@eddyskywalker/dsh-chatgpt-subscription 0.48.4 → 0.50.0

package/lib/index.js

@@ -145,7 +145,7 @@ const ROUTE_PREFIX$5 = "/api/dsh-chatgpt-subscription";
 * `test/responses-client.test.ts` asserts the two agree, so a release that
 * forgets this constant fails the suite instead of shipping quietly.
 */
-const PLUGIN_VERSION = "0.48.4";
+const PLUGIN_VERSION = "0.50.0";
 const CODEX_CHATGPT_PROVIDER_ID = "codex-chatgpt";
 const CODEX_API_BASE = "https://chatgpt.com/backend-api/codex";
 const CODEX_RESPONSES_URL = `${CODEX_API_BASE}/responses`;
@@ -859,7 +859,7 @@ async function rehydrateSnapshot(key) {
 * so a backend that flattens the envelope does not read as an empty catalog.
 */
 function parseListing(payload) {
-	const record = asRecord$19(payload);
+	const record = asRecord$20(payload);
 	const models = Array.isArray(payload) ? payload : record?.models;
 	if (!Array.isArray(models)) return [];
 	return models.flatMap((item) => parseListingEntry$1(item));
@@ -873,7 +873,7 @@ function parseListing(payload) {
 * back to a conservative answer rather than to a guess.
 */
 function parseListingEntry$1(value) {
-	const record = asRecord$19(value);
+	const record = asRecord$20(value);
 	if (record === void 0) return [];
 	const id = asString$27(record.slug) ?? asString$27(record.id);
 	if (id === void 0) return [];
@@ -909,7 +909,7 @@ function parseEfforts(value) {
 	if (!Array.isArray(value)) return null;
 	const out = [];
 	for (const item of value) {
-		const effort = asString$27(item) ?? asString$27(asRecord$19(item)?.effort);
+		const effort = asString$27(item) ?? asString$27(asRecord$20(item)?.effort);
 		if (effort !== void 0 && !out.includes(effort)) out.push(effort);
 	}
 	return out.length > 0 ? out : null;
@@ -924,7 +924,7 @@ function parseEfforts(value) {
 function accountKeyFor$1(credentials) {
 	return credentials.accountId || "default";
 }
-function asRecord$19(value) {
+function asRecord$20(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
 function asString$27(value) {
@@ -5289,9 +5289,9 @@ function requestImage$1(fetchFn, credentials, prompt, turnId, signal) {
 	});
 }
 function readBase64Image(value) {
-	const root = record$6(value);
+	const root = record$7(value);
 	const data = Array.isArray(root?.data) ? root.data[0] : null;
-	const image = string$3(record$6(data)?.b64_json) ?? string$3(record$6(data)?.image_base64) ?? string$3(root?.b64_json) ?? string$3(root?.image);
+	const image = string$3(record$7(data)?.b64_json) ?? string$3(record$7(data)?.image_base64) ?? string$3(root?.b64_json) ?? string$3(root?.image);
 	if (image === null) throw new HarnessError("Codex image response did not include image data.", "CODEX_IMAGE_RESPONSE_INVALID");
 	return image;
 }
@@ -5305,7 +5305,7 @@ function decodeImageBytes(base64, maxBytes) {
 function maxGeneratedImageBytes(attachments) {
 	return Math.min(attachments.imageLimits.maxImageBytes, attachments.imageLimits.maxMessageImageBytes);
 }
-function record$6(value) {
+function record$7(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
 function string$3(value) {
@@ -9043,7 +9043,7 @@ function buildImageRequest(prompt, projectId, aspectRatio) {
 		requestId: `img_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`
 	};
 }
-function record$5(value) {
+function record$6(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
 function string$2(value) {
@@ -9073,16 +9073,16 @@ function parseImageResponse(body) {
 		} catch {
 			continue;
 		}
-		const root = record$5(frame);
-		const response = record$5(root?.response) ?? root;
-		const error = record$5(root?.error) ?? record$5(response?.error);
+		const root = record$6(frame);
+		const response = record$6(root?.response) ?? root;
+		const error = record$6(root?.error) ?? record$6(response?.error);
 		if (error) throw new HarnessError(`Antigravity image generation failed: ${string$2(error.message) ?? "unknown error"}`, "ANTIGRAVITY_IMAGE_FAILED");
-		const candidate = record$5(Array.isArray(response?.candidates) ? response.candidates[0] : void 0);
-		const parts = Array.isArray(record$5(candidate?.content)?.parts) ? record$5(candidate?.content).parts : [];
+		const candidate = record$6(Array.isArray(response?.candidates) ? response.candidates[0] : void 0);
+		const parts = Array.isArray(record$6(candidate?.content)?.parts) ? record$6(candidate?.content).parts : [];
 		for (const raw of parts) {
-			const part = record$5(raw);
+			const part = record$6(raw);
 			if (!part || part.thought === true) continue;
-			const inline = record$5(part.inlineData) ?? record$5(part.inline_data);
+			const inline = record$6(part.inlineData) ?? record$6(part.inline_data);
 			const data = string$2(inline?.data);
 			if (inline && data) {
 				result.images.push({
@@ -9093,7 +9093,7 @@ function parseImageResponse(body) {
 			}
 			if (typeof part.text === "string") result.text += part.text;
 		}
-		const blockReason = string$2(record$5(response?.promptFeedback)?.blockReason);
+		const blockReason = string$2(record$6(response?.promptFeedback)?.blockReason);
 		result.finishReason = string$2(candidate?.finishReason) ?? (blockReason ? `PROMPT_BLOCKED:${blockReason}` : result.finishReason);
 		result.finishMessage = string$2(candidate?.finishMessage) ?? result.finishMessage;
 	}
@@ -9429,13 +9429,13 @@ function normalizeSearchResult(data, maxResults) {
 	};
 }
 function readSources(data) {
-	const root = record$4(data);
+	const root = record$5(data);
 	if (root === null) return [];
 	const candidates = [
 		root.sources,
 		root.results,
-		record$4(root.search_result)?.sources,
-		record$4(root.web_search)?.sources
+		record$5(root.search_result)?.sources,
+		record$5(root.web_search)?.sources
 	];
 	for (const candidate of candidates) {
 		if (!Array.isArray(candidate)) continue;
@@ -9445,7 +9445,7 @@ function readSources(data) {
 	return [];
 }
 function readSource(value) {
-	const data = record$4(value);
+	const data = record$5(value);
 	if (data === null) return null;
 	const url = string$1(data.url) ?? string$1(data.link) ?? string$1(data.uri);
 	if (url === null || !isHttpUrl(url)) return null;
@@ -9474,7 +9474,7 @@ function readSource(value) {
 * counterpart of `output`, not a fallback for it.
 */
 function readContent(data) {
-	const root = record$4(data);
+	const root = record$5(data);
 	if (root === null) return void 0;
 	return string$1(root.content) ?? string$1(root.output_text) ?? string$1(root.summary) ?? string$1(root.output) ?? void 0;
 }
@@ -9489,7 +9489,7 @@ function dedupeSources(sources) {
 	}
 	return result;
 }
-function record$4(value) {
+function record$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
 function string$1(value) {
@@ -10812,7 +10812,9 @@ const DEFAULT_PREFERENCES = {
 	contextWindowOverrides: {},
 	proxyMode: "auto",
 	customProxyUrl: null,
-	compactionRoute: null
+	compactionRoute: null,
+	subagentDefaultModels: [],
+	subagentModelsByMainModel: {}
 };
 const SEARCH_PROVIDER_CODEX = "codex";
 function isSearchProviderPreference(value) {
@@ -10827,6 +10829,105 @@ function isCodexReasoningSummary(value) {
 function isProxyMode(value) {
 	return value === "auto" || value === "custom" || value === "direct";
 }
+function asRecord$19(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+/**
+* Read one non-empty trimmed string field.
+* @param value - Candidate field value from stored JSON.
+* @returns the trimmed string, or undefined when it is not a non-empty string.
+*/
+function trimmedString(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	return trimmed.length === 0 ? void 0 : trimmed;
+}
+/**
+* Whether one value is a complete `{ provider, model }` route.
+*
+* Both halves are trimmed and must be non-empty: a route with a blank provider
+* names no adapter, and a blank model names no model, so neither can ever be
+* authorized. Stored documents are untrusted JSON, which is why this narrows
+* rather than asserts.
+* @param value - Candidate route.
+* @returns whether the value is a usable route.
+*/
+function isSubagentModelRoute(value) {
+	const record = asRecord$19(value);
+	if (record === void 0) return false;
+	return trimmedString(record["provider"]) !== void 0 && trimmedString(record["model"]) !== void 0;
+}
+/**
+* Normalize one route list, deduplicating it without reordering.
+*
+* Order is preserved because it is the order the settings card shows and the
+* order `list_subagent_models` prints: a set would silently reshuffle the list
+* a user arranged.
+* @param value - Candidate route list from stored JSON.
+* @returns the trimmed, deduplicated routes, or null when the value is not an
+*   array of well-formed routes.
+*/
+function normalizeSubagentModelRoutes(value) {
+	if (!Array.isArray(value)) return null;
+	const routes = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of value) {
+		if (!isSubagentModelRoute(entry)) return null;
+		const provider = entry.provider.trim();
+		const model = entry.model.trim();
+		const key = `${provider}/${model}`;
+		if (seen.has(key)) continue;
+		seen.add(key);
+		routes.push({
+			provider,
+			model
+		});
+	}
+	return routes;
+}
+/**
+* Whether one key names a main agent route as `provider/model`.
+*
+* The split is at the FIRST slash, so a model id that legally contains a slash
+* (`command-code` + `deepseek/deepseek-v4.1-flash`) still round-trips: the
+* provider half ends at the first separator and the model half keeps the rest.
+* @param key - Candidate map key.
+* @returns whether the key carries a non-empty provider and a non-empty model.
+*/
+function isValidMainModelKey(key) {
+	if (typeof key !== "string") return false;
+	const trimmed = key.trim();
+	const separator = trimmed.indexOf("/");
+	if (separator <= 0) return false;
+	return trimmed.slice(separator + 1).length > 0;
+}
+/**
+* Merge one `subagentModelsByMainModel` patch into the stored map.
+*
+* A merge rather than a replace, so the card can clear or set one main model
+* without resending every other entry — and `null` (or `[]`) is how one entry
+* is cleared, since a stored map has no other way to say "no override".
+* @param current - Map already stored in the preferences document.
+* @param patch - Incoming patch from a settings card or a route body.
+* @returns the merged map, or null when any key or value is malformed.
+*/
+function mergeSubagentModelsByMainModel(current, patch) {
+	const patchRecord = asRecord$19(patch);
+	if (patchRecord === void 0) return null;
+	const merged = { ...current };
+	for (const [rawKey, rawRoutes] of Object.entries(patchRecord)) {
+		const key = rawKey.trim();
+		if (!isValidMainModelKey(key)) return null;
+		if (rawRoutes === null || Array.isArray(rawRoutes) && rawRoutes.length === 0) {
+			delete merged[key];
+			continue;
+		}
+		const routes = normalizeSubagentModelRoutes(rawRoutes);
+		if (routes === null) return null;
+		merged[key] = routes;
+	}
+	return merged;
+}
 //#endregion
 //#region src/host/common/legacy-preferences.ts
 /**
@@ -10993,6 +11094,10 @@ function sectionOf(document, id) {
 */
 function registerPreferenceStore(settings) {
 	const contextWindowOverrides = z.object(Object.fromEntries(CODEX_MODEL_CATALOG.map((entry) => [entry.id, z.number().step(1).min(1).max(contextWindowLimitForModel(entry.id))]))).default({});
+	const subagentModelRoutes = z.array(z.object({
+		provider: z.string(),
+		model: z.string()
+	}));
 	const schema = z.object({
 		enabled: z.boolean().default(DEFAULT_PREFERENCES.enabled ?? true),
 		quickQuotaVisible: z.boolean().default(DEFAULT_PREFERENCES.quickQuotaVisible),
@@ -11022,7 +11127,9 @@ function registerPreferenceStore(settings) {
 		compactionRoute: z.union([z.object({
 			provider: z.string(),
 			model: z.string()
-		}), z.const(null)]).default(DEFAULT_PREFERENCES.compactionRoute ?? null)
+		}), z.const(null)]).default(DEFAULT_PREFERENCES.compactionRoute ?? null),
+		subagentDefaultModels: subagentModelRoutes.default([]),
+		subagentModelsByMainModel: z.dict(subagentModelRoutes).default({})
 	});
 	if (!hasRegister(settings)) {
 		const fileStore = new FilePreferencesStore(schema, preferencesPath(), readLegacyPreferences);
@@ -11080,6 +11187,16 @@ var SettingsPreferenceStore = class {
 				model: patch.compactionRoute.model.trim()
 			};
 		}
+		if (patch.subagentDefaultModels !== void 0) {
+			const routes = normalizeSubagentModelRoutes(patch.subagentDefaultModels);
+			if (routes === null) throw new PreferenceError("Unsupported subagentDefaultModels preference.");
+			normalized.subagentDefaultModels = routes;
+		}
+		if (patch.subagentModelsByMainModel !== void 0) {
+			const merged = mergeSubagentModelsByMainModel(this.scope.get().subagentModelsByMainModel, patch.subagentModelsByMainModel);
+			if (merged === null) throw new PreferenceError("Unsupported subagentModelsByMainModel preference.");
+			normalized.subagentModelsByMainModel = merged;
+		}
 		if (patch.customProxyUrl !== void 0) if (patch.customProxyUrl !== null) {
 			const trimmed = patch.customProxyUrl.trim();
 			if (trimmed.length > 0 && !/^https?:\/\//i.test(trimmed) && !/^socks5?:\/\//i.test(trimmed)) normalized.customProxyUrl = `http://${trimmed}`;
@@ -11175,7 +11292,7 @@ function offloadOldestInputImages(input, maxBytes = maxRequestImageBytes$2()) {
 	for (const item of input) {
 		if (!Array.isArray(item.content)) continue;
 		for (const [index, block] of item.content.entries()) {
-			if (record$3(block) === null || block.type !== "input_image") continue;
+			if (record$4(block) === null || block.type !== "input_image") continue;
 			const url = block.image_url;
 			if (typeof url !== "string") continue;
 			retained.push({
@@ -11375,14 +11492,14 @@ function toolParametersForCodex(toolName, parameters, allowSandboxRetry) {
 	const augmentCommandTool = isCommandTool(toolName);
 	if (!hideSandboxControls && toolName !== "run_code" && !augmentCommandTool) return parameters;
 	const cloned = structuredClone(parameters);
-	const properties = record$3(cloned.properties);
+	const properties = record$4(cloned.properties);
 	if (properties !== null && hideSandboxControls) {
 		delete properties.sandbox_permissions;
 		delete properties.justification;
 	}
 	if (hideSandboxControls && Array.isArray(cloned.required)) cloned.required = cloned.required.filter((name) => name !== "sandbox_permissions" && name !== "justification");
 	if (toolName === "run_code" && properties !== null) {
-		const code = record$3(properties.code);
+		const code = record$4(properties.code);
 		if (code !== null) {
 			const current = typeof code.description === "string" ? code.description.trim() : "";
 			const compatibility = "Strict JavaScript/TypeScript source. Nested shell commands are string data: template literals may consume ${...}, backticks, backslashes, and escape sequences before PowerShell, Bash, or POSIX sh sees them; String.raw still performs ${...} interpolation. Prefer ordinary quoted string arrays joined with \"\\n\", or write a script file with a dedicated file tool.";
@@ -11400,7 +11517,7 @@ function toolParametersForCodex(toolName, parameters, allowSandboxRetry) {
 	return cloned;
 }
 function appendPropertyDescription(value, addition) {
-	const property = record$3(value);
+	const property = record$4(value);
 	if (property === null) return;
 	const current = typeof property.description === "string" ? property.description.trim() : "";
 	if (current.includes(addition)) return;
@@ -11411,7 +11528,7 @@ function isCommandTool(name) {
 	return normalized === "pwsh" || normalized === "powershell" || normalized === "bash" || normalized === "sh" || normalized === "shell";
 }
 function hasSandboxControls(parameters) {
-	const properties = record$3(parameters.properties);
+	const properties = record$4(parameters.properties);
 	return properties !== null && ("sandbox_permissions" in properties || "justification" in properties);
 }
 function recentSandboxRetryToolNames(messages) {
@@ -11623,11 +11740,11 @@ function replayOutputItems(message) {
 	const replay = message.source?.replayState;
 	if (typeof replay !== "object" || replay === null || Array.isArray(replay)) return null;
 	const envelope = replay;
-	const items = Array.isArray(envelope.outputItems) ? envelope.outputItems : Array.isArray(record$3(envelope.response)?.outputItems) ? record$3(envelope.response).outputItems : null;
+	const items = Array.isArray(envelope.outputItems) ? envelope.outputItems : Array.isArray(record$4(envelope.response)?.outputItems) ? record$4(envelope.response).outputItems : null;
 	if (!Array.isArray(items)) return null;
 	return structuredClone(items.filter((item) => typeof item === "object" && item !== null && !Array.isArray(item)));
 }
-function record$3(value) {
+function record$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
 //#endregion
@@ -12028,7 +12145,7 @@ async function* parseResponsesStream(response, signal, hiddenSandboxControls = /
 			return;
 		}
 		if (type === "response.content_part.done") {
-			const part = record$2(event.part);
+			const part = record$3(event.part);
 			const partType = string(part?.type);
 			if (partType === "output_text" || partType === "refusal") yield* adoptText(string(part?.text) ?? "");
 			return;
@@ -12060,7 +12177,7 @@ async function* parseResponsesStream(response, signal, hiddenSandboxControls = /
 			return;
 		}
 		if (type === "response.output_item.added" || type === "response.output_item.done") {
-			const item = record$2(event.item);
+			const item = record$3(event.item);
 			if (item !== null && type === "response.output_item.done") replayOutput.push(structuredClone(item));
 			if (string(item?.type) !== "function_call") {
 				if (type === "response.output_item.done") yield* adoptText(messageItemText(item));
@@ -12120,18 +12237,18 @@ async function* parseResponsesStream(response, signal, hiddenSandboxControls = /
 			return;
 		}
 		if (type === "response.completed" || type === "response.incomplete") {
-			const completed = record$2(event.response);
-			usage = mapUsage$2(record$2(completed?.usage));
+			const completed = record$3(event.response);
+			usage = mapUsage$2(record$3(completed?.usage));
 			const output = completed?.output;
 			if (Array.isArray(output)) {
-				replayOutput = output.filter((item) => record$2(item) !== null).map((item) => structuredClone(item));
-				for (const item of output) yield* adoptText(messageItemText(record$2(item)));
+				replayOutput = output.filter((item) => record$3(item) !== null).map((item) => structuredClone(item));
+				for (const item of output) yield* adoptText(messageItemText(record$3(item)));
 			}
 			terminal = type === "response.incomplete" ? { kind: "max-tokens" } : { kind: "stop" };
 			return;
 		}
 		if (type === "response.failed" || type === "error") {
-			const error = record$2(event.error) ?? record$2(record$2(event.response)?.error);
+			const error = record$3(event.error) ?? record$3(record$3(event.response)?.error);
 			const message = string(error?.message) ?? "Codex generation failed.";
 			const rawCode = string(error?.code)?.toLowerCase();
 			const isOverload = message.toLowerCase().includes("overload") || message.toLowerCase().includes("server error") || rawCode === "server_error" || rawCode === "service_unavailable" || rawCode === "internal_error";
@@ -12157,7 +12274,7 @@ async function* parseResponsesStream(response, signal, hiddenSandboxControls = /
 				} catch {
 					throw new LlmError("Codex returned malformed streaming JSON.", "PROTOCOL_ERROR");
 				}
-				const valueRecord = record$2(event);
+				const valueRecord = record$3(event);
 				if (valueRecord !== null) yield* consume(valueRecord);
 			}
 		}
@@ -12263,10 +12380,10 @@ function mapUsage$2(value) {
 	if (value === null) return null;
 	const totalInput = number(value.input_tokens) ?? 0;
 	const outputTokens = number(value.output_tokens) ?? 0;
-	const details = record$2(value.input_tokens_details);
+	const details = record$3(value.input_tokens_details);
 	const cached = number(details?.cached_tokens);
 	const written = number(details?.cache_write_tokens);
-	const reasoning = number(record$2(value.output_tokens_details)?.reasoning_tokens);
+	const reasoning = number(record$3(value.output_tokens_details)?.reasoning_tokens);
 	return {
 		inputTokens: Math.max(0, totalInput - (cached ?? 0) - (written ?? 0)),
 		outputTokens,
@@ -12285,7 +12402,7 @@ function isSafeJsonArguments(value) {
 }
 function stripSandboxControls(value) {
 	try {
-		const parsedRecord = record$2(JSON.parse(value));
+		const parsedRecord = record$3(JSON.parse(value));
 		if (parsedRecord === null) return value;
 		let changed = false;
 		for (const name of ["sandbox_permissions", "justification"]) if (name in parsedRecord) {
@@ -12322,14 +12439,14 @@ function messageItemText(item) {
 	if (item === null || string(item.type) !== "message" || !Array.isArray(item.content)) return "";
 	let text = "";
 	for (const part of item.content) {
-		const value = record$2(part);
+		const value = record$3(part);
 		const kind = string(value?.type);
 		if (kind !== "output_text" && kind !== "refusal") continue;
 		text += string(value?.text) ?? "";
 	}
 	return text;
 }
-function record$2(value) {
+function record$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
 function string(value) {
@@ -13422,7 +13539,7 @@ function mapCodexUsage(value) {
 	return parseCodexUsage(value).buckets;
 }
 function parseCodexUsage(value) {
-	const data = record$1(value);
+	const data = record$2(value);
 	if (data === null) return structuredClone(EMPTY_USAGE);
 	const planType = typeof data.plan_type === "string" ? data.plan_type : null;
 	const buckets = [];
@@ -13431,21 +13548,21 @@ function parseCodexUsage(value) {
 	addBucket(buckets, usedIds, "code-review", "Code review", planType, data.code_review_rate_limit);
 	const additional = Array.isArray(data.additional_rate_limits) ? data.additional_rate_limits : [];
 	for (const [index, value] of additional.entries()) {
-		const limit = record$1(value);
+		const limit = record$2(value);
 		if (limit === null) continue;
-		const idSource = text$3(limit.limit_name) ?? text$3(limit.metered_feature) ?? `additional-${index + 1}`;
-		addBucket(buckets, usedIds, uniqueId(slug(idSource), usedIds), readableLimitName(text$3(limit.limit_name) ?? text$3(limit.metered_feature) ?? idSource), planType, limit.rate_limit);
+		const idSource = text$4(limit.limit_name) ?? text$4(limit.metered_feature) ?? `additional-${index + 1}`;
+		addBucket(buckets, usedIds, uniqueId(slug(idSource), usedIds), readableLimitName(text$4(limit.limit_name) ?? text$4(limit.metered_feature) ?? idSource), planType, limit.rate_limit);
 	}
 	return {
 		buckets,
 		credits: mapCredits(data.credits),
-		individualLimit: mapIndividualLimit(record$1(data.spend_control)?.individual_limit),
-		spendControlReached: boolean(record$1(data.spend_control)?.reached),
+		individualLimit: mapIndividualLimit(record$2(data.spend_control)?.individual_limit),
+		spendControlReached: boolean(record$2(data.spend_control)?.reached),
 		resetCredits: mapResetCredits(data.rate_limit_reset_credits)
 	};
 }
 function addBucket(result, usedIds, id, name, planType, value) {
-	const source = record$1(value);
+	const source = record$2(value);
 	if (source === null) return;
 	const primary = mapWindow(source.primary_window);
 	const secondary = mapWindow(source.secondary_window);
@@ -13461,7 +13578,7 @@ function addBucket(result, usedIds, id, name, planType, value) {
 	usedIds.add(id);
 }
 function mapWindow(value) {
-	const data = record$1(value);
+	const data = record$2(value);
 	if (data === null) return null;
 	const used = numeric(data.used_percent);
 	if (used === void 0) return null;
@@ -13474,7 +13591,7 @@ function mapWindow(value) {
 	};
 }
 function mapCredits(value) {
-	const data = record$1(value);
+	const data = record$2(value);
 	if (data === null) return null;
 	const hasCredits = boolean(data.has_credits);
 	const unlimited = boolean(data.unlimited);
@@ -13487,7 +13604,7 @@ function mapCredits(value) {
 	};
 }
 function mapIndividualLimit(value) {
-	const data = record$1(value);
+	const data = record$2(value);
 	if (data === null) return null;
 	const remaining = numeric(data.remaining_percent);
 	const reset = numeric(data.reset_at);
@@ -13502,7 +13619,7 @@ function mapIndividualLimit(value) {
 	};
 }
 function mapResetCredits(value) {
-	const data = record$1(value);
+	const data = record$2(value);
 	if (data === null) return null;
 	const available = numeric(data.available_count);
 	if (available === void 0) return null;
@@ -13512,14 +13629,14 @@ function mapResetCredits(value) {
 	};
 }
 function parseResetCredits(value) {
-	const data = record$1(value);
+	const data = record$2(value);
 	if (data === null) return {
 		availableCount: 0,
 		expiresAt: null,
 		availableCreditIds: []
 	};
-	const available = (Array.isArray(data.credits) ? data.credits : []).map(record$1).filter((credit) => credit !== null && credit.status === "available").map((credit) => ({
-		id: text$3(credit.id),
+	const available = (Array.isArray(data.credits) ? data.credits : []).map(record$2).filter((credit) => credit !== null && credit.status === "available").map((credit) => ({
+		id: text$4(credit.id),
 		expiresAt: timestamp(credit.expires_at)
 	})).filter((credit) => credit.id !== null).sort((left, right) => (left.expiresAt ?? Number.MAX_SAFE_INTEGER) - (right.expiresAt ?? Number.MAX_SAFE_INTEGER));
 	const reported = numeric(data.available_count);
@@ -13536,7 +13653,7 @@ function timestamp(value) {
 	const parsed = Date.parse(value);
 	return Number.isFinite(parsed) ? Math.floor(parsed / 1e3) : null;
 }
-function record$1(value) {
+function record$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
 function boolean(value) {
@@ -13553,7 +13670,7 @@ function decimalText(value) {
 	const trimmed = value.trim();
 	return trimmed !== "" ? trimmed : null;
 }
-function text$3(value) {
+function text$4(value) {
 	return typeof value === "string" && value.trim() !== "" ? value.trim() : null;
 }
 function slug(value) {
@@ -14006,6 +14123,15 @@ function readPreferencesUpdate(value, current) {
 			model: value.compactionRoute.model.trim()
 		};
 	}
+	if ("subagentDefaultModels" in value) {
+		const routes = normalizeSubagentModelRoutes(value.subagentDefaultModels);
+		if (routes === null) throw new PreferenceError("subagentDefaultModels must be an array of { provider, model } routes.");
+		patch.subagentDefaultModels = routes;
+	}
+	if ("subagentModelsByMainModel" in value) {
+		if (mergeSubagentModelsByMainModel(current.subagentModelsByMainModel, value.subagentModelsByMainModel) === null) throw new PreferenceError("subagentModelsByMainModel must map \"provider/model\" keys to arrays of { provider, model } routes, or null to clear one.");
+		patch.subagentModelsByMainModel = value.subagentModelsByMainModel;
+	}
 	if ("contextWindowOverrides" in value) {
 		if (!isRecord$55(value.contextWindowOverrides)) throw new PreferenceError("contextWindowOverrides must be an object.");
 		const overrides = {};
@@ -25751,11 +25877,73 @@ const TOOL_SUBAGENT = /(?:^|[-_/])(?:subagent|agent|task|delegate|ralph|teammate
 const TOOL_SOURCE = /(?:^|[-_/])(?:read|view|cat|open|edit|write|patch|apply_patch|notebook|document|diff)(?:[-_/]|$)/i;
 /** 独立开关覆盖的检索工具；只有明确导航任务才允许进入新投影。 */
 const TOOL_RETRIEVAL = /^(?:read|web_fetch|grep|glob)$/;
+/**
+* 多节/多读输出进入新投影的最小长度门槛（字符）。
+*
+* 短于这个长度、又没有 spill 的普通源码与契约读一律逐字保留：
+* 只有「确定已经大到装不进预算」的输出才值得换成摘要。
+*/
+const MULTI_OUTPUT_MIN_CHARS = 2e4;
 /** 一行文本的裁剪（超长行才裁剪，并留下省略号）。 */
 function clip(text, max) {
 	return text.length <= max ? text : `${text.slice(0, max)}…`;
 }
 /**
+* DSH 的输出上限提示：正文被截断，全文落在临时文件里。
+*
+* 省略说明可能是精确或未知字节数，还可能跟着一段图片计数；这些形态都由 DSH 的 formatSpillNotice 产生。
+* 路径本身可能带 `.txt` 之类的后缀，所以路径用**非贪婪**捕获，末尾的句点单独留给正则。
+*/
+const SPILL_NOTICE = /\n\n\((?:Omitted \d+ bytes\.|More bytes were omitted\.)(?: Omitted \d+ images\.)? Full formatted result stored at: ([^\r\n]+?)(?:\. Use read with offset\/limit, or grep this path to search within it)?\.\)\s*$/;
+/**
+* 读回一个 spill 文件的完整 UTF-8 内容。
+*
+* 文件系统依赖在这里动态引入：`contracts.ts` 必须保持零 Node 依赖，而投影是宿主侧代码。
+* 读不到、不是普通文件、或超过单结果字节上限时一律返回 undefined —— 宁可少投影，
+* 也不能把一份读了一半的原文当成全文入库。
+* @param filePath - spill 提示里给出的路径。
+* @returns 完整内容，或 undefined。
+*/
+async function readSpillFile(filePath) {
+	try {
+		const { stat, readFile } = await import("node:fs/promises");
+		const stats = await stat(filePath);
+		if (!stats.isFile()) return void 0;
+		if (stats.size > CACHE_WARMUP_DEFAULTS.maxResultBytes) return void 0;
+		return await readFile(filePath, "utf8");
+	} catch {
+		return;
+	}
+}
+/**
+* 处理 DSH 的 spill 提示。
+*
+* 读得到全文：投影与入库都用全文，`cache_warmup_result` 才能翻到**未截断**的输出。
+* 读不到：剥掉提示尾部，剩下的正文照常参与投影与入库。
+* @param raw - 工具结果原文。
+* @returns 解析结果。
+*/
+async function resolveSpillText(raw) {
+	const match = SPILL_NOTICE.exec(raw);
+	if (match === null) return {
+		text: raw,
+		spilled: false,
+		recovered: false
+	};
+	const filePath = match[1].trim();
+	const full = filePath === "" ? void 0 : await readSpillFile(filePath);
+	if (full !== void 0) return {
+		text: full,
+		spilled: true,
+		recovered: true
+	};
+	return {
+		text: raw.slice(0, match.index),
+		spilled: true,
+		recovered: false
+	};
+}
+/**
 * 剥离终端 ANSI/CSI 转义序列（如 `\x1b[31mFAIL\x1b[0m`）与回车符 `\r`。
 *
 * JSON 解码后，原先源码/日志里的 `\u001b[31m` 会还原成控制字符 `\x1b`；
@@ -25833,6 +26021,10 @@ function buildTestSections(evidence) {
 const SHELL_ERROR_LINE = /(?:error|fatal|panic|traceback|exception|EACCES|EPERM|ENOENT|EEXIST|ELIFECYCLE|ERR!|FAILED|permission denied|cannot |could not |not found)/i;
 /** TypeScript 编译器报错首行：`path(line,col): error TSxxxx:` 或 `path:line:col - error TSxxxx:`。 */
 const TS_DIAGNOSTIC_HEADER = /^(?:.+?\(\d+,\d+\):\s+error\s+TS\d+:|.+?:\d+:\d+\s+-\s+error\s+TS\d+:)/;
+/** shell 预览里最多列出的错误行数；超出的部分用 ref 提示补读。 */
+const SHELL_ERROR_MAX_LINES = 25;
+/** shell 预览里错误集最多占用的字符数（行数上限先到，这个只是兜底）。 */
+const SHELL_ERROR_MAX_CHARS = 6500;
 /**
 * 紧跟在 TypeScript 诊断首行后面的续行（缩进的类型比对、代码高亮行、波浪线指示行），
 * 最多连带收集 6 行，使模型无需补读就能看全 `Type A is not assignable to Type B` 的完整原因。
@@ -25959,15 +26151,27 @@ function buildShellSections(text) {
 		}
 		if (SHELL_ERROR_LINE.test(trimmed)) {
 			errorCount += 1;
-			errors.push(`  ${clip(trimmed, 360)}`);
+			errors.push(`  ${clip(trimmed, 240)}`);
 		}
 	}
 	if (errorCount > 300 || errors.length > 600) return void 0;
 	const exitMatch = /(?:exit code|exited with code|process exited with code)[:=\s]+(-?\d+)/i.exec(text) ?? /\[exit code: (-?\d+)\]/i.exec(text);
 	const sections = [];
 	if (exitMatch !== null) sections.push({ lines: [`exit code: ${exitMatch[1]}`] });
-	sections.push({ lines: [`errors: ${errorCount} (complete set)`] });
-	if (errors.length > 0) sections.push({ lines: errors });
+	const shownErrors = [];
+	let shownChars = 0;
+	for (const line of errors) {
+		if (shownErrors.length >= SHELL_ERROR_MAX_LINES) break;
+		if (shownChars + line.length + 1 > SHELL_ERROR_MAX_CHARS) break;
+		shownErrors.push(line);
+		shownChars += line.length + 1;
+	}
+	const truncated = shownErrors.length < errors.length;
+	sections.push({ lines: [truncated ? `errors: ${errorCount} (first ${shownErrors.length} shown; full set via ref)` : `errors: ${errorCount} (complete set)`] });
+	if (shownErrors.length > 0) {
+		const body = truncated ? [...shownErrors, `  … ${errors.length - shownErrors.length} more error lines (full list via ref)`] : shownErrors;
+		sections.push({ lines: body });
+	}
 	const nonEmpty = lines.map((line) => line.trimEnd()).filter((line) => line.trim() !== "");
 	const head = nonEmpty.slice(0, 5).map((line) => `  ${clip(line.trim(), 160)}`);
 	const tail = nonEmpty.slice(-5).map((line) => `  ${clip(line.trim(), 160)}`);
@@ -26183,6 +26387,42 @@ function planRetrievalOutline(text, toolName) {
 		};
 	}
 }
+/**
+* 读出装着日志字段的那个对象的元数据。
+* @param holder - 装着日志字段的对象（顶层信封或 1 层嵌套的内层对象）。
+* @returns 读到的元数据；两者都没有时 undefined。
+*/
+function shellMetadataOf(holder) {
+	const job = isPlainRecord(holder.job) ? holder.job : void 0;
+	let exitCode;
+	if (typeof holder.exitCode === "number" && Number.isFinite(holder.exitCode)) exitCode = holder.exitCode;
+	if (exitCode === void 0 && typeof job?.exitCode === "number" && Number.isFinite(job.exitCode)) exitCode = job.exitCode;
+	if (exitCode === void 0 && typeof job?.detail === "string") {
+		const matched = /(?:exit code|exited with code|process exited with code)\s*[:=]?\s*(-?\d+)/i.exec(job.detail);
+		if (matched !== null) exitCode = Number(matched[1]);
+	}
+	const status = typeof job?.status === "string" ? job.status : void 0;
+	if (exitCode === void 0 && status === void 0) return void 0;
+	return {
+		...exitCode === void 0 ? {} : { exitCode },
+		...status === void 0 ? {} : { status }
+	};
+}
+/**
+* 把信封里的退出码与状态补到 shell 预览的最前面。
+* @param sections - `buildShellSections` 交出来的段落。
+* @param meta - 信封元数据。
+* @returns 补过元数据的段落。
+*/
+function withShellMetadata(sections, meta) {
+	if (meta === void 0) return sections;
+	const lines = [];
+	const hasExit = sections.some((section) => section.lines[0]?.startsWith("exit code:"));
+	if (meta.exitCode !== void 0 && !hasExit) lines.push(`exit code: ${meta.exitCode}`);
+	if (meta.status !== void 0) lines.push(`status: ${meta.status}`);
+	if (lines.length === 0) return sections;
+	return [{ lines }, ...sections];
+}
 /** 契约/类型定义：命中两行以上声明就当它是契约，保持原样。 */
 function looksLikeContract(text) {
 	let declarations = 0;
@@ -26242,16 +26482,53 @@ function isJsonDocument(text) {
 	}
 	return false;
 }
-/** PTC `run_code` JSON envelope 中允许独立投影日志的字段白名单。 */
+/**
+* PTC `run_code` JSON envelope 中允许独立投影日志的字段白名单。
+*
+* `'text'` 在列：`tools.job_output` 返回的正是 `{ text, job }`，日志正文就叫 `text`。
+*/
 const JSON_ENVELOPE_LOG_KEYS = [
 	"stdout",
 	"stderr",
 	"output",
 	"logs",
-	"log"
+	"log",
+	"text"
 ];
 /** JSON envelope 其余字段允许占用的最大序列化字符数（防止把含批量源码的混合 envelope 压掉）。 */
 const JSON_ENVELOPE_MAX_OTHER_CHARS = 800;
+/** 判断一个值是不是普通 JSON 对象（不是数组，也不是 null）。 */
+function isPlainRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** 重建信封：只把预览写回被替换的键，其余字段原样保留。 */
+function rebuildEnvelope(binding, innerPreview) {
+	if (binding.nested === void 0) return JSON.stringify({
+		...binding.record,
+		[binding.key]: innerPreview
+	});
+	return JSON.stringify({
+		...binding.record,
+		[binding.nested.key]: {
+			...binding.nested.record,
+			[binding.key]: innerPreview
+		}
+	});
+}
+/** 信封外壳的序列化长度：被替换的字段先按空串算。 */
+function envelopeShellLength(binding) {
+	if (binding.nested === void 0) return JSON.stringify({
+		...binding.record,
+		[binding.key]: ""
+	}).length;
+	return JSON.stringify({
+		...binding.record,
+		[binding.nested.key]: {
+			...binding.nested.record,
+			[binding.key]: ""
+		}
+	}).length;
+}
 /**
 * 解开一层或两层 JSON 包装（支持顶层 JSON 字符串 `"..."` 或双重序列化的 `"{...}"`）。
 */
@@ -26295,10 +26572,10 @@ function parseJsonCandidate(text) {
 *
 * 规则刻意保守：
 * - 截断 JSON、数组一律返回 undefined；
+* - 白名单字段可以出现在**顶层**（`{ stdout: "..." }`），也可以出现在**1 层嵌套**里
+*   （`{ testOutput: { text: "...", job: {...} } }`，即 `tools.job_output` 的形状）；
 * - 对象 envelope 除白名单字段外，其余字段序列化后的总长度不超过 `JSON_ENVELOPE_MAX_OTHER_CHARS`；
-* - 解码并剥离 ANSI 后的日志文本自身必须能通过非源码/非契约的结构化日志投影计划；
-* - 返回的 `storeContent` 把解码后的多行日志直接展开（对象 envelope 还会把其余元数据缩进在头部），
-*   彻底避免单行 minified JSON 因没有真实 `\n` 导致 `store.page` 的按行分页失效。
+* - 解码并剥离 ANSI 后的日志文本自身必须能通过非源码/非契约的结构化日志投影计划。
 */
 function extractJsonEnvelopeLogField(text, toolName) {
 	const candidate = parseJsonCandidate(text);
@@ -26311,33 +26588,498 @@ function extractJsonEnvelopeLogField(text, toolName) {
 		return { plan };
 	}
 	const { record } = candidate;
-	let candidateKey;
-	let candidateText = "";
+	const candidates = [];
 	for (const key of JSON_ENVELOPE_LOG_KEYS) {
-		const val = record[key];
-		if (typeof val === "string" && val.length > candidateText.length) {
-			candidateKey = key;
-			candidateText = val;
+		const value = record[key];
+		if (typeof value === "string" && value.length > 0) candidates.push({
+			binding: {
+				record,
+				key
+			},
+			text: value
+		});
+	}
+	for (const [outerKey, outerValue] of Object.entries(record)) {
+		if (!isPlainRecord(outerValue)) continue;
+		for (const key of JSON_ENVELOPE_LOG_KEYS) {
+			const value = outerValue[key];
+			if (typeof value === "string" && value.length > 0) candidates.push({
+				binding: {
+					record,
+					key,
+					nested: {
+						key: outerKey,
+						record: outerValue
+					}
+				},
+				text: value
+			});
 		}
 	}
-	if (candidateKey === void 0 || candidateText.length === 0) return void 0;
+	if (candidates.length === 0) return void 0;
+	candidates.sort((left, right) => right.text.length - left.text.length);
+	const picked = candidates[0];
+	const binding = picked.binding;
+	const candidateText = picked.text;
+	const boundKey = binding.key;
+	const nested = binding.nested;
+	const holder = nested === void 0 ? record : nested.record;
 	const rest = {};
 	for (const [key, value] of Object.entries(record)) {
-		if (key === candidateKey) continue;
+		if (nested === void 0 ? key === boundKey : key === nested.key) continue;
 		if (typeof value === "string" && (value.length > 400 || looksLikeSourceCode(value) || looksLikeContract(value))) return;
 		rest[key] = value;
 	}
-	if (JSON.stringify(rest).length > JSON_ENVELOPE_MAX_OTHER_CHARS) return void 0;
+	let restJson;
+	if (nested === void 0) restJson = JSON.stringify(rest);
+	else {
+		const innerRest = {};
+		for (const [key, value] of Object.entries(nested.record)) {
+			if (key === boundKey) continue;
+			if (typeof value === "string" && (value.length > 400 || looksLikeSourceCode(value) || looksLikeContract(value))) return;
+			innerRest[key] = value;
+		}
+		restJson = JSON.stringify({
+			...rest,
+			[nested.key]: innerRest
+		});
+	}
+	if (restJson.length > JSON_ENVELOPE_MAX_OTHER_CHARS) return void 0;
 	const cleanField = stripAnsi(candidateText);
 	if (isJsonDocument(cleanField) || isMixedEvidenceOutput(cleanField)) return void 0;
 	const plan = planPlainTextProjection(cleanField, toolName);
-	if (plan.kind !== "preview") return void 0;
+	if (plan.kind !== "preview") {
+		if (plan.strategy === "verbatim-unparsed") {
+			const meta = shellMetadataOf(holder);
+			if (meta !== void 0) {
+				const sections = buildShellSections(cleanField);
+				if (sections !== void 0) return {
+					envelope: binding,
+					plan: {
+						kind: "preview",
+						strategy: "shell-output",
+						sections: withShellMetadata(sections, meta)
+					}
+				};
+			}
+		}
+		const multiSection = planMultiSectionProjection(cleanField);
+		if (multiSection !== void 0) return {
+			envelope: binding,
+			plan: multiSection
+		};
+		return;
+	}
+	return {
+		envelope: binding,
+		plan
+	};
+}
+/** 规范 glob 路径表。 */
+function canonicalGlobPaths(value) {
+	if (!Array.isArray(value) || value.length === 0) return void 0;
+	const paths = [];
+	for (const entry of value) {
+		if (typeof entry !== "string") return void 0;
+		paths.push(entry);
+	}
+	return paths;
+}
+/** 规范 grep 命中表。 */
+function canonicalGrepMatches(value) {
+	if (!Array.isArray(value) || value.length === 0) return void 0;
+	const matches = [];
+	for (const entry of value) {
+		if (!isPlainRecord(entry)) return void 0;
+		if (typeof entry.path !== "string") return void 0;
+		if (!Number.isSafeInteger(entry.lineNumber)) return void 0;
+		if (typeof entry.line !== "string") return void 0;
+		matches.push({
+			path: entry.path,
+			lineNumber: entry.lineNumber,
+			line: entry.line
+		});
+	}
+	return matches;
+}
+/** 规范读取结果。 */
+function canonicalReadResult(value) {
+	if (!isPlainRecord(value)) return void 0;
+	if (typeof value.path !== "string" || value.path.trim() === "") return void 0;
+	if (!Array.isArray(value.lines) || value.lines.length === 0) return void 0;
+	const lines = [];
+	for (const entry of value.lines) {
+		if (!isPlainRecord(entry)) return void 0;
+		if (!Number.isSafeInteger(entry.number)) return void 0;
+		if (typeof entry.text !== "string") return void 0;
+		lines.push({
+			number: entry.number,
+			text: entry.text
+		});
+	}
 	return {
-		envelope: {
+		path: value.path,
+		...typeof value.offset === "number" && Number.isFinite(value.offset) ? { offset: value.offset } : {},
+		lines
+	};
+}
+/** 在顶层或 1 层嵌套里找规范 grep 命中表。 */
+function findGrepBinding(record) {
+	const top = canonicalGrepMatches(record.matches);
+	if (top !== void 0) return {
+		binding: {
 			record,
-			key: candidateKey
+			key: "matches"
 		},
-		plan
+		matches: top
+	};
+	for (const [outerKey, outerValue] of Object.entries(record)) {
+		if (!isPlainRecord(outerValue)) continue;
+		const nested = canonicalGrepMatches(outerValue.matches);
+		if (nested !== void 0) return {
+			binding: {
+				record,
+				key: "matches",
+				nested: {
+					key: outerKey,
+					record: outerValue
+				}
+			},
+			matches: nested
+		};
+	}
+}
+/** 在顶层或 1 层嵌套里找规范 glob 路径表。 */
+function findGlobBinding(record) {
+	const top = canonicalGlobPaths(record.paths);
+	if (top !== void 0) return {
+		binding: {
+			record,
+			key: "paths"
+		},
+		paths: top,
+		...typeof record.root === "string" ? { root: record.root } : {}
+	};
+	for (const [outerKey, outerValue] of Object.entries(record)) {
+		if (!isPlainRecord(outerValue)) continue;
+		const nested = canonicalGlobPaths(outerValue.paths);
+		if (nested !== void 0) return {
+			binding: {
+				record,
+				key: "paths",
+				nested: {
+					key: outerKey,
+					record: outerValue
+				}
+			},
+			paths: nested,
+			...typeof outerValue.root === "string" ? { root: outerValue.root } : {}
+		};
+	}
+}
+/** grep 信封的预览段落：复用已有的完整计数策略。 */
+function buildGrepEnvelopeSections(matches) {
+	const files = /* @__PURE__ */ new Map();
+	for (const match of matches) {
+		const entry = files.get(match.path);
+		if (entry === void 0) files.set(match.path, {
+			count: 1,
+			first: match.line
+		});
+		else entry.count += 1;
+	}
+	return buildGrepSections({
+		files,
+		total: matches.length
+	});
+}
+/** glob 信封的预览段落：复用已有的扩展名分布策略。 */
+function buildGlobEnvelopeSections(paths, root) {
+	const sections = buildGlobSections(paths.join("\n"));
+	if (root === void 0) return sections;
+	return [{ lines: [`root: ${clip(root, 160)}`] }, ...sections];
+}
+/**
+* PTC 的结构化工具返回信封：`grep` 的 `matches` 与 `glob` 的 `paths`。
+*
+* 两种形状都认：顶层 `{ matches }` / `{ root, paths }`，以及 1 层嵌套
+* `{ batch: { matches } }` / `{ batch: { root, paths } }`。
+*
+* 落库用缩进 JSON 而不是原始的 minified 文本：minified 文本里没有真换行，
+* `store.page` 的「按行翻页」会退化成一次吐完一整行；缩进后每行一个字段，
+* 翻页干净，而且外层与内层的同级元数据一个不少。
+*/
+function extractStructuredToolEnvelope(text) {
+	const candidate = parseJsonCandidate(text);
+	if (candidate === void 0 || candidate.kind !== "object") return void 0;
+	const { record } = candidate;
+	if (collectCompositeEntries(record).length !== 1) return void 0;
+	const grep = findGrepBinding(record);
+	if (grep !== void 0) {
+		if (envelopeShellLength(grep.binding) > JSON_ENVELOPE_MAX_OTHER_CHARS) return void 0;
+		return {
+			binding: grep.binding,
+			plan: {
+				kind: "preview",
+				strategy: "grep-results",
+				sections: buildGrepEnvelopeSections(grep.matches)
+			},
+			storeContent: JSON.stringify(record, null, 2)
+		};
+	}
+	const glob = findGlobBinding(record);
+	if (glob !== void 0) {
+		if (envelopeShellLength(glob.binding) > JSON_ENVELOPE_MAX_OTHER_CHARS) return void 0;
+		return {
+			binding: glob.binding,
+			plan: {
+				kind: "preview",
+				strategy: "glob-results",
+				sections: buildGlobEnvelopeSections(glob.paths, glob.root)
+			},
+			storeContent: JSON.stringify(record, null, 2)
+		};
+	}
+}
+/** 日志正文的错误行数与尾部若干行。 */
+function logSummaryOf(text) {
+	const lines = text.split("\n").map((line) => line.trimEnd()).filter((line) => line.trim() !== "");
+	const errorLines = lines.filter((line) => SHELL_ERROR_LINE.test(line)).length;
+	const summary = [];
+	if (errorLines > 0) summary.push(`errors: ${errorLines}`);
+	for (const line of lines.slice(-2)) summary.push(clip(line.trim(), 160));
+	return summary;
+}
+/**
+* 把一个普通 JSON 对象分类成复合信封里的一个成员。
+*
+* 认得四种形状：读取结果、grep 命中表、glob 路径表、日志正文。
+* 分不出来就返回 undefined —— 宁可少认一个成员，也不把不相干的数据写进摘要。
+* @param key - 该成员所在的键。
+* @param value - 该成员的值。
+* @returns 识别出的成员，或 undefined。
+*/
+function classifyCompositeEntry(key, value) {
+	const jsonLength = JSON.stringify(value)?.length ?? 0;
+	const matches = canonicalGrepMatches(value.matches);
+	if (matches !== void 0) {
+		const counts = /* @__PURE__ */ new Map();
+		for (const match of matches) counts.set(match.path, (counts.get(match.path) ?? 0) + 1);
+		const files = [...counts.entries()].map(([path, count]) => ({
+			path,
+			count
+		})).sort((left, right) => right.count - left.count);
+		return {
+			kind: "grep",
+			key,
+			jsonLength,
+			total: matches.length,
+			files
+		};
+	}
+	const paths = canonicalGlobPaths(value.paths);
+	if (paths !== void 0) return {
+		kind: "glob",
+		key,
+		jsonLength,
+		count: paths.length,
+		...typeof value.root === "string" ? { root: value.root } : {},
+		sample: paths.slice(0, 3)
+	};
+	const read = canonicalReadResult(value);
+	if (read !== void 0) {
+		let first = Number.POSITIVE_INFINITY;
+		let last = Number.NEGATIVE_INFINITY;
+		for (const line of read.lines) {
+			if (line.number < first) first = line.number;
+			if (line.number > last) last = line.number;
+		}
+		return {
+			kind: "read",
+			key,
+			jsonLength,
+			path: read.path,
+			lineCount: read.lines.length,
+			first,
+			last,
+			firstLines: read.lines.slice(0, 2).map((line) => `${line.number}: ${line.text}`)
+		};
+	}
+	for (const logKey of JSON_ENVELOPE_LOG_KEYS) {
+		const logText = value[logKey];
+		if (typeof logText !== "string" || logText.length === 0) continue;
+		if (looksLikeSourceCode(logText) || looksLikeContract(logText) || isMixedEvidenceOutput(logText)) return void 0;
+		const meta = shellMetadataOf(value);
+		return {
+			kind: "log",
+			key,
+			jsonLength,
+			chars: logText.length,
+			...meta?.exitCode === void 0 ? {} : { exitCode: meta.exitCode },
+			...meta?.status === void 0 ? {} : { status: meta.status },
+			summary: logSummaryOf(logText)
+		};
+	}
+}
+/**
+* 收集一份 JSON 信封里的全部成员（顶层、1 层嵌套、数组元素）。
+* @param record - 顶层记录。
+* @returns 识别出的成员。
+*/
+function collectCompositeEntries(record) {
+	const entries = [];
+	const push = (key, value) => {
+		const entry = classifyCompositeEntry(key, value);
+		if (entry === void 0) return false;
+		entries.push(entry);
+		return true;
+	};
+	const root = classifyCompositeEntry("(root)", record);
+	if (root !== void 0) entries.push(root);
+	for (const [key, value] of Object.entries(record)) {
+		if (Array.isArray(value)) {
+			value.forEach((item, index) => {
+				if (isPlainRecord(item)) push(`${key}[${index}]`, item);
+			});
+			continue;
+		}
+		if (!isPlainRecord(value)) continue;
+		if (push(key, value)) continue;
+		for (const [subKey, subValue] of Object.entries(value)) if (isPlainRecord(subValue)) push(`${key}.${subKey}`, subValue);
+	}
+	return entries;
+}
+/** 复合信封的预览段落：逐个成员给出它是什么、有多大。 */
+function buildCompositeSections(entries) {
+	const allReads = entries.every((entry) => entry.kind === "read");
+	const shown = entries.slice(0, 20);
+	const summaries = [];
+	const firstLines = [];
+	const details = [];
+	for (const entry of shown) {
+		if (entry.kind === "read") {
+			summaries.push(`  ${clip(entry.key, 60)}: ${clip(entry.path, 120)} lines ${entry.first}-${entry.last} (${entry.lineCount})`);
+			continue;
+		}
+		if (entry.kind === "grep") {
+			summaries.push(`  ${clip(entry.key, 60)}: grep matches=${entry.total} across ${entry.files.length} files`);
+			for (const file of entry.files.slice(0, 3)) summaries.push(`    ${clip(file.path, 100)}: ${file.count}`);
+			continue;
+		}
+		if (entry.kind === "glob") {
+			const root = entry.root === void 0 ? "" : ` root=${clip(entry.root, 80)}`;
+			summaries.push(`  ${clip(entry.key, 60)}: glob paths=${entry.count}${root}`);
+			for (const sample of entry.sample) summaries.push(`    ${clip(sample, 140)}`);
+			continue;
+		}
+		const state = [entry.exitCode === void 0 ? "" : `exit code=${entry.exitCode}`, entry.status === void 0 ? "" : `status=${entry.status}`].filter((part) => part !== "").join(" ");
+		summaries.push(`  ${clip(entry.key, 60)}: log chars=${entry.chars}${state === "" ? "" : ` (${state})`}`);
+		for (const line of entry.summary) details.push(`      ${clip(line, 160)}`);
+	}
+	if (entries.length > shown.length) summaries.push(`  … ${entries.length - shown.length} more entries (full list via ref)`);
+	for (const entry of shown.slice(0, 3)) {
+		if (entry.kind !== "read") continue;
+		firstLines.push(`    ${clip(entry.path, 100)}`);
+		for (const line of entry.firstLines) firstLines.push(`      ${clip(line, 160)}`);
+	}
+	const sections = [{ lines: [allReads ? `reads: ${entries.length} (complete set)` : `results: ${entries.length} (complete set)`] }, { lines: summaries }];
+	const extra = [...firstLines, ...details];
+	if (extra.length > 0) sections.push({
+		lines: [allReads ? "first lines:" : "detail:", ...extra],
+		optional: true
+	});
+	return sections;
+}
+/**
+* 复合 JSON 信封的投影计划。
+*
+* 一份结果里混着多个成员（grep + read + glob + log）时，逐个成员摘要：
+* 模型要的是「这一趟拿到了什么、各自多大」，而不是某一份成员的完整正文。
+*
+* 触发条件：已经超长（或被 spill 截断）、成员不止一个、或单个成员本身就装不下预算。
+* @param text - 工具结果原文。
+* @param budgetMaxChars - 当前预览预算的字符上限。
+* @param oversized - 是否已经超长或被 spill 截断。
+* @returns 投影计划，或 undefined。
+*/
+function extractCompositeEnvelope(text, budgetMaxChars, oversized) {
+	const candidate = parseJsonCandidate(text);
+	if (candidate === void 0 || candidate.kind !== "object") return void 0;
+	const { record } = candidate;
+	const entries = collectCompositeEntries(record);
+	if (entries.length === 0) return void 0;
+	if (!(oversized || entries.length >= 2 || entries.some((entry) => entry.jsonLength > budgetMaxChars))) return void 0;
+	return {
+		kind: "preview",
+		strategy: "file-outline",
+		sections: buildCompositeSections(entries),
+		storeContent: JSON.stringify(record, null, 2)
+	};
+}
+/** 多节输出的分节头：整行大写，且至少含一个分隔符（空格、斜杠、连字符）。 */
+const MULTI_SECTION_HEADER = /^[A-Z][A-Z0-9]*(?:[ _/()-][A-Z0-9]+)*$/;
+/** 判断一行是不是分节头；光秃秃一个大写词不算一节。 */
+function isMultiSectionHeader(trimmed) {
+	if (trimmed.length < 4) return false;
+	if (!MULTI_SECTION_HEADER.test(trimmed)) return false;
+	return /[ _/-]/.test(trimmed);
+}
+/** 多节输出的预览段落：分了几节、每节多少行与行范围、每节前几行。 */
+function buildMultiSectionSections(text) {
+	const lines = text.split("\n");
+	const headers = [];
+	for (let index = 0; index < lines.length; index += 1) {
+		const trimmed = lines[index].trim();
+		if (!isMultiSectionHeader(trimmed)) continue;
+		if ((lines[index + 1] ?? "").trim() === "") continue;
+		headers.push({
+			name: trimmed,
+			start: index
+		});
+	}
+	if (headers.length < 2) return void 0;
+	const summaries = [];
+	const firstLines = [];
+	for (let index = 0; index < headers.length; index += 1) {
+		const header = headers[index];
+		const end = headers[index + 1]?.start ?? lines.length;
+		const body = lines.slice(header.start + 1, end).map((line) => line.trimEnd()).filter((line) => line.trim() !== "");
+		let first = Number.POSITIVE_INFINITY;
+		let last = Number.NEGATIVE_INFINITY;
+		for (const line of body) {
+			const matched = /^\s*(\d+)(?::|\t|\|)/.exec(line);
+			if (matched === null) continue;
+			const number = Number(matched[1]);
+			if (number < first) first = number;
+			if (number > last) last = number;
+		}
+		const range = Number.isFinite(first) && Number.isFinite(last) ? ` (${first}-${last})` : "";
+		summaries.push(`  ${clip(header.name, 80)}: ${body.length} lines${range}`);
+	}
+	for (let index = 0; index < Math.min(headers.length, 3); index += 1) {
+		const header = headers[index];
+		const end = headers[index + 1]?.start ?? lines.length;
+		const body = lines.slice(header.start + 1, end).map((line) => line.trim()).filter((line) => line !== "");
+		firstLines.push(`    ${clip(header.name, 80)}`);
+		for (const line of body.slice(0, 2)) firstLines.push(`      ${clip(line, 160)}`);
+	}
+	return [
+		{ lines: [`sections: ${headers.length} (complete set)`] },
+		{ lines: summaries },
+		{
+			lines: ["first lines:", ...firstLines],
+			optional: true
+		}
+	];
+}
+/** 多节输出的投影计划。 */
+function planMultiSectionProjection(text) {
+	const sections = buildMultiSectionSections(text);
+	if (sections === void 0) return void 0;
+	return {
+		kind: "preview",
+		strategy: "structured-rows",
+		sections
 	};
 }
 /** 对一段纯文本（非 JSON 文档）做投影计划判定。 */
@@ -26398,8 +27140,11 @@ function planPlainTextProjection(rawText, toolName) {
 * 然后是 JSON envelope（只允许纯日志字段投影，混合证据一律原样），
 * 接着是测试失败集、grep、结构化、glob、shell 这些有明确形状的，
 * 最后落到「无法解析 → 原样」。
+*
+* `spilled` 与超长门槛决定多节/多读输出还有没有资格进新投影：
+* 短于门槛、又没有 spill 的普通源码与契约读一律逐字保留。
 */
-function planProjection(text, toolName, navigation, retrievalOnly) {
+function planProjection(text, toolName, navigation, retrievalOnly, spilled = false, budgetMaxChars = Number.POSITIVE_INFINITY) {
 	if (TOOL_SUBAGENT.test(toolName)) return {
 		kind: "verbatim",
 		strategy: "verbatim-subagent-report"
@@ -26409,10 +27154,21 @@ function planProjection(text, toolName, navigation, retrievalOnly) {
 		kind: "verbatim",
 		strategy: "verbatim-intent"
 	};
-	if (TOOL_SOURCE.test(toolName) && navigation !== true) return {
-		kind: "verbatim",
-		strategy: "verbatim-source-code"
-	};
+	const oversized = text.length >= MULTI_OUTPUT_MIN_CHARS || spilled;
+	if (TOOL_SOURCE.test(toolName) && navigation !== true) {
+		if (oversized && !isJsonDocument(text)) {
+			const multiSection = planMultiSectionProjection(text);
+			if (multiSection !== void 0) return multiSection;
+		}
+		return {
+			kind: "verbatim",
+			strategy: "verbatim-source-code"
+		};
+	}
+	if (oversized && !isJsonDocument(text)) {
+		const multiSection = planMultiSectionProjection(text);
+		if (multiSection !== void 0) return multiSection;
+	}
 	if (looksLikeContract(text)) return {
 		kind: "verbatim",
 		strategy: "verbatim-contract"
@@ -26430,6 +27186,14 @@ function planProjection(text, toolName, navigation, retrievalOnly) {
 		if (outline !== void 0) return outline;
 	}
 	if (isJsonDocument(text)) {
+		const structuredTool = extractStructuredToolEnvelope(text);
+		if (structuredTool !== void 0) return {
+			kind: "preview",
+			strategy: structuredTool.plan.strategy,
+			sections: structuredTool.plan.sections,
+			envelope: structuredTool.binding,
+			storeContent: structuredTool.storeContent
+		};
 		const extracted = extractJsonEnvelopeLogField(text, toolName);
 		if (extracted !== void 0) return {
 			kind: "preview",
@@ -26437,6 +27201,8 @@ function planProjection(text, toolName, navigation, retrievalOnly) {
 			sections: extracted.plan.sections,
 			...extracted.envelope === void 0 ? {} : { envelope: extracted.envelope }
 		};
+		const composite = extractCompositeEnvelope(text, budgetMaxChars, oversized);
+		if (composite !== void 0) return composite;
 		return {
 			kind: "verbatim",
 			strategy: "verbatim-unparsed"
@@ -26455,34 +27221,30 @@ function footerFor(refId) {
 * 入库失败一律降级为「保持原样」—— 没有 ref 的预览等于把原文丢了。
 */
 async function decide(args) {
-	const { text, input, budget } = args;
+	const { input, budget } = args;
+	const spill = await resolveSpillText(args.text);
+	const text = spill.text;
 	if (text.length <= budget.maxChars) return { reason: "verbatim-small" };
-	const plan = planProjection(text, input.toolName, input.navigation, input.retrievalOnly);
+	const plan = planProjection(text, input.toolName, input.navigation, input.retrievalOnly, spill.spilled, budget.maxChars);
 	if (plan.kind === "verbatim") return { reason: plan.strategy };
 	if (input.isError === true && plan.strategy !== "test-failure" && plan.strategy !== "shell-output") return { reason: "verbatim-unparsed" };
 	const header = `[cache-warmup preview] strategy=${plan.strategy} input=${text.length}ch`;
 	const footerBudget = footerFor(`ref://${input.sessionId}/${"0".repeat(64)}`).length;
 	const jsonEscaped = plan.envelope !== void 0;
-	const envelopeShellLength = plan.envelope === void 0 ? 0 : JSON.stringify({
-		...plan.envelope.record,
-		[plan.envelope.key]: ""
-	}).length;
-	const bodyBudget = budget.maxChars - header.length - footerBudget - envelopeShellLength - (jsonEscaped ? 4 : 2);
+	const envelopeShell = plan.envelope === void 0 ? 0 : envelopeShellLength(plan.envelope);
+	const bodyBudget = budget.maxChars - header.length - footerBudget - envelopeShell - (jsonEscaped ? 4 : 2);
 	if (bodyBudget <= 0) return { reason: "verbatim-budget" };
 	const body = fitSections(plan.sections, bodyBudget, jsonEscaped);
 	if (body === void 0) return { reason: "verbatim-budget" };
 	const store = input.store;
 	if (store === void 0) return { reason: "store-unavailable" };
 	const placeholderInner = `${header}\n${body}\n${footerFor(`ref://${input.sessionId}/${"0".repeat(64)}`)}`;
-	if ((plan.envelope === void 0 ? placeholderInner : JSON.stringify({
-		...plan.envelope.record,
-		[plan.envelope.key]: placeholderInner
-	})).length > budget.maxChars) return { reason: "verbatim-budget" };
+	if ((plan.envelope === void 0 ? placeholderInner : rebuildEnvelope(plan.envelope, placeholderInner)).length > budget.maxChars) return { reason: "verbatim-budget" };
 	let reference;
 	try {
 		reference = await store.put({
 			sessionId: input.sessionId,
-			content: text,
+			content: plan.storeContent ?? text,
 			toolName: input.toolName,
 			at: args.at
 		});
@@ -26490,15 +27252,13 @@ async function decide(args) {
 		return { reason: "store-unavailable" };
 	}
 	const innerPreview = `${header}\n${body}\n${footerFor(reference.refId)}`;
-	const preview = plan.envelope === void 0 ? innerPreview : JSON.stringify({
-		...plan.envelope.record,
-		[plan.envelope.key]: innerPreview
-	});
+	const preview = plan.envelope === void 0 ? innerPreview : rebuildEnvelope(plan.envelope, innerPreview);
 	if (preview.length > budget.maxChars) return { reason: "verbatim-budget" };
 	return {
 		preview,
 		refId: reference.refId,
-		strategy: plan.strategy
+		strategy: plan.strategy,
+		inputChars: text.length
 	};
 }
 /** 块数组里文本字符数的合计。 */
@@ -26525,9 +27285,8 @@ async function projectToolResult(input) {
 		at
 	};
 	if (typeof input.content === "string") {
-		const text = input.content;
 		const decision = await decide({
-			text,
+			text: input.content,
 			input,
 			budget,
 			at
@@ -26537,8 +27296,8 @@ async function projectToolResult(input) {
 			content: input.content,
 			changed: false,
 			metrics: {
-				inputChars: text.length,
-				outputChars: text.length,
+				inputChars: input.content.length,
+				outputChars: input.content.length,
 				omittedChars: 0,
 				strategy: decision.reason
 			}
@@ -26550,9 +27309,9 @@ async function projectToolResult(input) {
 			refId: decision.refId,
 			preview: decision.preview,
 			metrics: {
-				inputChars: text.length,
+				inputChars: decision.inputChars,
 				outputChars: decision.preview.length,
-				omittedChars: Math.max(0, text.length - decision.preview.length),
+				omittedChars: Math.max(0, decision.inputChars - decision.preview.length),
 				strategy: decision.strategy
 			}
 		};
@@ -26602,15 +27361,26 @@ async function projectToolResult(input) {
 		refId: decision.refId,
 		preview: decision.preview,
 		metrics: {
-			inputChars: text.length,
+			inputChars: decision.inputChars,
 			outputChars: decision.preview.length,
-			omittedChars: Math.max(0, text.length - decision.preview.length),
+			omittedChars: Math.max(0, decision.inputChars - decision.preview.length),
 			strategy: decision.strategy
 		}
 	};
 }
 //#endregion
 //#region src/host/common/request-images.ts
+/**
+* Image resolution, byte budgeting and data-URL handling for one request.
+*
+* Shared by the provider lines that send inline images, because the budget is a
+* property of the deployment rather than of any one endpoint, and because two
+* lines that budget differently send different request bytes for the same picture.
+*
+* The notable decision is SCALE, not drop: see {@link resolveRequestImages}.
+*
+* @module dsh-chatgpt-subscription/request-images
+*/
 function isRecord$50(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -26708,7 +27478,7 @@ function base64Length$1(bytes) {
 * the only estimate available, so it stays the fallback and every call site that
 * has no resolved map behaves exactly as before.
 */
-function requestImagePayloadLength(block, images) {
+function inlinePayloadOf(block) {
 	let data = asString$21(block.data) || asString$21(block.base64);
 	const source = isRecord$50(block.source) ? block.source : void 0;
 	if (!data && source) data = asString$21(source.data) || asString$21(source.base64);
@@ -26716,7 +27486,11 @@ function requestImagePayloadLength(block, images) {
 		const matched = data.match(/^data:([^;,]+);base64,(.*)$/s);
 		if (matched) data = matched[2] ?? "";
 	}
-	if (data) return data.length;
+	return data === void 0 || data === "" ? void 0 : data;
+}
+function requestImagePayloadLength(block, images) {
+	const data = inlinePayloadOf(block);
+	if (data !== void 0) return data.length;
 	const attachment = attachmentOf$3(block);
 	if (!attachment) return void 0;
 	if (images === void 0) return base64Length$1(attachment.bytes);
@@ -26901,6 +27675,186 @@ function offloadOldestRequestImages$1(options, maxBytes = MAX_REQUEST_IMAGE_BYTE
 	return replaceOldestRequestImages(options, imagesToOffloadCount(requestImagePayloadLengths(options, images), maxBytes), images);
 }
 /**
+* A stable identity for one image occurrence.
+*
+* Two occurrences of the SAME picture have to share one identity, and that
+* identity has to survive the turn: a durable attachment keeps its id, and an
+* inline payload keeps its bytes, so hashing the payload names the same
+* picture the same way on every later request.
+*
+* `undefined` for a block that carries no sendable payload: an image that
+* resolved to `unavailable` is serialized as a short text placeholder, so it
+* is not an image on the wire and has nothing to remember.
+*/
+function requestImageKey(block, images) {
+	if (requestImagePayloadLength(block, images) === void 0) return void 0;
+	const attachment = attachmentOf$3(block);
+	if (attachment !== void 0) return `attachment:${attachment.attachmentId}`;
+	const data = inlinePayloadOf(block);
+	if (data === void 0) return void 0;
+	return `inline:${createHash("sha256").update(data).digest("hex")}`;
+}
+/**
+* Every sendable image occurrence one request carries, in request order.
+*
+* The traversal is the one `collectRequestImagePayloads` uses, tool results
+* included: a screenshot inside a tool result reaches the wire, so an
+* occurrence the budget cannot see is an occurrence it cannot budget for.
+*/
+function collectImageOccurrences(options, images) {
+	const occurrences = [];
+	const walk = (content) => {
+		if (!Array.isArray(content)) return;
+		for (const block of content) {
+			if (!isRecord$50(block)) continue;
+			if (block.type === "image") {
+				const bytes = requestImagePayloadLength(block, images);
+				const key = requestImageKey(block, images);
+				if (bytes !== void 0 && key !== void 0) occurrences.push({
+					key,
+					bytes
+				});
+				continue;
+			}
+			if (block.type === "tool-result") walk(block.content);
+		}
+	};
+	for (const message of options.messages) walk(message.content);
+	return occurrences;
+}
+/**
+* The identities of the images one request still carries, each once.
+*
+* The caller compares two of these to learn what a later build gave back: the
+* difference names the images a body-fit pass dropped after the budget pass
+* had already run.
+*/
+function collectRemainingImageKeys(options, images) {
+	const keys = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const occurrence of collectImageOccurrences(options, images)) {
+		if (seen.has(occurrence.key)) continue;
+		seen.add(occurrence.key);
+		keys.push(occurrence.key);
+	}
+	return keys;
+}
+/**
+* Replace every occurrence of a dropped image with the placeholder.
+*
+* Unlike {@link replaceOldestRequestImages} this replaces by IDENTITY rather
+* than by position: a sticky budget drops a picture, and the picture has to
+* stay dropped for the rest of the session wherever it appears.
+*/
+function replaceDroppedRequestImages(options, droppedKeys, images) {
+	if (droppedKeys.size === 0) return {
+		options,
+		count: 0
+	};
+	let count = 0;
+	const replaceIn = (content) => {
+		if (!Array.isArray(content)) return {
+			content,
+			replaced: false
+		};
+		let replaced = false;
+		return {
+			content: content.map((block) => {
+				if (!isRecord$50(block)) return block;
+				if (block.type === "image") {
+					const key = requestImageKey(block, images);
+					if (key === void 0 || !droppedKeys.has(key)) return block;
+					replaced = true;
+					count += 1;
+					return {
+						type: "text",
+						text: OMITTED_IMAGE_TEXT$1
+					};
+				}
+				if (block.type === "tool-result" && Array.isArray(block.content)) {
+					const inner = replaceIn(block.content);
+					if (!inner.replaced) return block;
+					replaced = true;
+					return {
+						...block,
+						content: inner.content
+					};
+				}
+				return block;
+			}),
+			replaced
+		};
+	};
+	let changed = false;
+	const messages = options.messages.map((message) => {
+		const result = replaceIn(message.content);
+		if (!result.replaced) return message;
+		changed = true;
+		return {
+			...message,
+			content: result.content
+		};
+	});
+	return {
+		options: changed ? {
+			...options,
+			messages
+		} : options,
+		count
+	};
+}
+/**
+* Offload images against a budget that RECOVERS instead of a budget that resets.
+*
+* WHY THE TWO WATERMARKS. A single ceiling makes the retained prefix depend
+* on the request: two conversations carrying the same images drop a different
+* number of them as one more image arrives, so the prefix the service cached
+* is rewritten on the next turn and the cache is cold again. Native `kimi-cli`
+* therefore keeps a HIGH mark (20 MiB) and a LOW mark (10 MiB): the request
+* is allowed to grow to the high mark, and once it passes it, the oldest
+* images are given back until the request is back under the LOW mark. The gap
+* between the two is the slack that keeps the number of retained images — and
+* therefore the cached prefix — stable across turns.
+*
+* WHY THE DROPS ARE STICKY. The images a request gives back are replaced for
+* the REST of the session: `priorDroppedKeys` carries the identities a
+* previous turn already dropped, and they are replaced again here. A picture
+* that was omitted stays omitted, so the request the service caches stops
+* changing once the session has settled under its low mark.
+*
+* @param options - the request to budget.
+* @param maxBytes - high-water mark; images are untouched below it.
+* @param lowBytes - low-water mark; the trimming stops once the request is back under it.
+* @param images - the resolution the request will be sent with.
+* @param priorDroppedKeys - identities dropped by earlier turns.
+*/
+function offloadRequestImagesWithStickyBudget(options, maxBytes = MAX_REQUEST_IMAGE_BYTES$1, lowBytes = Math.max(1, Math.floor(maxBytes / 2)), images, priorDroppedKeys) {
+	const allDroppedKeys = new Set(priorDroppedKeys ?? []);
+	const pending = /* @__PURE__ */ new Map();
+	for (const occurrence of collectImageOccurrences(options, images)) {
+		if (allDroppedKeys.has(occurrence.key)) continue;
+		pending.set(occurrence.key, (pending.get(occurrence.key) ?? 0) + occurrence.bytes);
+	}
+	let total = 0;
+	for (const bytes of pending.values()) total += bytes;
+	const newlyDroppedKeys = [];
+	if (total > maxBytes) for (const [key, bytes] of pending) {
+		if (total <= lowBytes) break;
+		if (bytes === 0) continue;
+		allDroppedKeys.add(key);
+		newlyDroppedKeys.push(key);
+		total -= bytes;
+	}
+	const replaced = replaceDroppedRequestImages(options, allDroppedKeys, images);
+	return {
+		options: replaced.options,
+		remainingBytes: total,
+		droppedCount: replaced.count,
+		newlyDroppedKeys,
+		allDroppedKeys
+	};
+}
+/**
 * Whether a request still carries at least one image the mapper can send.
 *
 * A request whose images have all been replaced by placeholders can no longer
@@ -27462,11 +28416,26 @@ function effectiveContextWindow(tokenWindow, env = process.env) {
 /**
 * Base64 image payload one request on this route may carry.
 *
-* Sized to leave room for the conversation inside the body ceiling above, which
-* is why it is the smaller of the two. DSH_KIMI_CODE_MAX_IMAGE_BYTES overrides it
-* under the same rules: ignored, never applied as a disabled guard.
+* Kimi's own CLI budgets request media at 20 MiB (REQUEST_MEDIA_BUDGET_BYTES),
+* and this route now speaks the same number. The previous 1.5 MB figure was
+* Kimi's TEXT-and-image body ceiling applied to the images alone, which threw
+* away pictures the service was perfectly willing to accept: a conversation
+* that carried three screenshots lost two of them to a limit that never
+* existed upstream.
+*
+* DSH_KIMI_CODE_MAX_IMAGE_BYTES overrides it under the same rules: ignored,
+* never applied as a disabled guard.
+*/
+const DEFAULT_MAX_REQUEST_IMAGE_BYTES$1 = 20 * 1024 * 1024;
+/**
+* The mark the request is brought back under once it has passed the high one.
+*
+* Half the high mark, exactly as the official client does
+* (REQUEST_MEDIA_BUDGET_LOW_BYTES). The gap between the two is the slack that
+* keeps the number of retained images stable from turn to turn, and a stable
+* image count is what keeps the cached prefix valid.
 */
-const DEFAULT_MAX_REQUEST_IMAGE_BYTES$1 = MAX_REQUEST_IMAGE_BYTES$1;
+const DEFAULT_LOW_REQUEST_IMAGE_BYTES = 10 * 1024 * 1024;
 /** Image budget this process enforces, honouring the deployment override. */
 function maxRequestImageBytes$1(env = process.env) {
 	const raw = (env.DSH_KIMI_CODE_MAX_IMAGE_BYTES ?? "").trim();
@@ -27476,6 +28445,22 @@ function maxRequestImageBytes$1(env = process.env) {
 	return Math.floor(parsed);
 }
 /**
+* The low-water mark this process enforces, honouring the deployment override.
+*
+* Half of whatever the deployment pinned, so an override moves both marks
+* together: a deployment that lowers the ceiling to 4 MB gets a 2 MB low mark
+* rather than the built-in 10 MB, which would let every request sit above the
+* mark it is supposed to recover to. A deployment that pins nothing gets
+* Kimi's own 10 MiB.
+*/
+function lowRequestImageBytes(env = process.env) {
+	const raw = (env.DSH_KIMI_CODE_MAX_IMAGE_BYTES ?? "").trim();
+	if (raw === "") return DEFAULT_LOW_REQUEST_IMAGE_BYTES;
+	const parsed = Number(raw);
+	if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_LOW_REQUEST_IMAGE_BYTES;
+	return Math.max(1, Math.floor(Math.floor(parsed) / 2));
+}
+/**
 * Which wire dialect a model id is served over.
 *
 * Always the OpenAI-compatible chat completions dialect: this line uses that one
@@ -27943,7 +28928,7 @@ async function persistRegion(region) {
 */
 const lastActiveBySession = /* @__PURE__ */ new Map();
 /** Bound on remembered sessions. */
-const MAX_TRACKED_SESSIONS$1 = 256;
+const MAX_TRACKED_SESSIONS$2 = 256;
 /**
 * Note that a session just did something.
 *
@@ -27956,7 +28941,7 @@ function markSessionActive(sessionId, now = Date.now()) {
 	const key = sessionId.trim();
 	lastActiveBySession.delete(key);
 	lastActiveBySession.set(key, now);
-	if (lastActiveBySession.size <= MAX_TRACKED_SESSIONS$1) return;
+	if (lastActiveBySession.size <= MAX_TRACKED_SESSIONS$2) return;
 	const oldest = lastActiveBySession.keys().next();
 	if (oldest.done !== true) lastActiveBySession.delete(oldest.value);
 }
@@ -31190,6 +32175,110 @@ function buildOpenAIRequest(options, images = NO_RESOLVED_IMAGES$3, preserveThin
 	return body;
 }
 /**
+* How the side-channel title request opens its prompt.
+*
+* Matching the opening identifies the request even when the provenance stamp
+* is absent - a harness generation that does not stamp it still asks for the
+* title in exactly this wording.
+*/
+const TITLE_REQUEST_PROMPT_PREFIX = "Generate the session title from this JSON array of human messages:";
+/**
+* How the side-channel title request opens its system prompt.
+*
+* Only a request that carries NO tools can be the title request: the real
+* conversation always carries the session's tool set, so the (absent) tool
+* list is what separates the two shapes.
+*/
+const TITLE_REQUEST_SYSTEM_PREFIX = "Create a concise title for an AI coding-assistant session";
+/**
+* The first non-empty text a message body contributes.
+*
+* The same ordering {@link textOf} folds a body in, but it stops at the first
+* contribution instead of joining all of them: a caller that only needs to know
+* where the text STARTS must not pay for the whole conversation. The join in
+* {@link textOf} puts the blocks in order and the empty ones contribute
+* nothing, so the first non-empty contribution is where the joined text begins.
+*
+* @param content - The body of one message.
+* @returns The first non-empty text it contributes, or undefined.
+*/
+function firstTextOf(content) {
+	if (typeof content === "string") {
+		const text = sanitizeText$7(content);
+		return text === "" ? void 0 : text;
+	}
+	if (!Array.isArray(content)) return void 0;
+	for (const block of content) {
+		if (!isRecord$45(block)) continue;
+		if (block.type === "text" && typeof block.text === "string") {
+			const text = sanitizeText$7(block.text);
+			if (text !== "") return text;
+			continue;
+		}
+		if (block.type === "tool-result") {
+			const nested = firstTextOf(block.content);
+			if (nested !== void 0) return nested;
+		}
+	}
+}
+/**
+* The text the folded system prompt starts with.
+*
+* Same ordering as {@link leadingSystemText}: `options.system` leads, and the
+* system-role messages follow in history order. Only the first contribution
+* matters here, so the scan stops at it.
+*
+* @param options - The request being inspected.
+* @returns The leading text of the system prompt, or undefined when there is none.
+*/
+function leadingSystemTextStart(options) {
+	if (typeof options.system === "string" && options.system.trim() !== "") return options.system;
+	for (const message of options.messages) {
+		if (message.role !== "system") continue;
+		if (messageToolsOf(message) !== void 0) continue;
+		const text = firstTextOf(message.content);
+		if (text !== void 0) return text;
+	}
+}
+/**
+* Whether this request is the side-channel one that titles a session.
+*
+* A title request is asked on the same adapter, under the same session id, and
+* with the same credential as the conversation it titles - but it shares
+* nothing else with it. Left alone it would:
+*
+* - send the session's prompt cache key, so the service would route the title
+*   prompt at the entry the conversation cached;
+* - overwrite the session's prefix snapshot, so the next real turn would be
+*   told its system prompt or its tool list changed; and
+* - file its usage under the session, so the session's cache ratio would
+*   describe a prompt the session never sent.
+*
+* The detection is deliberately structural rather than a flag on the options:
+* the caller is the harness, and the harness states a title request by its
+* CONTENT, not by anything this route could switch on.
+*
+* @param options - The request about to be mapped.
+* @returns Whether the request is the side-channel title request.
+*/
+function isSideChannelTitleRequest(options) {
+	if (options === void 0 || options === null) return false;
+	const messages = Array.isArray(options.messages) ? options.messages : [];
+	const tools = options.tools;
+	const toolLess = tools === void 0 || tools.length === 0;
+	for (const message of messages) {
+		if (!isRecord$45(message)) continue;
+		if (message.source?.kind === "dsh-session-title-llm") return true;
+		const text = firstTextOf(message.content);
+		if (toolLess && text !== void 0 && text.startsWith(TITLE_REQUEST_PROMPT_PREFIX)) return true;
+	}
+	if (toolLess) {
+		const systemText = leadingSystemTextStart(options);
+		if (systemText !== void 0 && systemText.startsWith(TITLE_REQUEST_SYSTEM_PREFIX)) return true;
+	}
+	return false;
+}
+/**
 * Stable identifier for the conversation this request belongs to.
 *
 * The key is derived from the session identifier alone — never from message
@@ -31202,6 +32291,7 @@ function buildOpenAIRequest(options, images = NO_RESOLVED_IMAGES$3, preserveThin
 * all rather than a key that will drift.
 */
 function promptCacheKey(options) {
+	if (isSideChannelTitleRequest(options)) return void 0;
 	if (typeof options.sessionId === "string" && options.sessionId.trim() !== "") return `dsh-${options.sessionId.trim()}`;
 }
 function anthropicUserContent$2(message, images, toolCallIds) {
@@ -31344,7 +32434,9 @@ function buildAnthropicRequest(options, images = NO_RESOLVED_IMAGES$3, media = {
 }
 /** Build the body for whichever endpoint serves `wire`. */
 function buildRequest(options, wire, images = NO_RESOLVED_IMAGES$3, preserveThinking = preserveThinkingEnabled(), media = {}) {
-	recordDriftCause(trackPrefixStability(options), options.sessionId);
+	if (isSideChannelTitleRequest(options)) return wire === "anthropic" ? buildAnthropicRequest(options, images, media) : buildOpenAIRequest(options, images, preserveThinking, media);
+	const cause = trackPrefixStability(options);
+	recordDriftCause(cause === "stable" && (pendingImageOffloads.get(cacheScopeKey(options.sessionId)) ?? 0) > 0 ? "image-offload" : cause, options.sessionId, options);
 	return wire === "anthropic" ? buildAnthropicRequest(options, images, media) : buildOpenAIRequest(options, images, preserveThinking, media);
 }
 /**
@@ -31441,10 +32533,11 @@ function oversizedBodyMessage(bytes, limit, body, context) {
 	const parts = requestBodyBreakdown(body);
 	return `Kimi Code rejected the request before sending: the serialized body is ${bytes} bytes, above the ${limit}-byte limit this route enforces. Composition: ${`images ${parts.imageBytes} bytes, tool schemas ${parts.toolSchemaBytes} bytes, conversation text and system prompt ${parts.otherBytes} bytes`}. ${bodyFitRemedy(parts, context)}`;
 }
-function createStreamState$5(wire, sessionId) {
+function createStreamState$5(wire, sessionId, sideChannel = false) {
 	return {
 		wire,
 		sessionId: typeof sessionId === "string" && sessionId.trim() !== "" ? sessionId.trim() : void 0,
+		sideChannel,
 		blocks: [],
 		current: null,
 		reasoningRuns: /* @__PURE__ */ new Map(),
@@ -31871,7 +32964,7 @@ const UNSCOPED_CACHE_KEY = "";
 * count: eviction only begins once a host has served hundreds of them, and it
 * evicts the least recently written key, which is a stale session by then.
 */
-const MAX_TRACKED_SESSIONS = 256;
+const MAX_TRACKED_SESSIONS$1 = 256;
 /**
 * Composite key separating one session's numbers from another's.
 *
@@ -31889,7 +32982,7 @@ function cacheScopeKey(sessionId, accountId) {
 function rememberScoped(store, key, value) {
 	store.delete(key);
 	store.set(key, value);
-	if (store.size <= MAX_TRACKED_SESSIONS) return;
+	if (store.size <= MAX_TRACKED_SESSIONS$1) return;
 	const oldest = store.keys().next();
 	if (oldest.done !== true) store.delete(oldest.value);
 }
@@ -31904,19 +32997,31 @@ function rememberScoped(store, key, value) {
 */
 const prefixSnapshots = /* @__PURE__ */ new Map();
 /**
+* Hash the prefix-breaking inputs of one request.
+*
+* @param options - The request about to be built.
+* @returns The hashes of its system prompt and its tool list.
+*/
+function prefixFingerprints(options) {
+	const systemText = leadingSystemText$7(options) ?? "";
+	const tools = options.tools ?? [];
+	return {
+		systemPromptHash: systemText === "" ? null : fingerprint(systemText),
+		toolsHash: tools.length === 0 ? null : fingerprint(JSON.stringify(tools.map((tool) => [
+			tool.name,
+			tool.description ?? "",
+			tool.parameters ?? {}
+		])))
+	};
+}
+/**
 * Fingerprint the current request's stability inputs and diff them against the
 * last request. Called once per request build; the result is read back when the
 * stream reports usage so a low-or-zero cache read can be explained.
 */
 function trackPrefixStability(options) {
-	const systemText = leadingSystemText$7(options) ?? "";
-	const systemPromptHash = systemText === "" ? null : fingerprint(systemText);
-	const tools = options.tools ?? [];
-	const toolsHash = tools.length === 0 ? null : fingerprint(JSON.stringify(tools.map((tool) => [
-		tool.name,
-		tool.description ?? "",
-		tool.parameters ?? {}
-	])));
+	if (isSideChannelTitleRequest(options)) return "stable";
+	const { systemPromptHash, toolsHash } = prefixFingerprints(options);
 	const cacheKey = promptCacheKey(options) ?? null;
 	const scope = cacheScopeKey(options.sessionId);
 	const previous = prefixSnapshots.get(scope);
@@ -31934,8 +33039,16 @@ function trackPrefixStability(options) {
 }
 /** Drift cause recorded for each session. */
 const driftCauses = /* @__PURE__ */ new Map();
-/** Record the cause computed for one in-flight request. */
-function recordDriftCause(cause, sessionId) {
+/**
+* Record the cause computed for one in-flight request.
+*
+* The options are optional and only used to recognise a side-channel request:
+* a title request carries its own prefix, so attributing it to the session
+* would blame the session's next cache miss on the title request's system
+* prompt or on its (absent) tool list.
+*/
+function recordDriftCause(cause, sessionId, options) {
+	if (options !== void 0 && isSideChannelTitleRequest(options)) return;
 	rememberScoped(driftCauses, cacheScopeKey(sessionId), cause);
 }
 /**
@@ -31948,6 +33061,94 @@ function recordDriftCause(cause, sessionId) {
 function getLastDriftCause(sessionId) {
 	return driftCauses.get(cacheScopeKey(sessionId));
 }
+/**
+* Image identities this session has given back to the image budget.
+*
+* Scoped per session for the same reason the prefix snapshots are: DSH runs
+* several conversations — and subagents — at once, so one process-wide set
+* would let one conversation's omission replace another conversation's image.
+*/
+const sessionDroppedImageKeys = /* @__PURE__ */ new Map();
+/**
+* What the most recent request of one session carried, in image bytes.
+*/
+const sessionImageBudgetStats = /* @__PURE__ */ new Map();
+/**
+* Images the request CURRENTLY BEING BUILT has already dropped.
+*
+* Separate from {@link sessionDroppedImageKeys} because the two answer
+* different questions: the set is what the session remembers, and this counter
+* is what the request in flight did. The counter is what lets the drift
+* attribution name the offload, whichever order the build and the recording
+* happen in.
+*/
+const pendingImageOffloads = /* @__PURE__ */ new Map();
+/**
+* The image identities this session has already dropped.
+*
+* `durableDropped` seeds the memory the first time a session is asked about,
+* so a session that ran before the restart keeps the omissions it made: the
+* budget is sticky, and a picture that was given back must stay given back.
+*/
+function getSessionDroppedImageKeys(sessionId, durableDropped) {
+	if (sessionId === void 0 || sessionId.trim() === "") return /* @__PURE__ */ new Set();
+	const scope = cacheScopeKey(sessionId);
+	const existing = sessionDroppedImageKeys.get(scope);
+	if (existing !== void 0) return existing;
+	const seeded = /* @__PURE__ */ new Set();
+	for (const key of durableDropped ?? []) if (typeof key === "string" && key !== "") seeded.add(key);
+	rememberScoped(sessionDroppedImageKeys, scope, seeded);
+	return seeded;
+}
+/**
+* Note that the request being built has dropped images, before its body is built.
+*
+* The drift attribution reads this back when the prefix is fingerprinted, so
+* the order of the two does not matter: a request that drops an image is
+* attributed to the offload whether the body was built before or after the
+* drop was recorded.
+*/
+function markPendingImageOffload(sessionId, newlyDroppedCount) {
+	const scope = cacheScopeKey(sessionId);
+	if (newlyDroppedCount <= 0) {
+		pendingImageOffloads.delete(scope);
+		return;
+	}
+	rememberScoped(pendingImageOffloads, scope, newlyDroppedCount);
+}
+/**
+* Record what one request's image budget did.
+*
+* The dropped identities are kept for the whole session: the budget is sticky,
+* so an image given back stays given back, and the next turn has to know
+* which ones those are.
+*/
+function recordSessionImageBudget(sessionId, input, options) {
+	const scope = cacheScopeKey(sessionId);
+	const named = sessionId !== void 0 && sessionId.trim() !== "";
+	const keys = named ? sessionDroppedImageKeys.get(scope) ?? /* @__PURE__ */ new Set() : /* @__PURE__ */ new Set();
+	if (named) {
+		for (const key of input.allDroppedKeys) if (typeof key === "string" && key !== "") keys.add(key);
+		rememberScoped(sessionDroppedImageKeys, scope, keys);
+	}
+	rememberScoped(sessionImageBudgetStats, scope, {
+		requestImageBytes: input.requestImageBytes,
+		droppedImages: input.droppedImages,
+		droppedKeys: named ? [...keys] : []
+	});
+	markPendingImageOffload(sessionId, input.newlyDroppedCount);
+	if (input.newlyDroppedCount > 0 && getLastDriftCause(sessionId) === "stable") recordDriftCause("image-offload", sessionId, options);
+}
+/**
+* What one session's last request carried of images, when it is known.
+*
+* `undefined` for a session that has not sent a request, rather than a zeroed
+* answer: "no request yet" and "a request that carried no images" are
+* different facts.
+*/
+function getSessionImageBudgetStats(sessionId) {
+	return sessionImageBudgetStats.get(cacheScopeKey(sessionId));
+}
 /** Last lift per session. */
 const thinkingCoercions = /* @__PURE__ */ new Map();
 /**
@@ -32025,6 +33226,7 @@ const EMPTY_CACHE_STATS = {
 /** Record one request's usage into its own session's totals. */
 function recordCacheStats(state, sessionId, accountId) {
 	if (!state.sawUsage) return;
+	if (state.sideChannel) return;
 	const scope = cacheScopeKey(sessionId ?? state.sessionId, accountId);
 	const previous = cacheStatsByScope.get(scope) ?? EMPTY_CACHE_STATS;
 	rememberScoped(cacheStatsByScope, scope, {
@@ -32326,6 +33528,9 @@ function normalizeRecord(value) {
 	if (lastActiveAt === void 0 || updatedAt === void 0) return void 0;
 	const drift = typeof value.lastDrift === "string" && value.lastDrift !== "" ? value.lastDrift : void 0;
 	const warmupStreak = count$1(value.warmupConsecutiveHits);
+	const budgetDropped = droppedImageKeys(value.budgetDropped);
+	const lastRequestImageBytes = nonNegative(value.lastRequestImageBytes);
+	const lastDroppedImages = nonNegative(value.lastDroppedImages);
 	return {
 		lastActiveAt,
 		updatedAt,
@@ -32338,10 +33543,46 @@ function normalizeRecord(value) {
 		cacheWrite5mTokens: count$1(value.cacheWrite5mTokens),
 		cacheWrite1hTokens: count$1(value.cacheWrite1hTokens),
 		...drift === void 0 ? {} : { lastDrift: drift },
-		...warmupStreak > 0 ? { warmupConsecutiveHits: warmupStreak } : {}
+		...warmupStreak > 0 ? { warmupConsecutiveHits: warmupStreak } : {},
+		...budgetDropped.length > 0 ? { budgetDropped } : {},
+		...lastRequestImageBytes === void 0 ? {} : { lastRequestImageBytes },
+		...lastDroppedImages === void 0 ? {} : { lastDroppedImages }
 	};
 }
 /**
+* How many dropped image identities one record keeps.
+*
+* A session that pastes hundreds of pictures would otherwise grow this
+* document without bound, and it is a diagnostic file: the identities that
+* matter are the ones a later turn still has to replace.
+*/
+const MAX_BUDGET_DROPPED_KEYS = 512;
+/**
+* The dropped image identities a stored record carries.
+*
+* Only non-empty strings, deduplicated and capped: the file is written from
+* whatever the process happened to hold, and a malformed entry must not take
+* the record down with it.
+*/
+function droppedImageKeys(value) {
+	if (!Array.isArray(value)) return [];
+	const keys = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of value) {
+		if (typeof entry !== "string" || entry === "") continue;
+		if (seen.has(entry)) continue;
+		seen.add(entry);
+		keys.push(entry);
+		if (keys.length >= MAX_BUDGET_DROPPED_KEYS) break;
+	}
+	return keys;
+}
+/** A stored byte or image count, or undefined when the field is absent or absurd. */
+function nonNegative(value) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) return void 0;
+	return Math.floor(value);
+}
+/**
 * Combine process memory with the durable record into the hint's two inputs.
 *
 * The process supplies the idle baseline whenever it has served the conversation,
@@ -33451,6 +34692,155 @@ function toolUpdateMode$1(modelId, catalog) {
 	].includes(raw)) return void 0;
 	return "in-history";
 }
+/**
+* How long a cold-start follower waits for the leader warming the same prefix.
+*
+* The leader only has to reach the response headers: past that the service is
+* already processing the prefix, and a follower that waited out the whole
+* budget would have lost more than the shared warm-up was worth.
+*/
+const COLD_START_WARMUP_WAIT_MS = 2500;
+/** How many prefix groups are remembered as warm. */
+const MAX_WARM_PREFIX_GROUPS = 256;
+/**
+* When each prefix group was last warmed.
+*
+* An entry older than the cache lifetime is treated as cold, because the
+* service's own entry is gone by then too. Bounded, so a long-lived process
+* cannot accumulate one entry per distinct prefix forever.
+*/
+const warmPrefixTimestamps = /* @__PURE__ */ new Map();
+/**
+* The request currently warming each prefix group.
+*
+* The promise is resolved when that leader reaches the response headers, which
+* is what releases the followers waiting behind it.
+*/
+const inFlightColdLeaders = /* @__PURE__ */ new Map();
+/** When each leader started, so a hung leader does not own its group forever. */
+const inFlightColdLeaderStartedAt = /* @__PURE__ */ new Map();
+/**
+* The resolver belonging to each in-flight leader.
+*
+* Kept beside the promise it settles, because a promise cannot be resolved
+* from the outside.
+*/
+const coldLeaderReleases = /* @__PURE__ */ new Map();
+/** The gate of a request that neither waits for nor leads a cold start. */
+const NO_COLD_START_GATE = {
+	isLeader: false,
+	release: () => void 0,
+	markWarm: () => void 0
+};
+/**
+* The group of requests that address the same cached prefix.
+*
+* The service derives its cache from the request content, so two requests with
+* the same model, the same system prompt and the same tool list hit the same
+* entry. The region is part of the key because each region is a separate
+* service with a cache of its own.
+*
+* A request with no system prompt has no prefix worth warming, and gets no
+* group at all.
+*
+* @param region - The region the request will be answered from.
+* @param options - The request about to be sent.
+* @returns The group key, or undefined when the request has no prefix.
+*/
+function coldStartGroupKey(region, options) {
+	const { systemPromptHash, toolsHash } = prefixFingerprints(options);
+	if (systemPromptHash === null) return void 0;
+	return `${region}:${options.model}:${systemPromptHash}:${toolsHash ?? "none"}`;
+}
+/**
+* Remember that a prefix group is warm.
+*
+* @param groupKey - The group that was just warmed.
+*/
+function rememberWarmPrefix(groupKey) {
+	warmPrefixTimestamps.delete(groupKey);
+	warmPrefixTimestamps.set(groupKey, Date.now());
+	while (warmPrefixTimestamps.size > MAX_WARM_PREFIX_GROUPS) {
+		const oldest = warmPrefixTimestamps.keys().next();
+		if (oldest.done === true) break;
+		warmPrefixTimestamps.delete(oldest.value);
+	}
+}
+/**
+* Wait for the leader of a prefix group, for the wait budget, or for an abort.
+*
+* The timer and the abort listener are removed whichever way the race ends, so
+* a follower that proceeds leaves neither behind.
+*
+* @param leader - The promise the in-flight leader settles.
+* @param signal - The caller's abort signal; an abort ends the wait.
+*/
+function raceColdStartLeader(leader, signal) {
+	const cleanups = [];
+	const budget = new Promise((resolve) => {
+		const timer = setTimeout(() => resolve(), COLD_START_WARMUP_WAIT_MS);
+		cleanups.push(() => clearTimeout(timer));
+	});
+	const aborted = new Promise((resolve) => {
+		if (signal.aborted) {
+			resolve();
+			return;
+		}
+		const onAbort = () => resolve();
+		signal.addEventListener("abort", onAbort, { once: true });
+		cleanups.push(() => signal.removeEventListener("abort", onAbort));
+	});
+	return Promise.race([
+		leader,
+		budget,
+		aborted
+	]).finally(() => {
+		for (const cleanup of cleanups) cleanup();
+	});
+}
+/**
+* Join the cold-start singleflight for one prefix group.
+*
+* A warm group returns at once. A cold group that already has a leader waits
+* for that leader — but never longer than {@link COLD_START_WARMUP_WAIT_MS}.
+* A cold group with no leader becomes the leader itself.
+*
+* @param groupKey - The prefix group this request belongs to.
+* @param signal - The caller's abort signal; an abort ends the wait.
+* @returns The gate this request holds.
+*/
+async function acquireColdStartWarmup(groupKey, signal) {
+	const warmedAt = warmPrefixTimestamps.get(groupKey);
+	if (warmedAt !== void 0 && Date.now() - warmedAt < 15e5) return NO_COLD_START_GATE;
+	if (inFlightColdLeaders.get(groupKey) !== void 0) {
+		const startedAt = inFlightColdLeaderStartedAt.get(groupKey);
+		if (startedAt !== void 0 && Date.now() - startedAt >= 2500) coldLeaderReleases.get(groupKey)?.();
+	}
+	const leader = inFlightColdLeaders.get(groupKey);
+	if (leader !== void 0) {
+		await raceColdStartLeader(leader, signal);
+		return NO_COLD_START_GATE;
+	}
+	let resolveLeader;
+	const promise = new Promise((resolve) => {
+		resolveLeader = resolve;
+	});
+	inFlightColdLeaders.set(groupKey, promise);
+	inFlightColdLeaderStartedAt.set(groupKey, Date.now());
+	const release = () => {
+		resolveLeader();
+		if (coldLeaderReleases.get(groupKey) !== release) return;
+		coldLeaderReleases.delete(groupKey);
+		inFlightColdLeaders.delete(groupKey);
+		inFlightColdLeaderStartedAt.delete(groupKey);
+	};
+	coldLeaderReleases.set(groupKey, release);
+	return {
+		isLeader: true,
+		release,
+		markWarm: () => rememberWarmPrefix(groupKey)
+	};
+}
 /** Sessions already told that their prefix broke, so the log stays readable. */
 const driftWarned = /* @__PURE__ */ new Set();
 /**
@@ -33476,6 +34866,13 @@ function noteSessionCacheState(sessionId, state) {
 	const lastDrift = getLastDriftCause(sessionId);
 	reportDriftCause(sessionId, lastDrift);
 	const now = Date.now();
+	const imageBudget = getSessionImageBudgetStats(sessionId);
+	const priorRecord = sessionCacheState.read(sessionId);
+	const budgetDropped = imageBudget !== void 0 && imageBudget.droppedKeys.length > 0 ? imageBudget.droppedKeys : priorRecord?.budgetDropped;
+	const liveBytes = imageBudget?.requestImageBytes ?? 0;
+	const liveDropped = imageBudget?.droppedImages ?? 0;
+	const lastRequestImageBytes = liveBytes > 0 ? liveBytes : priorRecord?.lastRequestImageBytes;
+	const lastDroppedImages = liveDropped > 0 ? liveDropped : priorRecord?.lastDroppedImages;
 	sessionCacheState.write(sessionId, {
 		lastActiveAt: now,
 		totalTokens: state.cacheReadTokens + state.inputTokens,
@@ -33487,6 +34884,9 @@ function noteSessionCacheState(sessionId, state) {
 		cacheWrite5mTokens: stats.cacheWrite5mTokens,
 		cacheWrite1hTokens: stats.cacheWrite1hTokens,
 		...lastDrift === void 0 ? {} : { lastDrift },
+		...budgetDropped === void 0 ? {} : { budgetDropped },
+		...lastRequestImageBytes === void 0 ? {} : { lastRequestImageBytes },
+		...lastDroppedImages === void 0 ? {} : { lastDroppedImages },
 		updatedAt: now
 	});
 	const warmupState = recordCacheWarmupUsage({
@@ -33714,8 +35114,12 @@ var KimiCodeAdapter = class extends LlmAdapter {
 		const wire = wireForCatalogEntry(options.model, catalog);
 		const entry = catalog.find((model) => model.id === options.model);
 		const normalized = normalizeGenerateOptions(options);
+		const sideChannel = isSideChannelTitleRequest(normalized);
 		const images = await resolveRequestImages$1(normalized, this.options.attachments, signal, KIMI_CODE_REQUEST_IMAGE_MAX_EDGE);
-		const imageTrimmed = offloadOldestRequestImages$1(normalized, maxRequestImageBytes$1(), images);
+		const priorDroppedKeys = getSessionDroppedImageKeys(options.sessionId, options.sessionId === void 0 ? void 0 : sessionCacheState.read(options.sessionId)?.budgetDropped);
+		const stickyOffload = offloadRequestImagesWithStickyBudget(normalized, maxRequestImageBytes$1(), lowRequestImageBytes(), images, priorDroppedKeys);
+		const imageTrimmed = stickyOffload.options;
+		if (!sideChannel) markPendingImageOffload(options.sessionId, stickyOffload.newlyDroppedKeys.length);
 		const gatedEffort = coerceThinkingEffort(options.model, mapReasoningEffort(options.reasoningEffort === void 0 || options.reasoningEffort === null ? void 0 : String(options.reasoningEffort)));
 		if (gatedEffort.coercedFrom !== null) recordThinkingCoercion({
 			model: options.model,
@@ -33891,7 +35295,22 @@ var KimiCodeAdapter = class extends LlmAdapter {
 					throw new LlmError(`Kimi Code request failed: ${error instanceof Error ? error.message : String(error)}`, "TRANSPORT", { cause: error });
 				}
 			};
-			response = await post(body);
+			const coldGroupKey = sideChannel ? void 0 : coldStartGroupKey(region, requestOptions);
+			const coldGate = coldGroupKey === void 0 ? void 0 : await acquireColdStartWarmup(coldGroupKey, signal);
+			let coldGateSettled = false;
+			const settleColdGate = (warm) => {
+				if (coldGateSettled) return;
+				coldGateSettled = true;
+				coldGate?.release();
+				if (warm) coldGate?.markWarm();
+			};
+			response = await post(body).then((value) => {
+				settleColdGate(value.ok);
+				return value;
+			}, (error) => {
+				settleColdGate(false);
+				throw error;
+			});
 			let detail = response.ok ? "" : (await response.text().catch(() => "")).slice(0, 2e3);
 			if (response.status === 404 && uploads !== void 0 && uploads.cited.length > 0 && isMissingResourceBody(detail)) {
 				const uploader = this.mediaFiles();
@@ -33935,12 +35354,25 @@ var KimiCodeAdapter = class extends LlmAdapter {
 				...after === void 0 ? {} : { providerRetryAfterMs: after }
 			});
 		}
+		if (measured !== void 0 && !sideChannel) {
+			const requestImageBytes = requestImagePayloadLengths(measured.options, images).reduce((sum, bytes) => sum + bytes, 0);
+			const trimmedKeys = new Set(collectRemainingImageKeys(imageTrimmed, images));
+			const measuredKeys = new Set(collectRemainingImageKeys(measured.options, images));
+			const bodyFitDroppedKeys = [...trimmedKeys].filter((key) => !measuredKeys.has(key));
+			const allDroppedKeys = /* @__PURE__ */ new Set([...stickyOffload.allDroppedKeys, ...bodyFitDroppedKeys]);
+			recordSessionImageBudget(options.sessionId, {
+				allDroppedKeys,
+				newlyDroppedCount: stickyOffload.newlyDroppedKeys.length + bodyFitDroppedKeys.length,
+				requestImageBytes,
+				droppedImages: stickyOffload.droppedCount + bodyFitDroppedKeys.length
+			}, requestOptions);
+		}
 		if (response.body === null) throw new LlmError("Kimi Code returned an empty response body", "PROVIDER_ERROR");
 		const reader = response.body.getReader();
 		const decoder = new TextDecoder();
-		const state = createStreamState$5(wire, requestOptions.sessionId);
+		const state = createStreamState$5(wire, requestOptions.sessionId, sideChannel);
 		applyCacheWriteTiers(state, response.headers);
-		markSessionActive(requestOptions.sessionId);
+		if (!sideChannel) markSessionActive(requestOptions.sessionId);
 		let buffer = "";
 		/**
 		* Set the moment ANY chunk reaches the caller, and never cleared.
@@ -33986,7 +35418,7 @@ var KimiCodeAdapter = class extends LlmAdapter {
 				throw streamFailure(error, signal);
 			}
 		} finally {
-			if (state.sawUsage) noteSessionCacheState(requestOptions.sessionId ?? state.sessionId, state);
+			if (state.sawUsage && !sideChannel) noteSessionCacheState(requestOptions.sessionId ?? state.sessionId, state);
 			reader.cancel().catch(() => void 0);
 		}
 	}
@@ -34505,6 +35937,7 @@ function cacheStatsOrNull(sessionId) {
 		...stats,
 		...lastDrift === void 0 ? {} : { lastDrift },
 		...warmup === void 0 ? {} : { warmup },
+		imageBudget: imageBudgetOf(sessionId),
 		cacheWriteTokens: stats.cacheWriteTokens,
 		cacheWrite5mTokens: stats.cacheWrite5mTokens,
 		cacheWrite1hTokens: stats.cacheWrite1hTokens
@@ -34557,7 +35990,28 @@ function durableCacheStats(sessionId) {
 		cacheWrite5mTokens: durable.cacheWrite5mTokens,
 		cacheWrite1hTokens: durable.cacheWrite1hTokens,
 		...lastDrift === void 0 ? {} : { lastDrift },
-		...warmup === void 0 ? {} : { warmup }
+		...warmup === void 0 ? {} : { warmup },
+		imageBudget: imageBudgetOf(sessionId)
+	};
+}
+/**
+* The image budget this route enforces and what the last turn of one session
+* spent of it.
+*
+* The live numbers win over the durable ones, because the durable record
+* describes the last run of this machine and the live numbers describe the
+* request that actually went out. The ceilings are read from the environment
+* every time, so a deployment that pinned a different budget sees its own
+* number rather than the built-in one.
+*/
+function imageBudgetOf(sessionId) {
+	const live = getSessionImageBudgetStats(sessionId);
+	const durable = sessionCacheState.read(sessionId);
+	return {
+		budgetBytes: maxRequestImageBytes$1(),
+		lowBudgetBytes: lowRequestImageBytes(),
+		requestImageBytes: live?.requestImageBytes ?? durable?.lastRequestImageBytes ?? 0,
+		droppedImages: live?.droppedImages ?? durable?.lastDroppedImages ?? 0
 	};
 }
 /**
@@ -34574,7 +36028,8 @@ function driftCauseOf(value) {
 		case "system-prompt":
 		case "tools":
 		case "cache-key":
-		case "cold-key": return value;
+		case "cold-key":
+		case "image-offload": return value;
 		default: return;
 	}
 }
@@ -43711,7 +45166,7 @@ function ms(value) {
 	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
 /** A non-empty string, or undefined. */
-function text$2(value) {
+function text$3(value) {
 	return typeof value === "string" && value !== "" ? value : void 0;
 }
 function withTimeout$6(signal, ms_) {
@@ -43806,9 +45261,9 @@ async function callAcrossHosts(input) {
 function parseResetCard(raw) {
 	const row = asRecord$9(raw);
 	if (row === void 0) return void 0;
-	const cardId = text$2(row.card_id);
-	const sourceType = text$2(row.source_type);
-	const outBizNo = text$2(row.out_biz_no);
+	const cardId = text$3(row.card_id);
+	const sourceType = text$3(row.source_type);
+	const outBizNo = text$3(row.out_biz_no);
 	const expiresAtMs = ms(row.expire_time);
 	const createdAtMs = ms(row.create_time);
 	if (cardId === void 0 || sourceType === void 0 || outBizNo === void 0) return void 0;
@@ -43831,8 +45286,8 @@ function parseResetCard(raw) {
 function parseResetCardFlow(raw) {
 	const row = asRecord$9(raw);
 	if (row === void 0) return void 0;
-	const cardId = text$2(row.card_id);
-	const eventType = text$2(row.event_type);
+	const cardId = text$3(row.card_id);
+	const eventType = text$3(row.event_type);
 	const createdAtMs = ms(row.create_time);
 	if (cardId === void 0 || createdAtMs === void 0) return void 0;
 	if (eventType !== "GRANT" && eventType !== "USE") return void 0;
@@ -43930,7 +45385,7 @@ async function useResetCard(credentials, card, options = {}) {
 		}),
 		options
 	});
-	const outcome = text$2(asRecord$9(payload)?.outcome);
+	const outcome = text$3(asRecord$9(payload)?.outcome);
 	if (outcome === void 0 || !RESET_OUTCOMES.has(outcome)) throw new MinimaxCodeResetCardError("reset-card use answered without a usable outcome", null, readStatusCode(payload));
 	return outcome;
 }
@@ -68764,7 +70219,7 @@ function createClinePassStore({ historyLimit = 100 } = {}) {
 *
 * @module dsh-chatgpt-subscription/cline-pass-tools
 */
-function text$1(value) {
+function text$2(value) {
 	return [{
 		type: "text",
 		text: value
@@ -69038,7 +70493,7 @@ function registerClinePassTools(ctx, options) {
 					}
 				}
 			},
-			render: (_args, value) => text$1([
+			render: (_args, value) => text$2([
 				`${value.displayName} provider "cline-pass" @ ${value.baseURL}`,
 				`route registered=${value.routeRegistered}`,
 				`accountMode=${value.accountMode}`,
@@ -69132,7 +70587,7 @@ function registerClinePassTools(ctx, options) {
 					if (model.lastProvider !== "") lines.push(`  last=${model.lastProvider} (${model.lastMs}ms)`);
 					return lines.join("\n");
 				});
-				return text$1([
+				return text$2([
 					`${value.models.length} Cline Pass model(s); official catalog=${value.catalogCount}${value.catalogSources.length === 0 ? "" : ` via ${value.catalogSources.join(",")}`}`,
 					...value.added.length === 0 ? [] : [`newly adopted: ${value.added.join(", ")}`],
 					...blocks
@@ -69269,8 +70724,8 @@ function registerClinePassTools(ctx, options) {
 				}
 			},
 			render: (_args, value) => {
-				if (!value.ok) return text$1(`probe ${value.model} failed: ${value.error}`);
-				return text$1([
+				if (!value.ok) return text$2(`probe ${value.model} failed: ${value.error}`);
+				return text$2([
 					`probe ${value.model}: ok in ${value.ms}ms`,
 					`pipeline=${value.pipeline} pinnable=${value.pinnable} canonicalSlug=${value.canonicalSlug || "-"} lastProvider=${value.lastProvider || "-"}`,
 					value.upstreams.length === 0 ? "upstreams: (none discovered)" : `upstreams (${value.upstreams.length}): ${value.upstreams.join(", ")}`,
@@ -69357,8 +70812,8 @@ function registerClinePassTools(ctx, options) {
 				}
 			},
 			render: (_args, value) => {
-				if (!value.ok) return text$1(`validate ${value.model} failed: ${value.error}`);
-				return text$1([
+				if (!value.ok) return text$2(`validate ${value.model} failed: ${value.error}`);
+				return text$2([
 					`validate ${value.model}: ${value.results.length} upstream(s)`,
 					`available=${value.summary.ok} rate-limited=${value.summary.limited} not-pinnable=${value.summary.bad} auth-failed=${value.summary.auth} unknown=${value.summary.unknown}`,
 					...value.results.map((entry) => `${entry.upstream}: ${statusLabel(entry.status)} (${entry.ms}ms)${entry.note === "" ? "" : ` — ${entry.note}`}`)
@@ -69478,7 +70933,7 @@ function registerClinePassTools(ctx, options) {
 			},
 			render: (_args, value) => {
 				const trace = value.trace.map((entry) => `  ${entry.upstream} -> HTTP ${entry.status} in ${entry.ms}ms${entry.note === "" ? "" : ` — ${entry.note}`}`);
-				return text$1([
+				return text$2([
 					value.ok ? `test ${value.model}: ok in ${value.ms}ms via ${value.actual || "(unknown)"}` : `test ${value.model}: FAILED — ${value.error}`,
 					...value.warnings.map((warning) => `⚠ ${warning}`),
 					trace.length === 0 ? "" : `attempts (${trace.length}):`,
@@ -69598,7 +71053,7 @@ function registerClinePassTools(ctx, options) {
 					}
 				}
 			},
-			render: (_args, value) => text$1([
+			render: (_args, value) => text$2([
 				`pinned ${value.model}`,
 				`upstreams: ${value.pinned.length === 0 ? "(auto)" : value.pinned.join(" > ")}`,
 				`exclude: ${value.excluded.length === 0 ? "(none)" : value.excluded.join(", ")}`,
@@ -69708,7 +71163,7 @@ function registerClinePassTools(ctx, options) {
 					}
 				}
 			},
-			render: (_args, value) => text$1([
+			render: (_args, value) => text$2([
 				`accounts.${value.action}: ${value.ok ? "ok" : "FAILED"}`,
 				value.note === "" ? "" : `note: ${value.note}`,
 				...value.accounts.map((account) => `  ${account.alias} (${account.id})${account.enabled ? "" : " (disabled)"}${account.authStatus ? ` [${account.authStatus}]` : ""}`)
@@ -69843,8 +71298,8 @@ function registerClinePassTools(ctx, options) {
 				}
 			},
 			render: (_args, value) => {
-				if (value.entries.length === 0) return text$1("No Cline Pass model calls recorded yet in this process.");
-				return text$1([`last ${value.entries.length} of ${value.total} call(s):`, ...value.entries.map((entry) => `${entry.ts === 0 ? "-" : new Date(entry.ts).toISOString()} ${entry.model} -> ${entry.provider || "(auto)"} ${entry.ttft > 0 ? `${entry.ttft}ms` : "—"}/${entry.ms}ms account=${entry.account || "-"}${entry.error === "" ? "" : ` error=${entry.error}`}`)].join("\n"));
+				if (value.entries.length === 0) return text$2("No Cline Pass model calls recorded yet in this process.");
+				return text$2([`last ${value.entries.length} of ${value.total} call(s):`, ...value.entries.map((entry) => `${entry.ts === 0 ? "-" : new Date(entry.ts).toISOString()} ${entry.model} -> ${entry.provider || "(auto)"} ${entry.ttft > 0 ? `${entry.ttft}ms` : "—"}/${entry.ms}ms account=${entry.account || "-"}${entry.error === "" ? "" : ` error=${entry.error}`}`)].join("\n"));
 			}
 		},
 		async execute(args) {
@@ -80176,6 +81631,124 @@ function subagentModelSelectionPreference(settings) {
 	}
 }
 /**
+* Main-model route per root Session, locked the first time it is observed.
+*
+* Without this, a mid-session model switch would silently re-point a Session's
+* child allowlist: the guard would start answering with a different main model's
+* routes, so the routes advertised in the prompt change, the prefix cache is
+* invalidated, and a model can be handed a list its own earlier turn contradicted.
+* Locking the FIRST resolved route keeps one Session's delegation policy stable
+* for its whole life, which is the same promise the durable policy event makes.
+*
+* Keyed weakly by the root Session object, so a closed Session's entry goes with
+* it. A Session object that is not an object (a minimal fixture) is simply not
+* locked.
+*/
+const lockedRootMainRoutes = /* @__PURE__ */ new WeakMap();
+/**
+* Authorized child routes per root Session, locked the first time they are used.
+*
+* Locking the main ROUTE is not enough on its own: the route is only the key
+* into `byMainModel`, and the list it resolves to is read from the live
+* preference on every step. A Settings edit made at step 5 of a running session
+* would therefore swap the list under it — the prompt-assembly hook rewrites the
+* `subagent` tool description and the `tools:sdk` section from that list, so the
+* next request would carry a different prefix, drop the provider's prefix cache,
+* and contradict the Settings card's promise that a routing change applies to
+* new sessions only. The first resolved list is frozen here for the same reason
+* the durable policy event is a snapshot: one Session is governed by one policy.
+*/
+const lockedRootAllowedRoutes = /* @__PURE__ */ new WeakMap();
+/**
+* Narrow one candidate route pair into an exact route.
+* @param provider - Candidate provider id.
+* @param model - Candidate model id.
+* @returns the route, or undefined unless both halves are non-empty strings.
+*/
+function routeOf(provider, model) {
+	const providerId = asString$3(provider);
+	const modelId = asString$3(model);
+	if (providerId === void 0 || modelId === void 0) return void 0;
+	if (providerId.length === 0 || modelId.length === 0) return void 0;
+	return {
+		provider: providerId,
+		model: modelId
+	};
+}
+/**
+* Read the route a Session's next request uses, when its header names one.
+* @param session - Session whose request header is read.
+* @returns the exact route, or undefined when the header is absent or silent.
+*/
+function headerRouteOf(session) {
+	let header;
+	try {
+		header = session?.requestHeader?.();
+	} catch {
+		return;
+	}
+	return routeOf(header?.config?.provider, header?.config?.model);
+}
+/**
+* Resolve the top-level Session of one agent's lineage, together with the route
+* its main model runs on.
+*
+* The main model is a property of the ROOT Session: a child subagent's own route
+* is the child's, and reading it would authorize children by what a child chose
+* rather than by what the user's main agent is. Walking up through
+* `header.parentSession` finds that root, and the root's route is read from its
+* own header (or, for an agent that IS the root, from the live model accessor and
+* then the delegation hint, which is what an unstarted Session has).
+*
+* Once resolved for a Session that has already sent a request, the route is
+* locked in {@link lockedRootMainRoutes}, so the answer never drifts mid-session.
+* @param agent - Calling agent.
+* @param sessions - Session registry used for ancestor lookup.
+* @param modelSelectionHint - Route fields the caller already resolved.
+* @param lockSnapshot - Lock even a route that has no request header yet; the
+*   prompt-assembly, post-execute and denial paths pass true, so a Session's
+*   first turn fixes its policy for the rest of its life.
+* @returns the root Session (when one exists) and the main route (when known).
+*/
+function resolveRootSessionAndMainRoute(agent, sessions, modelSelectionHint, lockSnapshot = false) {
+	let rootSession = agent?.session;
+	for (let depth = 0; depth < 8 && rootSession !== void 0; depth += 1) {
+		const header = rootSession.header;
+		if (header?.origin !== "subagent") break;
+		const parentId = asString$3(header.parentSession);
+		if (parentId === void 0) break;
+		const parent = sessions.get(parentId);
+		if (parent === void 0) break;
+		rootSession = parent;
+	}
+	if (rootSession === void 0) return { mainRoute: routeOf(modelSelectionHint?.provider, modelSelectionHint?.model) };
+	const lockable = typeof rootSession === "object" && rootSession !== null;
+	const locked = lockable ? lockedRootMainRoutes.get(rootSession) : void 0;
+	if (locked !== void 0) return {
+		rootSession,
+		mainRoute: locked
+	};
+	let mainRoute;
+	if (agent?.session === rootSession || agent?.session === void 0) {
+		let live;
+		try {
+			live = agent?.model?.current?.();
+		} catch {
+			live = void 0;
+		}
+		mainRoute = headerRouteOf(rootSession) ?? routeOf(live?.provider, live?.model) ?? routeOf(modelSelectionHint?.provider, modelSelectionHint?.model);
+	} else {
+		const rootOptions = rootSession.options;
+		mainRoute = headerRouteOf(rootSession) ?? routeOf(rootOptions?.provider, rootOptions?.model);
+	}
+	if (mainRoute === void 0) return { rootSession };
+	if (lockable && (lockSnapshot || headerRouteOf(rootSession) !== void 0)) lockedRootMainRoutes.set(rootSession, mainRoute);
+	return {
+		rootSession,
+		mainRoute
+	};
+}
+/**
 * Read the route an inherit-mode child would run on: the calling agent's own
 * effective request route. This mirrors the delegation seam's
 * `parentAgentOptionsForDelegation`, where the latest request header owns
@@ -80389,9 +81962,36 @@ function delegationModeOf(policies, toolName) {
 * @param scope - Whether an unrecorded Session falls back to the preference.
 * @returns the authorized routes in force for this agent, or an empty list when unrestricted.
 */
-function effectiveAllowedRoutes(agent, preference, sessions, scope = "session") {
+function effectiveAllowedRoutes(agent, preference, sessions, scope = "session", lockSnapshot = false) {
 	if (preference !== void 0 && !preference.enabled) return [];
-	return authorizedRoutesFor(agent, sessions) ?? (scope === "preference" ? preference?.allowedModels ?? [] : []);
+	const baseRoutes = authorizedRoutesFor(agent, sessions) ?? (scope === "preference" ? preference?.allowedModels ?? [] : []);
+	if (baseRoutes.length === 0) return [];
+	return mainModelRoutesFor(agent, sessions, preference, baseRoutes, lockSnapshot);
+}
+/**
+* Apply the per-main-model override to a Session's authorized routes.
+*
+* Precedence is exact-match, then fallback, then the Session's own list: an
+* entry for the main model the Session actually runs is the most specific
+* statement available, the fallback list covers every other main model, and the
+* Session policy is what governs when the deployment configured neither.
+* @param agent - Calling agent.
+* @param sessions - Session registry used for ancestor lookup.
+* @param preference - Current Host preference, when the settings service exists.
+* @param baseRoutes - Routes the Session itself authorized; never empty here.
+* @param lockSnapshot - Freeze the resolved main route AND the resolved route
+*   list for this Session now.
+* @returns the routes that actually govern this delegation.
+*/
+function mainModelRoutesFor(agent, sessions, preference, baseRoutes, lockSnapshot = false) {
+	const { rootSession, mainRoute } = resolveRootSessionAndMainRoute(agent, sessions, void 0, lockSnapshot);
+	const lockable = typeof rootSession === "object" && rootSession !== null;
+	const locked = lockable ? lockedRootAllowedRoutes.get(rootSession) : void 0;
+	if (locked !== void 0) return locked;
+	const overrideRoutes = mainRoute === void 0 ? void 0 : preference?.byMainModel?.[`${mainRoute.provider}/${mainRoute.model}`];
+	const resolved = overrideRoutes !== void 0 && overrideRoutes.length > 0 ? overrideRoutes : preference?.defaultAllowedModels !== void 0 && preference.defaultAllowedModels.length > 0 ? preference.defaultAllowedModels : baseRoutes;
+	if (lockable && (lockSnapshot || headerRouteOf(rootSession) !== void 0)) lockedRootAllowedRoutes.set(rootSession, [...resolved]);
+	return resolved;
 }
 /**
 * State a Session's routing posture in the `list_subagent_models` result.
@@ -80421,8 +82021,96 @@ function enrichListSubagentModelsOutput(output, allowed) {
 	}
 	const header = "Authorized child routes for this Session (already filtered by the Session allowlist; only these routes are accepted, and `provider` and `model` must be passed as separate fields):";
 	if (output.includes(header)) return output;
+	const filtered = filterListSubagentModelsOutput(output, allowed);
 	const suffix = `${header}\n${allowed.map((route) => `- ${route.provider}/${route.model} -> provider: "${route.provider}", model: "${route.model}"`).join("\n")}`;
-	return output.trim().length === 0 ? suffix : `${output}\n\n${suffix}`;
+	return filtered.trim().length === 0 ? suffix : `${filtered}\n\n${suffix}`;
+}
+/** One rendered `provider — Name` line of the upstream provider list. */
+const PROVIDER_LINE = /^([^/\s]+)\s+—\s+.+$/;
+/** One rendered `provider/model — Name` line of the upstream model list. */
+const MODEL_LINE = /^([^/\s]+)\/([^\s]+)\s+—\s+.+$/;
+/**
+* Drop the upstream lines that name a route this Session does not authorize.
+*
+* The upstream discovery tool reads the union policy recorded on the Session, so
+* its raw answer can list a provider or a `provider/model` line that belongs to
+* another main model's entry and NOT to the routes this main model is governed
+* by. Leaving those lines in place is worse than a cosmetic mismatch: the
+* documented way to read this output is to copy a line into `subagent`, so every
+* stale line is an invitation to a delegation the guard will refuse.
+*
+* Only the two known renderings are filtered, and only lines that MATCH one of
+* them are candidates: any other line (a heading, a hint, an empty answer) is
+* passed through untouched, so a generation that changes its wording degrades to
+* the old behavior rather than to an empty answer.
+* @param output - Original text returned by `list_subagent_models`.
+* @param allowed - Routes the calling Session authorizes; never empty here.
+* @returns the output with unauthorized lines removed.
+*/
+function filterListSubagentModelsOutput(output, allowed) {
+	if (allowed.length === 0 || output.length === 0) return output;
+	if (output.includes("\nReasoning efforts:\n")) return output;
+	const lines = output.split("\n");
+	const modelList = lines.some((line) => MODEL_LINE.test(line));
+	let matched = false;
+	const kept = [];
+	for (const line of lines) {
+		if (modelList) {
+			const match = MODEL_LINE.exec(line);
+			if (match === null) {
+				kept.push(line);
+				continue;
+			}
+			matched = true;
+			if (routesInclude(allowed, match[1], match[2])) kept.push(line);
+			continue;
+		}
+		const match = PROVIDER_LINE.exec(line);
+		if (match === null) {
+			kept.push(line);
+			continue;
+		}
+		matched = true;
+		if (allowed.some((route) => route.provider === match[1])) kept.push(line);
+	}
+	if (!matched) return output;
+	const keptText = kept.join("\n").replace(/\n{3,}/g, "\n\n").trim();
+	if (keptText.length > 0) return keptText;
+	if (modelList) return `(no advertised models for ${MODEL_LINE.exec(output)?.[1] ?? ""})`;
+	return "(no LLM providers)";
+}
+/**
+* Merge live per-main-model overrides into a resolved preference.
+*
+* The overrides are a separate seam from the settings namespace because they
+* live in THIS plugin's own preference document, not in the upstream
+* `subagent-model-selection` namespace. They also have to work on a harness
+* where that namespace cannot be registered at all (0.1.7 dropped
+* `settings.register`): there, an override is the only per-main-model statement
+* available, so it stands up an enabled preference by itself rather than being
+* dropped for lack of a base to attach to.
+* @param base - Preference resolved from the settings namespace, when any.
+* @param overrides - Live overrides read from this plugin's preferences.
+* @returns the merged preference, or undefined when neither source says anything.
+*/
+function mergePreferenceOverrides(base, overrides) {
+	const hasDefault = overrides?.defaultAllowedModels !== void 0;
+	const hasByMain = overrides?.byMainModel !== void 0;
+	if (base === void 0) {
+		if (!hasDefault && !hasByMain) return void 0;
+		return {
+			enabled: true,
+			allowedModels: overrides?.defaultAllowedModels ?? [],
+			...hasDefault ? { defaultAllowedModels: overrides?.defaultAllowedModels } : {},
+			...hasByMain ? { byMainModel: overrides?.byMainModel } : {}
+		};
+	}
+	if (!hasDefault && !hasByMain) return base;
+	return {
+		...base,
+		...hasDefault ? { defaultAllowedModels: overrides?.defaultAllowedModels } : {},
+		...hasByMain ? { byMainModel: overrides?.byMainModel } : {}
+	};
 }
 /**
 * The statement appended to `list_subagent_models` when no allowlist governs the
@@ -80533,7 +82221,7 @@ function rewriteAuthorizedPromptAssembly(assembly, allowed, toolNames = DEFAULT_
 * @param inheritToolNames - Delegation tools that start a child on the caller's own route.
 * @returns a denial reason, or undefined to leave the call untouched.
 */
-function delegationDenialReason(agent, toolName, args, preference, sessions, toolNames = DEFAULT_DELEGATION_TOOLS, scope = "session", inheritToolNames = [], declaresRouteParameters) {
+function delegationDenialReason(agent, toolName, args, preference, sessions, toolNames = DEFAULT_DELEGATION_TOOLS, scope = "session", inheritToolNames = [], declaresRouteParameters, lockSnapshot = true) {
 	const mode = delegationModeOf([...toolNames.map((name) => ({
 		name,
 		mode: "explicit"
@@ -80542,7 +82230,7 @@ function delegationDenialReason(agent, toolName, args, preference, sessions, too
 		mode: "inherit"
 	}))], toolName);
 	if (mode === void 0) return void 0;
-	const allowed = effectiveAllowedRoutes(agent, preference, sessions, scope);
+	const allowed = effectiveAllowedRoutes(agent, preference, sessions, scope, lockSnapshot);
 	if (allowed.length === 0) return void 0;
 	const request = asRecord$2(args) ?? {};
 	const requestedProvider = asString$3(request["provider"]);
@@ -80570,7 +82258,26 @@ function delegationDenialReason(agent, toolName, args, preference, sessions, too
 * @returns a guard that denies delegations outside the Session allowlist.
 */
 function createSubagentAuthorization(options) {
-	return (agent, toolName, args) => delegationDenialReason(agent, toolName, args, subagentModelSelectionPreference(options.settings), options.sessions, options.toolNames, options.scope ?? "session", options.inheritToolNames ?? [], options.declaresRouteParameters);
+	return (agent, toolName, args) => delegationDenialReason(agent, toolName, args, mergedPreference(options), options.sessions, options.toolNames, options.scope ?? "session", options.inheritToolNames ?? [], options.declaresRouteParameters);
+}
+/**
+* Resolve the preference one guard evaluation uses.
+*
+* The namespace preference and this plugin's per-main-model overrides are
+* separate seams — the override document outlives a harness that cannot register
+* the namespace at all — so they are merged here, once, rather than at each of
+* the four call sites that need the result.
+* @param options - Runtime inputs the guard closed over.
+* @returns the merged preference, or undefined when neither seam says anything.
+*/
+function mergedPreference(options) {
+	let overrides;
+	try {
+		overrides = options.routingOverrides?.();
+	} catch {
+		overrides = void 0;
+	}
+	return mergePreferenceOverrides(subagentModelSelectionPreference(options.settings), overrides);
 }
 /** Delegation names this guard recognizes when configuration omits them. */
 function normalizeDelegationToolNames(value) {
@@ -80662,14 +82369,19 @@ function installSubagentModelAuthorization(ctx, sessions, config = {}) {
 		toolNames,
 		inheritToolNames,
 		scope,
-		declaresRouteParameters: routeParameterProbe(ctx)
+		declaresRouteParameters: routeParameterProbe(ctx),
+		routingOverrides: config.routingOverrides
+	});
+	const currentPreference = () => mergedPreference({
+		settings,
+		routingOverrides: config.routingOverrides
 	});
 	const disposeGuard = ctx.tools.guard((exec) => authorize(exec.agent, exec.name, exec.arguments));
 	const eventHost = ctx;
 	const disposePostExecute = eventHost.on?.("tools/post-execute", async (exec, result, next) => {
 		const decision = await next();
 		if (exec.name !== "list_subagent_models" || result.isError === true || decision?.kind !== "accept") return decision;
-		const allowed = effectiveAllowedRoutes(exec.agent, subagentModelSelectionPreference(settings), sessions, scope);
+		const allowed = effectiveAllowedRoutes(exec.agent, currentPreference(), sessions, scope, true);
 		const currentValue = decision.value !== void 0 ? decision.value : result.value;
 		if (typeof currentValue === "string") {
 			const enriched = enrichListSubagentModelsOutput(currentValue, allowed);
@@ -80697,7 +82409,7 @@ function installSubagentModelAuthorization(ctx, sessions, config = {}) {
 		return decision;
 	});
 	const disposeAssemble = eventHost.on?.("system-prompt/assemble", async (_assembly, context, next) => {
-		return rewriteAuthorizedPromptAssembly(await next(), effectiveAllowedRoutes(context?.agent ?? context?.scope, subagentModelSelectionPreference(settings), sessions, scope), toolNames);
+		return rewriteAuthorizedPromptAssembly(await next(), effectiveAllowedRoutes(context?.agent ?? context?.scope, currentPreference(), sessions, scope, true), toolNames);
 	});
 	return () => {
 		disposeGuard();
@@ -83120,7 +84832,7 @@ When in doubt, clarify before escalating; if a task turns out more complex than
 - G6 Prohibited: Answering your own questions, making product/design decisions on the user's behalf, skipping the interview to plan directly, or treating a casual remark about one detail as full interview sign-off.
 
 ## R1 · Responsibility Boundary (Layered by Tier)
-For L2 tasks, never execute work yourself outside these six categories: (1) Planning & decomposition; (2) Dispatching tasks; (3) Review; (4) Acceptance verification; (5) Documentation & delivery summary; (6) Tasks subagents cannot perform.
+For L2 tasks, never execute work yourself outside these seven categories: (1) Planning & decomposition; (2) Dispatching tasks; (3) Review; (4) Acceptance verification; (5) Documentation & delivery summary; (6) Tasks subagents cannot perform; (7) Independent parallel-module implementation that shares no files, unfinished interfaces, or acceptance dependencies with active subagents and can be verified independently.
 For L0/L1 tasks, execute directly—do not spawn subagents just to look like you are orchestrating.
 
 ## R2 · Model Routing (Check Availability First, Then Decide How to Dispatch)
@@ -83176,7 +84888,7 @@ All three rules govern the boundary of a turn: after dispatching, before continu
 [Waiting for Subagents] By default, end your turn without calling any more tools and let the subagent completion notification wake you—notifications are built-in; do not manufacture your own wait.
 - The notification is a post-hoc signal. It tells you a child stopped running; it does not tell you the work is correct, and nothing about it arrives before the work is done. Treat it as "there is now something to review", never as "this passed". The pre-hoc control is the acceptance criteria in the brief (R5); the review itself is R6.
 - Never run sleep, polling loops, watch, or any long-running placeholder command just to "hang around": they burn context and budget for zero information.
-- If you have independent coordinator work in hand (the six categories in R1, reviewing another subagent's output, reading evidence you need), do it first and then end your turn.
+- If you have independent coordinator work in hand (the seven categories in R1, including non-overlapping parallel-module development, reviewing another subagent's output, or reading evidence you need), do it first and then end your turn. Do not manufacture work merely to keep a provider cache warm.
 - Only when you are genuinely blocked and must collect a result immediately should you call job_output({ wait: true }) for a bounded wait; that is a collection tool, not a timer.
 - Before ending the turn, state clearly: who was dispatched, what you are waiting for, and what you will do once the evidence arrives. Never leave the user guessing progress from silence.
 
@@ -83789,10 +85501,10 @@ const DELIVERY_FAILURE_MARKERS = [
 	"is closing",
 	"ACTIVATION_CLOSING"
 ];
-function record(value) {
+function record$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
-function text(value) {
+function text$1(value) {
 	return typeof value === "string" ? value : void 0;
 }
 function count(value) {
@@ -83807,8 +85519,8 @@ function oneLine(value, max) {
 function sessionTag(session) {
 	if (session === void 0) return "session=?";
 	const id = typeof session.id === "string" && session.id !== "" ? session.id : "?";
-	const origin = text(session.header?.origin);
-	const parent = text(session.header?.parentSession);
+	const origin = text$1(session.header?.origin);
+	const parent = text$1(session.header?.parentSession);
 	return `session=${id}${parent === void 0 || parent === "" ? "" : ` parent=${parent}`}${origin === void 0 ? "" : ` origin=${origin}`}`;
 }
 /** Block-type histogram plus whether a message carries anything the user can see. */
@@ -83818,11 +85530,11 @@ function blocksSummary(content) {
 	let visible = false;
 	let chars = 0;
 	for (const block of content) {
-		const value = record(block);
-		const type = text(value?.type) ?? "unknown";
+		const value = record$1(block);
+		const type = text$1(value?.type) ?? "unknown";
 		counts.set(type, (counts.get(type) ?? 0) + 1);
 		if (type === "tool-call") visible = true;
-		const body = text(value?.text);
+		const body = text$1(value?.text);
 		if (body !== void 0) {
 			chars += body.length;
 			if (type === "text" && body.trim().length > 0) visible = true;
@@ -83859,9 +85571,9 @@ var RelayProbe = class {
 		}
 	}
 	step(session, event) {
-		const type = text(event?.type);
+		const type = text$1(event?.type);
 		if (type === void 0) return;
-		const data = record(event.data);
+		const data = record$1(event.data);
 		if (data === void 0) return;
 		switch (type) {
 			case "agent/inbox/spliced":
@@ -83894,9 +85606,9 @@ var RelayProbe = class {
 				this.observedRequest(data);
 				return;
 			case "assistant/message": {
-				const message = record(data.message);
-				const source = record(message?.source);
-				const model = source === void 0 ? "" : ` model=${text(source.provider) ?? "?"}/${text(source.model) ?? "?"}`;
+				const message = record$1(data.message);
+				const source = record$1(message?.source);
+				const model = source === void 0 ? "" : ` model=${text$1(source.provider) ?? "?"}/${text$1(source.model) ?? "?"}`;
 				this.line(`assistant turn=${count(data.turn) ?? "?"} step=${count(data.step) ?? "?"}${model} ${blocksSummary(message?.content)}`);
 				return;
 			}
@@ -83905,16 +85617,16 @@ var RelayProbe = class {
 	}
 	/** A delivery entering (or leaving) the parent's inbox. */
 	onSplice(session, data) {
-		const target = text(data.target) ?? "?";
+		const target = text$1(data.target) ?? "?";
 		const inserted = Array.isArray(data.inserted) ? data.inserted : [];
 		const removed = count(data.removedCount) ?? 0;
 		const outcomes = [];
 		for (const entry of inserted) {
-			const message = record(entry);
-			const source = record(message?.source);
-			const kind = text(source?.kind) ?? "";
+			const message = record$1(entry);
+			const source = record$1(message?.source);
+			const kind = text$1(source?.kind) ?? "";
 			if (!RELAY_SOURCE_KINDS.includes(kind)) continue;
-			outcomes.push(`kind=${kind}${this.formTag(source)} msg=${text(message?.id) ?? "?"}`);
+			outcomes.push(`kind=${kind}${this.formTag(source)} msg=${text$1(message?.id) ?? "?"}`);
 		}
 		if (outcomes.length > 0) {
 			this.watch(session);
@@ -83923,84 +85635,84 @@ var RelayProbe = class {
 		}
 		if (!this.observed.has(session.id)) return;
 		if (removed === 0 && inserted.length === 0) return;
-		const outcome = text(data.outcome);
+		const outcome = text$1(data.outcome);
 		this.line(`inbox-splice ${sessionTag(session)} target=${target} inserted=${inserted.length} removed=${removed}${outcome === void 0 ? "" : ` outcome=${outcome}`} pending=${this.pending(session)}`);
 	}
 	/** A message committed to the session surface — for a relay, the claim. */
 	onUserMessage(session, data) {
-		const message = record(data.message);
-		const source = record(message?.source);
-		const kind = text(source?.kind) ?? "?";
+		const message = record$1(data.message);
+		const source = record$1(message?.source);
+		const kind = text$1(source?.kind) ?? "?";
 		const boundary = RELAY_SOURCE_KINDS.includes(kind);
 		if (boundary) this.watch(session);
 		if (!boundary && !this.observed.has(session.id)) return;
-		const sender = text(source?.senderSessionId);
+		const sender = text$1(source?.senderSessionId);
 		const senderTag = sender === void 0 || sender === "" ? "" : ` sender=${sender}`;
-		this.line(`user-committed ${sessionTag(session)} kind=${kind}${this.formTag(source)} msg=${text(message?.id) ?? "?"}${senderTag} turn=${count(data.turn) ?? "-"} ${blocksSummary(message?.content)} pending=${this.pending(session)}`);
+		this.line(`user-committed ${sessionTag(session)} kind=${kind}${this.formTag(source)} msg=${text$1(message?.id) ?? "?"}${senderTag} turn=${count(data.turn) ?? "-"} ${blocksSummary(message?.content)} pending=${this.pending(session)}`);
 		if (boundary) this.line(`agent-state ${this.agentState(session)}`);
 	}
 	/** A child attempting to report to its parent. */
 	onToolCall(session, data) {
-		const message = record(data.message);
+		const message = record$1(data.message);
 		if (!Array.isArray(message?.content)) return;
 		for (const block of message.content) {
-			const value = record(block);
-			if (text(value?.type) !== "tool-call") continue;
-			const name = text(value?.name) ?? "";
+			const value = record$1(block);
+			if (text$1(value?.type) !== "tool-call") continue;
+			const name = text$1(value?.name) ?? "";
 			if (!CHILD_SEND_TOOLS.includes(name)) continue;
-			this.line(`child-send ${sessionTag(session)} tool=${name} call=${text(value?.id) ?? "?"}`);
+			this.line(`child-send ${sessionTag(session)} tool=${name} call=${text$1(value?.id) ?? "?"}`);
 		}
 	}
 	/** A tool result that may be a refused delivery. */
 	onToolResult(session, data) {
-		const message = record(data.message);
+		const message = record$1(data.message);
 		if (!Array.isArray(message?.content)) return;
 		for (const block of message.content) {
-			const value = record(block);
-			if (value === void 0 || text(value.type) !== "tool-result") continue;
+			const value = record$1(block);
+			if (value === void 0 || text$1(value.type) !== "tool-result") continue;
 			const body = this.toolResultText(value.content);
 			const marker = DELIVERY_FAILURE_MARKERS.find((candidate) => body.includes(candidate));
 			if (marker === void 0) continue;
-			this.line(`child-send-failed ${sessionTag(session)} call=${text(value.toolCallId) ?? "?"} marker=${JSON.stringify(marker)} excerpt=${JSON.stringify(oneLine(body, EXCERPT_MAX))}`);
+			this.line(`child-send-failed ${sessionTag(session)} call=${text$1(value.toolCallId) ?? "?"} marker=${JSON.stringify(marker)} excerpt=${JSON.stringify(oneLine(body, EXCERPT_MAX))}`);
 		}
 	}
 	toolResultText(content) {
 		if (!Array.isArray(content)) return "";
 		const parts = [];
 		for (const block of content) {
-			const body = text(record(block)?.text);
+			const body = text$1(record$1(block)?.text);
 			if (body !== void 0) parts.push(body);
 		}
 		return parts.join(" ");
 	}
 	observedRequest(data) {
-		const config = record(record(data.header)?.config);
+		const config = record$1(record$1(data.header)?.config);
 		if (config === void 0) return;
 		const series = data.startsSeries === true ? " startsSeries=yes" : "";
-		this.line(`request provider=${text(config.provider) ?? "?"} model=${text(config.model) ?? "?"} reason=${text(data.reason) ?? "-"}${series}`);
+		this.line(`request provider=${text$1(config.provider) ?? "?"} model=${text$1(config.model) ?? "?"} reason=${text$1(data.reason) ?? "-"}${series}`);
 	}
 	turnReason(reason) {
-		const value = record(reason);
+		const value = record$1(reason);
 		if (value === void 0) return oneLine(String(reason ?? "?"), SUMMARY_MAX);
-		const kind = text(value.kind) ?? "?";
-		const failure = record(value.error);
+		const kind = text$1(value.kind) ?? "?";
+		const failure = record$1(value.error);
 		if (failure === void 0) return kind;
-		const code = text(failure.code) ?? "?";
-		const message = text(failure.message);
+		const code = text$1(failure.code) ?? "?";
+		const message = text$1(failure.message);
 		return message === void 0 ? `${kind} code=${code}` : `${kind} code=${code} message=${JSON.stringify(oneLine(message, SUMMARY_MAX))}`;
 	}
 	formTag(source) {
 		if (source === void 0) return "";
-		const form = text(source.form);
-		const summary = text(source.summary);
-		const plugin = text(source.plugin);
+		const form = text$1(source.form);
+		const summary = text$1(source.summary);
+		const plugin = text$1(source.plugin);
 		return `${form === void 0 ? "" : ` form=${form}`}${plugin === void 0 ? "" : ` plugin=${plugin}`}${summary === void 0 ? "" : ` summary=${JSON.stringify(oneLine(summary, SUMMARY_MAX))}`}`;
 	}
 	/** Live snapshot of the Agent behind this Session, when it is resident. */
 	agentState(session) {
 		const agent = this.options.agents?.get(session.id);
 		if (agent === void 0) return `${sessionTag(session)} resident=no`;
-		const status = text(agent.status) ?? "?";
+		const status = text$1(agent.status) ?? "?";
 		return `${sessionTag(session)} resident=yes status=${status} pending=${agent.inbox === void 0 ? "?" : `nextStep:${agent.inbox.nextStep?.length ?? 0},nextTurn:${agent.inbox.nextTurn?.length ?? 0}`}`;
 	}
 	pending(session) {
@@ -84425,7 +86137,7 @@ function asRegistry$1(value) {
 * Both reads are guarded: a host without the reader, and one without the
 * service, must leave this plugin loadable rather than failing its import.
 */
-function agentRegistry$1(ctx) {
+function agentRegistry$2(ctx) {
 	try {
 		const registry = asRegistry$1(typeof ctx.get === "function" ? ctx.get("agents") : void 0);
 		if (registry !== void 0) return registry;
@@ -84504,7 +86216,7 @@ function installReasoningCollapseGuard(ctx, options = {}) {
 	function resolveAgent(sessionId) {
 		if (sessionId === void 0) return void 0;
 		try {
-			const registered = agentRegistry$1(ctx)?.get(sessionId);
+			const registered = agentRegistry$2(ctx)?.get(sessionId);
 			if (registered !== void 0 && registered !== null) return registered;
 		} catch {}
 		return known.get(sessionId);
@@ -84892,7 +86604,7 @@ function asRegistry(value) {
 	return value !== null && typeof value === "object" && typeof value.get === "function" ? value : void 0;
 }
 /** The host's Agent registry, read defensively through both available routes. */
-function agentRegistry(ctx) {
+function agentRegistry$1(ctx) {
 	try {
 		const registry = asRegistry(typeof ctx.get === "function" ? ctx.get("agents") : void 0);
 		if (registry !== void 0) return registry;
@@ -84962,7 +86674,7 @@ function installNoAnswerResume(ctx, options = {}) {
 	function resolveAgent(sessionId) {
 		if (sessionId === void 0) return void 0;
 		try {
-			const registered = agentRegistry(ctx)?.get(sessionId);
+			const registered = agentRegistry$1(ctx)?.get(sessionId);
 			if (registered !== void 0 && registered !== null) return registered;
 		} catch {}
 	}
@@ -85789,11 +87501,13 @@ function installCacheWarmup(ctx, options) {
 	*
 	* 决策取舍写在代码里，因为它全是「什么时候**不动**」：
 	* - 不是 `accept`（`block` 的 feedback 是别人的东西）；
-	* - 已经带 `value`（执行本地的 canonical 值，replay 与结构化消费方读它，
-	*   替换掉等于把一份 JSON 换成字符串）；
 	* - 工具名不是 `run_code`、线路不是本线、会话拿不到；
 	* - 没有存储、内容为空。
 	* 上面任何一条成立就原样返回同一个决策对象。
+	*
+	* 决策带了 `value` 不再是「不动」的理由：核心没真正生成预览时，末尾仍然
+	* 原样交回同一个决策对象（`value` 一点不丢）；只有核心真的换了内容，
+	* 才换成带预览的 `accept` 决策。
 	* @param exec - 工具执行上下文。
 	* @param result - 归一化后的执行结果。
 	* @param decision - `next()` 交回来的决策。
@@ -85811,7 +87525,6 @@ function installCacheWarmup(ctx, options) {
 		const navigation = retrievalTool || ptcRetrieval ? cacheWarmupNavigationIntentOf(exec.agent) : void 0;
 		if (retrievalTool && navigation !== true) return decision;
 		if (sourceTool && !settings.enabled && navigation !== true) return decision;
-		if (sourceTool && decision.value !== void 0 && navigation !== true) return decision;
 		const route = cacheWarmupRouteOf(exec.agent);
 		if (route.provider !== "kimi-code") return decision;
 		const sessionId = route.sessionId;
@@ -85886,14 +87599,292 @@ function blocksOf(content) {
 	}];
 	return content;
 }
-/**
-* 本文件刻意**不保留**任何"把异常压成一句话"的辅助函数。
-*
-* 这里曾经有一个 `describe(error)`，把 `error.message` 截断后拼进宿主日志。它看上去
-* 无害（只取第一行、还截了长度），实际上是一条原文出口：异常消息里常常带着绝对
-* 路径、命令行片段、凭据，或者被读取结果的一段正文。三处降级日志现在统一走
-* {@link cacheWarmupErrorLabel}——只输出稳定的 name/code。
-*/
+/** Opt-in switch for one bounded warmup during a delegation batch. */
+const CACHE_WAIT_WARMUP_ENV = "DSH_KIMI_CODE_CACHE_WAIT_WARMUP";
+const MAX_TRACKED_SESSIONS = 256;
+/** Pure cache-wait policy; no child deadline or forced progress is involved. */
+function evaluateCacheWait(input) {
+	if (!input.waiting || !input.hasChildren || input.lastActiveAt === void 0) return { kind: "none" };
+	if (!Number.isFinite(input.lastActiveAt) || !Number.isFinite(input.now)) return { kind: "none" };
+	const decisionMs = input.decisionMs ?? 12e5;
+	const ttlMs = input.ttlMs ?? 15e5;
+	const minWarmupTokens = input.minWarmupTokens ?? 1e5;
+	const idleMs = Math.max(0, input.now - input.lastActiveAt);
+	if (idleMs >= ttlMs) return { kind: "cold" };
+	if (idleMs < decisionMs) return {
+		kind: "schedule",
+		delayMs: decisionMs - idleMs
+	};
+	if (input.warmupEnabled && !input.warmupUsed && input.totalTokens !== void 0 && Number.isFinite(input.totalTokens) && input.totalTokens >= minWarmupTokens) return { kind: "warmup" };
+	return { kind: "cold" };
+}
+/** The one opt-in message, built through the generation-safe harness factory. */
+function createCacheWaitWarmupMessage() {
+	return createUserMessage$1({
+		content: [{
+			type: "text",
+			text: "Automatic cache maintenance while delegated work continues. This is not a new task and must not change priorities or cause tool calls. Reply with one brief acknowledgment, then continue waiting for existing results. Do not request or manufacture progress from any subagent."
+		}],
+		source: {
+			kind: PLUGIN_MESSAGE_SOURCE_KIND,
+			form: "notice",
+			summary: boundContextSummary("Cache maintenance only; delegated work continues unchanged.")
+		}
+	});
+}
+/** Whether the deployment explicitly opted into bounded warmup. */
+function cacheWaitWarmupEnabled(env = process.env) {
+	const raw = env[CACHE_WAIT_WARMUP_ENV]?.trim().toLowerCase();
+	return raw === "1" || raw === "true" || raw === "yes" || raw === "on";
+}
+function record(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function text(value) {
+	return typeof value === "string" && value.trim() !== "" ? value : void 0;
+}
+function defaultTimer() {
+	return {
+		set(callback, delayMs) {
+			const handle = setTimeout(callback, delayMs);
+			handle.unref?.();
+			return handle;
+		},
+		clear(handle) {
+			clearTimeout(handle);
+		}
+	};
+}
+function defaultActivity(sessionId) {
+	const durable = sessionCacheState.read(sessionId);
+	const lastActiveAt = sessionLastActiveAt(sessionId) ?? durable?.lastActiveAt;
+	if (lastActiveAt === void 0) return void 0;
+	return {
+		lastActiveAt,
+		totalTokens: durable?.totalTokens
+	};
+}
+function agentRegistry(ctx) {
+	try {
+		const value = ctx.get?.("agents") ?? ctx.agents;
+		if (value !== null && typeof value === "object" && typeof value.get === "function") return value;
+	} catch {}
+}
+/** Host-side cache-wait state machine. It never sends anything to a child. */
+var KimiCacheWaitController = class {
+	options;
+	states = /* @__PURE__ */ new Map();
+	parentByChild = /* @__PURE__ */ new Map();
+	providerBySession = /* @__PURE__ */ new Map();
+	now;
+	timer;
+	agents;
+	activity;
+	kimiSession;
+	warmup;
+	logger;
+	decisionMs;
+	ttlMs;
+	minWarmupTokens;
+	disposed = false;
+	constructor(options = {}) {
+		this.options = options;
+		this.now = options.now ?? (() => Date.now());
+		this.timer = options.timer ?? defaultTimer();
+		this.agents = options.agents;
+		this.activity = options.activity ?? defaultActivity;
+		this.kimiSession = options.kimiSession;
+		this.warmup = options.warmup === true;
+		this.logger = options.logger;
+		this.decisionMs = options.decisionMs ?? 12e5;
+		this.ttlMs = options.ttlMs ?? 15e5;
+		this.minWarmupTokens = options.minWarmupTokens ?? 1e5;
+	}
+	/** Observe one durable Session event. */
+	observe(session, event) {
+		if (this.disposed) return;
+		try {
+			const type = text(event.type);
+			if (type === void 0) return;
+			const data = record(event.data);
+			if (type === "request/header") {
+				const provider = text(record(record(data?.header)?.config)?.provider);
+				if (provider !== void 0) this.providerBySession.set(session.id, provider);
+				return;
+			}
+			if (type === "subagent/catalog") {
+				const childId = text(data?.childId);
+				if (childId === void 0 || childId === session.id) return;
+				const state = this.stateFor(session.id);
+				const newChild = !state.children.has(childId);
+				state.children.add(childId);
+				this.parentByChild.set(childId, session.id);
+				if (newChild) {
+					state.warmupUsed = false;
+					state.handled = false;
+				}
+				this.reconcile(session, state);
+				return;
+			}
+			if (type === "subagent/end") {
+				this.removeChild(text(data?.id));
+				return;
+			}
+			if (type === "user/message") {
+				const source = record(record(data?.message)?.source);
+				if (text(source?.kind) === "subagent-settled") this.removeChild(text(source?.senderSessionId));
+				return;
+			}
+			const state = this.stateFor(session.id);
+			if (type === "turn/start") {
+				state.waiting = false;
+				this.clearTimer(state);
+				return;
+			}
+			if (type === "turn/end") {
+				state.waiting = true;
+				state.handled = false;
+				this.reconcile(session, state);
+			}
+		} catch (error) {
+			this.logger?.warn(`kimi-cache-wait: ignored an invalid event: ${error instanceof Error ? error.message : String(error)}`);
+		}
+	}
+	/** Forget a disposed Agent and any parent/child links it owned. */
+	disposeAgent(agent) {
+		const id = text(agent.id);
+		if (id === void 0) return;
+		this.dropState(id);
+		this.removeChild(id);
+		this.providerBySession.delete(id);
+	}
+	/** Test/diagnostic view; no mutable state escapes. */
+	snapshot(sessionId) {
+		const state = this.states.get(sessionId);
+		return {
+			waiting: state?.waiting ?? false,
+			childCount: state?.children.size ?? 0,
+			handled: state?.handled ?? false,
+			warmupUsed: state?.warmupUsed ?? false,
+			scheduled: state?.timer !== void 0,
+			...state?.lastDecision === void 0 ? {} : { lastDecision: state.lastDecision }
+		};
+	}
+	dispose() {
+		if (this.disposed) return;
+		this.disposed = true;
+		for (const state of this.states.values()) this.clearTimer(state);
+		this.states.clear();
+		this.parentByChild.clear();
+		this.providerBySession.clear();
+	}
+	stateFor(sessionId) {
+		const existing = this.states.get(sessionId);
+		if (existing !== void 0) {
+			this.states.delete(sessionId);
+			this.states.set(sessionId, existing);
+			return existing;
+		}
+		const state = {
+			children: /* @__PURE__ */ new Set(),
+			waiting: false,
+			handled: false,
+			warmupUsed: false
+		};
+		this.states.set(sessionId, state);
+		if (this.states.size > MAX_TRACKED_SESSIONS) {
+			const oldest = this.states.keys().next();
+			if (oldest.done !== true) this.dropState(oldest.value);
+		}
+		return state;
+	}
+	dropState(sessionId) {
+		const state = this.states.get(sessionId);
+		if (state === void 0) return;
+		this.clearTimer(state);
+		for (const child of state.children) this.parentByChild.delete(child);
+		this.states.delete(sessionId);
+	}
+	removeChild(childId) {
+		if (childId === void 0) return;
+		const parent = this.parentByChild.get(childId);
+		if (parent === void 0) return;
+		this.parentByChild.delete(childId);
+		const state = this.states.get(parent);
+		if (state === void 0) return;
+		state.children.delete(childId);
+		if (state.children.size === 0) this.clearTimer(state);
+	}
+	clearTimer(state) {
+		if (state.timer === void 0) return;
+		this.timer.clear(state.timer);
+		state.timer = void 0;
+	}
+	isKimiSession(session) {
+		if (this.kimiSession !== void 0) return this.kimiSession(session);
+		try {
+			const current = text(session.requestHeader?.()?.config?.provider);
+			if (current !== void 0) return current === "kimi-code";
+		} catch {}
+		const latest = this.providerBySession.get(session.id);
+		if (latest !== void 0) return latest === "kimi-code";
+		return this.activity(session.id)?.lastActiveAt !== void 0;
+	}
+	reconcile(session, state) {
+		this.clearTimer(state);
+		if (this.disposed || !state.waiting || state.handled || state.children.size === 0) return;
+		if (!this.isKimiSession(session)) return;
+		const activity = this.activity(session.id);
+		if (activity === void 0) return;
+		const action = evaluateCacheWait({
+			waiting: state.waiting,
+			hasChildren: state.children.size > 0,
+			now: this.now(),
+			lastActiveAt: activity.lastActiveAt,
+			totalTokens: activity.totalTokens,
+			warmupEnabled: this.warmup,
+			warmupUsed: state.warmupUsed,
+			decisionMs: this.decisionMs,
+			ttlMs: this.ttlMs,
+			minWarmupTokens: this.minWarmupTokens
+		});
+		if (action.kind === "none") return;
+		if (action.kind === "schedule") {
+			state.timer = this.timer.set(() => {
+				state.timer = void 0;
+				this.reconcile(session, state);
+			}, action.delayMs);
+			return;
+		}
+		state.handled = true;
+		state.lastDecision = action.kind;
+		if (action.kind === "cold") return;
+		state.warmupUsed = true;
+		try {
+			const agent = this.agents?.get(session.id);
+			if (agent?.steer === void 0) throw new Error("the parent Agent is not available for warmup");
+			agent.steer(createCacheWaitWarmupMessage());
+			this.logger?.info?.(`kimi-cache-wait: queued one bounded warmup for session ${session.id}`);
+		} catch (error) {
+			this.logger?.warn(`kimi-cache-wait: warmup skipped for session ${session.id}: ${error instanceof Error ? error.message : String(error)}`);
+		}
+	}
+};
+/** Install the host listener. Older hosts without the event bus remain inert. */
+function installKimiCacheWait(ctx, options = {}) {
+	if (typeof ctx.on !== "function") return void 0;
+	const agents = options.agents ?? agentRegistry(ctx);
+	const controller = new KimiCacheWaitController({
+		...options,
+		agents
+	});
+	const disposers = [ctx.on("session/event", (session, event) => controller.observe(session, event)), ctx.on("agent/disposed", ({ agent }) => controller.disposeAgent(agent))];
+	return () => {
+		controller.dispose();
+		for (const handle of disposers) if (typeof handle === "function") handle();
+		else handle?.dispose?.();
+	};
+}
 //#endregion
 //#region src/host/cache-warmup/settings.ts
 /**
@@ -94013,7 +96004,16 @@ function apply(ctx, pluginConfig = {}) {
 			return installSubagentModelAuthorization(scoped, sessions, {
 				toolNames: delegationToolNames,
 				inheritToolNames: delegationInheritNames,
-				scope: pluginConfig.subagentModelScope ?? "session"
+				scope: pluginConfig.subagentModelScope ?? "session",
+				routingOverrides: () => {
+					const current = preferences.status();
+					const defaultAllowedModels = current.subagentDefaultModels ?? [];
+					const byMainModel = current.subagentModelsByMainModel ?? {};
+					return {
+						...defaultAllowedModels.length > 0 ? { defaultAllowedModels } : {},
+						...Object.keys(byMainModel).length > 0 ? { byMainModel } : {}
+					};
+				}
 			});
 		}, "dsh-chatgpt-subscription: subagent model authorization");
 	});
@@ -94052,6 +96052,14 @@ function apply(ctx, pluginConfig = {}) {
 			};
 		}
 	}), "dsh-chatgpt-subscription: cache warmup");
+	ctx.effect(() => {
+		const dispose = installKimiCacheWait(ctx, { warmup: cacheWaitWarmupEnabled(process.env) });
+		if (dispose === void 0) {
+			ctx.logger.warn("[dsh-chatgpt-subscription] Kimi cache wait skipped: this harness exposes no event bus");
+			return () => void 0;
+		}
+		return dispose;
+	}, "dsh-chatgpt-subscription: Kimi cache wait");
 	const probeEnvFile = relayProbeEnvFile();
 	if (relayProbeEnabled(process.env, { envFile: probeEnvFile })) {
 		const probePath = relayProbeLogPath(process.env, { envFile: probeEnvFile });
@@ -94361,7 +96369,12 @@ function apply(ctx, pluginConfig = {}) {
 			const sessions = ctx.get("sessions");
 			const target = sessions.get(sessionId);
 			if (target === void 0) throw new Error(`Unknown session "${sessionId}".`);
-			const allowed = auditedRoutesOf(target);
+			const audited = auditedRoutesOf(target);
+			const current = preferences.status();
+			const mainRoute = resolveRootSessionAndMainRoute({ session: target }, sessions).mainRoute;
+			const override = mainRoute === void 0 ? void 0 : (current.subagentModelsByMainModel ?? {})[`${mainRoute.provider}/${mainRoute.model}`];
+			const fallback = current.subagentDefaultModels ?? [];
+			const allowed = audited === void 0 ? audited : override !== void 0 && override.length > 0 ? override : fallback.length > 0 ? fallback : audited;
 			return Promise.resolve({
 				sessionId,
 				allowedModels: (allowed ?? []).map((route) => ({