@eddyskywalker/dsh-chatgpt-subscription 0.38.1 → 0.39.0

package/lib/index.js

@@ -100,6 +100,37 @@ const OAUTH_SCOPE = "openid profile email offline_access";
 const CODEX_ORIGINATOR = "opencode";
 /** OAuth presents the same identity the request path does (see above). */
 const OAUTH_ORIGINATOR = CODEX_ORIGINATOR;
+/**
+* The device-code grant: the one sign-in path a headless host can finish.
+*
+* The browser flow redirects to a *fixed* `http://localhost:1455/auth/callback`
+* registered against this OAuth client, so it cannot be completed from a server:
+* nothing listens on that loopback port there, and an HTTPS page cannot reach it
+* anyway (mixed content). The device grant takes the redirect out of the
+* picture — the user types a short code on a page on their own machine and this
+* process polls for the result.
+*
+* Same client id as the browser flow, because it is the same registration. These
+* are that registration's device endpoints, verified against the live service.
+*/
+const OAUTH_DEVICE_USERCODE_URL = `${CHATGPT_OAUTH_ISSUER}/api/accounts/deviceauth/usercode`;
+const OAUTH_DEVICE_TOKEN_URL = `${CHATGPT_OAUTH_ISSUER}/api/accounts/deviceauth/token`;
+const OAUTH_DEVICE_VERIFY_URL = `${CHATGPT_OAUTH_ISSUER}/codex/device`;
+/**
+* The redirect the device grant redeems its authorization code against.
+*
+* Nothing listens on it: the device endpoint hands the code to this process
+* directly and the token endpoint only checks it against the grant.
+*/
+const OAUTH_DEVICE_REDIRECT_URI = `${CHATGPT_OAUTH_ISSUER}/deviceauth/callback`;
+/** Deadline used when a grant states no usable `expires_at` (the live one is ~15 min out). */
+const OAUTH_DEVICE_GRANT_LIFETIME_MS = 15 * 6e4;
+/**
+* Floor for a fractional poll interval (a grant answering `"0.2"`), so it cannot
+* turn the loop into a spin. `"0"`, a negative or an unparseable value never get
+* this far: `parseGrantInterval` already replaced them with the 5 s default.
+*/
+const OAUTH_DEVICE_MIN_POLL_INTERVAL_MS = 1e3;
 const TOKEN_REFRESH_MARGIN_MS = 6e4;
 const ROUTE_PREFIX$4 = "/api/dsh-chatgpt-subscription";
 const PLUGIN_VERSION = "0.1.0-alpha.0";
@@ -878,6 +909,61 @@ function asNumber$7(value) {
 	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
 //#endregion
+//#region src/host/token-store.ts
+/**
+* A stored document that cannot be read back as one.
+*
+* Distinct from a store that did not answer, on purpose. A corrupt document is
+* something the NEXT WRITE repairs; an unreadable store is not, and recovering
+* from it as if the pool were empty is how a transient keyring failure erases
+* every account: the read comes back empty, the caller mutates the empty pool and
+* saves it. Stores throw this class for their own "payload is invalid" case and
+* leave availability failures as plain errors, which is the only distinction the
+* pool core needs (see `AccountPoolCore.loadPoolData`).
+*/
+var CorruptStoredDocumentError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "CorruptStoredDocumentError";
+	}
+};
+/** Whether a store failure means "this document does not parse", not "the store is unreachable". */
+function isCorruptStoredDocument(error) {
+	return error instanceof CorruptStoredDocumentError;
+}
+function parseStoredCredentials(value) {
+	if (typeof value !== "object" || value === null) throw new Error("credential bundle is not an object");
+	const record = value;
+	if (typeof record.accessToken !== "string" || record.accessToken === "") throw new Error("access token is missing");
+	if (typeof record.refreshToken !== "string" || record.refreshToken === "") throw new Error("refresh token is missing");
+	if (typeof record.expiresAt !== "number" || !Number.isFinite(record.expiresAt)) throw new Error("expiry is invalid");
+	const optional = (key) => {
+		const candidate = record[key];
+		if (candidate === void 0) return void 0;
+		if (typeof candidate !== "string") throw new Error(`${key} is invalid`);
+		return candidate;
+	};
+	const credentials = {
+		accessToken: record.accessToken,
+		refreshToken: record.refreshToken,
+		expiresAt: record.expiresAt,
+		idToken: optional("idToken"),
+		accountId: optional("accountId"),
+		email: optional("email"),
+		planType: optional("planType")
+	};
+	if (record.adopted === true) {
+		const source = optional("source");
+		if (source !== void 0) {
+			credentials.adopted = true;
+			credentials.source = source;
+			const sourcePath = optional("sourcePath");
+			if (sourcePath !== void 0) credentials.sourcePath = sourcePath;
+		}
+	}
+	return credentials;
+}
+//#endregion
 //#region src/host/common/credential-read-cache.ts
 /**
 * Identity a file-backed credential store reports when nothing is stored.
@@ -944,6 +1030,16 @@ var CredentialReadCache = class {
 	entry = null;
 	pending = null;
 	/**
+	* Bumped by every {@link invalidate}.
+	*
+	* A read that was already in flight when the value changed must not fill the
+	* snapshot: with a 15-second keyring identity bucket, its bytes are the ones
+	* that were just replaced, and the next `load()` would answer with a refresh
+	* token the pool has already spent — up to fifteen seconds of exactly the
+	* double spend the single-flight path in `freshAccount` exists to prevent.
+	*/
+	generation = 0;
+	/**
 	* @param identity - cheap identity of the stored value; `null` disables
 	*   caching for the read.
 	*/
@@ -969,6 +1065,7 @@ var CredentialReadCache = class {
 			return null;
 		}
 		if (this.pending !== null && this.pending.identity === identity) return this.pending.promise;
+		const generation = this.generation;
 		const promise = read();
 		this.pending = {
 			identity,
@@ -976,7 +1073,7 @@ var CredentialReadCache = class {
 		};
 		const settle = (value) => {
 			if (this.pending !== null && this.pending.promise === promise) this.pending = null;
-			this.entry = {
+			if (generation === this.generation) this.entry = {
 				identity,
 				value
 			};
@@ -986,8 +1083,9 @@ var CredentialReadCache = class {
 		});
 		return promise;
 	}
-	/** Drop the snapshot; the next read consults storage again. */
+	/** Drop the snapshot; the next read consults storage again and in-flight ones stop filling it. */
 	invalidate() {
+		this.generation += 1;
 		this.entry = null;
 		this.pending = null;
 	}
@@ -996,198 +1094,6 @@ function isMissing$1(error) {
 	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
 //#endregion
-//#region src/host/token-store.ts
-function parseStoredCredentials(value) {
-	if (typeof value !== "object" || value === null) throw new Error("credential bundle is not an object");
-	const record = value;
-	if (typeof record.accessToken !== "string" || record.accessToken === "") throw new Error("access token is missing");
-	if (typeof record.refreshToken !== "string" || record.refreshToken === "") throw new Error("refresh token is missing");
-	if (typeof record.expiresAt !== "number" || !Number.isFinite(record.expiresAt)) throw new Error("expiry is invalid");
-	const optional = (key) => {
-		const candidate = record[key];
-		if (candidate === void 0) return void 0;
-		if (typeof candidate !== "string") throw new Error(`${key} is invalid`);
-		return candidate;
-	};
-	const credentials = {
-		accessToken: record.accessToken,
-		refreshToken: record.refreshToken,
-		expiresAt: record.expiresAt,
-		idToken: optional("idToken"),
-		accountId: optional("accountId"),
-		email: optional("email"),
-		planType: optional("planType")
-	};
-	if (record.adopted === true) {
-		const source = optional("source");
-		if (source !== void 0) {
-			credentials.adopted = true;
-			credentials.source = source;
-			const sourcePath = optional("sourcePath");
-			if (sourcePath !== void 0) credentials.sourcePath = sourcePath;
-		}
-	}
-	return credentials;
-}
-//#endregion
-//#region src/host/token-store-windows.ts
-const PROTECT_SCRIPT = String.raw`
-$ErrorActionPreference = 'Stop'
-[Console]::InputEncoding = [Text.Encoding]::UTF8
-[Console]::OutputEncoding = [Text.Encoding]::UTF8
-$OutputEncoding = [Text.Encoding]::UTF8
-Add-Type -AssemblyName System.Security
-$path = $env:DSH_CODEX_TOKEN_PATH
-$plain = [Console]::In.ReadToEnd()
-$bytes = [Text.Encoding]::UTF8.GetBytes($plain)
-$cipher = [Security.Cryptography.ProtectedData]::Protect($bytes, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser)
-$directory = [IO.Path]::GetDirectoryName($path)
-[IO.Directory]::CreateDirectory($directory) | Out-Null
-$temporary = $path + '.tmp-' + [Guid]::NewGuid().ToString('N')
-try {
-  [IO.File]::WriteAllBytes($temporary, $cipher)
-  if ([IO.File]::Exists($path)) {
-    [IO.File]::Replace($temporary, $path, [System.Management.Automation.Language.NullString]::Value)
-  } else {
-    [IO.File]::Move($temporary, $path)
-  }
-} finally {
-  if ([IO.File]::Exists($temporary)) { [IO.File]::Delete($temporary) }
-}
-`;
-const UNPROTECT_SCRIPT = String.raw`
-$ErrorActionPreference = 'Stop'
-[Console]::InputEncoding = [Text.Encoding]::UTF8
-[Console]::OutputEncoding = [Text.Encoding]::UTF8
-$OutputEncoding = [Text.Encoding]::UTF8
-Add-Type -AssemblyName System.Security
-$path = $env:DSH_CODEX_TOKEN_PATH
-if (-not [IO.File]::Exists($path)) { exit 3 }
-$cipher = [IO.File]::ReadAllBytes($path)
-$bytes = [Security.Cryptography.ProtectedData]::Unprotect($cipher, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser)
-[Console]::Out.Write([Text.Encoding]::UTF8.GetString($bytes))
-`;
-const CLEAR_SCRIPT = String.raw`
-$ErrorActionPreference = 'Stop'
-$path = $env:DSH_CODEX_TOKEN_PATH
-if ([IO.File]::Exists($path)) { [IO.File]::Delete($path) }
-`;
-function defaultDpapiCredentialPath() {
-	return join(process.env.DSH_HOME?.trim() || join(homedir(), ".dsh"), "storages", "dsh-chatgpt-subscription", "oauth.dpapi");
-}
-var WindowsDpapiCredentialStore = class {
-	path;
-	parse;
-	storage = {
-		kind: "windows-dpapi",
-		encrypted: true
-	};
-	/**
-	* Decrypted snapshot, validated against the file's own mtime and size.
-	*
-	* Every uncached read is a spawned `powershell.exe` (~200 ms), and one
-	* settings request reads several credentials, so the snapshot is what keeps a
-	* tab switch from costing seconds.
-	*/
-	cache = new CredentialReadCache(() => fileCredentialIdentity(this.path));
-	constructor(path, parse) {
-		this.path = path;
-		this.parse = parse;
-		if (process.platform !== "win32") throw new Error("Windows DPAPI storage requires Windows");
-		if (dirname(path) === path) throw new Error("invalid DPAPI credential path");
-	}
-	async load() {
-		return this.cache.load(async () => {
-			const result = await runPowerShell(UNPROTECT_SCRIPT, this.path, "");
-			if (result.code === 3) return null;
-			if (result.code !== 0) throw new Error("DPAPI credential read failed");
-			try {
-				return this.parse(JSON.parse(result.stdout));
-			} catch {
-				throw new Error("DPAPI credential payload is invalid");
-			}
-		});
-	}
-	async save(value) {
-		if ((await runPowerShell(PROTECT_SCRIPT, this.path, JSON.stringify(value))).code !== 0) throw new Error("DPAPI credential write failed");
-		this.cache.invalidate();
-	}
-	async clear() {
-		if ((await runPowerShell(CLEAR_SCRIPT, this.path, "")).code !== 0) throw new Error("DPAPI credential deletion failed");
-		this.cache.invalidate();
-	}
-};
-var WindowsDpapiTokenStore = class extends WindowsDpapiCredentialStore {
-	constructor(path = defaultDpapiCredentialPath()) {
-		super(path, parseStoredCredentials);
-	}
-};
-/**
-* How long a helper may run before it is killed and the read fails.
-*
-* A healthy spawn costs ~200 ms (see the cache note on this class), so the guard
-* exists only for a child that never exits, and it was set at 10 s - fifty times
-* the healthy cost. That turned out to be too tight for one real environment: a
-* cold Windows runner whose freshly-installed dependency tree is being scanned
-* on first spawn, where the helper legitimately took longer than 10 s and the
-* kill turned a working credential read into `DPAPI helper timed out`.
-*
-* The guard is kept, and only its headroom widened: 30 s is still bounded, still
-* far above anything a warm machine needs, and a hung helper now blocks one
-* credential read for 30 s rather than 10 - a worse wait in a case that is already
-* a failure, in exchange for not failing a machine that is merely cold.
-*/
-const POWERSHELL_HELPER_TIMEOUT_MS = 3e4;
-function runPowerShell(script, path, stdin) {
-	return new Promise((resolve, reject) => {
-		const child = spawn("powershell.exe", [
-			"-NoLogo",
-			"-NoProfile",
-			"-NonInteractive",
-			"-Command",
-			script
-		], {
-			env: {
-				...process.env,
-				DSH_CODEX_TOKEN_PATH: path
-			},
-			stdio: [
-				"pipe",
-				"pipe",
-				"pipe"
-			],
-			windowsHide: true
-		});
-		let stdout = "";
-		let stderrLength = 0;
-		const timer = setTimeout(() => {
-			child.kill();
-			reject(/* @__PURE__ */ new Error("DPAPI helper timed out"));
-		}, POWERSHELL_HELPER_TIMEOUT_MS);
-		child.stdout.setEncoding("utf8");
-		child.stdout.on("data", (chunk) => {
-			stdout += chunk;
-			if (stdout.length > 1 << 20) child.kill();
-		});
-		child.stderr.on("data", (chunk) => {
-			stderrLength += chunk.length;
-			if (stderrLength > 1 << 20) child.kill();
-		});
-		child.once("error", (error) => {
-			clearTimeout(timer);
-			reject(error);
-		});
-		child.once("close", (code) => {
-			clearTimeout(timer);
-			resolve({
-				code: code ?? 1,
-				stdout
-			});
-		});
-		child.stdin.end(stdin);
-	});
-}
-//#endregion
 //#region src/host/token-store-macos.ts
 const DEFAULT_SERVICE = "dsh-chatgpt-subscription";
 const DEFAULT_ACCOUNT = "oauth";
@@ -1242,7 +1148,7 @@ var MacKeychainCredentialStore = class {
 			try {
 				return this.parse(parseSecurityPayload(result.stdout));
 			} catch {
-				throw new Error("Keychain credential payload is invalid");
+				throw new CorruptStoredDocumentError("Keychain credential payload is invalid");
 			}
 		});
 	}
@@ -1370,9 +1276,9 @@ function envelopeFrom(parsed) {
 	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
 	const marker = parsed[ENVELOPE_KEY];
 	if (marker === void 0) return null;
-	if (typeof marker !== "object" || marker === null) throw new Error(INVALID);
+	if (typeof marker !== "object" || marker === null) throw new CorruptStoredDocumentError(INVALID);
 	const { gen, chunks, bytes } = marker;
-	if (typeof gen !== "string" || gen === "" || typeof chunks !== "number" || !Number.isInteger(chunks) || chunks < 1 || chunks > MAX_SHARDS || typeof bytes !== "number" || !Number.isInteger(bytes) || bytes < 0) throw new Error(INVALID);
+	if (typeof gen !== "string" || gen === "" || typeof chunks !== "number" || !Number.isInteger(chunks) || chunks < 1 || chunks > MAX_SHARDS || typeof bytes !== "number" || !Number.isInteger(bytes) || bytes < 0) throw new CorruptStoredDocumentError(INVALID);
 	return {
 		gen,
 		chunks,
@@ -1390,6 +1296,18 @@ var SecretServiceCredentialStore = class {
 		this.account = account;
 		this.parse = parse;
 	}
+	/**
+	* Label the desktop keyring manager shows for this entry.
+	*
+	* Derived from the entry's own `service` attribute: it used to be a hardcoded
+	* 'DSH Antigravity OAuth' for every caller, so the ChatGPT, Claude, Qoder and
+	* Minimax pools all appeared in seahorse under Antigravity's name and a user
+	* could not tell which secret they were looking at. The label is display-only,
+	* so entries stored under the old one keep working.
+	*/
+	get label() {
+		return `DSH ${this.service}`;
+	}
 	attributes() {
 		return [
 			"service",
@@ -1411,6 +1329,31 @@ var SecretServiceCredentialStore = class {
 			`${this.account}#${gen}#${index}`
 		];
 	}
+	/**
+	* Whether this host has a usable Secret Service at all.
+	*
+	* One lookup is the whole question, and its ANSWER is not the point: an entry
+	* that is not there exits 1 with empty stderr, which still proves the daemon
+	* answered. A host with no `secret-tool`, no session bus, no
+	* `org.freedesktop.secrets` or a locked keyring fails instead — by refusing the
+	* spawn, or by exiting non-zero with a message. Never throws, because it is
+	* asked by a fallback chain whose next step is the answer to "no".
+	*/
+	async ping() {
+		try {
+			const result = await runSecretTool(["lookup", ...this.attributes()]);
+			if (result.code === 0 || result.code === 1 && !result.hasStderr) return { available: true };
+			return {
+				available: false,
+				reason: UNAVAILABLE
+			};
+		} catch (error) {
+			return {
+				available: false,
+				reason: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
 	async load() {
 		return this.cache.load(async () => {
 			const result = await runSecretTool(["lookup", ...this.attributes()]);
@@ -1420,18 +1363,18 @@ var SecretServiceCredentialStore = class {
 			try {
 				parsed = JSON.parse(result.stdout);
 			} catch {
-				throw new Error(INVALID);
+				throw new CorruptStoredDocumentError(INVALID);
 			}
 			const envelope = envelopeFrom(parsed);
 			if (envelope === null) try {
 				return this.parse(parsed);
 			} catch {
-				throw new Error(INVALID);
+				throw new CorruptStoredDocumentError(INVALID);
 			}
 			const pieces = [];
 			for (let index = 0; index < envelope.chunks; index += 1) {
 				const shard = await runSecretTool(["lookup", ...this.shardAttributes(envelope.gen, index)]);
-				if (shard.code !== 0) throw new Error(INVALID);
+				if (shard.code !== 0) throw new CorruptStoredDocumentError(INVALID);
 				pieces.push(shard.stdout);
 			}
 			try {
@@ -1439,7 +1382,7 @@ var SecretServiceCredentialStore = class {
 				if (decoded.length !== envelope.bytes) throw new Error("shard byte count mismatch");
 				return this.parse(JSON.parse(decoded.toString("utf8")));
 			} catch {
-				throw new Error(INVALID);
+				throw new CorruptStoredDocumentError(INVALID);
 			}
 		});
 	}
@@ -1450,7 +1393,7 @@ var SecretServiceCredentialStore = class {
 		if (bytes < SECRET_TOOL_STDIN_LIMIT) {
 			if ((await runSecretTool([
 				"store",
-				"--label=DSH Antigravity OAuth",
+				"--label=" + this.label,
 				...this.attributes()
 			], payload)).code !== 0) throw new Error(UNAVAILABLE);
 		} else await this.saveChunked(payload, bytes);
@@ -1473,7 +1416,7 @@ var SecretServiceCredentialStore = class {
 			const piece = encoded.slice(index * SHARD_PAYLOAD_SIZE, (index + 1) * SHARD_PAYLOAD_SIZE);
 			if ((await runSecretTool([
 				"store",
-				"--label=DSH Antigravity OAuth",
+				"--label=" + this.label,
 				...this.shardAttributes(gen, index)
 			], piece)).code !== 0) {
 				await this.clearShards(gen, index);
@@ -1487,7 +1430,7 @@ var SecretServiceCredentialStore = class {
 		};
 		if ((await runSecretTool([
 			"store",
-			"--label=DSH Antigravity OAuth",
+			"--label=" + this.label,
 			...this.attributes()
 		], JSON.stringify({ [ENVELOPE_KEY]: envelope }))).code !== 0) {
 			await this.clearShards(gen, chunks);
@@ -1582,14 +1525,491 @@ function runSecretTool(args, stdin = "") {
 		child.stdin.end(stdin);
 	});
 }
+//#endregion
+//#region src/host/token-store-windows.ts
+const PROTECT_SCRIPT = String.raw`
+$ErrorActionPreference = 'Stop'
+[Console]::InputEncoding = [Text.Encoding]::UTF8
+[Console]::OutputEncoding = [Text.Encoding]::UTF8
+$OutputEncoding = [Text.Encoding]::UTF8
+Add-Type -AssemblyName System.Security
+$path = $env:DSH_CODEX_TOKEN_PATH
+$plain = [Console]::In.ReadToEnd()
+$bytes = [Text.Encoding]::UTF8.GetBytes($plain)
+$cipher = [Security.Cryptography.ProtectedData]::Protect($bytes, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser)
+$directory = [IO.Path]::GetDirectoryName($path)
+[IO.Directory]::CreateDirectory($directory) | Out-Null
+$temporary = $path + '.tmp-' + [Guid]::NewGuid().ToString('N')
+try {
+  [IO.File]::WriteAllBytes($temporary, $cipher)
+  if ([IO.File]::Exists($path)) {
+    [IO.File]::Replace($temporary, $path, [System.Management.Automation.Language.NullString]::Value)
+  } else {
+    [IO.File]::Move($temporary, $path)
+  }
+} finally {
+  if ([IO.File]::Exists($temporary)) { [IO.File]::Delete($temporary) }
+}
+`;
+const UNPROTECT_SCRIPT = String.raw`
+$ErrorActionPreference = 'Stop'
+[Console]::InputEncoding = [Text.Encoding]::UTF8
+[Console]::OutputEncoding = [Text.Encoding]::UTF8
+$OutputEncoding = [Text.Encoding]::UTF8
+Add-Type -AssemblyName System.Security
+$path = $env:DSH_CODEX_TOKEN_PATH
+if (-not [IO.File]::Exists($path)) { exit 3 }
+$cipher = [IO.File]::ReadAllBytes($path)
+$bytes = [Security.Cryptography.ProtectedData]::Unprotect($cipher, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser)
+[Console]::Out.Write([Text.Encoding]::UTF8.GetString($bytes))
+`;
+const CLEAR_SCRIPT = String.raw`
+$ErrorActionPreference = 'Stop'
+$path = $env:DSH_CODEX_TOKEN_PATH
+if ([IO.File]::Exists($path)) { [IO.File]::Delete($path) }
+`;
+function defaultDpapiCredentialPath() {
+	return join(process.env.DSH_HOME?.trim() || join(homedir(), ".dsh"), "storages", "dsh-chatgpt-subscription", "oauth.dpapi");
+}
+var WindowsDpapiCredentialStore = class {
+	path;
+	parse;
+	storage = {
+		kind: "windows-dpapi",
+		encrypted: true
+	};
+	/**
+	* Decrypted snapshot, validated against the file's own mtime and size.
+	*
+	* Every uncached read is a spawned `powershell.exe` (~200 ms), and one
+	* settings request reads several credentials, so the snapshot is what keeps a
+	* tab switch from costing seconds.
+	*/
+	cache = new CredentialReadCache(() => fileCredentialIdentity(this.path));
+	constructor(path, parse) {
+		this.path = path;
+		this.parse = parse;
+		if (process.platform !== "win32") throw new Error("Windows DPAPI storage requires Windows");
+		if (dirname(path) === path) throw new Error("invalid DPAPI credential path");
+	}
+	async load() {
+		return this.cache.load(async () => {
+			const result = await runPowerShell(UNPROTECT_SCRIPT, this.path, "");
+			if (result.code === 3) return null;
+			if (result.code !== 0) throw new Error("DPAPI credential read failed");
+			try {
+				return this.parse(JSON.parse(result.stdout));
+			} catch {
+				throw new CorruptStoredDocumentError("DPAPI credential payload is invalid");
+			}
+		});
+	}
+	async save(value) {
+		if ((await runPowerShell(PROTECT_SCRIPT, this.path, JSON.stringify(value))).code !== 0) throw new Error("DPAPI credential write failed");
+		this.cache.invalidate();
+	}
+	async clear() {
+		if ((await runPowerShell(CLEAR_SCRIPT, this.path, "")).code !== 0) throw new Error("DPAPI credential deletion failed");
+		this.cache.invalidate();
+	}
+};
+var WindowsDpapiTokenStore = class extends WindowsDpapiCredentialStore {
+	constructor(path = defaultDpapiCredentialPath()) {
+		super(path, parseStoredCredentials);
+	}
+};
+/**
+* How long a helper may run before it is killed and the read fails.
+*
+* A healthy spawn costs ~200 ms (see the cache note on this class), so the guard
+* exists only for a child that never exits, and it was set at 10 s - fifty times
+* the healthy cost. That turned out to be too tight for one real environment: a
+* cold Windows runner whose freshly-installed dependency tree is being scanned
+* on first spawn, where the helper legitimately took longer than 10 s and the
+* kill turned a working credential read into `DPAPI helper timed out`.
+*
+* The guard is kept, and only its headroom widened: 30 s is still bounded, still
+* far above anything a warm machine needs, and a hung helper now blocks one
+* credential read for 30 s rather than 10 - a worse wait in a case that is already
+* a failure, in exchange for not failing a machine that is merely cold.
+*/
+const POWERSHELL_HELPER_TIMEOUT_MS = 3e4;
+function runPowerShell(script, path, stdin) {
+	return new Promise((resolve, reject) => {
+		const child = spawn("powershell.exe", [
+			"-NoLogo",
+			"-NoProfile",
+			"-NonInteractive",
+			"-Command",
+			script
+		], {
+			env: {
+				...process.env,
+				DSH_CODEX_TOKEN_PATH: path
+			},
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			windowsHide: true
+		});
+		let stdout = "";
+		let stderrLength = 0;
+		const timer = setTimeout(() => {
+			child.kill();
+			reject(/* @__PURE__ */ new Error("DPAPI helper timed out"));
+		}, POWERSHELL_HELPER_TIMEOUT_MS);
+		child.stdout.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => {
+			stdout += chunk;
+			if (stdout.length > 1 << 20) child.kill();
+		});
+		child.stderr.on("data", (chunk) => {
+			stderrLength += chunk.length;
+			if (stderrLength > 1 << 20) child.kill();
+		});
+		child.once("error", (error) => {
+			clearTimeout(timer);
+			reject(error);
+		});
+		child.once("close", (code) => {
+			clearTimeout(timer);
+			resolve({
+				code: code ?? 1,
+				stdout
+			});
+		});
+		child.stdin.end(stdin);
+	});
+}
+//#endregion
+//#region src/host/common/credentials-compat.ts
+/**
+* One `<scope>/<id>` segment, exactly as the seam's own `credentialKey` requires.
+*
+* Copied from the shipped builder (`@deepseek-ai/dsh-credentials`,
+* `KEY_SEGMENT_PATTERN`) rather than invented: a key that this plugin builds and
+* the seam rejects is worse than no seam at all — the write succeeds, the record
+* document stops parsing on the next start, and every credential on the host
+* goes with it.
+*/
+const KEY_SEGMENT_PATTERN = /^[a-z][a-z0-9-]*$/;
+/** Whether one segment of a record key could be handed to the seam at all. */
+function isCredentialKeySegment(value) {
+	return KEY_SEGMENT_PATTERN.test(value);
+}
+/**
+* The seam, when `ctx.get('credentials')` returned something that is one.
+*
+* Takes the resolved SERVICE rather than the context: on a Cordis context a
+* service outside `inject` may only be read through `ctx.get`, so the lookup
+* belongs to the plugin entry (`src/index.ts`) and this function only decides
+* whether what came back is the record half the pool can use.
+*
+* Verified by shape, not by `!== undefined`: a host may carry a name that is not
+* this seam, and a service answering half the calls would fail in the middle of a
+* save — after the token exchange, which is exactly the failure the `poolStorage`
+* option exists to remove.
+*/
+function asCredentialsSeam(service) {
+	if (typeof service !== "object" || service === null) return void 0;
+	const candidate = service;
+	if (typeof candidate.readRecord !== "function" || typeof candidate.modifyRecord !== "function" || typeof candidate.deleteRecord !== "function") return;
+	return candidate;
+}
+/**
+* Address of one pool document inside the seam's record space.
+*
+* Scoped by plugin rather than by provider line: a record's payload is written in
+* its owner's format, so two lines of this plugin may share the scope and stay
+* apart by id.
+*
+* Both segments are validated HERE, by the seam's own rule, because the seam's
+* write path does not validate them: a key it would reject on the next start
+* (`parseCredentialKey` runs in `parseRecords`, and an invalid one fails the
+* provider's activation) is a key that must never be written at all. A caller
+* that cannot build a legal id gets a `TypeError` now, in the line that named it,
+* instead of a credential document that stops loading after a restart.
+*/
+function credentialsRecordKey(scope, id) {
+	for (const segment of [scope, id]) if (!isCredentialKeySegment(segment)) throw new TypeError(`credential key segment "${segment}" must match ${String(KEY_SEGMENT_PATTERN)}`);
+	return `${scope}/${id}`;
+}
+//#endregion
+//#region src/host/common/pool-storage.ts
+/**
+* Which store holds a provider line's account pool.
+*
+* The pool document is one JSON object per line. The store used to be decided by
+* `process.platform` alone: DPAPI on Windows, Keychain on macOS, and on Linux the
+* Secret Service — which a headless server does not have. There the token exchange
+* succeeded, saving failed, and the account could not be added at all; the only
+* workaround was running `gnome-keyring` unlocked with an empty password, which
+* protects the keyring file by permissions and nothing else.
+*
+* So the store becomes a choice with exactly two values:
+*
+* - `keyring` (default) — the platform store: DPAPI on Windows, the Keychain on
+*   macOS, the Secret Service on Linux. Every existing install has this, and
+*   nobody who never touches the setting sees a change.
+* - `credentials` — DSH's own credential store, through `ctx.credentials`. The
+*   option a server install should use: no external daemon, one store for every
+*   secret the host holds.
+*
+* There is deliberately NO automatic mode. An `auto` that picks by probing would
+* let one pool move between two stores depending on whether a daemon happened to
+* answer, and a pool that moves looks exactly like a pool whose accounts were
+* lost. A wrong choice is reported instead — the card names the store in use, says
+* why the configured one is unusable and offers the switch — and the accounts that
+* stayed behind in the other store are still there.
+*/
+/** Store a deployment gets when no `poolStorage` is configured anywhere. */
+const DEFAULT_POOL_STORAGE_MODE = "keyring";
+/** Record scope the pool document occupies in DSH's credential store. */
+const POOL_RECORD_SCOPE = "dsh-chatgpt-subscription";
+/**
+* Record id prefix for one pool: `<scope>/pool-<digest>`.
+*
+* The prefix is load-bearing, not decoration. The seam requires each key segment
+* to match `/^[a-z][a-z0-9-]*$/` while a pool's id is a sha256 hex digest, and
+* 62.5% of digests start with a digit — those keys are rejected on the NEXT start,
+* when the record document is parsed, and an invalid key fails the whole provider's
+* activation: the DeepSeek key, the Telegram token and every other secret in
+* `$DSH_HOME/.credentials.yaml` become unreadable. `pool-` puts a letter first and
+* leaves the digest untouched, so the address stays stable and the Secret Service
+* entry (which uses the bare digest as its account attribute) is unaffected.
+*/
+function poolRecordKey(account) {
+	return credentialsRecordKey(POOL_RECORD_SCOPE, `pool-${account}`);
+}
+let defaults = { mode: () => DEFAULT_POOL_STORAGE_MODE };
+/**
+* Revision of the deployment-wide choice.
+*
+* Every resolved pool remembers the revision it resolved under and re-resolves
+* when this moves. Without it, switching the store in the settings card would keep
+* serving the old backend until the host restarted: the resolution is deliberately
+* cached — the decision must not be retaken per request — so the switch has to
+* invalidate it explicitly.
+*/
+let revision = 0;
+/** Record the deployment-wide storage choice; call once, before any pool is built. */
+function configurePoolStorage(next) {
+	defaults = next.mode === void 0 ? {
+		...next,
+		mode: () => DEFAULT_POOL_STORAGE_MODE
+	} : next;
+	revision += 1;
+}
+/**
+* Announce that the stored choice changed.
+*
+* Called by the settings route after the new value is on disk; every pool drops
+* the backend it cached and resolves again on its next read.
+*/
+function poolStorageChanged() {
+	revision += 1;
+}
+/** The revision the current choice stands at. */
+function poolStorageRevision() {
+	return revision;
+}
+const BACKEND_LABELS = {
+	keyring: "desktop keyring (Secret Service)",
+	credentials: "DSH credential store",
+	dpapi: "Windows DPAPI",
+	keychain: "macOS Keychain"
+};
+/** Whether the backend encrypts the document at rest. */
+function poolStorageEncrypted(backend) {
+	return backend === "keyring" || backend === "dpapi" || backend === "keychain";
+}
+/**
+* The pool document as a record in DSH's own credential store.
+*
+* Stored through the seam's record half (see `credentials-compat.ts`): the
+* document is this plugin's own format, and a `grant` payload is exactly the slot
+* the seam keeps for a value only its owner can interpret.
+*
+* Writes are LAST-WRITER-WINS, and honestly so. `modifyRecord` is the seam's only
+* write path and it does hand back the record as it stands under its lock, but a
+* whole pool document is written from one in-memory copy: a second process that
+* saved between this process's read and this write is overwritten. The lock makes
+* the write atomic, not the transaction. This is the same guarantee the keyring
+* backend has always given, and exactly what the `keyring` option gives — one
+* process is the normal case (one `DSH_HOME`, one host), and it is stated here
+* rather than implied away.
+*/
+var CredentialsRecordStore = class {
+	seam;
+	key;
+	parse;
+	constructor(seam, key, parse) {
+		this.seam = seam;
+		this.key = key;
+		this.parse = parse;
+	}
+	/** The `<scope>/<id>` address this pool occupies; a location, never a credential. */
+	recordKey() {
+		return this.key;
+	}
+	async load() {
+		const record = await this.seam.readRecord(this.key);
+		if (record === void 0) return null;
+		if (record.kind !== "grant") throw new CorruptStoredDocumentError("pool record is not a grant");
+		try {
+			return this.parse(record.payload);
+		} catch (error) {
+			throw new CorruptStoredDocumentError("DSH credential store pool payload is invalid", { cause: error });
+		}
+	}
+	async save(value) {
+		const payload = JSON.parse(JSON.stringify(value));
+		await this.seam.modifyRecord(this.key, async () => ({
+			kind: "grant",
+			payload
+		}));
+	}
+	async clear() {
+		await this.seam.deleteRecord(this.key);
+	}
+};
+/**
+* A backend that cannot be used on this host, kept so the failure is reported with
+* its reason instead of being replaced by a silent substitution.
+*
+* `poolStorage` is an instruction. Answering it with a different store would make
+* the settings card describe a backend the user did not choose, and — worse —
+* would spread one deployment's accounts across two stores without saying so.
+* Every operation therefore fails with the sentence the card also shows, and
+* `unavailable` tells the card which reason code to translate.
+*/
+var UnusablePoolStore = class {
+	message;
+	constructor(message) {
+		this.message = message;
+	}
+	async load() {
+		throw new Error(this.message);
+	}
+	async save() {
+		throw new Error(this.message);
+	}
+	async clear() {
+		throw new Error(this.message);
+	}
+};
+/** What the user is told when `keyring` is configured and there is no keyring. */
+const KEYRING_UNREACHABLE = "poolStorage is \"keyring\", but this host has no reachable desktop keyring: the Secret Service does not answer (no secret-tool, no session bus, or a locked keyring). Switch \"Account storage\" to the DSH credential store, or set poolStorage: \"credentials\".";
+/** What the user is told when `credentials` is configured and the harness has no such seam. */
+const NO_CREDENTIALS_SERVICE = "poolStorage is \"credentials\", but this harness has no ctx.credentials service, so there is no DSH credential store to write into. Switch \"Account storage\" to the desktop keyring, or set poolStorage: \"keyring\".";
+/**
+* Resolve the pool store for one line.
+*
+* Async because `credentials` availability is a runtime fact and the configured
+* value may still be loading from disk; callers hold the promise rather than the
+* store (see `AccountPoolCore`).
+*/
+async function resolvePoolStorage(request) {
+	const platform = request.platform ?? process.platform;
+	const logger = request.logger ?? defaults.logger ?? console;
+	await defaults.ready?.();
+	const mode = request.mode ?? defaults.mode?.() ?? "keyring";
+	const seam = request.credentials ?? defaults.credentials?.();
+	if (mode === "credentials") {
+		if (seam === void 0) {
+			logger.warn(`[dsh-chatgpt-subscription] ${NO_CREDENTIALS_SERVICE}`);
+			return unusable(mode, "credentials", "no-credentials-service", NO_CREDENTIALS_SERVICE);
+		}
+		const store = new CredentialsRecordStore(seam, poolRecordKey(request.account), request.parsePoolData);
+		logger.info(`[dsh-chatgpt-subscription] account pool stored in ${BACKEND_LABELS.credentials}`);
+		return resolved(store, mode, "credentials");
+	}
+	if (platform === "win32" || platform === "darwin") {
+		const backend = platform === "win32" ? "dpapi" : "keychain";
+		const store = request.desktopStore ?? (platform === "win32" ? new WindowsDpapiCredentialStore(`${request.poolFile}.dpapi`, request.parsePoolData) : new MacKeychainCredentialStore(request.keychainService, request.account, request.parsePoolData));
+		logger.info(`[dsh-chatgpt-subscription] account pool stored in ${BACKEND_LABELS[backend]}`);
+		return resolved(store, mode, backend);
+	}
+	if (platform !== "linux") throw new Error(`${request.displayName} pool storage requires Windows, macOS, or Linux.`);
+	const keyring = request.keyring ?? new SecretServiceCredentialStore(request.keychainService, request.account, request.parsePoolData);
+	const availability = await probeKeyring(keyring);
+	if (!availability.available) {
+		const reason = availability.reason === void 0 ? KEYRING_UNREACHABLE : `${KEYRING_UNREACHABLE} (${availability.reason})`;
+		logger.warn(`[dsh-chatgpt-subscription] ${reason}`);
+		return unusable(mode, "keyring", "keyring-unreachable", reason);
+	}
+	logger.info(`[dsh-chatgpt-subscription] account pool stored in ${BACKEND_LABELS.keyring}`);
+	return resolved(keyring, mode, "keyring");
+}
+/**
+* The store a caller-supplied backend stands in for, on this platform.
+*
+* `AccountPoolHooks.backend` replaces the STORE, not the choice, and adoption
+* harnesses use it without a `storage` to go with it. Falling back to
+* `{ backend: 'keyring', encrypted: false }` there described a backend that cannot
+* exist (the platform keyring is encrypted on every platform it exists on) and the
+* wrong one on Windows or macOS.
+*/
+function poolStorageBackendForPlatform(platform) {
+	if (platform === "win32") return "dpapi";
+	if (platform === "darwin") return "keychain";
+	return "keyring";
+}
+function resolved(store, mode, backend) {
+	return {
+		store,
+		storage: {
+			mode,
+			backend,
+			encrypted: poolStorageEncrypted(backend)
+		}
+	};
+}
+function unusable(mode, backend, unavailable, message) {
+	return {
+		store: new UnusablePoolStore(`ChatGPT account pool storage is unavailable: ${message}`),
+		storage: {
+			mode,
+			backend,
+			encrypted: poolStorageEncrypted(backend),
+			unavailable
+		}
+	};
+}
+/** Whether the keyring answers at all; a backend without a probe is assumed to. */
+async function probeKeyring(keyring) {
+	if (typeof keyring.ping !== "function") return { available: true };
+	return keyring.ping();
+}
+/**
+* Human description of where a resolved pool lives, for diagnostics.
+*
+* A location, never a credential: the sentence the pool printed before, now
+* derived from the backend that actually won.
+*/
+function describePoolStoragePath(platform, poolFile, storage, keychainService, account) {
+	if (storage.backend === "dpapi") return `${poolFile}.dpapi`;
+	if (storage.backend === "credentials") return `credentials://${poolRecordKey(account)}`;
+	return `${platform === "darwin" ? "Keychain" : "Secret Service"}: ${keychainService}/${account}`;
+}
 /** Shortest cooldown a 429 may impose; a provider asking for less is clamped. */
 const MIN_COOLDOWN_MS = 1e4;
-/** Stable keychain account name for one pool file, isolated per `DSH_HOME`. */
 /** Accept a stored rotation strategy, or fall back to sequential. */
 function normalizeRotationStrategy(value) {
 	return value === "round-robin" || value === "sticky" ? value : "sequential";
 }
-function poolCredentialAccount$1(filePath) {
+/**
+* Stable keychain account name for one pool file, isolated per `DSH_HOME`.
+*
+* A bare sha256 hex digest: that is what the Secret Service entry, the DPAPI file
+* suffix and the Keychain account all address, and what survives a restart. It is
+* NOT a legal credential-record id on its own — see `poolRecordKey` in
+* `pool-storage.ts`, which prefixes it — so nothing may hand this value to the
+* `ctx.credentials` seam directly.
+*/
+function poolCredentialAccount(filePath) {
 	return createHash("sha256").update(path.resolve(filePath)).digest("hex");
 }
 const poolOperations = /* @__PURE__ */ new Map();
@@ -1614,7 +2034,11 @@ var PoolAccountUnavailableError = class extends LlmError {};
 var AccountPoolCore = class {
 	hooks;
 	filePath;
-	backend;
+	/** The resolved backend, and the promise that resolves it (see {@link backendStore}). */
+	backendRef = {};
+	backendPromise;
+	/** Choice revision {@link backendPromise} was resolved under. */
+	backendRevision = -1;
 	/**
 	* Bumped by every write that can move which account serves a request.
 	*
@@ -1629,7 +2053,6 @@ var AccountPoolCore = class {
 	constructor(hooks) {
 		this.hooks = hooks;
 		this.filePath = hooks.poolFile;
-		this.backend = hooks.backend ?? createPoolBackend(hooks);
 		const resolved = path.resolve(this.filePath);
 		this.operationKey = process.platform === "win32" ? resolved.toLowerCase() : resolved;
 	}
@@ -1649,10 +2072,71 @@ var AccountPoolCore = class {
 	currentIdentityRevision() {
 		return poolIdentityRevisions.get(this.operationKey) ?? 0;
 	}
-	/** Human description of where this pool's credentials live. */
+	/**
+	* Human description of where this pool's credentials live.
+	*
+	* Derived from the backend that was resolved, not from the platform: on a
+	* server that answered `poolStorage` with the credential store or a file, the
+	* old sentence named a keyring entry that does not exist.
+	*/
 	path() {
-		if (process.platform === "win32") return `${this.filePath}.dpapi`;
-		return `${process.platform === "darwin" ? "Keychain" : "Secret Service"}: ${this.hooks.keychainService}/${poolCredentialAccount$1(this.filePath)}`;
+		const selected = this.backendRef.current;
+		return selected === void 0 ? defaultPoolStoragePath(process.platform, this.filePath, this.hooks.keychainService) : describePoolStoragePath(process.platform, this.filePath, selected.storage, this.hooks.keychainService, poolCredentialAccount(this.filePath));
+	}
+	/**
+	* The backend holding this pool, and why it was chosen, for the settings surface.
+	*
+	* Resolves the store on first call, exactly as a read does: a card opened before
+	* any request has to be able to answer "where are my accounts?" as well.
+	*/
+	async poolStorage() {
+		return (await this.backendStore()).storage;
+	}
+	/**
+	* The pool store: resolved once, and re-resolved only when the setting changes.
+	*
+	* Lazy because the choice is a question about the host — does the keyring answer
+	* — and a pool is built from a constructor, which cannot await. CACHED for the
+	* life of the process on purpose: a read that re-detected the store on every
+	* model request would pay a `secret-tool` launch per request, and could hand two
+	* requests of one turn two different stores. The only thing that invalidates the
+	* cache is {@link poolStorageRevision} moving, which happens when the settings
+	* card writes a new choice.
+	*/
+	backendStore() {
+		const revision = poolStorageRevision();
+		if (this.backendPromise === void 0 || this.backendRevision !== revision) {
+			this.backendRevision = revision;
+			this.backendPromise = this.resolveBackend();
+		}
+		return this.backendPromise;
+	}
+	async resolveBackend() {
+		if (this.hooks.backend !== void 0) {
+			const backend = poolStorageBackendForPlatform(this.hooks.platform ?? process.platform);
+			const resolution = {
+				store: this.hooks.backend,
+				storage: this.hooks.storage ?? {
+					mode: this.hooks.poolStorage ?? "keyring",
+					backend,
+					encrypted: poolStorageEncrypted(backend)
+				}
+			};
+			this.backendRef.current = resolution;
+			return resolution;
+		}
+		const resolution = await resolvePoolStorage({
+			displayName: this.hooks.displayName,
+			...this.hooks.poolStorage === void 0 ? {} : { mode: this.hooks.poolStorage },
+			poolFile: this.filePath,
+			keychainService: this.hooks.keychainService,
+			account: poolCredentialAccount(this.filePath),
+			parsePoolData: this.hooks.parsePoolData,
+			...this.hooks.platform === void 0 ? {} : { platform: this.hooks.platform },
+			...this.hooks.keyring === void 0 ? {} : { keyring: this.hooks.keyring }
+		});
+		this.backendRef.current = resolution;
+		return resolution;
 	}
 	/**
 	* Queue one storage transaction for this pool file.
@@ -1672,8 +2156,12 @@ var AccountPoolCore = class {
 	}
 	async saveVerified(data) {
 		const normalized = this.hooks.parsePoolData(data);
-		await this.backend.save(normalized);
-		if (!isDeepStrictEqual(await this.backend.load(), normalized)) throw new Error(`${this.hooks.displayName} pool encrypted verification failed`);
+		const { store } = await this.backendStore();
+		await store.load().catch((error) => {
+			if (!isCorruptStoredDocument(error)) throw error;
+		});
+		await store.save(normalized);
+		if (!isDeepStrictEqual(await store.load(), normalized)) throw new Error(`${this.hooks.displayName} pool storage verification failed`);
 	}
 	/**
 	* Read the pool.
@@ -1695,9 +2183,13 @@ var AccountPoolCore = class {
 	*/
 	async loadPoolData() {
 		let current = null;
+		let resolution;
 		try {
-			current = await this.backend.load();
-		} catch {}
+			resolution = await this.backendStore();
+			current = await resolution.store.load();
+		} catch (error) {
+			if (isCorruptStoredDocument(error)) {} else if (resolution?.storage.unavailable === void 0) throw error;
+		}
 		if (current !== null && Array.isArray(current.accounts) && current.accounts.length > 0) return current;
 		try {
 			const legacy = await this.hooks.legacyAccount?.();
@@ -2203,13 +2695,16 @@ var AccountPoolCore = class {
 		};
 	}
 };
-/** Build the encrypted platform backend one pool file uses. */
-function createPoolBackend(hooks) {
-	const filePath = hooks.poolFile;
-	if (process.platform === "win32") return new WindowsDpapiCredentialStore(`${filePath}.dpapi`, hooks.parsePoolData);
-	if (process.platform === "darwin") return new MacKeychainCredentialStore(hooks.keychainService, poolCredentialAccount$1(filePath), hooks.parsePoolData);
-	if (process.platform === "linux") return new SecretServiceCredentialStore(hooks.keychainService, poolCredentialAccount$1(filePath), hooks.parsePoolData);
-	throw new Error(`${hooks.displayName} pool encrypted storage requires Windows, macOS, or Linux.`);
+/**
+* Where the pool would live on this platform before anything is resolved.
+*
+* Only used for the diagnostic sentence while the backend is still being
+* resolved; {@link AccountPoolCore.path} switches to the real answer afterwards.
+*/
+function defaultPoolStoragePath(platform, filePath, keychainService) {
+	if (platform === "win32") return `${filePath}.dpapi`;
+	if (platform === "darwin") return `Keychain: ${keychainService}/${poolCredentialAccount(filePath)}`;
+	return `Secret Service: ${keychainService}/${poolCredentialAccount(filePath)}`;
 }
 //#endregion
 //#region src/host/token-store-linux.ts
@@ -2252,7 +2747,7 @@ var LinuxFileTokenStore = class {
 			const payload = await handle.readFile({ encoding: "utf8" });
 			return parseStoredCredentials(JSON.parse(payload));
 		} catch (error) {
-			throw new Error("Linux credential payload is invalid or insecure", { cause: error });
+			throw new CorruptStoredDocumentError("Linux credential payload is invalid or insecure", { cause: error });
 		} finally {
 			await handle.close();
 		}
@@ -2546,6 +3041,18 @@ var OAuthService = class {
 	loginEvents = /* @__PURE__ */ new Map();
 	listeners = /* @__PURE__ */ new Map();
 	activeLogin = null;
+	/**
+	* True between taking the login slot and having something to put in
+	* {@link activeLogin}.
+	*
+	* Both starts have work to do before the login exists (a storage read, the
+	* device grant), and that work is awaited. A check made before the first
+	* `await` and an assignment made after it do not exclude each other: two
+	* overlapping calls both pass the check, the second overwrites the first, and
+	* the first flow's `AbortController` becomes unreachable — Cancel stops the
+	* wrong flow and the abandoned one keeps polling until its grant expires.
+	*/
+	startPending = false;
 	refreshPromise = null;
 	lastLoginError;
 	disposed = false;
@@ -2593,19 +3100,55 @@ var OAuthService = class {
 			accounts: [],
 			rotationStrategy: "sequential"
 		};
-		const [accounts, data] = await Promise.all([pool.listAccounts().catch(() => []), pool.read().catch(() => null)]);
+		let readFailed = false;
+		const [accounts, data, poolStorage] = await Promise.all([
+			pool.listAccounts().catch(() => {
+				readFailed = true;
+				return [];
+			}),
+			pool.read().catch(() => {
+				readFailed = true;
+				return null;
+			}),
+			pool.poolStorage().catch(() => void 0)
+		]);
+		const reason = readFailed && poolStorage !== void 0 && poolStorage.unavailable === void 0 ? {
+			...poolStorage,
+			unavailable: "store-unreadable"
+		} : poolStorage;
 		return {
 			accounts,
 			...data?.activeAccountId === void 0 ? {} : { activeAccountId: data.activeAccountId },
-			rotationStrategy: data?.rotationStrategy ?? "sequential"
+			rotationStrategy: data?.rotationStrategy ?? "sequential",
+			...reason === void 0 ? {} : { poolStorage: reason }
 		};
 	}
+	/**
+	* Take the one login slot, or say that it is taken.
+	*
+	* Called synchronously, before the first `await` of the start it belongs to:
+	* nothing can suspend between the check and the flag, so two overlapping
+	* starts cannot both get through. The caller's `finally` releases the flag once
+	* the login itself is in {@link activeLogin} (or the start has failed).
+	*/
+	beginStart() {
+		if (this.startPending || this.activeLogin !== null) throw new OAuthServiceError("login-active", "A ChatGPT sign-in is already in progress.");
+		this.startPending = true;
+	}
 	async startLogin() {
 		this.assertAvailable();
+		this.beginStart();
+		try {
+			return await this.startBrowserLogin();
+		} finally {
+			this.startPending = false;
+		}
+	}
+	/** The body of {@link startLogin}, with the slot already taken. */
+	async startBrowserLogin() {
 		await this.store.load().catch(() => {
 			throw new OAuthServiceError("storage-failed", "Secure credential storage is unavailable. Fix its ownership or permissions before signing in.");
 		});
-		if (this.activeLogin !== null) throw new OAuthServiceError("login-active", "A ChatGPT sign-in is already in progress.");
 		this.lastLoginError = void 0;
 		const loginId = this.random(24).toString("base64url");
 		const verifier = this.random(48).toString("base64url");
@@ -2629,8 +3172,10 @@ var OAuthService = class {
 		this.activeLogin = {
 			id: loginId,
 			expiresAt,
-			server,
-			timeout
+			stop: () => {
+				clearTimeout(timeout);
+				server.cancel(new OAuthServiceError("login-cancelled", "ChatGPT sign-in was cancelled."));
+			}
 		};
 		this.publish({
 			type: "pending",
@@ -2652,6 +3197,57 @@ var OAuthService = class {
 		if (this.activeLogin === null || this.activeLogin.id !== loginId) throw new OAuthServiceError("bad-request", "The requested sign-in is not active.");
 		this.cancelActive(new OAuthServiceError("login-cancelled", "ChatGPT sign-in was cancelled."), "cancelled");
 	}
+	/**
+	* Start a device-code sign-in, the path a headless host can finish.
+	*
+	* Answers as soon as the grant exists, with the code the user has to type and
+	* the page to type it on; the wait for confirmation runs in the background and
+	* reports through the same event stream the browser flow uses, so the card
+	* needs no second mechanism and cancellation is the same call.
+	*/
+	async startDeviceLogin() {
+		this.assertAvailable();
+		this.beginStart();
+		try {
+			return await this.startDeviceLoginInner();
+		} finally {
+			this.startPending = false;
+		}
+	}
+	/** The body of {@link startDeviceLogin}, with the slot already taken. */
+	async startDeviceLoginInner() {
+		await this.store.load().catch(() => {
+			throw new OAuthServiceError("storage-failed", "Secure credential storage is unavailable. Fix its ownership or permissions before signing in.");
+		});
+		this.lastLoginError = void 0;
+		const controller = new AbortController();
+		const grant = await this.requestDeviceGrant(controller.signal);
+		const loginId = this.random(24).toString("base64url");
+		const device = {
+			userCode: grant.userCode,
+			verificationUrl: OAUTH_DEVICE_VERIFY_URL,
+			expiresAt: Math.floor(grant.expiresAt / 1e3),
+			now: Math.floor(this.now() / 1e3)
+		};
+		this.activeLogin = {
+			id: loginId,
+			expiresAt: grant.expiresAt,
+			stop: () => controller.abort(),
+			device
+		};
+		this.publish({
+			type: "pending",
+			loginId
+		});
+		this.pollDeviceGrant(loginId, device, grant, controller.signal).catch((error) => {
+			this.failLogin(loginId, error);
+		});
+		this.logger.info("[dsh-chatgpt-subscription] device-code login started");
+		return {
+			loginId,
+			...device
+		};
+	}
 	subscribe(loginId, listener) {
 		const current = this.loginEvents.get(loginId);
 		if (current === void 0) return null;
@@ -2764,14 +3360,14 @@ var OAuthService = class {
 		this.listeners.clear();
 		this.loginEvents.clear();
 	}
-	async exchangeCode(code, verifier, signal) {
+	async exchangeCode(code, verifier, signal, redirectUri = OAUTH_REDIRECT_URI) {
 		const response = await this.fetchFn(OAUTH_TOKEN_URL$1, {
 			method: "POST",
 			headers: { "content-type": "application/x-www-form-urlencoded" },
 			body: new URLSearchParams({
 				grant_type: "authorization_code",
 				code,
-				redirect_uri: OAUTH_REDIRECT_URI,
+				redirect_uri: redirectUri,
 				client_id: CHATGPT_OAUTH_CLIENT_ID,
 				code_verifier: verifier
 			}).toString(),
@@ -2784,6 +3380,20 @@ var OAuthService = class {
 			throw new OAuthServiceError("oauth-token-exchange-failed", `ChatGPT token exchange failed (${response.status}${detail === null ? "" : `, ${detail}`}).`);
 		}
 		const credentials = credentialsFromTokenResponse(await response.json(), this.now());
+		await this.persistCredentials(credentials, signal);
+	}
+	/**
+	* Write freshly redeemed credentials into the pool, unless the sign-in was
+	* cancelled while the token answer was on its way.
+	*
+	* The abort check used to live only in the poll loop, *after* the exchange, so
+	* a Cancel landing between the token `200` and the write left the host having
+	* answered `{cancelled:true}` and published `cancelled` while the pool quietly
+	* gained an account. The check belongs at the last moment before the write —
+	* the narrower the window, the fewer writes it misses.
+	*/
+	async persistCredentials(credentials, signal) {
+		if (signal.aborted) throw new OAuthServiceError("login-cancelled", "ChatGPT sign-in was cancelled.");
 		if (this.pool !== null) {
 			await this.pool.addAccount(credentials).catch(() => {
 				throw new OAuthServiceError("storage-failed", "ChatGPT credentials could not be saved securely.");
@@ -2795,6 +3405,104 @@ var OAuthService = class {
 		});
 		this.credentialRevision += 1;
 	}
+	/**
+	* Ask for a device code, and normalise what the grant says about itself.
+	*
+	* `interval` arrives as a *string* (`"5"`) on the live service and
+	* `expires_at` as an ISO timestamp, so both are parsed rather than trusted to
+	* be the type they should be. A grant that states neither still works: the
+	* defaults are the values the service actually uses.
+	*/
+	async requestDeviceGrant(signal) {
+		const response = await this.fetchFn(OAUTH_DEVICE_USERCODE_URL, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ client_id: CHATGPT_OAUTH_CLIENT_ID }),
+			signal
+		}).catch(() => {
+			throw new OAuthServiceError("oauth-token-exchange-failed", "The ChatGPT device-code request could not be reached.");
+		});
+		if (!response.ok) {
+			const detail = await oauthErrorIdentifier(response);
+			throw new OAuthServiceError("oauth-token-exchange-failed", `The ChatGPT device code could not be issued (${response.status}${detail === null ? "" : `, ${detail}`}).`, response.status);
+		}
+		const payload = await response.json().catch(() => null);
+		const record = isRecord$49(payload) ? payload : {};
+		const authId = nonEmptyString$10(record.device_auth_id);
+		const userCode = nonEmptyString$10(record.user_code) ?? nonEmptyString$10(record.usercode);
+		if (authId === void 0 || userCode === void 0) throw new OAuthServiceError("oauth-token-exchange-failed", "ChatGPT returned no device code.");
+		return {
+			authId,
+			userCode,
+			interval: parseGrantInterval(record.interval),
+			expiresAt: parseGrantDeadline(record.expires_at, this.now())
+		};
+	}
+	/**
+	* Wait for the user to confirm the code, then redeem the grant.
+	*
+	* Three rules, and each one is a way this loop goes wrong if it is dropped:
+	* the wait between polls is the grant's own `interval` (clamped, see
+	* {@link pollDelayMs}); no single wait runs past the deadline; and nothing is
+	* accepted at or after the deadline, because a grant that expired upstream is
+	* not a sign-in — redeeming it would surface the server's error as if the
+	* user's code had failed.
+	*/
+	async pollDeviceGrant(loginId, device, grant, signal) {
+		const deadline = grant.expiresAt;
+		const interval = grant.interval;
+		for (;;) {
+			if (signal.aborted) return;
+			const remaining = deadline - this.now();
+			if (remaining <= 0) throw new OAuthServiceError("login-expired", "The device code expired before it was confirmed. Start the sign-in again for a fresh code.");
+			await sleep$6(Math.min(pollDelayMs(interval, deadline - this.now()), remaining), signal);
+			if (signal.aborted) return;
+			if (this.now() >= deadline) throw new OAuthServiceError("login-expired", "The device code expired before it was confirmed. Start the sign-in again for a fresh code.");
+			const outcome = await this.pollDeviceToken(grant, signal);
+			if (outcome === "pending") continue;
+			if (signal.aborted) return;
+			await this.exchangeCode(outcome.authorizationCode, outcome.codeVerifier, signal, OAUTH_DEVICE_REDIRECT_URI);
+			if (signal.aborted) return;
+			this.completeLogin(loginId);
+			return;
+		}
+	}
+	/**
+	* One confirmation check.
+	*
+	* `403`/`404` (and any payload whose status says pending) mean "not yet" — the
+	* user has not typed the code or has not confirmed it. Everything else is
+	* terminal and carries the status with any error code the service named, so
+	* the card can say what happened instead of polling until the deadline.
+	*/
+	async pollDeviceToken(grant, signal) {
+		const response = await this.fetchFn(OAUTH_DEVICE_TOKEN_URL, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				device_auth_id: grant.authId,
+				user_code: grant.userCode
+			}),
+			signal
+		}).catch(() => {
+			if (signal.aborted) throw new OAuthServiceError("login-cancelled", "ChatGPT sign-in was cancelled.");
+			throw new OAuthServiceError("oauth-token-exchange-failed", "The ChatGPT device confirmation could not be reached.");
+		});
+		const payload = await response.json().catch(() => null);
+		if (isPendingDeviceAnswer(response, payload)) return "pending";
+		if (!response.ok) {
+			const detail = deviceErrorIdentifier(payload);
+			throw new OAuthServiceError("oauth-token-exchange-failed", `The ChatGPT device confirmation was refused (${response.status}${detail === void 0 ? "" : `, ${detail}`}).`, response.status);
+		}
+		const record = isRecord$49(payload) ? payload : {};
+		const authorizationCode = nonEmptyString$10(record.authorization_code);
+		const codeVerifier = nonEmptyString$10(record.code_verifier);
+		if (authorizationCode === void 0 || codeVerifier === void 0) throw new OAuthServiceError("oauth-token-exchange-failed", "ChatGPT confirmed the device code but returned no authorization code.");
+		return {
+			authorizationCode,
+			codeVerifier
+		};
+	}
 	refreshCredentials(stored) {
 		if (this.refreshPromise !== null) return this.refreshPromise;
 		this.refreshPromise = this.performRefresh(stored).finally(() => {
@@ -2881,11 +3589,7 @@ var OAuthService = class {
 				...this.store.storage,
 				available: storageAvailable
 			},
-			login: {
-				active: active !== null,
-				loginId: active?.id ?? null,
-				expiresAt: active === null ? null : Math.floor(active.expiresAt / 1e3)
-			},
+			login: this.loginStatus(active),
 			...this.lastLoginError === void 0 ? {} : { error: this.lastLoginError }
 		};
 		const identity = extractIdentity(credentials);
@@ -2902,17 +3606,32 @@ var OAuthService = class {
 				...this.store.storage,
 				available: storageAvailable
 			},
-			login: {
-				active: active !== null,
-				loginId: active?.id ?? null,
-				expiresAt: active === null ? null : Math.floor(active.expiresAt / 1e3)
-			},
+			login: this.loginStatus(active),
 			...this.lastLoginError === void 0 ? {} : { error: this.lastLoginError }
 		};
 	}
+	/**
+	* The `login` slice of the status, shared by both branches above.
+	*
+	* A device flow also carries its code: the card is the only place the user can
+	* read it, and a settings page opened a second time (or reloaded) would
+	* otherwise show "waiting" with nothing to type anywhere on it.
+	*/
+	loginStatus(active) {
+		const device = active?.device;
+		return {
+			active: active !== null,
+			loginId: active?.id ?? null,
+			expiresAt: active === null ? null : Math.floor(active.expiresAt / 1e3),
+			...device === void 0 ? {} : { device: {
+				...device,
+				now: Math.floor(this.now() / 1e3)
+			} }
+		};
+	}
 	completeLogin(loginId) {
 		if (this.activeLogin?.id !== loginId) return;
-		clearTimeout(this.activeLogin.timeout);
+		this.activeLogin.stop();
 		this.activeLogin = null;
 		this.lastLoginError = void 0;
 		this.publish({
@@ -2923,7 +3642,7 @@ var OAuthService = class {
 	}
 	failLogin(loginId, error) {
 		if (this.activeLogin?.id !== loginId) return;
-		clearTimeout(this.activeLogin.timeout);
+		this.activeLogin.stop();
 		this.activeLogin = null;
 		const mapped = publicError(error, "oauth-callback-invalid");
 		this.lastLoginError = mapped;
@@ -2937,9 +3656,8 @@ var OAuthService = class {
 	cancelActive(error, outcome) {
 		const active = this.activeLogin;
 		if (active === null) return;
-		clearTimeout(active.timeout);
 		this.activeLogin = null;
-		active.server.cancel(error);
+		active.stop();
 		this.publish(outcome === "cancelled" ? {
 			type: "cancelled",
 			loginId: active.id
@@ -3042,6 +3760,119 @@ function maskAccountId(accountId) {
 	if (accountId === void 0) return null;
 	return `…${accountId.slice(-4)}`;
 }
+/**
+* How long to wait before the next confirmation check.
+*
+* Two clamps, for two different bad values. A floor keeps a fractional interval
+* (a grant answering `"0.2"`) from turning the loop into a spin against the
+* service — `"0"`, a negative and anything unparseable never reach it, because
+* {@link parseGrantInterval} already turns those into the 5 s default. The
+* deadline keeps an absurd interval from sleeping past the point where the grant
+* dies, which would leave the card "waiting" for a code that can no longer be
+* redeemed. The normal value — `"5"` — passes through untouched.
+*/
+function pollDelayMs(intervalSeconds, remainingMs) {
+	const requested = intervalSeconds * 1e3;
+	return Math.max(OAUTH_DEVICE_MIN_POLL_INTERVAL_MS, Math.min(requested, Math.max(remainingMs, 0)));
+}
+/** The grant's `interval`, which arrives as a string on the live service. */
+function parseGrantInterval(value) {
+	const seconds = typeof value === "number" ? value : Number(value);
+	return Number.isFinite(seconds) && seconds > 0 ? seconds : 5;
+}
+/**
+* The grant's `expires_at`, which the live service sends as an ISO timestamp.
+*
+* A number is accepted too, and its magnitude decides the unit: a Unix timestamp
+* in seconds and one in milliseconds differ by three orders of magnitude, so
+* guessing is safe here in a way it is not for a field that could be either by a
+* factor of a thousand. Anything unparseable falls back to the grant lifetime
+* this client expects — the deadline still exists, it just is not the grant's.
+*/
+function parseGrantDeadline(value, now) {
+	if (typeof value === "string" && value !== "") {
+		const parsed = Date.parse(value);
+		if (Number.isFinite(parsed)) return parsed;
+	}
+	if (typeof value === "number" && Number.isFinite(value) && value > 0) return value < 0xe8d4a51000 ? value * 1e3 : value;
+	return now + OAUTH_DEVICE_GRANT_LIFETIME_MS;
+}
+/**
+* Wait `ms`, or less if the sign-in is cancelled first.
+*
+* Resolves rather than rejects on abort: the caller already knows it was
+* cancelled and checks the signal, so a rejected promise here would only add an
+* unhandled path that says the same thing a second time.
+*/
+function sleep$6(ms, signal) {
+	return new Promise((resolve) => {
+		if (signal.aborted) {
+			resolve();
+			return;
+		}
+		const done = () => {
+			clearTimeout(timer);
+			signal.removeEventListener("abort", done);
+			resolve();
+		};
+		const timer = setTimeout(done, ms);
+		timer.unref?.();
+		signal.addEventListener("abort", done, { once: true });
+	});
+}
+/** Status values that mean "the user has not confirmed yet", not a failure. */
+const DEVICE_PENDING_STATUSES = /* @__PURE__ */ new Set([
+	"pending",
+	"authorization_pending",
+	"deviceauth_pending",
+	"not_found"
+]);
+/**
+* Whether one confirmation check was the grant saying "not yet".
+*
+* Two ways to say it, and the second is deliberately narrow. The live service
+* answers `403`/`404` while waiting, and those statuses mean "not yet" whatever
+* the body says. A body that merely *looks* pending counts only on a status that
+* could carry it — a `200`, or the `400` some builds answer — because honouring it
+* everywhere let a `401`/`429`/`500` that happened to mention `status: "pending"`
+* retry an invalid user code until the deadline, hiding a reason the user could
+* have been told at once. Every other status is a failure, read by its code.
+*/
+function isPendingDeviceAnswer(response, payload) {
+	if (response.status === 403 || response.status === 404) return true;
+	if (!response.ok && response.status !== 400) return false;
+	if (!isRecord$49(payload)) return false;
+	const status = payload.status;
+	if (typeof status === "string" && DEVICE_PENDING_STATUSES.has(status.toLowerCase())) return true;
+	const error = payload.error;
+	if (isRecord$49(error)) {
+		const code = error.code;
+		if (typeof code === "string" && DEVICE_PENDING_STATUSES.has(code.toLowerCase())) return true;
+	}
+	return false;
+}
+/**
+* The error code a device endpoint named, if it named one.
+*
+* A named `error.code` is read before the top-level `status`, so a status word
+* (`pending`) cannot be quoted as the reason when the body also says what went
+* wrong.
+*/
+function deviceErrorIdentifier(payload) {
+	if (!isRecord$49(payload)) return void 0;
+	const candidates = [payload.code];
+	const error = payload.error;
+	if (typeof error === "string") candidates.push(error);
+	else if (isRecord$49(error)) candidates.push(error.code, error.type);
+	candidates.push(payload.status);
+	for (const candidate of candidates) if (typeof candidate === "string" && /^[a-z0-9_.-]{1,64}$/i.test(candidate)) return candidate;
+}
+function nonEmptyString$10(value) {
+	return typeof value === "string" && value !== "" ? value : void 0;
+}
+function isRecord$49(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 async function oauthErrorIdentifier(response) {
 	const payload = await response.json().catch(() => null);
 	if (typeof payload !== "object" || payload === null || Array.isArray(payload)) return null;
@@ -3692,6 +4523,7 @@ var CodexAccountPool = class extends AccountPoolCore {
 			},
 			emptyMessage: "未登录 ChatGPT 账号，请在「设置 → 订阅服务 → ChatGPT」中添加并登录账号。",
 			...options.backend === void 0 ? {} : { backend: options.backend },
+			...options.keyring === void 0 ? {} : { keyring: options.keyring },
 			...options.maxAccounts === void 0 ? {} : { maxAccounts: options.maxAccounts }
 		};
 		super(hooks);
@@ -4467,8 +5299,7 @@ const SCOPES = [
 const DEFAULT_CLIENT_ID = Buffer.from("MTA3MTAwNjA2MDU5MS10bWhzc2luMmgyMWxjcmUyMzV2dG9sb2poNGc0MDNlcC5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbQ==", "base64").toString("utf8");
 const DEFAULT_CLIENT_SECRET = Buffer.from("R09DU1BYLUs1OEZXUjQ4NkxkTEoxbUxCOHNYQzR6NnFEQWY=", "base64").toString("utf8");
 const ANTIGRAVITY_SYSTEM_INSTRUCTION = "You are Antigravity, a powerful agentic AI coding assistant designed by Google DeepMind. You are pair programming with a user to solve coding tasks. Be concise, practical, and tool-aware.";
-const ANTIGRAVITY_NO_PREAMBLE_INSTRUCTION = "CRITICAL: NEVER output rule checks, formatting guidelines, constraint checklists, or thinking/personality preambles in the final response. Output only the final response. This forbids meta commentary only; it does not forbid the short progress lines the next rule requires before tool calls.";
-const ANTIGRAVITY_PROGRESS_INSTRUCTION = "Progress and tool execution rule: before EVERY tool call, emit 1-2 short sentences of ordinary, visible assistant text stating what you are about to do and why, written as normal response text the user can read. Never write those sentences only inside your thinking/thought summary: the visible text part must exist, otherwise the progress is not delivered. These progress lines are required and take precedence over the no-preamble rule. Keep them brief, professional, and factual; do not restate the whole plan. Only present the comprehensive final answer and summary in the final turn, after all tool operations are completed.";
+const ANTIGRAVITY_NO_PREAMBLE_INSTRUCTION = "CRITICAL: NEVER output rule checks, formatting guidelines, constraint checklists, or thinking/personality preambles in the final response. Output only the final response.";
 const GEMINI_ROLE = {
 	user: "user",
 	model: "model"
@@ -6768,12 +7599,7 @@ function gemini25ThinkingBudget(runtimeModel, effort) {
 	const max = isPro ? 32768 : 24576;
 	return Math.min(max, Math.max(min, effort === "off" || effort === "none" ? 0 : effort === "high" || effort === "xhigh" ? max : effort === "medium" ? 16384 : 4096));
 }
-function progressExplanationInstruction$1(tools) {
-	if (!tools?.length) return void 0;
-	return ANTIGRAVITY_PROGRESS_INSTRUCTION;
-}
 function buildRequest$2(options, model, projectId, runtimeModel, effort, images = NO_RESOLVED_IMAGES$5, wire = {}) {
-	const progressInstruction = progressExplanationInstruction$1(options.tools);
 	const request = {
 		contents: convertMessages(options, model, runtimeModel, images),
 		systemInstruction: {
@@ -6782,8 +7608,7 @@ function buildRequest$2(options, model, projectId, runtimeModel, effort, images
 				{ text: ANTIGRAVITY_SYSTEM_INSTRUCTION },
 				{ text: `Please ignore following [ignore]${ANTIGRAVITY_SYSTEM_INSTRUCTION}[/ignore]` },
 				{ text: ANTIGRAVITY_NO_PREAMBLE_INSTRUCTION },
-				...options.system ? [{ text: sanitizeText$8(options.system) }] : [],
-				...progressInstruction ? [{ text: progressInstruction }] : []
+				...options.system ? [{ text: sanitizeText$8(options.system) }] : []
 			]
 		}
 	};
@@ -7371,15 +8196,6 @@ function parseAntigravityPoolData(value) {
 	if (activeAccountId) res.activeAccountId = activeAccountId;
 	return res;
 }
-function poolCredentialAccount(filePath) {
-	return createHash("sha256").update(path.resolve(filePath)).digest("hex");
-}
-function createPoolCredentialBackend(filePath) {
-	if (process.platform === "win32") return new WindowsDpapiCredentialStore(`${filePath}.dpapi`, parseAntigravityPoolData);
-	if (process.platform === "darwin") return new MacKeychainCredentialStore("dsh-antigravity-pool", poolCredentialAccount(filePath), parseAntigravityPoolData);
-	if (process.platform === "linux") return new SecretServiceCredentialStore("dsh-antigravity-pool", poolCredentialAccount(filePath), parseAntigravityPoolData);
-	throw new Error("Antigravity pool encrypted storage requires Windows, macOS, or Linux.");
-}
 /**
 * One bucket's reset moment as Unix milliseconds, when it parses as a date.
 *
@@ -7441,7 +8257,7 @@ const MAX_DETAIL_CHARS = 500;
 var AccountPoolStore = class {
 	core;
 	legacyStore;
-	constructor(filePath = poolPath(), backend = createPoolCredentialBackend(filePath), legacyStore = new FileCredentialStore$3()) {
+	constructor(filePath = poolPath(), backend, legacyStore = new FileCredentialStore$3()) {
 		this.legacyStore = legacyStore;
 		const hooks = {
 			providerId: "antigravity",
@@ -7504,7 +8320,7 @@ var AccountPoolStore = class {
 			emptyMessage: "未登录 Antigravity 账号，请在「设置 → Antigravity」中添加并登录账号。",
 			allUnavailableMessage: (count, waitMinutes) => `全部 ${count} 个 Antigravity 账号均处于配额限制或冷却中 (429)。` + (waitMinutes === null ? "目前没有处于冷却中的账号。" : `最短预计在 ${waitMinutes} 分钟后解除冷却。`),
 			allAuthFailedMessage: (count) => `全部 ${count} 个 Antigravity 账号均需要重新登录。`,
-			backend
+			...backend === void 0 ? {} : { backend }
 		};
 		this.core = new AccountPoolCore(hooks);
 	}
@@ -12671,6 +13487,12 @@ function registerRoutes(ctx, oauth, usage, preferences, proxyManager, searchSwit
 						value: await oauth.startLogin()
 					});
 					return;
+				case `${ROUTE_PREFIX$4}/login/device/start`:
+					json(response, {
+						ok: true,
+						value: await oauth.startDeviceLogin()
+					});
+					return;
 				case `${ROUTE_PREFIX$4}/login/cancel`: {
 					const loginId = field(body, "loginId");
 					if (loginId === null) throw new Error("missing loginId");
@@ -12681,6 +13503,24 @@ function registerRoutes(ctx, oauth, usage, preferences, proxyManager, searchSwit
 					});
 					return;
 				}
+				case `${ROUTE_PREFIX$4}/storage`: {
+					const storage = adopt?.storage;
+					if (storage === void 0) {
+						jsonError(response, 404, {
+							code: "bad-request",
+							message: "The account storage setting is not available on this host."
+						});
+						return;
+					}
+					const mode = field(body, "mode");
+					if (mode !== "keyring" && mode !== "credentials") throw new PreferenceError("mode must be \"keyring\" or \"credentials\".");
+					await storage.update(mode);
+					json(response, {
+						ok: true,
+						value: await refreshedStatus()
+					});
+					return;
+				}
 				case `${ROUTE_PREFIX$4}/accounts`: {
 					if (accountPool === void 0) throw new Error("The ChatGPT account pool is not installed.");
 					const action = field(body, "action");
@@ -15695,6 +16535,65 @@ function registerAntigravityRoutes(ctx, store, modelSettings, preferences, fetch
 	});
 }
 //#endregion
+//#region src/host/common/pool-storage-settings.ts
+/**
+* Where the account-pool storage choice is remembered between restarts.
+*
+* The profile's `poolStorage` is the deployment's default, and the settings card
+* writes the operator's own answer here instead of rewriting `cordis.yml`: that
+* file is the harness composition, and a card that edited it would be rewriting
+* the deployment to change a preference. The document lives beside the plugin's
+* other storage under the harness home, is written atomically, validated with the
+* same schema machinery as the preferences, and — because it stores `null` until
+* somebody chooses — the profile's value keeps winning until a card actually says
+* otherwise.
+* @module dsh-chatgpt-subscription/pool-storage-settings
+*/
+/** Where the card's choice is kept. */
+function poolStorageSettingsPath() {
+	return join(dshHomeDir(), "storages", "dsh-chatgpt-subscription-pool-storage.json");
+}
+const schema = z.object({ mode: z.union([
+	z.const("keyring"),
+	z.const("credentials"),
+	z.const(null)
+]).default(null) });
+/** The choice the settings card writes, and the pools read. */
+var PoolStorageSettings = class {
+	store;
+	constructor(filePath = poolStorageSettingsPath()) {
+		this.store = new FilePreferencesStore(schema, filePath);
+	}
+	/** Load the document once; a missing or corrupt one counts as "nothing chosen". */
+	hydrate() {
+		return this.store.hydrate();
+	}
+	/** The chosen mode, or `null` while the profile's value stands. */
+	chosen() {
+		return this.store.get().mode;
+	}
+	/**
+	* The mode to use: the card's choice, else the profile's value, else the default.
+	*
+	* @param configured - `poolStorage` from the profile, when it carries one.
+	*/
+	effective(configured) {
+		return this.chosen() ?? configured ?? "keyring";
+	}
+	/**
+	* Persist one choice and tell the pools to resolve their backend again.
+	*
+	* The announcement is part of the write rather than the route's job: a caller
+	* that stores a mode without invalidating the caches would leave every pool on
+	* the old store until the host restarted, which is the one failure this whole
+	* option exists to avoid — reading and writing in different places.
+	*/
+	async update(mode) {
+		await this.store.update({ mode });
+		poolStorageChanged();
+	}
+};
+//#endregion
 //#region src/host/common/context-budget-fetch.ts
 /**
 * Recover a rejected input+output budget without dropping model-visible history.
@@ -24588,10 +25487,6 @@ function maxOutputTokensFor$4(modelId, contextWindow) {
 	const capped = (contextWindow ?? kimiCodeModelDef(modelId)?.contextWindow ?? 262144) - CONTEXT_HEADROOM_TOKENS$1;
 	return Math.max(declared, capped);
 }
-/** Whether a stored preference names a tier this line can send. */
-function isKimiCacheTtl(value) {
-	return value === "5m" || value === "1h";
-}
 /**
 * Reduce the requested output cap so prompt + output fit the window.
 *
@@ -24641,8 +25536,7 @@ function registerKimiCodePreferenceStore(settings, fallbackStore = new FileModel
 			enabledModelIds: [...DEFAULT_ENABLED_MODEL_IDS$4],
 			catalogModels: [],
 			contextWindowOverrides: {},
-			defaultReasoningEffort: null,
-			cacheTtl: null
+			defaultReasoningEffort: null
 		};
 		fallbackStore.read().then((stored) => {
 			snapshot = stored;
@@ -24659,12 +25553,7 @@ function registerKimiCodePreferenceStore(settings, fallbackStore = new FileModel
 		enabled: z.boolean().default(true),
 		enabledModelIds: z.array(z.string()).default([...DEFAULT_ENABLED_MODEL_IDS$4]),
 		contextWindowOverrides: z.dict(z.number()).default({}),
-		defaultReasoningEffort: z.union([...KIMI_CODE_REASONING_EFFORTS.map((effort) => z.const(effort)), z.const(null)]).default(null),
-		cacheTtl: z.union([
-			z.const("5m"),
-			z.const("1h"),
-			z.const(null)
-		]).default(null)
+		defaultReasoningEffort: z.union([...KIMI_CODE_REASONING_EFFORTS.map((effort) => z.const(effort)), z.const(null)]).default(null)
 	}));
 	return {
 		status: () => {
@@ -24674,8 +25563,7 @@ function registerKimiCodePreferenceStore(settings, fallbackStore = new FileModel
 				enabledModelIds: value.enabledModelIds,
 				catalogModels: [],
 				contextWindowOverrides: value.contextWindowOverrides,
-				defaultReasoningEffort: value.defaultReasoningEffort,
-				cacheTtl: isKimiCacheTtl(value.cacheTtl) ? value.cacheTtl : null
+				defaultReasoningEffort: value.defaultReasoningEffort
 			};
 		},
 		update: async (patch) => {
@@ -24684,8 +25572,7 @@ function registerKimiCodePreferenceStore(settings, fallbackStore = new FileModel
 				enabled: patch.enabled !== void 0 ? patch.enabled : current.enabled !== false,
 				enabledModelIds: patch.enabledModelIds ?? current.enabledModelIds,
 				contextWindowOverrides: patch.contextWindowOverrides ? mergeContextWindowOverrides(current.contextWindowOverrides, patch.contextWindowOverrides) : current.contextWindowOverrides,
-				defaultReasoningEffort: patch.defaultReasoningEffort !== void 0 ? patch.defaultReasoningEffort : current.defaultReasoningEffort,
-				cacheTtl: patch.cacheTtl !== void 0 ? patch.cacheTtl : current.cacheTtl
+				defaultReasoningEffort: patch.defaultReasoningEffort !== void 0 ? patch.defaultReasoningEffort : current.defaultReasoningEffort
 			};
 			await scope.update(normalized);
 			fallbackStore.updateSettings(patch).catch(() => void 0);
@@ -24879,8 +25766,7 @@ var FileModelSettingsStore$3 = class {
 					enabledModelIds,
 					catalogModels,
 					contextWindowOverrides,
-					defaultReasoningEffort,
-					cacheTtl: isKimiCacheTtl(record.cacheTtl) ? record.cacheTtl : null
+					defaultReasoningEffort
 				};
 			}
 		} catch {}
@@ -24889,8 +25775,7 @@ var FileModelSettingsStore$3 = class {
 			enabledModelIds: [...DEFAULT_ENABLED_MODEL_IDS$4],
 			catalogModels: [],
 			contextWindowOverrides: {},
-			defaultReasoningEffort: null,
-			cacheTtl: null
+			defaultReasoningEffort: null
 		};
 	}
 	async write(settings) {
@@ -24906,8 +25791,7 @@ var FileModelSettingsStore$3 = class {
 			...patch.enabled !== void 0 ? { enabled: patch.enabled } : {},
 			...patch.enabledModelIds !== void 0 ? { enabledModelIds: patch.enabledModelIds } : {},
 			...patch.contextWindowOverrides !== void 0 ? { contextWindowOverrides: mergeContextWindowOverrides(current.contextWindowOverrides, patch.contextWindowOverrides) } : {},
-			...patch.defaultReasoningEffort !== void 0 ? { defaultReasoningEffort: patch.defaultReasoningEffort } : {},
-			...patch.cacheTtl !== void 0 && patch.cacheTtl !== null ? { cacheTtl: isKimiCacheTtl(patch.cacheTtl) ? patch.cacheTtl : current.cacheTtl } : patch.cacheTtl === null ? { cacheTtl: null } : {}
+			...patch.defaultReasoningEffort !== void 0 ? { defaultReasoningEffort: patch.defaultReasoningEffort } : {}
 		};
 		await this.write(next);
 		return next;
@@ -24950,20 +25834,6 @@ async function persistRegion(region) {
 		await fs.writeFile(file, region, "utf8");
 	} catch {}
 }
-//#endregion
-//#region src/host/kimi-code/cache-hint.ts
-/**
-* How long an entry written at each tier survives.
-*
-* The tier is LOCKED when the prefix is first written, so this is the lifetime
-* of the entry a request actually created rather than of the tier as a name.
-*/
-const CACHE_TTL_MS = {
-	"5m": 300 * 1e3,
-	"1h": 3600 * 1e3
-};
-/** Tier assumed when the conversation states none. */
-const DEFAULT_TIER = "5m";
 /**
 * Last time each session did something, epoch ms.
 *
@@ -25008,9 +25878,8 @@ function evaluateCacheHint(input) {
 	if (lastActiveAt === void 0 || totalTokens === void 0) return { kind: "skip" };
 	if (!Number.isFinite(lastActiveAt) || !Number.isFinite(totalTokens)) return { kind: "skip" };
 	if (totalTokens < 1e5) return { kind: "skip" };
-	const tier = input.cacheTtl ?? DEFAULT_TIER;
 	const idleMs = now - lastActiveAt;
-	if (idleMs <= CACHE_TTL_MS[tier]) return { kind: "skip" };
+	if (idleMs <= 18e5) return { kind: "skip" };
 	return {
 		kind: "hint",
 		idleMs,
@@ -27253,39 +28122,6 @@ function thinkingBudgetFor(effort, maxTokens) {
 	const budget = Math.min(effort === "low" ? 2048 : effort === "high" ? 8192 : 16384, maxTokens - 1024);
 	return budget >= 1024 ? budget : void 0;
 }
-/**
-* Media a single request build may carry.
-*
-* Passed as one object so adding a media kind never grows a positional
-* signature the existing callers already bind.
-*/
-/**
-* The cache field for the Anthropic-compatible wire.
-*
-* TOP LEVEL, not per block: the service documents that a `cache_control` inside
-* a message is ignored, and omitting the field means "read a 5m entry but do
-* not write one" — which is why this is only attached when the caller asked
-* for a tier.
-*/
-function kimiAnthropicCacheControl(ttl) {
-	return { cache_control: {
-		type: "ephemeral",
-		ttl
-	} };
-}
-/**
-* The cache field for the OpenAI-compatible wire.
-*
-* `mode: 'implicit'` is the only mode the service supports — it identifies the
-* prefix itself, so this is not a request to break the cache but a request to
-* write it at a chosen TTL.
-*/
-function kimiOpenAICacheOptions(ttl) {
-	return { prompt_cache_options: {
-		mode: "implicit",
-		ttl
-	} };
-}
 function textOf$6(content) {
 	if (typeof content === "string") return sanitizeText$6(content);
 	if (!Array.isArray(content)) return "";
@@ -27672,7 +28508,6 @@ function buildOpenAIRequest(options, images = NO_RESOLVED_IMAGES$3, preserveThin
 		stream: true,
 		stream_options: { include_usage: true },
 		max_completion_tokens: maxTokens,
-		...media.cacheTtl === null || media.cacheTtl === void 0 ? {} : kimiOpenAICacheOptions(media.cacheTtl),
 		...stopSequences(options.stop).length > 0 ? { stop: stopSequences(options.stop) } : {},
 		...options.tools && options.tools.length > 0 ? {
 			tools: options.tools.map((tool) => ({
@@ -27807,7 +28642,6 @@ function mergeAnthropicMessages$2(entries) {
 }
 /** Build one `/v1/messages` body. */
 function buildAnthropicRequest(options, images = NO_RESOLVED_IMAGES$3, media = {}) {
-	const cacheTtl = media.cacheTtl ?? null;
 	const toolCallIds = new ToolCallIdNormalizer();
 	const carriers = options.messages.filter((message) => message.role === "system" && messageToolsOf(message) !== void 0);
 	const unsentDeclarations = carriers.reduce((total, message) => total + (messageToolsOf(message)?.length ?? 0), 0);
@@ -27839,7 +28673,6 @@ function buildAnthropicRequest(options, images = NO_RESOLVED_IMAGES$3, media = {
 		model: options.model,
 		max_tokens: maxTokens,
 		messages: mergeAnthropicMessages$2(entries),
-		...cacheTtl === null || cacheTtl === void 0 ? {} : kimiAnthropicCacheControl(cacheTtl),
 		...system === void 0 ? {} : { system },
 		...options.temperature === void 0 || budget !== void 0 ? {} : { temperature: options.temperature },
 		...options.stop && options.stop.length > 0 ? { stop_sequences: options.stop } : {},
@@ -29120,8 +29953,7 @@ var KimiCodeAdapter = class extends LlmAdapter {
 		const media = {
 			videos,
 			videoAccepted: inputModalitiesForEntry(options.model, catalog).includes("video"),
-			messageTools: dynamicToolsForEntry(options.model, catalog),
-			cacheTtl: settings.cacheTtl
+			messageTools: dynamicToolsForEntry(options.model, catalog)
 		};
 		const contextWindow = this.contextWindowFor(options.model, entry, settings.contextWindowOverrides);
 		const requestedMax = options.maxTokens ?? maxOutputTokensFor$4(options.model, contextWindow);
@@ -29666,12 +30498,11 @@ async function getKimiCodeWebStatus(store, modelSettings, preferences, options =
 		lastFetchedAt: quota?.fetchedAt ?? null,
 		credentialsRejected: active !== null && active !== void 0 && isRefreshTokenRejected$1(active.refreshToken),
 		cache: cacheStatsOrNull(options.sessionId),
-		cacheHint: cacheHintOrNull(options.sessionId, settings.cacheTtl),
+		cacheHint: cacheHintOrNull(options.sessionId),
 		preserveThinking: preserveThinkingEnabled(),
 		models,
 		contextWindowOverrides: settings.contextWindowOverrides,
 		defaultReasoningEffort: settings.defaultReasoningEffort,
-		cacheTtl: settings.cacheTtl,
 		loginRegion: region,
 		serving: readOption$5(options.serving, true),
 		conflict: readOption$5(options.conflict, null)
@@ -29706,13 +30537,12 @@ function cacheStatsOrNull(sessionId) {
 * the hint describes the conversation the card is actually showing rather than
 * some global figure.
 */
-function cacheHintOrNull(sessionId, cacheTtl) {
+function cacheHintOrNull(sessionId) {
 	const lastActiveAt = sessionLastActiveAt(sessionId);
 	const decision = evaluateCacheHint({
 		now: Date.now(),
 		lastActiveAt,
-		totalTokens: getCacheStats(sessionId).cachedTokens + getCacheStats(sessionId).freshTokens,
-		cacheTtl
+		totalTokens: getCacheStats(sessionId).cachedTokens + getCacheStats(sessionId).freshTokens
 	});
 	if (decision.kind !== "hint") return null;
 	return {
@@ -29936,10 +30766,6 @@ function registerKimiCodeRoutes(ctx, store, modelSettings, preferences, options
 						const effort = body.defaultReasoningEffort;
 						if (effort === null || isKimiCodeEffort(effort)) patch.defaultReasoningEffort = effort;
 					}
-					if (body.cacheTtl !== void 0) {
-						const ttl = body.cacheTtl;
-						if (ttl === null || isKimiCacheTtl(ttl)) patch.cacheTtl = ttl;
-					}
 					if (preferences) await preferences.update(patch);
 					else await modelSettings.updateSettings(patch);
 					if (patch.enabledModelIds !== void 0 || patch.enabled !== void 0) ctx.emit?.("llm/adapters-updated");
@@ -40300,7 +41126,7 @@ const CLAUDE_MODELS = Object.freeze([
 			"xhigh",
 			"max"
 		],
-		canDisableThinking: false
+		canDisableThinking: true
 	},
 	{
 		id: "claude-opus-5-5",
@@ -40324,7 +41150,7 @@ const CLAUDE_MODELS = Object.freeze([
 	{
 		id: "claude-sonnet-4-5",
 		name: "Claude Sonnet 4.5 (latest)",
-		contextWindow: 1e6,
+		contextWindow: 2e5,
 		maxTokens: 64e3,
 		supportsImage: true,
 		supportsTemperature: true,
@@ -40339,7 +41165,7 @@ const CLAUDE_MODELS = Object.freeze([
 	{
 		id: "claude-sonnet-4-5-20250929",
 		name: "Claude Sonnet 4.5",
-		contextWindow: 1e6,
+		contextWindow: 2e5,
 		maxTokens: 64e3,
 		supportsImage: true,
 		supportsTemperature: true,
@@ -42600,23 +43426,19 @@ function thinkingRequestedOff(effort) {
 * This is what decides whether the response ceiling is inflated by the level's
 * budget, and getting it wrong in the generous direction is not harmless: a
 * non-thinking model whose ceiling was raised by a budget it never had would
-* ask the server for tokens it cannot produce. mid-convo thinks whatever the
-* caller asked for; the other forms think unless the disable request is going
-* to be sent and the model allows one.
+* ask the server for tokens it cannot produce. Every form thinks unless the
+* caller asked for thinking off on a model that accepts a disabled request.
 */
 function claudeRequestThinks(model, effort) {
-	const mode = claudeThinkingMode(model);
-	if (mode === "none") return false;
-	if (mode === "mid-convo") return true;
+	if (claudeThinkingMode(model) === "none") return false;
 	return !(thinkingRequestedOff(effort) && claudeModelCanDisableThinking(model));
 }
 /**
 * Dispatch the four thinking cases for one model and effort.
 *
-* The guard order is the catalog's and is load-bearing: mid-convo is checked
-* first and unconditionally, so a caller asking for thinking off on a managed
-* effort model still gets the adaptive form with its block_binding. See the
-* module doc for what each form is and why.
+* The disable request is checked first. A mid-convo model that cannot disable
+* still gets the adaptive form with its block_binding; one that can disable
+* takes that form without an effort override. See the module doc for the cases.
 *
 * @param model - exact model id, resolved through the frozen catalog.
 * @param effort - the caller's raw effort, passed through as-is.
@@ -42629,7 +43451,7 @@ function claudeThinking(model, effort, level, maxTokens, customBudgets) {
 	const mode = claudeThinkingMode(model);
 	if (mode === "none") return {};
 	const namedEffort = effort !== void 0 && effort !== "" && !thinkingRequestedOff(effort) ? effort : void 0;
-	const off = thinkingRequestedOff(effort);
+	if (thinkingRequestedOff(effort) && claudeModelCanDisableThinking(model)) return { thinking: { type: "disabled" } };
 	if (mode === "mid-convo") return {
 		thinking: {
 			type: "adaptive",
@@ -42638,7 +43460,6 @@ function claudeThinking(model, effort, level, maxTokens, customBudgets) {
 		},
 		outputConfig: { effort: namedEffort ?? "high" }
 	};
-	if (off && claudeModelCanDisableThinking(model)) return { thinking: { type: "disabled" } };
 	if (mode === "adaptive") return {
 		thinking: {
 			type: "adaptive",
@@ -58919,6 +59740,20 @@ const REASONING_EFFORTS = [
 * configured request budget rather than taken as the budget itself.
 */
 const MODEL_CATALOG = Object.freeze({
+	"cline-pass/deepseek-v4.1-flash-1017": {
+		name: "DeepSeek V4.1 Flash 1017",
+		contextWindow: 1048576,
+		maxTokens: 384e3,
+		reasoning: true,
+		efforts: [
+			"none",
+			"low",
+			"high",
+			"max"
+		],
+		input: ["text", "image"],
+		gatewayHas: ["vision", "implicit-caching"]
+	},
 	"cline-pass/deepseek-v4.1-flash": {
 		name: "DeepSeek V4.1 Flash",
 		contextWindow: 1e6,
@@ -59081,13 +59916,34 @@ const DEFAULT_MODELS = Object.freeze(Object.keys(MODEL_CATALOG));
 function catalogEntry(model) {
 	return MODEL_CATALOG[model];
 }
-/** The default pin: automatic routing, no exclusions. */
-function defaultPin() {
+/** The capability filter a model needs by default; empty for all others. */
+function defaultGatewayHas(model) {
+	return [...catalogEntry(model)?.gatewayHas ?? []];
+}
+/**
+* Bound one pin's capability filter, the way channels are bounded.
+*
+* Applied on read and again on the wire: `has` is copied into every chat request
+* body, so a filter list is request payload on every turn, not a private note.
+*/
+function capGatewayHas(names) {
+	const capped = [];
+	for (const name of names) {
+		const trimmed = name.trim();
+		if (trimmed === "" || trimmed.length > 64) continue;
+		if (!capped.includes(trimmed)) capped.push(trimmed);
+		if (capped.length >= 16) break;
+	}
+	return capped;
+}
+/** The default pin: automatic routing, no exclusions, model-default capabilities. */
+function defaultPin(model = "") {
 	return {
 		upstreams: [],
 		exclude: [],
 		pinMode: "strict",
-		sort: ""
+		sort: "",
+		has: defaultGatewayHas(model)
 	};
 }
 //#endregion
@@ -59135,6 +59991,16 @@ function jwtExpiryMs(token) {
 		return;
 	}
 }
+/** Whether a catalog row belongs in the compact, built-in + official + added list. */
+function isListedClinePassCatalogModel(model) {
+	if (model.origin === "official" || model.origin === "custom") return true;
+	if (model.origin === "gateway") return false;
+	return model.id.startsWith("cline-pass/");
+}
+/** The catalog rows to display/advertise, never the whole gateway search index. */
+function listedClinePassCatalogModels(settings) {
+	return settings.catalogModels.filter(isListedClinePassCatalogModel);
+}
 function credentialPath$1() {
 	return path.join(dshHomeDir(), "storages", "cline-pass-credentials.json");
 }
@@ -59228,14 +60094,15 @@ var FileCredentialStore$1 = class {
 	}
 };
 /** One pin as stored, validated; a malformed row falls back to the default. */
-function readPin(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return defaultPin();
+function readPin(value, model) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return defaultPin(model);
 	const record = value;
 	return {
 		upstreams: Array.isArray(record.upstreams) ? record.upstreams.filter((entry) => typeof entry === "string" && entry.length > 0) : [],
 		exclude: Array.isArray(record.exclude) ? record.exclude.filter((entry) => typeof entry === "string" && entry.length > 0) : [],
 		pinMode: record.pinMode === "preferred" ? "preferred" : "strict",
-		sort: typeof record.sort === "string" ? record.sort : ""
+		sort: typeof record.sort === "string" ? record.sort : "",
+		has: Array.isArray(record.has) ? capGatewayHas(record.has.filter((entry) => typeof entry === "string" && entry.trim().length > 0).map((entry) => entry.trim())) : defaultGatewayHas(model)
 	};
 }
 function readPins(value) {
@@ -59243,7 +60110,7 @@ function readPins(value) {
 	const pins = {};
 	for (const [model, pin] of Object.entries(value)) {
 		if (typeof model !== "string" || model.length === 0) continue;
-		pins[model] = readPin(pin);
+		pins[model] = readPin(pin, model);
 	}
 	return pins;
 }
@@ -59270,6 +60137,7 @@ function readCatalogModels$1(value) {
 		if (typeof record.reasoning === "boolean") model.reasoning = record.reasoning;
 		if (Array.isArray(record.input)) model.input = record.input.filter((item) => typeof item === "string");
 		if (Array.isArray(record.efforts)) model.efforts = record.efforts.filter((item) => typeof item === "string");
+		if (record.origin === "official" || record.origin === "custom" || record.origin === "gateway") model.origin = record.origin;
 		models.push(model);
 	}
 	return models;
@@ -59278,18 +60146,41 @@ function positiveInteger$1(value, fallback, allowZero = false) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < (allowZero ? 0 : 1)) return fallback;
 	return value;
 }
+/**
+* Keep a legacy gateway row the user is demonstrably using.
+*
+* Rows written before `origin` existed carry none, and the compact list hides
+* every unmarked non-`cline-pass/*` row. A row that is enabled, pinned or given
+* a context override is one the user already selected, so hiding it would drop
+* a working model out of the picker on upgrade; those rows become `custom`
+* instead. Everything else stays hidden as a search-index row.
+*/
+function promoteInUseCatalogRows(models, enabledModelIds, pins, contextWindowOverrides) {
+	const inUse = /* @__PURE__ */ new Set([
+		...enabledModelIds === null ? models.map((model) => model.id) : enabledModelIds,
+		...Object.keys(pins),
+		...Object.keys(contextWindowOverrides)
+	]);
+	if (inUse.size === 0) return models;
+	return models.map((model) => model.origin !== void 0 || model.id.startsWith("cline-pass/") || !inUse.has(model.id) ? model : {
+		...model,
+		origin: "custom"
+	});
+}
 /** Parse one whole settings document. */
 function parseClinePassModelSettings(value) {
 	const record = typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
 	const enabledModelIds = record.enabledModelIds === null ? null : Array.isArray(record.enabledModelIds) ? record.enabledModelIds.filter((id) => typeof id === "string") : null;
+	const pins = readPins(record.pins);
+	const contextWindowOverrides = readNumberOverrides$1(record.contextWindowOverrides);
 	return {
 		enabled: record.enabled !== false,
 		baseURL: typeof record.baseURL === "string" && record.baseURL.trim() !== "" ? record.baseURL.trim() : DEFAULT_BASE_URL,
 		enabledModelIds,
-		catalogModels: readCatalogModels$1(record.catalogModels),
-		pins: readPins(record.pins),
+		catalogModels: promoteInUseCatalogRows(readCatalogModels$1(record.catalogModels), enabledModelIds, pins, contextWindowOverrides),
+		pins,
 		hiddenModels: Array.isArray(record.hiddenModels) ? record.hiddenModels.filter((id) => typeof id === "string") : [],
-		contextWindowOverrides: readNumberOverrides$1(record.contextWindowOverrides),
+		contextWindowOverrides,
 		defaultContextWindow: positiveInteger$1(record.defaultContextWindow, DEFAULT_CONTEXT_WINDOW$1),
 		defaultMaxTokens: positiveInteger$1(record.defaultMaxTokens, DEFAULT_MAX_TOKENS$1),
 		maxConcurrentRequests: positiveInteger$1(record.maxConcurrentRequests, 16, true),
@@ -60059,6 +60950,83 @@ function resolveModelInfo$1(model, options) {
 	};
 }
 //#endregion
+//#region src/shared/cline-pass-contracts.ts
+/**
+* Wire contracts for the Cline Pass line's settings API.
+*
+* The line is API-key based: there is no OAuth flow, no token expiry, and no
+* per-account identity beyond the key and the alias a user gives it. What the
+* card does render beyond the shared account facts is the routing observation
+* this plugin makes about each model (pipeline, discovered channels, per-channel
+* verdicts) and the per-model pin the user stores. None of it is a credential.
+*/
+const CLINE_PASS_PROVIDER_ID = "cline-pass";
+const CLINE_PASS_PROVIDER_NAME = "Cline Pass";
+const CLINE_PASS_ROUTE_PREFIX = "/cline-pass/api";
+/**
+* The gateway's anonymous contributor-route label.
+*
+* When Cline routes a model id onto the VMC fallback net, the serving channel
+* reports itself as `openai-compatible-private` and the resolved slug moves
+* under `private/…-contributor`. Answers from it may be used for training and
+* carry no zero-data-retention guarantee, so a pin landing there is a fact the
+* user must see, not a channel like any other.
+*/
+const CLINE_PASS_ANONYMOUS_UPSTREAMS = Object.freeze(["openai-compatible-private"]);
+/** Whether a channel name or resolved slug names the anonymous contributor route. */
+function isClinePassAnonymousUpstream(name, canonicalSlug) {
+	const value = String(name ?? "").toLowerCase();
+	if (CLINE_PASS_ANONYMOUS_UPSTREAMS.includes(value)) return true;
+	const slug = String(canonicalSlug ?? "").toLowerCase();
+	return slug.startsWith("private/") || slug.includes("-contributor");
+}
+/** Whether a submitted pin mode names one of the two accepted modes. */
+function isClinePassPinMode(value) {
+	return value === "strict" || value === "preferred";
+}
+/** Human label for the gateway's quota-window spelling. */
+function clinePassWindowLabel(type) {
+	switch (type) {
+		case "five_hour": return "5 小时";
+		case "weekly": return "每周";
+		case "monthly": return "每月";
+		default: return type;
+	}
+}
+/** Window length in minutes for the shared AccountQuota formatter. */
+function clinePassWindowDurationMins(type) {
+	switch (type) {
+		case "five_hour": return 300;
+		case "weekly": return 7 * 1440;
+		case "monthly": return 30 * 1440;
+		default: return;
+	}
+}
+/**
+* Project one account's Cline Pass usage reading into the shared
+* {@link PoolAccountQuotaDto} shape that AccountPoolSection renders inside the
+* account row. A failed reading returns undefined so the card does not draw
+* fabricated zero bars.
+*/
+function clinePassAccountQuota(reading) {
+	if (reading === void 0 || !reading.ok) return void 0;
+	const windows = reading.windows.map((window) => {
+		const duration = clinePassWindowDurationMins(window.type);
+		const parsedReset = window.resetsAt === "" ? NaN : Date.parse(window.resetsAt);
+		const resetsAt = Number.isFinite(parsedReset) && parsedReset > 0 ? parsedReset : null;
+		return {
+			label: window.label || clinePassWindowLabel(window.type),
+			usedPercent: window.percentUsed,
+			...duration === void 0 ? {} : { windowDurationMins: duration },
+			resetsAt
+		};
+	});
+	return {
+		fetchedAt: reading.fetchedAt,
+		windows
+	};
+}
+//#endregion
 //#region src/host/cline-pass/protocol.ts
 /**
 * Cline Pass wire protocol: pipeline detection, pin injection, failover
@@ -60108,22 +61076,97 @@ function parseRouting(json) {
 	const choices = Array.isArray(payload.choices) ? payload.choices : [];
 	const first = isRecord$11(choices[0]) ? choices[0] : {};
 	const message = isRecord$11(first.message) ? first.message : {};
-	const metadata = isRecord$11(message.provider_metadata) ? message.provider_metadata : isRecord$11(payload.provider_metadata) ? payload.provider_metadata : {};
+	const delta = isRecord$11(first.delta) ? first.delta : {};
+	const metadata = [
+		message,
+		delta,
+		payload
+	].map(providerMetadataOf).find((entry) => entry !== null) ?? {};
 	const gateway = isRecord$11(metadata.gateway) ? metadata.gateway : {};
-	const routing = isRecord$11(gateway.routing) ? gateway.routing : {};
 	const direct = typeof payload.provider === "string" ? payload.provider : null;
+	let routing = isRecord$11(gateway.routing) ? gateway.routing : {};
+	if (typeof routing.finalProvider !== "string") routing = huntRouting(payload) ?? routing;
+	const finalProvider = typeof routing.finalProvider === "string" ? routing.finalProvider : direct === null ? null : slugify(direct);
+	const canonicalSlug = typeof routing.canonicalSlug === "string" ? routing.canonicalSlug : typeof payload.model === "string" && payload.model.includes("/") ? payload.model : null;
 	return {
-		content: typeof message.content === "string" ? message.content : null,
-		toolCalls: Array.isArray(message.tool_calls) ? message.tool_calls : [],
+		content: typeof message.content === "string" ? message.content : typeof delta.content === "string" ? delta.content : null,
+		toolCalls: Array.isArray(message.tool_calls) ? message.tool_calls : Array.isArray(delta.tool_calls) ? delta.tool_calls : [],
 		usage: payload.usage ?? null,
 		pipeline: typeof routing.finalProvider === "string" ? "planner" : direct === null ? null : "direct",
-		canonicalSlug: typeof routing.canonicalSlug === "string" ? routing.canonicalSlug : typeof payload.model === "string" && payload.model.includes("/") ? payload.model : null,
-		finalProvider: typeof routing.finalProvider === "string" ? routing.finalProvider : direct === null ? null : slugify(direct),
+		canonicalSlug,
+		finalProvider,
 		finalProviderName: typeof routing.finalProvider === "string" ? routing.finalProvider : direct,
 		fallbacks: Array.isArray(routing.fallbacksAvailable) ? routing.fallbacksAvailable.map(String) : [],
-		plan: typeof routing.planningReasoning === "string" ? routing.planningReasoning : ""
+		plan: typeof routing.planningReasoning === "string" ? routing.planningReasoning : "",
+		fingerprint: huntFingerprint(payload),
+		anonymous: isClinePassAnonymousUpstream(finalProvider ?? "", canonicalSlug ?? "")
 	};
 }
+/**
+* Nodes one payload walk may visit before giving up.
+*
+* The hunts run per streamed frame, and a frame is small, but a pathological
+* payload must not turn a cheap re-read into an unbounded walk.
+*/
+const HUNT_NODE_BUDGET = 4e3;
+/** `provider_metadata` of one node, when present. */
+function providerMetadataOf(node) {
+	return isRecord$11(node.provider_metadata) ? node.provider_metadata : null;
+}
+/**
+* Depth-bounded hunt for the gateway's routing block anywhere in one payload.
+*
+* The fast paths (`message`/`delta`/`payload.provider_metadata.gateway`) are
+* checked by the caller first; this walk covers the nestings between the shapes
+* seen so far, so a frame the fast path does not know still yields its routing.
+*/
+function huntRouting(node, depth = 0, budget = { left: HUNT_NODE_BUDGET }) {
+	if (depth > 8 || budget.left <= 0 || node === null || typeof node !== "object") return null;
+	budget.left -= 1;
+	if (Array.isArray(node)) {
+		for (const entry of node) {
+			const found = huntRouting(entry, depth + 1, budget);
+			if (found !== null) return found;
+		}
+		return null;
+	}
+	const record = node;
+	const gateway = isRecord$11(record.gateway) ? record.gateway : null;
+	const routing = gateway !== null && isRecord$11(gateway.routing) ? gateway.routing : isRecord$11(record.routing) ? record.routing : null;
+	if (routing !== null && typeof routing.finalProvider === "string") return routing;
+	for (const value of Object.values(record)) {
+		const found = huntRouting(value, depth + 1, budget);
+		if (found !== null) return found;
+	}
+	return null;
+}
+/**
+* Read the first-party DeepSeek fingerprint wherever `provider_metadata`
+* carries it. Absent means the answer did not prove a first-party upstream —
+* the anonymous contributor route carries no `deepseek` namespace at all.
+*/
+function huntFingerprint(node, depth = 0, budget = { left: HUNT_NODE_BUDGET }) {
+	if (depth > 8 || budget.left <= 0 || node === null || typeof node !== "object") return null;
+	budget.left -= 1;
+	if (Array.isArray(node)) {
+		for (const entry of node) {
+			const found = huntFingerprint(entry, depth + 1, budget);
+			if (found !== null) return found;
+		}
+		return null;
+	}
+	const record = node;
+	const metadata = providerMetadataOf(record);
+	if (metadata !== null) {
+		const deepseek = isRecord$11(metadata.deepseek) ? metadata.deepseek : null;
+		if (deepseek !== null && typeof deepseek.systemFingerprint === "string" && deepseek.systemFingerprint !== "") return deepseek.systemFingerprint;
+	}
+	for (const value of Object.values(record)) {
+		const found = huntFingerprint(value, depth + 1, budget);
+		if (found !== null) return found;
+	}
+	return null;
+}
 /** Lowercase a display name into an upstream slug. */
 function slugify(value) {
 	return String(value).toLowerCase().replace(/\s+/g, "-");
@@ -60212,6 +61255,7 @@ function injectPrefs(body, meta, attempt) {
 	const excludeList = attempt.excludeList ?? [];
 	const strict = attempt.strict !== false;
 	const sort = normalizeSort(attempt.sort);
+	const has = capGatewayHas((attempt.has ?? []).filter((name) => typeof name === "string"));
 	const excluded = excludeList.filter((name) => normalizeSlug(name) !== normalizeSlug(upstream ?? ""));
 	const excludedIds = new Set(excluded.map(normalizeSlug));
 	const spell = (names, pipeline) => names.map((name) => channelNameFor(name, pipeline));
@@ -60221,7 +61265,7 @@ function injectPrefs(body, meta, attempt) {
 	const both = attempt.spelling !== "detected";
 	const useGateway = both || pipeline === "planner" || pipeline === null;
 	const useOpenRouter = both || pipeline === "direct" || pipeline === null;
-	const gatewayUsable = useGateway && (upstream !== null || sort !== null || gatewayAllow !== null && gatewayAllow.length > 0);
+	const gatewayUsable = useGateway && (upstream !== null || sort !== null || has.length > 0 || gatewayAllow !== null && gatewayAllow.length > 0);
 	const openRouterUsable = useOpenRouter && (upstream !== null || sort !== null || excluded.length > 0 || openRouterAllow !== null && openRouterAllow.length > 0);
 	if (!gatewayUsable && !openRouterUsable) return next;
 	if (gatewayUsable) {
@@ -60233,6 +61277,7 @@ function injectPrefs(body, meta, attempt) {
 		}
 		else if (gatewayAllow !== null && gatewayAllow.length > 0) gateway.only = spell(gatewayAllow, "planner");
 		if (sort !== null) gateway.sort = sort;
+		if (has.length > 0) gateway.has = [...has];
 		const providerOptions = isRecord$11(next.providerOptions) ? next.providerOptions : {};
 		const currentGateway = isRecord$11(providerOptions.gateway) ? providerOptions.gateway : {};
 		next.providerOptions = {
@@ -60290,13 +61335,16 @@ function isAdherenceOk(adherence) {
 */
 function pinWarnings(attempt, meta) {
 	const upstream = attempt.upstream ?? null;
+	const warnings = [];
+	if (upstream !== null && upstream !== void 0 && String(upstream).length > 0 && isClinePassAnonymousUpstream(upstream)) warnings.push(`anonymousUpstream: ${upstream} is the gateway's anonymous contributor route — answers from it may be used for training and carry no zero-data-retention guarantee; pin it only when that is acceptable`);
+	const known = Array.isArray(meta?.upstreams) ? meta.upstreams : [];
+	if (upstream !== null && upstream !== void 0 && String(upstream).length > 0 && !isClinePassAnonymousUpstream(upstream) && known.length > 0 && known.every((name) => isClinePassAnonymousUpstream(name))) warnings.push(`pinLikelyIgnored: every channel discovered for this model is the anonymous contributor route (${known.join(", ")}), which silently drops a pin and answers anyway — the request will likely be served by it regardless of ${upstream}`);
 	const excluded = (attempt.excludeList ?? []).filter((name) => normalizeSlug(name) !== normalizeSlug(upstream ?? ""));
 	const excludedIds = new Set(excluded.map(normalizeSlug));
-	if (excluded.length === 0) return [];
-	const known = Array.isArray(meta?.upstreams) ? meta.upstreams : [];
-	if (known.length === 0) return [`excludeUnresolved: this model has no channel list yet, so ${excluded.join(", ")} could not be compiled into an allow-list — run cline_pass_probe for it`];
-	if (known.filter((name) => !excludedIds.has(normalizeSlug(name))).length === 0 && upstream === null) return [`PIN_UNRESOLVED: every known channel is excluded (${known.join(", ")}), so the request falls back to the gateway's own routing`];
-	return [];
+	if (excluded.length === 0) return warnings;
+	if (known.length === 0) return [...warnings, `excludeUnresolved: this model has no channel list yet, so ${excluded.join(", ")} could not be compiled into an allow-list — run cline_pass_probe for it`];
+	if (known.filter((name) => !excludedIds.has(normalizeSlug(name))).length === 0 && upstream === null) return [...warnings, `PIN_UNRESOLVED: every known channel is excluded (${known.join(", ")}), so the request falls back to the gateway's own routing`];
+	return warnings;
 }
 /**
 * Expand one model's pin configuration into the ordered failover candidates.
@@ -60316,6 +61364,8 @@ function buildAttempts(config) {
 		sort: normalizeSort(config.sort),
 		excludeList: exclude
 	};
+	const has = (config.has ?? []).filter((name) => typeof name === "string" && name.trim().length > 0);
+	if (has.length > 0) base.has = [...has];
 	if (typeof config.spelling === "string" && config.spelling.length > 0) base.spelling = config.spelling;
 	if (wanted.length > 0) return wanted.map((upstream, index) => ({
 		...base,
@@ -60969,8 +62019,7 @@ var ClinePassAdapter = class extends LlmAdapter {
 	*/
 	async availableModelIds(settings) {
 		const ids = new Set(DEFAULT_MODELS);
-		for (const model of settings.catalogModels) ids.add(model.id);
-		if (settings.exposeCatalog === true) for (const id of this.store.catalog().ids) ids.add(id);
+		for (const model of listedClinePassCatalogModels(settings)) ids.add(model.id);
 		const hidden = new Set(settings.hiddenModels);
 		const enabled = settings.enabledModelIds === null ? null : new Set(settings.enabledModelIds);
 		return [...ids].filter((id) => !hidden.has(id) && (enabled === null || enabled.has(id)));
@@ -61149,7 +62198,9 @@ var ClinePassAdapter = class extends LlmAdapter {
 				const observed = {
 					provider: null,
 					canonical: null,
-					pipeline: null
+					pipeline: null,
+					fingerprint: null,
+					anonymous: false
 				};
 				const iterator = translate(tapRouting(parseServerSentEvents$1(tapChunks$1(response.body, () => {
 					activity?.pulse();
@@ -61221,6 +62272,9 @@ var ClinePassAdapter = class extends LlmAdapter {
 					upstream: attempt.upstream,
 					excludeList: attempt.excludeList
 				}, meta);
+				if (adherence === "not-adopted") warnings.push(`pinNotAdopted: the gateway served ${observed.provider ?? "(unknown)"} instead of the pinned ${attempt.upstream ?? "(auto)"}`);
+				else if (adherence === "violated") warnings.push(`pinViolated: an excluded channel served this request: ${observed.provider ?? "(unknown)"}`);
+				if (observed.anonymous) warnings.push(`anonymousServed: this answer came from the gateway's anonymous contributor route (${observed.provider ?? "openai-compatible-private"}) — it may be used for training and carries no zero-data-retention guarantee`);
 				const ms = Date.now() - attemptStarted;
 				trace.push(attemptLabel);
 				this.store.record({
@@ -61236,10 +62290,16 @@ var ClinePassAdapter = class extends LlmAdapter {
 					code: finishFailure?.code ?? "",
 					account: account.name,
 					adherence,
+					fingerprint: observed.fingerprint ?? "",
+					anonymous: observed.anonymous,
 					warnings,
 					...usage === void 0 ? {} : { usage },
 					effort: options.reasoningEffort === void 0 ? "" : String(options.reasoningEffort)
 				});
+				if (observed.fingerprint !== null || observed.provider !== null) this.store.learn(options.model, {
+					...observed.provider === null ? {} : { lastProvider: observed.provider },
+					...observed.fingerprint === null ? {} : { lastFingerprint: observed.fingerprint }
+				});
 				this.accountPool.recordModel(account.id, options.model);
 				if (finishFailure === null && attempt.upstream !== null && adherence === "adopted") this.store.learnUpstream(options.model, attempt.upstream, "ok", "", ms);
 				return;
@@ -61337,8 +62397,10 @@ async function* tapRouting(payloads, observed) {
 			if (routing.finalProvider !== null) {
 				observed.provider = routing.finalProvider;
 				observed.pipeline = routing.pipeline;
+				observed.anonymous = routing.anonymous;
 				if (routing.canonicalSlug !== null) observed.canonical = routing.canonicalSlug;
 			}
+			if (routing.fingerprint !== null) observed.fingerprint = routing.fingerprint;
 		}
 		yield payload;
 	}
@@ -61466,7 +62528,7 @@ function effortsFromOptions(options) {
 	const ordered = REASONING_EFFORTS.map((effort) => effort.id).filter((id) => levels.has(id));
 	return ordered.length > 0 ? ordered : void 0;
 }
-/** List the gateway's own catalog ids; an empty array when the call fails. */
+/** List the gateway's own catalog; empty when the call fails. */
 async function fetchGatewayCatalog({ fetchFn, baseURL, apiKey, signal, timeoutMs = 3e4 }) {
 	try {
 		const result = await sendJSON(fetchFn, `${trimBase(baseURL)}/models`, {
@@ -61474,9 +62536,24 @@ async function fetchGatewayCatalog({ fetchFn, baseURL, apiKey, signal, timeoutMs
 			signal,
 			timeoutMs
 		});
-		return (isRecord$10(result.json) && Array.isArray(result.json.data) ? result.json.data : []).map((model) => isRecord$10(model) ? model.id : void 0).filter((id) => typeof id === "string");
+		const data = isRecord$10(result.json) && Array.isArray(result.json.data) ? result.json.data : [];
+		const ids = [];
+		const models = {};
+		for (const model of data) {
+			if (!isRecord$10(model) || typeof model.id !== "string") continue;
+			ids.push(model.id);
+			const meta = modelMetadata(model);
+			if (Object.keys(meta).length > 0) models[model.id] = meta;
+		}
+		return {
+			ids,
+			models
+		};
 	} catch {
-		return [];
+		return {
+			ids: [],
+			models: {}
+		};
 	}
 }
 /**
@@ -61727,6 +62804,7 @@ var ClinePassEngine = class {
 			exclude: this.pinOf(model).exclude,
 			pinMode: this.pinOf(model).pinMode,
 			sort: this.pinOf(model).sort,
+			has: this.pinOf(model).has,
 			spelling: this.options.pinFor(model).spelling
 		};
 	}
@@ -61737,7 +62815,8 @@ var ClinePassEngine = class {
 			upstreams: (pin.upstreams ?? []).map(String),
 			exclude: (pin.exclude ?? []).map(String),
 			pinMode: pin.pinMode === "preferred" ? "preferred" : "strict",
-			sort: typeof pin.sort === "string" ? pin.sort : ""
+			sort: typeof pin.sort === "string" ? pin.sort : "",
+			has: Array.isArray(pin.has) ? pin.has.map(String) : defaultGatewayHas(model)
 		};
 	}
 	/**
@@ -61814,7 +62893,9 @@ var ClinePassEngine = class {
 				if (attempt.upstream === null && attempt.excludeList.length > 0 && outcome.error !== "") this.learnFromError(model, outcome.error);
 			}
 		}
-		const error = last === null ? "no candidate succeeded" : last.ok !== true ? last.error : last.adherence === "violated" ? `an excluded channel served the request: ${last.routing.finalProvider ?? "(unknown)"}` : `the gateway ignored the pin: served by ${last.routing.finalProvider ?? "(unknown)"}`;
+		const failure = last === null ? "no candidate succeeded" : last.ok !== true ? last.error : last.adherence === "violated" ? `an excluded channel served the request: ${last.routing.finalProvider ?? "(unknown)"}` : `the gateway ignored the pin: served by ${last.routing.finalProvider ?? "(unknown)"}`;
+		const has = (pinConfig.has ?? []).filter((name) => typeof name === "string" && name.trim() !== "");
+		const error = has.length > 0 && /provider|capabilit|filter/i.test(failure) ? `${failure} (this pin also requires capabilities [${has.join(", ")}]; clear them in the pin editor to widen routing)` : failure;
 		return {
 			ok: false,
 			result: last,
@@ -61876,21 +62957,26 @@ var ClinePassEngine = class {
 				lastProvider: "",
 				upstreams: [],
 				availableProviders: [],
-				tier0: []
+				tier0: [],
+				fingerprint: "",
+				anonymous: false
 			};
 		}
 		const routing = parseRouting(payload);
 		const pipeline = routing.pipeline;
 		const otherPipeline = pipeline === "planner" ? "direct" : pipeline === "direct" ? "planner" : null;
+		const has = this.pinOf(model).has;
 		let harvested = null;
 		if (pipeline !== null) harvested = await this.harvest(model, pipeline, account, {
 			signal,
-			timeoutMs: this.options.probeTimeoutMs
+			timeoutMs: this.options.probeTimeoutMs,
+			has
 		});
 		let otherHarvested = null;
 		if (otherPipeline !== null) otherHarvested = await this.harvest(model, otherPipeline, account, {
 			signal,
-			timeoutMs: this.options.probeTimeoutMs
+			timeoutMs: this.options.probeTimeoutMs,
+			has
 		});
 		let endpoints = [];
 		let openrouterSlug = null;
@@ -61930,6 +63016,7 @@ var ClinePassEngine = class {
 			staleAt: combined.length === 0 && upstreams.length > 0 ? Date.now() : 0,
 			tier0,
 			lastProvider: routing.finalProvider ?? previous.lastProvider ?? null,
+			lastFingerprint: routing.fingerprint ?? previous.lastFingerprint ?? null,
 			lastMs: ms,
 			probedAt: Date.now(),
 			lastError: ""
@@ -61945,7 +63032,9 @@ var ClinePassEngine = class {
 			lastProvider: meta.lastProvider ?? "",
 			upstreams: meta.upstreams ?? [],
 			availableProviders: meta.availableProviders ?? [],
-			tier0: meta.tier0 ?? []
+			tier0: meta.tier0 ?? [],
+			fingerprint: meta.lastFingerprint ?? "",
+			anonymous: isClinePassAnonymousUpstream(meta.lastProvider ?? "", meta.canonicalSlug ?? "")
 		};
 	}
 	/**
@@ -61953,7 +63042,7 @@ var ClinePassEngine = class {
 	* cannot exist: the router fails before spending a token and names every
 	* provider it could have used.
 	*/
-	async harvest(model, pipeline, account, { signal, timeoutMs }) {
+	async harvest(model, pipeline, account, { signal, timeoutMs, has = [] }) {
 		const base = {
 			model,
 			messages: [{
@@ -61964,7 +63053,10 @@ var ClinePassEngine = class {
 		};
 		const body = pipeline === "planner" ? {
 			...base,
-			providerOptions: { gateway: { only: ["__probe__"] } }
+			providerOptions: { gateway: {
+				only: ["__probe__"],
+				...has.length > 0 ? { has: [...has] } : {}
+			} }
 		} : {
 			...base,
 			provider: { only: ["__probe__"] }
@@ -61978,7 +63070,12 @@ var ClinePassEngine = class {
 				signal,
 				timeoutMs: timeoutMs ?? this.options.probeTimeoutMs
 			});
-			return extractAvailableProviders(errorText$1(unwrapEnvelope(result.json).error) || result.text, pipeline);
+			const payload = unwrapEnvelope(result.json);
+			const listed = extractAvailableProviders(errorText$1(payload.error) || result.text, pipeline);
+			if (listed !== null && listed.length > 0) return listed;
+			const routing = parseRouting(payload);
+			if (routing.finalProvider !== null && routing.finalProvider !== "") return [routing.finalProvider];
+			return listed;
 		} catch {
 			return null;
 		}
@@ -61993,6 +63090,7 @@ var ClinePassEngine = class {
 	async validate(model, { signal, timeoutMs } = {}) {
 		const meta = this.store.metaOf(model);
 		const list = Array.isArray(meta.upstreams) ? meta.upstreams : [];
+		const has = this.pinOf(model).has;
 		const results = [];
 		for (let index = 0; index < list.length; index += 5) {
 			if (signal?.aborted === true) break;
@@ -62004,7 +63102,8 @@ var ClinePassEngine = class {
 					strict: true,
 					sort: null,
 					orderRest: [],
-					excludeList: []
+					excludeList: [],
+					has
 				};
 				const body = injectPrefs({
 					model,
@@ -62083,13 +63182,14 @@ var ClinePassEngine = class {
 	* Send one small chat through a (possibly temporary) pin configuration and
 	* report what served it. Nothing is persisted.
 	*/
-	async test(model, { upstreams, exclude, signal } = {}) {
+	async test(model, { upstreams, exclude, has, signal } = {}) {
 		const stored = this.pinOf(model);
 		const pin = {
 			upstreams: Array.isArray(upstreams) ? upstreams : stored.upstreams,
 			exclude: Array.isArray(exclude) ? exclude : stored.exclude,
 			pinMode: stored.pinMode,
 			sort: stored.sort,
+			has: Array.isArray(has) ? has : stored.has,
 			spelling: this.options.pinFor(model).spelling
 		};
 		const started = Date.now();
@@ -62135,6 +63235,9 @@ var ClinePassEngine = class {
 				adopted: false,
 				adherence: outcome.result?.adherence ?? "",
 				plan: routing?.plan ?? "",
+				fingerprint: routing?.fingerprint ?? "",
+				anonymous: isClinePassAnonymousUpstream(routing?.finalProvider ?? "", routing?.canonicalSlug ?? ""),
+				has: [...pin.has ?? []],
 				warnings
 			};
 		}
@@ -62166,6 +63269,9 @@ var ClinePassEngine = class {
 			adopted: outcome.result?.adherence === "adopted",
 			adherence: outcome.result?.adherence ?? "",
 			plan: routing?.plan ?? "",
+			fingerprint: routing?.fingerprint ?? "",
+			anonymous: isClinePassAnonymousUpstream(routing?.finalProvider ?? "", routing?.canonicalSlug ?? ""),
+			has: [...pin.has ?? []],
 			warnings
 		};
 	}
@@ -62229,7 +63335,7 @@ var ClinePassEngine = class {
 			};
 		}
 	}
-	/** Refresh the gateway's own catalog ids. */
+	/** Refresh the gateway's own catalog: ids plus published metadata. */
 	async gatewayCatalog({ signal, timeoutMs } = {}) {
 		const account = await this.resolveAccount();
 		return await fetchGatewayCatalog({
@@ -62264,66 +63370,6 @@ var ClinePassEngine = class {
 	}
 };
 //#endregion
-//#region src/shared/cline-pass-contracts.ts
-/**
-* Wire contracts for the Cline Pass line's settings API.
-*
-* The line is API-key based: there is no OAuth flow, no token expiry, and no
-* per-account identity beyond the key and the alias a user gives it. What the
-* card does render beyond the shared account facts is the routing observation
-* this plugin makes about each model (pipeline, discovered channels, per-channel
-* verdicts) and the per-model pin the user stores. None of it is a credential.
-*/
-const CLINE_PASS_PROVIDER_ID = "cline-pass";
-const CLINE_PASS_PROVIDER_NAME = "Cline Pass";
-const CLINE_PASS_ROUTE_PREFIX = "/cline-pass/api";
-/** Whether a submitted pin mode names one of the two accepted modes. */
-function isClinePassPinMode(value) {
-	return value === "strict" || value === "preferred";
-}
-/** Human label for the gateway's quota-window spelling. */
-function clinePassWindowLabel(type) {
-	switch (type) {
-		case "five_hour": return "5 小时";
-		case "weekly": return "每周";
-		case "monthly": return "每月";
-		default: return type;
-	}
-}
-/** Window length in minutes for the shared AccountQuota formatter. */
-function clinePassWindowDurationMins(type) {
-	switch (type) {
-		case "five_hour": return 300;
-		case "weekly": return 7 * 1440;
-		case "monthly": return 30 * 1440;
-		default: return;
-	}
-}
-/**
-* Project one account's Cline Pass usage reading into the shared
-* {@link PoolAccountQuotaDto} shape that AccountPoolSection renders inside the
-* account row. A failed reading returns undefined so the card does not draw
-* fabricated zero bars.
-*/
-function clinePassAccountQuota(reading) {
-	if (reading === void 0 || !reading.ok) return void 0;
-	const windows = reading.windows.map((window) => {
-		const duration = clinePassWindowDurationMins(window.type);
-		const parsedReset = window.resetsAt === "" ? NaN : Date.parse(window.resetsAt);
-		const resetsAt = Number.isFinite(parsedReset) && parsedReset > 0 ? parsedReset : null;
-		return {
-			label: window.label || clinePassWindowLabel(window.type),
-			usedPercent: window.percentUsed,
-			...duration === void 0 ? {} : { windowDurationMins: duration },
-			resetsAt
-		};
-	});
-	return {
-		fetchedAt: reading.fetchedAt,
-		windows
-	};
-}
-//#endregion
 //#region src/host/cline-pass/routes.ts
 function sendJson$2(response, status, body) {
 	response.writeHead(status, { "content-type": "application/json; charset=utf-8" });
@@ -62373,23 +63419,40 @@ function formatModelCapacity$1(tokens) {
 	if (tokens >= 1e3 && tokens % 1e3 === 0) return tokens / 1e3 + "k";
 	return String(tokens);
 }
+/** `cline-pass/*` is the subscription catalogue; every other id is marketplace credit billing. */
+function catalogBilling(id) {
+	return id.startsWith("cline-pass/") ? "subscription" : "credits";
+}
+/** Published metadata for an id the store already scanned, so an added row keeps its real facts. */
+function publishedCatalogMeta(store, id) {
+	const entry = store.catalog().models[id];
+	if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return {};
+	const record = entry;
+	const meta = {};
+	if (typeof record.name === "string") meta.name = record.name;
+	if (typeof record.contextWindow === "number") meta.contextWindow = record.contextWindow;
+	if (typeof record.maxTokens === "number") meta.maxTokens = record.maxTokens;
+	if (typeof record.reasoning === "boolean") meta.reasoning = record.reasoning;
+	if (Array.isArray(record.input)) meta.input = record.input.filter((item) => typeof item === "string");
+	if (Array.isArray(record.efforts)) meta.efforts = record.efforts.filter((item) => typeof item === "string");
+	return meta;
+}
 function formatModelHint$1(contextWindow, input, reasoning) {
 	return formatModelCapacity$1(contextWindow) + " · " + input.join("+") + (reasoning ? " · reasoning" : "");
 }
-function uniqueModels$1(settings, catalogIds) {
+function uniqueModels$1(settings) {
 	const ids = new Set(DEFAULT_MODELS);
-	for (const model of settings.catalogModels) ids.add(model.id);
-	if (settings.exposeCatalog) for (const id of catalogIds) ids.add(id);
+	for (const model of listedClinePassCatalogModels(settings)) ids.add(model.id);
 	return [...ids];
 }
 /** Every model the card should render, whether or not it is advertised. */
 function projectModels$1(settings, store) {
-	const known = uniqueModels$1(settings, store.catalog().ids);
+	const known = uniqueModels$1(settings);
 	const hidden = new Set(settings.hiddenModels);
 	const enabledSet = settings.enabledModelIds === null ? null : new Set(settings.enabledModelIds);
 	return known.map((id) => {
 		const meta = store.metaOf(id);
-		const pin = settings.pins[id] ?? defaultPin();
+		const pin = settings.pins[id] ?? defaultPin(id);
 		const base = resolveModelInfo$1(id, {
 			displayName: "Cline Pass",
 			synced: settings.catalogModels,
@@ -62426,6 +63489,7 @@ function projectModels$1(settings, store) {
 			excluded: pin.exclude,
 			pinMode: normalizePinMode(pin.pinMode),
 			sort: pin.sort,
+			has: [...pin.has],
 			upstreams: (meta.upstreams ?? []).map(String),
 			upstreamStatus: verdicts,
 			lastProvider: String(meta.lastProvider ?? ""),
@@ -62478,7 +63542,7 @@ async function getClinePassWebStatus(options, quotaRefresh) {
 		pool,
 		models,
 		catalogSynced: settings.catalogModels.length > 0,
-		catalogCount: settings.catalogModels.length,
+		catalogCount: listedClinePassCatalogModels(settings).length,
 		usage: store.usage().accounts.length === 0 ? null : store.usage(),
 		quotaRefreshing: quotaRefresh?.refreshing === true,
 		historySize: store.historySize(),
@@ -62490,7 +63554,6 @@ async function getClinePassWebStatus(options, quotaRefresh) {
 			maxConcurrentRequests: settings.maxConcurrentRequests,
 			streamIdleTimeoutMs: settings.streamIdleTimeoutMs,
 			historyLimit: settings.historyLimit,
-			exposeCatalog: settings.exposeCatalog,
 			pinSpelling: settings.pinSpelling
 		}
 	};
@@ -62513,6 +63576,8 @@ const CLINE_PASS_ROUTES = {
 	"models/visibility-all": "POST",
 	"models/context-window": "POST",
 	"catalog/refresh": "POST",
+	"catalog/search": "GET",
+	"catalog/add": "POST",
 	usage: "GET|POST",
 	history: "GET"
 };
@@ -62532,6 +63597,27 @@ function registerClinePassRoutes(ctx, options) {
 		ctx.emit?.("llm/adapters-updated");
 	};
 	/**
+	* The full gateway catalog, cached as the search index for manual add.
+	*
+	* The metadata is kept alongside the ids: an id the official scan never saw
+	* has no other source, and `catalog/add` copies what this call learned so the
+	* added row is sized by the gateway rather than by the 128k default.
+	*/
+	const searchCatalogIds = async () => {
+		const cached = store.catalog().ids;
+		if (cached.length > 0) return cached;
+		const gateway = await engine.gatewayCatalog();
+		store.setCatalog({
+			ids: gateway.ids,
+			sources: ["gateway"],
+			models: {
+				...store.catalog().models,
+				...gateway.models
+			}
+		});
+		return gateway.ids;
+	};
+	/**
 	* Read every usable account's official quota and replace the snapshot.
 	*
 	* Shared by the explicit refresh action and the background one a status read
@@ -62841,12 +63927,13 @@ function registerClinePassRoutes(ctx, options) {
 						ok: false,
 						error: "this action needs a model id"
 					});
-					const current = (await settingsStore.read()).pins[model] ?? defaultPin();
+					const current = (await settingsStore.read()).pins[model] ?? defaultPin(model);
 					const next = {
 						upstreams: Array.isArray(body.upstreams) ? body.upstreams.map(String) : current.upstreams,
 						exclude: Array.isArray(body.exclude) ? body.exclude.map(String) : current.exclude,
 						pinMode: isClinePassPinMode(body.pinMode) ? body.pinMode : current.pinMode,
-						sort: body.sort === void 0 ? current.sort : body.sort === "none" ? "" : String(body.sort)
+						sort: body.sort === void 0 ? current.sort : body.sort === "none" ? "" : String(body.sort),
+						has: Array.isArray(body.has) ? body.has.map(String).map((name) => name.trim()).filter((name) => name !== "") : current.has
 					};
 					await settingsStore.setPin(model, next);
 					const meta = store.metaOf(model);
@@ -62915,7 +64002,9 @@ function registerClinePassRoutes(ctx, options) {
 								lastProvider: result.lastProvider,
 								upstreams: result.upstreams,
 								availableProviders: result.availableProviders,
-								tier0: result.tier0
+								tier0: result.tier0,
+								fingerprint: result.fingerprint,
+								anonymous: result.anonymous
 							},
 							status: await status()
 						}
@@ -62973,7 +64062,8 @@ function registerClinePassRoutes(ctx, options) {
 					});
 					const result = await engine.test(model, {
 						upstreams: Array.isArray(body.upstreams) ? body.upstreams.map(String) : void 0,
-						exclude: Array.isArray(body.exclude) ? body.exclude.map(String) : void 0
+						exclude: Array.isArray(body.exclude) ? body.exclude.map(String) : void 0,
+						has: Array.isArray(body.has) ? body.has.map(String).map((name) => name.trim()).filter((name) => name !== "") : void 0
 					});
 					return sendJson$2(response, 200, {
 						ok: true,
@@ -62995,6 +64085,9 @@ function registerClinePassRoutes(ctx, options) {
 								adopted: result.adopted,
 								adherence: result.adherence,
 								plan: firstLine$2(result.plan, 300),
+								fingerprint: result.fingerprint,
+								anonymous: result.anonymous,
+								has: result.has,
 								warnings: result.warnings,
 								trace: result.trace
 							},
@@ -63010,7 +64103,7 @@ function registerClinePassRoutes(ctx, options) {
 					});
 					const body = await readRequestJson$2(request).catch(() => ({}));
 					const current = await settingsStore.read();
-					const known = uniqueModels$1(current, store.catalog().ids);
+					const known = uniqueModels$1(current);
 					const hidden = new Set(current.hiddenModels);
 					if (path === "models/visibility") {
 						const model = typeof body.model === "string" ? body.model.trim() : "";
@@ -63063,6 +64156,94 @@ function registerClinePassRoutes(ctx, options) {
 						value: await status()
 					});
 				}
+				if (path === "catalog/search") {
+					if (method !== "GET") return sendMethodNotAllowed$2(response);
+					const query = (url.searchParams.get("q") ?? "").trim().toLowerCase();
+					if (query === "") return sendJson$2(response, 200, {
+						ok: true,
+						value: { results: [] }
+					});
+					let ids;
+					try {
+						ids = await searchCatalogIds();
+					} catch (error) {
+						return sendJson$2(response, 502, {
+							ok: false,
+							error: firstLine$2(error instanceof Error ? error.message : error, 240)
+						});
+					}
+					const current = await settingsStore.read();
+					const listed = /* @__PURE__ */ new Set([...DEFAULT_MODELS, ...listedClinePassCatalogModels(current).map((entry) => entry.id)]);
+					return sendJson$2(response, 200, {
+						ok: true,
+						value: { results: ids.filter((id) => id.toLowerCase().includes(query)).slice(0, 30).map((id) => ({
+							id,
+							added: listed.has(id),
+							billing: catalogBilling(id)
+						})) }
+					});
+				}
+				if (path === "catalog/add") {
+					if (method !== "POST") return sendMethodNotAllowed$2(response);
+					if (!isSameOriginMutation(request)) return sendJson$2(response, 403, {
+						ok: false,
+						error: "Cross-origin request rejected."
+					});
+					const body = await readRequestJson$2(request).catch(() => ({}));
+					const model = typeof body.model === "string" ? body.model.trim() : "";
+					if (model === "") return sendJson$2(response, 400, {
+						ok: false,
+						error: "this action needs a model id"
+					});
+					let ids;
+					try {
+						ids = await searchCatalogIds();
+					} catch (error) {
+						return sendJson$2(response, 502, {
+							ok: false,
+							error: firstLine$2(error instanceof Error ? error.message : error, 240)
+						});
+					}
+					if (!ids.includes(model)) return sendJson$2(response, 404, {
+						ok: false,
+						error: `${model} is not in the gateway catalog; refresh or search again.`
+					});
+					const billing = catalogBilling(model);
+					if (billing === "credits" && body.acknowledgeBilling !== true) return sendJson$2(response, 409, {
+						ok: false,
+						code: "credits_billing",
+						billing,
+						error: `${model} is a marketplace model billed against the Cline Credits balance, not the Cline Pass plan. Retry with acknowledgeBilling:true to add it anyway.`
+					});
+					const current = await settingsStore.read();
+					const published = publishedCatalogMeta(store, model);
+					const exists = current.catalogModels.some((entry) => entry.id === model);
+					const catalogModels = exists ? current.catalogModels.map((entry) => entry.id === model ? {
+						...entry,
+						...published,
+						origin: "custom"
+					} : entry) : [...current.catalogModels, {
+						id: model,
+						...published,
+						origin: "custom"
+					}];
+					const enabledModelIds = current.enabledModelIds === null ? null : [.../* @__PURE__ */ new Set([...current.enabledModelIds, model])];
+					const hiddenModels = current.hiddenModels.filter((id) => id !== model);
+					await settingsStore.update({
+						catalogModels,
+						enabledModelIds,
+						hiddenModels
+					});
+					emitModelsUpdated();
+					return sendJson$2(response, 200, {
+						ok: true,
+						value: {
+							added: !exists,
+							billing,
+							status: await status()
+						}
+					});
+				}
 				if (path === "catalog/refresh") {
 					if (method !== "POST") return sendMethodNotAllowed$2(response);
 					if (!isSameOriginMutation(request)) return sendJson$2(response, 403, {
@@ -63083,6 +64264,7 @@ function registerClinePassRoutes(ctx, options) {
 						const published = scan.catalog[id] ?? {};
 						existing.set(id, {
 							id,
+							origin: "official",
 							...published.name === void 0 ? {} : { name: published.name },
 							...published.contextWindow === void 0 ? {} : { contextWindow: published.contextWindow },
 							...published.maxTokens === void 0 ? {} : { maxTokens: published.maxTokens },
@@ -63091,17 +64273,18 @@ function registerClinePassRoutes(ctx, options) {
 							...published.efforts === void 0 ? {} : { efforts: published.efforts }
 						});
 					}
-					const gateway = current.exposeCatalog ? await engine.gatewayCatalog().catch(() => []) : [];
-					let merged = [...existing.values()];
-					if (gateway.length > 0) {
-						const known = new Set(merged.map((entry) => entry.id));
-						merged = [...merged, ...gateway.filter((id) => !known.has(id)).map((id) => ({ id }))];
-					}
-					await settingsStore.storeCatalog(merged);
+					const gateway = await engine.gatewayCatalog().catch(() => ({
+						ids: [],
+						models: {}
+					}));
+					await settingsStore.storeCatalog([...existing.values()]);
 					store.setCatalog({
-						ids: [.../* @__PURE__ */ new Set([...scan.models, ...gateway])],
-						sources: scan.sources,
-						models: scan.catalog
+						ids: [.../* @__PURE__ */ new Set([...scan.models, ...gateway.ids])],
+						sources: [...scan.sources, ...gateway.ids.length > 0 ? ["gateway"] : []],
+						models: {
+							...gateway.models,
+							...scan.catalog
+						}
 					});
 					emitModelsUpdated();
 					return sendJson$2(response, 200, {
@@ -63175,6 +64358,8 @@ function registerClinePassRoutes(ctx, options) {
 						error: entry.error,
 						attempts: entry.attempts,
 						adherence: entry.adherence,
+						fingerprint: entry.fingerprint,
+						anonymous: entry.anonymous,
 						warnings: entry.warnings
 					}));
 					return sendJson$2(response, 200, {
@@ -63295,6 +64480,8 @@ function createClinePassStore({ historyLimit = 100 } = {}) {
 				error: entry.error ?? "",
 				attempts: entry.attempts ?? [],
 				adherence: entry.adherence ?? "",
+				fingerprint: entry.fingerprint ?? "",
+				anonymous: entry.anonymous === true,
 				warnings: entry.warnings ?? [],
 				...entry.code === void 0 ? {} : { code: entry.code }
 			};
@@ -63478,6 +64665,11 @@ const MODEL_SCHEMA = {
 			type: "string",
 			required: true
 		},
+		has: {
+			type: "array",
+			required: true,
+			items: { type: "string" }
+		},
 		pinned: {
 			type: "array",
 			required: true,
@@ -63553,6 +64745,7 @@ function projectModel(status, model) {
 		hidden: !entry.enabled,
 		pinMode: normalizePinMode(entry.pinMode),
 		sort: entry.sort,
+		has: entry.has,
 		pinned: entry.pinned,
 		excluded: entry.excluded,
 		upstreams: entry.upstreams,
@@ -63576,7 +64769,7 @@ function projectModel(status, model) {
 function registerClinePassTools(ctx, options) {
 	const { settings, accountPool, store, engine, status, serving } = options;
 	const disposers = [];
-	const pinOf = async (model) => (await settings.read()).pins[model] ?? defaultPin();
+	const pinOf = async (model) => (await settings.read()).pins[model] ?? defaultPin(model);
 	disposers.push(ctx.tools.register(defineTool({
 		name: "cline_pass_status",
 		description: "Report the Cline Pass provider state: route, accounts and whether each key is stored, account mode, model and pin counts. Read-only and free. Check this first when a Cline Pass model fails.",
@@ -63741,6 +64934,7 @@ function registerClinePassTools(ctx, options) {
 					const published = scan.catalog[id] ?? {};
 					merged.push({
 						id,
+						origin: "official",
 						...published.name === void 0 ? {} : { name: published.name },
 						...published.contextWindow === void 0 ? {} : { contextWindow: published.contextWindow },
 						...published.maxTokens === void 0 ? {} : { maxTokens: published.maxTokens },
@@ -63750,10 +64944,17 @@ function registerClinePassTools(ctx, options) {
 					});
 				}
 				await settings.storeCatalog(merged);
+				const gateway = await engine.gatewayCatalog().catch(() => ({
+					ids: [],
+					models: {}
+				}));
 				store.setCatalog({
-					ids: scan.models,
-					sources: scan.sources,
-					models: scan.catalog
+					ids: [.../* @__PURE__ */ new Set([...scan.models, ...gateway.ids])],
+					sources: [...scan.sources, ...gateway.ids.length > 0 ? ["gateway"] : []],
+					models: {
+						...gateway.models,
+						...scan.catalog
+					}
 				});
 			}
 			const current = await settings.read();
@@ -63779,7 +64980,7 @@ function registerClinePassTools(ctx, options) {
 			const catalog = store.catalog();
 			return {
 				models,
-				catalogCount: catalog.ids.length,
+				catalogCount: listedClinePassCatalogModels(await settings.read()).length,
 				catalogSources: catalog.sources,
 				catalogFetchedAt: Math.round(catalog.fetchedAt),
 				added
@@ -63995,6 +65196,11 @@ function registerClinePassTools(ctx, options) {
 				type: "array",
 				items: { type: "string" },
 				description: "Upstream channels to exclude for this call only."
+			},
+			has: {
+				type: "array",
+				items: { type: "string" },
+				description: "Vercel gateway capability filter for this call only."
 			}
 		},
 		timeoutMs: 6e5,
@@ -64035,6 +65241,11 @@ function registerClinePassTools(ctx, options) {
 						type: "string",
 						required: true
 					},
+					has: {
+						type: "array",
+						required: true,
+						items: { type: "string" }
+					},
 					warnings: {
 						type: "array",
 						required: true,
@@ -64062,6 +65273,7 @@ function registerClinePassTools(ctx, options) {
 			const result = await engine.test(model, {
 				upstreams: Array.isArray(args.upstreams) ? args.upstreams.map(String) : void 0,
 				exclude: Array.isArray(args.exclude) ? args.exclude.map(String) : void 0,
+				has: Array.isArray(args.has) ? args.has.map(String) : void 0,
 				signal: exec.signal
 			});
 			return {
@@ -64073,6 +65285,7 @@ function registerClinePassTools(ctx, options) {
 				pipeline: result.pipeline,
 				account: result.account,
 				adherence: result.adherence,
+				has: result.has,
 				warnings: result.warnings,
 				trace: result.trace.map((entry) => ({
 					upstream: entry.upstream,
@@ -64116,6 +65329,11 @@ function registerClinePassTools(ctx, options) {
 					"none"
 				],
 				description: "Reorder candidates by this metric; \"none\" clears it."
+			},
+			has: {
+				type: "array",
+				items: { type: "string" },
+				description: "Vercel gateway capability filter; omit to keep the stored value, or pass an empty array to clear it."
 			}
 		},
 		timeoutMs: 3e4,
@@ -64150,6 +65368,11 @@ function registerClinePassTools(ctx, options) {
 						type: "string",
 						required: true
 					},
+					has: {
+						type: "array",
+						required: true,
+						items: { type: "string" }
+					},
 					warnings: {
 						type: "array",
 						required: true,
@@ -64161,7 +65384,7 @@ function registerClinePassTools(ctx, options) {
 				`pinned ${value.model}`,
 				`upstreams: ${value.pinned.length === 0 ? "(auto)" : value.pinned.join(" > ")}`,
 				`exclude: ${value.excluded.length === 0 ? "(none)" : value.excluded.join(", ")}`,
-				`pinMode=${value.pinMode} sort=${value.sort === "" ? "none" : value.sort}`,
+				`pinMode=${value.pinMode} sort=${value.sort === "" ? "none" : value.sort} has=${value.has.length === 0 ? "(none)" : value.has.join(",")}`,
 				...value.warnings.map((warning) => `⚠ ${warning}`)
 			].join("\n"))
 		},
@@ -64172,7 +65395,8 @@ function registerClinePassTools(ctx, options) {
 				upstreams: Array.isArray(args.upstreams) ? args.upstreams.map(String) : current.upstreams,
 				exclude: Array.isArray(args.exclude) ? args.exclude.map(String) : current.exclude,
 				pinMode: args.pinMode !== void 0 ? args.pinMode === "preferred" ? "preferred" : "strict" : current.pinMode,
-				sort: args.sort === void 0 ? current.sort : args.sort === "none" ? "" : String(args.sort)
+				sort: args.sort === void 0 ? current.sort : args.sort === "none" ? "" : String(args.sort),
+				has: Array.isArray(args.has) ? args.has.map(String).map((name) => name.trim()).filter((name) => name !== "") : current.has
 			};
 			await settings.setPin(model, next);
 			const meta = store.metaOf(model);
@@ -64194,6 +65418,7 @@ function registerClinePassTools(ctx, options) {
 				excluded: next.exclude,
 				pinMode: normalizePinMode(next.pinMode),
 				sort: next.sort,
+				has: next.has,
 				warnings
 			};
 		}
@@ -64426,16 +65651,15 @@ function registerClinePassTools(ctx, options) {
 /** Every id the visibility toggle may act on, including shipped ones. */
 function currentModelsForVisibility(settings) {
 	const ids = new Set(DEFAULT_MODELS);
-	for (const model of settings.catalogModels) ids.add(model.id);
+	for (const model of listedClinePassCatalogModels(settings)) ids.add(model.id);
 	return [...ids];
 }
 //#endregion
 //#region src/host/cline-pass/line.ts
 /** Every id the line knows, before the visibility selection is applied. */
-function clinePassKnownModelIds(settings, catalogIds) {
+function clinePassKnownModelIds(settings, _catalogIds = []) {
 	const ids = new Set(DEFAULT_MODELS);
-	for (const model of settings.catalogModels) ids.add(model.id);
-	if (settings.exposeCatalog) for (const id of catalogIds) ids.add(id);
+	for (const model of listedClinePassCatalogModels(settings)) ids.add(model.id);
 	return [...ids];
 }
 /** Every id the line advertises right now. */
@@ -64459,7 +65683,7 @@ function createClinePassLine(ctx, options) {
 		accountPool,
 		store,
 		pinFor: (model) => ({
-			...modelSettings.status().pins[model] ?? defaultPin(),
+			...modelSettings.status().pins[model] ?? defaultPin(model),
 			spelling: modelSettings.status().pinSpelling
 		}),
 		baseURL: () => modelSettings.status().baseURL,
@@ -66458,13 +67682,44 @@ async function fetchQoderUserInfo(accessToken, region, options = {}) {
 	};
 }
 /**
-* POST {openapi}/api/v1/jobToken/exchange，体 \`{"personal_token":"<pt-...>"}\`。
+* 一次 PAT 兑换的失败，带 HTTP 状态（调用方据此分类「token 被拒」与「瞬时故障」）。
+*/
+var QoderPatExchangeError = class extends Error {
+	status;
+	/** 兑换打的是哪个区（区域猜错是这类 400 最常见的真因）。 */
+	region;
+	constructor(message, status, region) {
+		super(message);
+		this.name = "QoderPatExchangeError";
+		this.status = status;
+		this.region = region;
+	}
+};
+/**
+* 上游对这个状态的回答是否在说「这把 token 不认」。
+*
+* 四个区共用一套语义：400 BadRequest 是服务端读完了 `personal_token` 才发现它
+* 不被接受（缺字段、写错字段名、空体也是 400，但那种请求来自别的实现，不来自这里）；
+* 401/403 是鉴权拒绝；404 是这套部署上没有这个 token。
+*/
+function qoderPatRejectionStatus(status) {
+	return status === 400 || status === 401 || status === 403 || status === 404;
+}
+/**
+* POST {openapi}/api/v1/jobToken/exchange，体 \`{"personal_token":"<pt-...>","machine_id":…}\`。
 *
 * PAT 不能直接鉴权，必须先兑换（docs.qoder.com/cli/authentication + pi-provider pat.ts）。
-* 失败抛错（登录路径要如实告诉用户 PAT 被拒）。
+* 失败抛 {@link QoderPatExchangeError}（登录路径要如实告诉用户 PAT 被拒）。
+*
+* **`machine_id` 是官方 CLI 1.1.74 的请求体字段**（qodercli2api `docs/oauth.md` §3：
+* `getMachineIdentityRequestFields` 为 exchange/refresh 补上既有 machine_id，
+* 没有 UMID 时不补 machine_token，也不拿 machine_id 冒充它）。早先按 pi-provider
+* 只发 `personal_token` 的形状在实测里仍可能被服务端接受，但没有理由不发这个官方字段。
 */
 async function exchangeQoderJobToken(personalToken, region, options = {}) {
-	const response = await (options.fetchFn ?? fetch)(openapiBaseForRegion(region, options.env ?? process.env) + JOB_TOKEN_EXCHANGE_PATH, {
+	const fetchFn = options.fetchFn ?? fetch;
+	const env = options.env ?? process.env;
+	const response = await fetchFn(openapiBaseForRegion(region, env) + JOB_TOKEN_EXCHANGE_PATH, {
 		method: "POST",
 		headers: {
 			"content-type": "application/json",
@@ -66473,12 +67728,15 @@ async function exchangeQoderJobToken(personalToken, region, options = {}) {
 			"cosy-clienttype": "5",
 			"user-agent": USER_AGENT
 		},
-		body: JSON.stringify({ personal_token: personalToken }),
+		body: JSON.stringify({
+			personal_token: personalToken,
+			machine_id: resolveQoderMachineId(env)
+		}),
 		signal: timeoutSignal(options.signal, DISCOVERY_TIMEOUT_MS)
 	});
 	if (!response.ok) {
 		const detail = qoderErrorDetail(await response.text().catch(() => ""), 160);
-		throw new Error("Qoder（订阅） PAT 兑换失败（HTTP " + response.status + "）" + (detail === "" ? "" : "：" + detail));
+		throw new QoderPatExchangeError("Qoder（订阅） PAT 兑换失败（HTTP " + response.status + "）" + (detail === "" ? "" : "：" + detail), response.status, region);
 	}
 	const payload = await response.json().catch(() => void 0);
 	if (!isRecord$7(payload)) throw new Error("Qoder（订阅） PAT 兑换响应不是 JSON 对象");
@@ -67921,11 +69179,42 @@ async function qoderCredentialsFromDevicePoll(ready, machineId, options = {}) {
 * 兑换 + userinfo 补齐；**PAT 本体留在凭据里**（host-only），因为 PAT 的「刷新」
 * 就是拿它重新兑换一把 job token（pi-provider 把 PAT 编进 refresh 字段，
 * 本线路把它放进一个具名字段——同一件事，更好读）。
+*
+* ---------------------------------------------------------------------------
+* 自动补认区域
+* ---------------------------------------------------------------------------
+* 区域是**凭据的属性**，但 PAT 字符串本身不自述区域，而卡片上的区域选择器默认停在
+* 全球区。中国站的 PAT 拿去全球区端点兑换，上游回的是 400 `BadRequest`——没有
+* 任何一句说明「你打错了区」，用户看到的只有一串 requestId。这一步因此不是
+* 「多试一次」，而是**把选错区域的这个必然失败翻译成一次成功的登录**。
+*
+* 只在明确的 token 被拒状态下换区（{@link qoderPatRejectionStatus}）：HTTP 429、
+* 5xx、网络错误都不换——那些是瞬时故障，换区重发只会把一个可重试的问题变成两次
+* 打上游。首次命中的区域写进凭据，之后刷新照它走。
 */
 async function qoderCredentialsFromPat(personalToken, region, options = {}) {
 	const pat = personalToken.trim();
 	if (pat === "") throw new Error("Qoder（订阅） 的 PAT 是空的。");
-	const exchanged = await exchangeQoderJobToken(pat, region, options);
+	if (!pat.startsWith("pt-")) throw new Error("Qoder（订阅） 的 PAT 格式不对：它必须以 `pt-` 开头，粘贴时不要带引号或多余空白。令牌在 https://qoder.com/account/integrations（中国站是 https://qoder.com.cn/account/integrations）生成。");
+	const candidates = [region, ...QODER_REGIONS.filter((other) => other !== region)];
+	let resolved = region;
+	let exchanged = null;
+	let rejection = null;
+	for (const candidate of candidates) try {
+		exchanged = await exchangeQoderJobToken(pat, candidate, options);
+		resolved = candidate;
+		rejection = null;
+		break;
+	} catch (error) {
+		rejection = error;
+		if (!(error instanceof QoderPatExchangeError) || !qoderPatRejectionStatus(error.status)) throw error;
+	}
+	if (exchanged === null) {
+		const primary = rejection instanceof Error ? rejection.message : String(rejection);
+		const tried = candidates.length > 1 ? regionLabel(candidates[0]) + "与" + regionLabel(candidates[1]) + "两个区域都试过" : regionLabel(region) + "区域试过";
+		const status = rejection instanceof QoderPatExchangeError ? rejection.status : 400;
+		throw new QoderPatExchangeError("这把 PAT 被上游拒了（" + tried + "，都会在兑换时被拒）。最可能的原因是它已经被撤销或过期——请到 Integrations 页重新生成一个再粘贴。技术详情：" + primary, status, region);
+	}
 	let uid = null;
 	let email = null;
 	let name = null;
@@ -67933,7 +69222,7 @@ async function qoderCredentialsFromPat(personalToken, region, options = {}) {
 	let organizationTags = [];
 	let dataPolicyAgreed = false;
 	try {
-		const info = await fetchQoderUserInfo(exchanged.token, region, options);
+		const info = await fetchQoderUserInfo(exchanged.token, resolved, options);
 		uid = info.userID === "" ? null : info.userID;
 		email = info.email === "" ? null : info.email;
 		name = info.name === "" ? null : info.name;
@@ -67945,7 +69234,7 @@ async function qoderCredentialsFromPat(personalToken, region, options = {}) {
 		accessToken: exchanged.token,
 		refreshToken: exchanged.refreshToken,
 		expiresAt: exchanged.expiresAt,
-		region,
+		region: resolved,
 		origin: "pat",
 		uid,
 		email,
@@ -67957,6 +69246,10 @@ async function qoderCredentialsFromPat(personalToken, region, options = {}) {
 		authenticatedAt: Date.now()
 	};
 }
+/** 区域的短名（只用于拼给人看的一句话，卡片另有自己的文案）。 */
+function regionLabel(region) {
+	return REGION_HOSTS$1[region].title;
+}
 /**
 * 刷新一份凭据（号池 refresh 钩子的实现）。
 *
@@ -67968,6 +69261,11 @@ async function qoderCredentialsFromPat(personalToken, region, options = {}) {
 *
 * 失败带上 \`status\`（有 HTTP 状态时），号池据此分类「这个账号要重登」还是
 * 「瞬时故障，别判死」。
+*
+* PAT 分支走的是 {@link qoderCredentialsFromPat}，因此**也和首次登录一样会补认区域**：
+* 一份区域记错了的旧凭据，会在下一次刷新时自己搬到真正认它的那一区（区域本来就是
+* 凭据的属性，而 PAT 是唯一能问出它归属的原料）。这是修好「区域选错 → 永远 400」
+* 的第二半——只修首次登录的话，落盘里已有的错区账号会一直刷不上。
 */
 async function refreshQoderCredential(credentials, fetchFn = fetch) {
 	if (credentials.origin === "pat" && credentials.personalToken !== null) return {
@@ -68254,8 +69552,13 @@ function qoderPoolQuota(snapshot) {
 *
 * 401/403 → \`'expired'\`（上游明说这把 token 不行了，这个账号要重登）；
 * 其余（网络故障、5xx、形状变了）→ undefined：瞬时故障不该把一个账号判死。
+*
+* PAT 来源的刷新是「拿存下的 PAT 重兑换」，它的 400 同样是终局：上游读完了
+* `personal_token` 才拒绝（见 client.ts 的 {@link QoderPatExchangeError}），
+* 重试不会变好，只有重新生成 PAT 能救这个账号。
 */
 function qoderRefreshFailureStatus(error) {
+	if (error instanceof QoderPatExchangeError && qoderPatRejectionStatus(error.status)) return "expired";
 	const status = error?.status;
 	if (status === 401 || status === 403) return "expired";
 	const message = error instanceof Error ? error.message : "";
@@ -68729,7 +70032,13 @@ function patchFromBody(body) {
 	if (body.selectedAccountId !== void 0) patch.selectedAccountId = typeof body.selectedAccountId === "string" ? body.selectedAccountId : null;
 	return patch;
 }
-/** 请求体里的区域（认不出时回落全球区——它是唯一支持设备流的，选错时上游明确拒）。 */
+/**
+* 请求体里的区域。
+*
+* 认不出时回落全球区（它是唯一支持设备流的，且是卡片默认值），但**只对设备流成立**：
+* 设备流本来就只有全球区。PAT 粘贴的兜底不靠这一层——`qoderCredentialsFromPat`
+* 会把「区域猜错」这件事自己修好（见该函数的注释），所以这里不需要猜得更聪明。
+*/
 function regionFromBody(body) {
 	return isQoderRegion(body.region) ? body.region : "global";
 }
@@ -74325,9 +75634,7 @@ function effectiveAllowedRoutes(agent, preference, sessions, scope = "session")
 	return authorizedRoutesFor(agent, sessions) ?? (scope === "preference" ? preference?.allowedModels ?? [] : []);
 }
 /**
-* Append the Session's authorized `{ provider, model }` pairs to a successful
-* `list_subagent_models` result when the calling Session is governed by an
-* allowlist.
+* State a Session's routing posture in the `list_subagent_models` result.
 *
 * Calling `list_subagent_models({})` upstream returns only provider names
 * (`minimax-code — MiniMax Code`), and calling it with `provider` prints
@@ -74336,18 +75643,38 @@ function effectiveAllowedRoutes(agent, preference, sessions, scope = "session")
 * here lets even a single `list_subagent_models({})` call hand the model every
 * authorized route in the form `subagent` expects, eliminating any reason to
 * search local config files or source code for the allowlist.
+*
+* The empty case states the opposite fact rather than staying silent, because
+* silence is what makes a model infer that a mounted tool implies enforcement.
+* It does not: the tool row and the route parameters are static, while whether
+* anything is enforced is decided by the allowlist the Session recorded. The
+* two facts differ, so the model has to be able to read the second one instead
+* of deriving it from the first.
 * @param output - Original text returned by `list_subagent_models`.
-* @param allowed - Routes the calling Session authorizes.
-* @returns the output with the Session allowlist summary appended.
+* @param allowed - Routes the calling Session authorizes, empty when none is in force.
+* @returns the output with the Session routing posture appended.
 */
 function enrichListSubagentModelsOutput(output, allowed) {
-	if (allowed.length === 0) return output;
+	if (allowed.length === 0) {
+		if (output.includes("No allowlist is in force for this Session: subagent routing is unrestricted, no route is validated against any list, and omitting provider/model is legitimate rather than a rule breach. To govern routing per task, enable subagent model selection under \"Settings -> Subagents\" and start a new session; this one keeps its current posture.")) return output;
+		return output.trim().length === 0 ? UNRESTRICTED_ROUTING_NOTICE : `${output}\n\n${UNRESTRICTED_ROUTING_NOTICE}`;
+	}
 	const header = "Authorized child routes for this Session (already filtered by the Session allowlist; only these routes are accepted, and `provider` and `model` must be passed as separate fields):";
 	if (output.includes(header)) return output;
 	const suffix = `${header}\n${allowed.map((route) => `- ${route.provider}/${route.model} -> provider: "${route.provider}", model: "${route.model}"`).join("\n")}`;
 	return output.trim().length === 0 ? suffix : `${output}\n\n${suffix}`;
 }
 /**
+* The statement appended to `list_subagent_models` when no allowlist governs the
+* calling Session.
+*
+* It names the three consequences a reading model would otherwise have to guess
+* at: nothing is enforced, omitting the route is legitimate, and "authorized" is
+* not a word that can be used about any route here. It also names the one action
+* that changes the state, without asking the user to stop and do it.
+*/
+const UNRESTRICTED_ROUTING_NOTICE = "No allowlist is in force for this Session: subagent routing is unrestricted, no route is validated against any list, and omitting provider/model is legitimate rather than a rule breach. To govern routing per task, enable subagent model selection under \"Settings -> Subagents\" and start a new session; this one keeps its current posture.";
+/**
 * Rewrite the upstream `list_subagent_models` and `subagent` tool/parameter
 * descriptions when the calling Session enforces an allowlist.
 *
@@ -74548,7 +75875,6 @@ function installSubagentModelAuthorization(ctx, sessions, config = {}) {
 		const decision = await next();
 		if (exec.name !== "list_subagent_models" || result.isError === true || decision?.kind !== "accept") return decision;
 		const allowed = effectiveAllowedRoutes(exec.agent, subagentModelSelectionPreference(settings), sessions, scope);
-		if (allowed.length === 0) return decision;
 		const currentValue = decision.value !== void 0 ? decision.value : result.value;
 		if (typeof currentValue === "string") {
 			const enriched = enrichListSubagentModelsOutput(currentValue, allowed);
@@ -74719,15 +76045,25 @@ function candidatePackageRoots(entryScript = process.argv[1]) {
 	return [...roots];
 }
 /**
-* Whether a package is installed in any candidate node_modules tree.
-* Matches DSH agent-presets' own discovery check.
+* Whether a package or exported subpath is installed in any candidate node_modules tree.
+* A subpath needs its own exact `exports` key; the package root alone is not enough.
 */
 function packageInstalled(specifier, roots = candidatePackageRoots()) {
 	const pkg = specifier.split("/").slice(0, specifier.startsWith("@") ? 2 : 1).join("/");
+	const subpath = specifier.slice(pkg.length);
 	for (const root of roots) {
 		let dir = root;
 		for (;;) {
-			if (existsSync(join(dir, "node_modules", pkg, "package.json"))) return true;
+			const manifestPath = join(dir, "node_modules", pkg, "package.json");
+			if (existsSync(manifestPath)) {
+				if (subpath === "") return true;
+				try {
+					const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+					if (manifest.exports !== void 0 && Object.prototype.hasOwnProperty.call(manifest.exports, `.${subpath}`)) return true;
+				} catch {
+					continue;
+				}
+			}
 			const parent = dirname(dir);
 			if (parent === dir) break;
 			dir = parent;
@@ -75082,6 +76418,12 @@ function installBundledPresets(host, install) {
 */
 /** The row package whose presence marks a harness that takes presets from a row. */
 const PRESET_REGISTRY_PACKAGE = "@deepseek-ai/dsh-agent-preset";
+/**
+* The package whose presence marks a harness (>= 0.2.1) that injects the
+* session working directory via `WORKING_DIRECTORY` user context and no longer
+* registers `{{cwd}}` as a `systemPrompt` variable.
+*/
+const WORKING_DIRECTORY_PACKAGE = "@deepseek-ai/dsh-working-directory";
 /** The id the `dispatch` preset is selectable under. */
 const DISPATCH_PRESET_ID = "dispatch";
 /**
@@ -75129,7 +76471,7 @@ Criterion: whether spawn_teammate and wait_agent exist (in PTC mode: tools.spawn
 ## R0 · Complexity Triage (Triage First, Then Choose the Workflow)
 Upon receiving a task, determine its tier first, write one line stating "Tier + Rationale", and then decide which phases to run.
 - L0 Simple / Single-point: single-file or single-point edit; unambiguous requirements; reversible change; no parallelism value; you already hold all required context. -> Do not spawn subagents or run an interview; execute directly and report.
-- L1 Moderate: 2–5 files; requirements mostly clear with 1–2 open points; decomposable but with limited parallelism gain. -> Ask at most 1–2 key questions (no full interview) -> brief plan -> execute yourself or dispatch 1 subagent.
+- L1 Moderate: edits at most 5 files (5 is a cap, not a range and not a target); requirements mostly clear with at most 2 open points; decomposable but with limited parallelism gain. -> Ask at most 2 key questions (no full interview; 2 is the cap) -> brief plan -> execute yourself or dispatch 1 subagent.
 - L2 Complex / Multi-step: cross-module or multi-deliverable; ambiguity or hidden assumptions; requires exploring unknowns; independent subtasks suitable for parallel execution. -> Must run the full workflow: Clarification Interview -> Full Plan -> Parallel Subagents -> Layered Acceptance.
 When in doubt, clarify before escalating; if a task turns out more complex than expected, stop, re-triage, and inform the user. Never open an interview or multi-agent orchestration for L0/L1 tasks.
 
@@ -75146,21 +76488,25 @@ For L2 tasks, never execute work yourself outside these six categories: (1) Plan
 For L0/L1 tasks, execute directly—do not spawn subagents just to look like you are orchestrating.
 
 ## R2 · Model Routing (Check Availability First, Then Decide How to Dispatch)
-Before dispatching, check whether subagent model selection is enabled in this session: check whether list_subagent_models exists (in PTC mode: whether tools.list_subagent_models is available). Its presence and the exposure of provider / model / reasoning_effort on subagent are controlled by the same setting and always appear or disappear together, so this single signal is sufficient.
+Before dispatching, check whether subagent model selection is enabled in this session: check whether list_subagent_models exists (in PTC mode: whether tools.list_subagent_models is available). Its presence tells you the tool is mounted, and nothing more: the tool row and the provider / model / reasoning_effort parameters are mounted statically, so they are present even in a session that authorized no route at all. Whether the route guard enforces anything is decided by the allowlist this session recorded, which is a separate fact. Read that fact instead of inferring it: the tool's output appends the session's authorized routes, and appends an explicit statement when no allowlist is in force. Then dispatch in one of three states.
 
-[When Available] Dispatch with explicit routing—this is the default operating mode.
+[State: Listed] The output ends with "Authorized child routes for this Session" and lists at least one route—enforcement is active. Dispatch with explicit routing; this is the default operating mode.
 - The sole source of truth for the allowlist is list_subagent_models: before your first dispatch, call list_subagent_models({}) to list authorized providers (its output also appends the full breakdown of every authorized provider/model pair for this session); if you need per-model capabilities or reasoning effort levels under a provider, call list_subagent_models({ provider }) to list authorized models under that provider (or pass { provider, model }). DSH already filters this tool's output at runtime against the session's Subagents settings—what it returns IS the complete authorized allowlist, and the route guard validates against the exact same session snapshot, so trust its output directly without cross-checking local config files or workspace code.
 - list_subagent_models({ provider }) formats entries as <provider>/<model> — <Name>; on every dispatch, pass the split provider and model fields explicitly (model without the <provider>/ prefix, plus reasoning_effort when needed), and the route must be in the allowlist returned by the tool.
 - Before every dispatch, write out the routing decision line: route: <provider>/<model> (+ reasoning_effort when applicable). Do not dispatch without writing this line first. The runtime route guard (enabled by default, covering tools.subagent(...) inside run_code in PTC mode as well) hard-rejects omitting provider/model, passing only one of them, or picking a route outside the allowlist before the child starts—never omit parameters or use trial-and-error to discover routes.
 - If a tool's generic upstream DSH description calls model selection "optional" or states "Catalog membership is advisory", this rule takes precedence: the runtime output is already filtered to this session's allowlist and needs no cross-checking elsewhere.
 
-[When Unavailable] Do not error, complain, or ask the user to change settings—continue with DSH's default behavior.
-- Here subagent does not expose provider/model/reasoning_effort, the route guard is inactive, and subagents silently inherit your route. This is a legitimate degraded path in this mode, not a violation.
+[State: Unlisted] The tool is present but its output states no allowlist is in force—the guard authorizes every route and enforces nothing. This is the second legitimate state of this mode, not a violation, and not the same thing as "model selection is off".
+- Dispatch per R3–R6 as usual. Passing provider/model is still legal and still needed for the child to differ from your route; omitting it is a genuine choice rather than a rule breach, because nothing is being enforced.
+- Say it once, in one sentence, in your delivery summary: subagent routing is unrestricted in this session because no allowlist was recorded. Only if the task clearly wants per-task routing (mechanical refactoring vs. deep reasoning) should you also point the user at "Settings -> Subagents" plus a new session—do not stop and wait.
+- Never claim per-task routing is in force here, and never report a route as "authorized" when the session recorded no allowlist—there was nothing to authorize it against.
+
+[State: Unmounted] list_subagent_models does not exist and subagent exposes no provider/model/reasoning_effort at all—the guard is inactive and subagents silently inherit your route. Do not error, complain, or ask the user to change settings; continue with DSH's default behavior.
 - Dispatch and verify per R3–R6 as usual, simply omitting the route: line.
 - Only exception worth a brief note: if a task is clearly better suited for a different model (e.g., mechanical refactoring vs. deep reasoning), you may mention in one sentence that the user can enable subagent model selection under "Settings -> Subagents" and start a new session, while continuing to complete the current task with default routing—do not stop and wait. That setting only affects newly created sessions.
 
 subagent_fork deliberately shares the parent agent's route (reusing conversation history and KV cache); use it only for reviews that require the coordinator's context, never as a shortcut around explicit routing.
-It has no provider/model parameters, so the explicit-route rule under [When Available] does not apply to it; however, the guard still validates the route it inherits: if your current model is not in the allowlist, subagent_fork will be hard-rejected—switch to subagent with an explicit allowed route, or switch this session to an allowed model so subagent_fork becomes available again.
+It has no provider/model parameters, so the explicit-route rule under [State: Listed] does not apply to it; however, the guard still validates the route it inherits: if your current model is not in the allowlist, subagent_fork will be hard-rejected—switch to subagent with an explicit allowed route, or switch this session to an allowed model so subagent_fork becomes available again.
 Choose models based on task nature and model capability; keep model selection consistent across tasks of the same kind within a batch.
 
 ## R3 · Subagent Autonomy
@@ -75170,21 +76516,26 @@ A subagent has full authority to plan, execute, and self-verify within its assig
 Subagents run with DSH's default subagent role and environment; do not inject custom personas. Model selection authority belongs solely to the Dispatch Agent: when multiple models are in the allowlist, you assign the model per task nature—never let a subagent choose its own model.
 
 ## R5 · Dispatch Discipline
-Every task brief must contain five elements: Goal / Boundary (which files or modules may be touched) / Constraints / Acceptance Criteria / Required Evidence to Report.
+Every task brief must contain six elements: Goal / Boundary (which files or modules may be touched) / Constraints / Limits (see below) / Acceptance Criteria / Required Evidence to Report.
+- [Limits] One line per numeric or quantitative limit, each spelling out four things: **what it bounds, in what unit, the cap, and whether it accumulates**. A subagent is a fresh instance of the same model and reads your brief exactly the way an ambiguous rule gets read—taking the strictest available meaning and not checking—so a loose limit is spent twice: once when you write it, once when the child under-delivers against it. Write "at most 3 attempts", not "a few attempts"; write "edits at most 5 files", not "2–5 files". Where a dimension is genuinely unbounded, say so explicitly ("test runs: unlimited"); silence is read as a limit of zero. Cover at minimum: attempts/retries, files edited, commands run, and any per-cycle quota with its reset rule (a quota that resets per cycle is lost, not banked—say that).
+- Do not ask the child to restate your rules back as a correctness check: restating an ambiguous rule reproduces the misreading rather than catching it. If a limit is genuinely unclear, the child should spend one minimal tool call to verify it; write that escaping instruction into the brief when the ambiguity is unavoidable.
 Issue mutually independent dispatches in parallel within the same message rather than waiting serially. A subagent's report is evidence, not a final verdict.
 Precondition: never dispatch implementation subagents before the clarification interview has converged.
 In PTC mode, dispatch via tools.subagent(...) inside run_code, running independent dispatches concurrently with Promise.all / asyncio.gather; parameters match the native tool.
 
 ## R6 · Review & Acceptance
 Two layers: subagent self-check -> your independent review. Acceptance must be grounded in concrete evidence (reading key diffs, running tests, checking each acceptance criterion).
+The completion notification is a post-hoc signal: it says the child stopped, not that the work is correct—and it arrives after the work is already done. Your pre-hoc control is the acceptance criteria you wrote into the brief under R5, not the notification and not the child's self-report.
 If work fails review, re-dispatch with specific evidence—do not step in to fix the code yourself, and never declare completion based solely on a subagent's self-report.
-Re-dispatch the same task brief at most twice; only if it still fails after two re-dispatches, or if re-dispatch is hard-rejected (tool unavailable or repeated errors), transition to R8 Fallback and state which condition triggered it.
+Re-dispatch budget, counted per task brief: 1 first attempt + at most 2 re-dispatches = at most 3 runs total. Only if it still fails after the third run, or if re-dispatch is hard-rejected (tool unavailable or repeated errors), transition to R8 Fallback and state which condition triggered it. Count runs, not failures; the number belongs in the task list item for that brief (R7), not in your memory.
+[Noticed but not handled] Every review that finds a defect must end one of two ways: the defect goes back out on a re-dispatch with evidence, or it goes to the user through ask_user_question as a scoping decision (R-W). Writing it into the delivery summary and shipping anyway is not an available outcome—a risk you named but never routed is exactly the failure this rule exists to stop. When the final delivery summary is written, it carries the list of risks you noticed and routed, each with what you did about it; an empty list means you found none, which is a claim in its own right.
 
 ## R-W · Turn Boundary (Waiting / Goals / Questions)
 
 All three rules govern the boundary of a turn: after dispatching, before continuing, and before stopping.
 
 [Waiting for Subagents] By default, end your turn without calling any more tools and let the subagent completion notification wake you—notifications are built-in; do not manufacture your own wait.
+- The notification is a post-hoc signal. It tells you a child stopped running; it does not tell you the work is correct, and nothing about it arrives before the work is done. Treat it as "there is now something to review", never as "this passed". The pre-hoc control is the acceptance criteria in the brief (R5); the review itself is R6.
 - Never run sleep, polling loops, watch, or any long-running placeholder command just to "hang around": they burn context and budget for zero information.
 - If you have independent coordinator work in hand (the six categories in R1, reviewing another subagent's output, reading evidence you need), do it first and then end your turn.
 - Only when you are genuinely blocked and must collect a result immediately should you call job_output({ wait: true }) for a bounded wait; that is a collection tool, not a timer.
@@ -75200,11 +76551,12 @@ All three rules govern the boundary of a turn: after dispatching, before continu
 - Only two exceptions: plan-mode approval still goes through exit_plan_mode (which has its own channel); and when the task is finished and only the delivery summary remains, do not ask a question.
 
 ## R7 · Documentation
-Maintain the task list (in todo_write, not create_goal; see R-W), decision log, and interview conclusions (which decisions are settled and why). Subagents never report directly to the user.
+Maintain the task list (in todo_write, not create_goal; see R-W), decision log, and interview conclusions (which decisions are settled and why). Each task item carries its own run count (R6), so the re-dispatch budget is read rather than remembered. Subagents never report directly to the user.
+[Before every turn] Scan the task list for items that will escalate, expire, or time out if you do nothing this turn, and handle those before the items that are merely large. Concretely, in this mode: a result that came back and has not been reviewed; an acceptance that failed with the rework scope still undecided; a question the user has not answered and that blocks a dispatch; a brief sitting at its run count. An item that has waited is not the same as an item that is fine—a low-priority backlog is what eventually turns into the incident, so every item still open at the end of a turn is listed with its age in turns, and any item older than the brief's own limit is handled or escalated instead of carried forward once more.
 
 ## R8 · Fallback
 Fallback is a task-scoped, non-session-wide exception: it covers only the single task that triggered it and never alters the default operating mode for subsequent tasks in this session.
-You may execute a task yourself only when at least one of the following holds, and you must state which condition triggered it and the supporting evidence: L0/L1 task; subagent tools unavailable; allowlist is empty and the user has not enabled it; task is non-delegable (pure Q&A, tiny single-point edit, or an operation that must share your immediate context); or the same task brief still fails after two re-dispatches under R6.
+You may execute a task yourself only when at least one of the following holds, and you must state which condition triggered it and the supporting evidence: L0/L1 task; subagent tools not mounted at all (R2 [State: Unmounted]); task is non-delegable (pure Q&A, tiny single-point edit, or an operation that must share your immediate context); or the same task brief has still not passed review after its third run under R6. An unmounted tool is the only routing condition that permits fallback: an empty, unlisted allowlist (R2 [State: Unlisted]) is not one, because delegation still works there—it is simply unrestricted.
 Fix the trigger condition on hard rejections instead of treating them as fallback grounds: on active child limit -> wait for existing children to settle and re-dispatch; on subagent model selection -> specify an explicit provider/model from the authorized routes listed in the error; on route-inheritance rejection -> switch to an explicit-route subagent tool or switch this session to an allowed model. Unless the condition is fixed, the same rejection will recur.
 Reset: fallback applies only to the current task. When the next task begins, always return to R0 to triage anew; as long as L2 holds and the trigger condition above no longer applies, resume dispatching subagents—never carry over or pre-assume fallback because a previous task fell back.
 
@@ -75212,7 +76564,7 @@ Reset: fallback applies only to the current task. When the next task begins, alw
 1. Opening an interview or multi-agent orchestration for an L0/L1 task—pure waste.
 2. Planning, dispatching, or coding before ambiguous requirements are clarified—baking uncertainty into rework.
 3. Running long execution tasks on the coordinator model that should have been delegated.
-4. Omitting provider/model when model selection is available, relying on the guard to catch it or letting it silently inherit the coordinator's route (inheritance when model selection is unavailable is not a violation).
+4. Omitting provider/model while [State: Listed] holds, relying on the guard to catch it or letting it silently inherit the coordinator's route (omitting it under [State: Unlisted] or [State: Unmounted] is a genuine choice, not a violation).
 5. Directly editing a module assigned to a subagent.
 6. Declaring completion as soon as a subagent reports back, without independent acceptance verification.
 7. Mixing multiple models across tasks of the same kind within the same batch.
@@ -75225,6 +76577,10 @@ Reset: fallback applies only to the current task. When the next task begins, alw
 14. Proactively creating a goal at the start of a task—goal auto-continuation wakes you mid-wait (R-W).
 15. Ending with a paragraph of prose to wait for user sign-off instead of calling ask_user_question (R-W).
 16. Second-guessing list_subagent_models output by hunting through local config or source files just to check which subagent models are allowed—list_subagent_models already returns the session's runtime allowlist (R2).
+17. Shipping a defect you already named in the review, on the grounds that it is recorded in the summary—unrouted risk is not handled risk (R6).
+18. Writing a task brief with a range where a cap belongs ("2–5 files", "1–2 questions", "a few attempts")—the strictest reading wins and the budget shrinks to its lower bound (R0, R5).
+19. Asking a subagent to restate its rules as a correctness check instead of verifying the ambiguous ones with one tool call—restatement reproduces the misreading (R5).
+20. Reporting a route as "authorized", or claiming per-task routing is in force, when the session recorded no allowlist (R2 [State: Unlisted]).
 `
 			}
 		},
@@ -75431,15 +76787,26 @@ Reset: fallback applies only to the current task. When the next task begins, alw
 * `unknown prompt variable "{{cwd}}"` at render time. On 0.1.7–0.2.0 that package
 * is absent and `{{cwd}}` is still the only way the persona states the workspace,
 * so the unmodified {@link DISPATCH_PRESET} is returned unchanged.
+*
+* Newer harnesses also register `list_agents` from the main subagent-control entry
+* and remove its standalone `./list-agents` export. That row is omitted only when
+* the export is absent; older harnesses keep it because their main entry does not
+* register the tool.
 * @param resolves - whether a bare specifier resolves in this installation.
 * @returns the preset definition for the running harness generation.
 */
 function resolveDispatchPreset(resolves = resolvesFromHere) {
-	if (!resolves("@deepseek-ai/dsh-working-directory")) return DISPATCH_PRESET;
+	const hasWorkingDirectory = resolves(WORKING_DIRECTORY_PACKAGE);
+	const hasLegacyListAgents = resolves("@deepseek-ai/dsh-tool-subagent-control/list-agents");
+	if (!hasWorkingDirectory && hasLegacyListAgents) return DISPATCH_PRESET;
 	return {
 		...DISPATCH_PRESET,
 		plugins: DISPATCH_PRESET.plugins.map((row) => {
-			if (row.id !== "persona" || typeof row.config !== "object" || row.config === null) return row;
+			if (row.id === "delegation" && !hasLegacyListAgents && Array.isArray(row.config)) return {
+				...row,
+				config: row.config.filter((nested) => nested.id !== "tool-subagent-list-agents")
+			};
+			if (row.id !== "persona" || !hasWorkingDirectory || typeof row.config !== "object" || row.config === null) return row;
 			const { suffix: _omitted, ...rest } = row.config;
 			return {
 				...row,
@@ -77841,6 +79208,7 @@ const Config = z.object({
 	reasoningCollapseGuard: z.union([z.object({}), z.const(false)]).default(false),
 	noAnswerResume: z.union([z.object({}), z.const(false)]).default({}),
 	codexStreamIdleTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS).step(1).default(DEFAULT_STREAM_IDLE_TIMEOUT_MS$2),
+	poolStorage: z.union([z.const("keyring"), z.const("credentials")]).default("keyring").description("号池存储后端：keyring（默认，桌面平台的系统密钥环）或 credentials（DSH 凭据库，服务器推荐）。"),
 	progressUpdates: z.boolean().default(true).volatile().description("启用进展更新：允许 agent 用 progress_update 工具主动汇报多步任务的进展，并在侧栏展示。"),
 	progressUpdatesNudgeThreshold: z.number().step(1).min(1).max(50).default(8).volatile().description("催促阈值：连续这么多轮带工具调用却没有进展更新时，提醒 agent 发一条进展。"),
 	progressUpdatesLanguage: z.union([
@@ -77859,6 +79227,14 @@ const inject = [
 ];
 function apply(ctx, pluginConfig = {}) {
 	const fetchConfiguration = resolveFetchConfiguration(pluginConfig);
+	const poolStorageSettings = new PoolStorageSettings();
+	poolStorageSettings.hydrate().catch(() => void 0);
+	configurePoolStorage({
+		mode: () => poolStorageSettings.effective(pluginConfig.poolStorage),
+		ready: () => poolStorageSettings.hydrate().catch(() => void 0),
+		credentials: () => asCredentialsSeam(ctx.get("credentials")),
+		logger: ctx.logger
+	});
 	if (pluginConfig.syncAgentPresets !== false) ctx.effect(() => installBundledPresets(ctx, installDispatchPreset(ctx)), "dsh-chatgpt-subscription: agent preset sync");
 	const store = createPlatformTokenStore();
 	const preferences = registerPreferenceStore(ctx.settings);
@@ -78230,7 +79606,7 @@ function apply(ctx, pluginConfig = {}) {
 				}))
 			});
 		};
-		const disposeRoutes = registerRoutes(ctx, oauth, usage, preferences, proxyManager, searchSwitcher, readRouteAudit, codexAccountPool, fetchConfiguration);
+		const disposeRoutes = registerRoutes(ctx, oauth, usage, preferences, proxyManager, searchSwitcher, readRouteAudit, codexAccountPool, fetchConfiguration, { storage: poolStorageSettings });
 		const routable = (accounts) => accounts.some((account) => account.authStatus === void 0 || account.authStatus === "ok");
 		const disposeHubOverview = registerHubOverviewRoutes(ctx, [
 			{