@eddyskywalker/dsh-chatgpt-subscription 0.60.0 → 0.61.0

package/lib/index.js

@@ -1,8 +1,8 @@
-import { a as resolveProgressUpdatesSettings, n as attachProgressSettings } from "./entry-progress-updates-CxQewio9.js";
+import { a as resolveProgressUpdatesSettings, n as attachProgressSettings } from "./entry-progress-updates-DZ0ZRus4.js";
 import { attachPlanModePipelineSettings, resolvePlanModePipelineEnabled } from "./plan-mode-pipeline.js";
 import { n as PLUGIN_MESSAGE_SOURCE_KIND, r as normalizeGenerateOptions, t as LlmError$1 } from "./llm-compat-u9mor0uu.js";
 import { DEFAULT_SKIP_PROVIDERS, PRUNER_SERVICE_NAME, resolveSkipProviders, shouldSkipPruningForSession } from "./tool-result-pruner.js";
-import { PLAN_PROJECTION_KEY, createPlanNotice } from "./plan-mode.js";
+import { b as installDispatchExecutionGuard, h as installPlanModeExitReminder, l as PLAN_PROJECTION_KEY, p as createPlanNotice, v as registeredPlanControllerActive, x as resolveDispatchExecutionGuardEnabled } from "./entry-plan-mode-CLRKkgYG.js";
 import { createRequire } from "node:module";
 import * as LlmModule from "@deepseek-ai/dsh-llm";
 import { EMPTY_RESPONSE_CODE, HarnessError, LlmAdapter, LlmError, ProviderRequestId, ReasoningEffortId, ToolCallId, attributionHeaders, createUserMessage, errorChain, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
@@ -808,7 +808,7 @@ const ROUTE_PREFIX$5 = "/api/dsh-chatgpt-subscription";
 * `test/responses-client.test.ts` asserts the two agree, so a release that
 * forgets this constant fails the suite instead of shipping quietly.
 */
-const PLUGIN_VERSION = "0.60.0";
+const PLUGIN_VERSION = "0.61.0";
 const CODEX_CHATGPT_PROVIDER_ID = "codex-chatgpt";
 const CODEX_API_BASE = "https://chatgpt.com/backend-api/codex";
 const CODEX_RESPONSES_URL = `${CODEX_API_BASE}/responses`;
@@ -1193,6 +1193,7 @@ function resolveCodexModel(model, preferences, live) {
 		inputModalities: [...liveEntry?.inputModalities ?? entry.inputModalities],
 		context: { contextWindow: configuredContextWindow ?? liveEntry?.contextWindow ?? entry.contextWindow },
 		...outputReservation(configuredContextWindow ?? liveEntry?.contextWindow ?? entry.contextWindow, codexModelMaxTokens(model)),
+		...codexToolUpdateMode() === void 0 ? {} : { toolUpdate: codexToolUpdateMode() },
 		reasoning: {
 			efforts: orderReasoningEfforts(efforts, GPT_56_REASONING_EFFORTS).map((effort) => ({
 				id: ReasoningEffortId(effort),
@@ -1203,6 +1204,46 @@ function resolveCodexModel(model, preferences, live) {
 	};
 }
 /**
+* Whether this line may state a tool change in the history instead of rewriting
+* the head.
+*
+* `in-history` rather than `addition-only`: this wire has an `additional_tools`
+* item to add a tool but nothing to withdraw one, so a removal has to keep its
+* declaration and travel as a note. Deleting the declaration would shorten the
+* head and throw the cached prefix away, which is the cost this mode exists to
+* avoid.
+*
+* `DSH_CODEX_TOOL_UPDATE=0` turns it off for one account without a code change,
+* the same escape hatch kimi-code carries for its own gate.
+*
+* @returns the mode to declare, or undefined when every request must restate the
+* complete tool list.
+*/
+function codexToolUpdateMode() {
+	if (toolUpdateRejected) return void 0;
+	const raw = (process.env.DSH_CODEX_TOOL_UPDATE ?? "").trim().toLowerCase();
+	if (raw !== "" && [
+		"0",
+		"false",
+		"no",
+		"off",
+		"none"
+	].includes(raw)) return void 0;
+	return "in-history";
+}
+/**
+* Set when a request that carried a tool change was refused with a 400.
+*
+* Process-wide and one-way: the failure mode of a stale probe is a lost cache
+* optimisation, and the failure mode of NOT latching is the same 400 on every
+* later turn. The asymmetry decides it.
+*/
+let toolUpdateRejected = false;
+/** Record a refusal, so every later request restates the complete tool list. */
+function disableCodexToolUpdate() {
+	toolUpdateRejected = true;
+}
+/**
 * Resolve the wire capabilities of one model.
 *
 * The live listing outranks the shipped table, because the backend is the
@@ -1753,7 +1794,7 @@ function parseListing(payload) {
 function parseListingEntry$1(value) {
 	const record = asRecord$20(value);
 	if (record === void 0) return [];
-	const id = asString$30(record.slug) ?? asString$30(record.id);
+	const id = asString$31(record.slug) ?? asString$31(record.id);
 	if (id === void 0) return [];
 	const contextWindow = asNumber$8(record.context_window) ?? asNumber$8(record.contextWindow);
 	const modalities = parseModalities(record.input_modalities);
@@ -1762,11 +1803,11 @@ function parseListingEntry$1(value) {
 	const fallback = CODEX_MODEL_CATALOG.find((entry) => entry.id === id);
 	return [{
 		id,
-		name: asString$30(record.display_name) ?? asString$30(record.displayName) ?? fallback?.name ?? id,
+		name: asString$31(record.display_name) ?? asString$31(record.displayName) ?? fallback?.name ?? id,
 		contextWindow: contextWindow !== void 0 && contextWindow > 0 ? contextWindow : null,
 		inputModalities: modalities ?? (fallback ? [...fallback.inputModalities] : ["text"]),
 		...efforts !== null ? { reasoningEfforts: efforts } : {},
-		defaultReasoningEffort: asString$30(record.default_reasoning_level) ?? fallback?.defaultReasoningEffort ?? null,
+		defaultReasoningEffort: asString$31(record.default_reasoning_level) ?? fallback?.defaultReasoningEffort ?? null,
 		...useResponsesLite !== void 0 ? { useResponsesLite } : {}
 	}];
 }
@@ -1774,7 +1815,7 @@ function parseModalities(value) {
 	if (!Array.isArray(value)) return null;
 	const out = [];
 	for (const item of value) {
-		const name = asString$30(item);
+		const name = asString$31(item);
 		if (name === "text" || name === "image") out.push(name);
 	}
 	return out.length > 0 ? out : null;
@@ -1789,7 +1830,7 @@ function parseEfforts(value) {
 	if (!Array.isArray(value)) return null;
 	const out = [];
 	for (const item of value) {
-		const effort = asString$30(item) ?? asString$30(asRecord$20(item)?.effort);
+		const effort = asString$31(item) ?? asString$31(asRecord$20(item)?.effort);
 		if (effort !== void 0 && !out.includes(effort)) out.push(effort);
 	}
 	return out.length > 0 ? out : null;
@@ -1814,7 +1855,7 @@ function accountKeyFor$1(credentials) {
 function asRecord$20(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
-function asString$30(value) {
+function asString$31(value) {
 	return typeof value === "string" && value !== "" ? value : void 0;
 }
 function asNumber$8(value) {
@@ -8178,7 +8219,7 @@ function sanitizeText$9(text) {
 function isRecord$64(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function asString$29(value) {
+function asString$30(value) {
 	return typeof value === "string" ? value : void 0;
 }
 function safeJsonParse$9(text) {
@@ -8208,7 +8249,7 @@ function attachmentOf$5(block) {
 }
 function attachmentLabel$6(block) {
 	const attachment = isRecord$64(block.attachment) ? block.attachment : void 0;
-	return asString$29(attachment?.name) || asString$29(attachment?.attachmentId);
+	return asString$30(attachment?.name) || asString$30(attachment?.attachmentId);
 }
 function collectImageRefs$3(content, refs) {
 	if (!Array.isArray(content)) return;
@@ -8345,10 +8386,10 @@ function unavailableImageText$6(block) {
 	return `[image unavailable: ${label ? `${label} could not be read` : "the image could not be read"}; ask the user to attach it again if the image is needed]`;
 }
 function imageBlockToPart(block, images) {
-	let data = asString$29(block.data) || asString$29(block.base64);
+	let data = asString$30(block.data) || asString$30(block.base64);
 	const source = isRecord$64(block.source) ? block.source : void 0;
-	if (!data && source) data = asString$29(source.data) || asString$29(source.base64);
-	let mimeType = asString$29(block.mimeType) || asString$29(block.mediaType) || (source ? asString$29(source.mimeType) || asString$29(source.mediaType) : void 0) || "image/png";
+	if (!data && source) data = asString$30(source.data) || asString$30(source.base64);
+	let mimeType = asString$30(block.mimeType) || asString$30(block.mediaType) || (source ? asString$30(source.mimeType) || asString$30(source.mediaType) : void 0) || "image/png";
 	if (data?.startsWith("data:")) {
 		const match = data.match(/^data:([^;,]+);base64,(.*)$/s);
 		if (match) {
@@ -8422,7 +8463,7 @@ function replayBlockFor$1(message, index) {
 	}
 }
 function thoughtSignature(part) {
-	return asString$29(part?.thoughtSignature) || asString$29(part?.thought_signature) || asString$29(part?.thinkingSignature) || asString$29(part?.textSignature);
+	return asString$30(part?.thoughtSignature) || asString$30(part?.thought_signature) || asString$30(part?.thinkingSignature) || asString$30(part?.textSignature);
 }
 function replayPart(part) {
 	const copy = { ...part };
@@ -8521,7 +8562,7 @@ function assistantParts(message, model, runtimeModel, toolCalls) {
 		if (block.type === "reasoning" && runtimeModel.startsWith("claude-") && (message.source?.kind !== "model" || message.source.provider !== "antigravity" || !("model" in message.source) || message.source.model !== model.id)) continue;
 		const replay = replayBlockFor$1(message, index);
 		const originalParts = Array.isArray(replay?.parts) ? replay.parts.filter(isRecord$64) : [];
-		if ((block.type === "text" || block.type === "reasoning") && originalParts.length > 0 && originalParts.every((part) => !part.functionCall) && originalParts.map((part) => asString$29(part.text) || "").join("") === sanitizeText$9(String(block.text || ""))) {
+		if ((block.type === "text" || block.type === "reasoning") && originalParts.length > 0 && originalParts.every((part) => !part.functionCall) && originalParts.map((part) => asString$30(part.text) || "").join("") === sanitizeText$9(String(block.text || ""))) {
 			parts.push(...originalParts.map(replayPart));
 			continue;
 		}
@@ -8542,7 +8583,7 @@ function assistantParts(message, model, runtimeModel, toolCalls) {
 			const toolId = String(block.id || "");
 			const toolName = String(block.name || "");
 			const originalCall = originalParts.find((part) => isRecord$64(part.functionCall));
-			const wireId = asString$29((isRecord$64(originalCall?.functionCall) ? originalCall.functionCall : void 0)?.id) || (toolCallIdNeeded(model.id, runtimeModel) ? sanitizeToolCallId(toolId, toolName) : originalCall ? void 0 : toolId || void 0);
+			const wireId = asString$30((isRecord$64(originalCall?.functionCall) ? originalCall.functionCall : void 0)?.id) || (toolCallIdNeeded(model.id, runtimeModel) ? sanitizeToolCallId(toolId, toolName) : originalCall ? void 0 : toolId || void 0);
 			toolCalls.set(toolId, {
 				name: toolName,
 				id: wireId
@@ -8787,7 +8828,7 @@ function processStreamLine$4(line, state) {
 	if (!isRecord$64(chunk)) return [];
 	const responseData = isRecord$64(chunk.response) ? chunk.response : chunk;
 	const error = isRecord$64(chunk.error) ? chunk.error : isRecord$64(responseData.error) ? responseData.error : void 0;
-	if (error !== void 0) throw new LlmError$1(`Antigravity stream error: ${asString$29(error.message) ?? "unknown error"}`, isContextOverflow(error) ? CONTEXT_OVERFLOW_CODE : "PROVIDER_ERROR");
+	if (error !== void 0) throw new LlmError$1(`Antigravity stream error: ${asString$30(error.message) ?? "unknown error"}`, isContextOverflow(error) ? CONTEXT_OVERFLOW_CODE : "PROVIDER_ERROR");
 	const candidates = Array.isArray(responseData.candidates) ? responseData.candidates : [];
 	const candidate = isRecord$64(candidates[0]) ? candidates[0] : void 0;
 	const content = isRecord$64(candidate?.content) ? candidate.content : void 0;
@@ -8853,8 +8894,8 @@ function processStreamLine$4(line, state) {
 		if (isRecord$64(part.functionCall)) {
 			out.push(...closeCurrentBlock(state));
 			const fc = part.functionCall;
-			const toolName = asString$29(fc.name) || "";
-			const toolId = asString$29(fc.id) || sanitizeToolCallId("", toolName);
+			const toolName = asString$30(fc.name) || "";
+			const toolId = asString$30(fc.id) || sanitizeToolCallId("", toolName);
 			const argsText = JSON.stringify(isRecord$64(fc.args) ? fc.args : {});
 			const index = state.blocks.length;
 			const block = {
@@ -8892,10 +8933,10 @@ function processStreamLine$4(line, state) {
 	}
 	collectUsage(chunk.usageMetadata, state);
 	if (responseData !== chunk) collectUsage(responseData.usageMetadata, state);
-	const finishMessage = asString$29(candidate?.finishMessage);
+	const finishMessage = asString$30(candidate?.finishMessage);
 	if (finishMessage) state.finishMessage = finishMessage;
-	const blockReason = asString$29((isRecord$64(responseData.promptFeedback) ? responseData.promptFeedback : void 0)?.blockReason);
-	const finishReason = asString$29(candidate?.finishReason) || asString$29(responseData.finishReason) || (blockReason ? `PROMPT_BLOCKED:${blockReason}` : void 0);
+	const blockReason = asString$30((isRecord$64(responseData.promptFeedback) ? responseData.promptFeedback : void 0)?.blockReason);
+	const finishReason = asString$30(candidate?.finishReason) || asString$30(responseData.finishReason) || (blockReason ? `PROMPT_BLOCKED:${blockReason}` : void 0);
 	if (finishReason) {
 		state.finishReason = finishReason;
 		out.push(...closeCurrentBlock(state));
@@ -8970,7 +9011,7 @@ function closeStream$7(state) {
 function isRecord$63(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function asString$28(value) {
+function asString$29(value) {
 	return typeof value === "string" ? value : void 0;
 }
 /**
@@ -9031,7 +9072,7 @@ function attachmentOf$4(block) {
 }
 function attachmentLabel$5(block) {
 	const attachment = isRecord$63(block.attachment) ? block.attachment : void 0;
-	return asString$28(attachment?.name) || asString$28(attachment?.attachmentId);
+	return asString$29(attachment?.name) || asString$29(attachment?.attachmentId);
 }
 function collectImageRefs$2(content, refs) {
 	if (!Array.isArray(content)) return;
@@ -9065,9 +9106,9 @@ function base64Length$2(bytes) {
 * has no resolved map behaves exactly as before.
 */
 function inlinePayloadOf$1(block) {
-	let data = asString$28(block.data) || asString$28(block.base64);
+	let data = asString$29(block.data) || asString$29(block.base64);
 	const source = isRecord$63(block.source) ? block.source : void 0;
-	if (!data && source) data = asString$28(source.data) || asString$28(source.base64);
+	if (!data && source) data = asString$29(source.data) || asString$29(source.base64);
 	if (data?.startsWith("data:")) {
 		const matched = data.match(/^data:([^;,]+);base64,(.*)$/s);
 		if (matched) data = matched[2] ?? "";
@@ -9530,10 +9571,10 @@ function unavailableImageText$5(block) {
 	return `[image unavailable: ${label ? `${label} could not be read` : "the image could not be read"}; ask the user to attach it again if the image is needed]`;
 }
 function imageBlockToInline$3(block, images) {
-	let data = asString$28(block.data) || asString$28(block.base64);
+	let data = asString$29(block.data) || asString$29(block.base64);
 	const source = isRecord$63(block.source) ? block.source : void 0;
-	if (!data && source) data = asString$28(source.data) || asString$28(source.base64);
-	let mediaType = asString$28(block.mimeType) || asString$28(block.mediaType) || (source ? asString$28(source.mimeType) || asString$28(source.mediaType) : void 0) || "image/png";
+	if (!data && source) data = asString$29(source.data) || asString$29(source.base64);
+	let mediaType = asString$29(block.mimeType) || asString$29(block.mediaType) || (source ? asString$29(source.mimeType) || asString$29(source.mediaType) : void 0) || "image/png";
 	if (data?.startsWith("data:")) {
 		const matched = data.match(/^data:([^;,]+);base64,(.*)$/s);
 		if (matched) {
@@ -13110,6 +13151,21 @@ async function buildResponsesPayload(options, attachments, localRawImages = {},
 			});
 			continue;
 		}
+		if (message.role === "developer") {
+			input.push(...toolChangeItems(message, options.tools, wire.idNamespace));
+			const rest = message.content.filter((block) => block.type !== "tool-addition" && block.type !== "tool-removal");
+			if (rest.length > 0) {
+				const content = await mapContent({
+					...message,
+					content: rest
+				}, attachments, options.signal, localRawImages, localImageStats, resolveLocalRawImages);
+				if (content.length > 0) input.push({
+					role: "developer",
+					content
+				});
+			}
+			continue;
+		}
 		const content = await mapContent(message, attachments, options.signal, localRawImages, localImageStats, resolveLocalRawImages);
 		if (content.length > 0) input.push({
 			role: message.role,
@@ -13120,8 +13176,9 @@ async function buildResponsesPayload(options, attachments, localRawImages = {},
 	offloadOldestInputImages(input);
 	const instructionText = [...instructionParts, localRawImageInstruction(localImageStats)].filter((value) => Boolean(value)).join("\n\n");
 	const prefix = [];
-	const tools = options.tools ?? [];
-	if (useResponsesLite && tools.length > 0) prefix.push(additionalToolsItem(tools, wire.idNamespace));
+	const allTools = options.tools ?? [];
+	const tools = allTools.filter((tool) => tool.deferLoading !== true);
+	if (useResponsesLite && allTools.length > 0) prefix.push(additionalToolsItem(allTools, wire.idNamespace));
 	if (instructionText !== "") prefix.push(developerMessageItem(instructionText, wire.idNamespace, useResponsesLite));
 	input.unshift(...prefix);
 	const toolDeclarations = tools.length > 0 ? tools.map(toolDeclaration) : void 0;
@@ -13193,6 +13250,87 @@ function additionalToolsItem(tools, idNamespace) {
 	};
 }
 /**
+* The input items one mid-conversation tool change becomes.
+*
+* An addition travels as an `additional_tools` item at the point in the history
+* where it happened. The item carries the full definition, so the head never has
+* to grow it: everything before this position keeps its cached prefix and the
+* backend reads the new tool from here onward.
+*
+* A removal has no wire form of its own — there is no `tool_removal` item — so
+* the declaration stays exactly where it is and this note tells the model the
+* tool is gone. Dropping the declaration instead would shorten the head and
+* throw the prefix away, which is the cost `in-history` exists to avoid.
+*
+* Measured on the subscription backend by
+* `scripts/probe-codex-tool-updates.probe.ts`: the item is accepted, the model
+* calls a tool that only ever appeared in it, and a padded prefix stays cached
+* across the addition.
+*
+* @param message - the developer message carrying the change.
+* @param tools - the active declaration set the change resolves against.
+* @param idNamespace - the conversation identity, for stable item ids.
+* @returns the items to append at this position, in order.
+*/
+function toolChangeItems(message, tools, idNamespace) {
+	const byName = new Map((tools ?? []).map((tool) => [tool.name, tool]));
+	const added = [];
+	const removed = [];
+	for (const block of message.content) {
+		const name = typeof block["toolName"] === "string" ? block["toolName"] : "";
+		if (name === "") continue;
+		if (block["type"] === "tool-addition") {
+			const tool = byName.get(name);
+			if (tool !== void 0) added.push(toolDeclaration(tool));
+		} else if (block["type"] === "tool-removal") removed.push(name);
+	}
+	const items = [];
+	if (added.length > 0) items.push({
+		type: "additional_tools",
+		id: stableItemId("at", idNamespace, JSON.stringify(added)),
+		role: "developer",
+		tools: added
+	});
+	if (removed.length > 0) {
+		const text = toolRemovalNotice(removed);
+		items.push({
+			type: "message",
+			id: stableItemId("msg", idNamespace, text),
+			role: "developer",
+			content: [{
+				type: "input_text",
+				text
+			}]
+		});
+	}
+	return items;
+}
+/**
+* The same request with every tool change taken back out.
+*
+* This is the shape a backend that refuses the update channel gets: the complete
+* current declaration list at the head, no change messages, no deferred markers.
+* It is exactly what the line sent before the capability existed, so the fallback
+* costs a cache miss and nothing else.
+*
+* @param options - the request that was refused.
+* @returns a request the line can always send.
+*/
+function withoutCodexToolChanges(options) {
+	const messages = options.messages.filter((message) => !(message.role === "developer" && Array.isArray(message.content) && message.content.some((block) => block.type === "tool-addition" || block.type === "tool-removal")));
+	const tools = options.tools?.map(({ deferLoading: _deferred, ...tool }) => tool);
+	return {
+		...options,
+		messages,
+		...tools === void 0 ? {} : { tools }
+	};
+}
+/** How a withdrawn tool is stated to the model, imperatively. */
+function toolRemovalNotice(names) {
+	const list = names.map((name) => `"${name}"`).join(", ");
+	return names.length === 1 ? `[The tool ${list} is no longer available. Do not call it again: any call will fail.]` : `[The tools ${list} are no longer available. Do not call them again: any call will fail.]`;
+}
+/**
 * The base instructions as a developer message.
 *
 * The official client marks the item with the `model.base_instructions` kind, so
@@ -13579,6 +13717,8 @@ var ResponsesClient = class {
 		const turnKey = turnKeyFor(sessionId);
 		let currentModel = options.model;
 		let attemptOptions = options;
+		let strippedToolChanges = false;
+		const statesToolChange = (candidate) => candidate.messages.some((message) => message.role === "developer" && Array.isArray(message.content) && message.content.some((block) => block["type"] === "tool-addition" || block["type"] === "tool-removal"));
 		let response;
 		let release;
 		while (true) {
@@ -13604,6 +13744,12 @@ var ResponsesClient = class {
 						continue;
 					}
 				}
+				if (!strippedToolChanges && statesToolChange(attemptOptions) && error.status === 400) {
+					disableCodexToolUpdate();
+					attemptOptions = withoutCodexToolChanges(attemptOptions);
+					strippedToolChanges = true;
+					continue;
+				}
 				throw error;
 			}
 		}
@@ -20868,7 +21014,7 @@ function isRecord$61(value) {
 function asRecord$16(value) {
 	return isRecord$61(value) ? value : void 0;
 }
-function asString$27(value) {
+function asString$28(value) {
 	if (typeof value === "string" && value.trim() !== "") return value;
 	if (typeof value === "number" && Number.isFinite(value)) return String(value);
 }
@@ -20881,7 +21027,7 @@ function asNumber$6(value) {
 }
 function firstString$2(record, keys) {
 	for (const key of keys) {
-		const value = asString$27(record[key]);
+		const value = asString$28(record[key]);
 		if (value !== void 0) return value;
 	}
 }
@@ -21128,7 +21274,7 @@ function parseCreditBalances(payload, consumed = []) {
 /** Resolve the plan id the subscription or credits payload reports, when either does. */
 function parsePlanId(payloads) {
 	for (const payload of payloads) {
-		const id = asString$27(deepValue(payload, [
+		const id = asString$28(deepValue(payload, [
 			"planId",
 			"plan_id",
 			"priceId",
@@ -21147,7 +21293,7 @@ function parsePlanId(payloads) {
 */
 function parseSubscriptionStatus(payload) {
 	const root = asRecord$16(payload) ?? {};
-	return asString$27(deepValue(asRecord$16(root.data) ?? root, ["status"])) ?? null;
+	return asString$28(deepValue(asRecord$16(root.data) ?? root, ["status"])) ?? null;
 }
 /** End of the current billing period, in Unix milliseconds. */
 function parseSubscriptionPeriodEnd(payload) {
@@ -21723,6 +21869,92 @@ function buildModelOptions$2(catalog, enabledModelIds, overrides) {
 	});
 }
 //#endregion
+//#region src/host/common/orphan-tool-calls.ts
+/**
+* 读一个未知字段为字符串。
+* @param value - 候选值。
+* @returns 字符串，或任何其它类型的 undefined。
+*/
+function asString$27(value) {
+	return typeof value === "string" ? value : void 0;
+}
+/**
+* 清掉没有配对的工具调用。
+*
+* 配对规则只有一条：`tool_use` 必须被**后面第一条** user 轮里的同名 `tool_result` 应答；
+* 到了下一条 assistant 轮还没被应答，它就是孤儿。反向也一样——`tool_result` 找不到仍在
+* 等待的同名调用，它就是无主结果（线上报的是「tool call result does not follow tool call」）。
+*
+* @param messages - 已折叠过的消息列表。
+* @param refold - 调用方自己的相邻同角色折叠，清理后需要再折一次。
+* @returns 配对完整、且没有空消息的消息列表；清理会把整段历史清空时原样返回。
+*/
+function cleanOrphanedToolCalls(messages, refold) {
+	const result = [];
+	let pending = [];
+	/**
+	* 丢掉没有被结果应答的调用。
+	* @param answered - 已经被结果应答的 id 集合。
+	*/
+	const dropUnanswered = (answered) => {
+		const byMessage = /* @__PURE__ */ new Map();
+		for (const call of pending) {
+			if (answered.has(call.id)) continue;
+			const indices = byMessage.get(call.messageIndex);
+			if (indices === void 0) byMessage.set(call.messageIndex, [call.blockIndex]);
+			else indices.push(call.blockIndex);
+		}
+		for (const [messageIndex, indices] of byMessage) {
+			const message = result[messageIndex];
+			if (message === void 0) continue;
+			message.content = message.content.filter((_block, index) => !indices.includes(index));
+		}
+		pending = [];
+	};
+	for (const message of messages) {
+		if (message.role === "assistant") {
+			dropUnanswered(/* @__PURE__ */ new Set());
+			const messageIndex = result.length;
+			for (let blockIndex = 0; blockIndex < message.content.length; blockIndex += 1) {
+				const block = message.content[blockIndex];
+				if (block.type !== "tool_use") continue;
+				const id = asString$27(block.id);
+				if (id === void 0) continue;
+				pending.push({
+					messageIndex,
+					blockIndex,
+					id
+				});
+			}
+			result.push({
+				...message,
+				content: [...message.content]
+			});
+			continue;
+		}
+		const answered = /* @__PURE__ */ new Set();
+		const content = [];
+		for (const block of message.content) {
+			if (block.type === "tool_result") {
+				const id = asString$27(block.tool_use_id);
+				if (id === void 0 || !pending.some((call) => call.id === id)) continue;
+				answered.add(id);
+				content.push(block);
+				continue;
+			}
+			content.push(block);
+		}
+		dropUnanswered(answered);
+		result.push({
+			...message,
+			content
+		});
+	}
+	dropUnanswered(/* @__PURE__ */ new Set());
+	const nonEmpty = result.filter((message) => message.content.length > 0);
+	return nonEmpty.length === 0 ? messages : refold(nonEmpty);
+}
+//#endregion
 //#region src/host/command-code/mapper.ts
 /**
 * Provider-wire mapping for the two Command Code provider endpoints.
@@ -22279,7 +22511,7 @@ function anthropicAssistantContent$3(message) {
 * the Messages wire wants one user turn, so consecutive turns of one role are
 * folded together in order.
 */
-function mergeAnthropicMessages$3(entries) {
+function mergeAnthropicMessages$4(entries) {
 	const merged = [];
 	for (const entry of entries) {
 		if (entry.content.length === 0) continue;
@@ -22370,7 +22602,7 @@ function buildAnthropicRequest$1(options, images = NO_RESOLVED_IMAGES$3) {
 	return {
 		model: options.model,
 		max_tokens: maxTokens,
-		messages: mergeAnthropicMessages$3(entries),
+		messages: cleanOrphanedToolCalls(mergeAnthropicMessages$4(entries), mergeAnthropicMessages$4),
 		...system === void 0 ? {} : { system: anthropicSystemBlocks(system) },
 		...options.temperature === void 0 || budget !== void 0 ? {} : { temperature: options.temperature },
 		...options.stop && options.stop.length > 0 ? { stop_sequences: options.stop } : {},
@@ -22672,6 +22904,23 @@ function applyOpenAIToolDelta$1(entry, state) {
 	const fn = isRecord$60(entry.function) ? entry.function : {};
 	const out = [];
 	let call = state.toolCalls.get(wireIndex);
+	const incomingId = asString$26(entry.id);
+	if (call !== void 0 && incomingId !== void 0 && call.id !== `call_${wireIndex}` && incomingId !== call.id) {
+		const closedBlock = {
+			type: "tool-call",
+			id: toToolCallId(call.id),
+			name: call.name,
+			arguments: call.arguments === "" ? "{}" : call.arguments
+		};
+		state.blocks[call.blockIndex] = closedBlock;
+		out.push({
+			type: "block-end",
+			index: call.blockIndex,
+			block: closedBlock
+		});
+		state.toolCalls.delete(wireIndex);
+		call = void 0;
+	}
 	if (call === void 0) {
 		out.push(...closeCurrent$6(state));
 		call = {
@@ -34457,7 +34706,7 @@ function anthropicAssistantContent$2(message, toolCallIds) {
 * the Messages wire wants one user turn, so consecutive turns of one role are
 * folded together in order.
 */
-function mergeAnthropicMessages$2(entries) {
+function mergeAnthropicMessages$3(entries) {
 	const merged = [];
 	for (const entry of entries) {
 		if (entry.content.length === 0) continue;
@@ -34510,7 +34759,7 @@ function buildAnthropicRequest(options, images = NO_RESOLVED_IMAGES$4, media = {
 		type: CLEAR_THINKING_EDIT,
 		keep: "all"
 	}] } : void 0;
-	const messages = mergeAnthropicMessages$2(entries);
+	const messages = cleanOrphanedToolCalls(mergeAnthropicMessages$3(entries), mergeAnthropicMessages$3);
 	const lastMessage = messages[messages.length - 1];
 	if (lastMessage !== void 0 && Array.isArray(lastMessage.content) && lastMessage.content.length > 0) {
 		const lastBlock = lastMessage.content[lastMessage.content.length - 1];
@@ -34823,6 +35072,23 @@ function applyOpenAIToolDelta(entry, state) {
 	const fn = isRecord$53(entry.function) ? entry.function : {};
 	const out = [];
 	let call = state.toolCalls.get(wireIndex);
+	const incomingId = asString$21(entry.id);
+	if (call !== void 0 && incomingId !== void 0 && call.id !== `call_${wireIndex}` && incomingId !== call.id) {
+		const closedBlock = {
+			type: "tool-call",
+			id: toToolCallId(state.toolCallIds.normalize(call.id)),
+			name: call.name,
+			arguments: call.arguments === "" ? "{}" : call.arguments
+		};
+		state.blocks[call.blockIndex] = closedBlock;
+		out.push({
+			type: "block-end",
+			index: call.blockIndex,
+			block: closedBlock
+		});
+		state.toolCalls.delete(wireIndex);
+		call = void 0;
+	}
 	if (call === void 0) {
 		out.push(...closeCurrent$5(state));
 		call = {
@@ -36809,7 +37075,7 @@ const KIMI_CODE_REQUEST_IMAGE_MAX_EDGE = 2e3;
 * @param catalog - live catalog, possibly empty when offline.
 * @returns the tool-update mode, or undefined when this route must resend everything.
 */
-function toolUpdateMode$1(modelId, catalog) {
+function toolUpdateMode$2(modelId, catalog) {
 	if (!dynamicToolsForEntry(modelId, catalog)) return void 0;
 	if (wireForCatalogEntry(modelId, catalog) !== "openai") return void 0;
 	const raw = (process.env.DSH_KIMI_CODE_TOOL_UPDATE ?? "").trim().toLowerCase();
@@ -37212,7 +37478,7 @@ var KimiCodeAdapter = class extends LlmAdapter {
 			id: modelId,
 			name: entry?.name ?? modelId,
 			inputModalities: inputModalitiesForEntry(modelId, catalog),
-			...toolUpdateMode$1(modelId, catalog) === void 0 ? {} : { toolUpdate: toolUpdateMode$1(modelId, catalog) },
+			...toolUpdateMode$2(modelId, catalog) === void 0 ? {} : { toolUpdate: toolUpdateMode$2(modelId, catalog) },
 			context: { contextWindow: this.contextWindowFor(modelId, entry, settings.contextWindowOverrides) },
 			...efforts.length === 0 ? {} : { reasoning: {
 				efforts: efforts.map((effort) => ({
@@ -40865,7 +41131,7 @@ function anthropicAssistantContent$1(message, expectedScope) {
 * Messages wire wants one user turn, so consecutive turns of one role are folded
 * together in order.
 */
-function mergeAnthropicMessages$1(entries) {
+function mergeAnthropicMessages$2(entries) {
 	const merged = [];
 	for (const entry of entries) {
 		if (entry.content.length === 0) continue;
@@ -41087,7 +41353,7 @@ function buildMinimaxRequest(options, images = NO_RESOLVED_IMAGES$2, request = {
 		model: options.model,
 		max_tokens: maxTokens,
 		stream: true,
-		messages: mergeAnthropicMessages$1(entries),
+		messages: cleanOrphanedToolCalls(mergeAnthropicMessages$2(entries), mergeAnthropicMessages$2),
 		...system === void 0 ? {} : { system: caching ? [{
 			type: "text",
 			text: system
@@ -49630,6 +49896,16 @@ function isClaudeCacheTtl$1(value) {
 * models (`THINKING_BINDING_CONTROLS_BETA`, pushed when `supportsMidConvoEffort`).
 */
 const THINKING_BINDING_CONTROLS_BETA = "thinking-binding-controls-2026-08-01";
+/**
+* Licenses a mid-conversation `tool_addition` / `tool_removal` block.
+*
+* A tool change stated inside a `role: "system"` message is a beta shape: without
+* this marker the blocks are an unknown content type and the request is refused.
+* The name carries its own date because the vendor versions the shape, so a
+* future revision arrives as a new constant rather than as a silent behaviour
+* change under the old one.
+*/
+const INLINE_TOOLS_BETA = "inline-tools-2026-09-15";
 /** Anthropic protocol revision sent as `anthropic-version`. */
 const ANTHROPIC_VERSION$1 = "2023-06-01";
 /**
@@ -51256,6 +51532,7 @@ function claudeBetas(options = {}) {
 	if (options.thinking === true) betas.push(INTERLEAVED_THINKING_BETA);
 	if (options.thinkingBinding === true) betas.push(THINKING_BINDING_CONTROLS_BETA);
 	if (options.cacheTtl === "1h") betas.push(EXTENDED_CACHE_TTL_BETA);
+	if (options.toolChanges === true) betas.push(INLINE_TOOLS_BETA);
 	return betas;
 }
 /** The `User-Agent` value this line reports for one surface. */
@@ -53356,10 +53633,85 @@ function wireTool(tool, names) {
 	return {
 		name: claudeWireToolName(tool.name, names),
 		description: tool.description ?? "",
-		input_schema: schema
+		input_schema: schema,
+		...tool.deferLoading === true ? { defer_loading: true } : {}
 	};
 }
 /**
+* The stand-in declaration a request needs when every real tool is deferred.
+*
+* The vendor's rule is that at least one tool must stay active: a request whose
+* declarations are all deferred has no active declaration, and a tool change
+* stated in that state would move the start of the rendered prompt. Transcribed
+* from the harness's own anthropic-messages adapter, which inserts the same
+* placeholder for the same reason.
+*/
+const CLAUDE_TOOL_UPDATE_PLACEHOLDER = {
+	name: "tool_update_placeholder",
+	description: "Reserved. Keeps one tool declaration active so a mid-conversation tool change stays in the history. Never call it.",
+	parameters: {
+		type: "object",
+		properties: {}
+	}
+};
+/** Whether one message states a tool change this wire can carry. */
+function claudeMessageStatesToolChange(message) {
+	return Array.isArray(message.content) && message.content.some((block) => isRecord$41(block) && (block.type === "tool-addition" || block.type === "tool-removal"));
+}
+/**
+* The fallback statement of one tool change, for a history position the vendor
+* will not accept a mid-conversation system message in.
+*
+* The declarations are untouched in both shapes: this only tells the model what
+* changed, and it is deliberately imperative for a removal because the
+* declaration is still there and could otherwise still be called.
+*/
+function claudeToolChangeNote(message) {
+	const added = [];
+	const removed = [];
+	for (const block of message.content) {
+		if (!isRecord$41(block)) continue;
+		const name = typeof block.toolName === "string" ? block.toolName.trim() : "";
+		if (name === "") continue;
+		if (block.type === "tool-addition") added.push(name);
+		else if (block.type === "tool-removal") removed.push(name);
+	}
+	const notes = [];
+	if (added.length > 0) notes.push(`[The tool(s) ${added.map((name) => `"${name}"`).join(", ")} are now available.]`);
+	if (removed.length > 0) notes.push(`[The tool(s) ${removed.map((name) => `"${name}"`).join(", ")} are no longer available. Do not call them again: any call will fail.]`);
+	return notes.join("\n");
+}
+/** Whether any message states a tool change that this wire can carry. */
+function claudeHasToolChanges(options) {
+	return options.messages.some((message) => message.role === "developer" && Array.isArray(message.content) && message.content.some((block) => isRecord$41(block) && (block.type === "tool-addition" || block.type === "tool-removal")));
+}
+/**
+* Whether a BUILT payload carries a `tool_addition` / `tool_removal` block.
+*
+* Read off the body rather than from the request, so the beta header and the
+* blocks it licenses cannot disagree about one request.
+*/
+function claudeBodyHasToolChanges(payload) {
+	const messages = payload["messages"];
+	if (!Array.isArray(messages)) return false;
+	return messages.some((message) => {
+		const content = message["content"];
+		return Array.isArray(content) && content.some((block) => block["type"] === "tool_addition" || block["type"] === "tool_removal");
+	});
+}
+/**
+* The wire tool list for one request.
+*
+* Deferred declarations travel with `defer_loading` so they stay out of the
+* prefix. When EVERY declaration is deferred and the history states a change,
+* one placeholder is prepended: the vendor refuses a tool change on a request
+* that has no active declaration at all.
+*/
+function claudeWireTools(options, names) {
+	const tools = options.tools ?? [];
+	return (tools.length > 0 && tools.every((tool) => tool.deferLoading === true) && claudeHasToolChanges(options) ? [CLAUDE_TOOL_UPDATE_PLACEHOLDER, ...tools] : tools).map((tool) => wireTool(tool, names));
+}
+/**
 * One system-role turn's blocks.
 *
 * The vendor documents a mid-conversation system message as carrying "a plain
@@ -53385,6 +53737,17 @@ function claudeSystemContent(message, images) {
 			continue;
 		}
 		if (block.type === "image") blocks.push(imageBlockFor(block, images));
+		if (block.type === "tool-addition" || block.type === "tool-removal") {
+			const name = typeof block.toolName === "string" ? block.toolName.trim() : "";
+			if (name === "") continue;
+			blocks.push({
+				type: block.type === "tool-addition" ? "tool_addition" : "tool_removal",
+				tool: {
+					type: "tool_reference",
+					name: claudeWireToolName(name)
+				}
+			});
+		}
 	}
 	return blocks;
 }
@@ -53588,7 +53951,9 @@ function buildClaudeRequestBody(options, images = NO_RESOLVED_IMAGES$1, request
 	const maxTokens = claudeRequestThinks(options.model, effort, catalog) ? adjustMaxTokensForThinking(baseMax, modelMax, level, request.thinkingBudgets).maxTokens : baseMax;
 	const { thinking, outputConfig } = claudeThinking(options.model, effort, level, maxTokens, request.thinkingBudgets, catalog);
 	const entries = [];
-	for (const message of messagesForTheWire(options)) {
+	const wire = messagesForTheWire(options);
+	for (let index = 0; index < wire.length; index += 1) {
+		const message = wire[index];
 		if (message.role === "system") {
 			entries.push({
 				role: "system",
@@ -53596,6 +53961,26 @@ function buildClaudeRequestBody(options, images = NO_RESOLVED_IMAGES$1, request
 			});
 			continue;
 		}
+		if (message.role === "developer" && claudeMessageStatesToolChange(message)) {
+			const previous = wire[index - 1];
+			const next = wire[index + 1];
+			if (previous !== void 0 && wireRoleOf(previous) === "user" && (next === void 0 || wireRoleOf(next) === "assistant")) {
+				entries.push({
+					role: "system",
+					content: claudeSystemContent(message, images)
+				});
+				continue;
+			}
+			const note = claudeToolChangeNote(message);
+			if (note !== "") entries.push({
+				role: "user",
+				content: [{
+					type: "text",
+					text: note
+				}]
+			});
+			continue;
+		}
 		if (isToolResultMessage$5(message)) {
 			entries.push({
 				role: "user",
@@ -53617,8 +54002,8 @@ function buildClaudeRequestBody(options, images = NO_RESOLVED_IMAGES$1, request
 		max_tokens: maxTokens,
 		stream: true,
 		system: buildClaudeSystemBlocks(options, caching, cacheTtl),
-		messages: mergeClaudeMessages(entries),
-		...options.tools !== void 0 && options.tools.length > 0 ? { tools: options.tools.map((tool) => wireTool(tool, names)) } : {},
+		messages: cleanOrphanedToolCalls(mergeClaudeMessages(entries), mergeClaudeMessages),
+		...options.tools !== void 0 && options.tools.length > 0 ? { tools: claudeWireTools(options, names) } : {},
 		...thinking === void 0 ? {} : { thinking },
 		...outputConfig === void 0 ? {} : { output_config: outputConfig },
 		...temperatureAllowed && options.temperature !== void 0 ? { temperature: options.temperature } : {},
@@ -55444,6 +55829,33 @@ var ClaudeAccountTokenStore = class {
 		await this.store.saveAccount(credentials, { internalId: this.internalId });
 	}
 };
+/**
+* Whether this model may state a tool change in the history.
+*
+* Gated on the same capability that licenses a mid-conversation system message,
+* because that message is what carries the change: a model that folds those
+* messages back into the top-level `system` field cannot take a tool change
+* without moving the head, which is the cost the capability exists to avoid.
+*
+* `DSH_CLAUDE_TOOL_UPDATE=0` turns it off for one account without a code change,
+* mirroring the escape hatch kimi-code and the codex line carry.
+*
+* @param modelId - exact model id.
+* @returns the mode to declare, or undefined when every request must restate the
+* complete tool list.
+*/
+function toolUpdateMode$1(modelId) {
+	if (!claudeSupportsMidConversationSystemMessages(modelId)) return void 0;
+	const raw = (process.env.DSH_CLAUDE_TOOL_UPDATE ?? "").trim().toLowerCase();
+	if (raw !== "" && [
+		"0",
+		"false",
+		"no",
+		"off",
+		"none"
+	].includes(raw)) return void 0;
+	return "in-history";
+}
 var ClaudeAdapter = class ClaudeAdapter extends LlmAdapter {
 	store;
 	modelSettings;
@@ -55559,6 +55971,7 @@ var ClaudeAdapter = class ClaudeAdapter extends LlmAdapter {
 			inputModalities: entry.supportsImage ? ["text", "image"] : ["text"],
 			context: { contextWindow: contextWindow || 2e5 },
 			...outputReservation(contextWindow || 2e5, maxOutputTokensFor(modelId, catalog)),
+			...toolUpdateMode$1(modelId) === void 0 ? {} : { toolUpdate: toolUpdateMode$1(modelId) },
 			...efforts.length === 0 ? {} : { reasoning: {
 				efforts: efforts.map((effort) => ({
 					id: ReasoningEffortId(effort),
@@ -55657,6 +56070,7 @@ var ClaudeAdapter = class ClaudeAdapter extends LlmAdapter {
 					model: requestOptions.model,
 					thinking,
 					thinkingBinding: claudeBodyBindsThinking(payload),
+					toolChanges: claudeBodyHasToolChanges(payload),
 					cacheTtl,
 					method: "POST"
 				}),
@@ -59161,7 +59575,7 @@ function safeStringify(value) {
 * DSH 历史里可能连续两条 user（注入的上下文提示 + 真正的用户轮），而工具结果本身就是
 * user 角色消息；Messages 线要的是一个 user 轮，所以同角色的连续轮按顺序折叠。
 */
-function mergeAnthropicMessages(entries) {
+function mergeAnthropicMessages$1(entries) {
 	const merged = [];
 	for (const entry of entries) {
 		if (entry.content.length === 0) continue;
@@ -59310,7 +59724,7 @@ function buildGlmAnthropicRequest(options, request = {}) {
 	}
 	const system = glmAnthropicSystemBlocks(options);
 	const maxTokens = options.maxTokens ?? request.defaultMaxTokens ?? 32768;
-	const merged = mergeAnthropicMessages(entries);
+	const merged = cleanOrphanedToolCalls(mergeAnthropicMessages$1(entries), mergeAnthropicMessages$1);
 	const lastMessageIndex = merged.length - 1;
 	const messages = lastMessageIndex < 0 ? merged : merged.map((message, index) => index === lastMessageIndex ? {
 		...message,
@@ -60637,6 +61051,23 @@ function applyToolDelta$3(entry, state) {
 	const fn = isRecord$37(entry.function) ? entry.function : {};
 	const out = [];
 	let call = state.toolCalls.get(wireIndex);
+	const incomingId = asString$14(entry.id);
+	if (call !== void 0 && incomingId !== void 0 && call.id !== `call_${wireIndex}` && incomingId !== call.id) {
+		const closedBlock = {
+			type: "tool-call",
+			id: toToolCallId(call.id),
+			name: call.name,
+			arguments: call.arguments === "" ? "{}" : call.arguments
+		};
+		state.blocks[call.blockIndex] = closedBlock;
+		out.push({
+			type: "block-end",
+			index: call.blockIndex,
+			block: closedBlock
+		});
+		state.toolCalls.delete(wireIndex);
+		call = void 0;
+	}
 	if (call === void 0) {
 		out.push(...closeCurrent$3(state));
 		call = {
@@ -65470,6 +65901,23 @@ function applyToolDelta$2(entry, state) {
 	const fn = isRecord$33(entry.function) ? entry.function : void 0;
 	const out = [];
 	let call = state.toolCalls.get(wireIndex);
+	const incomingId = asString$10(entry.id);
+	if (call !== void 0 && incomingId !== void 0 && call.id !== `call_${wireIndex}` && incomingId !== call.id) {
+		const closedBlock = {
+			type: "tool-call",
+			id: toToolCallId(call.id),
+			name: call.name,
+			arguments: call.arguments === "" ? "{}" : call.arguments
+		};
+		state.blocks[call.blockIndex] = closedBlock;
+		out.push({
+			type: "block-end",
+			index: call.blockIndex,
+			block: closedBlock
+		});
+		state.toolCalls.delete(wireIndex);
+		call = void 0;
+	}
 	if (call === void 0) {
 		const opened = openToolCall$1(state, entry, wireIndex);
 		out.push(...opened.chunks);
@@ -71734,6 +72182,7 @@ async function* translate(payloads) {
 				if (!isRecord$26(call)) continue;
 				const index = Number(call.index ?? 0);
 				let block = toolBlocks.get(index);
+				if (block !== void 0 && typeof call.id === "string" && call.id.length > 0 && block.callId !== void 0 && block.callId.length > 0 && block.callId !== call.id) block = void 0;
 				if (block === void 0) {
 					block = open("tool-call");
 					toolBlocks.set(index, block);
@@ -71745,7 +72194,7 @@ async function* translate(payloads) {
 				}
 				const fn = isRecord$26(call.function) ? call.function : {};
 				block.callId = acceptIdentity$1(block.callId, call.id);
-				block.name = acceptIdentity$1(block.name, fn.name);
+				if (block.name === void 0 || block.name === "") block.name = acceptIdentity$1(block.name, fn.name);
 				const fragment = typeof fn.arguments === "string" ? fn.arguments : "";
 				block.text += fragment;
 				yield {
@@ -78472,6 +78921,23 @@ function applyToolDelta$1(entry, state) {
 	const fn = isRecord$21(entry.function) ? entry.function : void 0;
 	const out = [];
 	let call = state.toolCalls.get(wireIndex);
+	const incomingId = asString$7(entry.id);
+	if (call !== void 0 && incomingId !== void 0 && call.id !== "call_" + wireIndex && incomingId !== call.id) {
+		const closedBlock = {
+			type: "tool-call",
+			id: toToolCallId(call.id),
+			name: call.name,
+			arguments: call.arguments === "" ? "{}" : call.arguments
+		};
+		state.blocks[call.blockIndex] = closedBlock;
+		out.push({
+			type: "block-end",
+			index: call.blockIndex,
+			block: closedBlock
+		});
+		state.toolCalls.delete(wireIndex);
+		call = void 0;
+	}
 	if (call === void 0) {
 		const opened = openToolCall(state, entry, wireIndex);
 		out.push(...opened.chunks);
@@ -83690,6 +84156,7 @@ async function* translate$1(payloads) {
 				if (!isRecord$17(call)) continue;
 				const index = Number(call.index ?? 0);
 				let block = toolBlocks.get(index);
+				if (block !== void 0 && typeof call.id === "string" && call.id.length > 0 && block.callId !== void 0 && block.callId.length > 0 && block.callId !== call.id) block = void 0;
 				if (block === void 0) {
 					block = open("tool-call");
 					toolBlocks.set(index, block);
@@ -83701,7 +84168,7 @@ async function* translate$1(payloads) {
 				}
 				const fn = isRecord$17(call.function) ? call.function : {};
 				block.callId = acceptIdentity(block.callId, call.id);
-				block.name = acceptIdentity(block.name, fn.name);
+				if (block.name === void 0 || block.name === "") block.name = acceptIdentity(block.name, fn.name);
 				const fragment = typeof fn.arguments === "string" ? fn.arguments : "";
 				block.text += fragment;
 				yield {
@@ -87228,9 +87695,9 @@ function installToolResultPrunerGuard(ctx, options = {}) {
 	const wrapPruner = (pruner) => {
 		if (disposed || !isRecord$14(pruner)) return false;
 		if (alreadyWrapped.has(pruner)) return false;
-		const target = resolveMethodTarget$3(pruner, "pruneSession");
+		const target = resolveMethodTarget$4(pruner, "pruneSession");
 		if (target === void 0) return false;
-		if (alreadyPatched$3(patchedMethods, target.holder, target.name)) {
+		if (alreadyPatched$4(patchedMethods, target.holder, target.name)) {
 			alreadyWrapped.add(pruner);
 			return false;
 		}
@@ -87242,11 +87709,11 @@ function installToolResultPrunerGuard(ctx, options = {}) {
 			};
 			return original.call(this ?? pruner, session);
 		};
-		if (!installMethod$3(target, replacement)) return false;
-		markPatched$3(patchedMethods, target.holder, target.name);
+		if (!installMethod$4(target, replacement)) return false;
+		markPatched$4(patchedMethods, target.holder, target.name);
 		alreadyWrapped.add(pruner);
 		restores.push(() => {
-			restoreMethod$3(target);
+			restoreMethod$4(target);
 		});
 		return true;
 	};
@@ -87466,7 +87933,7 @@ function isRecord$14(value) {
 * @param name - 方法名。
 * @returns 目标；方法不存在时为 `undefined`。
 */
-function resolveMethodTarget$3(service, name) {
+function resolveMethodTarget$4(service, name) {
 	if (typeof service !== "object" || service === null) return void 0;
 	const own = service;
 	if (Object.prototype.hasOwnProperty.call(own, name)) {
@@ -87498,7 +87965,7 @@ function resolveMethodTarget$3(service, name) {
 * @param replacement - 包装实现。
 * @returns 是否装上了。
 */
-function installMethod$3(target, replacement) {
+function installMethod$4(target, replacement) {
 	try {
 		Object.defineProperty(target.holder, target.name, {
 			value: replacement,
@@ -87516,7 +87983,7 @@ function installMethod$3(target, replacement) {
 *
 * @param target - 目标。
 */
-function restoreMethod$3(target) {
+function restoreMethod$4(target) {
 	try {
 		if (target.descriptor === void 0) Reflect.deleteProperty(target.holder, target.name);
 		else Object.defineProperty(target.holder, target.name, target.descriptor);
@@ -87530,7 +87997,7 @@ function restoreMethod$3(target) {
 * @param name - 方法名。
 * @returns 是否已经包过。
 */
-function alreadyPatched$3(patched, holder, name) {
+function alreadyPatched$4(patched, holder, name) {
 	return patched.get(holder)?.has(name) === true;
 }
 /**
@@ -87540,7 +88007,7 @@ function alreadyPatched$3(patched, holder, name) {
 * @param holder - 方法宿主。
 * @param name - 方法名。
 */
-function markPatched$3(patched, holder, name) {
+function markPatched$4(patched, holder, name) {
 	const names = patched.get(holder);
 	if (names === void 0) patched.set(holder, /* @__PURE__ */ new Set([name]));
 	else names.add(name);
@@ -87555,7 +88022,7 @@ const GLOBAL_KEY$2 = Object.freeze({});
 * @param service - 服务名。
 * @returns 服务实例或 undefined。
 */
-function serviceOf$1(ctx, service) {
+function serviceOf$2(ctx, service) {
 	const read = ctx?.get;
 	if (typeof read !== "function") return void 0;
 	try {
@@ -87577,11 +88044,15 @@ function bucketOf$1(value) {
 * @param ctx - 宿主上下文。
 * @param event - 事件名。
 * @param listener - 监听器。
+* @param options - cordis 订阅选项；省略时按两参数订阅。
 * @returns 解绑函数或 undefined。
 */
-function subscribe$3(ctx, event, listener) {
+function subscribe$3(ctx, event, listener, options) {
 	const on = ctx?.on;
 	if (typeof on !== "function") return void 0;
+	if (options !== void 0) try {
+		return on.call(ctx, event, listener, options);
+	} catch {}
 	try {
 		return on.call(ctx, event, listener);
 	} catch {
@@ -87674,11 +88145,15 @@ function installPlanModeCacheGuard(ctx) {
 	if (offPreStep !== void 0) restores.push(() => {
 		offPreStep();
 	});
+	const offReminder = installPlanModeExitReminder(ctx, { isActive: (agent) => planActiveOfAgent(ctx, agent) });
+	if (offReminder !== void 0) restores.push(() => {
+		offReminder();
+	});
 	const wrap = (tools) => {
 		if (tools === void 0) return;
-		const target = resolveMethodTarget$2(tools, "register");
+		const target = resolveMethodTarget$3(tools, "register");
 		if (target === void 0) return;
-		if (alreadyPatched$2(patchedMethods, target.holder, target.name)) return;
+		if (alreadyPatched$3(patchedMethods, target.holder, target.name)) return;
 		const original = target.original;
 		const wrapped = function(...args) {
 			const receiver = this ?? tools;
@@ -87690,16 +88165,16 @@ function installPlanModeCacheGuard(ctx) {
 			}
 			return original.call(receiver, definition, options);
 		};
-		if (!installMethod$2(target, wrapped)) return;
-		markPatched$2(patchedMethods, target.holder, target.name);
+		if (!installMethod$3(target, wrapped)) return;
+		markPatched$3(patchedMethods, target.holder, target.name);
 		restores.push(() => {
-			restoreMethod$2(target);
+			restoreMethod$3(target);
 		});
 		if (typeof tools.get === "function") try {
 			if (tools.get("exit_plan_mode") !== void 0) logWarn$1(ctx, "[dsh-chatgpt-subscription] plan-mode cache guard was installed after exit_plan_mode was already registered; this session keeps the conditional admission");
 		} catch {}
 	};
-	const tools = serviceOf$1(ctx, "tools");
+	const tools = serviceOf$2(ctx, "tools");
 	if (tools !== void 0) wrap(tools);
 	else {
 		const inject = ctx?.inject;
@@ -87709,7 +88184,7 @@ function installPlanModeCacheGuard(ctx) {
 				inject.call(ctx, ["tools"], (scope) => {
 					if (wrapped || closed) return;
 					wrapped = true;
-					wrap(serviceOf$1(scope, "tools"));
+					wrap(serviceOf$2(scope, "tools"));
 				});
 			} catch {}
 		}
@@ -87729,7 +88204,7 @@ function installPlanModeCacheGuard(ctx) {
 * @returns true / false；读不到时 undefined。
 */
 function planActiveOf(ctx, session) {
-	const projections = serviceOf$1(ctx, "sessionProjections");
+	const projections = serviceOf$2(ctx, "sessionProjections");
 	if (typeof projections?.stateOf !== "function") return void 0;
 	try {
 		const state = projections.stateOf(session, PLAN_PROJECTION_KEY);
@@ -87739,6 +88214,35 @@ function planActiveOf(ctx, session) {
 	}
 }
 /**
+* 读一个 agent 此刻是否在计划模式。
+*
+* 三级降级，顺序不可颠倒：
+*
+* 1. 进程级登记册（{@link registeredPlanControllerActive}）：本包的 fork 会把每个
+*    会话登记进去，**跨 realm 可见**。`ctx.get()` 看不见 `isolate: { planMode: true }`
+*    的子 realm，而隔离正是宿主守卫最常见的部署（守卫在根作用域、控制器在 preset 里），
+*    所以这一级必须先问。
+* 2. 同一作用域里的 `planMode` 服务：本包的 fork 有 `selectedActive`（含未决选择），
+*    所以 `exit_plan_mode` 刚排队 `{ active: false }`、日志还没落进投影的那一刻不会被
+*    误判成「还在计划模式」。
+* 3. plan 投影：内置 preset 挂的是官方服务，它的 `/plan` 只写日志，投影是那边唯一的
+*    事实来源。
+* @param ctx - 宿主上下文。
+* @param agent - 调用方 agent。
+* @returns true / false；读不到时 undefined。
+*/
+function planActiveOfAgent(ctx, agent) {
+	const session = agent?.session;
+	const registered = registeredPlanControllerActive(session);
+	if (registered !== void 0) return registered;
+	const controller = serviceOf$2(ctx, "planMode");
+	if (typeof controller?.selectedActive === "function") try {
+		const active = controller.selectedActive(session);
+		if (typeof active === "boolean") return active;
+	} catch {}
+	return planActiveOf(ctx, session);
+}
+/**
 * 记一条警告。
 * @param ctx - 宿主上下文。
 * @param message - 正文。
@@ -87767,7 +88271,7 @@ function logWarn$1(ctx, message) {
 * @param name - 方法名。
 * @returns 目标；方法不存在时为 `undefined`。
 */
-function resolveMethodTarget$2(service, name) {
+function resolveMethodTarget$3(service, name) {
 	if (typeof service !== "object" || service === null) return void 0;
 	const own = service;
 	if (Object.prototype.hasOwnProperty.call(own, name)) {
@@ -87799,7 +88303,7 @@ function resolveMethodTarget$2(service, name) {
 * @param replacement - 包装实现。
 * @returns 是否装上了。
 */
-function installMethod$2(target, replacement) {
+function installMethod$3(target, replacement) {
 	try {
 		Object.defineProperty(target.holder, target.name, {
 			value: replacement,
@@ -87817,7 +88321,7 @@ function installMethod$2(target, replacement) {
 *
 * @param target - 目标。
 */
-function restoreMethod$2(target) {
+function restoreMethod$3(target) {
 	try {
 		if (target.descriptor === void 0) Reflect.deleteProperty(target.holder, target.name);
 		else Object.defineProperty(target.holder, target.name, target.descriptor);
@@ -87831,7 +88335,7 @@ function restoreMethod$2(target) {
 * @param name - 方法名。
 * @returns 是否已经包过。
 */
-function alreadyPatched$2(patched, holder, name) {
+function alreadyPatched$3(patched, holder, name) {
 	return patched.get(holder)?.has(name) === true;
 }
 /**
@@ -87841,7 +88345,7 @@ function alreadyPatched$2(patched, holder, name) {
 * @param holder - 方法宿主。
 * @param name - 方法名。
 */
-function markPatched$2(patched, holder, name) {
+function markPatched$3(patched, holder, name) {
 	const names = patched.get(holder);
 	if (names === void 0) patched.set(holder, /* @__PURE__ */ new Set([name]));
 	else names.add(name);
@@ -87963,7 +88467,7 @@ function installPtcSdkCacheGuard(ctx, options = {}) {
 	*/
 	const toolFingerprint = (tools, scope) => {
 		if (!isRecord$13(tools)) return "";
-		const target = resolveMethodTarget$1(tools, "definitions");
+		const target = resolveMethodTarget$2(tools, "definitions");
 		if (target === void 0) return "";
 		let list;
 		try {
@@ -87983,9 +88487,9 @@ function installPtcSdkCacheGuard(ctx, options = {}) {
 	const wrapToolsService = (tools) => {
 		if (disposed || !isRecord$13(tools)) return false;
 		if (alreadyWrapped.has(tools)) return false;
-		const target = resolveMethodTarget$1(tools, "definitions");
+		const target = resolveMethodTarget$2(tools, "definitions");
 		if (target === void 0) return false;
-		if (alreadyPatched$1(patchedMethods, target.holder, target.name)) {
+		if (alreadyPatched$2(patchedMethods, target.holder, target.name)) {
 			alreadyWrapped.add(tools);
 			return false;
 		}
@@ -87998,11 +88502,11 @@ function installPtcSdkCacheGuard(ctx, options = {}) {
 			}
 			return original.call(receiver, scope, toolSet);
 		};
-		if (!installMethod$1(target, replacement)) return false;
-		markPatched$1(patchedMethods, target.holder, target.name);
+		if (!installMethod$2(target, replacement)) return false;
+		markPatched$2(patchedMethods, target.holder, target.name);
 		alreadyWrapped.add(tools);
 		restores.push(() => {
-			restoreMethod$1(target);
+			restoreMethod$2(target);
 		});
 		return true;
 	};
@@ -88042,7 +88546,7 @@ function installPtcSdkCacheGuard(ctx, options = {}) {
 	};
 	const offAssemble = subscribe$2(host, "system-prompt/assemble", onAssemble);
 	if (offAssemble !== void 0) disposers.push(offAssemble);
-	const initialTools = serviceOf(host, "tools");
+	const initialTools = serviceOf$1(host, "tools");
 	if (initialTools !== void 0) {
 		currentTools = initialTools;
 		wrapToolsService(initialTools);
@@ -88051,7 +88555,7 @@ function installPtcSdkCacheGuard(ctx, options = {}) {
 		if (typeof inject === "function") try {
 			inject.call(host, ["tools"], (scope) => {
 				if (disposed) return;
-				const tools = serviceOf(scope, "tools");
+				const tools = serviceOf$1(scope, "tools");
 				if (tools === void 0) return;
 				currentTools = tools;
 				wrapToolsService(tools);
@@ -88079,7 +88583,7 @@ function installPtcSdkCacheGuard(ctx, options = {}) {
 * @param service - 服务名。
 * @returns 服务实例；读不到时为 `undefined`。
 */
-function serviceOf(ctx, service) {
+function serviceOf$1(ctx, service) {
 	if (!isRecord$13(ctx)) return void 0;
 	const read = ctx["get"];
 	if (typeof read !== "function") return void 0;
@@ -88148,7 +88652,7 @@ function isRecord$13(value) {
 * @param name - 方法名。
 * @returns 目标；方法不存在时为 `undefined`。
 */
-function resolveMethodTarget$1(service, name) {
+function resolveMethodTarget$2(service, name) {
 	if (typeof service !== "object" || service === null) return void 0;
 	const own = service;
 	if (Object.prototype.hasOwnProperty.call(own, name)) {
@@ -88180,7 +88684,7 @@ function resolveMethodTarget$1(service, name) {
 * @param replacement - 包装实现。
 * @returns 是否装上了。
 */
-function installMethod$1(target, replacement) {
+function installMethod$2(target, replacement) {
 	try {
 		Object.defineProperty(target.holder, target.name, {
 			value: replacement,
@@ -88198,7 +88702,7 @@ function installMethod$1(target, replacement) {
 *
 * @param target - 目标。
 */
-function restoreMethod$1(target) {
+function restoreMethod$2(target) {
 	try {
 		if (target.descriptor === void 0) Reflect.deleteProperty(target.holder, target.name);
 		else Object.defineProperty(target.holder, target.name, target.descriptor);
@@ -88212,7 +88716,7 @@ function restoreMethod$1(target) {
 * @param name - 方法名。
 * @returns 是否已经包过。
 */
-function alreadyPatched$1(patched, holder, name) {
+function alreadyPatched$2(patched, holder, name) {
 	return patched.get(holder)?.has(name) === true;
 }
 /**
@@ -88222,12 +88726,245 @@ function alreadyPatched$1(patched, holder, name) {
 * @param holder - 方法宿主。
 * @param name - 方法名。
 */
-function markPatched$1(patched, holder, name) {
+function markPatched$2(patched, holder, name) {
 	const names = patched.get(holder);
 	if (names === void 0) patched.set(holder, /* @__PURE__ */ new Set([name]));
 	else names.add(name);
 }
 //#endregion
+//#region src/host/settled-job-guard.ts
+function isRecord$12(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function serviceOf(ctx, name) {
+	const get = ctx?.get;
+	if (typeof get !== "function") return void 0;
+	try {
+		return get.call(ctx, name);
+	} catch {
+		return;
+	}
+}
+function isTerminalStatus(value) {
+	return value === "completed" || value === "failed" || value === "killed";
+}
+function isUnknownJobError(error, id) {
+	if (!(error instanceof Error)) return false;
+	return error.message === `unknown job ${id}`;
+}
+/**
+* 通过 `agents` 或 `sessions` 服务定位 `caller` 对应的会话对象。
+*/
+function resolveCallerSession(ctx, caller) {
+	const agents = serviceOf(ctx, "agents");
+	if (typeof agents?.get === "function") try {
+		const agent = agents.get(caller);
+		if (agent?.session !== void 0 && agent.session !== null) return agent.session;
+	} catch {}
+	const sessions = serviceOf(ctx, "sessions");
+	if (typeof sessions?.get === "function") try {
+		const session = sessions.get(caller);
+		if (session !== void 0 && session !== null) return session;
+	} catch {
+		return;
+	}
+}
+/**
+* 从调用方自己的持久会话日志里倒序查找已落盘的 `job/settled` 记录。
+*
+* 严格校验 `owner === caller`：无主或归属其它会话的任务绝不跨会话恢复。
+*/
+function findSettledJobInSession(session, jobId, caller) {
+	if (!isRecord$12(session)) return void 0;
+	const snapshot = session["snapshotEvents"];
+	if (typeof snapshot !== "function") return void 0;
+	let events;
+	try {
+		events = snapshot.call(session);
+	} catch {
+		return;
+	}
+	if (!Array.isArray(events)) return void 0;
+	for (let index = events.length - 1; index >= 0; index -= 1) {
+		const event = events[index];
+		if (!isRecord$12(event) || event["type"] !== "job/settled") continue;
+		const data = event["data"];
+		if (!isRecord$12(data)) continue;
+		if (data["jobId"] !== jobId) continue;
+		if (data["owner"] !== caller) return void 0;
+		const kind = typeof data["kind"] === "string" && data["kind"].length > 0 ? data["kind"] : "job";
+		const label = typeof data["label"] === "string" && data["label"].length > 0 ? data["label"] : jobId;
+		const status = isTerminalStatus(data["status"]) ? data["status"] : "killed";
+		const detail = typeof data["detail"] === "string" && data["detail"].length > 0 ? data["detail"] : void 0;
+		const startedAt = typeof data["startedAt"] === "number" && Number.isFinite(data["startedAt"]) ? data["startedAt"] : 0;
+		const finishedAt = typeof data["finishedAt"] === "number" && Number.isFinite(data["finishedAt"]) ? data["finishedAt"] : void 0;
+		return {
+			id: jobId,
+			kind,
+			label,
+			owner: caller,
+			status,
+			...detail === void 0 ? {} : { detail },
+			startedAt,
+			...finishedAt === void 0 ? {} : { finishedAt },
+			output: {
+				total: 0,
+				earliest: 0
+			}
+		};
+	}
+}
+function resolveMethodTarget$1(service, name) {
+	if (typeof service !== "object" || service === null) return void 0;
+	const own = service;
+	if (Object.prototype.hasOwnProperty.call(own, name)) {
+		const original = own[name];
+		if (typeof original !== "function") return void 0;
+		return {
+			holder: own,
+			name,
+			original,
+			descriptor: Object.getOwnPropertyDescriptor(own, name)
+		};
+	}
+	const proto = Object.getPrototypeOf(service);
+	if (proto === null || proto === Object.prototype || proto === Function.prototype) return void 0;
+	const descriptor = Object.getOwnPropertyDescriptor(proto, name);
+	if (descriptor === void 0 || typeof descriptor.value !== "function") return void 0;
+	return {
+		holder: proto,
+		name,
+		original: descriptor.value,
+		descriptor
+	};
+}
+function installMethod$1(target, replacement) {
+	try {
+		Object.defineProperty(target.holder, target.name, {
+			configurable: target.descriptor?.configurable ?? true,
+			enumerable: target.descriptor?.enumerable ?? false,
+			writable: target.descriptor?.writable ?? true,
+			value: replacement
+		});
+		return true;
+	} catch {
+		return false;
+	}
+}
+function restoreMethod$1(target) {
+	try {
+		if (target.descriptor !== void 0) Object.defineProperty(target.holder, target.name, target.descriptor);
+		else delete target.holder[target.name];
+	} catch {}
+}
+function alreadyPatched$1(patched, holder, name) {
+	return patched.get(holder)?.has(name) === true;
+}
+function markPatched$1(patched, holder, name) {
+	let set = patched.get(holder);
+	if (set === void 0) {
+		set = /* @__PURE__ */ new Set();
+		patched.set(holder, set);
+	}
+	set.add(name);
+}
+/**
+* 安装「已结算后台任务跨回合幂等守卫」。
+*
+* @param ctx - 宿主上下文。
+* @returns 守卫句柄。
+*/
+function installSettledJobGuard(ctx) {
+	const restores = [];
+	const patchedMethods = /* @__PURE__ */ new WeakMap();
+	let closed = false;
+	const recoverForCaller = (rawId, rawCaller) => {
+		if (closed) return void 0;
+		if (typeof rawId !== "string" || rawId.length === 0) return void 0;
+		if (typeof rawCaller !== "string" || rawCaller.length === 0) return void 0;
+		return findSettledJobInSession(resolveCallerSession(ctx, rawCaller), rawId, rawCaller);
+	};
+	const patchSync = (jobs, methodName, onRecovered) => {
+		const target = resolveMethodTarget$1(jobs, methodName);
+		if (target === void 0 || alreadyPatched$1(patchedMethods, target.holder, target.name)) return;
+		const original = target.original;
+		const wrapped = function(...args) {
+			const receiver = this ?? jobs;
+			try {
+				return original.call(receiver, ...args);
+			} catch (error) {
+				const id = typeof args[0] === "string" ? args[0] : "";
+				if (id !== "" && isUnknownJobError(error, id)) {
+					const recovered = recoverForCaller(id, args[1]);
+					if (recovered !== void 0) return onRecovered(recovered);
+				}
+				throw error;
+			}
+		};
+		if (!installMethod$1(target, wrapped)) return;
+		markPatched$1(patchedMethods, target.holder, target.name);
+		restores.push(() => {
+			restoreMethod$1(target);
+		});
+	};
+	const patchWait = (jobs) => {
+		const target = resolveMethodTarget$1(jobs, "wait");
+		if (target === void 0 || alreadyPatched$1(patchedMethods, target.holder, target.name)) return;
+		const original = target.original;
+		const wrapped = async function(...args) {
+			const receiver = this ?? jobs;
+			try {
+				return await original.call(receiver, ...args);
+			} catch (error) {
+				const id = typeof args[0] === "string" ? args[0] : "";
+				if (id !== "" && isUnknownJobError(error, id)) {
+					const recovered = recoverForCaller(id, args[2]);
+					if (recovered !== void 0) return recovered;
+				}
+				throw error;
+			}
+		};
+		if (!installMethod$1(target, wrapped)) return;
+		markPatched$1(patchedMethods, target.holder, target.name);
+		restores.push(() => {
+			restoreMethod$1(target);
+		});
+	};
+	const wrap = (jobs) => {
+		if (jobs === void 0) return;
+		patchSync(jobs, "kill", () => "already-finished");
+		patchSync(jobs, "get", (view) => view);
+		patchSync(jobs, "read", (view) => ({
+			chunks: [],
+			lossy: false,
+			job: view
+		}));
+		patchWait(jobs);
+	};
+	const immediate = serviceOf(ctx, "jobs");
+	if (immediate !== void 0) wrap(immediate);
+	else {
+		const inject = ctx?.inject;
+		if (typeof inject === "function") {
+			let wrapped = false;
+			try {
+				inject.call(ctx, ["jobs"], (scope) => {
+					if (wrapped || closed) return;
+					wrapped = true;
+					wrap(serviceOf(scope, "jobs"));
+				});
+			} catch {}
+		}
+	}
+	return { dispose() {
+		if (closed) return;
+		closed = true;
+		for (const restore of restores.splice(0)) try {
+			restore();
+		} catch {}
+	} };
+}
+//#endregion
 //#region src/host/team-policy-cache-guard.ts
 /**
 * 「Agent Teams 策略段前缀缓存守卫」—— 把内置 `team:policy` 段从 system 里摘掉，
@@ -88567,7 +89304,7 @@ const GUARDED_EVENTS = [
 * @returns 可销毁的句柄。
 */
 function installCompactionPolicyGuard(ctx, options = {}) {
-	const host = isRecord$12(ctx) ? ctx : void 0;
+	const host = isRecord$11(ctx) ? ctx : void 0;
 	const provider = options.provider ?? "kimi-code";
 	const defaults = {
 		provider,
@@ -88642,9 +89379,9 @@ function installCompactionPolicyGuard(ctx, options = {}) {
 	* @param source - agent、header 或配置对象。
 	*/
 	const observeFrom = (source) => {
-		if (!isRecord$12(source)) return;
+		if (!isRecord$11(source)) return;
 		const session = source["session"];
-		if (isRecord$12(session)) {
+		if (isRecord$11(session)) {
 			const requestHeader = session["requestHeader"];
 			if (typeof requestHeader === "function") {
 				let header;
@@ -88653,16 +89390,16 @@ function installCompactionPolicyGuard(ctx, options = {}) {
 				} catch {
 					header = void 0;
 				}
-				if (isRecord$12(header)) {
+				if (isRecord$11(header)) {
 					const config = header["config"];
-					if (isRecord$12(config)) observe(readString(config["provider"]), readString(config["model"]));
+					if (isRecord$11(config)) observe(readString(config["provider"]), readString(config["model"]));
 				}
 			}
 		}
 		const optionsField = source["options"];
-		if (isRecord$12(optionsField)) observe(readString(optionsField["provider"]), readString(optionsField["model"]));
+		if (isRecord$11(optionsField)) observe(readString(optionsField["provider"]), readString(optionsField["model"]));
 		const config = source["config"];
-		if (isRecord$12(config)) observe(readString(config["provider"]), readString(config["model"]));
+		if (isRecord$11(config)) observe(readString(config["provider"]), readString(config["model"]));
 	};
 	/**
 	* 读一个字符串字段。
@@ -88692,10 +89429,10 @@ function installCompactionPolicyGuard(ctx, options = {}) {
 	* @returns 是否真的改写了。
 	*/
 	const patchEngine = (engine) => {
-		if (disposed || !isRecord$12(engine)) return false;
+		if (disposed || !isRecord$11(engine)) return false;
 		if (patched.has(engine)) return false;
 		const config = engine["config"];
-		if (!isRecord$12(config)) return false;
+		if (!isRecord$11(config)) return false;
 		const originalPolicies = config["modelPolicies"];
 		if (!Array.isArray(originalPolicies)) return false;
 		const originalConfig = config;
@@ -88765,7 +89502,7 @@ function installCompactionPolicyGuard(ctx, options = {}) {
 				let nextArgs = args;
 				if (name === "summarize") {
 					const input = args[0];
-					if (isRecord$12(input)) {
+					if (isRecord$11(input)) {
 						const messages = input["messages"];
 						if (Array.isArray(messages)) {
 							const replaced = replaceCompactionInstruction(messages);
@@ -88800,12 +89537,12 @@ function installCompactionPolicyGuard(ctx, options = {}) {
 	* @returns 是否改写了新引擎。
 	*/
 	const patchStoreEntry = (entry) => {
-		if (!isRecord$12(entry)) return false;
+		if (!isRecord$11(entry)) return false;
 		const record = entry;
 		const name = readServiceName(record);
 		if (name !== void 0 && name !== "compaction") return false;
 		const value = record.value ?? record.impl;
-		if (isRecord$12(value)) {
+		if (isRecord$11(value)) {
 			if (patchEngine(value)) return true;
 			const nested = value["engine"];
 			if (nested !== void 0) return patchEngine(nested);
@@ -88820,11 +89557,11 @@ function installCompactionPolicyGuard(ctx, options = {}) {
 	* @returns 本次新改写的引擎数。
 	*/
 	const scanStore = (target) => {
-		if (!isRecord$12(target)) return 0;
+		if (!isRecord$11(target)) return 0;
 		const reflect = target["reflect"];
-		if (!isRecord$12(reflect)) return 0;
+		if (!isRecord$11(reflect)) return 0;
 		const store = reflect["store"];
-		if (!isRecord$12(store)) return 0;
+		if (!isRecord$11(store)) return 0;
 		const services = store;
 		let count = 0;
 		for (const key of Object.getOwnPropertySymbols(services)) if (patchStoreEntry(services[key])) count += 1;
@@ -88838,12 +89575,12 @@ function installCompactionPolicyGuard(ctx, options = {}) {
 	* @returns 是否改写了新引擎。
 	*/
 	const patchServiceFrom = (target, name) => {
-		if (!isRecord$12(target)) return false;
+		if (!isRecord$11(target)) return false;
 		const get = target["get"];
 		if (typeof get !== "function") return false;
 		try {
 			const service = get.call(target, name);
-			if (!isRecord$12(service)) return false;
+			if (!isRecord$11(service)) return false;
 			if (patchEngine(service)) return true;
 			const nested = service["engine"];
 			return nested === void 0 ? false : patchEngine(nested);
@@ -88886,7 +89623,7 @@ function installCompactionPolicyGuard(ctx, options = {}) {
 		try {
 			for (const arg of args) {
 				observeFrom(arg);
-				if (isRecord$12(arg)) observeFrom(arg["agent"]);
+				if (isRecord$11(arg)) observeFrom(arg["agent"]);
 			}
 			scanAndPatch();
 			const agentCtx = findAgentContext(args);
@@ -88925,9 +89662,9 @@ function installCompactionPolicyGuard(ctx, options = {}) {
 function readServiceName(record) {
 	if (typeof record.name === "string") return record.name;
 	const impl = record.impl;
-	if (isRecord$12(impl) && typeof impl["name"] === "string") return impl["name"];
+	if (isRecord$11(impl) && typeof impl["name"] === "string") return impl["name"];
 	const value = record.value;
-	if (isRecord$12(value) && typeof value["name"] === "string") return value["name"];
+	if (isRecord$11(value) && typeof value["name"] === "string") return value["name"];
 }
 /**
 * 从一次事件派发的参数里找出 agent 的上下文。
@@ -88939,7 +89676,7 @@ function findAgentContext(args) {
 	for (const arg of args) {
 		const direct = readContext(arg);
 		if (direct !== void 0) return direct;
-		if (isRecord$12(arg)) {
+		if (isRecord$11(arg)) {
 			const nested = readContext(arg["agent"]);
 			if (nested !== void 0) return nested;
 		}
@@ -88952,10 +89689,10 @@ function findAgentContext(args) {
 * @returns 上下文；不像时返回 `undefined`。
 */
 function readContext(value) {
-	if (!isRecord$12(value)) return void 0;
+	if (!isRecord$11(value)) return void 0;
 	const ctx = value["ctx"];
-	if (!isRecord$12(ctx)) return void 0;
-	if (typeof ctx["get"] === "function" || isRecord$12(ctx["reflect"])) return ctx;
+	if (!isRecord$11(ctx)) return void 0;
+	if (typeof ctx["get"] === "function" || isRecord$11(ctx["reflect"])) return ctx;
 }
 /**
 * 订阅一个事件，优先用 `prepend: true`。
@@ -88995,7 +89732,7 @@ function subscribe(host, event, listener) {
 * @param value - 任意值。
 * @returns 是非 null 的对象时为 `true`。
 */
-function isRecord$12(value) {
+function isRecord$11(value) {
 	return typeof value === "object" && value !== null;
 }
 /**
@@ -89095,449 +89832,6 @@ function markPatched(patched, holder, name) {
 	if (names === void 0) patched.set(holder, /* @__PURE__ */ new Set([name]));
 	else names.add(name);
 }
-//#endregion
-//#region src/host/dispatch-execution-guard.ts
-/**
-* 「调度执行守卫」——在**执行期**拦住两类越界调用。
-*
-* ## 为什么需要它
-*
-* 调度模式（dispatch preset）里主控与子代理跑在同一进程、同一套工具注册面上，
-* 于是有两件事会悄悄坏掉：
-*
-* 1. **子代理越权调用主控专用工具**。`ask_user_question`、`exit_plan_mode`、
-*    `create_goal` 这些是**主控的**决定口：让子代理自己问用户、自己进/出计划模式、
-*    自己建目标，都会把「一个决定」拆成两个决定——子代理问完，用户答了，主控却
-*    不知道问过什么。子代理本来就该把未决问题**带回**主控，而不是自己去问。
-* 2. **等待子代理期间空等**。子代理还在跑的时候，主控用 `sleep` 空转，既烧 token
-*    又错过通知到达的那一刻。正确做法是**结束这一轮**，让内置的子代理完成通知把
-*    它叫醒（R-W）。
-*
-* ## 零 Kimi Code 缓存漂移
-*
-* 守卫**只**用 `ctx.tools.guard(exec => …)` 这一条执行期接缝：
-*
-* - 不包 `tools.definitions`，不包 `tools.register`，不听
-*   `system-prompt/assemble`——工具声明面（`tools:sdk` 段与顶层工具 schema）
-*   保持逐字节恒定，Kimi Code 的前缀缓存不会因为这个守卫重建一次。
-* - 拦截发生在**调用执行时**，模型看到的工具表完全没变，所以「看得见」与
-*   「叫得动」仍然被拆开：工具照常出现在表里，只是越界的调用被拒。
-*
-* ## 判定从哪来
-*
-* 两条判定都走**结构探测**，不 import 任何 harness 代次专属的类型：
-*
-* - 「你是不是子代理」：先看**持久会话血缘**（`session.header.origin ===
-*   'subagent'`），再看宿主活着的**存活根**（`agents.roots()`）。两条都是
-*   读得着的既有事实，不新增任何状态。
-* - 「你还有没有在跑的子代理」：依次问 `subagents.list` 与 `agents.list`，
-*   看有没有 `status === 'running'` 的直接子代。
-*
-* @module @eddyskywalker/dsh-chatgpt-subscription/host/dispatch-execution-guard
-*/
-/**
-* 子代理**不得**直接调用的主控专用工具。
-*
-* 这七个都是「决定口」或「交付口」，不是「干活口」：
-*
-* - `ask_user_question` / `exit_plan_mode` / `enter_plan_mode` /
-*   `leave_plan_mode`：计划与提问的决定权在主控；
-* - `create_goal` / `update_goal`：目标由主控持有；
-* - `present`：交付口由主控掌握。
-*
-* 子代理遇到需要决定的地方，正确动作是**把问题带回主控**，让主控去调这些工具。
-*/
-const DEFAULT_DELEGATED_BLOCKED_TOOLS = Object.freeze([
-	"ask_user_question",
-	"exit_plan_mode",
-	"enter_plan_mode",
-	"leave_plan_mode",
-	"create_goal",
-	"update_goal",
-	"present"
-]);
-/**
-* 承载「等待」语义的 shell 工具。
-*
-* 这三个是本包与宿主都会用到的 shell 入口：它们的 `command` 参数里可能藏着
-* `sleep`。空等只在**确实有在跑的子代理**时才是问题（有子代理时应当结束这一
-* 轮等通知），没有子代理时 `sleep 1` 只是普通命令，不该拦。
-*/
-const DEFAULT_SHELL_TOOLS = Object.freeze([
-	"bash",
-	"pwsh",
-	"win_bash"
-]);
-/** 一次执行里被判定为「纯等待」的命令形态。 */
-const SLEEP_COMMAND_PATTERN = /^(?:sleep\s+\d+(?:\.\d+)?[smhd]?|Start-Sleep\s+(?:-(?:Seconds|Milliseconds|s|m)\s+)?\d+(?:\.\d+)?|timeout(?:\.exe)?\s+(?:\/t\s+)?\d+(?:\s+\/nobreak)?|ping(?:\.exe)?\s+-(?:n|c)\s+\d+\s+(?:127\.0\.0\.1|localhost)(?:\s+>|\s*$).*)$/i;
-/** 无害的空转语句（回显、真、冒号）。 */
-const NOOP_COMMAND_PATTERN = /^(?:echo\b.*|Write-Host\b.*|Write-Output\b.*|true|:)$/;
-/** 注释行。 */
-const COMMENT_COMMAND_PATTERN = /^#/;
-/**
-* 读宿主上下文上「直接注入」的 running-child 判定回调。
-*
-* 这一步必须**try/catch**：真实 Cordis 的上下文代理对任何没有 inject 的属性直读
-* 都当场抛 `cannot get property "..." without inject`，一次读失败不该让守卫在
-* 每次工具调用上抛错。
-*
-* @param ctx - 宿主上下文。
-* @returns 注入的回调；没有时为 undefined。
-*/
-function injectedHasRunningChildren(ctx) {
-	if (!isRecord$11(ctx)) return void 0;
-	let injected;
-	try {
-		injected = ctx["hasRunningChildren"];
-	} catch {
-		return;
-	}
-	return typeof injected === "function" ? injected : void 0;
-}
-/**
-* 判断一个值是不是可读的记录对象。
-*
-* @param value - 候选值。
-* @returns 是记录对象时为 true。
-*/
-function isRecord$11(value) {
-	return typeof value === "object" && value !== null;
-}
-/**
-* 从宿主上下文里读一个**可选**服务。
-*
-* 一律走 `ctx.get()`：没写进 `inject` 的服务名不能当属性读，真实 Cordis 会当场
-* 抛 `cannot get property "..." without inject`，整个插件降级。读不到就是读不到，
-* 守卫据此放行，绝不因此让插件挂不上。
-*
-* @param ctx - 宿主上下文。
-* @param name - 服务名。
-* @returns 服务实例；不存在或读取抛错时为 undefined。
-*/
-function readService(ctx, name) {
-	const reader = ctx?.get;
-	if (typeof reader !== "function") return void 0;
-	try {
-		return reader.call(ctx, name);
-	} catch {
-		return;
-	}
-}
-/**
-* 读一个宿主上下文里的工具注册面。
-*
-* @param ctx - 宿主上下文。
-* @returns 带 `guard` 接缝的注册面；没有时为 undefined。
-*/
-function toolsOf$2(ctx) {
-	if (!isRecord$11(ctx)) return void 0;
-	let tools;
-	try {
-		tools = ctx["tools"];
-	} catch {
-		tools = void 0;
-	}
-	if (!isRecord$11(tools)) tools = readService(ctx, "tools");
-	return isRecord$11(tools) ? tools : void 0;
-}
-/**
-* 读一条记录的 `id`。
-*
-* @param value - 候选记录。
-* @returns id 字符串；没有时为 undefined。
-*/
-function idOf(value) {
-	if (!isRecord$11(value)) return void 0;
-	const id = value["id"];
-	return typeof id === "string" ? id : void 0;
-}
-/**
-* 读一条会话记录头里的 `id`。
-*
-* @param agent - 候选 agent。
-* @returns 会话 id；没有时为 undefined。
-*/
-function sessionIdOf$1(agent) {
-	if (!isRecord$11(agent)) return void 0;
-	const session = agent["session"];
-	if (!isRecord$11(session)) return void 0;
-	const header = session["header"];
-	return idOf(header);
-}
-/**
-* 这个调用方是不是**子代理**。
-*
-* 判定分两级，先看能独立成立的持久事实，再看宿主当前活着的存活根：
-*
-* 1. **持久会话血缘**：`session.header.origin === 'subagent'`。这是子代理会话
-*    创建时就写下的血缘，跨宿主代次都在，不依赖任何服务是否挂载。
-* 2. **存活根判定**：宿主提供 `agents.roots()` 时，一个**不在**存活根集合里的
-*    agent 就是别人的孩子。先核对**存活**（`agents.get(id) === agent`）：不是
-*    那个 id 当前登记的存活 agent，说明这个调用方已经过期或已被顶替——判它是不是
-*    子代理没有意义，放行。
-*
-* 宿主没有 `agents` 服务（或老代没有 `roots`）时，判不了就**放行**：把一个
-* 读不出来的身份当成子代理去拦，会拦掉主控自己的正常调用。
-*
-* @param agent - 调用方 agent。
-* @param ctx - 宿主上下文（可选；用于读 `agents` 服务）。
-* @returns 是子代理时为 true。
-*/
-function isDelegatedCaller(agent, ctx) {
-	if (!isRecord$11(agent)) return false;
-	const session = agent["session"];
-	if (isRecord$11(session)) {
-		const header = session["header"];
-		if (isRecord$11(header) && header["origin"] === "subagent") return true;
-	}
-	const agents = readService(ctx, "agents");
-	if (!isRecord$11(agents)) return false;
-	const roots = rootsOf(agents);
-	if (roots === void 0) return false;
-	const id = idOf(agent);
-	if (typeof id === "string" && typeof agents["get"] === "function") {
-		let live;
-		try {
-			live = agents["get"].call(agents, id);
-		} catch {
-			live = void 0;
-		}
-		if (live !== agent) return false;
-	}
-	return !roots.includes(agent);
-}
-/**
-* 读宿主存活根集合。
-*
-* @param agents - `agents` 服务。
-* @returns 存活根数组；服务没有 `roots` 或读取抛错时为 undefined。
-*/
-function rootsOf(agents) {
-	const roots = agents["roots"];
-	if (typeof roots !== "function") return void 0;
-	try {
-		const listed = roots.call(agents);
-		return Array.isArray(listed) ? listed : void 0;
-	} catch {
-		return;
-	}
-}
-/**
-* 判断一条命令是不是**纯等待**。
-*
-* 判据：整条命令**按分隔符切开后**，至少有一条是 sleep/wait，而**每一条**都是
-* sleep/wait 或者无害的空转（回显、真、冒号、注释）。只要有一条在做真事
-* （`sleep 1 && npm test`、`git status`、`node …`），整条命令就不是纯等待——
-* 这类命令**必须放行**，否则守卫会拦掉正当的后台工作。
-*
-* @param command - 候选命令。
-* @returns 是纯等待时为 true。
-*/
-function isPureSleepCommand(command) {
-	if (typeof command !== "string") return false;
-	const trimmed = command.trim();
-	if (trimmed.length === 0) return false;
-	const statements = trimmed.split(/;|&&|\n/).map((statement) => statement.trim()).filter((statement) => statement.length > 0);
-	if (statements.length === 0) return false;
-	let sawWait = false;
-	for (const statement of statements) {
-		if (SLEEP_COMMAND_PATTERN.test(statement)) {
-			sawWait = true;
-			continue;
-		}
-		if (!isNoopStatement(statement)) return false;
-	}
-	return sawWait;
-}
-/**
-* 判断一条语句是不是无害的空转。
-*
-* @param statement - 候选语句。
-* @returns 是空转时为 true。
-*/
-function isNoopStatement(statement) {
-	return NOOP_COMMAND_PATTERN.test(statement) || COMMENT_COMMAND_PATTERN.test(statement);
-}
-/**
-* 这个调用方当前**还有没有在跑的子代理**。
-*
-* 两条宿主探测，任何一条给出答案就算数：
-*
-* 1. `subagents.list(agent, 'children')`（老代退化成 `subagents.list(agent)`）：
-*    直接子代里有没有 `status === 'running'` 的。
-* 2. `agents.list()`：活着且 `status === 'running'`、并且 `parent` 就是这个
-*    调用方的那些 agent。
-*
-* 宿主提供 `hasRunningChildren` 回调时以它为准（直接注入口，见
-* {@link DispatchExecutionGuardOptions.hasRunningChildren}）。
-*
-* @param agent - 调用方 agent。
-* @param ctx - 宿主上下文（可选；用于读 `subagents` / `agents` 服务）。
-* @returns 有在跑的子代理时为 true。
-*/
-function hasRunningChildSubagent(agent, ctx) {
-	if (!isRecord$11(agent)) return false;
-	const injected = injectedHasRunningChildren(ctx);
-	if (injected !== void 0) try {
-		return injected(agent) === true;
-	} catch {
-		return false;
-	}
-	const subagents = readService(ctx, "subagents");
-	if (isRecord$11(subagents) && typeof subagents["list"] === "function") {
-		if (entriesOf(callList(subagents["list"], subagents, agent)).some((entry) => entry["status"] === "running")) return true;
-	}
-	const agents = readService(ctx, "agents");
-	if (isRecord$11(agents) && typeof agents["list"] === "function") {
-		const listed = callList(agents["list"], agents, agent, false);
-		const parentIds = /* @__PURE__ */ new Set();
-		const ownId = idOf(agent);
-		if (ownId !== void 0) parentIds.add(ownId);
-		const headerId = sessionIdOf$1(agent);
-		if (headerId !== void 0) parentIds.add(headerId);
-		if (entriesOf(listed).some((entry) => entry["status"] === "running" && typeof entry["parent"] === "string" && parentIds.has(entry["parent"]))) return true;
-	}
-	return false;
-}
-/**
-* 调用一个「列出子代」的宿主方法。
-*
-* 先试带 scope 的形态（`list(agent, 'children')`），老代只认 `list(agent)`，
-* 再老一代的 `agents.list()` 不接参数——三种都试，谁先成功用谁。
-*
-* @param fn - 宿主方法。
-* @param self - 调用宿主。
-* @param agent - 调用方 agent。
-* @param scoped - 是否先试带 scope 的形态。
-* @returns 宿主返回值；全部失败时为 undefined。
-*/
-function callList(fn, self, agent, scoped = true) {
-	if (typeof fn !== "function") return void 0;
-	const call = fn;
-	const attempts = scoped ? [
-		[agent, "children"],
-		[agent],
-		[]
-	] : [
-		[],
-		[agent],
-		[agent, "children"]
-	];
-	for (const args of attempts) try {
-		const listed = call.apply(self, args);
-		if (listed !== void 0) return listed;
-	} catch {}
-}
-/**
-* 从宿主返回值里取出「条目数组」。
-*
-* 宿主可能直接给数组，也可能给一个包着数组的记录（`children` / `agents`）。
-*
-* @param listed - 宿主返回值。
-* @returns 条目数组；取不到时是空数组。
-*/
-function entriesOf(listed) {
-	if (Array.isArray(listed)) return listed.filter(isRecord$11);
-	if (!isRecord$11(listed)) return [];
-	const entries = [];
-	for (const key of [
-		"children",
-		"agents",
-		"entries",
-		"list"
-	]) {
-		const candidate = listed[key];
-		if (!Array.isArray(candidate)) continue;
-		for (const entry of candidate) if (isRecord$11(entry)) entries.push(entry);
-	}
-	return entries;
-}
-/**
-* 解析「调度执行守卫」当前是否启用。
-*
-* 沿 volatile 活引用取当前值，所以设置保存后立刻生效。缺省、非法值、读取抛错都
-* 按**开启**处理：守卫是保护，不是功能开关，读失败不该把保护关掉。
-*
-* @param config - 插件配置（活引用或普通值）。
-* @returns 是否启用。
-*/
-function resolveDispatchExecutionGuardEnabled(config) {
-	const field = config?.dispatchExecutionGuard;
-	if (field === void 0 || field === null) return true;
-	if (typeof field === "object" && typeof field.get === "function") try {
-		return field.get() !== false;
-	} catch {
-		return true;
-	}
-	return field !== false;
-}
-/**
-* 子代理越权调用时的拒绝文案。
-*
-* 文案要**可执行**：光说「不许调」模型只会换个花样再试一次，所以这里写清楚
-* 它该做什么——把未决问题带回主控，并带上报告状态。
-*
-* @param toolName - 被拦下的工具名。
-* @returns 拒绝理由。
-*/
-function delegatedDenial(toolName) {
-	return `DELEGATED_CALLER: "${toolName}" is a dispatch-level tool and a delegated subagent must not call it directly. Report back to the dispatcher instead: include status: "hand_back" or status: "blocked" and the unresolved question or decision in your report, and let the dispatcher act on it.`;
-}
-/**
-* 子代理还在跑时用 sleep 空等的拒绝文案。
-*
-* @returns 拒绝理由。
-*/
-function activeChildSleepDenial() {
-	return "ACTIVE_CHILD_SLEEP_FORBIDDEN: a child subagent is still running, so sleeping to wait for it is not allowed. End your turn now and let the built-in subagent completion notification wake you.";
-}
-/**
-* 装一台「调度执行守卫」。
-*
-* 只用 `ctx.tools.guard()` 这一条执行期接缝：工具声明面（`tools:sdk` 段与顶层
-* 工具 schema）一个字节都不改，Kimi Code 的前缀缓存不会因为这个守卫重建。
-*
-* @param ctx - 宿主上下文。
-* @param options - 守卫选项。
-* @returns 注销守卫的函数；宿主没有 `guard` 接缝时是一个空操作。
-*/
-function installDispatchExecutionGuard(ctx, options = {}) {
-	const tools = toolsOf$2(ctx);
-	const register = tools?.guard;
-	if (typeof register !== "function") return () => void 0;
-	const enabled = options.enabled ?? (() => true);
-	const delegatedBlocked = new Set(DEFAULT_DELEGATED_BLOCKED_TOOLS);
-	const shellTools = new Set(DEFAULT_SHELL_TOOLS);
-	const hasRunningChildren = options.hasRunningChildren;
-	const guard = (execution) => {
-		if (!isEnabled(enabled)) return void 0;
-		const toolName = typeof execution?.name === "string" ? execution.name : void 0;
-		if (toolName === void 0) return void 0;
-		const agent = execution?.agent;
-		if (delegatedBlocked.has(toolName) && isDelegatedCaller(agent, ctx)) return delegatedDenial(toolName);
-		if (shellTools.has(toolName)) {
-			const args = isRecord$11(execution?.arguments) ? execution.arguments : void 0;
-			if (!(args?.["run_in_background"] === true) && isPureSleepCommand(args?.["command"])) {
-				if (hasRunningChildren !== void 0 ? hasRunningChildren(agent) === true : hasRunningChildSubagent(agent, ctx)) return activeChildSleepDenial();
-			}
-		}
-	};
-	const dispose = register.call(tools, guard);
-	return typeof dispose === "function" ? dispose : () => void 0;
-}
-/**
-* 读一次开关。读失败按**开启**处理：保护不该因为一次读失败而失效。
-*
-* @param enabled - 开关读取函数。
-* @returns 是否启用。
-*/
-function isEnabled(enabled) {
-	try {
-		return enabled() !== false;
-	} catch {
-		return true;
-	}
-}
 const ID_SCHEMA = z.string().min(1).max(64).regex(/^[A-Za-z0-9._:-]+$/);
 const TASK_REFERENCE_SCHEMA = z.string().min(1).max(160);
 const BOUNDARY_SCHEMA = z.string().min(1).max(120);
@@ -92883,23 +93177,16 @@ const DISPATCH_PRESET = {
 			name: "@deepseek-ai/dsh-persona",
 			config: {
 				suffix: "Your working directory is {{cwd}}.",
-				prefix: `[Role Identification] If your first user message is a task brief (rather than a direct request from the human user), you are a subagent: the coordinator-facing rules in R0, R0.5, R-G, R1, R2, R4, R5, and R-W do not apply to you. You are the executor—plan, execute, and self-verify strictly within your task boundary, and report concrete evidence back to the dispatcher; R3 remains in effect.
+				prefix: `[Role Identification] If your first user message is a task brief (rather than a direct request from the human user), you are a subagent: the coordinator-facing rules in R0, R-G, R1, R2, R4, R5, and R-W do not apply to you. You are the executor—plan, execute, and self-verify strictly within your task boundary, and report concrete evidence back to the dispatcher; R3 remains in effect.
 - [Standing Subagent Contract] Unless overridden by the brief, every subagent inherits these standing limits: retry attempts at most 3 total per brief; file edits bounded strictly to the declared Boundary module or files; read, search, verification, and test commands unlimited within that boundary; no per-cycle banking (all limits are single-run task totals, and unused allowance is not banked).
 - [Subagent Report Protocol] Every subagent completion report states status: ready | hand_back | blocked | failed | dropped, a summary, and evidence (diffs, test commands and outputs, before/after captures for UI). A status: hand_back report adds a one-sentence hand_back_reason naming the out-of-boundary file/interface or broken premise, and mutates no file outside Boundary.
 - [Coordinator-Only Tools] ask_user_question, enter_plan_mode, leave_plan_mode, exit_plan_mode, create_goal, update_goal, and present are coordinator-only: a subagent call is hard-blocked at execution time (DELEGATED_CALLER), while declarations remain visible to preserve the provider’s content-prefix cache. Never call them as a subagent; escalate via status: hand_back or status: blocked. The bridge’s enforcement is generation-graded (see R9), so never rely on the rejection.
 - [Dispatch Ledger] Call dispatch_ledger {action:"self"} once before your first delegation — it prints the v2 mandate protocol at the tail of its result — and follow that protocol verbatim for every dispatch, report, and steer.
 
 [Coordinator Identity] You are the Lead & Dispatch Agent: converge requirements, plan architecture, select R1 topology (Lead-Core / Hybrid / Fan-out), orchestrate subagents where ROI is positive, and own final acceptance.
-[Execution Pipeline] R0.5 Gate -> R0 Triage -> (L2) R-G Interview -> R9 Plan -> R1 Topology -> (if delegating: R2 Routing -> R5 Brief -> R-W Wait) -> R6 Acceptance.
+[Execution Pipeline] R0 Triage -> (L2) R-G Interview -> R9 Plan -> R1 Topology -> (if delegating: R2 Routing -> R5 Brief -> R-W Wait) -> R6 Acceptance.
 
-## R0.5 · Compatibility Gate (Once per New Session, Before R0)
-A legacy Agent Teams runtime (pre-#7519) registers spawn_teammate and replaces send_message / list_agents / interrupt_agent with team-scoped variants, leaving spawned subagents unreachable. The current runtime only adds a shared task board (team_task_create and its list/get/update siblings) and reuses this mode's tools.
-Criterion: whether spawn_teammate exists (check via code_run). Never gate on wait_agent, send_message, list_agents, or interrupt_agent: this mode mounts those itself.
-- Absent -> Write "Orchestration ready: subagent" and proceed to R0. The board tools stay declared whether or not the board is on - frozen declaration, not availability - so confirm with team_task_list before relying on it. When the board is on it is bookkeeping, not a second dispatcher: the dispatch ledger stays the dispatch authority and R5 briefs stay the task contract; publish cross-agent dependencies (blocked_by) and write scopes on one team task per brief, claimed and completed by the child that owns it; never start work because a task is ready, and never reassign a task to skip R6.
-- Present -> This session runs the legacy runtime and is **not orchestratable**. In order, and nothing else:
-  1. State in one sentence that the legacy runtime shadows the coordination tools and this mode has no degraded path.
-  2. Call ask_user_question once (see R-W) offering: disable the legacy runtime, restart Host, **start a new session**; switch preset; or execute this task directly.
-  3. **Do nothing else** until the user replies: no triage, plan, dispatch, file edits, or workarounds.
+[Agent Teams Board] A current harness adds exactly one Agent Teams surface beside this mode: the shared task board (team_task_create and its list/get/update siblings). It is bookkeeping, not a second dispatcher. The board tools stay declared whether or not the board is on - frozen declaration, not availability - so confirm with team_task_list before relying on it. When it is on, the dispatch ledger stays the dispatch authority and R5 briefs stay the task contract; publish cross-agent dependencies (blocked_by) and write scopes on one team task per brief, claimed and completed by the child that owns it; never start work because a task is ready, and never reassign a task to skip R6.
 
 ## R0 · Complexity Triage (Triage First, Then Choose the Workflow)
 Upon receiving a task, determine its tier by semantic impact and uncertainty first, write one line stating "Tier + Rationale", and run the matching workflow:
@@ -92970,7 +93257,7 @@ Fallback is a task-scoped, non-session-wide exception for delegated briefs: it c
 
 ## Anti-Patterns (Any Occurrence Is a Violation)
 1. Orchestrating or opening Plan Mode for an L0/L1 task, or before the R-G interview has converged (21. Entering Plan Mode for an L0/L1 task, or before the R-G interview has converged; 22. Using leave_plan_mode to bypass exit_plan_mode approval).
-2. Switching to teammate vocabulary to keep orchestrating under the legacy team runtime, or Treating the team task board as a substitute for R1 topology, R2 routing, R5 briefs, R6 acceptance, or R-W waiting (R0.5).
+2. Switching to teammate vocabulary to keep orchestrating, or Treating the team task board as a substitute for R1 topology, R2 routing, R5 briefs, R6 acceptance, or R-W waiting (R1, R6).
 3. Omitting provider/model under [State: Listed], Second-guessing list_subagent_models output by hunting through local config or source files just to check which subagent models are allowed, or Reporting a route as "authorized", or claiming per-task routing is in force, when the session recorded no allowlist (R2).
 4. Writing a task brief with a range where a cap belongs ("2–5 files", "a few attempts"), or Asking a subagent to restate its rules as a correctness check (R0, R5).
 5. Running sleep, polling loops, or placeholder long commands to wait, Proactively creating a goal at the start of a task, or Ending with a paragraph of prose to wait for user sign-off instead of calling ask_user_question (R-W).
@@ -99769,6 +100056,23 @@ function applyToolDelta(entry, state) {
 	const fn = isRecord$3(entry.function) ? entry.function : {};
 	const out = [];
 	let call = state.toolCalls.get(wireIndex);
+	const incomingId = asString$1(entry.id);
+	if (call !== void 0 && incomingId !== void 0 && call.id !== `call_${wireIndex}` && incomingId !== call.id) {
+		const closedBlock = {
+			type: "tool-call",
+			id: toToolCallId(call.id),
+			name: call.name,
+			arguments: call.arguments === "" ? "{}" : call.arguments
+		};
+		state.blocks[call.blockIndex] = closedBlock;
+		out.push({
+			type: "block-end",
+			index: call.blockIndex,
+			block: closedBlock
+		});
+		state.toolCalls.delete(wireIndex);
+		call = void 0;
+	}
 	if (call === void 0) {
 		out.push(...closeCurrent(state));
 		call = {
@@ -100138,6 +100442,30 @@ function messagesAssistantContent(message) {
 	return blocks;
 }
 /**
+* Merge neighbouring same-role turns.
+*
+* DSH history can hold two user messages in a row (an injected context notice
+* followed by the real turn) and a tool result is itself a user-role message;
+* the Messages wire wants one user turn, so consecutive turns of one role are
+* folded together in order.
+*/
+function mergeAnthropicMessages(entries) {
+	const merged = [];
+	for (const entry of entries) {
+		if (entry.content.length === 0) continue;
+		const last = merged[merged.length - 1];
+		if (last !== void 0 && last.role === entry.role) {
+			last.content = [...last.content, ...entry.content];
+			continue;
+		}
+		merged.push({
+			role: entry.role,
+			content: [...entry.content]
+		});
+	}
+	return merged;
+}
+/**
 * Build one `/v1/messages` body.
 *
 * `stream: true` is mandatory: the adapter reads every response as SSE, and a
@@ -100155,13 +100483,12 @@ function buildMessagesRequest(options, request = {}) {
 		const role = isToolResultMessage(message) || message.role !== "assistant" ? "user" : "assistant";
 		const content = role === "user" ? messagesUserContent(message, images) : messagesAssistantContent(message);
 		if (content.length === 0) continue;
-		const previous = entries[entries.length - 1];
-		if (previous !== void 0 && previous.role === role) previous.content.push(...content);
-		else entries.push({
+		entries.push({
 			role,
 			content
 		});
 	}
+	const messages = cleanOrphanedToolCalls(mergeAnthropicMessages(entries), mergeAnthropicMessages);
 	const system = leadingSystemTextRaw(options);
 	const tools = options.tools ?? [];
 	const effort = request.effort !== void 0 && (request.efforts ?? []).length > 0 ? request.effort : void 0;
@@ -100170,7 +100497,7 @@ function buildMessagesRequest(options, request = {}) {
 		model: options.model,
 		max_tokens: maxTokens,
 		stream: true,
-		messages: entries,
+		messages,
 		...system === void 0 ? {} : { system },
 		...tools.length > 0 ? { tools: tools.map((tool) => ({
 			name: tool.name,
@@ -103920,6 +104247,10 @@ function apply(ctx, pluginConfig = {}) {
 		const guard = installPtcSdkCacheGuard(ctx);
 		return () => guard.dispose();
 	}, "dsh-chatgpt-subscription: PTC SDK cache guard");
+	ctx.effect(() => {
+		const guard = installSettledJobGuard(ctx);
+		return () => guard.dispose();
+	}, "dsh-chatgpt-subscription: settled job guard");
 	ctx.effect(() => {
 		const guard = installTeamPolicyCacheGuard(ctx, { enabled: () => resolveTeamPolicyCacheGuardEnabled(pluginConfig) });
 		return () => guard.dispose();