@mars-sea/dsh-commandcode-provider 0.10.0 → 0.10.2

package/lib/index.js

@@ -173,12 +173,18 @@ var CommandCodeAccountPool = class {
 		if (accounts.length === 0) return;
 		const routed = selectAccountForModel(accounts, options?.model ?? "", this.deps.modelAccountRules?.());
 		if (routed !== void 0) return this.pick(routed);
-		const chosen = selectActiveAccount(accounts, this.deps.preferredId?.());
+		const preferred = this.deps.preferredId?.();
+		const chosen = selectActiveAccount(accounts, preferred);
 		if (chosen !== void 0) return this.pick(chosen);
 		await Promise.all(accounts.map(async (account) => {
 			if (account.state?.kind === "disabled") return;
 			if (options?.exclude !== void 0 && account.key === options.exclude) return;
-			const probe = await this.deps.probeWindow(account.key);
+			let probe;
+			try {
+				probe = await this.deps.probeWindow(account.key);
+			} catch {
+				return;
+			}
 			if (probe === void 0) return;
 			if (!probe.exceeded) this.states.delete(account.key);
 			else this.states.set(account.key, {
@@ -187,9 +193,9 @@ var CommandCodeAccountPool = class {
 				until: probe.resetAt
 			});
 		}));
-		const revived = selectActiveAccount(await this.resolvedAccounts(), this.deps.preferredId?.());
-		if (revived !== void 0) return this.pick(revived);
 		const latest = await this.resolvedAccounts();
+		const revived = selectActiveAccount(latest, preferred);
+		if (revived !== void 0) return this.pick(revived);
 		if (latest.filter((account) => account.state?.kind === "disabled").length === latest.length) throw new LlmError(`llm-commandcode: every configured Command Code account (${latest.length}) was rejected with 401 — check the stored API keys (Models page / settings) or the auth file；已配置的 ${latest.length} 个 Command Code 账户密钥均被拒绝（401）——请在设置页检查存储的 API 密钥，或重新运行 command-code login`, "INVALID_CREDENTIAL");
 		const resets = latest.map((account) => account.state).filter((state) => state !== void 0 && state.kind === "cooldown" && state.until > 0).map((state) => state.until);
 		const earliest = resets.length > 0 ? Math.min(...resets) : 0;
@@ -464,13 +470,21 @@ const KNOWN_EFFORTS = {
 		"low",
 		"medium",
 		"high",
-		"xhigh"
+		"xhigh",
+		"max"
 	],
 	"meta/muse-spark-1.3-contributor": [
 		"low",
 		"medium",
 		"high",
 		"xhigh"
+	],
+	"gpt-6-astra": [
+		"low",
+		"medium",
+		"high",
+		"xhigh",
+		"max"
 	]
 };
 /**
@@ -519,12 +533,12 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"gpt-5.6-luna",
 	"gpt-5.6-sol",
 	"gpt-5.6-terra",
+	"gpt-6-astra",
 	"meta/muse-spark-1.1",
 	"meta/muse-spark-1.2",
 	"meta/muse-spark-1.2-contributor",
 	"meta/muse-spark-1.3",
 	"meta/muse-spark-1.3-contributor",
-	"minimax/minimax-m3-free",
 	"moonshotai/Kimi-K2.5",
 	"moonshotai/Kimi-K2.6",
 	"moonshotai/Kimi-K2.7-Code",
@@ -540,7 +554,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"z-ai/glm-5.3-flash"
 ]);
 /**
-* Models the official CLI's model table (command-code@1.46.0) marks
+* Models the official CLI's model table (command-code@1.50.0) marks
 * `reasoning:!0` but defines no selectable `reasoning_effort` levels — they
 * think automatically, with Command Code driving the depth. This is the
 * authoritative "thinks, effort not adjustable" set: `KNOWN_EFFORTS` (which
@@ -548,7 +562,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 * effort levels, and this snapshot is not surfaced in the picker's compact
 * description — it exists for programmatic consumers.
 *
-* Source: the command-code@1.46.0 bundled model table (dist/cli.mjs),
+* Source: the command-code@1.50.0 bundled model table (dist/cli.mjs),
 * cross-checked with https://commandcode.ai/docs/reference/cli/models.
 * (`stealth/ox-alpha` left this set in command-code@1.32.1, which gave it
 * selectable `['low', 'high', 'max']` efforts; the preview then ended in
@@ -571,7 +585,6 @@ const KNOWN_THINKING_MODELS = /* @__PURE__ */ new Set([
 	"Qwen/Qwen3.7-Flash",
 	"Qwen/Qwen3.7-Max",
 	"Qwen/Qwen3.7-Plus",
-	"minimax/minimax-m3-free",
 	"moonshotai/Kimi-K2.7-Code",
 	"moonshotai/Kimi-K2.7-Code-Highspeed",
 	"stepfun/Step-3.5-Flash",
@@ -624,12 +637,9 @@ const KNOWN_PLANS = {
 	"deepseek/deepseek-v4-flash-vision-exp": "go",
 	"deepseek/deepseek-v4-pro": "go",
 	"gpt-5.6-luna": "go",
-	"inclusionai/ling-3.0-flash-free": "go",
 	"meituan/LongCat-2.0:free": "go",
 	"meta/muse-spark-1.2-contributor": "go",
 	"meta/muse-spark-1.3-contributor": "go",
-	"minimax/minimax-m2.7-free": "go",
-	"minimax/minimax-m3-free": "go",
 	"moonshotai/Kimi-K2.5": "go",
 	"moonshotai/Kimi-K2.6": "go",
 	"moonshotai/Kimi-K2.7-Code": "go",
@@ -639,7 +649,6 @@ const KNOWN_PLANS = {
 	"poolside/laguna-s-2.1-free": "go",
 	"stepfun/Step-3.5-Flash": "go",
 	"stepfun/Step-3.7-Flash": "go",
-	"tencent/Hy3": "go",
 	"tencent/hy3-paid": "go",
 	"tencent/hy4-preview": "go",
 	"thinkingmachines/inkling": "go",
@@ -677,6 +686,7 @@ const KNOWN_PLANS = {
 	"claude-opus-4-7": "provider",
 	"claude-opus-4-8": "provider",
 	"claude-opus-5": "provider",
+	"gpt-6-astra": "provider",
 	"sakana/fugu-ultra": "provider"
 };
 /** Official display labels for each plan tier. */
@@ -724,8 +734,8 @@ function compareByPlan(a, b) {
 }
 /**
 * Subscription plan table, synced from the official CLI bundle's plan maps
-* (`Nn`/`$n` in command-code@1.31.0 `dist/cli.mjs`, re-verified unchanged
-* against 1.32.2 where they appear as `Zn`/`er`): subscription `planId`
+* (located by the `"individual-go"` key in command-code@1.50.0 `dist/cli.mjs`,
+* re-verified unchanged through 1.50.0): subscription `planId`
 * prefix → display name and the plan's monthly credit total. This is the
 * account's own subscription (from `/alpha/billing/subscriptions`) — distinct
 * from {@link KNOWN_PLANS}, which maps catalog models to their minimum tier.
@@ -793,13 +803,14 @@ function subscriptionPlanInfo(planId) {
 /**
 * Whether the picker lists `modelId` for an account with the given billing
 * access. Fails open at every uncertainty: no billing data, an unknown plan,
-* or a model outside {@link KNOWN_PLANS} all keep the model visible — the
-* server remains the final gate (`403 MODEL_NOT_IN_PLAN`).
+* a non-finite weight (corrupt billing fact), or a model outside
+* {@link KNOWN_PLANS} all keep the model visible — the server remains the
+* final gate (`403 MODEL_NOT_IN_PLAN`).
 */
 function modelVisibleInPlan(modelId, access) {
 	if (access === void 0) return true;
 	if (access.onDemandCredits > 0) return true;
-	if (access.tierWeight === void 0) return true;
+	if (access.tierWeight === void 0 || !Number.isFinite(access.tierWeight)) return true;
 	const tier = KNOWN_PLANS[modelId];
 	if (tier === void 0) return true;
 	const weight = PLAN_ORDER[tier];
@@ -893,8 +904,8 @@ function dealLabel(modelId, now = Date.now()) {
 }
 /**
 * Compact human-readable context window, e.g. `1_000_000 -> "1M"`,
-* `256_000 -> "256K"`, `262_144 -> "256K"` (floor to the nearest K).
-* Returns undefined for unknown/absent sizes.
+* `256_000 -> "256K"`, `262_144 -> "262K"` (floor to the nearest K).
+* Returns undefined for unknown/absent sizes; values under 1K render raw.
 */
 function formatContext(contextWindow) {
 	if (contextWindow === void 0 || !Number.isFinite(contextWindow) || contextWindow <= 0) return;
@@ -903,6 +914,7 @@ function formatContext(contextWindow) {
 		const rounded = Math.round(m * 10) / 10;
 		return `${Number.isInteger(rounded) ? rounded : rounded.toFixed(1)}M`;
 	}
+	if (contextWindow < 1e3) return String(Math.floor(contextWindow));
 	return `${Math.floor(contextWindow / 1e3)}K`;
 }
 /**
@@ -935,7 +947,7 @@ function capabilityDescription(modelId, contextWindow, now = Date.now()) {
 * and API key or subscription, and Command Code's terms apply.
 *
 * Wire protocol (reverse-engineered by the pi plugin, command-code@1.28.4;
-* re-verified against command-code@1.44.0 — endpoints, request shape, and
+* re-verified against command-code@1.50.0 — endpoints, request shape, and
 * stream events unchanged):
 *   POST {apiBase}/alpha/generate
 *   body: { config, memory, taste, skills, params: { model, messages, tools,
@@ -948,13 +960,17 @@ function capabilityDescription(modelId, contextWindow, now = Date.now()) {
 * per-request options thunk and an API-key resolver from the plugin entry
 * (src/index.ts), so a settings change reaches the very next request.
 */
-const COMMAND_CODE_CLI_VERSION = "1.47.0";
+const COMMAND_CODE_CLI_VERSION = "1.50.0";
 const DEFAULT_API_BASE = "https://api.commandcode.ai";
 const DEFAULT_GENERATE_MAX_TOKENS = 64e3;
 const DEFAULT_MAX_OUTPUT_TOKENS = 65536;
 const MODELS_TIMEOUT_MS = 1e4;
 /** How long the picker's plan-filter billing facts stay cached before refetching. */
 const BILLING_ACCESS_TTL_MS = 3e5;
+/** The entry-plan tier weight (`individual-go` in KNOWN_SUBSCRIPTION_PLANS). */
+const GO_TIER_WEIGHT = 0;
+/** Hard cap on account rotations within one request (one attempt per distinct key). */
+const MAX_ACCOUNT_ROTATIONS = 16;
 /**
 * Subscription statuses the CLI treats as live (`Mr` in command-code's
 * cli.mjs): the plan gate applies only under one of these.
@@ -1109,6 +1125,40 @@ function pairedToolCalls(messages) {
 		names
 	};
 }
+/**
+* The Command Code gateway rejects tool call ids longer than 64 characters
+* (`input[N].call_id` must be `<= 64`, issue #23). Cross-provider histories
+* can carry longer ids — e.g. switching to Command Code mid-session after
+* another provider issued the call — so overlong paired ids are remapped to
+* short per-request aliases. Correlation only needs to hold within one
+* request (each call travels with its result in the same body), so a
+* sequential alias is enough: no durable state, no cross-request stability,
+* and the harness log keeps the original ids.
+*/
+const MAX_WIRE_TOOL_CALL_ID_LENGTH = 64;
+/**
+* Map each paired tool-call id to its wire id: ids within the gateway limit
+* pass through verbatim, overlong ids get a collision-free `cc-<n>` alias.
+* Callers must resolve BOTH the tool-call and its paired tool-result through
+* the returned map so the pair stays correlated.
+*/
+function wireToolCallIds(paired) {
+	const wire = /* @__PURE__ */ new Map();
+	const taken = /* @__PURE__ */ new Set();
+	for (const id of paired) if (id.length <= MAX_WIRE_TOOL_CALL_ID_LENGTH) {
+		wire.set(id, id);
+		taken.add(id);
+	}
+	let seq = 1;
+	for (const id of paired) {
+		if (wire.has(id)) continue;
+		let alias = `cc-${seq++}`;
+		while (taken.has(alias)) alias = `cc-${seq++}`;
+		wire.set(id, alias);
+		taken.add(alias);
+	}
+	return wire;
+}
 function blockText(block) {
 	return block.type === "text" || block.type === "reasoning" ? block.text : "";
 }
@@ -1139,6 +1189,7 @@ async function imageToCommandCode(ref, readImage) {
 async function messagesToCC(messages, readImage) {
 	const out = [];
 	const { ids: paired, names: toolNames } = pairedToolCalls(messages);
+	const wireIds = wireToolCallIds(paired);
 	for (const message of messages) {
 		if (message.role === "system") continue;
 		if (message.role === "user" && message.source.kind !== "tool") {
@@ -1167,7 +1218,7 @@ async function messagesToCC(messages, readImage) {
 			});
 			else if (block.type === "tool-call" && paired.has(block.id)) parts.push({
 				type: "tool-call",
-				toolCallId: block.id,
+				toolCallId: wireIds.get(block.id) ?? block.id,
 				toolName: block.name,
 				input: recordOrEmpty(block.arguments)
 			});
@@ -1184,7 +1235,7 @@ async function messagesToCC(messages, readImage) {
 				role: "tool",
 				content: [{
 					type: "tool-result",
-					toolCallId: block.toolCallId,
+					toolCallId: wireIds.get(block.toolCallId) ?? block.toolCallId,
 					toolName: toolNames.get(block.toolCallId) || "unknown",
 					output: block.isError ? {
 						type: "error-text",
@@ -1199,8 +1250,373 @@ async function messagesToCC(messages, readImage) {
 	}
 	return out;
 }
+/**
+* Convert one image reference to the OpenAI Chat Completions wire format:
+* `{ type: 'image_url', image_url: { url: 'data:...;base64,...' } }`.
+*/
+async function imageToOpenAI(ref, readImage) {
+	const data = await readImage(ref);
+	return {
+		type: "image_url",
+		image_url: { url: `data:${ref.mediaType};base64,${Buffer.from(data).toString("base64")}` }
+	};
+}
+/**
+* Convert harness messages to the OpenAI Chat Completions request shape.
+*
+* Unlike the Command Code CLI transport, this transport is the documented
+* Provider API surface. DeepSeek's thinking-mode contract requires historical
+* `reasoning_content` to be passed back whenever tools are in play, so this
+* converter intentionally DOES replay reasoning blocks as `reasoning_content`
+* on assistant messages. Only tool calls with a paired tool result are
+* replayed (same policy as the CLI path).
+*/
+async function messagesToOpenAI(messages, readImage) {
+	const out = [];
+	const { ids: paired } = pairedToolCalls(messages);
+	const wireIds = wireToolCallIds(paired);
+	for (const message of messages) {
+		if (message.role === "system") continue;
+		if (message.role === "user" && message.source.kind !== "tool") {
+			const parts = [];
+			for (const block of message.content) {
+				if (block.type === "text") parts.push({
+					type: "text",
+					text: block.text
+				});
+				if (block.type === "image") {
+					if (!readImage) throw new LlmError("Image input requires the durable attachment service", "UNSUPPORTED_CONTENT");
+					parts.push(await imageToOpenAI(block.attachment, readImage));
+				}
+			}
+			if (parts.length === 0) continue;
+			if (!parts.some((part) => part.type === "image_url") && parts.length === 1) out.push({
+				role: "user",
+				content: parts[0].text
+			});
+			else out.push({
+				role: "user",
+				content: parts
+			});
+			continue;
+		}
+		if (message.role === "assistant") {
+			const text = message.content.filter((block) => block.type === "text").map((block) => block.text).join("");
+			const reasoning = message.content.filter((block) => block.type === "reasoning").map((block) => block.text).join("");
+			const toolCalls = message.content.filter((block) => block.type === "tool-call" && paired.has(block.id)).map((block) => ({
+				id: wireIds.get(block.id) ?? block.id,
+				type: "function",
+				function: {
+					name: block.name,
+					arguments: block.arguments
+				}
+			}));
+			if (text === "" && reasoning === "" && toolCalls.length === 0) continue;
+			const assistant = {
+				role: "assistant",
+				content: text === "" ? null : text
+			};
+			if (reasoning !== "") assistant.reasoning_content = reasoning;
+			if (toolCalls.length > 0) assistant.tool_calls = toolCalls;
+			out.push(assistant);
+			continue;
+		}
+		if (message.role === "user" && message.source.kind === "tool") {
+			const block = message.content[0];
+			if (!block || block.type !== "tool-result" || !paired.has(block.toolCallId)) continue;
+			out.push({
+				role: "tool",
+				tool_call_id: wireIds.get(block.toolCallId) ?? block.toolCallId,
+				content: toolResultText(block)
+			});
+		}
+	}
+	return out;
+}
 /** Account endpoints fetched by one `getUsage()` run (see the classification there). */
 const USAGE_ENDPOINT_COUNT = 4;
+/**
+* Parse one usage/summary payload into the report's usage section.
+* Returns undefined when the endpoint answered nothing usable.
+*/
+function parseUsageTotals(usage) {
+	if (usage === void 0) return void 0;
+	return {
+		totalCount: numberValue(usage.totalCount) ?? 0,
+		totalCost: numberValue(usage.totalCost) ?? 0,
+		successRate: numberValue(usage.successRate) ?? 0,
+		completedCount: numberValue(usage.completedCount) ?? 0,
+		failedCount: numberValue(usage.failedCount) ?? 0,
+		totalTokensIn: numberValue(usage.totalTokensIn) ?? 0,
+		totalTokensOut: numberValue(usage.totalTokensOut) ?? 0,
+		totalCredits: numberValue(usage.totalCredits) ?? 0,
+		periodBasis: stringValue(usage.periodBasis) ?? "billing-period"
+	};
+}
+/** Parse one window-limit block (`fiveHour` / `weekly`). */
+function parseWindowLimit(value) {
+	const block = isRecord(value) ? value : void 0;
+	return {
+		used: numberValue(block?.used) ?? 0,
+		cap: numberValue(block?.cap) ?? 0,
+		exceeded: block?.exceeded === true,
+		resetAt: numberValue(block?.resetAt) ?? 0
+	};
+}
+/**
+* Parse one billing/credits payload into the report's credits section.
+* Returns undefined when the endpoint answered nothing usable.
+*/
+function parseCreditLimits(credits) {
+	if (credits === void 0) return void 0;
+	const creditsData = isRecord(credits.credits) ? credits.credits : void 0;
+	const windowLimits = isRecord(credits.windowLimits) ? credits.windowLimits : void 0;
+	const fiveHour = windowLimits !== void 0 && isRecord(windowLimits.fiveHour) ? windowLimits.fiveHour : void 0;
+	const weekly = windowLimits !== void 0 && isRecord(windowLimits.weekly) ? windowLimits.weekly : void 0;
+	if (creditsData === void 0 && fiveHour === void 0 && weekly === void 0) return void 0;
+	return {
+		monthlyCredits: numberValue(creditsData?.monthlyCredits) ?? 0,
+		purchasedCredits: numberValue(creditsData?.purchasedCredits) ?? 0,
+		freeCredits: numberValue(creditsData?.freeCredits) ?? 0,
+		fiveHour: parseWindowLimit(fiveHour),
+		weekly: parseWindowLimit(weekly)
+	};
+}
+/**
+* Parse the account identity from whoami plus the plan identity from the
+* subscriptions/credits payloads. Returns the org id for the subscriptions
+* query alongside, so getUsage fetches whoami first and the rest in parallel.
+*/
+function parseAccountIdentity(whoami) {
+	const whoamiData = whoami !== void 0 && isRecord(whoami.user) ? whoami.user : void 0;
+	const orgData = whoami !== void 0 && isRecord(whoami.org) ? whoami.org : void 0;
+	return {
+		account: whoamiData === void 0 ? void 0 : {
+			id: stringValue(whoamiData.id) ?? "",
+			name: stringValue(whoamiData.name) ?? "",
+			userName: stringValue(whoamiData.userName) ?? ""
+		},
+		orgId: orgData === void 0 ? void 0 : stringValue(orgData.id)
+	};
+}
+/**
+* Classify a TOTAL failure: when every endpoint failed with one class of
+* error, the degraded per-endpoint view would hide the root cause behind
+* a generic "partial data" note — name it instead.
+*/
+function classifyTotalFailure(failures, failedStatuses) {
+	if (failures.length !== USAGE_ENDPOINT_COUNT) return void 0;
+	const codes = failedStatuses.filter((status) => status !== void 0);
+	if (codes.length === USAGE_ENDPOINT_COUNT && codes.every((code) => code === 401)) return "invalid-key";
+	if (codes.length === USAGE_ENDPOINT_COUNT && codes.every((code) => code >= 500)) return "service-unavailable";
+	if (codes.length === 0) return "network";
+}
+/** Build the legacy CLI (`/alpha/generate`) request body for one call. */
+async function buildCliBody(options, connection, facts) {
+	return {
+		config: {
+			workingDir: connection.workingDir,
+			date: (/* @__PURE__ */ new Date()).toISOString().split("T")[0],
+			environment: `${process.platform}-${process.arch}, Node.js ${process.version}`,
+			structure: [],
+			isGitRepo: false,
+			currentBranch: "",
+			mainBranch: "",
+			gitStatus: "",
+			recentCommits: []
+		},
+		memory: null,
+		taste: null,
+		skills: null,
+		params: {
+			model: options.model,
+			messages: await messagesToCC(options.messages, facts.readImage),
+			tools: (options.tools ?? []).map((tool) => ({
+				type: "function",
+				name: tool.name,
+				description: tool.description,
+				input_schema: tool.parameters
+			})),
+			system: facts.systemText,
+			max_tokens: facts.maxTokens,
+			temperature: options.temperature ?? .3,
+			stream: true,
+			...facts.reasoningEffort ? { reasoning_effort: facts.reasoningEffort } : {}
+		},
+		threadId: randomUUID()
+	};
+}
+/** Build the documented Provider Chat Completions request body for one call. */
+async function buildOpenAIBody(options, facts) {
+	const openAiMessages = [...facts.systemText ? [{
+		role: "system",
+		content: facts.systemText
+	}] : [], ...await messagesToOpenAI(options.messages, facts.readImage)];
+	const openAiTools = (options.tools ?? []).map((tool) => ({
+		type: "function",
+		function: {
+			name: tool.name,
+			description: tool.description,
+			parameters: tool.parameters
+		}
+	}));
+	return {
+		model: options.model,
+		messages: openAiMessages,
+		...openAiTools.length > 0 ? { tools: openAiTools } : {},
+		max_tokens: facts.maxTokens,
+		temperature: options.temperature ?? .3,
+		stream: true,
+		...facts.reasoningEffort ? { reasoning_effort: facts.reasoningEffort } : {}
+	};
+}
+/**
+* One pre-stream connect attempt: POST the body and wait for response
+* headers only (`requestTimeoutMs` must never bound the body stream — see
+* the caller). Returns the live response plus its cleanup, or the rejection
+* facts for the rotation loop to classify. Every failure path cleans up
+* before returning or throwing; on success the caller-abort listener
+* outlives the connect phase (it aborts a stalled body read), so the
+* streaming tail calls cleanup.
+*/
+async function connectGenerate(deps, key, protocol, body) {
+	const { options, connection, fetchImpl } = deps;
+	const connectAbort = new AbortController();
+	let connectTimedOut = false;
+	const endpoint = protocol === "cli" ? `${connection.apiBase}/alpha/generate` : `${connection.apiBase}/provider/v1/chat/completions`;
+	const connectTimer = setTimeout(() => {
+		connectTimedOut = true;
+		connectAbort.abort(new DOMException(`Command Code API request to ${endpoint} did not respond within ${connection.requestTimeoutMs}ms`, "TimeoutError"));
+	}, connection.requestTimeoutMs);
+	const onCallerAbort = () => {
+		connectAbort.abort(options.signal?.reason);
+	};
+	if (options.signal) {
+		if (options.signal.aborted) onCallerAbort();
+		else options.signal.addEventListener("abort", onCallerAbort, { once: true });
+	}
+	const cleanup = () => {
+		clearTimeout(connectTimer);
+		if (options.signal) options.signal.removeEventListener("abort", onCallerAbort);
+	};
+	let response;
+	const headers = protocol === "cli" ? {
+		"Content-Type": "application/json",
+		Authorization: `Bearer ${key}`,
+		"x-command-code-version": COMMAND_CODE_CLI_VERSION,
+		"x-cli-environment": "production",
+		"x-project-slug": projectSlugFromPath(connection.workingDir),
+		"x-taste-learning": "true",
+		"x-co-flag": "false",
+		...attributionHeaders()
+	} : {
+		"Content-Type": "application/json",
+		Authorization: `Bearer ${key}`,
+		Accept: "text/event-stream",
+		...attributionHeaders()
+	};
+	try {
+		response = await fetchImpl(endpoint, {
+			method: "POST",
+			headers,
+			body: JSON.stringify(body),
+			signal: connectAbort.signal
+		});
+		clearTimeout(connectTimer);
+	} catch (error) {
+		cleanup();
+		if (options.signal?.aborted) throw error;
+		if (connectTimedOut || error instanceof DOMException && error.name === "TimeoutError") throw new LlmError(`Command Code API request to ${endpoint} did not respond within ${connection.requestTimeoutMs}ms: ${errorChain(error)}；Command Code API 请求在 ${connection.requestTimeoutMs} 毫秒内未收到响应——通常是网络或代理问题，请检查后重试`, "TIMEOUT", { cause: error });
+		throw new LlmError(`Command Code API request to ${endpoint} failed: ${errorChain(error)}；Command Code API 请求连接失败——通常是网络或代理问题，请检查网络或代理设置后重试`, "TRANSPORT", { cause: error });
+	}
+	if (!response.ok) {
+		const errText = await response.text().catch(() => "");
+		cleanup();
+		const retryAfterMs = parseRetryAfterMs(response.headers.get("retry-after"));
+		return retryAfterMs === void 0 ? {
+			status: response.status,
+			errText
+		} : {
+			status: response.status,
+			errText,
+			retryAfterMs
+		};
+	}
+	return {
+		response,
+		cleanup
+	};
+}
+/** Fresh block-assembly state for one stream. */
+function createBlockAssembler() {
+	return {
+		nextIndex: 0,
+		textIndex: -1,
+		textContent: "",
+		reasoningIndex: -1,
+		reasoningContent: "",
+		sawContent: false,
+		openAiToolCalls: []
+	};
+}
+function* closeText(asm) {
+	if (asm.textIndex < 0) return;
+	yield {
+		type: "block-end",
+		index: asm.textIndex,
+		block: {
+			type: "text",
+			text: asm.textContent
+		}
+	};
+	asm.textIndex = -1;
+	asm.textContent = "";
+}
+function* closeReasoning(asm) {
+	if (asm.reasoningIndex < 0) return;
+	yield {
+		type: "block-end",
+		index: asm.reasoningIndex,
+		block: {
+			type: "reasoning",
+			text: asm.reasoningContent
+		}
+	};
+	asm.reasoningIndex = -1;
+	asm.reasoningContent = "";
+}
+function* emitOpenAiToolCalls(asm) {
+	for (const call of asm.openAiToolCalls) {
+		const id = call.id ?? randomUUID();
+		const name = call.name ?? "";
+		const args = call.arguments || "{}";
+		const index = asm.nextIndex++;
+		asm.sawContent = true;
+		yield {
+			type: "block-start",
+			index,
+			blockType: "tool-call"
+		};
+		yield {
+			type: "tool-call-delta",
+			index,
+			id: ToolCallId(id),
+			name,
+			argumentsDelta: args
+		};
+		yield {
+			type: "block-end",
+			index,
+			block: {
+				type: "tool-call",
+				id: ToolCallId(id),
+				name,
+				arguments: args
+			}
+		};
+	}
+	asm.openAiToolCalls.length = 0;
+}
 var CommandCodeAdapter = class extends LlmAdapter {
 	deps;
 	catalog = [];
@@ -1208,6 +1624,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	resolveAttachments;
 	billingAccess = /* @__PURE__ */ new Map();
 	billingAccessInflight = /* @__PURE__ */ new Map();
+	protocolCache = /* @__PURE__ */ new Map();
 	constructor(deps) {
 		super();
 		this.deps = deps;
@@ -1282,10 +1699,9 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		}
 		return this.catalog;
 	}
-	async listModels(provider) {
+	async listModels(provider, opts) {
 		const catalog = await this.loadCatalog();
-		const access = this.deps.options().filterModelsByPlan === false ? void 0 : await this.loadBillingAccess();
-		return catalog.filter((model) => modelVisibleInPlan(model.id, access)).map((model) => {
+		const toInfo = (model) => {
 			const vision = KNOWN_IMAGE_MODELS.has(model.id);
 			return {
 				provider,
@@ -1294,7 +1710,12 @@ var CommandCodeAdapter = class extends LlmAdapter {
 				description: capabilityDescription(model.id, model.contextWindow),
 				inputModalities: vision ? ["text", "image"] : ["text"]
 			};
-		}).sort(compareByPlan);
+		};
+		if (opts?.unfiltered === true) return catalog.map(toInfo).sort(compareByPlan);
+		const access = this.deps.options().filterModelsByPlan === false ? void 0 : await this.loadBillingAccess();
+		const visible = this.deps.options().visibleModels;
+		const allow = Array.isArray(visible) && visible.length > 0 ? new Set(visible.filter((id) => typeof id === "string" && id !== "")) : void 0;
+		return catalog.filter((model) => modelVisibleInPlan(model.id, access)).filter((model) => allow === void 0 || allow.has(model.id)).map(toInfo).sort(compareByPlan);
 	}
 	async resolveModel(provider, model, signal) {
 		const entry = this.catalog.find((m) => m.id === model) ?? (await this.loadCatalog(signal)).find((m) => m.id === model);
@@ -1327,6 +1748,25 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		};
 	}
 	/**
+	* Fetch one account endpoint and parse its JSON body. Returns the HTTP
+	* status alongside the parsed record so each caller applies its own
+	* failure accounting: the billing probe fails open silently, the usage
+	* report books failures per endpoint. Non-2xx and non-record bodies come
+	* back without a record; only a transport throw propagates to the caller.
+	*/
+	async fetchEndpointJson(url, headers) {
+		const response = await this.fetchImpl(url, {
+			headers,
+			signal: AbortSignal.timeout(MODELS_TIMEOUT_MS)
+		});
+		if (!response.ok) return { status: response.status };
+		const parsed = await response.json();
+		return {
+			status: response.status,
+			...isRecord(parsed) ? { record: parsed } : {}
+		};
+	}
+	/**
 	* The billing facts behind the picker's plan filter, cached for
 	* {@link BILLING_ACCESS_TTL_MS} and shared across concurrent callers.
 	* `undefined` means "unknown — show everything" (fail-open).
@@ -1368,15 +1808,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			const connection = this.deps.options();
 			const headers = await this.accountHeaders(apiKey);
 			const base = connection.apiBase;
-			const getJson = async (path) => {
-				const response = await this.fetchImpl(`${base}${path}`, {
-					headers,
-					signal: AbortSignal.timeout(MODELS_TIMEOUT_MS)
-				});
-				if (!response.ok) return void 0;
-				const parsed = await response.json();
-				return isRecord(parsed) ? parsed : void 0;
-			};
+			const getJson = async (path) => (await this.fetchEndpointJson(`${base}${path}`, headers)).record;
 			const whoami = await getJson("/alpha/whoami");
 			const orgData = whoami && isRecord(whoami.org) ? whoami.org : void 0;
 			const orgId = orgData === void 0 ? void 0 : stringValue(orgData.id);
@@ -1397,6 +1829,41 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			return;
 		}
 	}
+	/** Fresh cached billing tier weight for a key, or undefined when not known. */
+	cachedBillingTierWeight(apiKey) {
+		const hit = this.billingAccess.get(apiKey);
+		if (hit === void 0 || Date.now() - hit.at >= 3e5) return void 0;
+		return hit.value?.tierWeight;
+	}
+	/** Cached protocol decision for a key, or undefined when expired/unknown. */
+	cachedProtocolUseCli(apiKey) {
+		const hit = this.protocolCache.get(apiKey);
+		if (hit === void 0 || Date.now() - hit.at >= 9e5) return void 0;
+		return hit.useCli;
+	}
+	rememberProtocol(apiKey, useCli) {
+		this.protocolCache.set(apiKey, {
+			useCli,
+			at: Date.now()
+		});
+	}
+	/**
+	* Choose the initial protocol for one request. A fresh protocol cache entry
+	* wins; otherwise a cached (not network-fetched) billing tier of Go is
+	* treated as CLI-only. Unknown accounts default to Provider API and fall
+	* back only after an `upgrade_required` rejection.
+	*/
+	resolveProtocol(apiKey) {
+		const forced = this.deps.options().protocol;
+		if (forced === "cli" || forced === "openai") return forced;
+		const cached = this.cachedProtocolUseCli(apiKey);
+		if (cached !== void 0) return cached ? "cli" : "openai";
+		if (this.cachedBillingTierWeight(apiKey) === GO_TIER_WEIGHT) {
+			this.rememberProtocol(apiKey, true);
+			return "cli";
+		}
+		return "openai";
+	}
 	/**
 	* Fetch account, usage, credit, and subscription state from the Command
 	* Code account endpoints (`/alpha/whoami`, `/alpha/usage/summary`,
@@ -1414,17 +1881,13 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		const failedStatuses = [];
 		const getJson = async (path) => {
 			try {
-				const response = await this.fetchImpl(`${base}${path}`, {
-					headers,
-					signal: AbortSignal.timeout(MODELS_TIMEOUT_MS)
-				});
-				if (!response.ok) {
-					failures.push(`${path}: HTTP ${response.status}`);
-					failedStatuses.push(response.status);
+				const { status, record } = await this.fetchEndpointJson(`${base}${path}`, headers);
+				if (record === void 0) {
+					failures.push(`${path}: HTTP ${status}`);
+					failedStatuses.push(status);
 					return;
 				}
-				const parsed = await response.json();
-				return isRecord(parsed) ? parsed : void 0;
+				return record;
 			} catch (error) {
 				failures.push(`${path}: ${error instanceof Error ? error.message : String(error)}`);
 				failedStatuses.push(void 0);
@@ -1432,51 +1895,19 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			}
 		};
 		const report = { failures };
-		const whoami = await getJson("/alpha/whoami");
-		const whoamiData = whoami && isRecord(whoami.user) ? whoami.user : void 0;
-		if (whoamiData) report.account = {
-			id: stringValue(whoamiData.id) ?? "",
-			name: stringValue(whoamiData.name) ?? "",
-			userName: stringValue(whoamiData.userName) ?? ""
-		};
-		const orgData = whoami && isRecord(whoami.org) ? whoami.org : void 0;
-		const orgId = orgData === void 0 ? void 0 : stringValue(orgData.id);
-		const usage = await getJson("/alpha/usage/summary");
-		if (usage) report.usage = {
-			totalCount: numberValue(usage.totalCount) ?? 0,
-			totalCost: numberValue(usage.totalCost) ?? 0,
-			successRate: numberValue(usage.successRate) ?? 0,
-			completedCount: numberValue(usage.completedCount) ?? 0,
-			failedCount: numberValue(usage.failedCount) ?? 0,
-			totalTokensIn: numberValue(usage.totalTokensIn) ?? 0,
-			totalTokensOut: numberValue(usage.totalTokensOut) ?? 0,
-			totalCredits: numberValue(usage.totalCredits) ?? 0,
-			periodBasis: stringValue(usage.periodBasis) ?? "billing-period"
-		};
-		const credits = await getJson("/alpha/billing/credits");
-		const creditsData = credits && isRecord(credits.credits) ? credits.credits : void 0;
-		const windowLimits = credits && isRecord(credits.windowLimits) ? credits.windowLimits : void 0;
-		const fiveHour = windowLimits && isRecord(windowLimits.fiveHour) ? windowLimits.fiveHour : void 0;
-		const weekly = windowLimits && isRecord(windowLimits.weekly) ? windowLimits.weekly : void 0;
-		if (creditsData || fiveHour || weekly) report.credits = {
-			monthlyCredits: numberValue(creditsData?.monthlyCredits) ?? 0,
-			purchasedCredits: numberValue(creditsData?.purchasedCredits) ?? 0,
-			freeCredits: numberValue(creditsData?.freeCredits) ?? 0,
-			fiveHour: {
-				used: numberValue(fiveHour?.used) ?? 0,
-				cap: numberValue(fiveHour?.cap) ?? 0,
-				exceeded: fiveHour?.exceeded === true,
-				resetAt: numberValue(fiveHour?.resetAt) ?? 0
-			},
-			weekly: {
-				used: numberValue(weekly?.used) ?? 0,
-				cap: numberValue(weekly?.cap) ?? 0,
-				exceeded: weekly?.exceeded === true,
-				resetAt: numberValue(weekly?.resetAt) ?? 0
-			}
-		};
-		const subscription = await getJson(orgId === void 0 ? "/alpha/billing/subscriptions" : `/alpha/billing/subscriptions?orgId=${encodeURIComponent(orgId)}`);
-		const subData = subscription && isRecord(subscription.data) ? subscription.data : void 0;
+		const { account, orgId } = parseAccountIdentity(await getJson("/alpha/whoami"));
+		if (account !== void 0) report.account = account;
+		const [usage, credits, subscription] = await Promise.all([
+			getJson("/alpha/usage/summary"),
+			getJson("/alpha/billing/credits"),
+			getJson(orgId === void 0 ? "/alpha/billing/subscriptions" : `/alpha/billing/subscriptions?orgId=${encodeURIComponent(orgId)}`)
+		]);
+		const totals = parseUsageTotals(usage);
+		if (totals !== void 0) report.usage = totals;
+		const limits = parseCreditLimits(credits);
+		if (limits !== void 0) report.credits = limits;
+		const subData = subscription !== void 0 && isRecord(subscription.data) ? subscription.data : void 0;
+		const creditsData = credits !== void 0 && isRecord(credits.credits) ? credits.credits : void 0;
 		const planId = stringValue(subData?.planId) ?? stringValue(creditsData?.planId);
 		if (subData !== void 0 || planId !== void 0) {
 			const info = planId === void 0 ? void 0 : subscriptionPlanInfo(planId);
@@ -1488,12 +1919,8 @@ var CommandCodeAdapter = class extends LlmAdapter {
 				currentPeriodEnd: periodEndValue(subData?.currentPeriodEnd)
 			};
 		}
-		if (failures.length === USAGE_ENDPOINT_COUNT) {
-			const codes = failedStatuses.filter((status) => status !== void 0);
-			if (codes.length === USAGE_ENDPOINT_COUNT && codes.every((code) => code === 401)) report.blocked = "invalid-key";
-			else if (codes.length === USAGE_ENDPOINT_COUNT && codes.every((code) => code >= 500)) report.blocked = "service-unavailable";
-			else if (codes.length === 0) report.blocked = "network";
-		}
+		const blocked = classifyTotalFailure(failures, failedStatuses);
+		if (blocked !== void 0) report.blocked = blocked;
 		return report;
 	}
 	/**
@@ -1543,107 +1970,39 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		const supported = KNOWN_EFFORTS[options.model];
 		const reasoningEffort = effort && effort !== "off" && supported?.includes(effort) ? effort : void 0;
 		const systemText = [options.system ?? "", ...options.messages.filter((m) => m.role === "system").map((m) => m.content.map(blockText).filter(Boolean).join("\n"))].filter(Boolean).join("\n\n");
-		const body = {
-			config: {
-				workingDir: connection.workingDir,
-				date: (/* @__PURE__ */ new Date()).toISOString().split("T")[0],
-				environment: `${process.platform}-${process.arch}, Node.js ${process.version}`,
-				structure: [],
-				isGitRepo: false,
-				currentBranch: "",
-				mainBranch: "",
-				gitStatus: "",
-				recentCommits: []
-			},
-			memory: null,
-			taste: null,
-			skills: null,
-			params: {
-				model: options.model,
-				messages: await messagesToCC(options.messages, readImage),
-				tools: (options.tools ?? []).map((tool) => ({
-					type: "function",
-					name: tool.name,
-					description: tool.description,
-					input_schema: tool.parameters
-				})),
-				system: systemText,
-				max_tokens: maxTokens,
-				temperature: options.temperature ?? .3,
-				stream: true,
-				...reasoningEffort ? { reasoning_effort: reasoningEffort } : {}
-			},
-			threadId: randomUUID()
-		};
-		const connect = async (key) => {
-			const connectAbort = new AbortController();
-			let connectTimedOut = false;
-			const connectTimer = setTimeout(() => {
-				connectTimedOut = true;
-				connectAbort.abort(new DOMException(`Command Code API request to ${connection.apiBase}/alpha/generate did not respond within ${connection.requestTimeoutMs}ms`, "TimeoutError"));
-			}, connection.requestTimeoutMs);
-			const onCallerAbort = () => {
-				connectAbort.abort(options.signal?.reason);
-			};
-			if (options.signal) {
-				if (options.signal.aborted) onCallerAbort();
-				else options.signal.addEventListener("abort", onCallerAbort, { once: true });
-			}
-			const cleanup = () => {
-				clearTimeout(connectTimer);
-				if (options.signal) options.signal.removeEventListener("abort", onCallerAbort);
-			};
-			let response;
-			try {
-				response = await this.fetchImpl(`${connection.apiBase}/alpha/generate`, {
-					method: "POST",
-					headers: {
-						"Content-Type": "application/json",
-						Authorization: `Bearer ${key}`,
-						"x-command-code-version": COMMAND_CODE_CLI_VERSION,
-						"x-cli-environment": "production",
-						"x-project-slug": projectSlugFromPath(connection.workingDir),
-						"x-taste-learning": "true",
-						"x-co-flag": "false",
-						...attributionHeaders()
-					},
-					body: JSON.stringify(body),
-					signal: connectAbort.signal
-				});
-				clearTimeout(connectTimer);
-			} catch (error) {
-				cleanup();
-				if (options.signal?.aborted) throw error;
-				if (connectTimedOut || error instanceof DOMException && error.name === "TimeoutError") throw new LlmError(`Command Code API request to ${connection.apiBase}/alpha/generate did not respond within ${connection.requestTimeoutMs}ms: ${errorChain(error)}；Command Code API 请求在 ${connection.requestTimeoutMs} 毫秒内未收到响应——通常是网络或代理问题，请检查后重试`, "TIMEOUT", { cause: error });
-				throw new LlmError(`Command Code API request to ${connection.apiBase}/alpha/generate failed: ${errorChain(error)}；Command Code API 请求连接失败——通常是网络或代理问题，请检查网络或代理设置后重试`, "TRANSPORT", { cause: error });
-			}
-			if (!response.ok) {
-				const errText = await response.text().catch(() => "");
-				cleanup();
-				const retryAfterMs = parseRetryAfterMs(response.headers.get("retry-after"));
-				return retryAfterMs === void 0 ? {
-					status: response.status,
-					errText
-				} : {
-					status: response.status,
-					errText,
-					retryAfterMs
-				};
-			}
-			return {
-				response,
-				cleanup
-			};
-		};
+		let protocol = this.resolveProtocol(apiKey);
+		const buildBody = async (target) => target === "cli" ? buildCliBody(options, connection, {
+			maxTokens,
+			reasoningEffort,
+			systemText,
+			readImage
+		}) : buildOpenAIBody(options, {
+			maxTokens,
+			reasoningEffort,
+			systemText,
+			readImage
+		});
+		let body = await buildBody(protocol);
 		const tried = /* @__PURE__ */ new Set();
+		const connectDeps = {
+			options,
+			connection,
+			fetchImpl: this.fetchImpl
+		};
 		let connected;
 		for (;;) {
 			tried.add(apiKey);
-			const attempt = await connect(apiKey);
+			const attempt = await connectGenerate(connectDeps, apiKey, protocol, body);
 			if ("response" in attempt) {
 				connected = attempt;
 				break;
 			}
+			if (protocol === "openai" && isUpgradeRequiredError(attempt.status, attempt.errText)) {
+				protocol = "cli";
+				this.rememberProtocol(apiKey, true);
+				body = await buildBody("cli");
+				continue;
+			}
 			const rotate = this.deps.rotateApiKey;
 			if ((attempt.status === 429 || attempt.status === 401) && rotate !== void 0 && options.signal?.aborted !== true && tried.size < MAX_ACCOUNT_ROTATIONS) {
 				const next = await rotate(apiKey, attempt.status === 429 ? "rate-limit" : "invalid-credential", connection, options.model);
@@ -1654,6 +2013,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			}
 			throw generateHttpError(attempt.status, attempt.errText, attempt.retryAfterMs);
 		}
+		if (connected === void 0) throw new LlmError("Command Code API connection failed without a response", "TRANSPORT");
 		const { response, cleanup } = connected;
 		if (!response.body) {
 			cleanup();
@@ -1677,154 +2037,8 @@ var CommandCodeAdapter = class extends LlmAdapter {
 				idleTimer = void 0;
 			}
 		};
-		let nextIndex = 0;
-		let textIndex = -1;
-		let textContent = "";
-		let reasoningIndex = -1;
-		let reasoningContent = "";
-		let sawContent = false;
-		const closeText = function* () {
-			if (textIndex < 0) return;
-			yield {
-				type: "block-end",
-				index: textIndex,
-				block: {
-					type: "text",
-					text: textContent
-				}
-			};
-			textIndex = -1;
-			textContent = "";
-		};
-		const closeReasoning = function* () {
-			if (reasoningIndex < 0) return;
-			yield {
-				type: "block-end",
-				index: reasoningIndex,
-				block: {
-					type: "reasoning",
-					text: reasoningContent
-				}
-			};
-			reasoningIndex = -1;
-			reasoningContent = "";
-		};
-		const handleEvent = (event) => {
-			const chunks = [];
-			if (!isRecord(event)) return chunks;
-			switch (event.type) {
-				case "text-delta": {
-					chunks.push(...closeReasoning());
-					if (textIndex < 0) {
-						textIndex = nextIndex++;
-						chunks.push({
-							type: "block-start",
-							index: textIndex,
-							blockType: "text"
-						});
-					}
-					const delta = stringValue(event.text) ?? "";
-					textContent += delta;
-					sawContent = true;
-					chunks.push({
-						type: "text-delta",
-						index: textIndex,
-						text: delta
-					});
-					break;
-				}
-				case "reasoning-delta": {
-					chunks.push(...closeText());
-					if (reasoningIndex < 0) {
-						reasoningIndex = nextIndex++;
-						chunks.push({
-							type: "block-start",
-							index: reasoningIndex,
-							blockType: "reasoning"
-						});
-					}
-					const delta = stringValue(event.text) ?? "";
-					reasoningContent += delta;
-					chunks.push({
-						type: "reasoning-delta",
-						index: reasoningIndex,
-						text: delta
-					});
-					break;
-				}
-				case "reasoning-start":
-					chunks.push(...closeText());
-					break;
-				case "reasoning-end":
-					chunks.push(...closeReasoning());
-					break;
-				case "tool-call": {
-					chunks.push(...closeText(), ...closeReasoning());
-					const id = stringValue(event.toolCallId) ?? randomUUID();
-					const name = stringValue(event.toolName) ?? "";
-					const args = JSON.stringify(recordOrEmpty(event.input ?? event.args ?? event.arguments));
-					const index = nextIndex++;
-					sawContent = true;
-					chunks.push({
-						type: "block-start",
-						index,
-						blockType: "tool-call"
-					}, {
-						type: "tool-call-delta",
-						index,
-						id: ToolCallId(id),
-						name,
-						argumentsDelta: args
-					}, {
-						type: "block-end",
-						index,
-						block: {
-							type: "tool-call",
-							id: ToolCallId(id),
-							name,
-							arguments: args
-						}
-					});
-					break;
-				}
-				case "finish": {
-					chunks.push(...closeText(), ...closeReasoning());
-					const usage = isRecord(event.totalUsage) ? event.totalUsage : void 0;
-					if (usage) {
-						const details = isRecord(usage.inputTokenDetails) ? usage.inputTokenDetails : void 0;
-						const totalInput = numberValue(usage.inputTokens) ?? 0;
-						const cacheRead = numberValue(details?.cacheReadTokens) ?? 0;
-						const cacheWrite = numberValue(details?.cacheWriteTokens) ?? 0;
-						const tokenUsage = {
-							inputTokens: numberValue(details?.noCacheTokens) ?? Math.max(0, totalInput - cacheRead - cacheWrite),
-							outputTokens: numberValue(usage.outputTokens) ?? 0,
-							cacheReadTokens: cacheRead,
-							cacheWriteTokens: cacheWrite
-						};
-						chunks.push({
-							type: "usage",
-							usage: tokenUsage
-						});
-					}
-					chunks.push({
-						type: "finish",
-						reason: mapFinishReason(event.finishReason)
-					});
-					break;
-				}
-				case "error": {
-					const err = isRecord(event.error) ? event.error : void 0;
-					const detail = isRecord(event.error) ? stringValue(event.error.message) ?? JSON.stringify(event.error) : stringValue(event.error) ?? stringValue(event.message) ?? "Stream error";
-					const statusCode = err ? numberValue(err.statusCode) : void 0;
-					const isRetryable = err ? booleanValue(err.isRetryable) : void 0;
-					const retryableStatus = statusCode !== void 0 && (statusCode === 429 || statusCode >= 500);
-					const terminal = hasTerminalStreamMarker(detail);
-					if (!(isRetryable === true || (statusCode !== void 0 ? retryableStatus : isRetryable !== false && !terminal))) throw new LlmError(`Command Code stream error: ${detail}`, "PROVIDER_STREAM_ERROR", statusCode !== void 0 ? { status: statusCode } : void 0);
-					throw new LlmError(`Command Code stream error: ${detail}`, "SERVER", statusCode !== void 0 ? { status: statusCode } : void 0);
-				}
-			}
-			return chunks;
-		};
+		const asm = createBlockAssembler();
+		const handle = (event) => handleEvent(asm, protocol, event);
 		try {
 			let finished = false;
 			for (;;) {
@@ -1841,14 +2055,17 @@ var CommandCodeAdapter = class extends LlmAdapter {
 				const { done, value } = read;
 				if (done) {
 					if (idleFired) throw new LlmError(`Command Code API stream from ${connection.apiBase} was idle for ${connection.streamIdleTimeoutMs}ms (no events) and was treated as a dead connection；Command Code API 流式响应已 ${connection.streamIdleTimeoutMs} 毫秒无任何事件，被判定为死连接——长思考模型可在设置中调大流空闲超时`, "TIMEOUT");
-					if (buffer.trim()) for (const chunk of handleEvent(parseStreamEventLine(buffer))) yield chunk;
+					if (buffer.trim()) for (const chunk of handle(parseStreamEventLine(buffer))) {
+						yield chunk;
+						if (chunk.type === "finish") finished = true;
+					}
 					break;
 				}
 				buffer += decoder.decode(value, { stream: true });
 				const lines = buffer.split("\n");
 				buffer = lines.pop() ?? "";
 				for (const line of lines) {
-					const chunks = handleEvent(parseStreamEventLine(line));
+					const chunks = handle(parseStreamEventLine(line));
 					for (const chunk of chunks) {
 						yield chunk;
 						if (chunk.type === "finish") finished = true;
@@ -1857,9 +2074,10 @@ var CommandCodeAdapter = class extends LlmAdapter {
 				if (finished) break;
 			}
 			if (!finished) {
-				yield* closeText();
-				yield* closeReasoning();
-				if (!sawContent) throw new LlmError("Command Code returned an empty response；Command Code 返回了空响应，重试通常可恢复", "EMPTY_RESPONSE");
+				yield* closeText(asm);
+				yield* closeReasoning(asm);
+				if (protocol === "openai") yield* emitOpenAiToolCalls(asm);
+				if (!asm.sawContent) throw new LlmError("Command Code returned an empty response；Command Code 返回了空响应，重试通常可恢复", "EMPTY_RESPONSE");
 				yield {
 					type: "finish",
 					reason: { kind: "stop" }
@@ -1873,8 +2091,6 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		}
 	}
 };
-/** Hard cap on account rotations within one request (one attempt per distinct key). */
-const MAX_ACCOUNT_ROTATIONS = 16;
 /**
 * Map a pre-stream generate HTTP failure onto a stable LlmError. Command
 * Code folds several business rejections into 403 (plan limits, CLI version,
@@ -1899,6 +2115,223 @@ function generateHttpError(status, errText, retryAfterMs) {
 	});
 }
 /**
+* Handle one CLI-transport (`/alpha/generate`) stream event, appending
+* harness StreamChunks. Pure over the passed assembler — no stream() locals.
+*/
+function handleCliEvent(asm, event) {
+	const chunks = [];
+	if (!isRecord(event)) return chunks;
+	switch (event.type) {
+		case "text-delta": {
+			chunks.push(...closeReasoning(asm));
+			if (asm.textIndex < 0) {
+				asm.textIndex = asm.nextIndex++;
+				chunks.push({
+					type: "block-start",
+					index: asm.textIndex,
+					blockType: "text"
+				});
+			}
+			const delta = stringValue(event.text) ?? "";
+			asm.textContent += delta;
+			asm.sawContent = true;
+			chunks.push({
+				type: "text-delta",
+				index: asm.textIndex,
+				text: delta
+			});
+			break;
+		}
+		case "reasoning-delta": {
+			chunks.push(...closeText(asm));
+			if (asm.reasoningIndex < 0) {
+				asm.reasoningIndex = asm.nextIndex++;
+				chunks.push({
+					type: "block-start",
+					index: asm.reasoningIndex,
+					blockType: "reasoning"
+				});
+			}
+			const delta = stringValue(event.text) ?? "";
+			asm.reasoningContent += delta;
+			chunks.push({
+				type: "reasoning-delta",
+				index: asm.reasoningIndex,
+				text: delta
+			});
+			break;
+		}
+		case "reasoning-start":
+			chunks.push(...closeText(asm));
+			break;
+		case "reasoning-end":
+			chunks.push(...closeReasoning(asm));
+			break;
+		case "tool-call": {
+			chunks.push(...closeText(asm), ...closeReasoning(asm));
+			const id = stringValue(event.toolCallId) ?? randomUUID();
+			const name = stringValue(event.toolName) ?? "";
+			const args = JSON.stringify(recordOrEmpty(event.input ?? event.args ?? event.arguments));
+			const index = asm.nextIndex++;
+			asm.sawContent = true;
+			chunks.push({
+				type: "block-start",
+				index,
+				blockType: "tool-call"
+			}, {
+				type: "tool-call-delta",
+				index,
+				id: ToolCallId(id),
+				name,
+				argumentsDelta: args
+			}, {
+				type: "block-end",
+				index,
+				block: {
+					type: "tool-call",
+					id: ToolCallId(id),
+					name,
+					arguments: args
+				}
+			});
+			break;
+		}
+		case "finish": {
+			chunks.push(...closeText(asm), ...closeReasoning(asm));
+			const usage = isRecord(event.totalUsage) ? event.totalUsage : void 0;
+			if (usage) {
+				const details = isRecord(usage.inputTokenDetails) ? usage.inputTokenDetails : void 0;
+				const totalInput = numberValue(usage.inputTokens) ?? 0;
+				const cacheRead = numberValue(details?.cacheReadTokens) ?? 0;
+				const cacheWrite = numberValue(details?.cacheWriteTokens) ?? 0;
+				const tokenUsage = {
+					inputTokens: numberValue(details?.noCacheTokens) ?? Math.max(0, totalInput - cacheRead - cacheWrite),
+					outputTokens: numberValue(usage.outputTokens) ?? 0,
+					cacheReadTokens: cacheRead,
+					cacheWriteTokens: cacheWrite
+				};
+				chunks.push({
+					type: "usage",
+					usage: tokenUsage
+				});
+			}
+			chunks.push({
+				type: "finish",
+				reason: mapFinishReason(event.finishReason)
+			});
+			break;
+		}
+		case "error": {
+			const err = isRecord(event.error) ? event.error : void 0;
+			const detail = isRecord(event.error) ? stringValue(event.error.message) ?? JSON.stringify(event.error) : stringValue(event.error) ?? stringValue(event.message) ?? "Stream error";
+			const statusCode = err ? numberValue(err.statusCode) : void 0;
+			const isRetryable = err ? booleanValue(err.isRetryable) : void 0;
+			const retryableStatus = statusCode !== void 0 && (statusCode === 429 || statusCode >= 500);
+			const terminal = hasTerminalStreamMarker(detail);
+			if (!(isRetryable === true || (statusCode !== void 0 ? retryableStatus : isRetryable !== false && !terminal))) throw new LlmError(`Command Code stream error: ${detail}`, "PROVIDER_STREAM_ERROR", statusCode !== void 0 ? { status: statusCode } : void 0);
+			throw new LlmError(`Command Code stream error: ${detail}`, "SERVER", statusCode !== void 0 ? { status: statusCode } : void 0);
+		}
+	}
+	return chunks;
+}
+/**
+* Handle one OpenAI-transport (`/provider/v1/chat/completions`) SSE event.
+* Same assembler contract as {@link handleCliEvent}; tool-call fragments
+* buffer on the assembler and flush at finish.
+*/
+function handleOpenAIEvent(asm, event) {
+	const chunks = [];
+	if (!isRecord(event)) return chunks;
+	const choices = event.choices;
+	if (!Array.isArray(choices) || choices.length === 0) {
+		if (event.usage !== void 0) chunks.push({
+			type: "usage",
+			usage: mapOpenAIUsage(event.usage)
+		});
+		return chunks;
+	}
+	const choice = isRecord(choices[0]) ? choices[0] : {};
+	const delta = isRecord(choice.delta) ? choice.delta : {};
+	const reasoningDelta = stringValue(delta.reasoning) ?? stringValue(delta.reasoning_content) ?? "";
+	if (reasoningDelta !== "") {
+		chunks.push(...closeText(asm));
+		if (asm.reasoningIndex < 0) {
+			asm.reasoningIndex = asm.nextIndex++;
+			chunks.push({
+				type: "block-start",
+				index: asm.reasoningIndex,
+				blockType: "reasoning"
+			});
+		}
+		asm.reasoningContent += reasoningDelta;
+		chunks.push({
+			type: "reasoning-delta",
+			index: asm.reasoningIndex,
+			text: reasoningDelta
+		});
+	}
+	const contentDelta = stringValue(delta.content) ?? "";
+	if (contentDelta !== "") {
+		chunks.push(...closeReasoning(asm));
+		if (asm.textIndex < 0) {
+			asm.textIndex = asm.nextIndex++;
+			chunks.push({
+				type: "block-start",
+				index: asm.textIndex,
+				blockType: "text"
+			});
+		}
+		asm.textContent += contentDelta;
+		asm.sawContent = true;
+		chunks.push({
+			type: "text-delta",
+			index: asm.textIndex,
+			text: contentDelta
+		});
+	}
+	if (Array.isArray(delta.tool_calls)) {
+		asm.sawContent = true;
+		for (const rawCall of delta.tool_calls) {
+			if (!isRecord(rawCall)) continue;
+			const callIndex = numberValue(rawCall.index) ?? 0;
+			let existing = asm.openAiToolCalls.find((call) => call.index === callIndex);
+			const fn = isRecord(rawCall.function) ? rawCall.function : void 0;
+			const id = stringValue(rawCall.id);
+			const name = fn === void 0 ? void 0 : stringValue(fn.name);
+			const argDelta = fn === void 0 ? void 0 : stringValue(fn.arguments) ?? (fn.arguments === void 0 ? "" : JSON.stringify(fn.arguments));
+			if (!existing) {
+				existing = {
+					index: callIndex,
+					name: name ?? "",
+					arguments: argDelta ?? ""
+				};
+				if (id !== void 0) existing.id = id;
+				asm.openAiToolCalls.push(existing);
+			} else {
+				if (id !== void 0 && existing.id === void 0) existing.id = id;
+				if (name !== void 0 && existing.name === "") existing.name = name;
+				if (argDelta !== void 0) existing.arguments += argDelta;
+			}
+		}
+	}
+	if (choice.finish_reason !== void 0 && choice.finish_reason !== null) {
+		chunks.push(...closeText(asm), ...closeReasoning(asm), ...emitOpenAiToolCalls(asm));
+		if (event.usage !== void 0) chunks.push({
+			type: "usage",
+			usage: mapOpenAIUsage(event.usage)
+		});
+		chunks.push({
+			type: "finish",
+			reason: mapFinishReason(choice.finish_reason)
+		});
+	}
+	return chunks;
+}
+/** Dispatch one parsed stream event to the active transport's handler. */
+function handleEvent(asm, protocol, event) {
+	return protocol === "openai" ? handleOpenAIEvent(asm, event) : handleCliEvent(asm, event);
+}
+/**
 * Parse an HTTP `Retry-After` value (delay-seconds or an HTTP-date) into
 * milliseconds; undefined when absent or unparseable. An HTTP-date in the
 * past yields 0, which the caller drops (LlmError wants a positive delay).
@@ -1918,11 +2351,61 @@ function parseRetryAfterMs(value, now = Date.now()) {
 	const date = Date.parse(trimmed);
 	if (!Number.isNaN(date)) return Math.max(0, date - now);
 }
+/**
+* Map a stream finish reason onto the harness taxonomy. The two transports
+* spell tool-calls differently (`tool-calls` on the CLI transport,
+* `tool_calls` on the OpenAI transport) but share every other reason, so
+* one function serves both — a new reason cannot drift between them.
+*/
 function mapFinishReason(reason) {
-	if (reason === "tool-calls") return { kind: "tool-calls" };
+	if (reason === "tool-calls" || reason === "tool_calls") return { kind: "tool-calls" };
 	if (reason === "length" || reason === "max_tokens" || reason === "max-tokens" || reason === "max_output_tokens") return { kind: "max-tokens" };
 	return { kind: "stop" };
 }
+/**
+* True when a Provider API pre-stream rejection is Command Code's Go-plan
+* gate (`upgrade_required`). Only this exact class of rejection should fall
+* back to the CLI /alpha/generate transport; other 4xx/5xx must surface as
+* ordinary errors so real account/model problems are not masked.
+*/
+function isUpgradeRequiredError(status, errText) {
+	if (status !== 403) return false;
+	const lower = errText.toLowerCase();
+	if (lower.includes("upgrade_required")) return true;
+	if (lower.includes("go plan") && lower.includes("api access")) return true;
+	if (lower.includes("only plan without api access")) return true;
+	if (lower.includes("upgrade to goat or higher")) return true;
+	try {
+		const parsed = JSON.parse(errText);
+		if (isRecord(parsed)) {
+			const error = isRecord(parsed.error) ? parsed.error : parsed;
+			if ((stringValue(error.code) ?? stringValue(error.type))?.toLowerCase() === "upgrade_required") return true;
+			const message = stringValue(error.message) ?? "";
+			if (message.toLowerCase().includes("go plan") && message.toLowerCase().includes("api access")) return true;
+		}
+	} catch {}
+	return false;
+}
+/** Map an OpenAI Chat Completions usage payload to harness disjoint counts. */
+function mapOpenAIUsage(usage) {
+	const source = isRecord(usage) ? usage : {};
+	const promptTokens = numberValue(source.prompt_tokens) ?? 0;
+	const outputTokens = numberValue(source.completion_tokens) ?? 0;
+	const totalTokens = numberValue(source.total_tokens);
+	const promptDetails = isRecord(source.prompt_tokens_details) ? source.prompt_tokens_details : void 0;
+	const cacheRead = numberValue(promptDetails?.cached_tokens) ?? 0;
+	const cacheWrite = numberValue(promptDetails?.cache_creation_input_tokens) ?? 0;
+	const reasoningTokens = numberValue((isRecord(source.completion_tokens_details) ? source.completion_tokens_details : void 0)?.reasoning_tokens);
+	const usageOut = {
+		inputTokens: Math.max(0, promptTokens - cacheRead - cacheWrite),
+		outputTokens,
+		cacheReadTokens: cacheRead
+	};
+	if (cacheWrite > 0) usageOut.cacheWriteTokens = cacheWrite;
+	if (reasoningTokens !== void 0) usageOut.reasoningTokens = reasoningTokens;
+	if (totalTokens !== void 0) usageOut.totalTokens = totalTokens;
+	return usageOut;
+}
 //#endregion
 //#region src/command-locales.ts
 const commandcodeCommand = {
@@ -1954,8 +2437,8 @@ const commandcodeCommand = {
 		exceededWarning: "  ⚠️ 超限!",
 		resetSuffix: "重置 {when}",
 		partialFailures: "⚠️  部分端点失败: {list}",
-		noData: "(no data — check your API key)",
-		errorText: "Could not fetch Command Code usage: {message}",
+		noData: "（无数据 — 请检查 API 密钥）",
+		errorText: "获取 Command Code 用量失败：{message}",
 		imageGate: "当前会话已包含图片，而模型 {model} 不支持图片输入；请选择支持图片的模型，或先移除会话中的图片。"
 	},
 	en: {
@@ -2129,7 +2612,7 @@ const REMOTE_SERVICE = "commandcodeUsage";
 /** The wire namespace all Command Code endpoints share. */
 const REMOTE_NAMESPACE = "commandcode";
 /**
-* Build the validator helpers one endpoint uses Sequence. `prefix` names the
+* Build the validator helpers one endpoint uses. `prefix` names the
 * endpoint in the rejection message (e.g. `commandcode/report result:`), so
 * each wire file keeps its own diagnostic phrasing while sharing the helper
 * bodies.
@@ -2185,14 +2668,13 @@ const USAGE_REMOTE_PACKAGE = REMOTE_PACKAGE;
 /** Canonical `<namespace>/<method>` endpoint of the usage report Remote. */
 const USAGE_REPORT_ENDPOINT = "commandcode/report";
 /**
-* The shared read/validate helpers, prefixed with the report endpoint so
-* rejection messages name the offending boundary (the catalog endpoint below
-* shares this prefix, matching the historical behavior).
+* The shared read/validate helpers for the usage report endpoint, prefixed
+* so rejection messages name the offending boundary.
 */
-const { reject: reject$1, record, stringField, numberField, booleanField } = makeBoundaryValidator("commandcode/report result:");
+const { reject: reject$1, record: record$1, stringField: stringField$1, numberField, booleanField } = makeBoundaryValidator("commandcode/report result:");
 /** Validate one window-limit block (`fiveHour` / `weekly`). */
 function windowLimit(value, field) {
-	const source = record(value, field);
+	const source = record$1(value, field);
 	return {
 		used: numberField(source, "used", `${field}.used`),
 		cap: numberField(source, "cap", `${field}.cap`),
@@ -2206,7 +2688,7 @@ function windowLimit(value, field) {
 * malformed frame fails the boundary instead of rendering garbage.
 */
 function parseUsageReport(value) {
-	const source = record(value, "report");
+	const source = record$1(value, "report");
 	const failures = source.failures;
 	if (!Array.isArray(failures) || failures.some((entry) => typeof entry !== "string")) reject$1("failures");
 	const report = { failures };
@@ -2216,15 +2698,15 @@ function parseUsageReport(value) {
 		else reject$1("blocked");
 	}
 	if (source.account !== void 0) {
-		const account = record(source.account, "account");
+		const account = record$1(source.account, "account");
 		report.account = {
-			id: stringField(account, "id", "account.id"),
-			name: stringField(account, "name", "account.name"),
-			userName: stringField(account, "userName", "account.userName")
+			id: stringField$1(account, "id", "account.id"),
+			name: stringField$1(account, "name", "account.name"),
+			userName: stringField$1(account, "userName", "account.userName")
 		};
 	}
 	if (source.usage !== void 0) {
-		const usage = record(source.usage, "usage");
+		const usage = record$1(source.usage, "usage");
 		report.usage = {
 			totalCount: numberField(usage, "totalCount", "usage.totalCount"),
 			totalCost: numberField(usage, "totalCost", "usage.totalCost"),
@@ -2234,11 +2716,11 @@ function parseUsageReport(value) {
 			totalTokensIn: numberField(usage, "totalTokensIn", "usage.totalTokensIn"),
 			totalTokensOut: numberField(usage, "totalTokensOut", "usage.totalTokensOut"),
 			totalCredits: numberField(usage, "totalCredits", "usage.totalCredits"),
-			periodBasis: stringField(usage, "periodBasis", "usage.periodBasis")
+			periodBasis: stringField$1(usage, "periodBasis", "usage.periodBasis")
 		};
 	}
 	if (source.credits !== void 0) {
-		const credits = record(source.credits, "credits");
+		const credits = record$1(source.credits, "credits");
 		report.credits = {
 			monthlyCredits: numberField(credits, "monthlyCredits", "credits.monthlyCredits"),
 			purchasedCredits: numberField(credits, "purchasedCredits", "credits.purchasedCredits"),
@@ -2248,13 +2730,13 @@ function parseUsageReport(value) {
 		};
 	}
 	if (source.plan !== void 0) {
-		const plan = record(source.plan, "plan");
+		const plan = record$1(source.plan, "plan");
 		const monthly = plan.monthlyCredits;
 		if (monthly !== null && (typeof monthly !== "number" || !Number.isFinite(monthly))) reject$1("plan.monthlyCredits");
 		report.plan = {
-			planId: stringField(plan, "planId", "plan.planId"),
-			name: stringField(plan, "name", "plan.name"),
-			status: stringField(plan, "status", "plan.status"),
+			planId: stringField$1(plan, "planId", "plan.planId"),
+			name: stringField$1(plan, "name", "plan.name"),
+			status: stringField$1(plan, "status", "plan.status"),
 			monthlyCredits: monthly,
 			currentPeriodEnd: numberField(plan, "currentPeriodEnd", "plan.currentPeriodEnd")
 		};
@@ -2263,20 +2745,20 @@ function parseUsageReport(value) {
 }
 /** Parse one untrusted boundary value into a {@link CommandCodeAccountUsage}. */
 function parseAccountUsage(value) {
-	const source = record(value, "account");
+	const source = record$1(value, "account");
 	return {
-		id: stringField(source, "id", "account.id"),
-		label: stringField(source, "label", "account.label"),
+		id: stringField$1(source, "id", "account.id"),
+		label: stringField$1(source, "label", "account.label"),
 		configured: booleanField(source, "configured", "account.configured"),
 		active: booleanField(source, "active", "account.active"),
-		mark: stringField(source, "mark", "account.mark"),
+		mark: stringField$1(source, "mark", "account.mark"),
 		cooldownUntil: numberField(source, "cooldownUntil", "account.cooldownUntil"),
 		report: parseUsageReport(source.report)
 	};
 }
 /** Parse the wire result into a {@link CommandCodeAccountsReport}. */
 function parseAccountsReport(value) {
-	const accounts = record(value, "result").accounts;
+	const accounts = record$1(value, "result").accounts;
 	if (Array.isArray(accounts)) return { accounts: accounts.map(parseAccountUsage) };
 	return reject$1("accounts");
 }
@@ -2300,19 +2782,27 @@ const USAGE_HOST_CONTRIBUTION = {
 };
 /** Canonical `<namespace>/<method>` endpoint of the model-catalog Remote. */
 const MODELS_ENDPOINT = "commandcode/models";
+/**
+* The shared read/validate helpers for the model-catalog endpoint — a
+* separate instance so catalog boundary errors name `commandcode/models`,
+* not the report endpoint.
+*/
+const { record: catalogRecord, stringField: catalogString } = makeBoundaryValidator("commandcode/models result:");
 /** Parse one untrusted boundary value into a {@link CommandCodeCatalogModel}. */
 function parseCatalogModel(value) {
-	const source = record(value, "model");
-	return {
-		id: stringField(source, "id", "model.id"),
-		name: stringField(source, "name", "model.name")
+	const source = catalogRecord(value, "model");
+	const model = {
+		id: catalogString(source, "id", "model.id"),
+		name: catalogString(source, "name", "model.name")
 	};
+	if (source.tier !== void 0) model.tier = catalogString(source, "tier", "model.tier");
+	return model;
 }
 /** Parse the wire result into a {@link CommandCodeCatalog}. */
 function parseCatalog(value) {
-	const models = record(value, "result").models;
+	const models = catalogRecord(value, "result").models;
 	if (Array.isArray(models)) return { models: models.map(parseCatalogModel) };
-	return reject$1("models");
+	throw new TypeError("commandcode/models result: invalid models");
 }
 /**
 * The model-catalog invocation descriptor, sharing the same `commandcodeUsage`
@@ -2336,45 +2826,29 @@ const REASONS = [
 ];
 /** The shared read/validate helpers, prefixed with the login endpoint so
 * rejection messages name the offending boundary. */
-/** Reject one boundary value with a field-naming error. A module-level
-* function declaration (not the factory's destructured arrow) so TypeScript's
-* control-flow analysis recognizes it as never-returning and narrows `state`
-* after the guard below. */
-function reject(field) {
-	throw new TypeError(`commandcode/login result: invalid ${field}`);
-}
+const { reject, record, stringField } = makeBoundaryValidator("commandcode/login result:");
 /**
 * Parse one untrusted boundary value into a {@link CommandCodeLoginStatus}.
 * Every field is shape-checked so a malformed frame fails the boundary
 * instead of leaking into the page.
 */
 function parseLoginStatus(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) reject("status");
-	const source = value;
+	const source = record(value, "status");
 	const state = source.state;
-	if (state !== "idle" && state !== "waiting" && state !== "success" && state !== "failed") reject("state");
-	const status = { state };
-	if (source.authUrl !== void 0) {
-		if (typeof source.authUrl !== "string") reject("authUrl");
-		status.authUrl = source.authUrl;
-	}
-	if (source.userName !== void 0) {
-		if (typeof source.userName !== "string") reject("userName");
-		status.userName = source.userName;
-	}
-	if (source.keyName !== void 0) {
-		if (typeof source.keyName !== "string") reject("keyName");
-		status.keyName = source.keyName;
-	}
-	if (source.reason !== void 0) {
-		if (!REASONS.includes(source.reason)) reject("reason");
-		status.reason = source.reason;
-	}
-	if (source.message !== void 0) {
-		if (typeof source.message !== "string") reject("message");
-		status.message = source.message;
+	if (state === "idle" || state === "waiting" || state === "success" || state === "failed") {
+		const status = { state };
+		if (source.authUrl !== void 0) status.authUrl = stringField(source, "authUrl", "authUrl");
+		if (source.userName !== void 0) status.userName = stringField(source, "userName", "userName");
+		if (source.keyName !== void 0) status.keyName = stringField(source, "keyName", "keyName");
+		if (source.reason !== void 0) {
+			const reason = source.reason;
+			if (typeof reason === "string" && REASONS.includes(reason)) status.reason = reason;
+			else reject("reason");
+		}
+		if (source.message !== void 0) status.message = stringField(source, "message", "message");
+		return status;
 	}
-	return status;
+	return reject("state");
 }
 /** The strict result codec shared by all three login endpoints. */
 const loginStatusSchema = { parse: parseLoginStatus };
@@ -2424,10 +2898,11 @@ var CommandCodeUsageService = class extends TypertRemoteService {
 		}] };
 	}
 	/**
-	* The model catalog for the settings page's routing-rule editor. The
-	* browser never calls the Command Code API directly — the Host serves the
-	* catalog (already fetched/cached by the adapter) so rules can be picked
-	* from the live model list instead of typed by hand.
+	* The full model catalog for the settings page's model editors (the
+	* routing-rule editor and the visible-models filter). The browser never
+	* calls the Command Code API directly — the Host serves the catalog
+	* (already fetched/cached by the adapter) so models can be picked from
+	* the live list instead of typed by hand.
 	*/
 	async models() {
 		return this.deps.listModels?.() ?? { models: [] };
@@ -2739,12 +3214,15 @@ var CommandCodeLoginFlow = class {
 			});
 			return;
 		}
+		let bodyBytes = 0;
 		let body = "";
 		request.on("data", (chunk) => {
+			bodyBytes += chunk.length;
 			body += chunk.toString();
-			if (body.length > 1e4) request.destroy();
+			if (bodyBytes > 1e4) request.destroy();
 		});
 		request.on("end", () => {
+			if (request.destroyed) return;
 			let payload;
 			try {
 				payload = JSON.parse(body);
@@ -2880,21 +3358,86 @@ function corsOrigin(origin) {
 const COMMANDCODE_SEARCH_PROVIDER_ID = "commandcode";
 /**
 * The factory-declared search provider id dsh ships by default (from
-* `dsh-base`'s cordis patch `web.config.searchProvider`). A plugin that wants
-* its own backend to win rewrites `WebRuntime.searchProviderId` to its own id;
-* disabling that plugin restores this value.
+* `dsh-base`'s cordis patch `web.config.searchProvider`). Kept as a
+* documented reference only: disabling this plugin's `webSearch` toggle
+* restores the previously selected backend (see
+* {@link applyCommandCodeSearchSelection}) — it never forces this default,
+* because forcing it is what used to silence sibling search plugins such as
+* modsearch even with Command Code search turned off (issue #26).
 */
 const DEFAULT_WEB_SEARCH_PROVIDER_ID = "deepseek-official";
 /**
 * Point the web seam's search selection at this plugin's provider (`commandcode`).
 * Sets the runtime field; the next search call honours it because `search()`
 * re-reads `searchProviderId` each time. Returns the prior id (or undefined).
+* Never throws: a hardened/frozen runtime shape must not break the
+* settings-save path that calls this — the provider simply stays
+* registered-but-unselected (the boot-time `searchProvider: commandcode`
+* cordis patch is the durable alternative).
+*
+* @deprecated Prefer {@link applyCommandCodeSearchSelection}: this overload
+* always overwrites the displaced backend with the factory default on
+* disable, so turning Command Code search off silences whichever provider
+* was selected before (e.g. modsearch) instead of restoring it (issue #26).
 */
 function selectCommandCodeSearchProvider(web, enable) {
-	const field = web;
-	const prior = field.searchProviderId;
-	field.searchProviderId = enable ? COMMANDCODE_SEARCH_PROVIDER_ID : DEFAULT_WEB_SEARCH_PROVIDER_ID;
-	return prior;
+	try {
+		const field = web;
+		const prior = field.searchProviderId;
+		field.searchProviderId = enable ? COMMANDCODE_SEARCH_PROVIDER_ID : DEFAULT_WEB_SEARCH_PROVIDER_ID;
+		return prior;
+	} catch {
+		return;
+	}
+}
+/** Fresh selection state: the plugin starts out not owning the selection. */
+function commandCodeSearchSelection() {
+	return {
+		owner: false,
+		displaced: void 0
+	};
+}
+/**
+* Reach one end of the `webSearch` toggle without trampling sibling search
+* providers (issue #26).
+*
+* - Enabling writes `commandcode` and remembers whatever it displaced. When
+*   the plugin already owns the selection (e.g. a settings save while still
+*   on), the original `displaced` value is kept — the field currently holds
+*   our own id, which must never be mistaken for the user's backend.
+* - Disabling hands the selection back to the remembered backend. When the
+*   state holds no memory (a fresh boot straight into `webSearch: false`),
+*   the field is left alone: the runtime's current value — a sibling's
+*   cordis pin such as `searchProvider: modsearch`, or unset for
+*   auto-select — already says what the user wants.
+* - When the field already reads `commandcode` at first touch (e.g. a
+*   surviving runtime the plugin did not set, or a manual
+*   `searchProvider: commandcode` pin), `displaced` stays undefined so the
+*   later disable is a no-op rather than a guess at the factory default.
+*
+* Never throws: like the low-level rewrite, a hardened runtime shape degrades
+* to registered-but-unselected.
+*/
+function applyCommandCodeSearchSelection(web, state, enable) {
+	try {
+		const field = web;
+		if (enable) {
+			if (state.owner) {
+				field.searchProviderId = COMMANDCODE_SEARCH_PROVIDER_ID;
+				return;
+			}
+			const prior = field.searchProviderId;
+			state.displaced = prior === "commandcode" ? void 0 : prior;
+			field.searchProviderId = COMMANDCODE_SEARCH_PROVIDER_ID;
+			state.owner = true;
+			return;
+		}
+		if (state.owner) {
+			state.owner = false;
+			field.searchProviderId = state.displaced;
+			return;
+		}
+	} catch {}
 }
 /** Command Code's lower/upper bound on `numResults` (from the CLI's `web_search` schema). */
 const MIN_NUM_RESULTS = 1;
@@ -2945,7 +3488,7 @@ var CommandCodeSearchProvider = class {
 	constructor(deps) {
 		this.deps = deps;
 	}
-	/** Cheap local check; must not make network calls. Presence of a key path + a parseable base is enough. */
+	/** Cheap local check; must not make network calls. Presence of a parseable base is enough. */
 	available() {
 		const base = this.deps.apiBase();
 		return base.length > 0 && URL.canParse(base);
@@ -2992,6 +3535,8 @@ var CommandCodeSearchProvider = class {
 				}
 			} catch (error) {
 				if (signal?.aborted === true || isAbortError(error)) throw searchAborted(signal, error);
+				const slice = (await response.text().catch(() => "")).trim().slice(0, 200);
+				if (slice !== "") message += `: ${slice}`;
 			}
 			throw new WebError(message, "WEB_PROVIDER_ERROR");
 		}
@@ -3000,7 +3545,7 @@ var CommandCodeSearchProvider = class {
 			payload = await response.json();
 		} catch (error) {
 			if (signal?.aborted === true || isAbortError(error)) throw searchAborted(signal, error);
-			throw new WebError("Command Code web search returned an unparseable response body", "WEB_PROVIDER_ERROR");
+			throw new WebError("Command Code web search returned an unparseable response body", "WEB_PROVIDER_ERROR", { cause: error });
 		}
 		const results = payload?.results;
 		if (!Array.isArray(results)) throw new WebError("Command Code web search returned no results array (the server may have rejected the query)", "WEB_PROVIDER_ERROR");
@@ -3081,6 +3626,7 @@ const Config = z.object({
 	requestTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
 	streamIdleTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
 	filterModelsByPlan: z.boolean(),
+	visibleModels: z.array(z.string()),
 	webSearch: z.boolean().default(true),
 	accounts: z.array(z.object({
 		label: z.string(),
@@ -3108,7 +3654,8 @@ function resolveAdapterOptions(config) {
 		modelsCachePath: config.modelsCachePath ?? DEFAULT_MODELS_CACHE_PATH,
 		requestTimeoutMs: config.requestTimeoutMs ?? 6e4,
 		streamIdleTimeoutMs: config.streamIdleTimeoutMs ?? 3e5,
-		filterModelsByPlan: config.filterModelsByPlan ?? true
+		filterModelsByPlan: config.filterModelsByPlan ?? true,
+		visibleModels: Array.isArray(config.visibleModels) ? config.visibleModels.filter((id) => typeof id === "string" && id !== "") : void 0
 	};
 }
 function apply(ctx, config) {
@@ -3238,18 +3785,26 @@ function apply(ctx, config) {
 		}
 	});
 	ctx.effect(() => () => loginFlow.dispose(), "dsh-commandcode-provider: login flow");
-	const catalogForRules = async () => {
-		return { models: (await adapter.listModels(PROVIDER)).map((model) => ({
-			id: model.id,
-			name: model.name.replace(/\s*\(CC\)$/, "")
-		})) };
+	const catalogForEditors = async () => {
+		return { models: (await adapter.listModels(PROVIDER, { unfiltered: true })).map((model) => {
+			const tier = KNOWN_PLANS[model.id];
+			return {
+				id: model.id,
+				name: model.name.replace(/\s*\(CC\)$/, ""),
+				...tier === void 0 ? {} : { tier }
+			};
+		}) };
 	};
 	applyUsageRemote(ctx, {
 		adapter,
 		reports: usageReports,
 		login: loginFlow,
-		listModels: catalogForRules
+		listModels: catalogForEditors
 	});
+	const searchSelection = commandCodeSearchSelection();
+	const applySearchSelection = (enabled) => {
+		if (webRuntime !== void 0) applyCommandCodeSearchSelection(webRuntime, searchSelection, enabled);
+	};
 	let webRuntime;
 	ctx.inject(["web"], (webCtx) => {
 		webRuntime = webCtx.web;
@@ -3260,7 +3815,11 @@ function apply(ctx, config) {
 			},
 			apiBase: () => options().apiBase
 		}));
-		selectCommandCodeSearchProvider(webCtx.web, current().webSearch ?? true);
+		applySearchSelection(current().webSearch ?? true);
+		webCtx.effect(() => () => {
+			webRuntime = void 0;
+			applyCommandCodeSearchSelection(webCtx.web, searchSelection, false);
+		}, "dsh-commandcode-provider: web search selection");
 	});
 	ctx.inject(["settings"], (settingsCtx) => {
 		settingsCtx.settings.installSection(ctx, NS, Config, config, {
@@ -3268,12 +3827,12 @@ function apply(ctx, config) {
 				current = source;
 			},
 			onChange: () => {
-				if (webRuntime !== void 0) selectCommandCodeSearchProvider(webRuntime, current().webSearch ?? true);
+				applySearchSelection(current().webSearch ?? true);
 			}
 		});
 	});
 }
 //#endregion
-export { BILLING_ACCESS_TTL_MS, COMMANDCODE_SEARCH_PROVIDER_ID, COMMAND_CODE_CLI_VERSION, CommandCodeAccountPool, CommandCodeAdapter, CommandCodeLoginFlow, CommandCodeSearchProvider, CommandCodeUsageService, Config, DEFAULT_API_BASE, DEFAULT_GENERATE_MAX_TOKENS, DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_MODELS_CACHE_PATH, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_WEB_SEARCH_PROVIDER_ID, KNOWN_DEALS, KNOWN_EFFORTS, KNOWN_IMAGE_MODELS, KNOWN_PEAK_PRICING, KNOWN_PLANS, KNOWN_SUBSCRIPTION_PLANS, KNOWN_THINKING_MODELS, LOGIN_ALLOWED_ORIGINS, LOGIN_BEGIN_ENDPOINT, LOGIN_BODY_LIMIT_BYTES, LOGIN_CANCEL_ENDPOINT, LOGIN_MAX_PORT_ATTEMPTS, LOGIN_START_PORT, LOGIN_STATUS_ENDPOINT, LOGIN_TIMEOUT_MS, PLAN_LABELS, PLAN_ORDER, PROVIDER, USAGE_REPORT_ENDPOINT, accountUsable, apply, applyCommands, applyUsageRemote, buildCommandAuthUrl, capabilityDescription, commandDefinition, compareByPlan, dealLabel, formatContext, inject, loginStatusSchema, matchModelRule, modelVisibleInPlan, name, parseLoginStatus, peakPricingLabel, peakPricingState, planLabel, projectSlugFromPath, resolveAdapterOptions, resolveAuthFileApiKey, selectAccountForModel, selectActiveAccount, selectCommandCodeSearchProvider, studioBaseForApiBase, subscriptionPlanInfo, usageReportSchema, validateCommandApiKey };
+export { BILLING_ACCESS_TTL_MS, COMMANDCODE_SEARCH_PROVIDER_ID, COMMAND_CODE_CLI_VERSION, CommandCodeAccountPool, CommandCodeAdapter, CommandCodeLoginFlow, CommandCodeSearchProvider, CommandCodeUsageService, Config, DEFAULT_API_BASE, DEFAULT_GENERATE_MAX_TOKENS, DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_MODELS_CACHE_PATH, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_WEB_SEARCH_PROVIDER_ID, KNOWN_DEALS, KNOWN_EFFORTS, KNOWN_IMAGE_MODELS, KNOWN_PEAK_PRICING, KNOWN_PLANS, KNOWN_SUBSCRIPTION_PLANS, KNOWN_THINKING_MODELS, LOGIN_ALLOWED_ORIGINS, LOGIN_BEGIN_ENDPOINT, LOGIN_BODY_LIMIT_BYTES, LOGIN_CANCEL_ENDPOINT, LOGIN_MAX_PORT_ATTEMPTS, LOGIN_START_PORT, LOGIN_STATUS_ENDPOINT, LOGIN_TIMEOUT_MS, PLAN_LABELS, PLAN_ORDER, PROVIDER, USAGE_REPORT_ENDPOINT, accountUsable, apply, applyCommandCodeSearchSelection, applyCommands, applyUsageRemote, buildCommandAuthUrl, capabilityDescription, commandCodeSearchSelection, commandDefinition, compareByPlan, dealLabel, formatContext, inject, loginStatusSchema, matchModelRule, modelVisibleInPlan, name, parseLoginStatus, peakPricingLabel, peakPricingState, planLabel, projectSlugFromPath, resolveAdapterOptions, resolveAuthFileApiKey, selectAccountForModel, selectActiveAccount, selectCommandCodeSearchProvider, studioBaseForApiBase, subscriptionPlanInfo, usageReportSchema, validateCommandApiKey };
 
 //# sourceMappingURL=index.js.map