@eddyskywalker/dsh-chatgpt-subscription 0.59.0 → 0.61.0

package/lib/index.js

@@ -1,15 +1,16 @@
-import { a as resolveProgressUpdatesSettings, n as attachProgressSettings } from "./entry-progress-updates-CxQewio9.js";
+import { a as resolveProgressUpdatesSettings, n as attachProgressSettings } from "./entry-progress-updates-DZ0ZRus4.js";
 import { attachPlanModePipelineSettings, resolvePlanModePipelineEnabled } from "./plan-mode-pipeline.js";
+import { n as PLUGIN_MESSAGE_SOURCE_KIND, r as normalizeGenerateOptions, t as LlmError$1 } from "./llm-compat-u9mor0uu.js";
 import { DEFAULT_SKIP_PROVIDERS, PRUNER_SERVICE_NAME, resolveSkipProviders, shouldSkipPruningForSession } from "./tool-result-pruner.js";
-import { PLAN_PROJECTION_KEY, createPlanNotice } from "./plan-mode.js";
+import { b as installDispatchExecutionGuard, h as installPlanModeExitReminder, l as PLAN_PROJECTION_KEY, p as createPlanNotice, v as registeredPlanControllerActive, x as resolveDispatchExecutionGuardEnabled } from "./entry-plan-mode-CLRKkgYG.js";
 import { createRequire } from "node:module";
 import * as LlmModule from "@deepseek-ai/dsh-llm";
-import { EMPTY_RESPONSE_CODE, HarnessError, LlmAdapter, LlmError, LlmError as LlmError$1, ProviderRequestId, ReasoningEffortId, ToolCallId, attributionHeaders, createUserMessage, errorChain, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
+import { EMPTY_RESPONSE_CODE, HarnessError, LlmAdapter, LlmError, ProviderRequestId, ReasoningEffortId, ToolCallId, attributionHeaders, createUserMessage, errorChain, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { z } from "zod";
 import z$1 from "@deepseek-ai/schemastery";
 import fs, { chmod, lstat, mkdir, open, readFile, realpath, rename, stat, unlink, writeFile } from "node:fs/promises";
-import path, { basename, dirname, extname, join, relative, resolve } from "node:path";
+import path, { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import os, { homedir, platform, userInfo } from "node:os";
 import { constants, createCipheriv, createDecipheriv, createHash, createHmac, publicEncrypt, randomBytes, randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
@@ -807,7 +808,7 @@ const ROUTE_PREFIX$5 = "/api/dsh-chatgpt-subscription";
 * `test/responses-client.test.ts` asserts the two agree, so a release that
 * forgets this constant fails the suite instead of shipping quietly.
 */
-const PLUGIN_VERSION = "0.59.0";
+const PLUGIN_VERSION = "0.61.0";
 const CODEX_CHATGPT_PROVIDER_ID = "codex-chatgpt";
 const CODEX_API_BASE = "https://chatgpt.com/backend-api/codex";
 const CODEX_RESPONSES_URL = `${CODEX_API_BASE}/responses`;
@@ -1192,6 +1193,7 @@ function resolveCodexModel(model, preferences, live) {
 		inputModalities: [...liveEntry?.inputModalities ?? entry.inputModalities],
 		context: { contextWindow: configuredContextWindow ?? liveEntry?.contextWindow ?? entry.contextWindow },
 		...outputReservation(configuredContextWindow ?? liveEntry?.contextWindow ?? entry.contextWindow, codexModelMaxTokens(model)),
+		...codexToolUpdateMode() === void 0 ? {} : { toolUpdate: codexToolUpdateMode() },
 		reasoning: {
 			efforts: orderReasoningEfforts(efforts, GPT_56_REASONING_EFFORTS).map((effort) => ({
 				id: ReasoningEffortId(effort),
@@ -1202,6 +1204,46 @@ function resolveCodexModel(model, preferences, live) {
 	};
 }
 /**
+* Whether this line may state a tool change in the history instead of rewriting
+* the head.
+*
+* `in-history` rather than `addition-only`: this wire has an `additional_tools`
+* item to add a tool but nothing to withdraw one, so a removal has to keep its
+* declaration and travel as a note. Deleting the declaration would shorten the
+* head and throw the cached prefix away, which is the cost this mode exists to
+* avoid.
+*
+* `DSH_CODEX_TOOL_UPDATE=0` turns it off for one account without a code change,
+* the same escape hatch kimi-code carries for its own gate.
+*
+* @returns the mode to declare, or undefined when every request must restate the
+* complete tool list.
+*/
+function codexToolUpdateMode() {
+	if (toolUpdateRejected) return void 0;
+	const raw = (process.env.DSH_CODEX_TOOL_UPDATE ?? "").trim().toLowerCase();
+	if (raw !== "" && [
+		"0",
+		"false",
+		"no",
+		"off",
+		"none"
+	].includes(raw)) return void 0;
+	return "in-history";
+}
+/**
+* Set when a request that carried a tool change was refused with a 400.
+*
+* Process-wide and one-way: the failure mode of a stale probe is a lost cache
+* optimisation, and the failure mode of NOT latching is the same 400 on every
+* later turn. The asymmetry decides it.
+*/
+let toolUpdateRejected = false;
+/** Record a refusal, so every later request restates the complete tool list. */
+function disableCodexToolUpdate() {
+	toolUpdateRejected = true;
+}
+/**
 * Resolve the wire capabilities of one model.
 *
 * The live listing outranks the shipped table, because the backend is the
@@ -1752,7 +1794,7 @@ function parseListing(payload) {
 function parseListingEntry$1(value) {
 	const record = asRecord$20(value);
 	if (record === void 0) return [];
-	const id = asString$30(record.slug) ?? asString$30(record.id);
+	const id = asString$31(record.slug) ?? asString$31(record.id);
 	if (id === void 0) return [];
 	const contextWindow = asNumber$8(record.context_window) ?? asNumber$8(record.contextWindow);
 	const modalities = parseModalities(record.input_modalities);
@@ -1761,11 +1803,11 @@ function parseListingEntry$1(value) {
 	const fallback = CODEX_MODEL_CATALOG.find((entry) => entry.id === id);
 	return [{
 		id,
-		name: asString$30(record.display_name) ?? asString$30(record.displayName) ?? fallback?.name ?? id,
+		name: asString$31(record.display_name) ?? asString$31(record.displayName) ?? fallback?.name ?? id,
 		contextWindow: contextWindow !== void 0 && contextWindow > 0 ? contextWindow : null,
 		inputModalities: modalities ?? (fallback ? [...fallback.inputModalities] : ["text"]),
 		...efforts !== null ? { reasoningEfforts: efforts } : {},
-		defaultReasoningEffort: asString$30(record.default_reasoning_level) ?? fallback?.defaultReasoningEffort ?? null,
+		defaultReasoningEffort: asString$31(record.default_reasoning_level) ?? fallback?.defaultReasoningEffort ?? null,
 		...useResponsesLite !== void 0 ? { useResponsesLite } : {}
 	}];
 }
@@ -1773,7 +1815,7 @@ function parseModalities(value) {
 	if (!Array.isArray(value)) return null;
 	const out = [];
 	for (const item of value) {
-		const name = asString$30(item);
+		const name = asString$31(item);
 		if (name === "text" || name === "image") out.push(name);
 	}
 	return out.length > 0 ? out : null;
@@ -1788,7 +1830,7 @@ function parseEfforts(value) {
 	if (!Array.isArray(value)) return null;
 	const out = [];
 	for (const item of value) {
-		const effort = asString$30(item) ?? asString$30(asRecord$20(item)?.effort);
+		const effort = asString$31(item) ?? asString$31(asRecord$20(item)?.effort);
 		if (effort !== void 0 && !out.includes(effort)) out.push(effort);
 	}
 	return out.length > 0 ? out : null;
@@ -1813,7 +1855,7 @@ function accountKeyFor$1(credentials) {
 function asRecord$20(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
-function asString$30(value) {
+function asString$31(value) {
 	return typeof value === "string" && value !== "" ? value : void 0;
 }
 function asNumber$8(value) {
@@ -4434,7 +4476,7 @@ var OAuthService = class {
 			throw new OAuthServiceError("oauth-token-exchange-failed", `The ChatGPT device code could not be issued (${response.status}${detail === null ? "" : `, ${detail}`}).`, response.status);
 		}
 		const payload = await response.json().catch(() => null);
-		const record = isRecord$68(payload) ? payload : {};
+		const record = isRecord$67(payload) ? payload : {};
 		const authId = nonEmptyString$11(record.device_auth_id);
 		const userCode = nonEmptyString$11(record.user_code) ?? nonEmptyString$11(record.usercode);
 		if (authId === void 0 || userCode === void 0) throw new OAuthServiceError("oauth-token-exchange-failed", "ChatGPT returned no device code.");
@@ -4501,7 +4543,7 @@ var OAuthService = class {
 			const detail = deviceErrorIdentifier(payload);
 			throw new OAuthServiceError("oauth-token-exchange-failed", `The ChatGPT device confirmation was refused (${response.status}${detail === void 0 ? "" : `, ${detail}`}).`, response.status);
 		}
-		const record = isRecord$68(payload) ? payload : {};
+		const record = isRecord$67(payload) ? payload : {};
 		const authorizationCode = nonEmptyString$11(record.authorization_code);
 		const codeVerifier = nonEmptyString$11(record.code_verifier);
 		if (authorizationCode === void 0 || codeVerifier === void 0) throw new OAuthServiceError("oauth-token-exchange-failed", "ChatGPT confirmed the device code but returned no authorization code.");
@@ -4834,11 +4876,11 @@ const DEVICE_PENDING_STATUSES = /* @__PURE__ */ new Set([
 function isPendingDeviceAnswer(response, payload) {
 	if (response.status === 403 || response.status === 404) return true;
 	if (!response.ok && response.status !== 400) return false;
-	if (!isRecord$68(payload)) return false;
+	if (!isRecord$67(payload)) return false;
 	const status = payload.status;
 	if (typeof status === "string" && DEVICE_PENDING_STATUSES.has(status.toLowerCase())) return true;
 	const error = payload.error;
-	if (isRecord$68(error)) {
+	if (isRecord$67(error)) {
 		const code = error.code;
 		if (typeof code === "string" && DEVICE_PENDING_STATUSES.has(code.toLowerCase())) return true;
 	}
@@ -4852,18 +4894,18 @@ function isPendingDeviceAnswer(response, payload) {
 * wrong.
 */
 function deviceErrorIdentifier(payload) {
-	if (!isRecord$68(payload)) return void 0;
+	if (!isRecord$67(payload)) return void 0;
 	const candidates = [payload.code];
 	const error = payload.error;
 	if (typeof error === "string") candidates.push(error);
-	else if (isRecord$68(error)) candidates.push(error.code, error.type);
+	else if (isRecord$67(error)) candidates.push(error.code, error.type);
 	candidates.push(payload.status);
 	for (const candidate of candidates) if (typeof candidate === "string" && /^[a-z0-9_.-]{1,64}$/i.test(candidate)) return candidate;
 }
 function nonEmptyString$11(value) {
 	return typeof value === "string" && value !== "" ? value : void 0;
 }
-function isRecord$68(value) {
+function isRecord$67(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function oauthErrorIdentifier(response) {
@@ -5044,7 +5086,7 @@ const CODEX_CLI_CREDENTIAL_SOURCE = "codex";
 * here, and the import has to be repeated afterwards.
 */
 const ADOPTED_CODEX_CREDENTIAL_EXPIRED_HINT = "The sign-in imported from the Codex CLI has expired. Sign in again in the Codex CLI, then import it again from this settings card.";
-function isRecord$67(value) {
+function isRecord$66(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /** A trimmed, non-empty string, or nothing. */
@@ -5146,7 +5188,7 @@ function decodeJwtClaims$1(token) {
 	if (parts.length !== 3) return void 0;
 	try {
 		const value = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
-		return isRecord$67(value) ? value : void 0;
+		return isRecord$66(value) ? value : void 0;
 	} catch {
 		return;
 	}
@@ -5191,10 +5233,10 @@ function expiryFromAccessToken(accessToken) {
 * the file carries cannot reach the result.
 */
 function parseAdoptedCodexCredential(value, sourcePath) {
-	if (!isRecord$67(value)) return void 0;
+	if (!isRecord$66(value)) return void 0;
 	if (value.auth_mode !== "chatgpt") return void 0;
 	const tokens = value[CODEX_CLI_TOKENS_KEY];
-	if (!isRecord$67(tokens)) return void 0;
+	if (!isRecord$66(tokens)) return void 0;
 	const accessToken = nonEmptyString$10(tokens.access_token);
 	if (accessToken === void 0) return void 0;
 	const refreshToken = nonEmptyString$10(tokens.refresh_token);
@@ -5213,7 +5255,7 @@ function parseAdoptedCodexCredential(value, sourcePath) {
 		const email = claims === void 0 ? void 0 : nonEmptyString$10(claims.email);
 		if (email !== void 0) credentials.email = email;
 		const authClaims = claims === void 0 ? void 0 : claims[CODEX_AUTH_CLAIMS_KEY];
-		const planType = isRecord$67(authClaims) ? nonEmptyString$10(authClaims.chatgpt_plan_type) : void 0;
+		const planType = isRecord$66(authClaims) ? nonEmptyString$10(authClaims.chatgpt_plan_type) : void 0;
 		if (planType !== void 0) credentials.planType = planType;
 	}
 	const accountId = nonEmptyString$10(tokens.account_id);
@@ -5999,114 +6041,6 @@ function webServerOrigin(server) {
 	return `http://${server.host === "0.0.0.0" ? "127.0.0.1" : server.host}:${server.port}`;
 }
 //#endregion
-//#region src/host/common/llm-compat.ts
-/** This package's kind in the harness message-source map. */
-const PLUGIN_MESSAGE_SOURCE_KIND = "dsh-chatgpt-subscription";
-function isRecord$66(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/** Read a message body's blocks, keeping every entry that carries a block tag. */
-function readBlocks(raw) {
-	if (!Array.isArray(raw)) return [];
-	return raw.filter((block) => isRecord$66(block) && typeof block.type === "string");
-}
-/**
-* The first value that is a non-empty string.
-*
-* Used for fields the two generations spell in different places: a value that
-* is present but empty must not shadow a real one further down the chain, which
-* is what `??` alone does.
-*/
-function firstNonEmptyString(...values) {
-	for (const value of values) if (typeof value === "string" && value !== "") return value;
-	return "";
-}
-/**
-* The result block a `role: 'tool'` message already carries inside its body.
-*
-* Some harness generations deliver the call id inside the result block rather
-* than on the message, and one shape carries both: `role: 'tool'` with a
-* `tool-result` block holding the id. Reading only the message-level fields
-* leaves {@link toolCallIdOf} nothing to find.
-*/
-function embeddedToolResult(content) {
-	if (content.length !== 1) return void 0;
-	const [block] = content;
-	return block?.type === "tool-result" ? block : void 0;
-}
-/**
-* The call id one `role: 'tool'` message associates with its `tool-call`.
-*
-* The id is the only thing tying a result to the call it answers: a mapper that
-* sends it empty makes every result an orphan and tells the repair pass that no
-* call was answered, which some gateways reject outright (WorkBuddy answers
-* `11148`, "tool calls and tool results do not match"). It therefore has to be
-* read from every place the harness generations put it — the message, the
-* message's source, and the result block inside the body — and an empty string
-* must not shadow a later, real one.
-*/
-function toolCallIdOf(raw, source, embedded) {
-	return firstNonEmptyString(raw.toolCallId, raw.callId, source?.callId, embedded?.toolCallId);
-}
-/**
-* Normalize one harness message list into {@link Message}.
-*
-* A 0.1.7 `role: 'tool'` message is re-wrapped as the user-role message holding
-* one {@link ToolResultBlock} that the mappers expect, keeping the tool
-* provenance (`kind: 'tool'`) they use to tell a real tool result from a user
-* turn. A message that already carries that block keeps its own body instead of
-* nesting a second `tool-result` around it. Everything a newer harness adds
-* beside that keeps its own shape.
-* @param messages - Messages straight off the request options, in either generation's shape.
-* @returns The same conversation in the pre-0.1.7 vocabulary.
-*/
-function normalizeMessages(messages) {
-	const normalized = [];
-	for (const raw of messages ?? []) {
-		if (!isRecord$66(raw)) continue;
-		const content = readBlocks(raw.content);
-		if (raw.role === "tool") {
-			const source = isRecord$66(raw.source) ? raw.source : void 0;
-			const embedded = embeddedToolResult(content);
-			const callId = toolCallIdOf(raw, source, embedded);
-			const isError = raw.isError === true || embedded?.isError === true;
-			normalized.push({
-				id: raw.id,
-				role: "user",
-				content: [{
-					type: "tool-result",
-					toolCallId: callId,
-					content: embedded === void 0 ? content : embedded.content,
-					...isError ? { isError: true } : {}
-				}],
-				source: {
-					kind: "tool",
-					callId
-				}
-			});
-			continue;
-		}
-		normalized.push({
-			id: raw.id,
-			role: typeof raw.role === "string" ? raw.role : "user",
-			content,
-			...isRecord$66(raw.source) ? { source: raw.source } : {}
-		});
-	}
-	return normalized;
-}
-/**
-* Normalize request options for the mappers.
-* @param options - Request options the harness handed the adapter.
-* @returns The same options with {@link Message} history.
-*/
-function normalizeGenerateOptions(options) {
-	return {
-		...options,
-		messages: normalizeMessages(options.messages)
-	};
-}
-//#endregion
 //#region src/host/codex-images.ts
 /**
 * Output canvases the Codex image endpoint accepts in `size`.
@@ -8285,7 +8219,7 @@ function sanitizeText$9(text) {
 function isRecord$64(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function asString$29(value) {
+function asString$30(value) {
 	return typeof value === "string" ? value : void 0;
 }
 function safeJsonParse$9(text) {
@@ -8315,7 +8249,7 @@ function attachmentOf$5(block) {
 }
 function attachmentLabel$6(block) {
 	const attachment = isRecord$64(block.attachment) ? block.attachment : void 0;
-	return asString$29(attachment?.name) || asString$29(attachment?.attachmentId);
+	return asString$30(attachment?.name) || asString$30(attachment?.attachmentId);
 }
 function collectImageRefs$3(content, refs) {
 	if (!Array.isArray(content)) return;
@@ -8452,10 +8386,10 @@ function unavailableImageText$6(block) {
 	return `[image unavailable: ${label ? `${label} could not be read` : "the image could not be read"}; ask the user to attach it again if the image is needed]`;
 }
 function imageBlockToPart(block, images) {
-	let data = asString$29(block.data) || asString$29(block.base64);
+	let data = asString$30(block.data) || asString$30(block.base64);
 	const source = isRecord$64(block.source) ? block.source : void 0;
-	if (!data && source) data = asString$29(source.data) || asString$29(source.base64);
-	let mimeType = asString$29(block.mimeType) || asString$29(block.mediaType) || (source ? asString$29(source.mimeType) || asString$29(source.mediaType) : void 0) || "image/png";
+	if (!data && source) data = asString$30(source.data) || asString$30(source.base64);
+	let mimeType = asString$30(block.mimeType) || asString$30(block.mediaType) || (source ? asString$30(source.mimeType) || asString$30(source.mediaType) : void 0) || "image/png";
 	if (data?.startsWith("data:")) {
 		const match = data.match(/^data:([^;,]+);base64,(.*)$/s);
 		if (match) {
@@ -8529,7 +8463,7 @@ function replayBlockFor$1(message, index) {
 	}
 }
 function thoughtSignature(part) {
-	return asString$29(part?.thoughtSignature) || asString$29(part?.thought_signature) || asString$29(part?.thinkingSignature) || asString$29(part?.textSignature);
+	return asString$30(part?.thoughtSignature) || asString$30(part?.thought_signature) || asString$30(part?.thinkingSignature) || asString$30(part?.textSignature);
 }
 function replayPart(part) {
 	const copy = { ...part };
@@ -8628,7 +8562,7 @@ function assistantParts(message, model, runtimeModel, toolCalls) {
 		if (block.type === "reasoning" && runtimeModel.startsWith("claude-") && (message.source?.kind !== "model" || message.source.provider !== "antigravity" || !("model" in message.source) || message.source.model !== model.id)) continue;
 		const replay = replayBlockFor$1(message, index);
 		const originalParts = Array.isArray(replay?.parts) ? replay.parts.filter(isRecord$64) : [];
-		if ((block.type === "text" || block.type === "reasoning") && originalParts.length > 0 && originalParts.every((part) => !part.functionCall) && originalParts.map((part) => asString$29(part.text) || "").join("") === sanitizeText$9(String(block.text || ""))) {
+		if ((block.type === "text" || block.type === "reasoning") && originalParts.length > 0 && originalParts.every((part) => !part.functionCall) && originalParts.map((part) => asString$30(part.text) || "").join("") === sanitizeText$9(String(block.text || ""))) {
 			parts.push(...originalParts.map(replayPart));
 			continue;
 		}
@@ -8649,7 +8583,7 @@ function assistantParts(message, model, runtimeModel, toolCalls) {
 			const toolId = String(block.id || "");
 			const toolName = String(block.name || "");
 			const originalCall = originalParts.find((part) => isRecord$64(part.functionCall));
-			const wireId = asString$29((isRecord$64(originalCall?.functionCall) ? originalCall.functionCall : void 0)?.id) || (toolCallIdNeeded(model.id, runtimeModel) ? sanitizeToolCallId(toolId, toolName) : originalCall ? void 0 : toolId || void 0);
+			const wireId = asString$30((isRecord$64(originalCall?.functionCall) ? originalCall.functionCall : void 0)?.id) || (toolCallIdNeeded(model.id, runtimeModel) ? sanitizeToolCallId(toolId, toolName) : originalCall ? void 0 : toolId || void 0);
 			toolCalls.set(toolId, {
 				name: toolName,
 				id: wireId
@@ -8894,7 +8828,7 @@ function processStreamLine$4(line, state) {
 	if (!isRecord$64(chunk)) return [];
 	const responseData = isRecord$64(chunk.response) ? chunk.response : chunk;
 	const error = isRecord$64(chunk.error) ? chunk.error : isRecord$64(responseData.error) ? responseData.error : void 0;
-	if (error !== void 0) throw new LlmError$1(`Antigravity stream error: ${asString$29(error.message) ?? "unknown error"}`, isContextOverflow(error) ? CONTEXT_OVERFLOW_CODE : "PROVIDER_ERROR");
+	if (error !== void 0) throw new LlmError$1(`Antigravity stream error: ${asString$30(error.message) ?? "unknown error"}`, isContextOverflow(error) ? CONTEXT_OVERFLOW_CODE : "PROVIDER_ERROR");
 	const candidates = Array.isArray(responseData.candidates) ? responseData.candidates : [];
 	const candidate = isRecord$64(candidates[0]) ? candidates[0] : void 0;
 	const content = isRecord$64(candidate?.content) ? candidate.content : void 0;
@@ -8960,8 +8894,8 @@ function processStreamLine$4(line, state) {
 		if (isRecord$64(part.functionCall)) {
 			out.push(...closeCurrentBlock(state));
 			const fc = part.functionCall;
-			const toolName = asString$29(fc.name) || "";
-			const toolId = asString$29(fc.id) || sanitizeToolCallId("", toolName);
+			const toolName = asString$30(fc.name) || "";
+			const toolId = asString$30(fc.id) || sanitizeToolCallId("", toolName);
 			const argsText = JSON.stringify(isRecord$64(fc.args) ? fc.args : {});
 			const index = state.blocks.length;
 			const block = {
@@ -8999,10 +8933,10 @@ function processStreamLine$4(line, state) {
 	}
 	collectUsage(chunk.usageMetadata, state);
 	if (responseData !== chunk) collectUsage(responseData.usageMetadata, state);
-	const finishMessage = asString$29(candidate?.finishMessage);
+	const finishMessage = asString$30(candidate?.finishMessage);
 	if (finishMessage) state.finishMessage = finishMessage;
-	const blockReason = asString$29((isRecord$64(responseData.promptFeedback) ? responseData.promptFeedback : void 0)?.blockReason);
-	const finishReason = asString$29(candidate?.finishReason) || asString$29(responseData.finishReason) || (blockReason ? `PROMPT_BLOCKED:${blockReason}` : void 0);
+	const blockReason = asString$30((isRecord$64(responseData.promptFeedback) ? responseData.promptFeedback : void 0)?.blockReason);
+	const finishReason = asString$30(candidate?.finishReason) || asString$30(responseData.finishReason) || (blockReason ? `PROMPT_BLOCKED:${blockReason}` : void 0);
 	if (finishReason) {
 		state.finishReason = finishReason;
 		out.push(...closeCurrentBlock(state));
@@ -9077,7 +9011,7 @@ function closeStream$7(state) {
 function isRecord$63(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function asString$28(value) {
+function asString$29(value) {
 	return typeof value === "string" ? value : void 0;
 }
 /**
@@ -9138,7 +9072,7 @@ function attachmentOf$4(block) {
 }
 function attachmentLabel$5(block) {
 	const attachment = isRecord$63(block.attachment) ? block.attachment : void 0;
-	return asString$28(attachment?.name) || asString$28(attachment?.attachmentId);
+	return asString$29(attachment?.name) || asString$29(attachment?.attachmentId);
 }
 function collectImageRefs$2(content, refs) {
 	if (!Array.isArray(content)) return;
@@ -9172,9 +9106,9 @@ function base64Length$2(bytes) {
 * has no resolved map behaves exactly as before.
 */
 function inlinePayloadOf$1(block) {
-	let data = asString$28(block.data) || asString$28(block.base64);
+	let data = asString$29(block.data) || asString$29(block.base64);
 	const source = isRecord$63(block.source) ? block.source : void 0;
-	if (!data && source) data = asString$28(source.data) || asString$28(source.base64);
+	if (!data && source) data = asString$29(source.data) || asString$29(source.base64);
 	if (data?.startsWith("data:")) {
 		const matched = data.match(/^data:([^;,]+);base64,(.*)$/s);
 		if (matched) data = matched[2] ?? "";
@@ -9637,10 +9571,10 @@ function unavailableImageText$5(block) {
 	return `[image unavailable: ${label ? `${label} could not be read` : "the image could not be read"}; ask the user to attach it again if the image is needed]`;
 }
 function imageBlockToInline$3(block, images) {
-	let data = asString$28(block.data) || asString$28(block.base64);
+	let data = asString$29(block.data) || asString$29(block.base64);
 	const source = isRecord$63(block.source) ? block.source : void 0;
-	if (!data && source) data = asString$28(source.data) || asString$28(source.base64);
-	let mediaType = asString$28(block.mimeType) || asString$28(block.mediaType) || (source ? asString$28(source.mimeType) || asString$28(source.mediaType) : void 0) || "image/png";
+	if (!data && source) data = asString$29(source.data) || asString$29(source.base64);
+	let mediaType = asString$29(block.mimeType) || asString$29(block.mediaType) || (source ? asString$29(source.mimeType) || asString$29(source.mediaType) : void 0) || "image/png";
 	if (data?.startsWith("data:")) {
 		const matched = data.match(/^data:([^;,]+);base64,(.*)$/s);
 		if (matched) {
@@ -13217,6 +13151,21 @@ async function buildResponsesPayload(options, attachments, localRawImages = {},
 			});
 			continue;
 		}
+		if (message.role === "developer") {
+			input.push(...toolChangeItems(message, options.tools, wire.idNamespace));
+			const rest = message.content.filter((block) => block.type !== "tool-addition" && block.type !== "tool-removal");
+			if (rest.length > 0) {
+				const content = await mapContent({
+					...message,
+					content: rest
+				}, attachments, options.signal, localRawImages, localImageStats, resolveLocalRawImages);
+				if (content.length > 0) input.push({
+					role: "developer",
+					content
+				});
+			}
+			continue;
+		}
 		const content = await mapContent(message, attachments, options.signal, localRawImages, localImageStats, resolveLocalRawImages);
 		if (content.length > 0) input.push({
 			role: message.role,
@@ -13227,8 +13176,9 @@ async function buildResponsesPayload(options, attachments, localRawImages = {},
 	offloadOldestInputImages(input);
 	const instructionText = [...instructionParts, localRawImageInstruction(localImageStats)].filter((value) => Boolean(value)).join("\n\n");
 	const prefix = [];
-	const tools = options.tools ?? [];
-	if (useResponsesLite && tools.length > 0) prefix.push(additionalToolsItem(tools, wire.idNamespace));
+	const allTools = options.tools ?? [];
+	const tools = allTools.filter((tool) => tool.deferLoading !== true);
+	if (useResponsesLite && allTools.length > 0) prefix.push(additionalToolsItem(allTools, wire.idNamespace));
 	if (instructionText !== "") prefix.push(developerMessageItem(instructionText, wire.idNamespace, useResponsesLite));
 	input.unshift(...prefix);
 	const toolDeclarations = tools.length > 0 ? tools.map(toolDeclaration) : void 0;
@@ -13300,6 +13250,87 @@ function additionalToolsItem(tools, idNamespace) {
 	};
 }
 /**
+* The input items one mid-conversation tool change becomes.
+*
+* An addition travels as an `additional_tools` item at the point in the history
+* where it happened. The item carries the full definition, so the head never has
+* to grow it: everything before this position keeps its cached prefix and the
+* backend reads the new tool from here onward.
+*
+* A removal has no wire form of its own — there is no `tool_removal` item — so
+* the declaration stays exactly where it is and this note tells the model the
+* tool is gone. Dropping the declaration instead would shorten the head and
+* throw the prefix away, which is the cost `in-history` exists to avoid.
+*
+* Measured on the subscription backend by
+* `scripts/probe-codex-tool-updates.probe.ts`: the item is accepted, the model
+* calls a tool that only ever appeared in it, and a padded prefix stays cached
+* across the addition.
+*
+* @param message - the developer message carrying the change.
+* @param tools - the active declaration set the change resolves against.
+* @param idNamespace - the conversation identity, for stable item ids.
+* @returns the items to append at this position, in order.
+*/
+function toolChangeItems(message, tools, idNamespace) {
+	const byName = new Map((tools ?? []).map((tool) => [tool.name, tool]));
+	const added = [];
+	const removed = [];
+	for (const block of message.content) {
+		const name = typeof block["toolName"] === "string" ? block["toolName"] : "";
+		if (name === "") continue;
+		if (block["type"] === "tool-addition") {
+			const tool = byName.get(name);
+			if (tool !== void 0) added.push(toolDeclaration(tool));
+		} else if (block["type"] === "tool-removal") removed.push(name);
+	}
+	const items = [];
+	if (added.length > 0) items.push({
+		type: "additional_tools",
+		id: stableItemId("at", idNamespace, JSON.stringify(added)),
+		role: "developer",
+		tools: added
+	});
+	if (removed.length > 0) {
+		const text = toolRemovalNotice(removed);
+		items.push({
+			type: "message",
+			id: stableItemId("msg", idNamespace, text),
+			role: "developer",
+			content: [{
+				type: "input_text",
+				text
+			}]
+		});
+	}
+	return items;
+}
+/**
+* The same request with every tool change taken back out.
+*
+* This is the shape a backend that refuses the update channel gets: the complete
+* current declaration list at the head, no change messages, no deferred markers.
+* It is exactly what the line sent before the capability existed, so the fallback
+* costs a cache miss and nothing else.
+*
+* @param options - the request that was refused.
+* @returns a request the line can always send.
+*/
+function withoutCodexToolChanges(options) {
+	const messages = options.messages.filter((message) => !(message.role === "developer" && Array.isArray(message.content) && message.content.some((block) => block.type === "tool-addition" || block.type === "tool-removal")));
+	const tools = options.tools?.map(({ deferLoading: _deferred, ...tool }) => tool);
+	return {
+		...options,
+		messages,
+		...tools === void 0 ? {} : { tools }
+	};
+}
+/** How a withdrawn tool is stated to the model, imperatively. */
+function toolRemovalNotice(names) {
+	const list = names.map((name) => `"${name}"`).join(", ");
+	return names.length === 1 ? `[The tool ${list} is no longer available. Do not call it again: any call will fail.]` : `[The tools ${list} are no longer available. Do not call them again: any call will fail.]`;
+}
+/**
 * The base instructions as a developer message.
 *
 * The official client marks the item with the `model.base_instructions` kind, so
@@ -13686,6 +13717,8 @@ var ResponsesClient = class {
 		const turnKey = turnKeyFor(sessionId);
 		let currentModel = options.model;
 		let attemptOptions = options;
+		let strippedToolChanges = false;
+		const statesToolChange = (candidate) => candidate.messages.some((message) => message.role === "developer" && Array.isArray(message.content) && message.content.some((block) => block["type"] === "tool-addition" || block["type"] === "tool-removal"));
 		let response;
 		let release;
 		while (true) {
@@ -13711,6 +13744,12 @@ var ResponsesClient = class {
 						continue;
 					}
 				}
+				if (!strippedToolChanges && statesToolChange(attemptOptions) && error.status === 400) {
+					disableCodexToolUpdate();
+					attemptOptions = withoutCodexToolChanges(attemptOptions);
+					strippedToolChanges = true;
+					continue;
+				}
 				throw error;
 			}
 		}
@@ -20079,6 +20118,21 @@ const COMMAND_CODE_MODELS = [
 		maxTokens: 256e3,
 		hidden: false
 	},
+	{
+		id: "stealth/crouton-alpha",
+		name: "Crouton Alpha",
+		inputModalities: ["text", "image"],
+		reasoningEfforts: [
+			"low",
+			"medium",
+			"high",
+			"xhigh",
+			"max"
+		],
+		contextWindow: 1048576,
+		maxTokens: 943718,
+		hidden: false
+	},
 	{
 		id: "reflection/beam:free",
 		name: "Beam 1.0",
@@ -20096,7 +20150,7 @@ const COMMAND_CODE_MODELS = [
 	},
 	{
 		id: "poolside/laguna-s-2.1-free",
-		name: "Laguna S 2.1",
+		name: "Laguna S 2.1 (Free)",
 		inputModalities: ["text"],
 		reasoningEfforts: [],
 		contextWindow: 256e3,
@@ -20125,6 +20179,32 @@ const COMMAND_CODE_MODELS = [
 		maxTokens: 32768,
 		hidden: false
 	},
+	{
+		id: "inclusionai/ling-3.1-flash-1019",
+		name: "Ling 3.1 Flash 1019",
+		inputModalities: ["text"],
+		reasoningEfforts: [
+			"low",
+			"medium",
+			"high"
+		],
+		contextWindow: 1e6,
+		maxTokens: 262144,
+		hidden: false
+	},
+	{
+		id: "inclusionai/ling-3.1-flash-1019:free",
+		name: "Ling 3.1 Flash 1019",
+		inputModalities: ["text"],
+		reasoningEfforts: [
+			"low",
+			"medium",
+			"high"
+		],
+		contextWindow: 1e6,
+		maxTokens: 262144,
+		hidden: true
+	},
 	{
 		id: "meta/muse-spark-1.1",
 		name: "Muse Spark 1.1",
@@ -20286,42 +20366,37 @@ const COMMAND_CODE_MODELS = [
 function commandCodeModelDef(modelId) {
 	return COMMAND_CODE_MODELS.find((model) => model.id === modelId);
 }
-/**
-* Model ids the 1.88.2 catalog refresh added to the shipped default selection.
-*
-* The shipped default is the set of models the settings card offers before the
-* user edits it, and a stored selection that still equals it counts as "never
-* edited" (see `resolveEnabledModelIds` in `./routes.ts`). A refresh that
-* changed the default without saying so would make every untouched selection
-* from the previous release look edited, and the models this release adds
-* would stay hidden behind a list nobody touched. These two lists carry that
-* change: the retired ids are the ones the previous default had and this one
-* does not, and the added ids are the ones it gained.
-*/
-const SHIPPED_DEFAULT_ADDED_MODEL_IDS = [
-	"claude-haiku-5-5",
-	"gpt-6.1-terra",
-	"moonshotai/Kimi-K3.1-Pro",
-	"minimax/minimax-m3.1-flash",
-	"ornith/ornith-1.5-122b",
-	"Qwen/Qwen3.8-Max-Prime",
-	"google/gemini-4-argon",
-	"nvidia/nemotron-3.5-super-vl",
-	"stealth/glyph-cluster:free",
-	"reflection/beam:free",
-	"inclusionai/ling-3.1-flash",
-	"meta/muse-spark-open",
-	"meta/muse-wonder-1.0",
-	"mistral/mistral-large-4"
-];
-/** Model ids the 1.88.2 catalog refresh dropped from the shipped default selection. */
-const SHIPPED_DEFAULT_RETIRED_MODEL_IDS = [
-	"xiaomi/mimo-v2.5-pro",
-	"xiaomi/mimo-v2.5",
-	"stealth/space-bunny-alpha",
-	"inclusionai/ling-3.0-flash-sante:free",
-	"inclusionai/ling-3.1-flash:free"
-];
+/** Default-selection deltas recognized by `resolveEnabledModelIds` in `./routes.ts`. */
+const SHIPPED_DEFAULT_MIGRATIONS = [{
+	version: "1.88.4",
+	added: ["stealth/crouton-alpha", "inclusionai/ling-3.1-flash-1019"],
+	retired: []
+}, {
+	version: "1.88.2",
+	added: [
+		"claude-haiku-5-5",
+		"gpt-6.1-terra",
+		"moonshotai/Kimi-K3.1-Pro",
+		"minimax/minimax-m3.1-flash",
+		"ornith/ornith-1.5-122b",
+		"Qwen/Qwen3.8-Max-Prime",
+		"google/gemini-4-argon",
+		"nvidia/nemotron-3.5-super-vl",
+		"stealth/glyph-cluster:free",
+		"reflection/beam:free",
+		"inclusionai/ling-3.1-flash",
+		"meta/muse-spark-open",
+		"meta/muse-wonder-1.0",
+		"mistral/mistral-large-4"
+	],
+	retired: [
+		"xiaomi/mimo-v2.5-pro",
+		"xiaomi/mimo-v2.5",
+		"stealth/space-bunny-alpha",
+		"inclusionai/ling-3.0-flash-sante:free",
+		"inclusionai/ling-3.1-flash:free"
+	]
+}];
 //#endregion
 //#region src/host/command-code/types.ts
 const PROVIDER_ID$11 = "command-code";
@@ -20939,7 +21014,7 @@ function isRecord$61(value) {
 function asRecord$16(value) {
 	return isRecord$61(value) ? value : void 0;
 }
-function asString$27(value) {
+function asString$28(value) {
 	if (typeof value === "string" && value.trim() !== "") return value;
 	if (typeof value === "number" && Number.isFinite(value)) return String(value);
 }
@@ -20952,7 +21027,7 @@ function asNumber$6(value) {
 }
 function firstString$2(record, keys) {
 	for (const key of keys) {
-		const value = asString$27(record[key]);
+		const value = asString$28(record[key]);
 		if (value !== void 0) return value;
 	}
 }
@@ -21199,7 +21274,7 @@ function parseCreditBalances(payload, consumed = []) {
 /** Resolve the plan id the subscription or credits payload reports, when either does. */
 function parsePlanId(payloads) {
 	for (const payload of payloads) {
-		const id = asString$27(deepValue(payload, [
+		const id = asString$28(deepValue(payload, [
 			"planId",
 			"plan_id",
 			"priceId",
@@ -21218,7 +21293,7 @@ function parsePlanId(payloads) {
 */
 function parseSubscriptionStatus(payload) {
 	const root = asRecord$16(payload) ?? {};
-	return asString$27(deepValue(asRecord$16(root.data) ?? root, ["status"])) ?? null;
+	return asString$28(deepValue(asRecord$16(root.data) ?? root, ["status"])) ?? null;
 }
 /** End of the current billing period, in Unix milliseconds. */
 function parseSubscriptionPeriodEnd(payload) {
@@ -21794,6 +21869,92 @@ function buildModelOptions$2(catalog, enabledModelIds, overrides) {
 	});
 }
 //#endregion
+//#region src/host/common/orphan-tool-calls.ts
+/**
+* 读一个未知字段为字符串。
+* @param value - 候选值。
+* @returns 字符串，或任何其它类型的 undefined。
+*/
+function asString$27(value) {
+	return typeof value === "string" ? value : void 0;
+}
+/**
+* 清掉没有配对的工具调用。
+*
+* 配对规则只有一条：`tool_use` 必须被**后面第一条** user 轮里的同名 `tool_result` 应答；
+* 到了下一条 assistant 轮还没被应答，它就是孤儿。反向也一样——`tool_result` 找不到仍在
+* 等待的同名调用，它就是无主结果（线上报的是「tool call result does not follow tool call」）。
+*
+* @param messages - 已折叠过的消息列表。
+* @param refold - 调用方自己的相邻同角色折叠，清理后需要再折一次。
+* @returns 配对完整、且没有空消息的消息列表；清理会把整段历史清空时原样返回。
+*/
+function cleanOrphanedToolCalls(messages, refold) {
+	const result = [];
+	let pending = [];
+	/**
+	* 丢掉没有被结果应答的调用。
+	* @param answered - 已经被结果应答的 id 集合。
+	*/
+	const dropUnanswered = (answered) => {
+		const byMessage = /* @__PURE__ */ new Map();
+		for (const call of pending) {
+			if (answered.has(call.id)) continue;
+			const indices = byMessage.get(call.messageIndex);
+			if (indices === void 0) byMessage.set(call.messageIndex, [call.blockIndex]);
+			else indices.push(call.blockIndex);
+		}
+		for (const [messageIndex, indices] of byMessage) {
+			const message = result[messageIndex];
+			if (message === void 0) continue;
+			message.content = message.content.filter((_block, index) => !indices.includes(index));
+		}
+		pending = [];
+	};
+	for (const message of messages) {
+		if (message.role === "assistant") {
+			dropUnanswered(/* @__PURE__ */ new Set());
+			const messageIndex = result.length;
+			for (let blockIndex = 0; blockIndex < message.content.length; blockIndex += 1) {
+				const block = message.content[blockIndex];
+				if (block.type !== "tool_use") continue;
+				const id = asString$27(block.id);
+				if (id === void 0) continue;
+				pending.push({
+					messageIndex,
+					blockIndex,
+					id
+				});
+			}
+			result.push({
+				...message,
+				content: [...message.content]
+			});
+			continue;
+		}
+		const answered = /* @__PURE__ */ new Set();
+		const content = [];
+		for (const block of message.content) {
+			if (block.type === "tool_result") {
+				const id = asString$27(block.tool_use_id);
+				if (id === void 0 || !pending.some((call) => call.id === id)) continue;
+				answered.add(id);
+				content.push(block);
+				continue;
+			}
+			content.push(block);
+		}
+		dropUnanswered(answered);
+		result.push({
+			...message,
+			content
+		});
+	}
+	dropUnanswered(/* @__PURE__ */ new Set());
+	const nonEmpty = result.filter((message) => message.content.length > 0);
+	return nonEmpty.length === 0 ? messages : refold(nonEmpty);
+}
+//#endregion
 //#region src/host/command-code/mapper.ts
 /**
 * Provider-wire mapping for the two Command Code provider endpoints.
@@ -22350,7 +22511,7 @@ function anthropicAssistantContent$3(message) {
 * the Messages wire wants one user turn, so consecutive turns of one role are
 * folded together in order.
 */
-function mergeAnthropicMessages$3(entries) {
+function mergeAnthropicMessages$4(entries) {
 	const merged = [];
 	for (const entry of entries) {
 		if (entry.content.length === 0) continue;
@@ -22441,7 +22602,7 @@ function buildAnthropicRequest$1(options, images = NO_RESOLVED_IMAGES$3) {
 	return {
 		model: options.model,
 		max_tokens: maxTokens,
-		messages: mergeAnthropicMessages$3(entries),
+		messages: cleanOrphanedToolCalls(mergeAnthropicMessages$4(entries), mergeAnthropicMessages$4),
 		...system === void 0 ? {} : { system: anthropicSystemBlocks(system) },
 		...options.temperature === void 0 || budget !== void 0 ? {} : { temperature: options.temperature },
 		...options.stop && options.stop.length > 0 ? { stop_sequences: options.stop } : {},
@@ -22743,6 +22904,23 @@ function applyOpenAIToolDelta$1(entry, state) {
 	const fn = isRecord$60(entry.function) ? entry.function : {};
 	const out = [];
 	let call = state.toolCalls.get(wireIndex);
+	const incomingId = asString$26(entry.id);
+	if (call !== void 0 && incomingId !== void 0 && call.id !== `call_${wireIndex}` && incomingId !== call.id) {
+		const closedBlock = {
+			type: "tool-call",
+			id: toToolCallId(call.id),
+			name: call.name,
+			arguments: call.arguments === "" ? "{}" : call.arguments
+		};
+		state.blocks[call.blockIndex] = closedBlock;
+		out.push({
+			type: "block-end",
+			index: call.blockIndex,
+			block: closedBlock
+		});
+		state.toolCalls.delete(wireIndex);
+		call = void 0;
+	}
 	if (call === void 0) {
 		out.push(...closeCurrent$6(state));
 		call = {
@@ -24692,16 +24870,20 @@ function resolveEnabledModelIds$5(stored, catalog, enabled = true) {
 /**
 * Whether a stored selection still is a shipped default.
 *
-* The current one, and the one the previous release shipped: the refresh moved
-* a handful of models in and out of the default, and the difference between the
-* two defaults is exactly the pair of id lists the catalog records.
+* Walk the recorded catalog refreshes newest-first. Each step reconstructs one
+* earlier default, so users who never edited either the immediate previous
+* release or an older recorded release still receive the current catalog.
 */
 function isUneditedSelection(stored, shipped) {
 	if (stored.length === 0) return false;
 	if (sameSelection(stored, shipped)) return true;
-	const previous = new Set([...shipped].filter((id) => !SHIPPED_DEFAULT_ADDED_MODEL_IDS.includes(id)));
-	for (const id of SHIPPED_DEFAULT_RETIRED_MODEL_IDS) previous.add(id);
-	return sameSelection(stored, previous);
+	let previous = new Set(shipped);
+	for (const migration of SHIPPED_DEFAULT_MIGRATIONS) {
+		previous = new Set([...previous].filter((id) => !migration.added.includes(id)));
+		for (const id of migration.retired) previous.add(id);
+		if (sameSelection(stored, previous)) return true;
+	}
+	return false;
 }
 /** Whether two id lists name exactly the same models, in any order. */
 function sameSelection(stored, other) {
@@ -34524,7 +34706,7 @@ function anthropicAssistantContent$2(message, toolCallIds) {
 * the Messages wire wants one user turn, so consecutive turns of one role are
 * folded together in order.
 */
-function mergeAnthropicMessages$2(entries) {
+function mergeAnthropicMessages$3(entries) {
 	const merged = [];
 	for (const entry of entries) {
 		if (entry.content.length === 0) continue;
@@ -34577,7 +34759,7 @@ function buildAnthropicRequest(options, images = NO_RESOLVED_IMAGES$4, media = {
 		type: CLEAR_THINKING_EDIT,
 		keep: "all"
 	}] } : void 0;
-	const messages = mergeAnthropicMessages$2(entries);
+	const messages = cleanOrphanedToolCalls(mergeAnthropicMessages$3(entries), mergeAnthropicMessages$3);
 	const lastMessage = messages[messages.length - 1];
 	if (lastMessage !== void 0 && Array.isArray(lastMessage.content) && lastMessage.content.length > 0) {
 		const lastBlock = lastMessage.content[lastMessage.content.length - 1];
@@ -34890,6 +35072,23 @@ function applyOpenAIToolDelta(entry, state) {
 	const fn = isRecord$53(entry.function) ? entry.function : {};
 	const out = [];
 	let call = state.toolCalls.get(wireIndex);
+	const incomingId = asString$21(entry.id);
+	if (call !== void 0 && incomingId !== void 0 && call.id !== `call_${wireIndex}` && incomingId !== call.id) {
+		const closedBlock = {
+			type: "tool-call",
+			id: toToolCallId(state.toolCallIds.normalize(call.id)),
+			name: call.name,
+			arguments: call.arguments === "" ? "{}" : call.arguments
+		};
+		state.blocks[call.blockIndex] = closedBlock;
+		out.push({
+			type: "block-end",
+			index: call.blockIndex,
+			block: closedBlock
+		});
+		state.toolCalls.delete(wireIndex);
+		call = void 0;
+	}
 	if (call === void 0) {
 		out.push(...closeCurrent$5(state));
 		call = {
@@ -36876,7 +37075,7 @@ const KIMI_CODE_REQUEST_IMAGE_MAX_EDGE = 2e3;
 * @param catalog - live catalog, possibly empty when offline.
 * @returns the tool-update mode, or undefined when this route must resend everything.
 */
-function toolUpdateMode$1(modelId, catalog) {
+function toolUpdateMode$2(modelId, catalog) {
 	if (!dynamicToolsForEntry(modelId, catalog)) return void 0;
 	if (wireForCatalogEntry(modelId, catalog) !== "openai") return void 0;
 	const raw = (process.env.DSH_KIMI_CODE_TOOL_UPDATE ?? "").trim().toLowerCase();
@@ -37279,7 +37478,7 @@ var KimiCodeAdapter = class extends LlmAdapter {
 			id: modelId,
 			name: entry?.name ?? modelId,
 			inputModalities: inputModalitiesForEntry(modelId, catalog),
-			...toolUpdateMode$1(modelId, catalog) === void 0 ? {} : { toolUpdate: toolUpdateMode$1(modelId, catalog) },
+			...toolUpdateMode$2(modelId, catalog) === void 0 ? {} : { toolUpdate: toolUpdateMode$2(modelId, catalog) },
 			context: { contextWindow: this.contextWindowFor(modelId, entry, settings.contextWindowOverrides) },
 			...efforts.length === 0 ? {} : { reasoning: {
 				efforts: efforts.map((effort) => ({
@@ -40932,7 +41131,7 @@ function anthropicAssistantContent$1(message, expectedScope) {
 * Messages wire wants one user turn, so consecutive turns of one role are folded
 * together in order.
 */
-function mergeAnthropicMessages$1(entries) {
+function mergeAnthropicMessages$2(entries) {
 	const merged = [];
 	for (const entry of entries) {
 		if (entry.content.length === 0) continue;
@@ -41154,7 +41353,7 @@ function buildMinimaxRequest(options, images = NO_RESOLVED_IMAGES$2, request = {
 		model: options.model,
 		max_tokens: maxTokens,
 		stream: true,
-		messages: mergeAnthropicMessages$1(entries),
+		messages: cleanOrphanedToolCalls(mergeAnthropicMessages$2(entries), mergeAnthropicMessages$2),
 		...system === void 0 ? {} : { system: caching ? [{
 			type: "text",
 			text: system
@@ -49697,6 +49896,16 @@ function isClaudeCacheTtl$1(value) {
 * models (`THINKING_BINDING_CONTROLS_BETA`, pushed when `supportsMidConvoEffort`).
 */
 const THINKING_BINDING_CONTROLS_BETA = "thinking-binding-controls-2026-08-01";
+/**
+* Licenses a mid-conversation `tool_addition` / `tool_removal` block.
+*
+* A tool change stated inside a `role: "system"` message is a beta shape: without
+* this marker the blocks are an unknown content type and the request is refused.
+* The name carries its own date because the vendor versions the shape, so a
+* future revision arrives as a new constant rather than as a silent behaviour
+* change under the old one.
+*/
+const INLINE_TOOLS_BETA = "inline-tools-2026-09-15";
 /** Anthropic protocol revision sent as `anthropic-version`. */
 const ANTHROPIC_VERSION$1 = "2023-06-01";
 /**
@@ -51323,6 +51532,7 @@ function claudeBetas(options = {}) {
 	if (options.thinking === true) betas.push(INTERLEAVED_THINKING_BETA);
 	if (options.thinkingBinding === true) betas.push(THINKING_BINDING_CONTROLS_BETA);
 	if (options.cacheTtl === "1h") betas.push(EXTENDED_CACHE_TTL_BETA);
+	if (options.toolChanges === true) betas.push(INLINE_TOOLS_BETA);
 	return betas;
 }
 /** The `User-Agent` value this line reports for one surface. */
@@ -53423,10 +53633,85 @@ function wireTool(tool, names) {
 	return {
 		name: claudeWireToolName(tool.name, names),
 		description: tool.description ?? "",
-		input_schema: schema
+		input_schema: schema,
+		...tool.deferLoading === true ? { defer_loading: true } : {}
 	};
 }
 /**
+* The stand-in declaration a request needs when every real tool is deferred.
+*
+* The vendor's rule is that at least one tool must stay active: a request whose
+* declarations are all deferred has no active declaration, and a tool change
+* stated in that state would move the start of the rendered prompt. Transcribed
+* from the harness's own anthropic-messages adapter, which inserts the same
+* placeholder for the same reason.
+*/
+const CLAUDE_TOOL_UPDATE_PLACEHOLDER = {
+	name: "tool_update_placeholder",
+	description: "Reserved. Keeps one tool declaration active so a mid-conversation tool change stays in the history. Never call it.",
+	parameters: {
+		type: "object",
+		properties: {}
+	}
+};
+/** Whether one message states a tool change this wire can carry. */
+function claudeMessageStatesToolChange(message) {
+	return Array.isArray(message.content) && message.content.some((block) => isRecord$41(block) && (block.type === "tool-addition" || block.type === "tool-removal"));
+}
+/**
+* The fallback statement of one tool change, for a history position the vendor
+* will not accept a mid-conversation system message in.
+*
+* The declarations are untouched in both shapes: this only tells the model what
+* changed, and it is deliberately imperative for a removal because the
+* declaration is still there and could otherwise still be called.
+*/
+function claudeToolChangeNote(message) {
+	const added = [];
+	const removed = [];
+	for (const block of message.content) {
+		if (!isRecord$41(block)) continue;
+		const name = typeof block.toolName === "string" ? block.toolName.trim() : "";
+		if (name === "") continue;
+		if (block.type === "tool-addition") added.push(name);
+		else if (block.type === "tool-removal") removed.push(name);
+	}
+	const notes = [];
+	if (added.length > 0) notes.push(`[The tool(s) ${added.map((name) => `"${name}"`).join(", ")} are now available.]`);
+	if (removed.length > 0) notes.push(`[The tool(s) ${removed.map((name) => `"${name}"`).join(", ")} are no longer available. Do not call them again: any call will fail.]`);
+	return notes.join("\n");
+}
+/** Whether any message states a tool change that this wire can carry. */
+function claudeHasToolChanges(options) {
+	return options.messages.some((message) => message.role === "developer" && Array.isArray(message.content) && message.content.some((block) => isRecord$41(block) && (block.type === "tool-addition" || block.type === "tool-removal")));
+}
+/**
+* Whether a BUILT payload carries a `tool_addition` / `tool_removal` block.
+*
+* Read off the body rather than from the request, so the beta header and the
+* blocks it licenses cannot disagree about one request.
+*/
+function claudeBodyHasToolChanges(payload) {
+	const messages = payload["messages"];
+	if (!Array.isArray(messages)) return false;
+	return messages.some((message) => {
+		const content = message["content"];
+		return Array.isArray(content) && content.some((block) => block["type"] === "tool_addition" || block["type"] === "tool_removal");
+	});
+}
+/**
+* The wire tool list for one request.
+*
+* Deferred declarations travel with `defer_loading` so they stay out of the
+* prefix. When EVERY declaration is deferred and the history states a change,
+* one placeholder is prepended: the vendor refuses a tool change on a request
+* that has no active declaration at all.
+*/
+function claudeWireTools(options, names) {
+	const tools = options.tools ?? [];
+	return (tools.length > 0 && tools.every((tool) => tool.deferLoading === true) && claudeHasToolChanges(options) ? [CLAUDE_TOOL_UPDATE_PLACEHOLDER, ...tools] : tools).map((tool) => wireTool(tool, names));
+}
+/**
 * One system-role turn's blocks.
 *
 * The vendor documents a mid-conversation system message as carrying "a plain
@@ -53452,6 +53737,17 @@ function claudeSystemContent(message, images) {
 			continue;
 		}
 		if (block.type === "image") blocks.push(imageBlockFor(block, images));
+		if (block.type === "tool-addition" || block.type === "tool-removal") {
+			const name = typeof block.toolName === "string" ? block.toolName.trim() : "";
+			if (name === "") continue;
+			blocks.push({
+				type: block.type === "tool-addition" ? "tool_addition" : "tool_removal",
+				tool: {
+					type: "tool_reference",
+					name: claudeWireToolName(name)
+				}
+			});
+		}
 	}
 	return blocks;
 }
@@ -53655,7 +53951,9 @@ function buildClaudeRequestBody(options, images = NO_RESOLVED_IMAGES$1, request
 	const maxTokens = claudeRequestThinks(options.model, effort, catalog) ? adjustMaxTokensForThinking(baseMax, modelMax, level, request.thinkingBudgets).maxTokens : baseMax;
 	const { thinking, outputConfig } = claudeThinking(options.model, effort, level, maxTokens, request.thinkingBudgets, catalog);
 	const entries = [];
-	for (const message of messagesForTheWire(options)) {
+	const wire = messagesForTheWire(options);
+	for (let index = 0; index < wire.length; index += 1) {
+		const message = wire[index];
 		if (message.role === "system") {
 			entries.push({
 				role: "system",
@@ -53663,6 +53961,26 @@ function buildClaudeRequestBody(options, images = NO_RESOLVED_IMAGES$1, request
 			});
 			continue;
 		}
+		if (message.role === "developer" && claudeMessageStatesToolChange(message)) {
+			const previous = wire[index - 1];
+			const next = wire[index + 1];
+			if (previous !== void 0 && wireRoleOf(previous) === "user" && (next === void 0 || wireRoleOf(next) === "assistant")) {
+				entries.push({
+					role: "system",
+					content: claudeSystemContent(message, images)
+				});
+				continue;
+			}
+			const note = claudeToolChangeNote(message);
+			if (note !== "") entries.push({
+				role: "user",
+				content: [{
+					type: "text",
+					text: note
+				}]
+			});
+			continue;
+		}
 		if (isToolResultMessage$5(message)) {
 			entries.push({
 				role: "user",
@@ -53684,8 +54002,8 @@ function buildClaudeRequestBody(options, images = NO_RESOLVED_IMAGES$1, request
 		max_tokens: maxTokens,
 		stream: true,
 		system: buildClaudeSystemBlocks(options, caching, cacheTtl),
-		messages: mergeClaudeMessages(entries),
-		...options.tools !== void 0 && options.tools.length > 0 ? { tools: options.tools.map((tool) => wireTool(tool, names)) } : {},
+		messages: cleanOrphanedToolCalls(mergeClaudeMessages(entries), mergeClaudeMessages),
+		...options.tools !== void 0 && options.tools.length > 0 ? { tools: claudeWireTools(options, names) } : {},
 		...thinking === void 0 ? {} : { thinking },
 		...outputConfig === void 0 ? {} : { output_config: outputConfig },
 		...temperatureAllowed && options.temperature !== void 0 ? { temperature: options.temperature } : {},
@@ -55511,6 +55829,33 @@ var ClaudeAccountTokenStore = class {
 		await this.store.saveAccount(credentials, { internalId: this.internalId });
 	}
 };
+/**
+* Whether this model may state a tool change in the history.
+*
+* Gated on the same capability that licenses a mid-conversation system message,
+* because that message is what carries the change: a model that folds those
+* messages back into the top-level `system` field cannot take a tool change
+* without moving the head, which is the cost the capability exists to avoid.
+*
+* `DSH_CLAUDE_TOOL_UPDATE=0` turns it off for one account without a code change,
+* mirroring the escape hatch kimi-code and the codex line carry.
+*
+* @param modelId - exact model id.
+* @returns the mode to declare, or undefined when every request must restate the
+* complete tool list.
+*/
+function toolUpdateMode$1(modelId) {
+	if (!claudeSupportsMidConversationSystemMessages(modelId)) return void 0;
+	const raw = (process.env.DSH_CLAUDE_TOOL_UPDATE ?? "").trim().toLowerCase();
+	if (raw !== "" && [
+		"0",
+		"false",
+		"no",
+		"off",
+		"none"
+	].includes(raw)) return void 0;
+	return "in-history";
+}
 var ClaudeAdapter = class ClaudeAdapter extends LlmAdapter {
 	store;
 	modelSettings;
@@ -55626,6 +55971,7 @@ var ClaudeAdapter = class ClaudeAdapter extends LlmAdapter {
 			inputModalities: entry.supportsImage ? ["text", "image"] : ["text"],
 			context: { contextWindow: contextWindow || 2e5 },
 			...outputReservation(contextWindow || 2e5, maxOutputTokensFor(modelId, catalog)),
+			...toolUpdateMode$1(modelId) === void 0 ? {} : { toolUpdate: toolUpdateMode$1(modelId) },
 			...efforts.length === 0 ? {} : { reasoning: {
 				efforts: efforts.map((effort) => ({
 					id: ReasoningEffortId(effort),
@@ -55724,6 +56070,7 @@ var ClaudeAdapter = class ClaudeAdapter extends LlmAdapter {
 					model: requestOptions.model,
 					thinking,
 					thinkingBinding: claudeBodyBindsThinking(payload),
+					toolChanges: claudeBodyHasToolChanges(payload),
 					cacheTtl,
 					method: "POST"
 				}),
@@ -59228,7 +59575,7 @@ function safeStringify(value) {
 * DSH 历史里可能连续两条 user（注入的上下文提示 + 真正的用户轮），而工具结果本身就是
 * user 角色消息；Messages 线要的是一个 user 轮，所以同角色的连续轮按顺序折叠。
 */
-function mergeAnthropicMessages(entries) {
+function mergeAnthropicMessages$1(entries) {
 	const merged = [];
 	for (const entry of entries) {
 		if (entry.content.length === 0) continue;
@@ -59377,7 +59724,7 @@ function buildGlmAnthropicRequest(options, request = {}) {
 	}
 	const system = glmAnthropicSystemBlocks(options);
 	const maxTokens = options.maxTokens ?? request.defaultMaxTokens ?? 32768;
-	const merged = mergeAnthropicMessages(entries);
+	const merged = cleanOrphanedToolCalls(mergeAnthropicMessages$1(entries), mergeAnthropicMessages$1);
 	const lastMessageIndex = merged.length - 1;
 	const messages = lastMessageIndex < 0 ? merged : merged.map((message, index) => index === lastMessageIndex ? {
 		...message,
@@ -60704,6 +61051,23 @@ function applyToolDelta$3(entry, state) {
 	const fn = isRecord$37(entry.function) ? entry.function : {};
 	const out = [];
 	let call = state.toolCalls.get(wireIndex);
+	const incomingId = asString$14(entry.id);
+	if (call !== void 0 && incomingId !== void 0 && call.id !== `call_${wireIndex}` && incomingId !== call.id) {
+		const closedBlock = {
+			type: "tool-call",
+			id: toToolCallId(call.id),
+			name: call.name,
+			arguments: call.arguments === "" ? "{}" : call.arguments
+		};
+		state.blocks[call.blockIndex] = closedBlock;
+		out.push({
+			type: "block-end",
+			index: call.blockIndex,
+			block: closedBlock
+		});
+		state.toolCalls.delete(wireIndex);
+		call = void 0;
+	}
 	if (call === void 0) {
 		out.push(...closeCurrent$3(state));
 		call = {
@@ -65537,6 +65901,23 @@ function applyToolDelta$2(entry, state) {
 	const fn = isRecord$33(entry.function) ? entry.function : void 0;
 	const out = [];
 	let call = state.toolCalls.get(wireIndex);
+	const incomingId = asString$10(entry.id);
+	if (call !== void 0 && incomingId !== void 0 && call.id !== `call_${wireIndex}` && incomingId !== call.id) {
+		const closedBlock = {
+			type: "tool-call",
+			id: toToolCallId(call.id),
+			name: call.name,
+			arguments: call.arguments === "" ? "{}" : call.arguments
+		};
+		state.blocks[call.blockIndex] = closedBlock;
+		out.push({
+			type: "block-end",
+			index: call.blockIndex,
+			block: closedBlock
+		});
+		state.toolCalls.delete(wireIndex);
+		call = void 0;
+	}
 	if (call === void 0) {
 		const opened = openToolCall$1(state, entry, wireIndex);
 		out.push(...opened.chunks);
@@ -71801,6 +72182,7 @@ async function* translate(payloads) {
 				if (!isRecord$26(call)) continue;
 				const index = Number(call.index ?? 0);
 				let block = toolBlocks.get(index);
+				if (block !== void 0 && typeof call.id === "string" && call.id.length > 0 && block.callId !== void 0 && block.callId.length > 0 && block.callId !== call.id) block = void 0;
 				if (block === void 0) {
 					block = open("tool-call");
 					toolBlocks.set(index, block);
@@ -71812,7 +72194,7 @@ async function* translate(payloads) {
 				}
 				const fn = isRecord$26(call.function) ? call.function : {};
 				block.callId = acceptIdentity$1(block.callId, call.id);
-				block.name = acceptIdentity$1(block.name, fn.name);
+				if (block.name === void 0 || block.name === "") block.name = acceptIdentity$1(block.name, fn.name);
 				const fragment = typeof fn.arguments === "string" ? fn.arguments : "";
 				block.text += fragment;
 				yield {
@@ -78539,6 +78921,23 @@ function applyToolDelta$1(entry, state) {
 	const fn = isRecord$21(entry.function) ? entry.function : void 0;
 	const out = [];
 	let call = state.toolCalls.get(wireIndex);
+	const incomingId = asString$7(entry.id);
+	if (call !== void 0 && incomingId !== void 0 && call.id !== "call_" + wireIndex && incomingId !== call.id) {
+		const closedBlock = {
+			type: "tool-call",
+			id: toToolCallId(call.id),
+			name: call.name,
+			arguments: call.arguments === "" ? "{}" : call.arguments
+		};
+		state.blocks[call.blockIndex] = closedBlock;
+		out.push({
+			type: "block-end",
+			index: call.blockIndex,
+			block: closedBlock
+		});
+		state.toolCalls.delete(wireIndex);
+		call = void 0;
+	}
 	if (call === void 0) {
 		const opened = openToolCall(state, entry, wireIndex);
 		out.push(...opened.chunks);
@@ -83757,6 +84156,7 @@ async function* translate$1(payloads) {
 				if (!isRecord$17(call)) continue;
 				const index = Number(call.index ?? 0);
 				let block = toolBlocks.get(index);
+				if (block !== void 0 && typeof call.id === "string" && call.id.length > 0 && block.callId !== void 0 && block.callId.length > 0 && block.callId !== call.id) block = void 0;
 				if (block === void 0) {
 					block = open("tool-call");
 					toolBlocks.set(index, block);
@@ -83768,7 +84168,7 @@ async function* translate$1(payloads) {
 				}
 				const fn = isRecord$17(call.function) ? call.function : {};
 				block.callId = acceptIdentity(block.callId, call.id);
-				block.name = acceptIdentity(block.name, fn.name);
+				if (block.name === void 0 || block.name === "") block.name = acceptIdentity(block.name, fn.name);
 				const fragment = typeof fn.arguments === "string" ? fn.arguments : "";
 				block.text += fragment;
 				yield {
@@ -87295,9 +87695,9 @@ function installToolResultPrunerGuard(ctx, options = {}) {
 	const wrapPruner = (pruner) => {
 		if (disposed || !isRecord$14(pruner)) return false;
 		if (alreadyWrapped.has(pruner)) return false;
-		const target = resolveMethodTarget$3(pruner, "pruneSession");
+		const target = resolveMethodTarget$4(pruner, "pruneSession");
 		if (target === void 0) return false;
-		if (alreadyPatched$3(patchedMethods, target.holder, target.name)) {
+		if (alreadyPatched$4(patchedMethods, target.holder, target.name)) {
 			alreadyWrapped.add(pruner);
 			return false;
 		}
@@ -87309,11 +87709,11 @@ function installToolResultPrunerGuard(ctx, options = {}) {
 			};
 			return original.call(this ?? pruner, session);
 		};
-		if (!installMethod$3(target, replacement)) return false;
-		markPatched$3(patchedMethods, target.holder, target.name);
+		if (!installMethod$4(target, replacement)) return false;
+		markPatched$4(patchedMethods, target.holder, target.name);
 		alreadyWrapped.add(pruner);
 		restores.push(() => {
-			restoreMethod$3(target);
+			restoreMethod$4(target);
 		});
 		return true;
 	};
@@ -87533,7 +87933,7 @@ function isRecord$14(value) {
 * @param name - 方法名。
 * @returns 目标；方法不存在时为 `undefined`。
 */
-function resolveMethodTarget$3(service, name) {
+function resolveMethodTarget$4(service, name) {
 	if (typeof service !== "object" || service === null) return void 0;
 	const own = service;
 	if (Object.prototype.hasOwnProperty.call(own, name)) {
@@ -87565,7 +87965,7 @@ function resolveMethodTarget$3(service, name) {
 * @param replacement - 包装实现。
 * @returns 是否装上了。
 */
-function installMethod$3(target, replacement) {
+function installMethod$4(target, replacement) {
 	try {
 		Object.defineProperty(target.holder, target.name, {
 			value: replacement,
@@ -87583,7 +87983,7 @@ function installMethod$3(target, replacement) {
 *
 * @param target - 目标。
 */
-function restoreMethod$3(target) {
+function restoreMethod$4(target) {
 	try {
 		if (target.descriptor === void 0) Reflect.deleteProperty(target.holder, target.name);
 		else Object.defineProperty(target.holder, target.name, target.descriptor);
@@ -87597,7 +87997,7 @@ function restoreMethod$3(target) {
 * @param name - 方法名。
 * @returns 是否已经包过。
 */
-function alreadyPatched$3(patched, holder, name) {
+function alreadyPatched$4(patched, holder, name) {
 	return patched.get(holder)?.has(name) === true;
 }
 /**
@@ -87607,7 +88007,7 @@ function alreadyPatched$3(patched, holder, name) {
 * @param holder - 方法宿主。
 * @param name - 方法名。
 */
-function markPatched$3(patched, holder, name) {
+function markPatched$4(patched, holder, name) {
 	const names = patched.get(holder);
 	if (names === void 0) patched.set(holder, /* @__PURE__ */ new Set([name]));
 	else names.add(name);
@@ -87622,7 +88022,7 @@ const GLOBAL_KEY$2 = Object.freeze({});
 * @param service - 服务名。
 * @returns 服务实例或 undefined。
 */
-function serviceOf$1(ctx, service) {
+function serviceOf$2(ctx, service) {
 	const read = ctx?.get;
 	if (typeof read !== "function") return void 0;
 	try {
@@ -87644,11 +88044,15 @@ function bucketOf$1(value) {
 * @param ctx - 宿主上下文。
 * @param event - 事件名。
 * @param listener - 监听器。
+* @param options - cordis 订阅选项；省略时按两参数订阅。
 * @returns 解绑函数或 undefined。
 */
-function subscribe$3(ctx, event, listener) {
+function subscribe$3(ctx, event, listener, options) {
 	const on = ctx?.on;
 	if (typeof on !== "function") return void 0;
+	if (options !== void 0) try {
+		return on.call(ctx, event, listener, options);
+	} catch {}
 	try {
 		return on.call(ctx, event, listener);
 	} catch {
@@ -87741,11 +88145,15 @@ function installPlanModeCacheGuard(ctx) {
 	if (offPreStep !== void 0) restores.push(() => {
 		offPreStep();
 	});
+	const offReminder = installPlanModeExitReminder(ctx, { isActive: (agent) => planActiveOfAgent(ctx, agent) });
+	if (offReminder !== void 0) restores.push(() => {
+		offReminder();
+	});
 	const wrap = (tools) => {
 		if (tools === void 0) return;
-		const target = resolveMethodTarget$2(tools, "register");
+		const target = resolveMethodTarget$3(tools, "register");
 		if (target === void 0) return;
-		if (alreadyPatched$2(patchedMethods, target.holder, target.name)) return;
+		if (alreadyPatched$3(patchedMethods, target.holder, target.name)) return;
 		const original = target.original;
 		const wrapped = function(...args) {
 			const receiver = this ?? tools;
@@ -87757,16 +88165,16 @@ function installPlanModeCacheGuard(ctx) {
 			}
 			return original.call(receiver, definition, options);
 		};
-		if (!installMethod$2(target, wrapped)) return;
-		markPatched$2(patchedMethods, target.holder, target.name);
+		if (!installMethod$3(target, wrapped)) return;
+		markPatched$3(patchedMethods, target.holder, target.name);
 		restores.push(() => {
-			restoreMethod$2(target);
+			restoreMethod$3(target);
 		});
 		if (typeof tools.get === "function") try {
 			if (tools.get("exit_plan_mode") !== void 0) logWarn$1(ctx, "[dsh-chatgpt-subscription] plan-mode cache guard was installed after exit_plan_mode was already registered; this session keeps the conditional admission");
 		} catch {}
 	};
-	const tools = serviceOf$1(ctx, "tools");
+	const tools = serviceOf$2(ctx, "tools");
 	if (tools !== void 0) wrap(tools);
 	else {
 		const inject = ctx?.inject;
@@ -87776,7 +88184,7 @@ function installPlanModeCacheGuard(ctx) {
 				inject.call(ctx, ["tools"], (scope) => {
 					if (wrapped || closed) return;
 					wrapped = true;
-					wrap(serviceOf$1(scope, "tools"));
+					wrap(serviceOf$2(scope, "tools"));
 				});
 			} catch {}
 		}
@@ -87796,7 +88204,7 @@ function installPlanModeCacheGuard(ctx) {
 * @returns true / false；读不到时 undefined。
 */
 function planActiveOf(ctx, session) {
-	const projections = serviceOf$1(ctx, "sessionProjections");
+	const projections = serviceOf$2(ctx, "sessionProjections");
 	if (typeof projections?.stateOf !== "function") return void 0;
 	try {
 		const state = projections.stateOf(session, PLAN_PROJECTION_KEY);
@@ -87806,6 +88214,35 @@ function planActiveOf(ctx, session) {
 	}
 }
 /**
+* 读一个 agent 此刻是否在计划模式。
+*
+* 三级降级，顺序不可颠倒：
+*
+* 1. 进程级登记册（{@link registeredPlanControllerActive}）：本包的 fork 会把每个
+*    会话登记进去，**跨 realm 可见**。`ctx.get()` 看不见 `isolate: { planMode: true }`
+*    的子 realm，而隔离正是宿主守卫最常见的部署（守卫在根作用域、控制器在 preset 里），
+*    所以这一级必须先问。
+* 2. 同一作用域里的 `planMode` 服务：本包的 fork 有 `selectedActive`（含未决选择），
+*    所以 `exit_plan_mode` 刚排队 `{ active: false }`、日志还没落进投影的那一刻不会被
+*    误判成「还在计划模式」。
+* 3. plan 投影：内置 preset 挂的是官方服务，它的 `/plan` 只写日志，投影是那边唯一的
+*    事实来源。
+* @param ctx - 宿主上下文。
+* @param agent - 调用方 agent。
+* @returns true / false；读不到时 undefined。
+*/
+function planActiveOfAgent(ctx, agent) {
+	const session = agent?.session;
+	const registered = registeredPlanControllerActive(session);
+	if (registered !== void 0) return registered;
+	const controller = serviceOf$2(ctx, "planMode");
+	if (typeof controller?.selectedActive === "function") try {
+		const active = controller.selectedActive(session);
+		if (typeof active === "boolean") return active;
+	} catch {}
+	return planActiveOf(ctx, session);
+}
+/**
 * 记一条警告。
 * @param ctx - 宿主上下文。
 * @param message - 正文。
@@ -87834,7 +88271,7 @@ function logWarn$1(ctx, message) {
 * @param name - 方法名。
 * @returns 目标；方法不存在时为 `undefined`。
 */
-function resolveMethodTarget$2(service, name) {
+function resolveMethodTarget$3(service, name) {
 	if (typeof service !== "object" || service === null) return void 0;
 	const own = service;
 	if (Object.prototype.hasOwnProperty.call(own, name)) {
@@ -87866,7 +88303,7 @@ function resolveMethodTarget$2(service, name) {
 * @param replacement - 包装实现。
 * @returns 是否装上了。
 */
-function installMethod$2(target, replacement) {
+function installMethod$3(target, replacement) {
 	try {
 		Object.defineProperty(target.holder, target.name, {
 			value: replacement,
@@ -87884,7 +88321,7 @@ function installMethod$2(target, replacement) {
 *
 * @param target - 目标。
 */
-function restoreMethod$2(target) {
+function restoreMethod$3(target) {
 	try {
 		if (target.descriptor === void 0) Reflect.deleteProperty(target.holder, target.name);
 		else Object.defineProperty(target.holder, target.name, target.descriptor);
@@ -87898,7 +88335,7 @@ function restoreMethod$2(target) {
 * @param name - 方法名。
 * @returns 是否已经包过。
 */
-function alreadyPatched$2(patched, holder, name) {
+function alreadyPatched$3(patched, holder, name) {
 	return patched.get(holder)?.has(name) === true;
 }
 /**
@@ -87908,7 +88345,7 @@ function alreadyPatched$2(patched, holder, name) {
 * @param holder - 方法宿主。
 * @param name - 方法名。
 */
-function markPatched$2(patched, holder, name) {
+function markPatched$3(patched, holder, name) {
 	const names = patched.get(holder);
 	if (names === void 0) patched.set(holder, /* @__PURE__ */ new Set([name]));
 	else names.add(name);
@@ -88030,7 +88467,7 @@ function installPtcSdkCacheGuard(ctx, options = {}) {
 	*/
 	const toolFingerprint = (tools, scope) => {
 		if (!isRecord$13(tools)) return "";
-		const target = resolveMethodTarget$1(tools, "definitions");
+		const target = resolveMethodTarget$2(tools, "definitions");
 		if (target === void 0) return "";
 		let list;
 		try {
@@ -88050,9 +88487,9 @@ function installPtcSdkCacheGuard(ctx, options = {}) {
 	const wrapToolsService = (tools) => {
 		if (disposed || !isRecord$13(tools)) return false;
 		if (alreadyWrapped.has(tools)) return false;
-		const target = resolveMethodTarget$1(tools, "definitions");
+		const target = resolveMethodTarget$2(tools, "definitions");
 		if (target === void 0) return false;
-		if (alreadyPatched$1(patchedMethods, target.holder, target.name)) {
+		if (alreadyPatched$2(patchedMethods, target.holder, target.name)) {
 			alreadyWrapped.add(tools);
 			return false;
 		}
@@ -88065,11 +88502,11 @@ function installPtcSdkCacheGuard(ctx, options = {}) {
 			}
 			return original.call(receiver, scope, toolSet);
 		};
-		if (!installMethod$1(target, replacement)) return false;
-		markPatched$1(patchedMethods, target.holder, target.name);
+		if (!installMethod$2(target, replacement)) return false;
+		markPatched$2(patchedMethods, target.holder, target.name);
 		alreadyWrapped.add(tools);
 		restores.push(() => {
-			restoreMethod$1(target);
+			restoreMethod$2(target);
 		});
 		return true;
 	};
@@ -88109,7 +88546,7 @@ function installPtcSdkCacheGuard(ctx, options = {}) {
 	};
 	const offAssemble = subscribe$2(host, "system-prompt/assemble", onAssemble);
 	if (offAssemble !== void 0) disposers.push(offAssemble);
-	const initialTools = serviceOf(host, "tools");
+	const initialTools = serviceOf$1(host, "tools");
 	if (initialTools !== void 0) {
 		currentTools = initialTools;
 		wrapToolsService(initialTools);
@@ -88118,7 +88555,7 @@ function installPtcSdkCacheGuard(ctx, options = {}) {
 		if (typeof inject === "function") try {
 			inject.call(host, ["tools"], (scope) => {
 				if (disposed) return;
-				const tools = serviceOf(scope, "tools");
+				const tools = serviceOf$1(scope, "tools");
 				if (tools === void 0) return;
 				currentTools = tools;
 				wrapToolsService(tools);
@@ -88146,7 +88583,7 @@ function installPtcSdkCacheGuard(ctx, options = {}) {
 * @param service - 服务名。
 * @returns 服务实例；读不到时为 `undefined`。
 */
-function serviceOf(ctx, service) {
+function serviceOf$1(ctx, service) {
 	if (!isRecord$13(ctx)) return void 0;
 	const read = ctx["get"];
 	if (typeof read !== "function") return void 0;
@@ -88215,7 +88652,7 @@ function isRecord$13(value) {
 * @param name - 方法名。
 * @returns 目标；方法不存在时为 `undefined`。
 */
-function resolveMethodTarget$1(service, name) {
+function resolveMethodTarget$2(service, name) {
 	if (typeof service !== "object" || service === null) return void 0;
 	const own = service;
 	if (Object.prototype.hasOwnProperty.call(own, name)) {
@@ -88247,7 +88684,7 @@ function resolveMethodTarget$1(service, name) {
 * @param replacement - 包装实现。
 * @returns 是否装上了。
 */
-function installMethod$1(target, replacement) {
+function installMethod$2(target, replacement) {
 	try {
 		Object.defineProperty(target.holder, target.name, {
 			value: replacement,
@@ -88265,7 +88702,7 @@ function installMethod$1(target, replacement) {
 *
 * @param target - 目标。
 */
-function restoreMethod$1(target) {
+function restoreMethod$2(target) {
 	try {
 		if (target.descriptor === void 0) Reflect.deleteProperty(target.holder, target.name);
 		else Object.defineProperty(target.holder, target.name, target.descriptor);
@@ -88279,7 +88716,7 @@ function restoreMethod$1(target) {
 * @param name - 方法名。
 * @returns 是否已经包过。
 */
-function alreadyPatched$1(patched, holder, name) {
+function alreadyPatched$2(patched, holder, name) {
 	return patched.get(holder)?.has(name) === true;
 }
 /**
@@ -88289,12 +88726,245 @@ function alreadyPatched$1(patched, holder, name) {
 * @param holder - 方法宿主。
 * @param name - 方法名。
 */
-function markPatched$1(patched, holder, name) {
+function markPatched$2(patched, holder, name) {
 	const names = patched.get(holder);
 	if (names === void 0) patched.set(holder, /* @__PURE__ */ new Set([name]));
 	else names.add(name);
 }
 //#endregion
+//#region src/host/settled-job-guard.ts
+function isRecord$12(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function serviceOf(ctx, name) {
+	const get = ctx?.get;
+	if (typeof get !== "function") return void 0;
+	try {
+		return get.call(ctx, name);
+	} catch {
+		return;
+	}
+}
+function isTerminalStatus(value) {
+	return value === "completed" || value === "failed" || value === "killed";
+}
+function isUnknownJobError(error, id) {
+	if (!(error instanceof Error)) return false;
+	return error.message === `unknown job ${id}`;
+}
+/**
+* 通过 `agents` 或 `sessions` 服务定位 `caller` 对应的会话对象。
+*/
+function resolveCallerSession(ctx, caller) {
+	const agents = serviceOf(ctx, "agents");
+	if (typeof agents?.get === "function") try {
+		const agent = agents.get(caller);
+		if (agent?.session !== void 0 && agent.session !== null) return agent.session;
+	} catch {}
+	const sessions = serviceOf(ctx, "sessions");
+	if (typeof sessions?.get === "function") try {
+		const session = sessions.get(caller);
+		if (session !== void 0 && session !== null) return session;
+	} catch {
+		return;
+	}
+}
+/**
+* 从调用方自己的持久会话日志里倒序查找已落盘的 `job/settled` 记录。
+*
+* 严格校验 `owner === caller`：无主或归属其它会话的任务绝不跨会话恢复。
+*/
+function findSettledJobInSession(session, jobId, caller) {
+	if (!isRecord$12(session)) return void 0;
+	const snapshot = session["snapshotEvents"];
+	if (typeof snapshot !== "function") return void 0;
+	let events;
+	try {
+		events = snapshot.call(session);
+	} catch {
+		return;
+	}
+	if (!Array.isArray(events)) return void 0;
+	for (let index = events.length - 1; index >= 0; index -= 1) {
+		const event = events[index];
+		if (!isRecord$12(event) || event["type"] !== "job/settled") continue;
+		const data = event["data"];
+		if (!isRecord$12(data)) continue;
+		if (data["jobId"] !== jobId) continue;
+		if (data["owner"] !== caller) return void 0;
+		const kind = typeof data["kind"] === "string" && data["kind"].length > 0 ? data["kind"] : "job";
+		const label = typeof data["label"] === "string" && data["label"].length > 0 ? data["label"] : jobId;
+		const status = isTerminalStatus(data["status"]) ? data["status"] : "killed";
+		const detail = typeof data["detail"] === "string" && data["detail"].length > 0 ? data["detail"] : void 0;
+		const startedAt = typeof data["startedAt"] === "number" && Number.isFinite(data["startedAt"]) ? data["startedAt"] : 0;
+		const finishedAt = typeof data["finishedAt"] === "number" && Number.isFinite(data["finishedAt"]) ? data["finishedAt"] : void 0;
+		return {
+			id: jobId,
+			kind,
+			label,
+			owner: caller,
+			status,
+			...detail === void 0 ? {} : { detail },
+			startedAt,
+			...finishedAt === void 0 ? {} : { finishedAt },
+			output: {
+				total: 0,
+				earliest: 0
+			}
+		};
+	}
+}
+function resolveMethodTarget$1(service, name) {
+	if (typeof service !== "object" || service === null) return void 0;
+	const own = service;
+	if (Object.prototype.hasOwnProperty.call(own, name)) {
+		const original = own[name];
+		if (typeof original !== "function") return void 0;
+		return {
+			holder: own,
+			name,
+			original,
+			descriptor: Object.getOwnPropertyDescriptor(own, name)
+		};
+	}
+	const proto = Object.getPrototypeOf(service);
+	if (proto === null || proto === Object.prototype || proto === Function.prototype) return void 0;
+	const descriptor = Object.getOwnPropertyDescriptor(proto, name);
+	if (descriptor === void 0 || typeof descriptor.value !== "function") return void 0;
+	return {
+		holder: proto,
+		name,
+		original: descriptor.value,
+		descriptor
+	};
+}
+function installMethod$1(target, replacement) {
+	try {
+		Object.defineProperty(target.holder, target.name, {
+			configurable: target.descriptor?.configurable ?? true,
+			enumerable: target.descriptor?.enumerable ?? false,
+			writable: target.descriptor?.writable ?? true,
+			value: replacement
+		});
+		return true;
+	} catch {
+		return false;
+	}
+}
+function restoreMethod$1(target) {
+	try {
+		if (target.descriptor !== void 0) Object.defineProperty(target.holder, target.name, target.descriptor);
+		else delete target.holder[target.name];
+	} catch {}
+}
+function alreadyPatched$1(patched, holder, name) {
+	return patched.get(holder)?.has(name) === true;
+}
+function markPatched$1(patched, holder, name) {
+	let set = patched.get(holder);
+	if (set === void 0) {
+		set = /* @__PURE__ */ new Set();
+		patched.set(holder, set);
+	}
+	set.add(name);
+}
+/**
+* 安装「已结算后台任务跨回合幂等守卫」。
+*
+* @param ctx - 宿主上下文。
+* @returns 守卫句柄。
+*/
+function installSettledJobGuard(ctx) {
+	const restores = [];
+	const patchedMethods = /* @__PURE__ */ new WeakMap();
+	let closed = false;
+	const recoverForCaller = (rawId, rawCaller) => {
+		if (closed) return void 0;
+		if (typeof rawId !== "string" || rawId.length === 0) return void 0;
+		if (typeof rawCaller !== "string" || rawCaller.length === 0) return void 0;
+		return findSettledJobInSession(resolveCallerSession(ctx, rawCaller), rawId, rawCaller);
+	};
+	const patchSync = (jobs, methodName, onRecovered) => {
+		const target = resolveMethodTarget$1(jobs, methodName);
+		if (target === void 0 || alreadyPatched$1(patchedMethods, target.holder, target.name)) return;
+		const original = target.original;
+		const wrapped = function(...args) {
+			const receiver = this ?? jobs;
+			try {
+				return original.call(receiver, ...args);
+			} catch (error) {
+				const id = typeof args[0] === "string" ? args[0] : "";
+				if (id !== "" && isUnknownJobError(error, id)) {
+					const recovered = recoverForCaller(id, args[1]);
+					if (recovered !== void 0) return onRecovered(recovered);
+				}
+				throw error;
+			}
+		};
+		if (!installMethod$1(target, wrapped)) return;
+		markPatched$1(patchedMethods, target.holder, target.name);
+		restores.push(() => {
+			restoreMethod$1(target);
+		});
+	};
+	const patchWait = (jobs) => {
+		const target = resolveMethodTarget$1(jobs, "wait");
+		if (target === void 0 || alreadyPatched$1(patchedMethods, target.holder, target.name)) return;
+		const original = target.original;
+		const wrapped = async function(...args) {
+			const receiver = this ?? jobs;
+			try {
+				return await original.call(receiver, ...args);
+			} catch (error) {
+				const id = typeof args[0] === "string" ? args[0] : "";
+				if (id !== "" && isUnknownJobError(error, id)) {
+					const recovered = recoverForCaller(id, args[2]);
+					if (recovered !== void 0) return recovered;
+				}
+				throw error;
+			}
+		};
+		if (!installMethod$1(target, wrapped)) return;
+		markPatched$1(patchedMethods, target.holder, target.name);
+		restores.push(() => {
+			restoreMethod$1(target);
+		});
+	};
+	const wrap = (jobs) => {
+		if (jobs === void 0) return;
+		patchSync(jobs, "kill", () => "already-finished");
+		patchSync(jobs, "get", (view) => view);
+		patchSync(jobs, "read", (view) => ({
+			chunks: [],
+			lossy: false,
+			job: view
+		}));
+		patchWait(jobs);
+	};
+	const immediate = serviceOf(ctx, "jobs");
+	if (immediate !== void 0) wrap(immediate);
+	else {
+		const inject = ctx?.inject;
+		if (typeof inject === "function") {
+			let wrapped = false;
+			try {
+				inject.call(ctx, ["jobs"], (scope) => {
+					if (wrapped || closed) return;
+					wrapped = true;
+					wrap(serviceOf(scope, "jobs"));
+				});
+			} catch {}
+		}
+	}
+	return { dispose() {
+		if (closed) return;
+		closed = true;
+		for (const restore of restores.splice(0)) try {
+			restore();
+		} catch {}
+	} };
+}
+//#endregion
 //#region src/host/team-policy-cache-guard.ts
 /**
 * 「Agent Teams 策略段前缀缓存守卫」—— 把内置 `team:policy` 段从 system 里摘掉，
@@ -88634,7 +89304,7 @@ const GUARDED_EVENTS = [
 * @returns 可销毁的句柄。
 */
 function installCompactionPolicyGuard(ctx, options = {}) {
-	const host = isRecord$12(ctx) ? ctx : void 0;
+	const host = isRecord$11(ctx) ? ctx : void 0;
 	const provider = options.provider ?? "kimi-code";
 	const defaults = {
 		provider,
@@ -88709,9 +89379,9 @@ function installCompactionPolicyGuard(ctx, options = {}) {
 	* @param source - agent、header 或配置对象。
 	*/
 	const observeFrom = (source) => {
-		if (!isRecord$12(source)) return;
+		if (!isRecord$11(source)) return;
 		const session = source["session"];
-		if (isRecord$12(session)) {
+		if (isRecord$11(session)) {
 			const requestHeader = session["requestHeader"];
 			if (typeof requestHeader === "function") {
 				let header;
@@ -88720,16 +89390,16 @@ function installCompactionPolicyGuard(ctx, options = {}) {
 				} catch {
 					header = void 0;
 				}
-				if (isRecord$12(header)) {
+				if (isRecord$11(header)) {
 					const config = header["config"];
-					if (isRecord$12(config)) observe(readString(config["provider"]), readString(config["model"]));
+					if (isRecord$11(config)) observe(readString(config["provider"]), readString(config["model"]));
 				}
 			}
 		}
 		const optionsField = source["options"];
-		if (isRecord$12(optionsField)) observe(readString(optionsField["provider"]), readString(optionsField["model"]));
+		if (isRecord$11(optionsField)) observe(readString(optionsField["provider"]), readString(optionsField["model"]));
 		const config = source["config"];
-		if (isRecord$12(config)) observe(readString(config["provider"]), readString(config["model"]));
+		if (isRecord$11(config)) observe(readString(config["provider"]), readString(config["model"]));
 	};
 	/**
 	* 读一个字符串字段。
@@ -88759,10 +89429,10 @@ function installCompactionPolicyGuard(ctx, options = {}) {
 	* @returns 是否真的改写了。
 	*/
 	const patchEngine = (engine) => {
-		if (disposed || !isRecord$12(engine)) return false;
+		if (disposed || !isRecord$11(engine)) return false;
 		if (patched.has(engine)) return false;
 		const config = engine["config"];
-		if (!isRecord$12(config)) return false;
+		if (!isRecord$11(config)) return false;
 		const originalPolicies = config["modelPolicies"];
 		if (!Array.isArray(originalPolicies)) return false;
 		const originalConfig = config;
@@ -88832,7 +89502,7 @@ function installCompactionPolicyGuard(ctx, options = {}) {
 				let nextArgs = args;
 				if (name === "summarize") {
 					const input = args[0];
-					if (isRecord$12(input)) {
+					if (isRecord$11(input)) {
 						const messages = input["messages"];
 						if (Array.isArray(messages)) {
 							const replaced = replaceCompactionInstruction(messages);
@@ -88867,12 +89537,12 @@ function installCompactionPolicyGuard(ctx, options = {}) {
 	* @returns 是否改写了新引擎。
 	*/
 	const patchStoreEntry = (entry) => {
-		if (!isRecord$12(entry)) return false;
+		if (!isRecord$11(entry)) return false;
 		const record = entry;
 		const name = readServiceName(record);
 		if (name !== void 0 && name !== "compaction") return false;
 		const value = record.value ?? record.impl;
-		if (isRecord$12(value)) {
+		if (isRecord$11(value)) {
 			if (patchEngine(value)) return true;
 			const nested = value["engine"];
 			if (nested !== void 0) return patchEngine(nested);
@@ -88887,11 +89557,11 @@ function installCompactionPolicyGuard(ctx, options = {}) {
 	* @returns 本次新改写的引擎数。
 	*/
 	const scanStore = (target) => {
-		if (!isRecord$12(target)) return 0;
+		if (!isRecord$11(target)) return 0;
 		const reflect = target["reflect"];
-		if (!isRecord$12(reflect)) return 0;
+		if (!isRecord$11(reflect)) return 0;
 		const store = reflect["store"];
-		if (!isRecord$12(store)) return 0;
+		if (!isRecord$11(store)) return 0;
 		const services = store;
 		let count = 0;
 		for (const key of Object.getOwnPropertySymbols(services)) if (patchStoreEntry(services[key])) count += 1;
@@ -88905,12 +89575,12 @@ function installCompactionPolicyGuard(ctx, options = {}) {
 	* @returns 是否改写了新引擎。
 	*/
 	const patchServiceFrom = (target, name) => {
-		if (!isRecord$12(target)) return false;
+		if (!isRecord$11(target)) return false;
 		const get = target["get"];
 		if (typeof get !== "function") return false;
 		try {
 			const service = get.call(target, name);
-			if (!isRecord$12(service)) return false;
+			if (!isRecord$11(service)) return false;
 			if (patchEngine(service)) return true;
 			const nested = service["engine"];
 			return nested === void 0 ? false : patchEngine(nested);
@@ -88953,7 +89623,7 @@ function installCompactionPolicyGuard(ctx, options = {}) {
 		try {
 			for (const arg of args) {
 				observeFrom(arg);
-				if (isRecord$12(arg)) observeFrom(arg["agent"]);
+				if (isRecord$11(arg)) observeFrom(arg["agent"]);
 			}
 			scanAndPatch();
 			const agentCtx = findAgentContext(args);
@@ -88992,9 +89662,9 @@ function installCompactionPolicyGuard(ctx, options = {}) {
 function readServiceName(record) {
 	if (typeof record.name === "string") return record.name;
 	const impl = record.impl;
-	if (isRecord$12(impl) && typeof impl["name"] === "string") return impl["name"];
+	if (isRecord$11(impl) && typeof impl["name"] === "string") return impl["name"];
 	const value = record.value;
-	if (isRecord$12(value) && typeof value["name"] === "string") return value["name"];
+	if (isRecord$11(value) && typeof value["name"] === "string") return value["name"];
 }
 /**
 * 从一次事件派发的参数里找出 agent 的上下文。
@@ -89006,7 +89676,7 @@ function findAgentContext(args) {
 	for (const arg of args) {
 		const direct = readContext(arg);
 		if (direct !== void 0) return direct;
-		if (isRecord$12(arg)) {
+		if (isRecord$11(arg)) {
 			const nested = readContext(arg["agent"]);
 			if (nested !== void 0) return nested;
 		}
@@ -89019,10 +89689,10 @@ function findAgentContext(args) {
 * @returns 上下文；不像时返回 `undefined`。
 */
 function readContext(value) {
-	if (!isRecord$12(value)) return void 0;
+	if (!isRecord$11(value)) return void 0;
 	const ctx = value["ctx"];
-	if (!isRecord$12(ctx)) return void 0;
-	if (typeof ctx["get"] === "function" || isRecord$12(ctx["reflect"])) return ctx;
+	if (!isRecord$11(ctx)) return void 0;
+	if (typeof ctx["get"] === "function" || isRecord$11(ctx["reflect"])) return ctx;
 }
 /**
 * 订阅一个事件，优先用 `prepend: true`。
@@ -89062,7 +89732,7 @@ function subscribe(host, event, listener) {
 * @param value - 任意值。
 * @returns 是非 null 的对象时为 `true`。
 */
-function isRecord$12(value) {
+function isRecord$11(value) {
 	return typeof value === "object" && value !== null;
 }
 /**
@@ -89162,449 +89832,6 @@ function markPatched(patched, holder, name) {
 	if (names === void 0) patched.set(holder, /* @__PURE__ */ new Set([name]));
 	else names.add(name);
 }
-//#endregion
-//#region src/host/dispatch-execution-guard.ts
-/**
-* 「调度执行守卫」——在**执行期**拦住两类越界调用。
-*
-* ## 为什么需要它
-*
-* 调度模式（dispatch preset）里主控与子代理跑在同一进程、同一套工具注册面上，
-* 于是有两件事会悄悄坏掉：
-*
-* 1. **子代理越权调用主控专用工具**。`ask_user_question`、`exit_plan_mode`、
-*    `create_goal` 这些是**主控的**决定口：让子代理自己问用户、自己进/出计划模式、
-*    自己建目标，都会把「一个决定」拆成两个决定——子代理问完，用户答了，主控却
-*    不知道问过什么。子代理本来就该把未决问题**带回**主控，而不是自己去问。
-* 2. **等待子代理期间空等**。子代理还在跑的时候，主控用 `sleep` 空转，既烧 token
-*    又错过通知到达的那一刻。正确做法是**结束这一轮**，让内置的子代理完成通知把
-*    它叫醒（R-W）。
-*
-* ## 零 Kimi Code 缓存漂移
-*
-* 守卫**只**用 `ctx.tools.guard(exec => …)` 这一条执行期接缝：
-*
-* - 不包 `tools.definitions`，不包 `tools.register`，不听
-*   `system-prompt/assemble`——工具声明面（`tools:sdk` 段与顶层工具 schema）
-*   保持逐字节恒定，Kimi Code 的前缀缓存不会因为这个守卫重建一次。
-* - 拦截发生在**调用执行时**，模型看到的工具表完全没变，所以「看得见」与
-*   「叫得动」仍然被拆开：工具照常出现在表里，只是越界的调用被拒。
-*
-* ## 判定从哪来
-*
-* 两条判定都走**结构探测**，不 import 任何 harness 代次专属的类型：
-*
-* - 「你是不是子代理」：先看**持久会话血缘**（`session.header.origin ===
-*   'subagent'`），再看宿主活着的**存活根**（`agents.roots()`）。两条都是
-*   读得着的既有事实，不新增任何状态。
-* - 「你还有没有在跑的子代理」：依次问 `subagents.list` 与 `agents.list`，
-*   看有没有 `status === 'running'` 的直接子代。
-*
-* @module @eddyskywalker/dsh-chatgpt-subscription/host/dispatch-execution-guard
-*/
-/**
-* 子代理**不得**直接调用的主控专用工具。
-*
-* 这七个都是「决定口」或「交付口」，不是「干活口」：
-*
-* - `ask_user_question` / `exit_plan_mode` / `enter_plan_mode` /
-*   `leave_plan_mode`：计划与提问的决定权在主控；
-* - `create_goal` / `update_goal`：目标由主控持有；
-* - `present`：交付口由主控掌握。
-*
-* 子代理遇到需要决定的地方，正确动作是**把问题带回主控**，让主控去调这些工具。
-*/
-const DEFAULT_DELEGATED_BLOCKED_TOOLS = Object.freeze([
-	"ask_user_question",
-	"exit_plan_mode",
-	"enter_plan_mode",
-	"leave_plan_mode",
-	"create_goal",
-	"update_goal",
-	"present"
-]);
-/**
-* 承载「等待」语义的 shell 工具。
-*
-* 这三个是本包与宿主都会用到的 shell 入口：它们的 `command` 参数里可能藏着
-* `sleep`。空等只在**确实有在跑的子代理**时才是问题（有子代理时应当结束这一
-* 轮等通知），没有子代理时 `sleep 1` 只是普通命令，不该拦。
-*/
-const DEFAULT_SHELL_TOOLS = Object.freeze([
-	"bash",
-	"pwsh",
-	"win_bash"
-]);
-/** 一次执行里被判定为「纯等待」的命令形态。 */
-const SLEEP_COMMAND_PATTERN = /^(?:sleep\s+\d+(?:\.\d+)?[smhd]?|Start-Sleep\s+(?:-(?:Seconds|Milliseconds|s|m)\s+)?\d+(?:\.\d+)?|timeout(?:\.exe)?\s+(?:\/t\s+)?\d+(?:\s+\/nobreak)?|ping(?:\.exe)?\s+-(?:n|c)\s+\d+\s+(?:127\.0\.0\.1|localhost)(?:\s+>|\s*$).*)$/i;
-/** 无害的空转语句（回显、真、冒号）。 */
-const NOOP_COMMAND_PATTERN = /^(?:echo\b.*|Write-Host\b.*|Write-Output\b.*|true|:)$/;
-/** 注释行。 */
-const COMMENT_COMMAND_PATTERN = /^#/;
-/**
-* 读宿主上下文上「直接注入」的 running-child 判定回调。
-*
-* 这一步必须**try/catch**：真实 Cordis 的上下文代理对任何没有 inject 的属性直读
-* 都当场抛 `cannot get property "..." without inject`，一次读失败不该让守卫在
-* 每次工具调用上抛错。
-*
-* @param ctx - 宿主上下文。
-* @returns 注入的回调；没有时为 undefined。
-*/
-function injectedHasRunningChildren(ctx) {
-	if (!isRecord$11(ctx)) return void 0;
-	let injected;
-	try {
-		injected = ctx["hasRunningChildren"];
-	} catch {
-		return;
-	}
-	return typeof injected === "function" ? injected : void 0;
-}
-/**
-* 判断一个值是不是可读的记录对象。
-*
-* @param value - 候选值。
-* @returns 是记录对象时为 true。
-*/
-function isRecord$11(value) {
-	return typeof value === "object" && value !== null;
-}
-/**
-* 从宿主上下文里读一个**可选**服务。
-*
-* 一律走 `ctx.get()`：没写进 `inject` 的服务名不能当属性读，真实 Cordis 会当场
-* 抛 `cannot get property "..." without inject`，整个插件降级。读不到就是读不到，
-* 守卫据此放行，绝不因此让插件挂不上。
-*
-* @param ctx - 宿主上下文。
-* @param name - 服务名。
-* @returns 服务实例；不存在或读取抛错时为 undefined。
-*/
-function readService(ctx, name) {
-	const reader = ctx?.get;
-	if (typeof reader !== "function") return void 0;
-	try {
-		return reader.call(ctx, name);
-	} catch {
-		return;
-	}
-}
-/**
-* 读一个宿主上下文里的工具注册面。
-*
-* @param ctx - 宿主上下文。
-* @returns 带 `guard` 接缝的注册面；没有时为 undefined。
-*/
-function toolsOf$2(ctx) {
-	if (!isRecord$11(ctx)) return void 0;
-	let tools;
-	try {
-		tools = ctx["tools"];
-	} catch {
-		tools = void 0;
-	}
-	if (!isRecord$11(tools)) tools = readService(ctx, "tools");
-	return isRecord$11(tools) ? tools : void 0;
-}
-/**
-* 读一条记录的 `id`。
-*
-* @param value - 候选记录。
-* @returns id 字符串；没有时为 undefined。
-*/
-function idOf(value) {
-	if (!isRecord$11(value)) return void 0;
-	const id = value["id"];
-	return typeof id === "string" ? id : void 0;
-}
-/**
-* 读一条会话记录头里的 `id`。
-*
-* @param agent - 候选 agent。
-* @returns 会话 id；没有时为 undefined。
-*/
-function sessionIdOf$1(agent) {
-	if (!isRecord$11(agent)) return void 0;
-	const session = agent["session"];
-	if (!isRecord$11(session)) return void 0;
-	const header = session["header"];
-	return idOf(header);
-}
-/**
-* 这个调用方是不是**子代理**。
-*
-* 判定分两级，先看能独立成立的持久事实，再看宿主当前活着的存活根：
-*
-* 1. **持久会话血缘**：`session.header.origin === 'subagent'`。这是子代理会话
-*    创建时就写下的血缘，跨宿主代次都在，不依赖任何服务是否挂载。
-* 2. **存活根判定**：宿主提供 `agents.roots()` 时，一个**不在**存活根集合里的
-*    agent 就是别人的孩子。先核对**存活**（`agents.get(id) === agent`）：不是
-*    那个 id 当前登记的存活 agent，说明这个调用方已经过期或已被顶替——判它是不是
-*    子代理没有意义，放行。
-*
-* 宿主没有 `agents` 服务（或老代没有 `roots`）时，判不了就**放行**：把一个
-* 读不出来的身份当成子代理去拦，会拦掉主控自己的正常调用。
-*
-* @param agent - 调用方 agent。
-* @param ctx - 宿主上下文（可选；用于读 `agents` 服务）。
-* @returns 是子代理时为 true。
-*/
-function isDelegatedCaller(agent, ctx) {
-	if (!isRecord$11(agent)) return false;
-	const session = agent["session"];
-	if (isRecord$11(session)) {
-		const header = session["header"];
-		if (isRecord$11(header) && header["origin"] === "subagent") return true;
-	}
-	const agents = readService(ctx, "agents");
-	if (!isRecord$11(agents)) return false;
-	const roots = rootsOf(agents);
-	if (roots === void 0) return false;
-	const id = idOf(agent);
-	if (typeof id === "string" && typeof agents["get"] === "function") {
-		let live;
-		try {
-			live = agents["get"].call(agents, id);
-		} catch {
-			live = void 0;
-		}
-		if (live !== agent) return false;
-	}
-	return !roots.includes(agent);
-}
-/**
-* 读宿主存活根集合。
-*
-* @param agents - `agents` 服务。
-* @returns 存活根数组；服务没有 `roots` 或读取抛错时为 undefined。
-*/
-function rootsOf(agents) {
-	const roots = agents["roots"];
-	if (typeof roots !== "function") return void 0;
-	try {
-		const listed = roots.call(agents);
-		return Array.isArray(listed) ? listed : void 0;
-	} catch {
-		return;
-	}
-}
-/**
-* 判断一条命令是不是**纯等待**。
-*
-* 判据：整条命令**按分隔符切开后**，至少有一条是 sleep/wait，而**每一条**都是
-* sleep/wait 或者无害的空转（回显、真、冒号、注释）。只要有一条在做真事
-* （`sleep 1 && npm test`、`git status`、`node …`），整条命令就不是纯等待——
-* 这类命令**必须放行**，否则守卫会拦掉正当的后台工作。
-*
-* @param command - 候选命令。
-* @returns 是纯等待时为 true。
-*/
-function isPureSleepCommand(command) {
-	if (typeof command !== "string") return false;
-	const trimmed = command.trim();
-	if (trimmed.length === 0) return false;
-	const statements = trimmed.split(/;|&&|\n/).map((statement) => statement.trim()).filter((statement) => statement.length > 0);
-	if (statements.length === 0) return false;
-	let sawWait = false;
-	for (const statement of statements) {
-		if (SLEEP_COMMAND_PATTERN.test(statement)) {
-			sawWait = true;
-			continue;
-		}
-		if (!isNoopStatement(statement)) return false;
-	}
-	return sawWait;
-}
-/**
-* 判断一条语句是不是无害的空转。
-*
-* @param statement - 候选语句。
-* @returns 是空转时为 true。
-*/
-function isNoopStatement(statement) {
-	return NOOP_COMMAND_PATTERN.test(statement) || COMMENT_COMMAND_PATTERN.test(statement);
-}
-/**
-* 这个调用方当前**还有没有在跑的子代理**。
-*
-* 两条宿主探测，任何一条给出答案就算数：
-*
-* 1. `subagents.list(agent, 'children')`（老代退化成 `subagents.list(agent)`）：
-*    直接子代里有没有 `status === 'running'` 的。
-* 2. `agents.list()`：活着且 `status === 'running'`、并且 `parent` 就是这个
-*    调用方的那些 agent。
-*
-* 宿主提供 `hasRunningChildren` 回调时以它为准（直接注入口，见
-* {@link DispatchExecutionGuardOptions.hasRunningChildren}）。
-*
-* @param agent - 调用方 agent。
-* @param ctx - 宿主上下文（可选；用于读 `subagents` / `agents` 服务）。
-* @returns 有在跑的子代理时为 true。
-*/
-function hasRunningChildSubagent(agent, ctx) {
-	if (!isRecord$11(agent)) return false;
-	const injected = injectedHasRunningChildren(ctx);
-	if (injected !== void 0) try {
-		return injected(agent) === true;
-	} catch {
-		return false;
-	}
-	const subagents = readService(ctx, "subagents");
-	if (isRecord$11(subagents) && typeof subagents["list"] === "function") {
-		if (entriesOf(callList(subagents["list"], subagents, agent)).some((entry) => entry["status"] === "running")) return true;
-	}
-	const agents = readService(ctx, "agents");
-	if (isRecord$11(agents) && typeof agents["list"] === "function") {
-		const listed = callList(agents["list"], agents, agent, false);
-		const parentIds = /* @__PURE__ */ new Set();
-		const ownId = idOf(agent);
-		if (ownId !== void 0) parentIds.add(ownId);
-		const headerId = sessionIdOf$1(agent);
-		if (headerId !== void 0) parentIds.add(headerId);
-		if (entriesOf(listed).some((entry) => entry["status"] === "running" && typeof entry["parent"] === "string" && parentIds.has(entry["parent"]))) return true;
-	}
-	return false;
-}
-/**
-* 调用一个「列出子代」的宿主方法。
-*
-* 先试带 scope 的形态（`list(agent, 'children')`），老代只认 `list(agent)`，
-* 再老一代的 `agents.list()` 不接参数——三种都试，谁先成功用谁。
-*
-* @param fn - 宿主方法。
-* @param self - 调用宿主。
-* @param agent - 调用方 agent。
-* @param scoped - 是否先试带 scope 的形态。
-* @returns 宿主返回值；全部失败时为 undefined。
-*/
-function callList(fn, self, agent, scoped = true) {
-	if (typeof fn !== "function") return void 0;
-	const call = fn;
-	const attempts = scoped ? [
-		[agent, "children"],
-		[agent],
-		[]
-	] : [
-		[],
-		[agent],
-		[agent, "children"]
-	];
-	for (const args of attempts) try {
-		const listed = call.apply(self, args);
-		if (listed !== void 0) return listed;
-	} catch {}
-}
-/**
-* 从宿主返回值里取出「条目数组」。
-*
-* 宿主可能直接给数组，也可能给一个包着数组的记录（`children` / `agents`）。
-*
-* @param listed - 宿主返回值。
-* @returns 条目数组；取不到时是空数组。
-*/
-function entriesOf(listed) {
-	if (Array.isArray(listed)) return listed.filter(isRecord$11);
-	if (!isRecord$11(listed)) return [];
-	const entries = [];
-	for (const key of [
-		"children",
-		"agents",
-		"entries",
-		"list"
-	]) {
-		const candidate = listed[key];
-		if (!Array.isArray(candidate)) continue;
-		for (const entry of candidate) if (isRecord$11(entry)) entries.push(entry);
-	}
-	return entries;
-}
-/**
-* 解析「调度执行守卫」当前是否启用。
-*
-* 沿 volatile 活引用取当前值，所以设置保存后立刻生效。缺省、非法值、读取抛错都
-* 按**开启**处理：守卫是保护，不是功能开关，读失败不该把保护关掉。
-*
-* @param config - 插件配置（活引用或普通值）。
-* @returns 是否启用。
-*/
-function resolveDispatchExecutionGuardEnabled(config) {
-	const field = config?.dispatchExecutionGuard;
-	if (field === void 0 || field === null) return true;
-	if (typeof field === "object" && typeof field.get === "function") try {
-		return field.get() !== false;
-	} catch {
-		return true;
-	}
-	return field !== false;
-}
-/**
-* 子代理越权调用时的拒绝文案。
-*
-* 文案要**可执行**：光说「不许调」模型只会换个花样再试一次，所以这里写清楚
-* 它该做什么——把未决问题带回主控，并带上报告状态。
-*
-* @param toolName - 被拦下的工具名。
-* @returns 拒绝理由。
-*/
-function delegatedDenial(toolName) {
-	return `DELEGATED_CALLER: "${toolName}" is a dispatch-level tool and a delegated subagent must not call it directly. Report back to the dispatcher instead: include status: "hand_back" or status: "blocked" and the unresolved question or decision in your report, and let the dispatcher act on it.`;
-}
-/**
-* 子代理还在跑时用 sleep 空等的拒绝文案。
-*
-* @returns 拒绝理由。
-*/
-function activeChildSleepDenial() {
-	return "ACTIVE_CHILD_SLEEP_FORBIDDEN: a child subagent is still running, so sleeping to wait for it is not allowed. End your turn now and let the built-in subagent completion notification wake you.";
-}
-/**
-* 装一台「调度执行守卫」。
-*
-* 只用 `ctx.tools.guard()` 这一条执行期接缝：工具声明面（`tools:sdk` 段与顶层
-* 工具 schema）一个字节都不改，Kimi Code 的前缀缓存不会因为这个守卫重建。
-*
-* @param ctx - 宿主上下文。
-* @param options - 守卫选项。
-* @returns 注销守卫的函数；宿主没有 `guard` 接缝时是一个空操作。
-*/
-function installDispatchExecutionGuard(ctx, options = {}) {
-	const tools = toolsOf$2(ctx);
-	const register = tools?.guard;
-	if (typeof register !== "function") return () => void 0;
-	const enabled = options.enabled ?? (() => true);
-	const delegatedBlocked = new Set(DEFAULT_DELEGATED_BLOCKED_TOOLS);
-	const shellTools = new Set(DEFAULT_SHELL_TOOLS);
-	const hasRunningChildren = options.hasRunningChildren;
-	const guard = (execution) => {
-		if (!isEnabled(enabled)) return void 0;
-		const toolName = typeof execution?.name === "string" ? execution.name : void 0;
-		if (toolName === void 0) return void 0;
-		const agent = execution?.agent;
-		if (delegatedBlocked.has(toolName) && isDelegatedCaller(agent, ctx)) return delegatedDenial(toolName);
-		if (shellTools.has(toolName)) {
-			const args = isRecord$11(execution?.arguments) ? execution.arguments : void 0;
-			if (!(args?.["run_in_background"] === true) && isPureSleepCommand(args?.["command"])) {
-				if (hasRunningChildren !== void 0 ? hasRunningChildren(agent) === true : hasRunningChildSubagent(agent, ctx)) return activeChildSleepDenial();
-			}
-		}
-	};
-	const dispose = register.call(tools, guard);
-	return typeof dispose === "function" ? dispose : () => void 0;
-}
-/**
-* 读一次开关。读失败按**开启**处理：保护不该因为一次读失败而失效。
-*
-* @param enabled - 开关读取函数。
-* @returns 是否启用。
-*/
-function isEnabled(enabled) {
-	try {
-		return enabled() !== false;
-	} catch {
-		return true;
-	}
-}
 const ID_SCHEMA = z.string().min(1).max(64).regex(/^[A-Za-z0-9._:-]+$/);
 const TASK_REFERENCE_SCHEMA = z.string().min(1).max(160);
 const BOUNDARY_SCHEMA = z.string().min(1).max(120);
@@ -92408,6 +92635,7 @@ const RENAMED_PACKAGES = /* @__PURE__ */ new Map([["@deepseek-ai/dsh-workflow-wo
 */
 const OPTIONALLY_ABSENT_PACKAGES = [
 	"@deepseek-ai/dsh-tool-present",
+	"@deepseek-ai/dsh-tool-subagent-control/list-agents",
 	"@eddyskywalker/dsh-chatgpt-subscription/plan-mode-pipeline",
 	"@eddyskywalker/dsh-chatgpt-subscription/plan-mode",
 	"@eddyskywalker/dsh-chatgpt-subscription/tool-result-pruner"
@@ -92470,12 +92698,20 @@ function candidatePackageRoots(entryScript = process.argv[1]) {
 	} catch {}
 	return [...roots];
 }
+/** The package-name portion of a bare package or package-subpath specifier. */
+function packageNameOf(specifier) {
+	return specifier.split("/").slice(0, specifier.startsWith("@") ? 2 : 1).join("/");
+}
 /**
 * Whether a package or exported subpath is installed in any candidate node_modules tree.
 * A subpath needs its own exact `exports` key; the package root alone is not enough.
+*
+* The nearest manifest on each Node resolution chain is authoritative. Looking
+* farther out after that manifest rejects a subpath would let an unrelated old
+* installation resurrect an export the running package deliberately removed.
 */
 function packageInstalled(specifier, roots = candidatePackageRoots()) {
-	const pkg = specifier.split("/").slice(0, specifier.startsWith("@") ? 2 : 1).join("/");
+	const pkg = packageNameOf(specifier);
 	const subpath = specifier.slice(pkg.length);
 	for (const root of roots) {
 		let dir = root;
@@ -92485,9 +92721,9 @@ function packageInstalled(specifier, roots = candidatePackageRoots()) {
 				if (subpath === "") return true;
 				try {
 					const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-					if (manifest.exports !== void 0 && Object.prototype.hasOwnProperty.call(manifest.exports, `.${subpath}`)) return true;
+					return manifest.exports !== void 0 && Object.prototype.hasOwnProperty.call(manifest.exports, `.${subpath}`);
 				} catch {
-					continue;
+					return false;
 				}
 			}
 			const parent = dirname(dir);
@@ -92498,20 +92734,72 @@ function packageInstalled(specifier, roots = candidatePackageRoots()) {
 	return false;
 }
 /**
-* Whether a bare specifier resolves from this module in the running
-* installation. A harness whose Node build exposes no `import.meta.resolve`
-* or whose plugin is executed from outside the profile tree falls through to
-* checking candidate `node_modules` trees across the running harness home.
+* Packages the preset intentionally loads from the plugin's own dependency
+* closure rather than the harness installation. Every other harness row must
+* resolve where the registry mounts it, not merely beside this plugin.
+*/
+const PLUGIN_RESOLVED_PACKAGES = ["@eddyskywalker/dsh-chatgpt-subscription", "@deepseek-ai/dsh-tool-executor-native"];
+/** Whether `candidate` is `root` itself or one of its descendants. */
+function pathInside(root, candidate) {
+	const rel = relative(root, candidate);
+	return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+/**
+* Whether a plugin-side resolution points into the package the harness's own
+* entry script reaches. Walking ancestors mirrors Node's node_modules lookup;
+* the CLI commonly sits in `bin/`, beside rather than inside node_modules.
+*/
+function resolvedFromHarness(resolved, entryDir, specifier) {
+	if (typeof resolved !== "string") return false;
+	let path;
+	try {
+		path = fileURLToPath(resolved);
+	} catch {
+		return false;
+	}
+	const pkg = packageNameOf(specifier);
+	let dir = entryDir;
+	for (;;) {
+		if (pathInside(join(dir, "node_modules", pkg), path)) return true;
+		const parent = dirname(dir);
+		if (parent === dir) return false;
+		dir = parent;
+	}
+}
+/**
+* Resolve against the installation that will actually mount the preset.
+*
+* `import.meta.resolve` is based at this plugin, while the harness mounts
+* runtime-declared preset rows from its own context. A successful plugin-side
+* resolution is therefore not sufficient for a harness package: an old copy in
+* the profile tree must not override the running harness's missing export.
+* Plugin-owned rows and the plugin-borne native executor are the deliberate
+* exceptions. With no harness entry, retain the legacy local probe behavior.
+*/
+function resolvesFromInstallation(specifier, entryScript, resolveFromPlugin) {
+	const entryDir = harnessEntryDir(entryScript);
+	if (entryDir !== void 0 && packageInstalled(specifier, [entryDir])) return true;
+	let resolved;
+	let didResolve = false;
+	if (resolveFromPlugin !== void 0) try {
+		resolved = resolveFromPlugin(specifier);
+		didResolve = true;
+	} catch {}
+	if (entryDir === void 0) {
+		if (didResolve) return true;
+		return packageInstalled(specifier, candidatePackageRoots(entryScript));
+	}
+	if (didResolve && PLUGIN_RESOLVED_PACKAGES.includes(packageNameOf(specifier))) return true;
+	return didResolve && resolvedFromHarness(resolved, entryDir, specifier);
+}
+/**
+* Whether a bare specifier resolves in the installation that mounts presets.
 * @param specifier - bare package specifier.
 * @returns whether the specifier resolves.
 */
 function resolvesFromHere(specifier) {
-	const resolve = import.meta.resolve;
-	if (resolve !== void 0) try {
-		resolve(specifier);
-		return true;
-	} catch {}
-	return packageInstalled(specifier);
+	const resolveFromPlugin = import.meta.resolve;
+	return resolvesFromInstallation(specifier, process.argv[1], resolveFromPlugin);
 }
 /**
 * Point every renamed package name at the spelling this installation ships.
@@ -92889,23 +93177,16 @@ const DISPATCH_PRESET = {
 			name: "@deepseek-ai/dsh-persona",
 			config: {
 				suffix: "Your working directory is {{cwd}}.",
-				prefix: `[Role Identification] If your first user message is a task brief (rather than a direct request from the human user), you are a subagent: the coordinator-facing rules in R0, R0.5, R-G, R1, R2, R4, R5, and R-W do not apply to you. You are the executor—plan, execute, and self-verify strictly within your task boundary, and report concrete evidence back to the dispatcher; R3 remains in effect.
+				prefix: `[Role Identification] If your first user message is a task brief (rather than a direct request from the human user), you are a subagent: the coordinator-facing rules in R0, R-G, R1, R2, R4, R5, and R-W do not apply to you. You are the executor—plan, execute, and self-verify strictly within your task boundary, and report concrete evidence back to the dispatcher; R3 remains in effect.
 - [Standing Subagent Contract] Unless overridden by the brief, every subagent inherits these standing limits: retry attempts at most 3 total per brief; file edits bounded strictly to the declared Boundary module or files; read, search, verification, and test commands unlimited within that boundary; no per-cycle banking (all limits are single-run task totals, and unused allowance is not banked).
 - [Subagent Report Protocol] Every subagent completion report states status: ready | hand_back | blocked | failed | dropped, a summary, and evidence (diffs, test commands and outputs, before/after captures for UI). A status: hand_back report adds a one-sentence hand_back_reason naming the out-of-boundary file/interface or broken premise, and mutates no file outside Boundary.
 - [Coordinator-Only Tools] ask_user_question, enter_plan_mode, leave_plan_mode, exit_plan_mode, create_goal, update_goal, and present are coordinator-only: a subagent call is hard-blocked at execution time (DELEGATED_CALLER), while declarations remain visible to preserve the provider’s content-prefix cache. Never call them as a subagent; escalate via status: hand_back or status: blocked. The bridge’s enforcement is generation-graded (see R9), so never rely on the rejection.
 - [Dispatch Ledger] Call dispatch_ledger {action:"self"} once before your first delegation — it prints the v2 mandate protocol at the tail of its result — and follow that protocol verbatim for every dispatch, report, and steer.
 
 [Coordinator Identity] You are the Lead & Dispatch Agent: converge requirements, plan architecture, select R1 topology (Lead-Core / Hybrid / Fan-out), orchestrate subagents where ROI is positive, and own final acceptance.
-[Execution Pipeline] R0.5 Gate -> R0 Triage -> (L2) R-G Interview -> R9 Plan -> R1 Topology -> (if delegating: R2 Routing -> R5 Brief -> R-W Wait) -> R6 Acceptance.
+[Execution Pipeline] R0 Triage -> (L2) R-G Interview -> R9 Plan -> R1 Topology -> (if delegating: R2 Routing -> R5 Brief -> R-W Wait) -> R6 Acceptance.
 
-## R0.5 · Compatibility Gate (Once per New Session, Before R0)
-A legacy Agent Teams runtime (pre-#7519) registers spawn_teammate and replaces send_message / list_agents / interrupt_agent with team-scoped variants, leaving spawned subagents unreachable. The current runtime only adds a shared task board (team_task_create and its list/get/update siblings) and reuses this mode's tools.
-Criterion: whether spawn_teammate exists (PTC: tools.spawn_teammate). Never gate on wait_agent, send_message, list_agents, or interrupt_agent: this mode mounts those itself.
-- Absent -> Write "Orchestration ready: subagent" and proceed to R0. The board tools stay visible in the PTC SDK whether or not the board is on - frozen declaration, not availability - so confirm with team_task_list before relying on it. When the board is on it is bookkeeping, not a second dispatcher: the dispatch ledger stays the dispatch authority and R5 briefs stay the task contract; publish cross-agent dependencies (blocked_by) and write scopes on one team task per brief, claimed and completed by the child that owns it; never start work because a task is ready, and never reassign a task to skip R6.
-- Present -> This session runs the legacy runtime and is **not orchestratable**. In order, and nothing else:
-  1. State in one sentence that the legacy runtime shadows the coordination tools and this mode has no degraded path.
-  2. Call ask_user_question once (see R-W) offering: disable the legacy runtime, restart Host, **start a new session**; switch preset; or execute this task directly.
-  3. **Do nothing else** until the user replies: no triage, plan, dispatch, file edits, or workarounds.
+[Agent Teams Board] A current harness adds exactly one Agent Teams surface beside this mode: the shared task board (team_task_create and its list/get/update siblings). It is bookkeeping, not a second dispatcher. The board tools stay declared whether or not the board is on - frozen declaration, not availability - so confirm with team_task_list before relying on it. When it is on, the dispatch ledger stays the dispatch authority and R5 briefs stay the task contract; publish cross-agent dependencies (blocked_by) and write scopes on one team task per brief, claimed and completed by the child that owns it; never start work because a task is ready, and never reassign a task to skip R6.
 
 ## R0 · Complexity Triage (Triage First, Then Choose the Workflow)
 Upon receiving a task, determine its tier by semantic impact and uncertainty first, write one line stating "Tier + Rationale", and run the matching workflow:
@@ -92931,7 +93212,7 @@ L0/L1: execute directly (or 1 subagent for L1). L2: R-G, R9, and R6 are mandator
 - [Media generation] Generate/revise/retry images directly; delegate complex creative work, never a bare call.
 
 ## R2 · Model Routing (Check Availability First, Then Decide How to Dispatch)
-Check whether list_subagent_models exists (in PTC mode: tools.list_subagent_models). The tool row and provider/model/reasoning_effort parameters are mounted statically, so they are present even in a session that authorized no route at all. Read that fact instead of inferring it from the tool's output:
+Check whether list_subagent_models exists. The tool row and provider/model/reasoning_effort parameters are mounted statically, so they are present even in a session that authorized no route at all. Read that fact instead of inferring it from the tool's output:
 - If the output says neither—no authorized-routes block and no "No allowlist is in force" sentence—the annotation is absent and you cannot read the posture. Treat it as [State: Unlisted] for behaviour, but say "unconfirmed" rather than claiming either posture, and never report a route as authorized.
 - [State: Listed] Output ends with "Authorized child routes for this Session": enforcement is active.
   - The sole source of truth for the allowlist is list_subagent_models: call list_subagent_models({}) to list authorized providers, and call list_subagent_models({ provider }) to list authorized models under that provider; trust its output directly without cross-checking local config files or workspace code (even if upstream tool text says "Catalog membership is advisory", the runtime output is already filtered to this session's allowlist).
@@ -92947,7 +93228,7 @@ A subagent has full authority to plan, execute, and self-verify within its assig
 Every task brief covers six elements: Goal / Boundary (which files or modules may be touched) / Constraints / Limits (see below) / Acceptance Criteria / Required Evidence to Report.
 - [Compact Delta Brief] Standing default limits and the report schema already live in [Role Identification], so use a Compact Delta Brief by default: state Goal, original file/line Source Pointers (do not paraphrase code into long prose), Module-Interface Boundary, Constraints, Acceptance Criteria, and Required Evidence, and omit repeating standing limits unless overriding them.
 - [Limits] When overriding any standing limit, write one line per limit spelling out four things: **what it bounds, in what unit, the cap, and whether it accumulates**. Write explicit caps ("at most 3 attempts", "edits at most 5 files", "test runs: unlimited"), never ranges ("2–5 files"); where an override dimension is left unstated, silence is read as a limit of zero, and a quota that resets per cycle is lost, not banked.
-- Do not ask the child to restate your rules back as a correctness check; if a limit is genuinely unclear, instruct the child to spend one minimal tool call to verify it. Dispatch independent tasks concurrently in one message (via Promise.all in PTC mode) only after the interview has converged.
+- Do not ask the child to restate your rules back as a correctness check; if a limit is genuinely unclear, instruct the child to spend one minimal tool call to verify it. Dispatch independent tasks concurrently in one message (native calls; use code_run Promise.all for batch filter/MCP) only after the interview has converged.
 
 ## R6 · Review & Acceptance
 Two layers: subagent self-check -> your independent review (reading diffs, running tests, checking each criterion). The completion notification is a post-hoc signal: it tells you a child stopped, not that the work passed.
@@ -92976,7 +93257,7 @@ Fallback is a task-scoped, non-session-wide exception for delegated briefs: it c
 
 ## Anti-Patterns (Any Occurrence Is a Violation)
 1. Orchestrating or opening Plan Mode for an L0/L1 task, or before the R-G interview has converged (21. Entering Plan Mode for an L0/L1 task, or before the R-G interview has converged; 22. Using leave_plan_mode to bypass exit_plan_mode approval).
-2. Switching to teammate vocabulary to keep orchestrating under the legacy team runtime, or Treating the team task board as a substitute for R1 topology, R2 routing, R5 briefs, R6 acceptance, or R-W waiting (R0.5).
+2. Switching to teammate vocabulary to keep orchestrating, or Treating the team task board as a substitute for R1 topology, R2 routing, R5 briefs, R6 acceptance, or R-W waiting (R1, R6).
 3. Omitting provider/model under [State: Listed], Second-guessing list_subagent_models output by hunting through local config or source files just to check which subagent models are allowed, or Reporting a route as "authorized", or claiming per-task routing is in force, when the session recorded no allowlist (R2).
 4. Writing a task brief with a range where a cap belongs ("2–5 files", "a few attempts"), or Asking a subagent to restate its rules as a correctness check (R0, R5).
 5. Running sleep, polling loops, or placeholder long commands to wait, Proactively creating a goal at the start of a task, or Ending with a paragraph of prose to wait for user sign-off instead of calling ask_user_question (R-W).
@@ -99775,6 +100056,23 @@ function applyToolDelta(entry, state) {
 	const fn = isRecord$3(entry.function) ? entry.function : {};
 	const out = [];
 	let call = state.toolCalls.get(wireIndex);
+	const incomingId = asString$1(entry.id);
+	if (call !== void 0 && incomingId !== void 0 && call.id !== `call_${wireIndex}` && incomingId !== call.id) {
+		const closedBlock = {
+			type: "tool-call",
+			id: toToolCallId(call.id),
+			name: call.name,
+			arguments: call.arguments === "" ? "{}" : call.arguments
+		};
+		state.blocks[call.blockIndex] = closedBlock;
+		out.push({
+			type: "block-end",
+			index: call.blockIndex,
+			block: closedBlock
+		});
+		state.toolCalls.delete(wireIndex);
+		call = void 0;
+	}
 	if (call === void 0) {
 		out.push(...closeCurrent(state));
 		call = {
@@ -100144,6 +100442,30 @@ function messagesAssistantContent(message) {
 	return blocks;
 }
 /**
+* Merge neighbouring same-role turns.
+*
+* DSH history can hold two user messages in a row (an injected context notice
+* followed by the real turn) and a tool result is itself a user-role message;
+* the Messages wire wants one user turn, so consecutive turns of one role are
+* folded together in order.
+*/
+function mergeAnthropicMessages(entries) {
+	const merged = [];
+	for (const entry of entries) {
+		if (entry.content.length === 0) continue;
+		const last = merged[merged.length - 1];
+		if (last !== void 0 && last.role === entry.role) {
+			last.content = [...last.content, ...entry.content];
+			continue;
+		}
+		merged.push({
+			role: entry.role,
+			content: [...entry.content]
+		});
+	}
+	return merged;
+}
+/**
 * Build one `/v1/messages` body.
 *
 * `stream: true` is mandatory: the adapter reads every response as SSE, and a
@@ -100161,13 +100483,12 @@ function buildMessagesRequest(options, request = {}) {
 		const role = isToolResultMessage(message) || message.role !== "assistant" ? "user" : "assistant";
 		const content = role === "user" ? messagesUserContent(message, images) : messagesAssistantContent(message);
 		if (content.length === 0) continue;
-		const previous = entries[entries.length - 1];
-		if (previous !== void 0 && previous.role === role) previous.content.push(...content);
-		else entries.push({
+		entries.push({
 			role,
 			content
 		});
 	}
+	const messages = cleanOrphanedToolCalls(mergeAnthropicMessages(entries), mergeAnthropicMessages);
 	const system = leadingSystemTextRaw(options);
 	const tools = options.tools ?? [];
 	const effort = request.effort !== void 0 && (request.efforts ?? []).length > 0 ? request.effort : void 0;
@@ -100176,7 +100497,7 @@ function buildMessagesRequest(options, request = {}) {
 		model: options.model,
 		max_tokens: maxTokens,
 		stream: true,
-		messages: entries,
+		messages,
 		...system === void 0 ? {} : { system },
 		...tools.length > 0 ? { tools: tools.map((tool) => ({
 			name: tool.name,
@@ -103926,6 +104247,10 @@ function apply(ctx, pluginConfig = {}) {
 		const guard = installPtcSdkCacheGuard(ctx);
 		return () => guard.dispose();
 	}, "dsh-chatgpt-subscription: PTC SDK cache guard");
+	ctx.effect(() => {
+		const guard = installSettledJobGuard(ctx);
+		return () => guard.dispose();
+	}, "dsh-chatgpt-subscription: settled job guard");
 	ctx.effect(() => {
 		const guard = installTeamPolicyCacheGuard(ctx, { enabled: () => resolveTeamPolicyCacheGuardEnabled(pluginConfig) });
 		return () => guard.dispose();