinite(seconds) || seconds <= 0) return "—";
 			const ms = seconds > 1e10 ? seconds : seconds * 1e3;
@@ -4351,11 +4699,8 @@ window.__ModuleLoader__.load({
 			defaultReasoningEffortHint: "可用档位跟随勾选的模型自己声明的能力（一个都没勾时按 low / high / max / none 全列）；none 表示关闭思考，只对允许关闭的模型有效。切换档位会使上下文缓存失效，建议在同一会话中保持一致。",
 			effortThinkingOnlyNote: "勾选的模型里有只支持思考模式的：{models}。它们没有「关闭思考」这一档，请求关闭思考会被服务端拒绝（400），所以这里不提供。",
 			effortNotOffered: "当前勾选的模型不接受",
-			cacheTtl: "上下文缓存时长",
-			cacheTtlHint: "Kimi 按前缀自动缓存，这里选择写入档位（只有 5m / 1h 两档）。不传时服务端按 5 分钟档写入。1h 写入单价约为 5m 的两倍，只有当同一前缀会在一小时内被反复读取才划算。档位在首次写入时锁定，之后命中按原 TTL 续期，无法改写。依据回合间隔选：间隔通常短于约 30 分钟选 5 分钟；调度、等子代理这类会出现长空闲的会话选 1 小时。",
-			cacheTtlDefault: "不传（服务端按 5 分钟档写入）",
-			cacheTtl5m: "5 分钟",
-			cacheTtl1h: "1 小时",
+			cacheNote: "上下文缓存",
+			cacheNoteHint: "Kimi 按前缀自动缓存，本线路不发送任何缓存时长字段，由服务端自己决定写入与存活。缓存时长无法从客户端选择：官方文档只给开放平台写了 5m / 1h 两档，Kimi Code 订阅端点既没有文档说明，官方 CLI 也没有发出该字段的能力。实测该端点的默认档在 25 分钟内稳定命中、30 分钟开始零星失效、35 分钟全部失效，所以这里的过期提示按 30 分钟判断。",
 			defaultEffortAuto: "使用模型默认值",
 			effortLow: "低 (low)",
 			effortHigh: "高 (high)",
@@ -4485,11 +4830,8 @@ window.__ModuleLoader__.load({
 			defaultReasoningEffortHint: "The levels offered follow what the checked models declare (all of low / high / max / none when none is checked); none disables thinking and only applies to models that allow it. Switching the level invalidates the context cache, so keep it steady within a session.",
 			effortThinkingOnlyNote: "Some checked models think at every level: {models}. They have no \"thinking off\" — the service rejects that request with HTTP 400 — so it is not offered here.",
 			effortNotOffered: "not accepted by the checked models",
-			cacheTtl: "Context cache duration",
-			cacheTtlHint: "Kimi caches prefixes automatically; this chooses the write tier, and there are only two (5m and 1h). Unset sends no cache field, and the service then writes at the 5-minute tier. A 1h write costs about twice a 5m one and only pays off when the same prefix is re-read within the hour. The tier is locked at the first write, and later hits renew it under that original TTL. Choose by the gap between turns: 5 minutes when turns are normally less than about 30 minutes apart, 1 hour for a session that idles for long stretches, such as dispatch work waiting on subagents.",
-			cacheTtlDefault: "Unset (service writes at the 5-minute tier)",
-			cacheTtl5m: "5 minutes",
-			cacheTtl1h: "1 hour",
+			cacheNote: "Context cache",
+			cacheNoteHint: "Kimi caches prefixes automatically. This line sends no cache-duration field at all, so the service decides both the write and its lifetime. The duration is not selectable from the client: the 5m / 1h tiers are documented only for the Open Platform, the Kimi Code subscription endpoint documents nothing, and the official CLI has no way to emit that field. Measured on this endpoint, the default tier stays warm through 25 minutes, starts missing around 30, and is fully cold by 35 — which is why the expiry notice here triggers at 30 minutes.",
 			defaultEffortAuto: "Use the model default",
 			effortLow: "Low",
 			effortHigh: "High",
@@ -5010,18 +5352,6 @@ window.__ModuleLoader__.load({
 					setError(err instanceof Error ? err.message : String(err));
 				}
 			};
-			const handleUpdateCacheTtl = async (ttl) => {
-				try {
-					const updated = await api$12.request("/settings", {
-						method: "POST",
-						body: JSON.stringify({ cacheTtl: ttl })
-					});
-					setStatus(updated);
-					notifyChange();
-				} catch (err) {
-					setError(err instanceof Error ? err.message : String(err));
-				}
-			};
 			const handleSaveContextWindow = async (modelId) => {
 				const raw = contextDrafts[modelId] || "";
 				const parsed = parsePositiveCapacity$1(raw);
@@ -5424,35 +5754,12 @@ window.__ModuleLoader__.load({
 								className: "dsha-notice",
 								children: t.effortThinkingOnlyNote.replace("{models}", thinkingOnly.map((model) => model.name).join(" · "))
 							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 								className: "dsha-pref-row",
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", { children: t.cacheTtl }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", { children: t.cacheNote }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 									className: "dsha-muted",
-									children: t.cacheTtlHint
-								})] }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
-									className: "dsha-select",
-									"aria-label": t.cacheTtl,
-									value: status?.cacheTtl ?? "",
-									disabled: busy !== null,
-									onChange: (event) => {
-										const value = event.currentTarget.value;
-										handleUpdateCacheTtl(value === "" ? null : value);
-									},
-									children: [
-										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
-											value: "",
-											children: t.cacheTtlDefault
-										}),
-										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
-											value: "5m",
-											children: t.cacheTtl5m
-										}),
-										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
-											value: "1h",
-											children: t.cacheTtl1h
-										})
-									]
-								})]
+									children: t.cacheNoteHint
+								})] })
 							})
 						]
 					}),
@@ -12920,6 +13227,23 @@ window.__ModuleLoader__.load({
 		//#region src/shared/cline-pass-contracts.ts
 		const CLINE_PASS_PROVIDER_NAME = "Cline Pass";
 		const CLINE_PASS_ROUTE_PREFIX = "/cline-pass/api";
+		/**
+		* The gateway's anonymous contributor-route label.
+		*
+		* When Cline routes a model id onto the VMC fallback net, the serving channel
+		* reports itself as `openai-compatible-private` and the resolved slug moves
+		* under `private/…-contributor`. Answers from it may be used for training and
+		* carry no zero-data-retention guarantee, so a pin landing there is a fact the
+		* user must see, not a channel like any other.
+		*/
+		const CLINE_PASS_ANONYMOUS_UPSTREAMS = Object.freeze(["openai-compatible-private"]);
+		/** Whether a channel name or resolved slug names the anonymous contributor route. */
+		function isClinePassAnonymousUpstream(name, canonicalSlug) {
+			const value = String(name ?? "").toLowerCase();
+			if (CLINE_PASS_ANONYMOUS_UPSTREAMS.includes(value)) return true;
+			const slug = String(canonicalSlug ?? "").toLowerCase();
+			return slug.startsWith("private/") || slug.includes("-contributor");
+		}
 		/** Human label for the gateway's quota-window spelling. */
 		function clinePassWindowLabel(type) {
 			switch (type) {
@@ -13067,6 +13391,21 @@ window.__ModuleLoader__.load({
 			refreshCatalog() {
 				return api$7.post("/catalog/refresh", {});
 			}
+			searchCatalog(query) {
+				return api$7.get("/catalog/search?q=" + encodeURIComponent(query));
+			}
+			/**
+			* Add one search hit.
+			*
+			* A marketplace id is billed against the Cline Credits balance, so the host
+			* refuses it until the caller acknowledges that (`acknowledgeBilling`).
+			*/
+			addCatalogModel(model, acknowledgeBilling = false) {
+				return api$7.post("/catalog/add", acknowledgeBilling ? {
+					model,
+					acknowledgeBilling: true
+				} : { model });
+			}
 			readUsage() {
 				return api$7.post("/usage", {});
 			}
@@ -13125,7 +13464,7 @@ window.__ModuleLoader__.load({
 			keyTestFailed: "Key 不可用：{detail}",
 			testSavedKey: "测试",
 			modelsSection: "模型",
-			modelsHint: "模型列表来自官方订阅目录；首次使用前先刷新一次。未勾选的模型不会出现在模型选择器中。",
+			modelsHint: "只列出随包内置模型、官方订阅目录和手动添加的模型；首次使用前先刷新一次。其他网关模型在下方按需搜索添加，未勾选的模型不会出现在模型选择器中。",
 			modelCount: "{count} 个模型",
 			modelChecklistCount: "已选 {count} / 共 {total} 个模型",
 			selectAll: "全选",
@@ -13136,6 +13475,17 @@ window.__ModuleLoader__.load({
 			catalogEmpty: "官方目录没有返回任何模型。",
 			noModels: "暂无可用模型。",
 			catalogSources: "目录来源：{sources}",
+			catalogSearch: "搜索",
+			catalogSearching: "搜索中…",
+			catalogSearchPlaceholder: "搜索网关目录中的模型 id…",
+			catalogSearchHint: "搜索结果只用于选择添加，不会把整个网关目录列出来。标「Cline Credits」的是 marketplace 模型，按 credits 计费，不占订阅额度。",
+			catalogSearchEmpty: "没有匹配的网关模型。",
+			catalogAdd: "添加",
+			catalogAdded: "已添加",
+			catalogBillingSubscription: "订阅额度",
+			catalogBillingCredits: "Cline Credits",
+			catalogCreditsWarning: "marketplace 模型，按 Cline Credits 计费，不占用 Cline Pass 订阅额度；余额不足会返回 402。",
+			catalogAddCredits: "确认按 credits 添加",
 			contextSection: "上下文窗口",
 			contextHint: "只对勾选的模型显示。留空或保存无效值会提示错误；恢复默认会清掉覆盖值。",
 			tokens: "tokens",
@@ -13170,6 +13520,18 @@ window.__ModuleLoader__.load({
 			noChannels: "尚未探测渠道。点「探测」获取这个模型的可用上游。",
 			channelHint: "点击渠道名按顺序钉住；再次点击移除。⊘ 切换排除。",
 			lastServed: "最近由 {provider} 服务（{ms}ms）",
+			anonymousChannel: "匿名路由",
+			anonymousChannelHint: "网关的匿名贡献者路由：回答可能被用于训练，无零数据保留（ZDR）保证",
+			anonymousServed: "注意：本次回答来自网关的匿名贡献者路由（{provider}），可能被用于训练且无 ZDR 保证",
+			fingerprintOk: "第一方 DeepSeek 指纹：{fingerprint}",
+			pinLikelyIgnored: "该模型当前只发现匿名路由，钉选很可能被网关静默忽略",
+			addChannel: "添加",
+			manualChannelPlaceholder: "手动输入渠道名（如 deepseek）…",
+			manualChannelHint: "探测依赖网关报错列出渠道；当网关把模型改指匿名路由时探测拿不到列表。渠道名是网关级词汇（其他模型探测到的可直接选用），手动钉选后请用「测试」回读验证是否被采纳。",
+			hasLabel: "能力过滤 (has)",
+			hasHint: "Vercel 网关的模型能力过滤，只写进 providerOptions.gateway.has。1017 默认 vision + implicit-caching（实测是钉选与渠道探测生效的必要条件）；其他模型通常留空。",
+			pinHas: "能力过滤：{list}",
+			testHas: "本次能力过滤：{list}",
 			probedAt: "探测于 {time}",
 			pipeline: "管线：{pipeline}",
 			notPinnable: "该模型当前不支持钉住",
@@ -13205,8 +13567,6 @@ window.__ModuleLoader__.load({
 			maxConcurrentRequests: "每账号并发流上限（0 = 不限）",
 			streamIdleTimeoutMs: "流空闲超时（ms）",
 			historyLimit: "历史保留条数",
-			exposeCatalog: "在模型选择器中列出网关目录的额外模型",
-			exposeCatalogHint: "关闭时只列出官方订阅目录与随包内置模型。",
 			pinSpelling: "钉住字段写法",
 			pinSpellingBoth: "两种写法都发（推荐）",
 			pinSpellingDetected: "只发探测到的写法",
@@ -13267,7 +13627,7 @@ window.__ModuleLoader__.load({
 			keyTestFailed: "Key rejected: {detail}",
 			testSavedKey: "Test",
 			modelsSection: "Models",
-			modelsHint: "The list comes from the official subscription catalog; sync once before first use. Unchecked models do not appear in the model picker.",
+			modelsHint: "Only bundled models, the official subscription catalog, and manually added models are listed; sync once before first use. Search below to add any other gateway model on demand. Unchecked models do not appear in the model picker.",
 			modelCount: "{count} model(s)",
 			modelChecklistCount: "{count} of {total} selected",
 			selectAll: "Select all",
@@ -13278,6 +13638,17 @@ window.__ModuleLoader__.load({
 			catalogEmpty: "The official catalog returned no models.",
 			noModels: "No models available.",
 			catalogSources: "Catalog sources: {sources}",
+			catalogSearch: "Search",
+			catalogSearching: "Searching…",
+			catalogSearchPlaceholder: "Search the gateway catalog by model id…",
+			catalogSearchHint: "Search results are only candidates to add; the full gateway catalog is never dumped into this page. A \"Cline Credits\" hit is a marketplace model billed against the credits balance, not the plan quota.",
+			catalogSearchEmpty: "No matching gateway models.",
+			catalogAdd: "Add",
+			catalogAdded: "Added",
+			catalogBillingSubscription: "Subscription",
+			catalogBillingCredits: "Cline Credits",
+			catalogCreditsWarning: "Marketplace model billed against the Cline Credits balance, not the Cline Pass plan; an empty balance answers 402.",
+			catalogAddCredits: "Add and bill credits",
 			contextSection: "Context windows",
 			contextHint: "Shown for checked models only. An invalid value is reported rather than saved; restoring clears the override.",
 			tokens: "tokens",
@@ -13312,6 +13683,18 @@ window.__ModuleLoader__.load({
 			noChannels: "No channels discovered yet. Use \"Probe\" to read the model upstream list.",
 			channelHint: "Click a channel to add it to the pin order; click again to remove. ⊘ toggles exclusion.",
 			lastServed: "Last served by {provider} ({ms}ms)",
+			anonymousChannel: "anonymous route",
+			anonymousChannelHint: "The gateway's anonymous contributor route: answers may be used for training, with no zero-data-retention guarantee",
+			anonymousServed: "Note: this answer was served by the gateway's anonymous contributor route ({provider}) — it may be used for training and carries no ZDR guarantee",
+			fingerprintOk: "First-party DeepSeek fingerprint: {fingerprint}",
+			pinLikelyIgnored: "Only the anonymous route has been discovered for this model, so a pin will most likely be silently ignored by the gateway",
+			addChannel: "Add",
+			manualChannelPlaceholder: "type a channel name (e.g. deepseek)…",
+			manualChannelHint: "Discovery relies on the gateway naming its channels in an error; a model redirected to the anonymous route yields no list. Channel names are a gateway-wide vocabulary (anything another model discovered is offered), so pin by name anyway and verify with Test.",
+			hasLabel: "Capability filter (has)",
+			hasHint: "Vercel gateway capability filter, written only to providerOptions.gateway.has. The 1017 default is vision + implicit-caching (measured as required for pinning and discovery); leave empty for other models unless a probe says otherwise.",
+			pinHas: "Capabilities: {list}",
+			testHas: "Capabilities sent: {list}",
 			probedAt: "Probed {time}",
 			pipeline: "Pipeline: {pipeline}",
 			notPinnable: "This model is not pinnable right now",
@@ -13347,8 +13730,6 @@ window.__ModuleLoader__.load({
 			maxConcurrentRequests: "Streams per account (0 = unlimited)",
 			streamIdleTimeoutMs: "Stream idle timeout (ms)",
 			historyLimit: "History rows retained",
-			exposeCatalog: "List extra models from the gateway catalog",
-			exposeCatalogHint: "When off, only the official subscription catalog and the bundled table are listed.",
 			pinSpelling: "Pin field spelling",
 			pinSpellingBoth: "Write both spellings (recommended)",
 			pinSpellingDetected: "Write only the probed spelling",
@@ -13399,7 +13780,6 @@ window.__ModuleLoader__.load({
 				maxConcurrentRequests: String(status.settings.maxConcurrentRequests),
 				streamIdleTimeoutMs: String(status.settings.streamIdleTimeoutMs),
 				historyLimit: String(status.settings.historyLimit),
-				exposeCatalog: status.settings.exposeCatalog,
 				pinSpelling: status.settings.pinSpelling
 			};
 		}
@@ -13427,6 +13807,11 @@ window.__ModuleLoader__.load({
 			const [settingsForm, setSettingsForm] = (0, react.useState)(null);
 			const [history, setHistory] = (0, react.useState)(null);
 			const [loginFlow, setLoginFlow] = (0, react.useState)(null);
+			const [catalogQuery, setCatalogQuery] = (0, react.useState)("");
+			const [catalogResults, setCatalogResults] = (0, react.useState)([]);
+			const [catalogSearched, setCatalogSearched] = (0, react.useState)(false);
+			/** Ids the user has already been told are credit-billed; the second click adds them. */
+			const [catalogCreditsAck, setCatalogCreditsAck] = (0, react.useState)({});
 			/** Follow-up poll owed while the host refreshes the quota behind an answer. */
 			const quotaFollowUp = (0, react.useRef)(null);
 			/**
@@ -13641,6 +14026,28 @@ window.__ModuleLoader__.load({
 			const refreshCatalog = (0, react.useCallback)(() => {
 				run("catalog", async () => (await API$3.refreshCatalog()).status);
 			}, [run]);
+			const searchCatalog = (0, react.useCallback)(() => {
+				const query = catalogQuery.trim();
+				if (query === "") return;
+				setBusy("catalog-search");
+				setError(null);
+				API$3.searchCatalog(query).then((outcome) => {
+					setCatalogResults(outcome.results);
+					setCatalogSearched(true);
+					setCatalogCreditsAck({});
+				}).catch((cause) => setError(detail$1(cause))).finally(() => setBusy(null));
+			}, [catalogQuery]);
+			const addCatalogModel = (0, react.useCallback)((id, acknowledgeBilling = false) => {
+				setBusy("catalog-add:" + id);
+				setError(null);
+				API$3.addCatalogModel(id, acknowledgeBilling).then((outcome) => {
+					applyStatus(outcome.status);
+					setCatalogResults((current) => current.map((entry) => entry.id === id ? {
+						...entry,
+						added: true
+					} : entry));
+				}).catch((cause) => setError(detail$1(cause))).finally(() => setBusy(null));
+			}, [applyStatus]);
 			const refreshUsage = (0, react.useCallback)(() => {
 				run("usage", async () => {
 					const outcome = await API$3.readUsage();
@@ -13672,7 +14079,6 @@ window.__ModuleLoader__.load({
 				API$3.updateSettings({
 					baseURL: settingsForm.baseURL,
 					...numbers,
-					exposeCatalog: settingsForm.exposeCatalog,
 					pinSpelling: settingsForm.pinSpelling
 				}).then((next) => {
 					applyStatus(next);
@@ -13711,7 +14117,8 @@ window.__ModuleLoader__.load({
 				upstreams: [...model.pinned],
 				exclude: [...model.excluded],
 				pinMode: model.pinMode,
-				sort: model.sort
+				sort: model.sort,
+				has: [...model.has ?? []]
 			}, [pinDrafts]);
 			const editPin = (0, react.useCallback)((model, patch) => {
 				setPinDrafts((current) => ({
@@ -13988,6 +14395,79 @@ window.__ModuleLoader__.load({
 								style: { fontSize: 12 },
 								children: t.modelsHint
 							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("form", {
+								className: "dshcp-pin-row",
+								onSubmit: (event) => {
+									event.preventDefault();
+									searchCatalog();
+								},
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									className: "dsha-input",
+									style: {
+										flex: 1,
+										minWidth: 240
+									},
+									value: catalogQuery,
+									placeholder: t.catalogSearchPlaceholder,
+									disabled: busyAny,
+									onChange: (event) => setCatalogQuery(event.target.value)
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									className: "dsha-btn",
+									type: "submit",
+									disabled: busyAny || catalogQuery.trim() === "",
+									children: busy === "catalog-search" ? t.catalogSearching : t.catalogSearch
+								})]
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "dsha-muted",
+								style: { fontSize: 12 },
+								children: t.catalogSearchHint
+							}),
+							catalogSearched && catalogResults.length === 0 && busy !== "catalog-search" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "dsha-muted",
+								style: { fontSize: 12 },
+								children: t.catalogSearchEmpty
+							}),
+							catalogResults.length > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+								className: "dshcp-channels",
+								children: catalogResults.map((entry) => {
+									const acknowledged = catalogCreditsAck[entry.id] === true;
+									return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+										className: "dshcp-channel",
+										"data-added": entry.added,
+										title: entry.id,
+										children: [
+											entry.id,
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+												className: "dsha-muted",
+												style: { fontSize: 11 },
+												children: entry.billing === "credits" ? t.catalogBillingCredits : t.catalogBillingSubscription
+											}),
+											entry.billing === "credits" && !entry.added && acknowledged && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+												className: "dsha-muted",
+												style: { fontSize: 11 },
+												children: t.catalogCreditsWarning
+											}),
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+												type: "button",
+												className: "dshcp-exclude",
+												disabled: busyAny || entry.added,
+												onClick: () => {
+													if (entry.billing === "credits" && !acknowledged) {
+														setCatalogCreditsAck((current) => ({
+															...current,
+															[entry.id]: true
+														}));
+														return;
+													}
+													addCatalogModel(entry.id, entry.billing === "credits");
+												},
+												children: entry.added ? t.catalogAdded : busy === "catalog-add:" + entry.id ? "…" : entry.billing === "credits" && !acknowledged ? t.catalogAdd : entry.billing === "credits" ? t.catalogAddCredits : t.catalogAdd
+											})
+										]
+									}, entry.id);
+								})
+							}),
 							status !== null && models.length === 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 								className: "dsha-empty",
 								children: status.catalogSynced ? t.catalogEmpty : t.catalogNeverSynced
@@ -14100,6 +14580,7 @@ window.__ModuleLoader__.load({
 									result: results[model.id] ?? {},
 									busy,
 									t,
+									suggestions: [...new Set(models.flatMap((entry) => entry.upstreams))],
 									onToggleChannel: (upstream) => {
 										const draft = pinDraftFor(model);
 										editPin(model, {
@@ -14116,6 +14597,7 @@ window.__ModuleLoader__.load({
 									},
 									onPinMode: (pinMode) => editPin(model, { pinMode }),
 									onSort: (sort) => editPin(model, { sort }),
+									onHas: (has) => editPin(model, { has }),
 									onProbe: () => {
 										setBusy("probe:" + model.id);
 										setError(null);
@@ -14162,7 +14644,8 @@ window.__ModuleLoader__.load({
 										setError(null);
 										API$3.test(model.id, {
 											...draft.upstreams.length === 0 ? {} : { upstreams: draft.upstreams },
-											...draft.exclude.length === 0 ? {} : { exclude: draft.exclude }
+											...draft.exclude.length === 0 ? {} : { exclude: draft.exclude },
+											has: draft.has
 										}).then((outcome) => {
 											applyStatus(outcome.status);
 											setResults((current) => ({
@@ -14427,29 +14910,6 @@ window.__ModuleLoader__.load({
 									})]
 								})]
 							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-								className: "dsha-pref-row",
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("label", {
-									htmlFor: "cline-pass-expose-catalog",
-									children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", { children: t.exposeCatalog })
-								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-									className: "dsha-muted",
-									style: {
-										fontSize: 12,
-										marginTop: 2
-									},
-									children: t.exposeCatalogHint
-								})] }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-									id: "cline-pass-expose-catalog",
-									className: "dshcp-check",
-									type: "checkbox",
-									checked: settingsForm.exposeCatalog,
-									onChange: (event) => setSettingsForm({
-										...settingsForm,
-										exposeCatalog: event.target.checked
-									})
-								})]
-							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								className: "dsha-pref-row",
 								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", { children: t.exposeTools }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
@@ -14486,6 +14946,10 @@ window.__ModuleLoader__.load({
 		function ChannelEditor(props) {
 			const { model, draft, result, t } = props;
 			const busyAny = props.busy !== null;
+			const [manualChannel, setManualChannel] = (0, react.useState)("");
+			const [hasText, setHasText] = (0, react.useState)(draft.has.join(", "));
+			const hasValue = draft.has.join(", ");
+			(0, react.useEffect)(() => setHasText(hasValue), [model.id, hasValue]);
 			const verdicts = new Map(model.upstreamStatus.map((entry) => [entry.upstream, entry]));
 			const channels = [.../* @__PURE__ */ new Set([
 				...model.upstreams,
@@ -14501,6 +14965,7 @@ window.__ModuleLoader__.load({
 							t.pipeline.replace("{pipeline}", model.pipeline === "" ? "—" : model.pipeline),
 							model.pinnable ? "" : ` · ${t.notPinnable}`,
 							model.lastProvider !== "" ? ` · ${t.lastServed.replace("{provider}", model.lastProvider).replace("{ms}", String(model.lastMs))}` : "",
+							isClinePassAnonymousUpstream(model.lastProvider) ? ` · ⚠ ${t.anonymousChannel}` : "",
 							model.probedAt > 0 ? ` · ${t.probedAt.replace("{time}", formatDate$1(model.probedAt))}` : ""
 						]
 					}),
@@ -14519,19 +14984,22 @@ window.__ModuleLoader__.load({
 							const verdict = verdicts.get(upstream);
 							const pinned = draft.upstreams.includes(upstream);
 							const excluded = draft.exclude.includes(upstream);
+							const anonymous = isClinePassAnonymousUpstream(upstream);
+							const baseTitle = verdict === void 0 ? upstream : `${upstream}: ${verdict.status}${verdict.note === "" ? "" : ` — ${verdict.note}`}`;
 							return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
 								className: "dshcp-channel",
 								"data-pinned": pinned,
 								"data-excluded": excluded,
 								"data-status": verdict?.status ?? "unknown",
+								"data-anonymous": anonymous,
 								role: "button",
 								tabIndex: 0,
-								title: verdict === void 0 ? upstream : `${upstream}: ${verdict.status}${verdict.note === "" ? "" : ` — ${verdict.note}`}`,
+								title: anonymous ? `${baseTitle} — ${t.anonymousChannelHint}` : baseTitle,
 								onClick: () => props.onToggleChannel(upstream),
 								onKeyDown: (event) => {
 									if (event.key === "Enter" || event.key === " ") props.onToggleChannel(upstream);
 								},
-								children: [upstream, /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								children: [anonymous ? `⚠ ${upstream}` : upstream, /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 									type: "button",
 									className: "dshcp-exclude",
 									"aria-label": `${excluded ? "include" : "exclude"} ${upstream}`,
@@ -14546,46 +15014,128 @@ window.__ModuleLoader__.load({
 					})] }),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "dshcp-pin-row",
-						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [t.pinMode, /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
-							className: "dsha-select",
-							value: draft.pinMode,
-							disabled: busyAny,
-							onChange: (event) => props.onPinMode(event.target.value === "preferred" ? "preferred" : "strict"),
-							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
-								value: "strict",
-								children: t.modeStrict
-							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
-								value: "preferred",
-								children: t.modePreferred
-							})]
-						})] }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [t.sort, /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
-							className: "dsha-select",
-							value: draft.sort === "" ? "none" : draft.sort,
-							disabled: busyAny,
-							onChange: (event) => props.onSort(event.target.value === "none" ? "" : event.target.value),
-							children: [
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
-									value: "none",
-									children: t.sortNone
-								}),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
-									value: "cost",
-									children: t.sortCost
-								}),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
-									value: "ttft",
-									children: t.sortTtft
-								}),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
-									value: "tps",
-									children: t.sortTps
-								})
-							]
-						})] })]
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+								className: "dsha-input",
+								style: { minWidth: 220 },
+								list: `dshcp-known-${model.id}`,
+								placeholder: t.manualChannelPlaceholder,
+								value: manualChannel,
+								disabled: busyAny,
+								onChange: (event) => setManualChannel(event.target.value),
+								onKeyDown: (event) => {
+									if (event.key !== "Enter") return;
+									const name = manualChannel.trim().toLowerCase();
+									if (name === "") return;
+									if (!draft.upstreams.includes(name)) props.onToggleChannel(name);
+									setManualChannel("");
+								}
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("datalist", {
+								id: `dshcp-known-${model.id}`,
+								children: props.suggestions.map((name) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", { value: name }, name))
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								className: "dsha-btn",
+								disabled: busyAny || manualChannel.trim() === "",
+								onClick: () => {
+									const name = manualChannel.trim().toLowerCase();
+									if (name === "") return;
+									if (!draft.upstreams.includes(name)) props.onToggleChannel(name);
+									setManualChannel("");
+								},
+								children: t.addChannel
+							})
+						]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsha-muted",
+						style: { fontSize: 12 },
+						children: t.manualChannelHint
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dshcp-pin-row",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [t.pinMode, /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
+								className: "dsha-select",
+								value: draft.pinMode,
+								disabled: busyAny,
+								onChange: (event) => props.onPinMode(event.target.value === "preferred" ? "preferred" : "strict"),
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+									value: "strict",
+									children: t.modeStrict
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+									value: "preferred",
+									children: t.modePreferred
+								})]
+							})] }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [t.sort, /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
+								className: "dsha-select",
+								value: draft.sort === "" ? "none" : draft.sort,
+								disabled: busyAny,
+								onChange: (event) => props.onSort(event.target.value === "none" ? "" : event.target.value),
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+										value: "none",
+										children: t.sortNone
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+										value: "cost",
+										children: t.sortCost
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+										value: "ttft",
+										children: t.sortTtft
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+										value: "tps",
+										children: t.sortTps
+									})
+								]
+							})] }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+								style: {
+									flex: 1,
+									minWidth: 260
+								},
+								children: [t.hasLabel, /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									className: "dsha-input",
+									style: {
+										flex: 1,
+										minWidth: 180
+									},
+									value: hasText,
+									disabled: busyAny,
+									placeholder: "vision, implicit-caching",
+									onChange: (event) => {
+										const text = event.target.value;
+										setHasText(text);
+										props.onHas([...new Set(text.split(/[\s,]+/).map((name) => name.trim()).filter((name) => name !== ""))]);
+									}
+								})]
+							})
+						]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsha-muted",
+						style: { fontSize: 12 },
+						children: t.hasHint
 					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
 						className: "dshcp-meta",
-						children: [draft.upstreams.length === 0 ? t.pinAuto : t.pinPinned.replace("{list}", draft.upstreams.join(" > ")), draft.exclude.length === 0 ? "" : ` · ${t.pinExcluded.replace("{list}", draft.exclude.join(", "))}`]
+						children: [
+							draft.upstreams.length === 0 ? t.pinAuto : t.pinPinned.replace("{list}", draft.upstreams.join(" > ")),
+							draft.exclude.length === 0 ? "" : ` · ${t.pinExcluded.replace("{list}", draft.exclude.join(", "))}`,
+							draft.has.length === 0 ? "" : ` · ${t.pinHas.replace("{list}", draft.has.join(", "))}`
+						]
+					}),
+					draft.upstreams.some((name) => isClinePassAnonymousUpstream(name)) && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dshcp-warning",
+						children: t.anonymousServed.replace("{provider}", draft.upstreams.find((name) => isClinePassAnonymousUpstream(name)) ?? "")
+					}),
+					draft.upstreams.length > 0 && !draft.upstreams.some((name) => isClinePassAnonymousUpstream(name)) && model.upstreams.length > 0 && model.upstreams.every((name) => isClinePassAnonymousUpstream(name)) && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dshcp-warning",
+						children: t.pinLikelyIgnored
 					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "dshcp-actions",
@@ -14658,6 +15208,18 @@ window.__ModuleLoader__.load({
 							className: result.test.ok ? "dshcp-meta" : "dshcp-warning",
 							children: result.test.ok ? t.testServed.replace("{provider}", result.test.actual || "—").replace("{ms}", String(result.test.ms)) : t.testFailed.replace("{detail}", result.test.error)
 						}),
+						result.test.anonymous && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: "dshcp-warning",
+							children: t.anonymousServed.replace("{provider}", result.test.actual || "openai-compatible-private")
+						}),
+						(result.test.has ?? []).length > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: "dshcp-meta",
+							children: t.testHas.replace("{list}", (result.test.has ?? []).join(", "))
+						}),
+						result.test.fingerprint !== "" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: "dshcp-meta",
+							children: t.fingerprintOk.replace("{fingerprint}", result.test.fingerprint)
+						}),
 						result.test.warnings.length > 0 && result.test.warnings.map((warning) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 							className: "dshcp-warning",
 							children: warning
@@ -14746,7 +15308,7 @@ window.__ModuleLoader__.load({
 			regionGlobal: "全球区（qoder.com）",
 			regionCn: "中国站（qoder.com.cn）",
 			regionHint: "区域由凭据唯一决定，本页只决定「下一次登录」落在哪一区；两区端点互不通用。",
-			regionHintExtra: "全球区支持浏览器设备流登录与 PAT；中国站没有设备流，只支持 PAT 粘贴或导入本机 qodercli 登录态。",
+			regionHintExtra: "全球区支持浏览器设备流登录与 PAT；中国站没有设备流，只支持 PAT 粘贴或导入本机 qodercli 登录态。粘贴 PAT 时不用纠结区域：一个区拒了，插件会自动改试另一个区，落盘的是真正认这把 PAT 的那一区。",
 			authorizing: "授权中…",
 			loginIdle: "尚未开始登录。",
 			/** idle 不是「你没登录」：host 的流程状态是进程内变量，重启后回到 idle 而号池里的账号还在。 */
@@ -14867,7 +15429,7 @@ window.__ModuleLoader__.load({
 				regionGlobal: "Global (qoder.com)",
 				regionCn: "China (qoder.com.cn)",
 				regionHint: "Region is a property of the credential; this picker only decides where the NEXT sign-in lands.",
-				regionHintExtra: "Global supports browser device sign-in and PAT; the China site has no device flow — paste a PAT or import the local qodercli session.",
+				regionHintExtra: "Global supports browser device sign-in and PAT; the China site has no device flow — paste a PAT or import the local qodercli session. When pasting a PAT you need not get the region right: if one region rejects it, the plugin retries the other and stores whichever region actually accepts it.",
 				authorizing: "Authorizing…",
 				loginIdle: "No sign-in has been started yet.",
 				loginHaveAccounts: "The pool already holds {count} account(s). Add another with the button above.",
@@ -18044,6 +18606,20 @@ window.__ModuleLoader__.load({
 				proxyDetectedEffective: "（已自动生效）",
 				proxyNoneDetected: "未检测到系统代理，将使用直连",
 				proxyDirectHint: "本插件的全部请求将直接连接，不经过任何代理服务器。",
+				poolStorageTitle: "账号存储位置",
+				poolStorageKeyring: "桌面密钥环",
+				poolStorageCredentials: "DSH 凭据库",
+				poolStorageKeyringHint: "仅限桌面安装：使用操作系统密钥环（DPAPI / 钥匙串 / Secret Service）。在服务器或无桌面的 Linux 主机上密钥环通常不可用，登录会失败——请改选 DSH 凭据库。",
+				poolStorageCredentialsHint: "DSH 的标准密钥存储（$DSH_HOME/.credentials.yaml）。POSIX 上强制 0600、创建者独占；Windows 上只有 profile ACL，没有权限位可强制。服务器以及任何没有桌面密钥环的主机都用它。静态不加密，靠宿主权限保护。",
+				poolStorageEffective: "当前实际使用：{storage}",
+				poolStorageBackendKeyring: "桌面密钥环（Secret Service），静态加密",
+				poolStorageBackendDpapi: "Windows DPAPI，静态加密",
+				poolStorageBackendKeychain: "macOS 钥匙串，静态加密",
+				poolStorageBackendCredentials: "DSH 凭据库（.credentials.yaml），由文件权限保护",
+				poolStorageSwitchWarning: "已保存在另一个存储里的账号会留在原处，切回去之前不会显示。不会做迁移。",
+				poolStorageUnavailableKeyring: "这台主机上没有可用的桌面密钥环，因此号池无法读写。请把「账号存储位置」改成 DSH 凭据库。",
+				poolStorageUnavailableCredentials: "这个 harness 没有凭据库（ctx.credentials），因此号池无法读写。请把「账号存储位置」改成桌面密钥环。",
+				poolStorageUnavailableStore: "号池存储这次没有应答，所以这里没有列出账号——账号并没有被删除，存储恢复后重新打开本页即可。",
 				enhancements: "增强功能",
 				fastMode: "快速模式（1.5x 速度）",
 				fastModeHint: "提升 Token 生成速度至约 1.5 倍；将以约 2x–2.5x 速度消耗 Codex 订阅额度。",
@@ -18171,6 +18747,13 @@ window.__ModuleLoader__.load({
 				hubUpdateCommandLabel: "手动更新命令",
 				localCodexLoginImport: "导入本机 Codex CLI 登录",
 				localCodexLoginImporting: "导入中…",
+				deviceCodeLogin: "用设备代码添加账号",
+				deviceCodeLoginStarting: "正在获取代码…",
+				deviceCodeHint: "在任意设备上打开下面的链接并输入这个代码，本页会自动完成登录：这条路不需要浏览器回调到本机端口。",
+				deviceCodeLabel: "设备代码",
+				deviceCodeOpen: "打开确认页面",
+				deviceCodeCopy: "复制到剪贴板",
+				deviceCodeWaiting: "等待确认… 剩余 {time}",
 				stopImporting: "停止导入全部本机登录",
 				stopImportingLabel: "停止导入全部本机登录（当前 {count} 个）",
 				stopImportingBusy: "停止导入中…",
@@ -18219,6 +18802,20 @@ window.__ModuleLoader__.load({
 				proxyDetectedEffective: " (active)",
 				proxyNoneDetected: "No system proxy detected; connecting directly",
 				proxyDirectHint: "Every request from this plugin connects directly without using any proxy server.",
+				poolStorageTitle: "Account storage",
+				poolStorageKeyring: "Desktop keyring",
+				poolStorageCredentials: "DSH credential store",
+				poolStorageKeyringHint: "Desktop installs only: uses the OS keyring (DPAPI / Keychain / Secret Service). On a server or a headless Linux host the keyring is usually unavailable and sign-in will fail — pick the DSH credential store instead.",
+				poolStorageCredentialsHint: "The standard DSH secret store ($DSH_HOME/.credentials.yaml). POSIX: 0600 enforced, owner-only; Windows: profile ACL, no mode enforcement. Use this on servers and any host without a desktop keyring. Stored unencrypted at rest, protected by the host.",
+				poolStorageEffective: "In use now: {storage}",
+				poolStorageBackendKeyring: "desktop keyring (Secret Service), encrypted at rest",
+				poolStorageBackendDpapi: "Windows DPAPI, encrypted at rest",
+				poolStorageBackendKeychain: "macOS Keychain, encrypted at rest",
+				poolStorageBackendCredentials: "DSH credential store (.credentials.yaml), protected by file permissions",
+				poolStorageSwitchWarning: "Accounts saved in the other store stay there and are not shown until you switch back. There is no migration.",
+				poolStorageUnavailableKeyring: "This host has no usable desktop keyring, so the account pool cannot be read or written. Switch Account storage to the DSH credential store.",
+				poolStorageUnavailableCredentials: "This harness has no credential store (ctx.credentials), so the account pool cannot be read or written. Switch Account storage to the desktop keyring.",
+				poolStorageUnavailableStore: "The pool store did not answer this time, so no accounts are listed here — none were deleted; reopen this page once the store answers again.",
 				enhancements: "Enhancements",
 				fastMode: "Fast mode (1.5x speed)",
 				fastModeHint: "Generates tokens ~1.5x faster; consumes Codex subscription quota at ~2x–2.5x the normal rate.",
@@ -18346,6 +18943,13 @@ window.__ModuleLoader__.load({
 				hubUpdateCommandLabel: "Manual update command",
 				localCodexLoginImport: "Import the local Codex CLI sign-in",
 				localCodexLoginImporting: "Importing…",
+				deviceCodeLogin: "Add account with device code",
+				deviceCodeLoginStarting: "Requesting code…",
+				deviceCodeHint: "Open the link below on any device and enter this code. This page finishes the sign-in by itself: nothing has to call back to a local port.",
+				deviceCodeLabel: "Device code",
+				deviceCodeOpen: "Open the confirmation page",
+				deviceCodeCopy: "Copy to clipboard",
+				deviceCodeWaiting: "Waiting for confirmation… {time} remaining",
 				stopImporting: "Stop importing all local sign-ins",
 				stopImportingLabel: "Stop importing all local sign-ins ({count} currently imported)",
 				stopImportingBusy: "Stopping the import…",
@@ -18738,7 +19342,7 @@ window.__ModuleLoader__.load({
 			keyTestFailed: "Ключ отклонён: {detail}",
 			testSavedKey: "Проверить",
 			modelsSection: "Модели",
-			modelsHint: "Список берётся из официального каталога подписки; перед первым использованием обновите его. Неотмеченные модели не появляются в выборе моделей.",
+			modelsHint: "Показываются только встроенные модели, официальный каталог подписки и добавленные вручную; перед первым использованием обновите его. Остальные модели шлюза можно найти и добавить ниже. Неотмеченные модели не появляются в выборе моделей.",
 			modelCount: "Моделей: {count}",
 			modelChecklistCount: "Выбрано {count} из {total}",
 			selectAll: "Выбрать все",
@@ -18749,6 +19353,17 @@ window.__ModuleLoader__.load({
 			catalogEmpty: "Официальный каталог не вернул ни одной модели.",
 			noModels: "Нет доступных моделей.",
 			catalogSources: "Источники каталога: {sources}",
+			catalogSearch: "Найти",
+			catalogSearching: "Поиск…",
+			catalogSearchPlaceholder: "Поиск модели в каталоге шлюза по id…",
+			catalogSearchHint: "Результаты поиска — только кандидаты для добавления; весь каталог шлюза на этой странице не выводится. Пометка «Cline Credits» означает модель маркетплейса: списание идёт с баланса credits, а не с квоты подписки.",
+			catalogSearchEmpty: "Подходящих моделей шлюза нет.",
+			catalogAdd: "Добавить",
+			catalogAdded: "Добавлено",
+			catalogBillingSubscription: "Подписка",
+			catalogBillingCredits: "Cline Credits",
+			catalogCreditsWarning: "Модель маркетплейса: списывается с баланса Cline Credits, а не с плана Cline Pass; при нулевом балансе вернётся 402.",
+			catalogAddCredits: "Добавить за credits",
 			contextSection: "Контекстные окна",
 			contextHint: "Показывается только для отмеченных моделей. Недопустимое значение приводит к ошибке и не сохраняется; «Вернуть по умолчанию» сбрасывает переопределение.",
 			tokens: "токенов",
@@ -18783,6 +19398,18 @@ window.__ModuleLoader__.load({
 			noChannels: "Каналы ещё не обнаружены. Нажмите «Зондировать», чтобы получить список апстримов этой модели.",
 			channelHint: "Нажмите на канал, чтобы добавить его в порядок закрепления; повторное нажатие убирает. ⊘ переключает исключение.",
 			lastServed: "Последний раз обслужил {provider} ({ms} мс)",
+			anonymousChannel: "анонимный маршрут",
+			anonymousChannelHint: "Анонимный contributor-маршрут шлюза: ответы могут использоваться для обучения, без гарантии нулевого хранения данных (ZDR)",
+			anonymousServed: "Внимание: ответ получен от анонимного contributor-маршрута шлюза ({provider}) — он может использоваться для обучения и не имеет гарантии ZDR",
+			fingerprintOk: "Фингерпринт первоисточника DeepSeek: {fingerprint}",
+			pinLikelyIgnored: "Для этой модели обнаружен только анонимный маршрут, поэтому закрепление, скорее всего, будет молча проигнорировано шлюзом",
+			addChannel: "Добавить",
+			manualChannelPlaceholder: "введите имя канала (напр. deepseek)…",
+			manualChannelHint: "Обнаружение опирается на то, что шлюз перечисляет каналы в ошибке; модель, перенаправленная на анонимный маршрут, списка не даёт. Имена каналов — общий для шлюза словарь (предлагаются имена, найденные другими моделями), поэтому закрепите по имени и проверьте кнопкой «Тест».",
+			hasLabel: "Фильтр возможностей (has)",
+			hasHint: "Фильтр возможностей модели шлюза Vercel, записывается только в providerOptions.gateway.has. Для 1017 по умолчанию vision + implicit-caching (по измерениям необходимо для закрепления и обнаружения); для других моделей обычно оставьте пустым.",
+			pinHas: "Возможности: {list}",
+			testHas: "Отправленные возможности: {list}",
 			probedAt: "Зондирование {time}",
 			pipeline: "Пайплайн: {pipeline}",
 			notPinnable: "Эту модель сейчас нельзя закрепить",
@@ -18818,8 +19445,6 @@ window.__ModuleLoader__.load({
 			maxConcurrentRequests: "Потоков на аккаунт (0 = без ограничений)",
 			streamIdleTimeoutMs: "Таймаут простоя потока (мс)",
 			historyLimit: "Строк истории",
-			exposeCatalog: "Показывать в выборе моделей дополнительные модели из каталога шлюза",
-			exposeCatalogHint: "Если выключено, показываются только официальный каталог подписки и встроенная таблица.",
 			pinSpelling: "Написание поля закрепления",
 			pinSpellingBoth: "Отправлять оба написания (рекомендуется)",
 			pinSpellingDetected: "Только обнаруженное написание",
@@ -19053,6 +19678,20 @@ window.__ModuleLoader__.load({
 			proxyDetectedEffective: " (уже действует)",
 			proxyNoneDetected: "Системный прокси не обнаружен, соединение напрямую",
 			proxyDirectHint: "Все запросы этого плагина идут напрямую, без прокси-сервера.",
+			poolStorageTitle: "Где хранить аккаунты",
+			poolStorageKeyring: "Связка ключей рабочего стола",
+			poolStorageCredentials: "Хранилище DSH",
+			poolStorageKeyringHint: "Только для настольных установок: используется системная связка ключей (DPAPI / Keychain / Secret Service). На сервере или headless-хосте Linux связки ключей обычно нет, и вход не сохранится — выберите хранилище DSH.",
+			poolStorageCredentialsHint: "Стандартное хранилище секретов DSH ($DSH_HOME/.credentials.yaml). POSIX: права 0600 принудительно, только владелец; Windows: ACL профиля, режим файла не задаётся. Для серверов и любых хостов без связки ключей рабочего стола. На диске не шифруется, защищено правами хоста.",
+			poolStorageEffective: "Сейчас используется: {storage}",
+			poolStorageBackendKeyring: "связка ключей рабочего стола (Secret Service), шифруется",
+			poolStorageBackendDpapi: "Windows DPAPI, шифруется",
+			poolStorageBackendKeychain: "связка ключей macOS, шифруется",
+			poolStorageBackendCredentials: "хранилище DSH (.credentials.yaml), защищено правами доступа",
+			poolStorageSwitchWarning: "Аккаунты, сохранённые в другом хранилище, остаются там и не видны, пока не переключитесь обратно. Переноса нет.",
+			poolStorageUnavailableKeyring: "На этом хосте нет доступной связки ключей рабочего стола, поэтому пул аккаунтов нельзя ни прочитать, ни записать. Переключите «Где хранить аккаунты» на хранилище DSH.",
+			poolStorageUnavailableCredentials: "У этого harness нет хранилища учётных данных (ctx.credentials), поэтому пул аккаунтов нельзя ни прочитать, ни записать. Переключите «Где хранить аккаунты» на связку ключей рабочего стола.",
+			poolStorageUnavailableStore: "Хранилище пула на этот раз не ответило, поэтому аккаунты здесь не показаны — они не удалены. Откройте эту страницу снова, когда хранилище ответит.",
 			enhancements: "Дополнительные функции",
 			fastMode: "Быстрый режим (скорость 1.5x)",
 			fastModeHint: "Генерирует токены примерно в 1.5 раза быстрее; квота подписки Codex при этом расходуется в 2–2.5 раза быстрее.",
@@ -19180,6 +19819,13 @@ window.__ModuleLoader__.load({
 			hubUpdateCommandLabel: "Команда для ручного обновления",
 			localCodexLoginImport: "Импортировать вход локального Codex CLI",
 			localCodexLoginImporting: "Импорт…",
+			deviceCodeLogin: "Добавить аккаунт по коду устройства",
+			deviceCodeLoginStarting: "Получаем код…",
+			deviceCodeHint: "Открой ссылку ниже на любом устройстве и введи этот код. Эта страница завершит вход сама: обращаться к локальному порту не нужно.",
+			deviceCodeLabel: "Код устройства",
+			deviceCodeOpen: "Открыть страницу подтверждения",
+			deviceCodeCopy: "Копировать в буфер обмена",
+			deviceCodeWaiting: "Ждём подтверждения… осталось {time}",
 			stopImporting: "Остановить импорт всех локальных входов",
 			stopImportingLabel: "Остановить импорт всех локальных входов (сейчас {count})",
 			stopImportingBusy: "Останавливаем импорт…",
@@ -19260,11 +19906,8 @@ window.__ModuleLoader__.load({
 			defaultReasoningEffortHint: "Набор уровней следует тому, что заявляют отмеченные модели (если не отмечено ни одной — все четыре: low / high / max / none); none отключает рассуждения и действует только для моделей, которые это позволяют. Смена уровня сбрасывает кеш контекста, поэтому в пределах сессии держите его неизменным.",
 			effortThinkingOnlyNote: "Среди отмеченных моделей есть те, что рассуждают всегда: {models}. Уровня «рассуждения выкл.» у них нет — такой запрос сервис отклоняет (HTTP 400), поэтому здесь он не предлагается.",
 			effortNotOffered: "отмеченные модели это не принимают",
-			cacheTtl: "Время жизни кеша контекста",
-			cacheTtlHint: "Kimi кеширует префиксы автоматически, здесь выбирается уровень записи, и их всего два: 5m и 1h. Пустое значение — поле не отправляется, и тогда сервис пишет на уровне 5 минут. Запись на 1 ч стоит примерно вдвое дороже записи на 5 мин и окупается, только если тот же префикс перечитывается в течение часа. Уровень фиксируется при первой записи, а попадания продлевают её по исходному TTL. Выбирайте по паузе между ходами: 5 минут, если она обычно короче ~30 минут; 1 час для сессий с долгим простоем, например диспетчера, ждущего субагентов.",
-			cacheTtlDefault: "Не передавать (сервис пишет на уровне 5 минут)",
-			cacheTtl5m: "5 минут",
-			cacheTtl1h: "1 час",
+			cacheNote: "Кеш контекста",
+			cacheNoteHint: "Kimi кеширует префиксы автоматически. Эта линия вообще не отправляет поле длительности кеша — и запись, и срок её жизни определяет сервис. Длительность нельзя выбрать из клиента: ступени 5m / 1h описаны только для Open Platform, для эндпоинта подписки Kimi Code документации нет, а официальный CLI не умеет отправлять это поле. По замерам на этом эндпоинте уровень по умолчанию стабильно попадает в кеш до 25 минут, около 30 минут начинаются промахи, а к 35 минутам кеш полностью остывает — поэтому напоминание об истечении здесь срабатывает на 30 минутах.",
 			defaultEffortAuto: "Как в модели по умолчанию",
 			effortLow: "Низкий",
 			effortHigh: "Высокий",
@@ -19736,7 +20379,7 @@ window.__ModuleLoader__.load({
 			regionGlobal: "Глобальная зона (qoder.com)",
 			regionCn: "Китайский сайт (qoder.com.cn)",
 			regionHint: "Регион определяется только учётными данными; этот выбор задаёт лишь то, куда попадёт следующий вход. Эндпоинты двух регионов не взаимозаменяемы.",
-			regionHintExtra: "В глобальной зоне есть вход по коду устройства в браузере и PAT; на китайском сайте потока устройства нет — только вставка PAT или импорт локальной сессии qodercli.",
+			regionHintExtra: "В глобальной зоне есть вход по коду устройства в браузере и PAT; на китайском сайте потока устройства нет — только вставка PAT или импорт локальной сессии qodercli. При вставке PAT регион угадывать не нужно: если один регион токен отклонит, плагин попробует другой и сохранит тот, который его действительно принял.",
 			authorizing: "Авторизация…",
 			loginIdle: "Вход ещё не начинался.",
 			loginHaveAccounts: "В пуле уже {count} аккаунтов. Чтобы добавить ещё один, нажмите «Добавить аккаунт» выше.",
@@ -20116,6 +20759,16 @@ window.__ModuleLoader__.load({
 .dsh-codex-success{color:var(--dsw-alias-label-success,#2e9b62)}
 .dsh-codex-errorbar{align-items:center;background:color-mix(in srgb,var(--dsw-alias-label-danger,#d94b4b) 9%,transparent);border:0.5px solid color-mix(in srgb,var(--dsw-alias-label-danger,#d94b4b) 28%,transparent);border-radius:7px;color:var(--dsw-alias-label-danger,#d94b4b);display:flex;font-size:13px;gap:12px;justify-content:space-between;padding:10px 12px}
 .dsh-codex-link{color:var(--dsw-alias-label-link,#3278d4);display:inline-block;font-size:13px;margin-top:8px}
+.dsh-codex-device{border:0.5px solid var(--dsw-alias-border-l2);border-radius:8px;display:flex;flex-direction:column;gap:6px;margin-top:12px;padding:10px 12px}
+.dsh-codex-device-row{align-items:center;display:flex;flex-wrap:wrap;gap:10px}
+.dsh-codex-device-value{align-items:center;display:inline-flex;gap:8px;min-width:0}
+/* One class, one size: the icon beside the code and the one beside the link are
+   the same control, so a later tweak cannot leave them different heights. */
+.dsh-codex-copy{align-items:center;background:var(--dsw-alias-bg-layer-2);border:0.5px solid var(--dsw-alias-border-l2);border-radius:6px;color:var(--dsw-alias-label-secondary);cursor:pointer;display:inline-flex;flex:0 0 auto;height:22px;justify-content:center;padding:0;vertical-align:middle;width:22px}
+.dsh-codex-copy:hover{background:var(--dsw-alias-interactive-bg-hover);color:var(--dsw-alias-label-primary)}
+.dsh-codex-copy:focus-visible{outline:2px solid var(--dsw-alias-button-info-fill,#397ee8);outline-offset:1px}
+.dsh-codex-copy-done,.dsh-codex-copy-done:hover{color:var(--dsw-alias-label-success,#2e9b62)}
+.dsh-codex-device-code{border:0.5px solid var(--dsw-alias-brand-primary);border-radius:8px;color:var(--dsw-alias-label-primary);font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:18px;font-weight:700;letter-spacing:.14em;padding:6px 12px}
 .dsh-codex-pref-row{align-items:center;border-bottom:0.5px solid var(--dsw-alias-border-l2);display:flex;gap:16px;justify-content:space-between;min-height:58px;padding:10px 0}
 .dsh-codex-pref-row strong,.dsh-codex-check strong{display:block;font-size:13px;font-weight:600;line-height:1.35}
 .dsh-codex-segments{background:var(--dsw-alias-bg-layer-2);border:0.5px solid var(--dsw-alias-border-l2);border-radius:8px;display:inline-flex;flex-wrap:nowrap;gap:3px;padding:3px}
@@ -21929,6 +22582,7 @@ window.__ModuleLoader__.load({
 .dshcp-channel[data-status=ok]{box-shadow:inset 3px 0 0 var(--dsw-alias-label-success,#2e8b57)}
 .dshcp-channel[data-status=limited]{box-shadow:inset 3px 0 0 var(--dsw-alias-label-warning,#d9913b)}
 .dshcp-channel[data-status=bad],.dshcp-channel[data-status=auth]{box-shadow:inset 3px 0 0 var(--dsw-alias-label-danger,#d94b4b)}
+.dshcp-channel[data-anonymous=true]{border-color:color-mix(in srgb,var(--dsw-alias-label-warning,#d9913b) 60%,transparent);color:var(--dsw-alias-label-warning,#d9913b)}
 .dshcp-exclude{border:0;background:transparent;color:var(--dsw-alias-label-tertiary);cursor:pointer;font-size:12px;line-height:1;padding:0 2px}
 .dshcp-exclude:hover{color:var(--dsw-alias-label-danger,#d94b4b)}
 .dshcp-pin-row{display:flex;gap:10px;flex-wrap:wrap;align-items:center}