@eddyskywalker/dsh-chatgpt-subscription 0.48.4 → 0.49.0

package/lib/index.js

@@ -145,7 +145,7 @@ const ROUTE_PREFIX$5 = "/api/dsh-chatgpt-subscription";
 * `test/responses-client.test.ts` asserts the two agree, so a release that
 * forgets this constant fails the suite instead of shipping quietly.
 */
-const PLUGIN_VERSION = "0.48.4";
+const PLUGIN_VERSION = "0.49.0";
 const CODEX_CHATGPT_PROVIDER_ID = "codex-chatgpt";
 const CODEX_API_BASE = "https://chatgpt.com/backend-api/codex";
 const CODEX_RESPONSES_URL = `${CODEX_API_BASE}/responses`;
@@ -859,7 +859,7 @@ async function rehydrateSnapshot(key) {
 * so a backend that flattens the envelope does not read as an empty catalog.
 */
 function parseListing(payload) {
-	const record = asRecord$19(payload);
+	const record = asRecord$20(payload);
 	const models = Array.isArray(payload) ? payload : record?.models;
 	if (!Array.isArray(models)) return [];
 	return models.flatMap((item) => parseListingEntry$1(item));
@@ -873,7 +873,7 @@ function parseListing(payload) {
 * back to a conservative answer rather than to a guess.
 */
 function parseListingEntry$1(value) {
-	const record = asRecord$19(value);
+	const record = asRecord$20(value);
 	if (record === void 0) return [];
 	const id = asString$27(record.slug) ?? asString$27(record.id);
 	if (id === void 0) return [];
@@ -909,7 +909,7 @@ function parseEfforts(value) {
 	if (!Array.isArray(value)) return null;
 	const out = [];
 	for (const item of value) {
-		const effort = asString$27(item) ?? asString$27(asRecord$19(item)?.effort);
+		const effort = asString$27(item) ?? asString$27(asRecord$20(item)?.effort);
 		if (effort !== void 0 && !out.includes(effort)) out.push(effort);
 	}
 	return out.length > 0 ? out : null;
@@ -924,7 +924,7 @@ function parseEfforts(value) {
 function accountKeyFor$1(credentials) {
 	return credentials.accountId || "default";
 }
-function asRecord$19(value) {
+function asRecord$20(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
 function asString$27(value) {
@@ -10812,7 +10812,9 @@ const DEFAULT_PREFERENCES = {
 	contextWindowOverrides: {},
 	proxyMode: "auto",
 	customProxyUrl: null,
-	compactionRoute: null
+	compactionRoute: null,
+	subagentDefaultModels: [],
+	subagentModelsByMainModel: {}
 };
 const SEARCH_PROVIDER_CODEX = "codex";
 function isSearchProviderPreference(value) {
@@ -10827,6 +10829,105 @@ function isCodexReasoningSummary(value) {
 function isProxyMode(value) {
 	return value === "auto" || value === "custom" || value === "direct";
 }
+function asRecord$19(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+/**
+* Read one non-empty trimmed string field.
+* @param value - Candidate field value from stored JSON.
+* @returns the trimmed string, or undefined when it is not a non-empty string.
+*/
+function trimmedString(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	return trimmed.length === 0 ? void 0 : trimmed;
+}
+/**
+* Whether one value is a complete `{ provider, model }` route.
+*
+* Both halves are trimmed and must be non-empty: a route with a blank provider
+* names no adapter, and a blank model names no model, so neither can ever be
+* authorized. Stored documents are untrusted JSON, which is why this narrows
+* rather than asserts.
+* @param value - Candidate route.
+* @returns whether the value is a usable route.
+*/
+function isSubagentModelRoute(value) {
+	const record = asRecord$19(value);
+	if (record === void 0) return false;
+	return trimmedString(record["provider"]) !== void 0 && trimmedString(record["model"]) !== void 0;
+}
+/**
+* Normalize one route list, deduplicating it without reordering.
+*
+* Order is preserved because it is the order the settings card shows and the
+* order `list_subagent_models` prints: a set would silently reshuffle the list
+* a user arranged.
+* @param value - Candidate route list from stored JSON.
+* @returns the trimmed, deduplicated routes, or null when the value is not an
+*   array of well-formed routes.
+*/
+function normalizeSubagentModelRoutes(value) {
+	if (!Array.isArray(value)) return null;
+	const routes = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of value) {
+		if (!isSubagentModelRoute(entry)) return null;
+		const provider = entry.provider.trim();
+		const model = entry.model.trim();
+		const key = `${provider}/${model}`;
+		if (seen.has(key)) continue;
+		seen.add(key);
+		routes.push({
+			provider,
+			model
+		});
+	}
+	return routes;
+}
+/**
+* Whether one key names a main agent route as `provider/model`.
+*
+* The split is at the FIRST slash, so a model id that legally contains a slash
+* (`command-code` + `deepseek/deepseek-v4.1-flash`) still round-trips: the
+* provider half ends at the first separator and the model half keeps the rest.
+* @param key - Candidate map key.
+* @returns whether the key carries a non-empty provider and a non-empty model.
+*/
+function isValidMainModelKey(key) {
+	if (typeof key !== "string") return false;
+	const trimmed = key.trim();
+	const separator = trimmed.indexOf("/");
+	if (separator <= 0) return false;
+	return trimmed.slice(separator + 1).length > 0;
+}
+/**
+* Merge one `subagentModelsByMainModel` patch into the stored map.
+*
+* A merge rather than a replace, so the card can clear or set one main model
+* without resending every other entry — and `null` (or `[]`) is how one entry
+* is cleared, since a stored map has no other way to say "no override".
+* @param current - Map already stored in the preferences document.
+* @param patch - Incoming patch from a settings card or a route body.
+* @returns the merged map, or null when any key or value is malformed.
+*/
+function mergeSubagentModelsByMainModel(current, patch) {
+	const patchRecord = asRecord$19(patch);
+	if (patchRecord === void 0) return null;
+	const merged = { ...current };
+	for (const [rawKey, rawRoutes] of Object.entries(patchRecord)) {
+		const key = rawKey.trim();
+		if (!isValidMainModelKey(key)) return null;
+		if (rawRoutes === null || Array.isArray(rawRoutes) && rawRoutes.length === 0) {
+			delete merged[key];
+			continue;
+		}
+		const routes = normalizeSubagentModelRoutes(rawRoutes);
+		if (routes === null) return null;
+		merged[key] = routes;
+	}
+	return merged;
+}
 //#endregion
 //#region src/host/common/legacy-preferences.ts
 /**
@@ -10993,6 +11094,10 @@ function sectionOf(document, id) {
 */
 function registerPreferenceStore(settings) {
 	const contextWindowOverrides = z.object(Object.fromEntries(CODEX_MODEL_CATALOG.map((entry) => [entry.id, z.number().step(1).min(1).max(contextWindowLimitForModel(entry.id))]))).default({});
+	const subagentModelRoutes = z.array(z.object({
+		provider: z.string(),
+		model: z.string()
+	}));
 	const schema = z.object({
 		enabled: z.boolean().default(DEFAULT_PREFERENCES.enabled ?? true),
 		quickQuotaVisible: z.boolean().default(DEFAULT_PREFERENCES.quickQuotaVisible),
@@ -11022,7 +11127,9 @@ function registerPreferenceStore(settings) {
 		compactionRoute: z.union([z.object({
 			provider: z.string(),
 			model: z.string()
-		}), z.const(null)]).default(DEFAULT_PREFERENCES.compactionRoute ?? null)
+		}), z.const(null)]).default(DEFAULT_PREFERENCES.compactionRoute ?? null),
+		subagentDefaultModels: subagentModelRoutes.default([]),
+		subagentModelsByMainModel: z.dict(subagentModelRoutes).default({})
 	});
 	if (!hasRegister(settings)) {
 		const fileStore = new FilePreferencesStore(schema, preferencesPath(), readLegacyPreferences);
@@ -11080,6 +11187,16 @@ var SettingsPreferenceStore = class {
 				model: patch.compactionRoute.model.trim()
 			};
 		}
+		if (patch.subagentDefaultModels !== void 0) {
+			const routes = normalizeSubagentModelRoutes(patch.subagentDefaultModels);
+			if (routes === null) throw new PreferenceError("Unsupported subagentDefaultModels preference.");
+			normalized.subagentDefaultModels = routes;
+		}
+		if (patch.subagentModelsByMainModel !== void 0) {
+			const merged = mergeSubagentModelsByMainModel(this.scope.get().subagentModelsByMainModel, patch.subagentModelsByMainModel);
+			if (merged === null) throw new PreferenceError("Unsupported subagentModelsByMainModel preference.");
+			normalized.subagentModelsByMainModel = merged;
+		}
 		if (patch.customProxyUrl !== void 0) if (patch.customProxyUrl !== null) {
 			const trimmed = patch.customProxyUrl.trim();
 			if (trimmed.length > 0 && !/^https?:\/\//i.test(trimmed) && !/^socks5?:\/\//i.test(trimmed)) normalized.customProxyUrl = `http://${trimmed}`;
@@ -14006,6 +14123,15 @@ function readPreferencesUpdate(value, current) {
 			model: value.compactionRoute.model.trim()
 		};
 	}
+	if ("subagentDefaultModels" in value) {
+		const routes = normalizeSubagentModelRoutes(value.subagentDefaultModels);
+		if (routes === null) throw new PreferenceError("subagentDefaultModels must be an array of { provider, model } routes.");
+		patch.subagentDefaultModels = routes;
+	}
+	if ("subagentModelsByMainModel" in value) {
+		if (mergeSubagentModelsByMainModel(current.subagentModelsByMainModel, value.subagentModelsByMainModel) === null) throw new PreferenceError("subagentModelsByMainModel must map \"provider/model\" keys to arrays of { provider, model } routes, or null to clear one.");
+		patch.subagentModelsByMainModel = value.subagentModelsByMainModel;
+	}
 	if ("contextWindowOverrides" in value) {
 		if (!isRecord$55(value.contextWindowOverrides)) throw new PreferenceError("contextWindowOverrides must be an object.");
 		const overrides = {};
@@ -26611,6 +26737,17 @@ async function projectToolResult(input) {
 }
 //#endregion
 //#region src/host/common/request-images.ts
+/**
+* Image resolution, byte budgeting and data-URL handling for one request.
+*
+* Shared by the provider lines that send inline images, because the budget is a
+* property of the deployment rather than of any one endpoint, and because two
+* lines that budget differently send different request bytes for the same picture.
+*
+* The notable decision is SCALE, not drop: see {@link resolveRequestImages}.
+*
+* @module dsh-chatgpt-subscription/request-images
+*/
 function isRecord$50(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -26708,7 +26845,7 @@ function base64Length$1(bytes) {
 * the only estimate available, so it stays the fallback and every call site that
 * has no resolved map behaves exactly as before.
 */
-function requestImagePayloadLength(block, images) {
+function inlinePayloadOf(block) {
 	let data = asString$21(block.data) || asString$21(block.base64);
 	const source = isRecord$50(block.source) ? block.source : void 0;
 	if (!data && source) data = asString$21(source.data) || asString$21(source.base64);
@@ -26716,7 +26853,11 @@ function requestImagePayloadLength(block, images) {
 		const matched = data.match(/^data:([^;,]+);base64,(.*)$/s);
 		if (matched) data = matched[2] ?? "";
 	}
-	if (data) return data.length;
+	return data === void 0 || data === "" ? void 0 : data;
+}
+function requestImagePayloadLength(block, images) {
+	const data = inlinePayloadOf(block);
+	if (data !== void 0) return data.length;
 	const attachment = attachmentOf$3(block);
 	if (!attachment) return void 0;
 	if (images === void 0) return base64Length$1(attachment.bytes);
@@ -26901,6 +27042,186 @@ function offloadOldestRequestImages$1(options, maxBytes = MAX_REQUEST_IMAGE_BYTE
 	return replaceOldestRequestImages(options, imagesToOffloadCount(requestImagePayloadLengths(options, images), maxBytes), images);
 }
 /**
+* A stable identity for one image occurrence.
+*
+* Two occurrences of the SAME picture have to share one identity, and that
+* identity has to survive the turn: a durable attachment keeps its id, and an
+* inline payload keeps its bytes, so hashing the payload names the same
+* picture the same way on every later request.
+*
+* `undefined` for a block that carries no sendable payload: an image that
+* resolved to `unavailable` is serialized as a short text placeholder, so it
+* is not an image on the wire and has nothing to remember.
+*/
+function requestImageKey(block, images) {
+	if (requestImagePayloadLength(block, images) === void 0) return void 0;
+	const attachment = attachmentOf$3(block);
+	if (attachment !== void 0) return `attachment:${attachment.attachmentId}`;
+	const data = inlinePayloadOf(block);
+	if (data === void 0) return void 0;
+	return `inline:${createHash("sha256").update(data).digest("hex")}`;
+}
+/**
+* Every sendable image occurrence one request carries, in request order.
+*
+* The traversal is the one `collectRequestImagePayloads` uses, tool results
+* included: a screenshot inside a tool result reaches the wire, so an
+* occurrence the budget cannot see is an occurrence it cannot budget for.
+*/
+function collectImageOccurrences(options, images) {
+	const occurrences = [];
+	const walk = (content) => {
+		if (!Array.isArray(content)) return;
+		for (const block of content) {
+			if (!isRecord$50(block)) continue;
+			if (block.type === "image") {
+				const bytes = requestImagePayloadLength(block, images);
+				const key = requestImageKey(block, images);
+				if (bytes !== void 0 && key !== void 0) occurrences.push({
+					key,
+					bytes
+				});
+				continue;
+			}
+			if (block.type === "tool-result") walk(block.content);
+		}
+	};
+	for (const message of options.messages) walk(message.content);
+	return occurrences;
+}
+/**
+* The identities of the images one request still carries, each once.
+*
+* The caller compares two of these to learn what a later build gave back: the
+* difference names the images a body-fit pass dropped after the budget pass
+* had already run.
+*/
+function collectRemainingImageKeys(options, images) {
+	const keys = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const occurrence of collectImageOccurrences(options, images)) {
+		if (seen.has(occurrence.key)) continue;
+		seen.add(occurrence.key);
+		keys.push(occurrence.key);
+	}
+	return keys;
+}
+/**
+* Replace every occurrence of a dropped image with the placeholder.
+*
+* Unlike {@link replaceOldestRequestImages} this replaces by IDENTITY rather
+* than by position: a sticky budget drops a picture, and the picture has to
+* stay dropped for the rest of the session wherever it appears.
+*/
+function replaceDroppedRequestImages(options, droppedKeys, images) {
+	if (droppedKeys.size === 0) return {
+		options,
+		count: 0
+	};
+	let count = 0;
+	const replaceIn = (content) => {
+		if (!Array.isArray(content)) return {
+			content,
+			replaced: false
+		};
+		let replaced = false;
+		return {
+			content: content.map((block) => {
+				if (!isRecord$50(block)) return block;
+				if (block.type === "image") {
+					const key = requestImageKey(block, images);
+					if (key === void 0 || !droppedKeys.has(key)) return block;
+					replaced = true;
+					count += 1;
+					return {
+						type: "text",
+						text: OMITTED_IMAGE_TEXT$1
+					};
+				}
+				if (block.type === "tool-result" && Array.isArray(block.content)) {
+					const inner = replaceIn(block.content);
+					if (!inner.replaced) return block;
+					replaced = true;
+					return {
+						...block,
+						content: inner.content
+					};
+				}
+				return block;
+			}),
+			replaced
+		};
+	};
+	let changed = false;
+	const messages = options.messages.map((message) => {
+		const result = replaceIn(message.content);
+		if (!result.replaced) return message;
+		changed = true;
+		return {
+			...message,
+			content: result.content
+		};
+	});
+	return {
+		options: changed ? {
+			...options,
+			messages
+		} : options,
+		count
+	};
+}
+/**
+* Offload images against a budget that RECOVERS instead of a budget that resets.
+*
+* WHY THE TWO WATERMARKS. A single ceiling makes the retained prefix depend
+* on the request: two conversations carrying the same images drop a different
+* number of them as one more image arrives, so the prefix the service cached
+* is rewritten on the next turn and the cache is cold again. Native `kimi-cli`
+* therefore keeps a HIGH mark (20 MiB) and a LOW mark (10 MiB): the request
+* is allowed to grow to the high mark, and once it passes it, the oldest
+* images are given back until the request is back under the LOW mark. The gap
+* between the two is the slack that keeps the number of retained images — and
+* therefore the cached prefix — stable across turns.
+*
+* WHY THE DROPS ARE STICKY. The images a request gives back are replaced for
+* the REST of the session: `priorDroppedKeys` carries the identities a
+* previous turn already dropped, and they are replaced again here. A picture
+* that was omitted stays omitted, so the request the service caches stops
+* changing once the session has settled under its low mark.
+*
+* @param options - the request to budget.
+* @param maxBytes - high-water mark; images are untouched below it.
+* @param lowBytes - low-water mark; the trimming stops once the request is back under it.
+* @param images - the resolution the request will be sent with.
+* @param priorDroppedKeys - identities dropped by earlier turns.
+*/
+function offloadRequestImagesWithStickyBudget(options, maxBytes = MAX_REQUEST_IMAGE_BYTES$1, lowBytes = Math.max(1, Math.floor(maxBytes / 2)), images, priorDroppedKeys) {
+	const allDroppedKeys = new Set(priorDroppedKeys ?? []);
+	const pending = /* @__PURE__ */ new Map();
+	for (const occurrence of collectImageOccurrences(options, images)) {
+		if (allDroppedKeys.has(occurrence.key)) continue;
+		pending.set(occurrence.key, (pending.get(occurrence.key) ?? 0) + occurrence.bytes);
+	}
+	let total = 0;
+	for (const bytes of pending.values()) total += bytes;
+	const newlyDroppedKeys = [];
+	if (total > maxBytes) for (const [key, bytes] of pending) {
+		if (total <= lowBytes) break;
+		if (bytes === 0) continue;
+		allDroppedKeys.add(key);
+		newlyDroppedKeys.push(key);
+		total -= bytes;
+	}
+	const replaced = replaceDroppedRequestImages(options, allDroppedKeys, images);
+	return {
+		options: replaced.options,
+		remainingBytes: total,
+		droppedCount: replaced.count,
+		newlyDroppedKeys,
+		allDroppedKeys
+	};
+}
+/**
 * Whether a request still carries at least one image the mapper can send.
 *
 * A request whose images have all been replaced by placeholders can no longer
@@ -27462,11 +27783,26 @@ function effectiveContextWindow(tokenWindow, env = process.env) {
 /**
 * Base64 image payload one request on this route may carry.
 *
-* Sized to leave room for the conversation inside the body ceiling above, which
-* is why it is the smaller of the two. DSH_KIMI_CODE_MAX_IMAGE_BYTES overrides it
-* under the same rules: ignored, never applied as a disabled guard.
+* Kimi's own CLI budgets request media at 20 MiB (REQUEST_MEDIA_BUDGET_BYTES),
+* and this route now speaks the same number. The previous 1.5 MB figure was
+* Kimi's TEXT-and-image body ceiling applied to the images alone, which threw
+* away pictures the service was perfectly willing to accept: a conversation
+* that carried three screenshots lost two of them to a limit that never
+* existed upstream.
+*
+* DSH_KIMI_CODE_MAX_IMAGE_BYTES overrides it under the same rules: ignored,
+* never applied as a disabled guard.
+*/
+const DEFAULT_MAX_REQUEST_IMAGE_BYTES$1 = 20 * 1024 * 1024;
+/**
+* The mark the request is brought back under once it has passed the high one.
+*
+* Half the high mark, exactly as the official client does
+* (REQUEST_MEDIA_BUDGET_LOW_BYTES). The gap between the two is the slack that
+* keeps the number of retained images stable from turn to turn, and a stable
+* image count is what keeps the cached prefix valid.
 */
-const DEFAULT_MAX_REQUEST_IMAGE_BYTES$1 = MAX_REQUEST_IMAGE_BYTES$1;
+const DEFAULT_LOW_REQUEST_IMAGE_BYTES = 10 * 1024 * 1024;
 /** Image budget this process enforces, honouring the deployment override. */
 function maxRequestImageBytes$1(env = process.env) {
 	const raw = (env.DSH_KIMI_CODE_MAX_IMAGE_BYTES ?? "").trim();
@@ -27476,6 +27812,22 @@ function maxRequestImageBytes$1(env = process.env) {
 	return Math.floor(parsed);
 }
 /**
+* The low-water mark this process enforces, honouring the deployment override.
+*
+* Half of whatever the deployment pinned, so an override moves both marks
+* together: a deployment that lowers the ceiling to 4 MB gets a 2 MB low mark
+* rather than the built-in 10 MB, which would let every request sit above the
+* mark it is supposed to recover to. A deployment that pins nothing gets
+* Kimi's own 10 MiB.
+*/
+function lowRequestImageBytes(env = process.env) {
+	const raw = (env.DSH_KIMI_CODE_MAX_IMAGE_BYTES ?? "").trim();
+	if (raw === "") return DEFAULT_LOW_REQUEST_IMAGE_BYTES;
+	const parsed = Number(raw);
+	if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_LOW_REQUEST_IMAGE_BYTES;
+	return Math.max(1, Math.floor(Math.floor(parsed) / 2));
+}
+/**
 * Which wire dialect a model id is served over.
 *
 * Always the OpenAI-compatible chat completions dialect: this line uses that one
@@ -31344,7 +31696,8 @@ function buildAnthropicRequest(options, images = NO_RESOLVED_IMAGES$3, media = {
 }
 /** Build the body for whichever endpoint serves `wire`. */
 function buildRequest(options, wire, images = NO_RESOLVED_IMAGES$3, preserveThinking = preserveThinkingEnabled(), media = {}) {
-	recordDriftCause(trackPrefixStability(options), options.sessionId);
+	const cause = trackPrefixStability(options);
+	recordDriftCause(cause === "stable" && (pendingImageOffloads.get(cacheScopeKey(options.sessionId)) ?? 0) > 0 ? "image-offload" : cause, options.sessionId);
 	return wire === "anthropic" ? buildAnthropicRequest(options, images, media) : buildOpenAIRequest(options, images, preserveThinking, media);
 }
 /**
@@ -31948,6 +32301,94 @@ function recordDriftCause(cause, sessionId) {
 function getLastDriftCause(sessionId) {
 	return driftCauses.get(cacheScopeKey(sessionId));
 }
+/**
+* Image identities this session has given back to the image budget.
+*
+* Scoped per session for the same reason the prefix snapshots are: DSH runs
+* several conversations — and subagents — at once, so one process-wide set
+* would let one conversation's omission replace another conversation's image.
+*/
+const sessionDroppedImageKeys = /* @__PURE__ */ new Map();
+/**
+* What the most recent request of one session carried, in image bytes.
+*/
+const sessionImageBudgetStats = /* @__PURE__ */ new Map();
+/**
+* Images the request CURRENTLY BEING BUILT has already dropped.
+*
+* Separate from {@link sessionDroppedImageKeys} because the two answer
+* different questions: the set is what the session remembers, and this counter
+* is what the request in flight did. The counter is what lets the drift
+* attribution name the offload, whichever order the build and the recording
+* happen in.
+*/
+const pendingImageOffloads = /* @__PURE__ */ new Map();
+/**
+* The image identities this session has already dropped.
+*
+* `durableDropped` seeds the memory the first time a session is asked about,
+* so a session that ran before the restart keeps the omissions it made: the
+* budget is sticky, and a picture that was given back must stay given back.
+*/
+function getSessionDroppedImageKeys(sessionId, durableDropped) {
+	if (sessionId === void 0 || sessionId.trim() === "") return /* @__PURE__ */ new Set();
+	const scope = cacheScopeKey(sessionId);
+	const existing = sessionDroppedImageKeys.get(scope);
+	if (existing !== void 0) return existing;
+	const seeded = /* @__PURE__ */ new Set();
+	for (const key of durableDropped ?? []) if (typeof key === "string" && key !== "") seeded.add(key);
+	rememberScoped(sessionDroppedImageKeys, scope, seeded);
+	return seeded;
+}
+/**
+* Note that the request being built has dropped images, before its body is built.
+*
+* The drift attribution reads this back when the prefix is fingerprinted, so
+* the order of the two does not matter: a request that drops an image is
+* attributed to the offload whether the body was built before or after the
+* drop was recorded.
+*/
+function markPendingImageOffload(sessionId, newlyDroppedCount) {
+	const scope = cacheScopeKey(sessionId);
+	if (newlyDroppedCount <= 0) {
+		pendingImageOffloads.delete(scope);
+		return;
+	}
+	rememberScoped(pendingImageOffloads, scope, newlyDroppedCount);
+}
+/**
+* Record what one request's image budget did.
+*
+* The dropped identities are kept for the whole session: the budget is sticky,
+* so an image given back stays given back, and the next turn has to know
+* which ones those are.
+*/
+function recordSessionImageBudget(sessionId, input) {
+	const scope = cacheScopeKey(sessionId);
+	const named = sessionId !== void 0 && sessionId.trim() !== "";
+	const keys = named ? sessionDroppedImageKeys.get(scope) ?? /* @__PURE__ */ new Set() : /* @__PURE__ */ new Set();
+	if (named) {
+		for (const key of input.allDroppedKeys) if (typeof key === "string" && key !== "") keys.add(key);
+		rememberScoped(sessionDroppedImageKeys, scope, keys);
+	}
+	rememberScoped(sessionImageBudgetStats, scope, {
+		requestImageBytes: input.requestImageBytes,
+		droppedImages: input.droppedImages,
+		droppedKeys: named ? [...keys] : []
+	});
+	markPendingImageOffload(sessionId, input.newlyDroppedCount);
+	if (input.newlyDroppedCount > 0 && getLastDriftCause(sessionId) === "stable") recordDriftCause("image-offload", sessionId);
+}
+/**
+* What one session's last request carried of images, when it is known.
+*
+* `undefined` for a session that has not sent a request, rather than a zeroed
+* answer: "no request yet" and "a request that carried no images" are
+* different facts.
+*/
+function getSessionImageBudgetStats(sessionId) {
+	return sessionImageBudgetStats.get(cacheScopeKey(sessionId));
+}
 /** Last lift per session. */
 const thinkingCoercions = /* @__PURE__ */ new Map();
 /**
@@ -32326,6 +32767,9 @@ function normalizeRecord(value) {
 	if (lastActiveAt === void 0 || updatedAt === void 0) return void 0;
 	const drift = typeof value.lastDrift === "string" && value.lastDrift !== "" ? value.lastDrift : void 0;
 	const warmupStreak = count$1(value.warmupConsecutiveHits);
+	const budgetDropped = droppedImageKeys(value.budgetDropped);
+	const lastRequestImageBytes = nonNegative(value.lastRequestImageBytes);
+	const lastDroppedImages = nonNegative(value.lastDroppedImages);
 	return {
 		lastActiveAt,
 		updatedAt,
@@ -32338,10 +32782,46 @@ function normalizeRecord(value) {
 		cacheWrite5mTokens: count$1(value.cacheWrite5mTokens),
 		cacheWrite1hTokens: count$1(value.cacheWrite1hTokens),
 		...drift === void 0 ? {} : { lastDrift: drift },
-		...warmupStreak > 0 ? { warmupConsecutiveHits: warmupStreak } : {}
+		...warmupStreak > 0 ? { warmupConsecutiveHits: warmupStreak } : {},
+		...budgetDropped.length > 0 ? { budgetDropped } : {},
+		...lastRequestImageBytes === void 0 ? {} : { lastRequestImageBytes },
+		...lastDroppedImages === void 0 ? {} : { lastDroppedImages }
 	};
 }
 /**
+* How many dropped image identities one record keeps.
+*
+* A session that pastes hundreds of pictures would otherwise grow this
+* document without bound, and it is a diagnostic file: the identities that
+* matter are the ones a later turn still has to replace.
+*/
+const MAX_BUDGET_DROPPED_KEYS = 512;
+/**
+* The dropped image identities a stored record carries.
+*
+* Only non-empty strings, deduplicated and capped: the file is written from
+* whatever the process happened to hold, and a malformed entry must not take
+* the record down with it.
+*/
+function droppedImageKeys(value) {
+	if (!Array.isArray(value)) return [];
+	const keys = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of value) {
+		if (typeof entry !== "string" || entry === "") continue;
+		if (seen.has(entry)) continue;
+		seen.add(entry);
+		keys.push(entry);
+		if (keys.length >= MAX_BUDGET_DROPPED_KEYS) break;
+	}
+	return keys;
+}
+/** A stored byte or image count, or undefined when the field is absent or absurd. */
+function nonNegative(value) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) return void 0;
+	return Math.floor(value);
+}
+/**
 * Combine process memory with the durable record into the hint's two inputs.
 *
 * The process supplies the idle baseline whenever it has served the conversation,
@@ -33476,6 +33956,13 @@ function noteSessionCacheState(sessionId, state) {
 	const lastDrift = getLastDriftCause(sessionId);
 	reportDriftCause(sessionId, lastDrift);
 	const now = Date.now();
+	const imageBudget = getSessionImageBudgetStats(sessionId);
+	const priorRecord = sessionCacheState.read(sessionId);
+	const budgetDropped = imageBudget !== void 0 && imageBudget.droppedKeys.length > 0 ? imageBudget.droppedKeys : priorRecord?.budgetDropped;
+	const liveBytes = imageBudget?.requestImageBytes ?? 0;
+	const liveDropped = imageBudget?.droppedImages ?? 0;
+	const lastRequestImageBytes = liveBytes > 0 ? liveBytes : priorRecord?.lastRequestImageBytes;
+	const lastDroppedImages = liveDropped > 0 ? liveDropped : priorRecord?.lastDroppedImages;
 	sessionCacheState.write(sessionId, {
 		lastActiveAt: now,
 		totalTokens: state.cacheReadTokens + state.inputTokens,
@@ -33487,6 +33974,9 @@ function noteSessionCacheState(sessionId, state) {
 		cacheWrite5mTokens: stats.cacheWrite5mTokens,
 		cacheWrite1hTokens: stats.cacheWrite1hTokens,
 		...lastDrift === void 0 ? {} : { lastDrift },
+		...budgetDropped === void 0 ? {} : { budgetDropped },
+		...lastRequestImageBytes === void 0 ? {} : { lastRequestImageBytes },
+		...lastDroppedImages === void 0 ? {} : { lastDroppedImages },
 		updatedAt: now
 	});
 	const warmupState = recordCacheWarmupUsage({
@@ -33715,7 +34205,10 @@ var KimiCodeAdapter = class extends LlmAdapter {
 		const entry = catalog.find((model) => model.id === options.model);
 		const normalized = normalizeGenerateOptions(options);
 		const images = await resolveRequestImages$1(normalized, this.options.attachments, signal, KIMI_CODE_REQUEST_IMAGE_MAX_EDGE);
-		const imageTrimmed = offloadOldestRequestImages$1(normalized, maxRequestImageBytes$1(), images);
+		const priorDroppedKeys = getSessionDroppedImageKeys(options.sessionId, options.sessionId === void 0 ? void 0 : sessionCacheState.read(options.sessionId)?.budgetDropped);
+		const stickyOffload = offloadRequestImagesWithStickyBudget(normalized, maxRequestImageBytes$1(), lowRequestImageBytes(), images, priorDroppedKeys);
+		const imageTrimmed = stickyOffload.options;
+		markPendingImageOffload(options.sessionId, stickyOffload.newlyDroppedKeys.length);
 		const gatedEffort = coerceThinkingEffort(options.model, mapReasoningEffort(options.reasoningEffort === void 0 || options.reasoningEffort === null ? void 0 : String(options.reasoningEffort)));
 		if (gatedEffort.coercedFrom !== null) recordThinkingCoercion({
 			model: options.model,
@@ -33935,6 +34428,19 @@ var KimiCodeAdapter = class extends LlmAdapter {
 				...after === void 0 ? {} : { providerRetryAfterMs: after }
 			});
 		}
+		if (measured !== void 0) {
+			const requestImageBytes = requestImagePayloadLengths(measured.options, images).reduce((sum, bytes) => sum + bytes, 0);
+			const trimmedKeys = new Set(collectRemainingImageKeys(imageTrimmed, images));
+			const measuredKeys = new Set(collectRemainingImageKeys(measured.options, images));
+			const bodyFitDroppedKeys = [...trimmedKeys].filter((key) => !measuredKeys.has(key));
+			const allDroppedKeys = /* @__PURE__ */ new Set([...stickyOffload.allDroppedKeys, ...bodyFitDroppedKeys]);
+			recordSessionImageBudget(options.sessionId, {
+				allDroppedKeys,
+				newlyDroppedCount: stickyOffload.newlyDroppedKeys.length + bodyFitDroppedKeys.length,
+				requestImageBytes,
+				droppedImages: stickyOffload.droppedCount + bodyFitDroppedKeys.length
+			});
+		}
 		if (response.body === null) throw new LlmError("Kimi Code returned an empty response body", "PROVIDER_ERROR");
 		const reader = response.body.getReader();
 		const decoder = new TextDecoder();
@@ -34505,6 +35011,7 @@ function cacheStatsOrNull(sessionId) {
 		...stats,
 		...lastDrift === void 0 ? {} : { lastDrift },
 		...warmup === void 0 ? {} : { warmup },
+		imageBudget: imageBudgetOf(sessionId),
 		cacheWriteTokens: stats.cacheWriteTokens,
 		cacheWrite5mTokens: stats.cacheWrite5mTokens,
 		cacheWrite1hTokens: stats.cacheWrite1hTokens
@@ -34557,7 +35064,28 @@ function durableCacheStats(sessionId) {
 		cacheWrite5mTokens: durable.cacheWrite5mTokens,
 		cacheWrite1hTokens: durable.cacheWrite1hTokens,
 		...lastDrift === void 0 ? {} : { lastDrift },
-		...warmup === void 0 ? {} : { warmup }
+		...warmup === void 0 ? {} : { warmup },
+		imageBudget: imageBudgetOf(sessionId)
+	};
+}
+/**
+* The image budget this route enforces and what the last turn of one session
+* spent of it.
+*
+* The live numbers win over the durable ones, because the durable record
+* describes the last run of this machine and the live numbers describe the
+* request that actually went out. The ceilings are read from the environment
+* every time, so a deployment that pinned a different budget sees its own
+* number rather than the built-in one.
+*/
+function imageBudgetOf(sessionId) {
+	const live = getSessionImageBudgetStats(sessionId);
+	const durable = sessionCacheState.read(sessionId);
+	return {
+		budgetBytes: maxRequestImageBytes$1(),
+		lowBudgetBytes: lowRequestImageBytes(),
+		requestImageBytes: live?.requestImageBytes ?? durable?.lastRequestImageBytes ?? 0,
+		droppedImages: live?.droppedImages ?? durable?.lastDroppedImages ?? 0
 	};
 }
 /**
@@ -34574,7 +35102,8 @@ function driftCauseOf(value) {
 		case "system-prompt":
 		case "tools":
 		case "cache-key":
-		case "cold-key": return value;
+		case "cold-key":
+		case "image-offload": return value;
 		default: return;
 	}
 }
@@ -80176,6 +80705,124 @@ function subagentModelSelectionPreference(settings) {
 	}
 }
 /**
+* Main-model route per root Session, locked the first time it is observed.
+*
+* Without this, a mid-session model switch would silently re-point a Session's
+* child allowlist: the guard would start answering with a different main model's
+* routes, so the routes advertised in the prompt change, the prefix cache is
+* invalidated, and a model can be handed a list its own earlier turn contradicted.
+* Locking the FIRST resolved route keeps one Session's delegation policy stable
+* for its whole life, which is the same promise the durable policy event makes.
+*
+* Keyed weakly by the root Session object, so a closed Session's entry goes with
+* it. A Session object that is not an object (a minimal fixture) is simply not
+* locked.
+*/
+const lockedRootMainRoutes = /* @__PURE__ */ new WeakMap();
+/**
+* Authorized child routes per root Session, locked the first time they are used.
+*
+* Locking the main ROUTE is not enough on its own: the route is only the key
+* into `byMainModel`, and the list it resolves to is read from the live
+* preference on every step. A Settings edit made at step 5 of a running session
+* would therefore swap the list under it — the prompt-assembly hook rewrites the
+* `subagent` tool description and the `tools:sdk` section from that list, so the
+* next request would carry a different prefix, drop the provider's prefix cache,
+* and contradict the Settings card's promise that a routing change applies to
+* new sessions only. The first resolved list is frozen here for the same reason
+* the durable policy event is a snapshot: one Session is governed by one policy.
+*/
+const lockedRootAllowedRoutes = /* @__PURE__ */ new WeakMap();
+/**
+* Narrow one candidate route pair into an exact route.
+* @param provider - Candidate provider id.
+* @param model - Candidate model id.
+* @returns the route, or undefined unless both halves are non-empty strings.
+*/
+function routeOf(provider, model) {
+	const providerId = asString$3(provider);
+	const modelId = asString$3(model);
+	if (providerId === void 0 || modelId === void 0) return void 0;
+	if (providerId.length === 0 || modelId.length === 0) return void 0;
+	return {
+		provider: providerId,
+		model: modelId
+	};
+}
+/**
+* Read the route a Session's next request uses, when its header names one.
+* @param session - Session whose request header is read.
+* @returns the exact route, or undefined when the header is absent or silent.
+*/
+function headerRouteOf(session) {
+	let header;
+	try {
+		header = session?.requestHeader?.();
+	} catch {
+		return;
+	}
+	return routeOf(header?.config?.provider, header?.config?.model);
+}
+/**
+* Resolve the top-level Session of one agent's lineage, together with the route
+* its main model runs on.
+*
+* The main model is a property of the ROOT Session: a child subagent's own route
+* is the child's, and reading it would authorize children by what a child chose
+* rather than by what the user's main agent is. Walking up through
+* `header.parentSession` finds that root, and the root's route is read from its
+* own header (or, for an agent that IS the root, from the live model accessor and
+* then the delegation hint, which is what an unstarted Session has).
+*
+* Once resolved for a Session that has already sent a request, the route is
+* locked in {@link lockedRootMainRoutes}, so the answer never drifts mid-session.
+* @param agent - Calling agent.
+* @param sessions - Session registry used for ancestor lookup.
+* @param modelSelectionHint - Route fields the caller already resolved.
+* @param lockSnapshot - Lock even a route that has no request header yet; the
+*   prompt-assembly, post-execute and denial paths pass true, so a Session's
+*   first turn fixes its policy for the rest of its life.
+* @returns the root Session (when one exists) and the main route (when known).
+*/
+function resolveRootSessionAndMainRoute(agent, sessions, modelSelectionHint, lockSnapshot = false) {
+	let rootSession = agent?.session;
+	for (let depth = 0; depth < 8 && rootSession !== void 0; depth += 1) {
+		const header = rootSession.header;
+		if (header?.origin !== "subagent") break;
+		const parentId = asString$3(header.parentSession);
+		if (parentId === void 0) break;
+		const parent = sessions.get(parentId);
+		if (parent === void 0) break;
+		rootSession = parent;
+	}
+	if (rootSession === void 0) return { mainRoute: routeOf(modelSelectionHint?.provider, modelSelectionHint?.model) };
+	const lockable = typeof rootSession === "object" && rootSession !== null;
+	const locked = lockable ? lockedRootMainRoutes.get(rootSession) : void 0;
+	if (locked !== void 0) return {
+		rootSession,
+		mainRoute: locked
+	};
+	let mainRoute;
+	if (agent?.session === rootSession || agent?.session === void 0) {
+		let live;
+		try {
+			live = agent?.model?.current?.();
+		} catch {
+			live = void 0;
+		}
+		mainRoute = headerRouteOf(rootSession) ?? routeOf(live?.provider, live?.model) ?? routeOf(modelSelectionHint?.provider, modelSelectionHint?.model);
+	} else {
+		const rootOptions = rootSession.options;
+		mainRoute = headerRouteOf(rootSession) ?? routeOf(rootOptions?.provider, rootOptions?.model);
+	}
+	if (mainRoute === void 0) return { rootSession };
+	if (lockable && (lockSnapshot || headerRouteOf(rootSession) !== void 0)) lockedRootMainRoutes.set(rootSession, mainRoute);
+	return {
+		rootSession,
+		mainRoute
+	};
+}
+/**
 * Read the route an inherit-mode child would run on: the calling agent's own
 * effective request route. This mirrors the delegation seam's
 * `parentAgentOptionsForDelegation`, where the latest request header owns
@@ -80389,9 +81036,36 @@ function delegationModeOf(policies, toolName) {
 * @param scope - Whether an unrecorded Session falls back to the preference.
 * @returns the authorized routes in force for this agent, or an empty list when unrestricted.
 */
-function effectiveAllowedRoutes(agent, preference, sessions, scope = "session") {
+function effectiveAllowedRoutes(agent, preference, sessions, scope = "session", lockSnapshot = false) {
 	if (preference !== void 0 && !preference.enabled) return [];
-	return authorizedRoutesFor(agent, sessions) ?? (scope === "preference" ? preference?.allowedModels ?? [] : []);
+	const baseRoutes = authorizedRoutesFor(agent, sessions) ?? (scope === "preference" ? preference?.allowedModels ?? [] : []);
+	if (baseRoutes.length === 0) return [];
+	return mainModelRoutesFor(agent, sessions, preference, baseRoutes, lockSnapshot);
+}
+/**
+* Apply the per-main-model override to a Session's authorized routes.
+*
+* Precedence is exact-match, then fallback, then the Session's own list: an
+* entry for the main model the Session actually runs is the most specific
+* statement available, the fallback list covers every other main model, and the
+* Session policy is what governs when the deployment configured neither.
+* @param agent - Calling agent.
+* @param sessions - Session registry used for ancestor lookup.
+* @param preference - Current Host preference, when the settings service exists.
+* @param baseRoutes - Routes the Session itself authorized; never empty here.
+* @param lockSnapshot - Freeze the resolved main route AND the resolved route
+*   list for this Session now.
+* @returns the routes that actually govern this delegation.
+*/
+function mainModelRoutesFor(agent, sessions, preference, baseRoutes, lockSnapshot = false) {
+	const { rootSession, mainRoute } = resolveRootSessionAndMainRoute(agent, sessions, void 0, lockSnapshot);
+	const lockable = typeof rootSession === "object" && rootSession !== null;
+	const locked = lockable ? lockedRootAllowedRoutes.get(rootSession) : void 0;
+	if (locked !== void 0) return locked;
+	const overrideRoutes = mainRoute === void 0 ? void 0 : preference?.byMainModel?.[`${mainRoute.provider}/${mainRoute.model}`];
+	const resolved = overrideRoutes !== void 0 && overrideRoutes.length > 0 ? overrideRoutes : preference?.defaultAllowedModels !== void 0 && preference.defaultAllowedModels.length > 0 ? preference.defaultAllowedModels : baseRoutes;
+	if (lockable && (lockSnapshot || headerRouteOf(rootSession) !== void 0)) lockedRootAllowedRoutes.set(rootSession, [...resolved]);
+	return resolved;
 }
 /**
 * State a Session's routing posture in the `list_subagent_models` result.
@@ -80421,8 +81095,96 @@ function enrichListSubagentModelsOutput(output, allowed) {
 	}
 	const header = "Authorized child routes for this Session (already filtered by the Session allowlist; only these routes are accepted, and `provider` and `model` must be passed as separate fields):";
 	if (output.includes(header)) return output;
+	const filtered = filterListSubagentModelsOutput(output, allowed);
 	const suffix = `${header}\n${allowed.map((route) => `- ${route.provider}/${route.model} -> provider: "${route.provider}", model: "${route.model}"`).join("\n")}`;
-	return output.trim().length === 0 ? suffix : `${output}\n\n${suffix}`;
+	return filtered.trim().length === 0 ? suffix : `${filtered}\n\n${suffix}`;
+}
+/** One rendered `provider — Name` line of the upstream provider list. */
+const PROVIDER_LINE = /^([^/\s]+)\s+—\s+.+$/;
+/** One rendered `provider/model — Name` line of the upstream model list. */
+const MODEL_LINE = /^([^/\s]+)\/([^\s]+)\s+—\s+.+$/;
+/**
+* Drop the upstream lines that name a route this Session does not authorize.
+*
+* The upstream discovery tool reads the union policy recorded on the Session, so
+* its raw answer can list a provider or a `provider/model` line that belongs to
+* another main model's entry and NOT to the routes this main model is governed
+* by. Leaving those lines in place is worse than a cosmetic mismatch: the
+* documented way to read this output is to copy a line into `subagent`, so every
+* stale line is an invitation to a delegation the guard will refuse.
+*
+* Only the two known renderings are filtered, and only lines that MATCH one of
+* them are candidates: any other line (a heading, a hint, an empty answer) is
+* passed through untouched, so a generation that changes its wording degrades to
+* the old behavior rather than to an empty answer.
+* @param output - Original text returned by `list_subagent_models`.
+* @param allowed - Routes the calling Session authorizes; never empty here.
+* @returns the output with unauthorized lines removed.
+*/
+function filterListSubagentModelsOutput(output, allowed) {
+	if (allowed.length === 0 || output.length === 0) return output;
+	if (output.includes("\nReasoning efforts:\n")) return output;
+	const lines = output.split("\n");
+	const modelList = lines.some((line) => MODEL_LINE.test(line));
+	let matched = false;
+	const kept = [];
+	for (const line of lines) {
+		if (modelList) {
+			const match = MODEL_LINE.exec(line);
+			if (match === null) {
+				kept.push(line);
+				continue;
+			}
+			matched = true;
+			if (routesInclude(allowed, match[1], match[2])) kept.push(line);
+			continue;
+		}
+		const match = PROVIDER_LINE.exec(line);
+		if (match === null) {
+			kept.push(line);
+			continue;
+		}
+		matched = true;
+		if (allowed.some((route) => route.provider === match[1])) kept.push(line);
+	}
+	if (!matched) return output;
+	const keptText = kept.join("\n").replace(/\n{3,}/g, "\n\n").trim();
+	if (keptText.length > 0) return keptText;
+	if (modelList) return `(no advertised models for ${MODEL_LINE.exec(output)?.[1] ?? ""})`;
+	return "(no LLM providers)";
+}
+/**
+* Merge live per-main-model overrides into a resolved preference.
+*
+* The overrides are a separate seam from the settings namespace because they
+* live in THIS plugin's own preference document, not in the upstream
+* `subagent-model-selection` namespace. They also have to work on a harness
+* where that namespace cannot be registered at all (0.1.7 dropped
+* `settings.register`): there, an override is the only per-main-model statement
+* available, so it stands up an enabled preference by itself rather than being
+* dropped for lack of a base to attach to.
+* @param base - Preference resolved from the settings namespace, when any.
+* @param overrides - Live overrides read from this plugin's preferences.
+* @returns the merged preference, or undefined when neither source says anything.
+*/
+function mergePreferenceOverrides(base, overrides) {
+	const hasDefault = overrides?.defaultAllowedModels !== void 0;
+	const hasByMain = overrides?.byMainModel !== void 0;
+	if (base === void 0) {
+		if (!hasDefault && !hasByMain) return void 0;
+		return {
+			enabled: true,
+			allowedModels: overrides?.defaultAllowedModels ?? [],
+			...hasDefault ? { defaultAllowedModels: overrides?.defaultAllowedModels } : {},
+			...hasByMain ? { byMainModel: overrides?.byMainModel } : {}
+		};
+	}
+	if (!hasDefault && !hasByMain) return base;
+	return {
+		...base,
+		...hasDefault ? { defaultAllowedModels: overrides?.defaultAllowedModels } : {},
+		...hasByMain ? { byMainModel: overrides?.byMainModel } : {}
+	};
 }
 /**
 * The statement appended to `list_subagent_models` when no allowlist governs the
@@ -80533,7 +81295,7 @@ function rewriteAuthorizedPromptAssembly(assembly, allowed, toolNames = DEFAULT_
 * @param inheritToolNames - Delegation tools that start a child on the caller's own route.
 * @returns a denial reason, or undefined to leave the call untouched.
 */
-function delegationDenialReason(agent, toolName, args, preference, sessions, toolNames = DEFAULT_DELEGATION_TOOLS, scope = "session", inheritToolNames = [], declaresRouteParameters) {
+function delegationDenialReason(agent, toolName, args, preference, sessions, toolNames = DEFAULT_DELEGATION_TOOLS, scope = "session", inheritToolNames = [], declaresRouteParameters, lockSnapshot = true) {
 	const mode = delegationModeOf([...toolNames.map((name) => ({
 		name,
 		mode: "explicit"
@@ -80542,7 +81304,7 @@ function delegationDenialReason(agent, toolName, args, preference, sessions, too
 		mode: "inherit"
 	}))], toolName);
 	if (mode === void 0) return void 0;
-	const allowed = effectiveAllowedRoutes(agent, preference, sessions, scope);
+	const allowed = effectiveAllowedRoutes(agent, preference, sessions, scope, lockSnapshot);
 	if (allowed.length === 0) return void 0;
 	const request = asRecord$2(args) ?? {};
 	const requestedProvider = asString$3(request["provider"]);
@@ -80570,7 +81332,26 @@ function delegationDenialReason(agent, toolName, args, preference, sessions, too
 * @returns a guard that denies delegations outside the Session allowlist.
 */
 function createSubagentAuthorization(options) {
-	return (agent, toolName, args) => delegationDenialReason(agent, toolName, args, subagentModelSelectionPreference(options.settings), options.sessions, options.toolNames, options.scope ?? "session", options.inheritToolNames ?? [], options.declaresRouteParameters);
+	return (agent, toolName, args) => delegationDenialReason(agent, toolName, args, mergedPreference(options), options.sessions, options.toolNames, options.scope ?? "session", options.inheritToolNames ?? [], options.declaresRouteParameters);
+}
+/**
+* Resolve the preference one guard evaluation uses.
+*
+* The namespace preference and this plugin's per-main-model overrides are
+* separate seams — the override document outlives a harness that cannot register
+* the namespace at all — so they are merged here, once, rather than at each of
+* the four call sites that need the result.
+* @param options - Runtime inputs the guard closed over.
+* @returns the merged preference, or undefined when neither seam says anything.
+*/
+function mergedPreference(options) {
+	let overrides;
+	try {
+		overrides = options.routingOverrides?.();
+	} catch {
+		overrides = void 0;
+	}
+	return mergePreferenceOverrides(subagentModelSelectionPreference(options.settings), overrides);
 }
 /** Delegation names this guard recognizes when configuration omits them. */
 function normalizeDelegationToolNames(value) {
@@ -80662,14 +81443,19 @@ function installSubagentModelAuthorization(ctx, sessions, config = {}) {
 		toolNames,
 		inheritToolNames,
 		scope,
-		declaresRouteParameters: routeParameterProbe(ctx)
+		declaresRouteParameters: routeParameterProbe(ctx),
+		routingOverrides: config.routingOverrides
+	});
+	const currentPreference = () => mergedPreference({
+		settings,
+		routingOverrides: config.routingOverrides
 	});
 	const disposeGuard = ctx.tools.guard((exec) => authorize(exec.agent, exec.name, exec.arguments));
 	const eventHost = ctx;
 	const disposePostExecute = eventHost.on?.("tools/post-execute", async (exec, result, next) => {
 		const decision = await next();
 		if (exec.name !== "list_subagent_models" || result.isError === true || decision?.kind !== "accept") return decision;
-		const allowed = effectiveAllowedRoutes(exec.agent, subagentModelSelectionPreference(settings), sessions, scope);
+		const allowed = effectiveAllowedRoutes(exec.agent, currentPreference(), sessions, scope, true);
 		const currentValue = decision.value !== void 0 ? decision.value : result.value;
 		if (typeof currentValue === "string") {
 			const enriched = enrichListSubagentModelsOutput(currentValue, allowed);
@@ -80697,7 +81483,7 @@ function installSubagentModelAuthorization(ctx, sessions, config = {}) {
 		return decision;
 	});
 	const disposeAssemble = eventHost.on?.("system-prompt/assemble", async (_assembly, context, next) => {
-		return rewriteAuthorizedPromptAssembly(await next(), effectiveAllowedRoutes(context?.agent ?? context?.scope, subagentModelSelectionPreference(settings), sessions, scope), toolNames);
+		return rewriteAuthorizedPromptAssembly(await next(), effectiveAllowedRoutes(context?.agent ?? context?.scope, currentPreference(), sessions, scope, true), toolNames);
 	});
 	return () => {
 		disposeGuard();
@@ -94013,7 +94799,16 @@ function apply(ctx, pluginConfig = {}) {
 			return installSubagentModelAuthorization(scoped, sessions, {
 				toolNames: delegationToolNames,
 				inheritToolNames: delegationInheritNames,
-				scope: pluginConfig.subagentModelScope ?? "session"
+				scope: pluginConfig.subagentModelScope ?? "session",
+				routingOverrides: () => {
+					const current = preferences.status();
+					const defaultAllowedModels = current.subagentDefaultModels ?? [];
+					const byMainModel = current.subagentModelsByMainModel ?? {};
+					return {
+						...defaultAllowedModels.length > 0 ? { defaultAllowedModels } : {},
+						...Object.keys(byMainModel).length > 0 ? { byMainModel } : {}
+					};
+				}
 			});
 		}, "dsh-chatgpt-subscription: subagent model authorization");
 	});
@@ -94361,7 +95156,12 @@ function apply(ctx, pluginConfig = {}) {
 			const sessions = ctx.get("sessions");
 			const target = sessions.get(sessionId);
 			if (target === void 0) throw new Error(`Unknown session "${sessionId}".`);
-			const allowed = auditedRoutesOf(target);
+			const audited = auditedRoutesOf(target);
+			const current = preferences.status();
+			const mainRoute = resolveRootSessionAndMainRoute({ session: target }, sessions).mainRoute;
+			const override = mainRoute === void 0 ? void 0 : (current.subagentModelsByMainModel ?? {})[`${mainRoute.provider}/${mainRoute.model}`];
+			const fallback = current.subagentDefaultModels ?? [];
+			const allowed = audited === void 0 ? audited : override !== void 0 && override.length > 0 ? override : fallback.length > 0 ? fallback : audited;
 			return Promise.resolve({
 				sessionId,
 				allowedModels: (allowed ?? []).map((route) => ({