@mars-sea/dsh-commandcode-provider 0.10.6 → 0.11.1

package/lib/index.js

@@ -2,7 +2,7 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { MAX_TIMER_DELAY_MS } from "@deepseek-ai/dsh-timeout";
-import { LlmAdapter, LlmError, ReasoningEffortId, ToolCallId, assertUsableApiKey, attributionHeaders, errorChain, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
+import { CONTEXT_WINDOW_EXCEEDED_CODE, LlmAdapter, LlmError, ReasoningEffortId, ToolCallId, assertUsableApiKey, attributionHeaders, errorChain, isContextWindowExceededError, offloadRequestImagesWithPolicy, offloadedImageText, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
 import { launchEnvironmentOf } from "@deepseek-ai/dsh-launch-environment";
 import { existsSync, readFileSync } from "node:fs";
@@ -12,267 +12,6 @@ import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { createServer } from "node:http";
 import { createServer as createServer$1 } from "node:net";
 import { WebError } from "@deepseek-ai/dsh-web";
-//#region src/accounts.ts
-/**
-* Multi-account pool for the Command Code provider (host side).
-*
-* One Command Code subscription (e.g. the Go plan's 5-hour window) is
-* metered; a user with several subscriptions wants a request that hits one
-* account's limit to continue on the next account without a visible failure.
-* This module owns that rotation:
-*
-*   - {@link CommandCodeAccountPool.resolveKey} hands out the first account
-*     whose key is not currently marked exhausted — or, when the request's
-*     model matches a {@link CommandCodeModelAccountRule} and that account is
-*     usable, the routed account — resolving each slot's key lazily (literal
-*     config key → credential seam → launch environment → the official CLI
-*     auth file for the default slot only).
-*   - {@link CommandCodeAccountPool.markRejected} records a 429 (rate limit,
-*     window unknown) or 401 (invalid key, disabled until the config changes)
-*     against the exact API key, so several slots sharing one key share one
-*     state.
-*   - When every account is marked, the pool probes each key's
-*     `/alpha/billing/credits` window limits (through the injected
-*     {@link CommandCodeAccountPoolDeps.probeWindow}): an account whose window
-*     no longer reports `exceeded` is revived, otherwise the pool throws a
-*     `RATE_LIMIT` error naming the earliest reset time.
-*
-* The pool is deliberately cordis-free (like the adapter): every host fact
-* arrives through injected thunks, so node tests can drive it directly.
-*
-* @module dsh-commandcode-provider/accounts
-*/
-/**
-* Upper bound on the retry wait this pool attaches to the all-exhausted
-* `RATE_LIMIT` error. Must equal the `backoff.maxDelayMs` in the adapter's
-* `providerRetryPolicy` (which imports it from here): dsh-llm-retry honors a
-* provider-specified wait verbatim only at or below that cap — in normal mode
-* a LONGER attached wait makes the executor abandon the retry entirely
-* instead of falling back to local backoff, which would turn "poll until the
-* window opens" into "fail now".
-*/
-const RETRY_MAX_DELAY_MS = 9e5;
-/** A labeled, human-readable clock reading for error messages. */
-function clockLabel(ms) {
-	return new Date(ms).toLocaleString();
-}
-/**
-* Whether an account with this rotation state can serve a request right now.
-* `undefined` (never rejected) is usable; a cooldown becomes usable again
-* once its reset time passes; `unknown` (429, reset unprobed) and
-* `disabled` (401) are not.
-*/
-function accountUsable(state) {
-	if (state === void 0) return true;
-	if (state.kind === "cooldown") return state.until > 0 && Date.now() >= state.until;
-	return false;
-}
-/**
-* Pick the account that should serve now: the manually preferred slot when it
-* is usable, otherwise the first usable account in rotation order; undefined
-* when no account is usable. Shared by the pool (request path) and the plugin
-* entry (the usage view's active badge) so both always agree.
-*/
-function selectActiveAccount(accounts, preferredId) {
-	const usable = accounts.filter((account) => accountUsable(account.state));
-	if (preferredId !== void 0) {
-		const preferred = usable.find((account) => account.slot.id === preferredId);
-		if (preferred !== void 0) return preferred;
-	}
-	return usable[0];
-}
-/**
-* The first routing rule whose model list contains the request's model id.
-* Undefined when no rule matches.
-*/
-function matchModelRule(model, rules) {
-	if (model === "" || rules === void 0 || rules.length === 0) return void 0;
-	for (const rule of rules) if (rule.models.includes(model)) return rule;
-}
-/**
-* The routed account for a request's model: the first usable account whose
-* slot id matches the first matching rule's target. Undefined when no rule
-* matches or the routed account is not usable (the caller then falls back to
-* the normal preferred/rotation selection).
-*/
-function selectAccountForModel(accounts, model, rules) {
-	const rule = matchModelRule(model, rules);
-	if (rule === void 0) return void 0;
-	return accounts.find((account) => account.slot.id === rule.account && accountUsable(account.state));
-}
-/**
-* The account pool. Rotation state is keyed by API key (never logged), so two
-* slots resolving to the same credential share one mark, and a key changed in
-* the credentials service starts with a clean slate.
-*/
-var CommandCodeAccountPool = class {
-	deps;
-	/** Rotation state by API key. */
-	states = /* @__PURE__ */ new Map();
-	constructor(deps) {
-		this.deps = deps;
-	}
-	/**
-	* Resolve every slot's key, deduplicated by key (first slot wins). Slots
-	* without any resolvable key are omitted — they still appear in the
-	* settings page as unconfigured, they just cannot serve requests.
-	*/
-	async resolvedAccounts() {
-		const out = [];
-		const seen = /* @__PURE__ */ new Set();
-		for (const slot of this.deps.slots()) {
-			const key = await this.resolveSlotKey(slot);
-			if (key === void 0 || seen.has(key)) continue;
-			seen.add(key);
-			out.push({
-				slot,
-				key,
-				state: this.states.get(key)
-			});
-		}
-		return out;
-	}
-	/**
-	* Every slot paired with its resolved key and rotation state — NOT
-	* deduplicated: two slots sharing one credential both appear (the usage
-	* view reports them individually), while slots without any resolvable key
-	* are omitted. The serving path uses {@link resolvedAccounts} instead.
-	*/
-	async describeAccounts() {
-		const out = [];
-		for (const slot of this.deps.slots()) {
-			const key = await this.resolveSlotKey(slot);
-			if (key === void 0) continue;
-			out.push({
-				slot,
-				key,
-				state: this.states.get(key)
-			});
-		}
-		return out;
-	}
-	/**
-	* Hand out the key for a request: the model-routed account when the
-	* request's model matches a rule (and that account is usable), else the
-	* manually preferred account when usable, else the first usable account in
-	* rotation order. Returns `undefined` when no account resolves any key at
-	* all (the caller then reports the missing credential). Throws
-	* `RATE_LIMIT` — naming the earliest window reset — or
-	* `INVALID_CREDENTIAL` when accounts exist but none can serve.
-	*
-	* `options.model` is the request's model id; routing rules re-read per
-	* resolution, so a settings change applies live.
-	*
-	* `options.exclude` skips one key during the probe-revival pass: the
-	* rotation hook excludes the just-rejected key so a probe that clears its
-	* window cannot re-offer the same key within the same request (the adapter
-	* refuses already-tried keys; the next request picks the revived key up).
-	*/
-	async resolveKey(options) {
-		const accounts = await this.resolvedAccounts();
-		if (accounts.length === 0) return;
-		const routed = selectAccountForModel(accounts, options?.model ?? "", this.deps.modelAccountRules?.());
-		if (routed !== void 0) return this.pick(routed);
-		const preferred = this.deps.preferredId?.();
-		const chosen = selectActiveAccount(accounts, preferred);
-		if (chosen !== void 0) return this.pick(chosen);
-		await Promise.all(accounts.map(async (account) => {
-			if (account.state?.kind === "disabled") return;
-			if (options?.exclude !== void 0 && account.key === options.exclude) return;
-			let probe;
-			try {
-				probe = await this.deps.probeWindow(account.key);
-			} catch {
-				return;
-			}
-			if (probe === void 0) return;
-			if (!probe.exceeded) this.states.delete(account.key);
-			else this.states.set(account.key, {
-				kind: "cooldown",
-				reason: account.state?.reason ?? "rate limited (429)",
-				until: probe.resetAt
-			});
-		}));
-		const latest = await this.resolvedAccounts();
-		const revived = selectActiveAccount(latest, preferred);
-		if (revived !== void 0) return this.pick(revived);
-		if (latest.filter((account) => account.state?.kind === "disabled").length === latest.length) throw new LlmError(`llm-commandcode: every configured Command Code account (${latest.length}) was rejected with 401 — check the stored API keys (Models page / settings) or the auth file；已配置的 ${latest.length} 个 Command Code 账户密钥均被拒绝（401）——请在设置页检查存储的 API 密钥，或重新运行 command-code login`, "INVALID_CREDENTIAL");
-		const resets = latest.map((account) => account.state).filter((state) => state !== void 0 && state.kind === "cooldown" && state.until > 0).map((state) => state.until);
-		const earliest = resets.length > 0 ? Math.min(...resets) : 0;
-		const wait = earliest > 0 ? Math.max(1e3, earliest - Date.now()) : 0;
-		throw new LlmError(`llm-commandcode: all ${latest.length} Command Code account(s) have exhausted their usage window` + (earliest > 0 ? `; the earliest window resets at ${clockLabel(earliest)}` : "") + ` — requests will succeed again after the reset (or add another account)；已用尽全部 ${latest.length} 个 Command Code 账户的用量窗口` + (earliest > 0 ? `，最早的重置时间为 ${clockLabel(earliest)}` : "") + "——窗口重置后请求会自动恢复（也可以添加更多账户）", "RATE_LIMIT", wait > 0 && wait <= 9e5 ? { providerRetryAfterMs: wait } : void 0);
-	}
-	/**
-	* Record a rejection against one key. `rate-limit` (429) marks the key
-	* exhausted with an unknown reset (probed lazily at the next resolution
-	* once every account is marked); `invalid-credential` (401) disables the
-	* key until the stored credential changes.
-	*/
-	markRejected(apiKey, rejection) {
-		if (rejection === "invalid-credential") this.states.set(apiKey, {
-			kind: "disabled",
-			reason: "invalid API key (401)",
-			until: 0
-		});
-		else this.states.set(apiKey, {
-			kind: "unknown",
-			reason: "rate limited (429)",
-			until: 0
-		});
-	}
-	/**
-	* One account's key: literal → credential seam → auth file (default slot).
-	*
-	* Every source is normalized here, at the single point where a slot's key
-	* enters the pool. The adapter sends the key through the harness's
-	* `assertUsableApiKey()`, which trims it — a stored key from the credentials
-	* seam, a `.env` line, or a shell export all pick up surrounding whitespace
-	* — and reports that trimmed form back to `markRejected()`. Returning the
-	* raw value would file every 429/401 mark under a key no later lookup can
-	* find: rotation would re-offer the same account, the account card would show
-	* no mark, and the usage endpoints would 401 while chat kept working.
-	* Normalizing once makes resolution, probing, marking, and the request path
-	* agree on one string.
-	*/
-	async resolveSlotKey(slot) {
-		if (slot.literal !== void 0) {
-			const literal = normalizeResolvedKey(slot.literal);
-			if (literal !== void 0) return literal;
-		}
-		if (slot.ref !== void 0) {
-			const hit = await this.deps.resolveRef(slot.ref);
-			if (hit !== void 0) {
-				const resolved = normalizeResolvedKey(hit);
-				if (resolved !== void 0) return resolved;
-			}
-		}
-		if (slot.allowAuthFile) {
-			const fromFile = this.deps.authFileKey();
-			if (fromFile !== void 0) {
-				const fileKey = normalizeResolvedKey(fromFile);
-				if (fileKey !== void 0) return fileKey;
-			}
-		}
-	}
-	/** Hand out the chosen account's key. */
-	pick(account) {
-		return {
-			key: account.key,
-			slot: account.slot
-		};
-	}
-};
-/**
-* Normalize one resolved credential to the form every consumer sees. Trim
-* only: a blank-after-trim value means "no key" (the slot is omitted and the
-* caller reports `MISSING_CREDENTIAL`), while characters an HTTP header cannot
-* carry are left for `assertUsableApiKey()` to reject with its own message.
-*/
-function normalizeResolvedKey(value) {
-	const trimmed = value.trim();
-	return trimmed === "" ? void 0 : trimmed;
-}
-//#endregion
 //#region src/capabilities.ts
 /**
 * Static capability snapshot for the Command Code provider: model →
@@ -751,268 +490,1586 @@ const PLAN_LABELS = {
 	max: "Max"
 };
 /**
-* Plan-tier sort weights, low to high. Models outside the snapshot (unknown
-* plans) sort after every known tier, keeping known models predictable.
+* Plan-tier sort weights, low to high. Models outside the snapshot (unknown
+* plans) sort after every known tier, keeping known models predictable.
+*/
+const PLAN_ORDER = {
+	go: 0,
+	goat: 1,
+	pro: 2,
+	provider: 3,
+	max: 4
+};
+/**
+* Whether a model is free (requests cost no credits), per the pricing page's
+* deals (`KNOWN_DEALS` `free: true`). Free models lead the picker regardless
+* of tier — they are usable by every account, so they are the best default
+* candidates.
+*/
+function isFreeModel(modelId) {
+	return KNOWN_DEALS[modelId]?.free === true;
+}
+/**
+* Comparator for the model picker: free models first (zero credit cost, usable
+* by every account), then by plan tier (lowest first), then by model name,
+* then by id as a tiebreak. Models with no known plan sort last.
+*/
+function compareByPlan(a, b) {
+	const freeDelta = Number(isFreeModel(b.id)) - Number(isFreeModel(a.id));
+	if (freeDelta !== 0) return freeDelta;
+	const pa = PLAN_ORDER[KNOWN_PLANS[a.id] ?? ""] ?? Number.MAX_SAFE_INTEGER;
+	const pb = PLAN_ORDER[KNOWN_PLANS[b.id] ?? ""] ?? Number.MAX_SAFE_INTEGER;
+	if (pa !== pb) return pa - pb;
+	const nameDiff = a.name.localeCompare(b.name);
+	if (nameDiff !== 0) return nameDiff;
+	return a.id.localeCompare(b.id);
+}
+/**
+* Subscription plan table, synced from the official CLI bundle's plan maps
+* (located by the `"individual-go"` key in command-code@1.53.0 `dist/cli.mjs`,
+* re-verified unchanged through 1.53.0): subscription `planId`
+* prefix → display name and the plan's monthly credit total. This is the
+* account's own subscription (from `/alpha/billing/subscriptions`) — distinct
+* from {@link KNOWN_PLANS}, which maps catalog models to their minimum tier.
+*
+* `tierWeight` is plugin-added (not from the CLI maps): the plan's rank on
+* the {@link PLAN_ORDER} scale, used by the picker's plan filter
+* ({@link modelVisibleInPlan}) to hide models above the account's tier.
+*/
+const KNOWN_SUBSCRIPTION_PLANS = {
+	"individual-go": {
+		name: "Go",
+		monthlyCredits: 10,
+		tierWeight: 0
+	},
+	"individual-goat": {
+		name: "GOAT",
+		monthlyCredits: 70,
+		tierWeight: 1
+	},
+	"individual-pro": {
+		name: "Pro",
+		monthlyCredits: 30,
+		tierWeight: 2
+	},
+	"individual-pro-v1": {
+		name: "Pro",
+		monthlyCredits: 80,
+		tierWeight: 2
+	},
+	"individual-provider": {
+		name: "Provider",
+		monthlyCredits: 15,
+		tierWeight: 3
+	},
+	"individual-max": {
+		name: "Max",
+		monthlyCredits: 150,
+		tierWeight: 4
+	},
+	"individual-ultra": {
+		name: "Ultra",
+		monthlyCredits: 300,
+		tierWeight: 4
+	},
+	"teams-pro": {
+		name: "Teams Pro",
+		monthlyCredits: 40,
+		tierWeight: 2
+	}
+};
+/** Plan-id prefixes, longest first — the CLI's prefix-match order. */
+const SUBSCRIPTION_PLAN_PREFIXES = Object.keys(KNOWN_SUBSCRIPTION_PLANS).sort((a, b) => b.length - a.length);
+/**
+* Resolve a subscription `planId` (e.g. `individual-pro-v1`) to its display
+* name and monthly credit total, mirroring the CLI's `getPlanInfo`:
+* normalize (lowercase, `_` → `-`), then longest-prefix match so
+* `individual-pro-v1` wins over `individual-pro`. Unknown ids return
+* `undefined`.
+*/
+function subscriptionPlanInfo(planId) {
+	const normalized = planId.toLowerCase().replace(/_/g, "-");
+	const prefix = SUBSCRIPTION_PLAN_PREFIXES.find((candidate) => normalized.startsWith(candidate));
+	return prefix === void 0 ? void 0 : KNOWN_SUBSCRIPTION_PLANS[prefix];
+}
+/**
+* Whether the picker lists `modelId` for an account with the given billing
+* access. Fails open at every uncertainty: no billing data, an unknown plan,
+* a non-finite weight (corrupt billing fact), or a model outside
+* {@link KNOWN_PLANS} all keep the model visible — the server remains the
+* final gate (`403 MODEL_NOT_IN_PLAN`).
+*/
+function modelVisibleInPlan(modelId, access) {
+	if (access === void 0) return true;
+	if (access.onDemandCredits > 0) return true;
+	if (access.tierWeight === void 0 || !Number.isFinite(access.tierWeight)) return true;
+	const tier = KNOWN_PLANS[modelId];
+	if (tier === void 0) return true;
+	const weight = PLAN_ORDER[tier];
+	if (weight === void 0) return true;
+	return weight <= access.tierWeight;
+}
+const KNOWN_DEALS = {
+	"MiniMaxAI/MiniMax-M3": { label: "50% off" },
+	"xiaomi/mimo-v2.5-pro": { label: "99% off" },
+	"xiaomi/mimo-v2.5": { label: "98% off" },
+	"poolside/laguna-s-2.1-free": {
+		label: "FREE",
+		free: true
+	},
+	"meituan/LongCat-2.0:free": {
+		label: "FREE",
+		free: true
+	},
+	"inclusionai/ling-3.0-flash-sante:free": {
+		label: "FREE",
+		free: true
+	}
+};
+/**
+* Models with time-of-day (peak/off-peak) pricing, per the official pricing
+* page (`/docs/resources/pricing-limits`). Since 2026-08-16 16:00 UTC, DeepSeek
+* charges by the hour: peak hours are 01:00–04:00 and 06:00–10:00 UTC (7h per
+* weekday, full price) **Monday to Friday only**; the other 17 hours of a
+* weekday and every hour of Saturday/Sunday (UTC) are off-peak at half price.
+* The V4 Flash Vision (exp) variant (command-code@1.32.0) shares the V4 Flash
+* rates exactly — $0.15/$0.60 off-peak and $0.30/$1.20 peak, per the page's own
+* `timeOfDay` block, not merely 2× its own off-peak figures: a rate that is
+* internally consistent can still be the wrong row, which is why the vendored
+* price table (`./model-prices.ts`) is synced from the page and not hand-kept.
+* The picker shows the
+* *current* state as a compact
+* label (`Peak`/`Half`) matching the English noun style of the other markers
+* (`Image`, `FREE`), so a developer can tell at a glance whether calling the
+* model right now is cheap or expensive.
+*
+* Authoritative extraction: the pricing page embeds a model JSON array whose
+* hourly-priced entries carry a `timeOfDay` block
+* (`{ windows: "01–04 & 06–10 UTC, Mon–Fri", peakHoursPerDay: 7,
+* offPeakHoursPerDay: 17, peak: {...}, offPeak: {...} }`). Exactly four models
+* carry it: V4 Pro, V4 Flash, V4 Flash Vision (exp), and V4.1 Flash (added in
+* command-code@1.53.0 at $0.15/$0.60 off-peak, $0.30/$1.20 peak — the same
+* schedule as the other three).
+*
+* Extraction caution: the rendered HTML rows are a trap. Each annotation div
+* sits inside its OWN row's container, immediately before the NEXT row starts,
+* so flattening the page to text makes every annotation look like it belongs
+* to the model printed after it — that is how `deepseek/deepseek-v4-flash-fast`
+* was wrongly added here (its row is flat-priced at $0.28/$0.56/$0.07 and has
+* no `timeOfDay` block). Trust the embedded JSON's `timeOfDay` membership and
+* the 2× price relation, never the flat-text neighbor.
+*
+* Keep in sync with the official pricing page when the model set, the peak
+* windows, or the weekday rule change (see the dsh-commandcode-upstream skill).
+*/
+const KNOWN_PEAK_PRICING = /* @__PURE__ */ new Set([
+	"deepseek/deepseek-v4-pro",
+	"deepseek/deepseek-v4-flash",
+	"deepseek/deepseek-v4-flash-vision-exp",
+	"deepseek/deepseek-v4.1-flash"
+]);
+/**
+* Peak hours (UTC, hour-of-day range end-exclusive): 01–03 and 06–09.
+* Weekday-only — see `peakPricingState()`; weekends are fully off-peak.
+*
+* Exported because the vendored price table (`./model-prices.ts`) ships these
+* windows to the browser with the table itself: the composer prices a session
+* against the very schedule this snapshot knows rather than restating it, so
+* there is one place to update when the windows move.
+*/
+const PEAK_HOUR_RANGES = [[1, 4], [6, 10]];
+/**
+* Whether `now` (defaults to `Date.now()`) falls inside a peak-pricing window,
+* ignoring which model is asking. Peak rates apply Monday–Friday (UTC) only,
+* so a weekend timestamp is off-peak even inside {@link PEAK_HOUR_RANGES}.
+*
+* Model-independent on purpose: `peakPricingState()` adds the membership test
+* on top for the picker's label, while the price table selects peak rates from
+* a row's own `peak` block — so a model whose catalog id spelling differs from
+* the one in {@link KNOWN_PEAK_PRICING} still gets the right half of the day.
+*/
+function isPeakPricingHour(now = Date.now()) {
+	const at = new Date(now);
+	const day = at.getUTCDay();
+	if (day === 0 || day === 6) return false;
+	const hour = at.getUTCHours();
+	return PEAK_HOUR_RANGES.some(([start, end]) => hour >= start && hour < end);
+}
+/**
+* Whether `now` (defaults to `Date.now()`) falls in a peak-pricing window for
+* time-of-day-priced models. Peak rates apply Monday–Friday (UTC) only: the
+* official rule charges Saturday and Sunday completely off-peak for all 24
+* hours, so a weekend timestamp is off-peak even inside `PEAK_HOUR_RANGES`.
+* `undefined` for models outside the snapshot.
+*/
+function peakPricingState(modelId, now = Date.now()) {
+	if (!KNOWN_PEAK_PRICING.has(modelId)) return void 0;
+	return isPeakPricingHour(now) ? "peak" : "off-peak";
+}
+/**
+* Compact label for the current peak/off-peak state: `Peak` (full price) or
+* `Half` (off-peak, half price). These English nouns match the picker's other
+* markers (`Go`, `Image`, `FREE`), and since they appear only on time-of-day
+* priced models they double as a "priced by the hour" signal. Returns undefined
+* for models without time-of-day pricing.
 */
-const PLAN_ORDER = {
-	go: 0,
-	goat: 1,
-	pro: 2,
-	provider: 3,
-	max: 4
-};
+function peakPricingLabel(modelId, now = Date.now()) {
+	const state = peakPricingState(modelId, now);
+	if (state === void 0) return void 0;
+	return state === "peak" ? "Peak" : "Half";
+}
 /**
-* Whether a model is free (requests cost no credits), per the pricing page's
-* deals (`KNOWN_DEALS` `free: true`). Free models lead the picker regardless
-* of tier — they are usable by every account, so they are the best default
-* candidates.
+* Official display label for a model's minimum plan, or undefined for models
+* outside the snapshot (e.g. future catalog additions).
 */
-function isFreeModel(modelId) {
-	return KNOWN_DEALS[modelId]?.free === true;
+function planLabel(modelId) {
+	const plan = KNOWN_PLANS[modelId];
+	return plan === void 0 ? void 0 : PLAN_LABELS[plan];
 }
 /**
-* Comparator for the model picker: free models first (zero credit cost, usable
-* by every account), then by plan tier (lowest first), then by model name,
-* then by id as a tiebreak. Models with no known plan sort last.
+* The active deal label for a model, or undefined when the model has no deal
+* or the deal has expired. Expiry is judged against `now` (defaults to
+* `Date.now()`), so a snapshot that has gone stale stops showing its discount
+* the moment the official end date passes — the user never believes a lapsed
+* deal is still live. Permanent deals (no `expiresAt`) never lapse.
 */
-function compareByPlan(a, b) {
-	const freeDelta = Number(isFreeModel(b.id)) - Number(isFreeModel(a.id));
-	if (freeDelta !== 0) return freeDelta;
-	const pa = PLAN_ORDER[KNOWN_PLANS[a.id] ?? ""] ?? Number.MAX_SAFE_INTEGER;
-	const pb = PLAN_ORDER[KNOWN_PLANS[b.id] ?? ""] ?? Number.MAX_SAFE_INTEGER;
-	if (pa !== pb) return pa - pb;
-	const nameDiff = a.name.localeCompare(b.name);
-	if (nameDiff !== 0) return nameDiff;
-	return a.id.localeCompare(b.id);
+function dealLabel(modelId, now = Date.now()) {
+	const deal = KNOWN_DEALS[modelId];
+	if (deal === void 0) return void 0;
+	if (deal.expiresAt !== void 0 && now >= Date.parse(deal.expiresAt)) return void 0;
+	return deal.label;
 }
 /**
-* Subscription plan table, synced from the official CLI bundle's plan maps
-* (located by the `"individual-go"` key in command-code@1.53.0 `dist/cli.mjs`,
-* re-verified unchanged through 1.53.0): subscription `planId`
-* prefix → display name and the plan's monthly credit total. This is the
-* account's own subscription (from `/alpha/billing/subscriptions`) — distinct
-* from {@link KNOWN_PLANS}, which maps catalog models to their minimum tier.
+* Compact human-readable context window, e.g. `1_000_000 -> "1M"`,
+* `256_000 -> "256K"`, `262_144 -> "262K"` (floor to the nearest K).
+* Returns undefined for unknown/absent sizes; values under 1K render raw.
+*/
+function formatContext(contextWindow) {
+	if (contextWindow === void 0 || !Number.isFinite(contextWindow) || contextWindow <= 0) return;
+	if (contextWindow >= 1e6) {
+		const m = contextWindow / 1e6;
+		const rounded = Math.round(m * 10) / 10;
+		return `${Number.isInteger(rounded) ? rounded : rounded.toFixed(1)}M`;
+	}
+	if (contextWindow < 1e3) return String(Math.floor(contextWindow));
+	return `${Math.floor(contextWindow / 1e3)}K`;
+}
+/**
+* Compact one-line summary for the model picker: plan tier, then any active
+* deal (discount or FREE), then the current peak/off-peak state (`Peak`/`Half`)
+* for time-of-day-priced models, then `Image` for Vision-capable models, then
+* the context window. Text-only models simply omit the Image marker — "Text
+* only" adds nothing the picker needs to show.
+*/
+function capabilityDescription(modelId, contextWindow, now = Date.now()) {
+	const parts = [];
+	const plan = planLabel(modelId);
+	if (plan !== void 0) parts.push(plan);
+	const deal = dealLabel(modelId, now);
+	if (deal !== void 0) parts.push(deal);
+	const peak = peakPricingLabel(modelId, now);
+	if (peak !== void 0) parts.push(peak);
+	if (KNOWN_IMAGE_MODELS.has(modelId)) parts.push("Image");
+	const ctx = formatContext(contextWindow);
+	if (ctx !== void 0) parts.push(ctx);
+	return parts.join(" · ");
+}
+//#endregion
+//#region src/model-prices.ts
+/**
+* Every price row the page publishes, ordered by its own slug.
 *
-* `tierWeight` is plugin-added (not from the CLI maps): the plan's rank on
-* the {@link PLAN_ORDER} scale, used by the picker's plan filter
-* ({@link modelVisibleInPlan}) to hide models above the account's tier.
+* Note on the GPT rows: `gpt-5.3-codex`, `gpt-5.4`, `gpt-5.4-mini` and
+* `gpt-5.5` carry a LITERAL `cacheWriteCost: 0` — a different fact from a
+* missing key, because `ratesOf()` keeps it and the readout then charges
+* cache writes at zero instead of reporting them unpriced. That is what the
+* page's JSON says; its rendered column shows `—` for exactly these four while
+* rendering a genuine zero as `$0.00` elsewhere, so the page contradicts
+* itself. The table stays faithful to the machine-readable source and the
+* discrepancy is recorded in AGENTS.md rather than papered over here.
 */
-const KNOWN_SUBSCRIPTION_PLANS = {
-	"individual-go": {
-		name: "Go",
-		monthlyCredits: 10,
-		tierWeight: 0
+const MODEL_PRICE_ROWS = [
+	{
+		id: "claude-fable-5",
+		rates: [
+			10,
+			50,
+			1,
+			12.5
+		]
 	},
-	"individual-goat": {
-		name: "GOAT",
-		monthlyCredits: 70,
-		tierWeight: 1
+	{
+		id: "claude-fable-5-1",
+		rates: [
+			10,
+			50,
+			.25,
+			12.5
+		]
 	},
-	"individual-pro": {
-		name: "Pro",
-		monthlyCredits: 30,
-		tierWeight: 2
+	{
+		id: "claude-haiku-4-5",
+		rates: [
+			1,
+			5,
+			.1,
+			1.25
+		]
+	},
+	{
+		id: "claude-opus-4-6",
+		rates: [
+			5,
+			25,
+			.5,
+			6.25
+		]
+	},
+	{
+		id: "claude-opus-4-7",
+		rates: [
+			5,
+			25,
+			.5,
+			6.25
+		]
+	},
+	{
+		id: "claude-opus-4-8",
+		rates: [
+			5,
+			25,
+			.5,
+			6.25
+		]
+	},
+	{
+		id: "claude-opus-5",
+		rates: [
+			5,
+			25,
+			.5,
+			6.25
+		]
+	},
+	{
+		id: "claude-sonnet-4-6",
+		rates: [
+			3,
+			15,
+			.3,
+			3.75
+		]
+	},
+	{
+		id: "claude-sonnet-5",
+		rates: [
+			2,
+			10,
+			.2,
+			2.5
+		]
+	},
+	{
+		id: "deepseek-v4-flash",
+		rates: [
+			.15,
+			.6,
+			.003
+		],
+		peak: [
+			.3,
+			1.2,
+			.006
+		]
+	},
+	{
+		id: "deepseek-v4-flash-fast",
+		rates: [
+			.28,
+			.56,
+			.07
+		]
+	},
+	{
+		id: "deepseek-v4-flash-vision-exp",
+		rates: [
+			.15,
+			.6,
+			.003
+		],
+		peak: [
+			.3,
+			1.2,
+			.006
+		]
+	},
+	{
+		id: "deepseek-v4-pro",
+		rates: [
+			.66,
+			1.98,
+			.022
+		],
+		peak: [
+			1.32,
+			3.96,
+			.044
+		]
+	},
+	{
+		id: "deepseek-v4.1-flash",
+		rates: [
+			.15,
+			.6,
+			.003
+		],
+		peak: [
+			.3,
+			1.2,
+			.006
+		]
+	},
+	{
+		id: "fugu-ultra",
+		rates: [
+			5,
+			30,
+			.5
+		]
+	},
+	{
+		id: "gemini-3.1-flash-lite",
+		rates: [
+			.25,
+			1.5,
+			.03
+		]
+	},
+	{
+		id: "gemini-3.5-flash",
+		rates: [
+			1.5,
+			9,
+			.15
+		]
+	},
+	{
+		id: "gemini-3.5-flash-lite",
+		rates: [
+			.3,
+			2.5,
+			.03
+		]
+	},
+	{
+		id: "gemini-3.6-flash",
+		rates: [
+			1.5,
+			7.5,
+			.15
+		]
+	},
+	{
+		id: "gemini-3.7-flash",
+		rates: [
+			1.5,
+			7.5,
+			.15,
+			.08334
+		]
+	},
+	{
+		id: "gemini-3.8-flash",
+		rates: [
+			1.5,
+			7.5,
+			.15
+		]
+	},
+	{
+		id: "glm-5",
+		rates: [
+			1,
+			3.2,
+			.2
+		]
+	},
+	{
+		id: "glm-5.1",
+		rates: [
+			1.4,
+			4.4,
+			.26
+		]
+	},
+	{
+		id: "glm-5.2",
+		rates: [
+			1.4,
+			4.4,
+			.26
+		]
+	},
+	{
+		id: "glm-5.2-fast",
+		rates: [
+			3,
+			10.25,
+			.5
+		]
+	},
+	{
+		id: "glm-5.3",
+		rates: [
+			1.4,
+			4.4,
+			.26
+		]
+	},
+	{
+		id: "glm-5.3-flash",
+		rates: [
+			.15,
+			.5,
+			.03
+		]
+	},
+	{
+		id: "gpt-5.3-codex",
+		rates: [
+			2,
+			8,
+			.5,
+			0
+		]
+	},
+	{
+		id: "gpt-5.4",
+		rates: [
+			2.5,
+			15,
+			.25,
+			0
+		]
+	},
+	{
+		id: "gpt-5.4-mini",
+		rates: [
+			.75,
+			4.5,
+			.075,
+			0
+		]
+	},
+	{
+		id: "gpt-5.5",
+		rates: [
+			5,
+			30,
+			.5,
+			0
+		]
+	},
+	{
+		id: "gpt-5.6-luna",
+		rates: [
+			.2,
+			1.2,
+			.02,
+			.25
+		],
+		contextTiers: [{
+			"maxContext": 272e3,
+			"rates": [
+				.2,
+				1.2,
+				.02,
+				.25
+			]
+		}, { "rates": [
+			.4,
+			1.8,
+			.04,
+			.5
+		] }]
+	},
+	{
+		id: "gpt-5.6-sol",
+		rates: [
+			5,
+			30,
+			.5,
+			6.25
+		],
+		contextTiers: [{
+			"maxContext": 272e3,
+			"rates": [
+				5,
+				30,
+				.5,
+				6.25
+			]
+		}, { "rates": [
+			10,
+			45,
+			1,
+			12.5
+		] }]
+	},
+	{
+		id: "gpt-5.6-terra",
+		rates: [
+			2,
+			12,
+			.2,
+			2.5
+		],
+		contextTiers: [{
+			"maxContext": 272e3,
+			"rates": [
+				2,
+				12,
+				.2,
+				2.5
+			]
+		}, { "rates": [
+			4,
+			18,
+			.4,
+			5
+		] }]
+	},
+	{
+		id: "gpt-6-astra",
+		rates: [
+			10,
+			50,
+			1,
+			12.5
+		],
+		contextTiers: [{
+			"maxContext": 272e3,
+			"rates": [
+				10,
+				50,
+				1,
+				12.5
+			]
+		}, { "rates": [
+			20,
+			75,
+			2,
+			25
+		] }]
+	},
+	{
+		id: "grok-4.5",
+		rates: [
+			2,
+			6,
+			.5
+		]
+	},
+	{
+		id: "grok-4.6",
+		rates: [
+			2,
+			6,
+			.5
+		],
+		contextTiers: [{
+			"maxContext": 2e5,
+			"rates": [
+				2,
+				6,
+				.5
+			]
+		}, { "rates": [
+			4,
+			12,
+			1
+		] }]
+	},
+	{
+		id: "inkling",
+		rates: [
+			1,
+			4.05,
+			.17
+		]
+	},
+	{
+		id: "inkling-small",
+		rates: [
+			.5,
+			1.2,
+			.1
+		]
+	},
+	{
+		id: "kimi-k2.5",
+		rates: [
+			.6,
+			3,
+			.1
+		]
+	},
+	{
+		id: "kimi-k2.6",
+		rates: [
+			.95,
+			4,
+			.16
+		]
+	},
+	{
+		id: "kimi-k2.7-code",
+		rates: [
+			.95,
+			4,
+			.19
+		]
+	},
+	{
+		id: "kimi-k2.7-code-highspeed",
+		rates: [
+			1.9,
+			8,
+			.38
+		]
+	},
+	{
+		id: "kimi-k3",
+		rates: [
+			3,
+			15,
+			.3
+		]
+	},
+	{
+		id: "mimo-v2.5",
+		rates: [
+			.14,
+			.28,
+			.0028
+		]
+	},
+	{
+		id: "mimo-v2.5-pro",
+		rates: [
+			.435,
+			.87,
+			.0036
+		]
+	},
+	{
+		id: "minimax-m2.5",
+		rates: [
+			.3,
+			1.2,
+			.03
+		]
+	},
+	{
+		id: "minimax-m2.7",
+		rates: [
+			.3,
+			1.2,
+			.06
+		]
+	},
+	{
+		id: "minimax-m3",
+		rates: [
+			.3,
+			1.2,
+			.06
+		]
+	},
+	{
+		id: "muse-spark-1.1",
+		rates: [
+			1.25,
+			4.25,
+			.15
+		]
+	},
+	{
+		id: "muse-spark-1.2",
+		rates: [
+			1.25,
+			4.25,
+			.15
+		]
+	},
+	{
+		id: "muse-spark-1.2-contributor",
+		rates: [
+			.1,
+			.2,
+			.002
+		]
+	},
+	{
+		id: "muse-spark-1.3",
+		rates: [
+			1.25,
+			4.25,
+			.15
+		]
+	},
+	{
+		id: "muse-spark-1.3-contributor",
+		rates: [
+			.1,
+			.2,
+			.002
+		]
+	},
+	{
+		id: "nemotron-3-ultra",
+		rates: [
+			.6,
+			2.4,
+			.12
+		]
+	},
+	{
+		id: "qwen-3.6-max",
+		rates: [
+			1.3,
+			7.8,
+			.26,
+			1.63
+		]
+	},
+	{
+		id: "qwen-3.6-plus",
+		rates: [
+			.5,
+			3,
+			.1
+		],
+		contextTiers: [{
+			"maxContext": 256e3,
+			"rates": [
+				.5,
+				3,
+				.1
+			]
+		}, { "rates": [
+			2,
+			6,
+			.2
+		] }]
+	},
+	{
+		id: "qwen-3.7-flash",
+		rates: [
+			.03,
+			.13,
+			.006,
+			.038
+		],
+		contextTiers: [
+			{
+				"maxContext": 32e3,
+				"rates": [
+					.03,
+					.13,
+					.006,
+					.038
+				]
+			},
+			{
+				"maxContext": 256e3,
+				"rates": [
+					.1,
+					.4,
+					.02,
+					.125
+				]
+			},
+			{ "rates": [
+				.2,
+				.8,
+				.04,
+				.25
+			] }
+		]
+	},
+	{
+		id: "qwen-3.7-max",
+		rates: [
+			2.5,
+			7.5,
+			.5,
+			3.13
+		]
+	},
+	{
+		id: "qwen-3.7-plus",
+		rates: [
+			.4,
+			1.6,
+			.08,
+			.5
+		],
+		contextTiers: [{
+			"maxContext": 256e3,
+			"rates": [
+				.4,
+				1.6,
+				.08,
+				.5
+			]
+		}, { "rates": [
+			1.2,
+			4.8,
+			.24,
+			1.5
+		] }]
+	},
+	{
+		id: "qwen-3.8-27b",
+		rates: [
+			.4,
+			3,
+			.04
+		]
+	},
+	{
+		id: "qwen-3.8-flash",
+		rates: [
+			.16,
+			.47,
+			.016
+		]
+	},
+	{
+		id: "qwen-3.8-max",
+		rates: [
+			2,
+			6,
+			.25,
+			2.5
+		]
 	},
-	"individual-pro-v1": {
-		name: "Pro",
-		monthlyCredits: 80,
-		tierWeight: 2
+	{
+		id: "qwen-3.8-max-0902",
+		rates: [
+			2,
+			6,
+			.25
+		]
 	},
-	"individual-provider": {
-		name: "Provider",
-		monthlyCredits: 15,
-		tierWeight: 3
+	{
+		id: "step-3.5-flash",
+		rates: [
+			.1,
+			.3,
+			.02
+		]
 	},
-	"individual-max": {
-		name: "Max",
-		monthlyCredits: 150,
-		tierWeight: 4
+	{
+		id: "step-3.7-flash",
+		rates: [
+			.2,
+			1.15,
+			.04
+		]
 	},
-	"individual-ultra": {
-		name: "Ultra",
-		monthlyCredits: 300,
-		tierWeight: 4
+	{
+		id: "tencent/hy3-paid",
+		rates: [
+			.14,
+			.58,
+			.035
+		]
 	},
-	"teams-pro": {
-		name: "Teams Pro",
-		monthlyCredits: 40,
-		tierWeight: 2
+	{
+		id: "tencent/hy4-preview",
+		rates: [
+			.834,
+			2.501,
+			.042
+		]
 	}
-};
-/** Plan-id prefixes, longest first — the CLI's prefix-match order. */
-const SUBSCRIPTION_PLAN_PREFIXES = Object.keys(KNOWN_SUBSCRIPTION_PLANS).sort((a, b) => b.length - a.length);
+];
 /**
-* Resolve a subscription `planId` (e.g. `individual-pro-v1`) to its display
-* name and monthly credit total, mirroring the CLI's `getPlanInfo`:
-* normalize (lowercase, `_` → `-`), then longest-prefix match so
-* `individual-pro-v1` wins over `individual-pro`. Unknown ids return
-* `undefined`.
+* Catalog ids no candidate rule can reach, because the page names the model
+* differently from the catalog. `tests/model-prices.test.ts` fails whenever a
+* catalog model has no price, so a new miss lands here as a visible decision
+* rather than a silently unpriced model.
 */
-function subscriptionPlanInfo(planId) {
-	const normalized = planId.toLowerCase().replace(/_/g, "-");
-	const prefix = SUBSCRIPTION_PLAN_PREFIXES.find((candidate) => normalized.startsWith(candidate));
-	return prefix === void 0 ? void 0 : KNOWN_SUBSCRIPTION_PLANS[prefix];
+const PRICE_SLUG_OVERRIDES = { "nvidia/nemotron-3-ultra-550b-a55b": "nemotron-3-ultra" };
+/**
+* Plausible price slugs for one catalog model id, most specific first.
+*
+* The page normalizes to lowercase and usually drops the vendor segment, but
+* not consistently: `tencent/hy4-preview` keeps its prefix while
+* `Qwen/Qwen3.8-Max-0902` becomes `qwen-3.8-max-0902`, with a hyphen the
+* catalog id does not have. Generating candidates and taking the first that
+* exists in the vendored table absorbs that drift without a hand-maintained
+* map of seventy ids.
+*/
+function priceSlugCandidates(modelId) {
+	const lower = modelId.toLowerCase();
+	const bare = lower.includes("/") ? lower.slice(lower.indexOf("/") + 1) : lower;
+	const out = /* @__PURE__ */ new Set();
+	const add = (slug) => {
+		const hyphenated = slug.replace(/^([a-z]+)(\d)/, "$1-$2");
+		out.add(slug);
+		out.add(hyphenated);
+		out.add(slug.replace(/-\d{8}$/, ""));
+		out.add(slug.replace(/-(preview|latest)$/, ""));
+		out.add(hyphenated.replace(/-\d{8}$/, ""));
+		out.add(hyphenated.replace(/-(preview|latest)$/, ""));
+	};
+	add(lower);
+	add(bare);
+	return [...out];
+}
+/** The pricing-page slug for one catalog model id, or undefined when unpriced. */
+function priceSlugFor(modelId, known) {
+	const override = PRICE_SLUG_OVERRIDES[modelId];
+	if (override !== void 0) return known.has(override) ? override : void 0;
+	return priceSlugCandidates(modelId).find((slug) => known.has(slug));
+}
+/** Split a stored triplet/quadruplet into the wire rate shape. */
+function ratesOf(values) {
+	const rates = {
+		inputCost: values[0],
+		outputCost: values[1],
+		cacheReadCost: values[2]
+	};
+	if (values[3] !== void 0) rates.cacheWriteCost = values[3];
+	return rates;
+}
+/** Build the full price row the browser prices a session with. */
+function wireRow(id, slug, row) {
+	const price = {
+		id,
+		slug,
+		...ratesOf(row.rates)
+	};
+	if (row.peak !== void 0) price.peak = ratesOf(row.peak);
+	if (row.contextTiers !== void 0) price.contextTiers = row.contextTiers.map((tier) => ({
+		...ratesOf(tier.rates),
+		...tier.maxContext === void 0 ? {} : { maxContext: tier.maxContext }
+	}));
+	return price;
 }
 /**
-* Whether the picker lists `modelId` for an account with the given billing
-* access. Fails open at every uncertainty: no billing data, an unknown plan,
-* a non-finite weight (corrupt billing fact), or a model outside
-* {@link KNOWN_PLANS} all keep the model visible — the server remains the
-* final gate (`403 MODEL_NOT_IN_PLAN`).
+* Build the table the composer prices a session with.
+*
+* Rows are keyed by CATALOG id wherever the two namespaces reconcile, because
+* that is what a session reports, and every row also carries its page slug as a
+* second lookup key. Price rows no catalog model claims are served under the
+* slug alone, so drift in either direction still prices: a page rename the
+* catalog has not followed, or a model the catalog snapshot has not learned
+* yet. Free models are served explicitly at zero so the composer can say so
+* instead of showing nothing.
+*
+* The peak windows travel with the table, so the browser applies the very
+* schedule this snapshot knows instead of restating it.
 */
-function modelVisibleInPlan(modelId, access) {
-	if (access === void 0) return true;
-	if (access.onDemandCredits > 0) return true;
-	if (access.tierWeight === void 0 || !Number.isFinite(access.tierWeight)) return true;
-	const tier = KNOWN_PLANS[modelId];
-	if (tier === void 0) return true;
-	const weight = PLAN_ORDER[tier];
-	if (weight === void 0) return true;
-	return weight <= access.tierWeight;
+function modelPriceTable() {
+	const bySlug = new Map(MODEL_PRICE_ROWS.map((row) => [row.id, row]));
+	const known = new Set(bySlug.keys());
+	const models = [];
+	const claimed = /* @__PURE__ */ new Set();
+	for (const catalogId of Object.keys(KNOWN_PLANS)) {
+		if (isFreeModel(catalogId) || catalogId.endsWith(":free")) {
+			models.push({
+				id: catalogId,
+				slug: catalogId,
+				inputCost: 0,
+				outputCost: 0,
+				cacheReadCost: 0,
+				free: true
+			});
+			continue;
+		}
+		const slug = priceSlugFor(catalogId, known);
+		if (slug === void 0) continue;
+		const row = bySlug.get(slug);
+		if (row === void 0) continue;
+		claimed.add(slug);
+		models.push(wireRow(catalogId, slug, row));
+	}
+	for (const row of MODEL_PRICE_ROWS) {
+		if (claimed.has(row.id)) continue;
+		models.push(wireRow(row.id, row.id, row));
+	}
+	return {
+		models,
+		peakHours: PEAK_HOUR_RANGES.map(([start, end]) => [start, end])
+	};
 }
-const KNOWN_DEALS = {
-	"MiniMaxAI/MiniMax-M3": { label: "50% off" },
-	"xiaomi/mimo-v2.5-pro": { label: "99% off" },
-	"xiaomi/mimo-v2.5": { label: "98% off" },
-	"poolside/laguna-s-2.1-free": {
-		label: "FREE",
-		free: true
-	},
-	"meituan/LongCat-2.0:free": {
-		label: "FREE",
-		free: true
-	},
-	"inclusionai/ling-3.0-flash-sante:free": {
-		label: "FREE",
-		free: true
+//#endregion
+//#region src/cost-facts.ts
+const zeroCostTokens = () => ({
+	uncachedInputTokens: 0,
+	outputTokens: 0,
+	cacheReadTokens: 0,
+	cacheWriteTokens: 0
+});
+const COST_TOKEN_KEYS = [
+	"uncachedInputTokens",
+	"outputTokens",
+	"cacheReadTokens",
+	"cacheWriteTokens"
+];
+function peakHour(at, windows) {
+	const time = new Date(at);
+	return time.getUTCDay() !== 0 && time.getUTCDay() !== 6 && windows.some(([start, end]) => time.getUTCHours() >= start && time.getUTCHours() < end);
+}
+/**
+* All prompt billing buckets determine a request's band, never cumulative session input.
+*
+* A tiered model returns the matching band and does NOT then apply `peak`: the
+* page publishes those two dimensions independently, no row carries both today,
+* and the generator would report a tiered row on every sync — so the combination
+* becoming real is visible before it reaches a user. This ordering is a latent
+* choice, not a verified upstream rule.
+*/
+function requestRates(price, at, contextTokens, table) {
+	const tier = price.contextTiers?.find((tier) => tier.maxContext === void 0 || contextTokens <= tier.maxContext);
+	if (tier !== void 0) return tier;
+	return price.peak !== void 0 && at !== null && peakHour(at, table.peakHours) ? price.peak : price;
+}
+/** Cache version and wire guard: changing bands/rates must refold historical groups. */
+function pricingKey(table) {
+	const rates = (r) => [
+		r.inputCost,
+		r.outputCost,
+		r.cacheReadCost,
+		r.cacheWriteCost ?? null
+	];
+	const canonical = JSON.stringify([
+		"commandCodeCost-v1",
+		table.peakHours,
+		table.models.map((p) => [
+			p.id,
+			p.slug,
+			p.free === true,
+			rates(p),
+			p.peak ? rates(p.peak) : null,
+			p.contextTiers?.map((t) => [t.maxContext ?? null, rates(t)]) ?? null
+		])
+	]);
+	let hash = 2166136261;
+	for (const c of canonical) hash = Math.imul(hash ^ c.charCodeAt(0), 16777619) >>> 0;
+	return hash;
+}
+/** Only safe to merge requests whose billing classification is identical. */
+function costGroupKey(group, table) {
+	const price = table.models.find((p) => p.id === group.model || p.slug === group.model);
+	return JSON.stringify([
+		group.provider,
+		group.model,
+		price === void 0 ? null : requestRates(price, group.at, group.contextTokens, table),
+		group.at === null
+	]);
+}
+//#endregion
+//#region src/cost-projection.ts
+const record$2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? v : void 0;
+const finite = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
+function tokensOf(value) {
+	const u = record$2(value);
+	if (!u || !finite(u.inputTokens) || !finite(u.outputTokens)) return void 0;
+	if (u.cacheReadTokens !== void 0 && !finite(u.cacheReadTokens) || u.cacheWriteTokens !== void 0 && !finite(u.cacheWriteTokens)) return void 0;
+	return {
+		uncachedInputTokens: u.inputTokens,
+		outputTokens: u.outputTokens,
+		cacheReadTokens: u.cacheReadTokens ?? 0,
+		cacheWriteTokens: u.cacheWriteTokens ?? 0
+	};
+}
+/** Current v2 settlements store the last usage in their stream; v1 stores chunk events. */
+function usageOf(type, data) {
+	if (type === "assistant/chunk") {
+		const chunk = record$2(data.chunk);
+		return chunk?.type === "usage" ? tokensOf(chunk.usage) : void 0;
 	}
-};
+	if (type !== "assistant/message" && type !== "assistant/attempt") return void 0;
+	const direct = tokensOf(data.usage);
+	if (direct !== void 0) return direct;
+	if (!Array.isArray(data.stream)) return void 0;
+	for (let i = data.stream.length - 1; i >= 0; i--) {
+		const item = record$2(data.stream[i]);
+		const chunk = item?.type === "chunk" ? record$2(item.chunk) : void 0;
+		if (chunk?.type === "usage") return tokensOf(chunk.usage);
+	}
+}
+function parseState(value) {
+	const s = record$2(value), facts = record$2(s?.facts);
+	if (!s || !facts || !finite(facts.pricingKey) || !Array.isArray(facts.groups)) throw new TypeError("invalid commandCodeCost state");
+	const group = (v) => {
+		const g = record$2(v), t = record$2(g?.tokens);
+		return !!g && typeof g.provider === "string" && typeof g.model === "string" && (g.at === null || finite(g.at)) && finite(g.contextTokens) && !!t && COST_TOKEN_KEYS.every((k) => finite(t[k]));
+	};
+	const sel = record$2(s.selection), last = record$2(s.last);
+	if (!(s.selection === null || sel && typeof sel.provider === "string" && typeof sel.model === "string") || !(s.at === null || finite(s.at)) || !facts.groups.every(group) || !(s.last === null || last && finite(last.turn) && finite(last.step) && group(last.group))) throw new TypeError("invalid commandCodeCost state");
+	return value;
+}
+/** Optional registry uses only synchronous parse/view; no new runtime module is required. */
+function createCostProjection(table = modelPriceTable()) {
+	const version = pricingKey(table);
+	return {
+		key: "commandCodeCost",
+		stateVersion: version,
+		stateSchema: { parse: parseState },
+		init: () => ({
+			selection: null,
+			at: null,
+			last: null,
+			facts: {
+				pricingKey: version,
+				groups: []
+			}
+		}),
+		apply(state, event) {
+			const data = record$2(event.data);
+			if (!data) return state;
+			if (event.type === "request/header") {
+				const config = record$2(record$2(data.header)?.config);
+				return {
+					...state,
+					selection: config && typeof config.provider === "string" && typeof config.model === "string" ? {
+						provider: config.provider,
+						model: config.model
+					} : null
+				};
+			}
+			if (event.type === "step/start" || event.type === "llm/retry-started") return {
+				...state,
+				at: finite(event.time) ? event.time : null,
+				last: null
+			};
+			const tokens = usageOf(event.type, data);
+			if (tokens === void 0 || !finite(data.turn) || !finite(data.step)) return state;
+			const previous = state.last?.turn === data.turn && state.last.step === data.step ? state.last.group : void 0;
+			const group = {
+				provider: state.selection?.provider ?? "",
+				model: state.selection?.model ?? "",
+				at: state.at,
+				contextTokens: tokens.uncachedInputTokens + tokens.cacheReadTokens + tokens.cacheWriteTokens,
+				tokens
+			};
+			if (previous && JSON.stringify(previous) === JSON.stringify(group)) return state;
+			const groups = state.facts.groups.map((g) => ({
+				...g,
+				tokens: { ...g.tokens }
+			}));
+			if (previous) {
+				const old = groups.find((g) => costGroupKey(g, table) === costGroupKey(previous, table));
+				if (old) for (const k of COST_TOKEN_KEYS) old.tokens[k] -= previous.tokens[k];
+			}
+			let target = groups.find((g) => costGroupKey(g, table) === costGroupKey(group, table));
+			if (!target) {
+				target = {
+					...group,
+					tokens: zeroCostTokens()
+				};
+				groups.push(target);
+			}
+			for (const k of COST_TOKEN_KEYS) target.tokens[k] += tokens[k];
+			return {
+				...state,
+				last: {
+					turn: data.turn,
+					step: data.step,
+					group
+				},
+				facts: {
+					pricingKey: version,
+					groups: groups.filter((g) => COST_TOKEN_KEYS.some((k) => g.tokens[k] > 0))
+				}
+			};
+		},
+		wire: {
+			view: (state) => state.facts,
+			viewSchema: { parse(value) {
+				return parseState({
+					selection: null,
+					at: null,
+					last: null,
+					facts: value
+				}).facts;
+			} }
+		}
+	};
+}
+function installCostProjection(ctx) {
+	ctx.inject(["sessionProjections"], (c) => {
+		const registry = c.get("sessionProjections");
+		if (typeof registry?.register === "function") c.effect(() => registry.register(createCostProjection()), "commandcode cost projection");
+	});
+}
+//#endregion
+//#region src/accounts.ts
 /**
-* Models with time-of-day (peak/off-peak) pricing, per the official pricing
-* page (`/docs/resources/pricing-limits`). Since 2026-08-16 16:00 UTC, DeepSeek
-* charges by the hour: peak hours are 01:00–04:00 and 06:00–10:00 UTC (7h per
-* weekday, full price) **Monday to Friday only**; the other 17 hours of a
-* weekday and every hour of Saturday/Sunday (UTC) are off-peak at half price.
-* The V4 Flash Vision (exp) variant (command-code@1.32.0) shares the V4 Flash
-* windows and peak prices ($0.44/$1.32) — each row's hover annotation states
-* exactly 2× that row's displayed off-peak prices. The picker shows the
-* *current* state as a compact
-* label (`Peak`/`Half`) matching the English noun style of the other markers
-* (`Image`, `FREE`), so a developer can tell at a glance whether calling the
-* model right now is cheap or expensive.
+* Multi-account pool for the Command Code provider (host side).
 *
-* Authoritative extraction: the pricing page embeds a model JSON array whose
-* hourly-priced entries carry a `timeOfDay` block
-* (`{ windows: "01–04 & 06–10 UTC, Mon–Fri", peakHoursPerDay: 7,
-* offPeakHoursPerDay: 17, peak: {...}, offPeak: {...} }`). Exactly four models
-* carry it: V4 Pro, V4 Flash, V4 Flash Vision (exp), and V4.1 Flash (added in
-* command-code@1.53.0 at $0.15/$0.60 off-peak, $0.30/$1.20 peak — the same
-* schedule as the other three).
+* One Command Code subscription (e.g. the Go plan's 5-hour window) is
+* metered; a user with several subscriptions wants a request that hits one
+* account's limit to continue on the next account without a visible failure.
+* This module owns that rotation:
 *
-* Extraction caution: the rendered HTML rows are a trap. Each annotation div
-* sits inside its OWN row's container, immediately before the NEXT row starts,
-* so flattening the page to text makes every annotation look like it belongs
-* to the model printed after it — that is how `deepseek/deepseek-v4-flash-fast`
-* was wrongly added here (its row is flat-priced at $0.28/$0.56/$0.07 and has
-* no `timeOfDay` block). Trust the embedded JSON's `timeOfDay` membership and
-* the 2× price relation, never the flat-text neighbor.
+*   - {@link CommandCodeAccountPool.resolveKey} hands out the first account
+*     whose key is not currently marked exhausted — or, when the request's
+*     model matches a {@link CommandCodeModelAccountRule} and that account is
+*     usable, the routed account — resolving each slot's key lazily (literal
+*     config key → credential seam → launch environment → the official CLI
+*     auth file for the default slot only).
+*   - {@link CommandCodeAccountPool.markRejected} records a 429 (rate limit,
+*     window unknown) or 401 (invalid key, disabled until the config changes)
+*     against the exact API key, so several slots sharing one key share one
+*     state.
+*   - When every account is marked, the pool probes each key's
+*     `/alpha/billing/credits` window limits (through the injected
+*     {@link CommandCodeAccountPoolDeps.probeWindow}): an account whose window
+*     no longer reports `exceeded` is revived, otherwise the pool throws a
+*     `RATE_LIMIT` error naming the earliest reset time.
 *
-* Keep in sync with the official pricing page when the model set, the peak
-* windows, or the weekday rule change (see the dsh-commandcode-upstream skill).
+* The pool is deliberately cordis-free (like the adapter): every host fact
+* arrives through injected thunks, so node tests can drive it directly.
+*
+* @module dsh-commandcode-provider/accounts
 */
-const KNOWN_PEAK_PRICING = /* @__PURE__ */ new Set([
-	"deepseek/deepseek-v4-pro",
-	"deepseek/deepseek-v4-flash",
-	"deepseek/deepseek-v4-flash-vision-exp",
-	"deepseek/deepseek-v4.1-flash"
-]);
 /**
-* Peak hours (UTC, hour-of-day range end-exclusive): 01–03 and 06–09.
-* Weekday-only — see `peakPricingState()`; weekends are fully off-peak.
+* Upper bound on the retry wait this pool attaches to the all-exhausted
+* `RATE_LIMIT` error. Must equal the `backoff.maxDelayMs` in the adapter's
+* `providerRetryPolicy` (which imports it from here): dsh-llm-retry honors a
+* provider-specified wait verbatim only at or below that cap — in normal mode
+* a LONGER attached wait makes the executor abandon the retry entirely
+* instead of falling back to local backoff, which would turn "poll until the
+* window opens" into "fail now".
 */
-const PEAK_HOUR_RANGES = [[1, 4], [6, 10]];
+const RETRY_MAX_DELAY_MS = 9e5;
+/** A labeled, human-readable clock reading for error messages. */
+function clockLabel(ms) {
+	return new Date(ms).toLocaleString();
+}
 /**
-* Whether `now` (defaults to `Date.now()`) falls in a peak-pricing window for
-* time-of-day-priced models. Peak rates apply Monday–Friday (UTC) only: the
-* official rule charges Saturday and Sunday completely off-peak for all 24
-* hours, so a weekend timestamp is off-peak even inside `PEAK_HOUR_RANGES`.
-* `undefined` for models outside the snapshot.
+* Whether an account with this rotation state can serve a request right now.
+* `undefined` (never rejected) is usable; a cooldown becomes usable again
+* once its reset time passes; `unknown` (429, reset unprobed) and
+* `disabled` (401) are not.
 */
-function peakPricingState(modelId, now = Date.now()) {
-	if (!KNOWN_PEAK_PRICING.has(modelId)) return void 0;
-	const at = new Date(now);
-	const day = at.getUTCDay();
-	if (day === 0 || day === 6) return "off-peak";
-	const hour = at.getUTCHours();
-	return PEAK_HOUR_RANGES.some(([start, end]) => hour >= start && hour < end) ? "peak" : "off-peak";
+function accountUsable(state) {
+	if (state === void 0) return true;
+	if (state.kind === "cooldown") return state.until > 0 && Date.now() >= state.until;
+	return false;
 }
 /**
-* Compact label for the current peak/off-peak state: `Peak` (full price) or
-* `Half` (off-peak, half price). These English nouns match the picker's other
-* markers (`Go`, `Image`, `FREE`), and since they appear only on time-of-day
-* priced models they double as a "priced by the hour" signal. Returns undefined
-* for models without time-of-day pricing.
+* Pick the account that should serve now: the manually preferred slot when it
+* is usable, otherwise the first usable account in rotation order; undefined
+* when no account is usable. Shared by the pool (request path) and the plugin
+* entry (the usage view's active badge) so both always agree.
 */
-function peakPricingLabel(modelId, now = Date.now()) {
-	const state = peakPricingState(modelId, now);
-	if (state === void 0) return void 0;
-	return state === "peak" ? "Peak" : "Half";
+function selectActiveAccount(accounts, preferredId) {
+	const usable = accounts.filter((account) => accountUsable(account.state));
+	if (preferredId !== void 0) {
+		const preferred = usable.find((account) => account.slot.id === preferredId);
+		if (preferred !== void 0) return preferred;
+	}
+	return usable[0];
 }
 /**
-* Official display label for a model's minimum plan, or undefined for models
-* outside the snapshot (e.g. future catalog additions).
+* The first routing rule whose model list contains the request's model id.
+* Undefined when no rule matches.
 */
-function planLabel(modelId) {
-	const plan = KNOWN_PLANS[modelId];
-	return plan === void 0 ? void 0 : PLAN_LABELS[plan];
+function matchModelRule(model, rules) {
+	if (model === "" || rules === void 0 || rules.length === 0) return void 0;
+	for (const rule of rules) if (rule.models.includes(model)) return rule;
 }
 /**
-* The active deal label for a model, or undefined when the model has no deal
-* or the deal has expired. Expiry is judged against `now` (defaults to
-* `Date.now()`), so a snapshot that has gone stale stops showing its discount
-* the moment the official end date passes — the user never believes a lapsed
-* deal is still live. Permanent deals (no `expiresAt`) never lapse.
+* The routed account for a request's model: the first usable account whose
+* slot id matches the first matching rule's target. Undefined when no rule
+* matches or the routed account is not usable (the caller then falls back to
+* the normal preferred/rotation selection).
 */
-function dealLabel(modelId, now = Date.now()) {
-	const deal = KNOWN_DEALS[modelId];
-	if (deal === void 0) return void 0;
-	if (deal.expiresAt !== void 0 && now >= Date.parse(deal.expiresAt)) return void 0;
-	return deal.label;
+function selectAccountForModel(accounts, model, rules) {
+	const rule = matchModelRule(model, rules);
+	if (rule === void 0) return void 0;
+	return accounts.find((account) => account.slot.id === rule.account && accountUsable(account.state));
 }
 /**
-* Compact human-readable context window, e.g. `1_000_000 -> "1M"`,
-* `256_000 -> "256K"`, `262_144 -> "262K"` (floor to the nearest K).
-* Returns undefined for unknown/absent sizes; values under 1K render raw.
+* The account pool. Rotation state is keyed by API key (never logged), so two
+* slots resolving to the same credential share one mark, and a key changed in
+* the credentials service starts with a clean slate.
 */
-function formatContext(contextWindow) {
-	if (contextWindow === void 0 || !Number.isFinite(contextWindow) || contextWindow <= 0) return;
-	if (contextWindow >= 1e6) {
-		const m = contextWindow / 1e6;
-		const rounded = Math.round(m * 10) / 10;
-		return `${Number.isInteger(rounded) ? rounded : rounded.toFixed(1)}M`;
+var CommandCodeAccountPool = class {
+	deps;
+	/** Rotation state by API key. */
+	states = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
 	}
-	if (contextWindow < 1e3) return String(Math.floor(contextWindow));
-	return `${Math.floor(contextWindow / 1e3)}K`;
-}
+	/**
+	* Resolve every slot's key, deduplicated by key (first slot wins). Slots
+	* without any resolvable key are omitted — they still appear in the
+	* settings page as unconfigured, they just cannot serve requests.
+	*/
+	async resolvedAccounts() {
+		const out = [];
+		const seen = /* @__PURE__ */ new Set();
+		for (const slot of this.deps.slots()) {
+			const key = await this.resolveSlotKey(slot);
+			if (key === void 0 || seen.has(key)) continue;
+			seen.add(key);
+			out.push({
+				slot,
+				key,
+				state: this.states.get(key)
+			});
+		}
+		return out;
+	}
+	/**
+	* Every slot paired with its resolved key and rotation state — NOT
+	* deduplicated: two slots sharing one credential both appear (the usage
+	* view reports them individually), while slots without any resolvable key
+	* are omitted. The serving path uses {@link resolvedAccounts} instead.
+	*/
+	async describeAccounts() {
+		const out = [];
+		for (const slot of this.deps.slots()) {
+			const key = await this.resolveSlotKey(slot);
+			if (key === void 0) continue;
+			out.push({
+				slot,
+				key,
+				state: this.states.get(key)
+			});
+		}
+		return out;
+	}
+	/**
+	* Hand out the key for a request: the model-routed account when the
+	* request's model matches a rule (and that account is usable), else the
+	* manually preferred account when usable, else the first usable account in
+	* rotation order. Returns `undefined` when no account resolves any key at
+	* all (the caller then reports the missing credential). Throws
+	* `RATE_LIMIT` — naming the earliest window reset — or
+	* `INVALID_CREDENTIAL` when accounts exist but none can serve.
+	*
+	* `options.model` is the request's model id; routing rules re-read per
+	* resolution, so a settings change applies live.
+	*
+	* `options.exclude` skips one key during the probe-revival pass: the
+	* rotation hook excludes the just-rejected key so a probe that clears its
+	* window cannot re-offer the same key within the same request (the adapter
+	* refuses already-tried keys; the next request picks the revived key up).
+	*/
+	async resolveKey(options) {
+		const accounts = await this.resolvedAccounts();
+		if (accounts.length === 0) return;
+		const routed = selectAccountForModel(accounts, options?.model ?? "", this.deps.modelAccountRules?.());
+		if (routed !== void 0) return this.pick(routed);
+		const preferred = this.deps.preferredId?.();
+		const chosen = selectActiveAccount(accounts, preferred);
+		if (chosen !== void 0) return this.pick(chosen);
+		await Promise.all(accounts.map(async (account) => {
+			if (account.state?.kind === "disabled") return;
+			if (options?.exclude !== void 0 && account.key === options.exclude) return;
+			let probe;
+			try {
+				probe = await this.deps.probeWindow(account.key);
+			} catch {
+				return;
+			}
+			if (probe === void 0) return;
+			if (!probe.exceeded) this.states.delete(account.key);
+			else this.states.set(account.key, {
+				kind: "cooldown",
+				reason: account.state?.reason ?? "rate limited (429)",
+				until: probe.resetAt
+			});
+		}));
+		const latest = await this.resolvedAccounts();
+		const revived = selectActiveAccount(latest, preferred);
+		if (revived !== void 0) return this.pick(revived);
+		if (latest.filter((account) => account.state?.kind === "disabled").length === latest.length) throw new LlmError(`llm-commandcode: every configured Command Code account (${latest.length}) was rejected with 401 — check the stored API keys (Models page / settings) or the auth file；已配置的 ${latest.length} 个 Command Code 账户密钥均被拒绝（401）——请在设置页检查存储的 API 密钥，或重新运行 command-code login`, "INVALID_CREDENTIAL");
+		const resets = latest.map((account) => account.state).filter((state) => state !== void 0 && state.kind === "cooldown" && state.until > 0).map((state) => state.until);
+		const earliest = resets.length > 0 ? Math.min(...resets) : 0;
+		const wait = earliest > 0 ? Math.max(1e3, earliest - Date.now()) : 0;
+		throw new LlmError(`llm-commandcode: all ${latest.length} Command Code account(s) have exhausted their usage window` + (earliest > 0 ? `; the earliest window resets at ${clockLabel(earliest)}` : "") + ` — requests will succeed again after the reset (or add another account)；已用尽全部 ${latest.length} 个 Command Code 账户的用量窗口` + (earliest > 0 ? `，最早的重置时间为 ${clockLabel(earliest)}` : "") + "——窗口重置后请求会自动恢复（也可以添加更多账户）", "RATE_LIMIT", wait > 0 && wait <= 9e5 ? { providerRetryAfterMs: wait } : void 0);
+	}
+	/**
+	* Record a rejection against one key. `rate-limit` (429) marks the key
+	* exhausted with an unknown reset (probed lazily at the next resolution
+	* once every account is marked); `invalid-credential` (401) disables the
+	* key until the stored credential changes.
+	*/
+	markRejected(apiKey, rejection) {
+		if (rejection === "invalid-credential") this.states.set(apiKey, {
+			kind: "disabled",
+			reason: "invalid API key (401)",
+			until: 0
+		});
+		else this.states.set(apiKey, {
+			kind: "unknown",
+			reason: "rate limited (429)",
+			until: 0
+		});
+	}
+	/**
+	* One account's key: literal → credential seam → auth file (default slot).
+	*
+	* Every source is normalized here, at the single point where a slot's key
+	* enters the pool. The adapter sends the key through the harness's
+	* `assertUsableApiKey()`, which trims it — a stored key from the credentials
+	* seam, a `.env` line, or a shell export all pick up surrounding whitespace
+	* — and reports that trimmed form back to `markRejected()`. Returning the
+	* raw value would file every 429/401 mark under a key no later lookup can
+	* find: rotation would re-offer the same account, the account card would show
+	* no mark, and the usage endpoints would 401 while chat kept working.
+	* Normalizing once makes resolution, probing, marking, and the request path
+	* agree on one string.
+	*/
+	async resolveSlotKey(slot) {
+		if (slot.literal !== void 0) {
+			const literal = normalizeResolvedKey(slot.literal);
+			if (literal !== void 0) return literal;
+		}
+		if (slot.ref !== void 0) {
+			const hit = await this.deps.resolveRef(slot.ref);
+			if (hit !== void 0) {
+				const resolved = normalizeResolvedKey(hit);
+				if (resolved !== void 0) return resolved;
+			}
+		}
+		if (slot.allowAuthFile) {
+			const fromFile = this.deps.authFileKey();
+			if (fromFile !== void 0) {
+				const fileKey = normalizeResolvedKey(fromFile);
+				if (fileKey !== void 0) return fileKey;
+			}
+		}
+	}
+	/** Hand out the chosen account's key. */
+	pick(account) {
+		return {
+			key: account.key,
+			slot: account.slot
+		};
+	}
+};
 /**
-* Compact one-line summary for the model picker: plan tier, then any active
-* deal (discount or FREE), then the current peak/off-peak state (`Peak`/`Half`)
-* for time-of-day-priced models, then `Image` for Vision-capable models, then
-* the context window. Text-only models simply omit the Image marker — "Text
-* only" adds nothing the picker needs to show.
+* Normalize one resolved credential to the form every consumer sees. Trim
+* only: a blank-after-trim value means "no key" (the slot is omitted and the
+* caller reports `MISSING_CREDENTIAL`), while characters an HTTP header cannot
+* carry are left for `assertUsableApiKey()` to reject with its own message.
 */
-function capabilityDescription(modelId, contextWindow, now = Date.now()) {
-	const parts = [];
-	const plan = planLabel(modelId);
-	if (plan !== void 0) parts.push(plan);
-	const deal = dealLabel(modelId, now);
-	if (deal !== void 0) parts.push(deal);
-	const peak = peakPricingLabel(modelId, now);
-	if (peak !== void 0) parts.push(peak);
-	if (KNOWN_IMAGE_MODELS.has(modelId)) parts.push("Image");
-	const ctx = formatContext(contextWindow);
-	if (ctx !== void 0) parts.push(ctx);
-	return parts.join(" · ");
+function normalizeResolvedKey(value) {
+	const trimmed = value.trim();
+	return trimmed === "" ? void 0 : trimmed;
 }
 //#endregion
 //#region src/adapter.ts
@@ -1024,7 +2081,7 @@ function capabilityDescription(modelId, contextWindow, now = Date.now()) {
 * and API key or subscription, and Command Code's terms apply.
 *
 * Wire protocol (reverse-engineered by the pi plugin, command-code@1.28.4;
-* re-verified against command-code@1.53.1 — endpoints, request shape, and
+* re-verified against command-code@1.54.0 — endpoints, request shape, and
 * stream events unchanged):
 *   POST {apiBase}/alpha/generate
 *   body: { config, memory, taste, skills, params: { model, messages, tools,
@@ -1037,7 +2094,7 @@ function capabilityDescription(modelId, contextWindow, now = Date.now()) {
 * per-request options thunk and an API-key resolver from the plugin entry
 * (src/index.ts), so a settings change reaches the very next request.
 */
-const COMMAND_CODE_CLI_VERSION = "1.53.1";
+const COMMAND_CODE_CLI_VERSION = "1.54.0";
 const DEFAULT_API_BASE = "https://api.commandcode.ai";
 const DEFAULT_GENERATE_MAX_TOKENS = 64e3;
 const DEFAULT_MAX_OUTPUT_TOKENS = 65536;
@@ -1097,6 +2154,61 @@ function hasTerminalStreamMarker(message) {
 	const lower = message.toLowerCase();
 	return TERMINAL_STREAM_ERROR_MARKERS.some((marker) => lower.includes(marker));
 }
+/**
+* Context-window wording the provider uses to reject a request that outgrew
+* the model's window. `isContextWindowExceededError` is the harness's own
+* provider-neutral classifier — and the contract `CONTEXT_WINDOW_EXCEEDED`
+* exists for — so it decides; the official CLI's `truncated` pattern adds the
+* phrasings Command Code's upstreams emit that the harness helper does not
+* cover (a bare `prompt is too long`, or a complaint about `max_tokens`).
+* The CLI matches these first and answers them by compacting and retrying —
+* never by resending the request unchanged.
+*/
+const CLI_CONTEXT_OVERFLOW_PATTERN = /prompt is too long|context.*(length|window)|max_tokens|maximum.*tokens/i;
+function isContextOverflowDetail(detail) {
+	return isContextWindowExceededError(detail) || CLI_CONTEXT_OVERFLOW_PATTERN.test(detail);
+}
+/**
+* Classify one in-band stream `error` payload into the failure the caller
+* throws. Shared by both transports — the CLI transport delivers it as an
+* `error` event (`{ type: 'error', error }`), the Provider API transport as a
+* top-level `error` member of an SSE chunk — so the two cannot drift apart.
+*
+* The wording decides before the status does, mirroring the official CLI's
+* `classifyKind` (which reads the message first) and the harness helpers
+* (which exist so thrown and in-band delivery share one classifier). Order is
+* load-bearing:
+*
+* - A context-window rejection is terminal for THIS request but recoverable by
+*   the harness: `dsh-compaction-basic` listens on `agent/request-error` for
+*   `CONTEXT_WINDOW_EXCEEDED` and answers it with a compaction + retry of the
+*   reduced surface. That is what lets a long session survive a request that
+*   outgrew the model's window, and it is what the official CLI does (its
+*   non-retryable `truncated` kind). Reported as retryable `SERVER` — where
+*   this wording landed before — the adapter resent the byte-identical
+*   oversized request up to `maxRetries` times and the session could never
+*   recover, which is exactly the endless-retry-at-long-context report
+*   (issue #39).
+* - Credits/plan wording is terminal, so an exhausted balance or a model
+*   outside the plan is not retried as if it were a transient rate limit.
+* - Only then does the status/`isRetryable` pair decide, as before.
+*/
+function streamErrorToLlmError(value, fallbackMessage) {
+	const record = isRecord(value) ? value : void 0;
+	const message = record ? stringValue(record.message) ?? JSON.stringify(record) : stringValue(value) ?? fallbackMessage ?? "Stream error";
+	const statusCode = record === void 0 ? void 0 : numberValue(record.statusCode) ?? numberValue(record.status);
+	const isRetryable = record === void 0 ? void 0 : booleanValue(record.isRetryable);
+	const detail = [
+		stringValue(record?.code),
+		stringValue(record?.type),
+		message
+	].filter((part) => part !== void 0 && part !== "").join(" ");
+	const statusOption = statusCode !== void 0 ? { status: statusCode } : void 0;
+	if (isContextOverflowDetail(detail)) return new LlmError(`Command Code stream error: ${message}；Command Code API 拒绝了这次请求：内容超出模型上下文窗口。正在压缩上下文后重试；如仍失败，请新建会话或减少上下文`, CONTEXT_WINDOW_EXCEEDED_CODE, statusOption);
+	const terminal = hasTerminalStreamMarker(detail);
+	if (!(isRetryable === true || (statusCode !== void 0 ? statusCode !== void 0 && (statusCode === 429 || statusCode >= 500) : isRetryable !== false && !terminal))) return new LlmError(`Command Code stream error: ${message}`, "PROVIDER_STREAM_ERROR", statusOption);
+	return new LlmError(`Command Code stream error: ${message}`, "SERVER", statusOption);
+}
 function recordOrEmpty(value) {
 	if (isRecord(value)) return value;
 	if (typeof value === "string") try {
@@ -1431,6 +2543,52 @@ function hasImageContent(message) {
 	const check = (blocks) => blocks.some((b) => b.type === "image" || b.type === "tool-result" && check(b.content));
 	return check(message.content);
 }
+/** The budget ladder: the primary rung first, the 413 eviction rung second. */
+const REQUEST_IMAGE_BUDGETS = [{
+	maxBytes: 33554432,
+	maxImages: 60,
+	byteQuantum: 16777216,
+	countQuantum: 30
+}, {
+	maxBytes: 8388608,
+	maxImages: 12,
+	byteQuantum: 8388608,
+	countQuantum: 12
+}];
+/**
+* Project request history under one image budget: the oldest images past it
+* become placeholder text in place, the newest keep their bytes, and a history
+* already inside the budget is returned as the SAME array — the caller uses
+* that identity to tell "nothing evicted" from "evicted".
+*
+* Nested tool-result images ride the same core walk, which is exactly right
+* for this adapter: an evicted `read_image` result surfaces its placeholder as
+* the tool message's own text, so no carrier user message is emitted for it.
+*/
+function projectRequestImages(messages, budget) {
+	return offloadRequestImagesWithPolicy(messages, {
+		representation: "base64",
+		maxBytes: budget.maxBytes,
+		maxImages: budget.maxImages,
+		byteQuantum: budget.byteQuantum,
+		countQuantum: budget.countQuantum,
+		placeholder: (ref) => offloadedImageText(ref)
+	});
+}
+/**
+* The request options one budget produced: the caller's own object when the
+* history was already inside the budget, else a copy carrying the projection.
+* The next rung of the ladder is applied to the CURRENT projection, never to
+* the raw history — otherwise a retry could reintroduce images the first rung
+* had already evicted.
+*/
+function withImageBudget(options, budget) {
+	const projected = projectRequestImages(options.messages, budget);
+	return projected === options.messages ? options : {
+		...options,
+		messages: [...projected]
+	};
+}
 /**
 * Convert one image reference to the Command Code wire format, as the official
 * CLI does: `{ type: 'image', source: { type: 'base64', media_type, data } }`.
@@ -1665,13 +2823,22 @@ function parseUsageTotals(usage) {
 	};
 }
 /** Parse one window-limit block (`fiveHour` / `weekly`). */
+/**
+* Parse one window block into a window limit, or undefined when the endpoint
+* reported no such window.
+*
+* Returning undefined (rather than a zeroed window) is load-bearing: the panel
+* must not draw a quota row for a window the account never reported, and a
+* zeroed window is indistinguishable from a genuinely uncapped one.
+*/
 function parseWindowLimit(value) {
 	const block = isRecord(value) ? value : void 0;
+	if (block === void 0) return void 0;
 	return {
-		used: numberValue(block?.used) ?? 0,
-		cap: numberValue(block?.cap) ?? 0,
-		exceeded: block?.exceeded === true,
-		resetAt: numberValue(block?.resetAt) ?? 0
+		used: numberValue(block.used) ?? 0,
+		cap: numberValue(block.cap) ?? 0,
+		exceeded: block.exceeded === true,
+		resetAt: numberValue(block.resetAt) ?? 0
 	};
 }
 /**
@@ -1685,13 +2852,19 @@ function parseCreditLimits(credits) {
 	const fiveHour = windowLimits !== void 0 && isRecord(windowLimits.fiveHour) ? windowLimits.fiveHour : void 0;
 	const weekly = windowLimits !== void 0 && isRecord(windowLimits.weekly) ? windowLimits.weekly : void 0;
 	if (creditsData === void 0 && fiveHour === void 0 && weekly === void 0) return void 0;
-	return {
+	const parsed = {
 		monthlyCredits: numberValue(creditsData?.monthlyCredits) ?? 0,
 		purchasedCredits: numberValue(creditsData?.purchasedCredits) ?? 0,
 		freeCredits: numberValue(creditsData?.freeCredits) ?? 0,
-		fiveHour: parseWindowLimit(fiveHour),
-		weekly: parseWindowLimit(weekly)
+		monthlyReported: numberValue(creditsData?.monthlyCredits) !== void 0,
+		purchasedReported: numberValue(creditsData?.purchasedCredits) !== void 0,
+		freeReported: numberValue(creditsData?.freeCredits) !== void 0
 	};
+	const fiveHourLimit = parseWindowLimit(fiveHour);
+	const weeklyLimit = parseWindowLimit(weekly);
+	if (fiveHourLimit !== void 0) parsed.fiveHour = fiveHourLimit;
+	if (weeklyLimit !== void 0) parsed.weekly = weeklyLimit;
+	return parsed;
 }
 /**
 * Parse the account identity from whoami plus the plan identity from the
@@ -2287,12 +3460,14 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		const reasoningEffort = effort && effort !== "off" && supported?.includes(effort) ? effort : void 0;
 		const systemText = [options.system ?? "", ...options.messages.filter((m) => m.role === "system").map((m) => m.content.map(blockText).filter(Boolean).join("\n"))].filter(Boolean).join("\n\n");
 		let protocol = this.resolveProtocol(apiKey);
-		const buildBody = async (target) => target === "cli" ? buildCliBody(options, connection, {
+		let requestOptions = withImageBudget(options, REQUEST_IMAGE_BUDGETS[0]);
+		let imageBudgetIndex = 0;
+		const buildBody = async (target) => target === "cli" ? buildCliBody(requestOptions, connection, {
 			maxTokens,
 			reasoningEffort,
 			systemText,
 			readImage
-		}) : buildOpenAIBody(options, {
+		}) : buildOpenAIBody(requestOptions, {
 			maxTokens,
 			reasoningEffort,
 			systemText,
@@ -2319,6 +3494,15 @@ var CommandCodeAdapter = class extends LlmAdapter {
 				body = await buildBody("cli");
 				continue;
 			}
+			if (attempt.status === 413 && imageBudgetIndex + 1 < REQUEST_IMAGE_BUDGETS.length) {
+				const tightened = withImageBudget(requestOptions, REQUEST_IMAGE_BUDGETS[imageBudgetIndex + 1]);
+				if (tightened !== requestOptions) {
+					imageBudgetIndex += 1;
+					requestOptions = tightened;
+					body = await buildBody(protocol);
+					continue;
+				}
+			}
 			const rotate = this.deps.rotateApiKey;
 			if ((attempt.status === 429 || attempt.status === 401) && rotate !== void 0 && options.signal?.aborted !== true && tried.size < MAX_ACCOUNT_ROTATIONS) {
 				const next = await rotate(apiKey, attempt.status === 429 ? "rate-limit" : "invalid-credential", connection, options.model);
@@ -2411,26 +3595,68 @@ var CommandCodeAdapter = class extends LlmAdapter {
 * Map a pre-stream generate HTTP failure onto a stable LlmError. Command
 * Code folds several business rejections into 403 (plan limits, CLI version,
 * model access): prefer the machine-readable `error.code` when present; the
-* status alone cannot distinguish them. A 429's `Retry-After` rides along as
+* status alone cannot distinguish them. The status also decides the failure
+* CODE via {@link httpErrorCode}, which is what the retry policy routes on —
+* a transient 5xx must not be reported as a permanent provider rejection. A
+* 429's `Retry-After` header rides along as
 * `providerRetryAfterMs` so dsh-llm-retry can wait exactly that long instead
 * of guessing at the backoff cadence — capped at RETRY_MAX_DELAY_MS, because
 * in normal mode a longer attached wait makes the executor abandon the retry
 * outright instead of falling back to local backoff.
+*
+* One body is read, not just its status: a client-side rejection whose
+* `error.code`/`type`/`message` names the model context window is reported as
+* `CONTEXT_WINDOW_EXCEEDED` (see the branch below), because that failure has a
+* recovery the harness performs and a generic provider error does not.
 */
 function generateHttpError(status, errText, retryAfterMs) {
 	let providerCode;
+	let providerDetail = "";
 	try {
 		const parsed = JSON.parse(errText);
-		if (isRecord(parsed) && isRecord(parsed.error)) providerCode = stringValue(parsed.error.code);
+		if (isRecord(parsed) && isRecord(parsed.error)) {
+			providerCode = stringValue(parsed.error.code);
+			providerDetail = [
+				stringValue(parsed.error.code),
+				stringValue(parsed.error.type),
+				stringValue(parsed.error.message)
+			].filter((part) => part !== void 0 && part !== "").join(" ");
+		}
 	} catch {}
 	const detail = providerCode ?? `HTTP ${status}`;
+	const overflowDetail = providerDetail !== "" ? providerDetail : errText.slice(0, 500);
+	if (status < 500 && isContextOverflowDetail(overflowDetail)) return new LlmError(`Command Code API error ${status}: the request exceeds the model's context window — this session is being compacted and the request retried；Command Code API 返回 ${status}：请求内容超出模型上下文窗口——正在压缩上下文后重试；如仍失败，请新建会话或减少上下文`, CONTEXT_WINDOW_EXCEEDED_CODE, { status });
 	if (status === 401) return new LlmError(`Command Code API error 401 (${detail}): the API key is missing or invalid — check the key stored for COMMANDCODE_API_KEY (Models page) or the auth file；Command Code API 返回 401：API 密钥缺失或无效——请在设置页检查 COMMANDCODE_API_KEY 存储的密钥，或检查 auth 文件`, "INVALID_CREDENTIAL", { status: 401 });
-	return new LlmError(`Command Code API error ${status}${detail === `HTTP ${status}` ? "" : ` (${detail})`}: ${errText.slice(0, 500)}`, status === 429 ? "RATE_LIMIT" : "PROVIDER_HTTP_ERROR", {
+	if (status === 413) return new LlmError("Command Code API error 413: the request body exceeds the provider's size limit (the cap is undocumented, measured at about 50 MB) — the session history is too large to send, usually because of accumulated image attachments. Start a new session, or drop the image-heavy part of this one, and retry；Command Code API 返回 413：请求体超过服务端的体积上限（官方未公开，实测约 50 MB）——会话历史过大，通常是历史图片累积所致。请新建会话，或移除本会话中图片较多的部分后重试", "PROVIDER_HTTP_ERROR", { status: 413 });
+	return new LlmError(`Command Code API error ${status}${detail === `HTTP ${status}` ? "" : ` (${detail})`}: ${errText.slice(0, 500)}`, httpErrorCode(status), {
 		status,
 		...retryAfterMs !== void 0 && retryAfterMs > 0 && retryAfterMs <= 9e5 ? { providerRetryAfterMs: retryAfterMs } : {}
 	});
 }
 /**
+* Classify a pre-stream HTTP status into the failure code the route's retry
+* policy keys on. dsh-llm-retry matches `retryableCodes` only — never the
+* status, never the provider's `error.type` — so a status that arrives here as
+* a permanent code is never retried, whatever it says about itself.
+*
+* 5xx is the provider's own "we are temporarily unavailable" class (Cloudflare's
+* 520-527 included; a 520 body says exactly that in words) and the only sane
+* answer to it is the byte-identical resend the retry policy exists to make.
+* Keeping it on `PROVIDER_HTTP_ERROR` — absent from the whitelist by design, so
+* that a 403 plan rejection or a 400 shape error fails fast — made the one
+* failure that asks to be retried the only one that never was, while the same
+* status arriving as an in-band stream `error` event was classified retryable
+* `SERVER` (see the `error` case of {@link handleCliEvent}). 408 is the same
+* story for the request itself. Everything else stays permanent: a 400/403/404/
+* 409/422 rejection repeats identically on every attempt.
+*/
+function httpErrorCode(status) {
+	if (status === 429) return "RATE_LIMIT";
+	if (status === 408) return "TIMEOUT";
+	if (status >= 500) return "SERVER";
+	return "PROVIDER_HTTP_ERROR";
+}
+/**
 * Handle one CLI-transport (`/alpha/generate`) stream event, appending
 * harness StreamChunks. Pure over the passed assembler — no stream() locals.
 */
@@ -2537,16 +3763,7 @@ function handleCliEvent(asm, event) {
 			});
 			break;
 		}
-		case "error": {
-			const err = isRecord(event.error) ? event.error : void 0;
-			const detail = isRecord(event.error) ? stringValue(event.error.message) ?? JSON.stringify(event.error) : stringValue(event.error) ?? stringValue(event.message) ?? "Stream error";
-			const statusCode = err ? numberValue(err.statusCode) : void 0;
-			const isRetryable = err ? booleanValue(err.isRetryable) : void 0;
-			const retryableStatus = statusCode !== void 0 && (statusCode === 429 || statusCode >= 500);
-			const terminal = hasTerminalStreamMarker(detail);
-			if (!(isRetryable === true || (statusCode !== void 0 ? retryableStatus : isRetryable !== false && !terminal))) throw new LlmError(`Command Code stream error: ${detail}`, "PROVIDER_STREAM_ERROR", statusCode !== void 0 ? { status: statusCode } : void 0);
-			throw new LlmError(`Command Code stream error: ${detail}`, "SERVER", statusCode !== void 0 ? { status: statusCode } : void 0);
-		}
+		case "error": throw streamErrorToLlmError(event.error, stringValue(event.message));
 	}
 	return chunks;
 }
@@ -2558,6 +3775,7 @@ function handleCliEvent(asm, event) {
 function handleOpenAIEvent(asm, event) {
 	const chunks = [];
 	if (!isRecord(event)) return chunks;
+	if (event.error !== void 0) throw streamErrorToLlmError(event.error, stringValue(event.message));
 	const choices = event.choices;
 	if (!Array.isArray(choices) || choices.length === 0) {
 		if (event.usage !== void 0) chunks.push({
@@ -2880,8 +4098,13 @@ function renderReport(report, locale, title) {
 	}
 	if (report.credits) {
 		const c = report.credits;
-		const monthlyPct = c.monthlyCredits > 0 ? `${(c.monthlyCredits / (c.monthlyCredits + c.purchasedCredits) * 100).toFixed(0)}%` : "—";
-		lines.push(commandCopy(locale, "creditsHeader"), commandCopy(locale, "monthlyLine").replace("{monthly}", moneyShort(c.monthlyCredits)).replace("{purchased}", moneyShort(c.purchasedCredits)).replace("{free}", moneyShort(c.freeCredits)), commandCopy(locale, "barLine").replace("{bar}", bar(c.monthlyCredits, c.monthlyCredits + c.purchasedCredits)).replace("{pct}", monthlyPct), "", commandCopy(locale, "windowsHeader"), commandCopy(locale, "fiveHourLine").replace("{used}", moneyShort(c.fiveHour.used)).replace("{cap}", moneyShort(c.fiveHour.cap)).replace("{warn}", c.fiveHour.exceeded ? commandCopy(locale, "exceededWarning") : ""), commandCopy(locale, "windowBarLine").replace("{bar}", bar(c.fiveHour.used, c.fiveHour.cap)).replace("{when}", resetLabel(c.fiveHour.resetAt)), commandCopy(locale, "weeklyLine").replace("{used}", moneyShort(c.weekly.used)).replace("{cap}", moneyShort(c.weekly.cap)).replace("{warn}", c.weekly.exceeded ? commandCopy(locale, "exceededWarning") : ""), commandCopy(locale, "windowBarLine").replace("{bar}", bar(c.weekly.used, c.weekly.cap)).replace("{when}", resetLabel(c.weekly.resetAt)), "");
+		const balanceTotal = c.monthlyCredits + c.purchasedCredits;
+		const ratioKnown = c.monthlyReported !== false && c.purchasedReported !== false && balanceTotal > 0;
+		lines.push(commandCopy(locale, "creditsHeader"), commandCopy(locale, "monthlyLine").replace("{monthly}", c.monthlyReported === false ? "—" : moneyShort(c.monthlyCredits)).replace("{purchased}", c.purchasedReported === false ? "—" : moneyShort(c.purchasedCredits)).replace("{free}", c.freeReported === false ? "—" : moneyShort(c.freeCredits)), ...ratioKnown ? [commandCopy(locale, "barLine").replace("{bar}", bar(c.monthlyCredits, balanceTotal)).replace("{pct}", (c.monthlyCredits / balanceTotal * 100).toFixed(0))] : [], "");
+		const windowLines = [];
+		if (c.fiveHour !== void 0) windowLines.push(commandCopy(locale, "fiveHourLine").replace("{used}", moneyShort(c.fiveHour.used)).replace("{cap}", moneyShort(c.fiveHour.cap)).replace("{warn}", c.fiveHour.exceeded ? commandCopy(locale, "exceededWarning") : ""), commandCopy(locale, "windowBarLine").replace("{bar}", bar(c.fiveHour.used, c.fiveHour.cap)).replace("{when}", resetLabel(c.fiveHour.resetAt)));
+		if (c.weekly !== void 0) windowLines.push(commandCopy(locale, "weeklyLine").replace("{used}", moneyShort(c.weekly.used)).replace("{cap}", moneyShort(c.weekly.cap)).replace("{warn}", c.weekly.exceeded ? commandCopy(locale, "exceededWarning") : ""), commandCopy(locale, "windowBarLine").replace("{bar}", bar(c.weekly.used, c.weekly.cap)).replace("{when}", resetLabel(c.weekly.resetAt)));
+		if (windowLines.length > 0) lines.push(commandCopy(locale, "windowsHeader"), ...windowLines, "");
 	}
 	if (report.failures.length > 0) lines.push(commandCopy(locale, "partialFailures").replace("{list}", report.failures.join("; ")), "");
 	if (!report.account && !report.usage && !report.credits) lines.push(commandCopy(locale, "noData"), "");
@@ -2997,7 +4220,16 @@ const USAGE_REPORT_ENDPOINT = "commandcode/report";
 */
 const { reject: reject$1, record: record$1, stringField: stringField$1, numberField, booleanField } = makeBoundaryValidator("commandcode/report result:");
 /** Validate one window-limit block (`fiveHour` / `weekly`). */
+/**
+* Parse one quota window, or undefined when the frame carries no such window.
+*
+* The distinction is load-bearing at this boundary: an ABSENT window means the
+* billing endpoint reported none (an unlimited plan), while a present block with
+* `cap: 0` means uncapped spend that was really reported. Collapsing the two
+* would draw a zeroed quota row for an account that has no such limit.
+*/
 function windowLimit(value, field) {
+	if (value === void 0) return void 0;
 	const source = record$1(value, field);
 	return {
 		used: numberField(source, "used", `${field}.used`),
@@ -3045,13 +4277,18 @@ function parseUsageReport(value) {
 	}
 	if (source.credits !== void 0) {
 		const credits = record$1(source.credits, "credits");
-		report.credits = {
+		const parsed = {
 			monthlyCredits: numberField(credits, "monthlyCredits", "credits.monthlyCredits"),
 			purchasedCredits: numberField(credits, "purchasedCredits", "credits.purchasedCredits"),
-			freeCredits: numberField(credits, "freeCredits", "credits.freeCredits"),
-			fiveHour: windowLimit(credits.fiveHour, "credits.fiveHour"),
-			weekly: windowLimit(credits.weekly, "credits.weekly")
+			freeCredits: numberField(credits, "freeCredits", "credits.freeCredits")
 		};
+		if (credits.monthlyReported !== void 0) parsed.monthlyReported = booleanField(credits, "monthlyReported", "credits.monthlyReported");
+		for (const flag of ["purchasedReported", "freeReported"]) if (credits[flag] !== void 0) parsed[flag] = booleanField(credits, flag, `credits.${flag}`);
+		const fiveHour = windowLimit(credits.fiveHour, "credits.fiveHour");
+		const weekly = windowLimit(credits.weekly, "credits.weekly");
+		if (fiveHour !== void 0) parsed.fiveHour = fiveHour;
+		if (weekly !== void 0) parsed.weekly = weekly;
+		report.credits = parsed;
 	}
 	if (source.plan !== void 0) {
 		const plan = record$1(source.plan, "plan");
@@ -3133,6 +4370,72 @@ function parseCatalog(value) {
 * service and `commandcode` namespace as the usage report.
 */
 const MODELS_DESCRIPTOR = makeRemoteDescriptor(MODELS_ENDPOINT, "models", `${USAGE_REMOTE_PACKAGE}#CommandCodeCatalog`, { parse: parseCatalog });
+/** Canonical `<namespace>/<method>` endpoint of the price-table Remote. */
+const PRICES_ENDPOINT = "commandcode/prices";
+/**
+* The shared read/validate helpers for the price-table endpoint — its own
+* instance so price boundary errors name `commandcode/prices`.
+*/
+const { reject: priceReject, record: priceRecord, stringField: priceString, numberField: priceNumber, booleanField: priceBoolean } = makeBoundaryValidator("commandcode/prices result:");
+/** Parse one rate block (`rates`, or a model's `peak` override). */
+function parseRates(source, field) {
+	const rates = {
+		inputCost: priceNumber(source, "inputCost", `${field}.inputCost`),
+		outputCost: priceNumber(source, "outputCost", `${field}.outputCost`),
+		cacheReadCost: priceNumber(source, "cacheReadCost", `${field}.cacheReadCost`)
+	};
+	if (source.cacheWriteCost !== void 0) rates.cacheWriteCost = priceNumber(source, "cacheWriteCost", `${field}.cacheWriteCost`);
+	return rates;
+}
+/** Parse one untrusted boundary value into a {@link CommandCodeModelPrice}. */
+function parseModelPrice(value) {
+	const source = priceRecord(value, "model");
+	const price = {
+		id: priceString(source, "id", "model.id"),
+		slug: priceString(source, "slug", "model.slug"),
+		...parseRates(source, "model")
+	};
+	if (source.peak !== void 0) price.peak = parseRates(priceRecord(source.peak, "model.peak"), "model.peak");
+	if (source.contextTiers !== void 0) {
+		if (!Array.isArray(source.contextTiers) || source.contextTiers.length === 0) priceReject("contextTiers");
+		let previous = 0;
+		price.contextTiers = source.contextTiers.map((value, index, tiers) => {
+			const tier = priceRecord(value, "contextTier");
+			const out = parseRates(tier, "contextTier");
+			if (tier.maxContext !== void 0) {
+				const max = priceNumber(tier, "maxContext", "contextTier.maxContext");
+				if (!Number.isSafeInteger(max) || max <= previous || index === tiers.length - 1) priceReject("contextTier.maxContext");
+				previous = max;
+				out.maxContext = max;
+			} else if (index !== tiers.length - 1) priceReject("contextTier.maxContext");
+			return out;
+		});
+	}
+	if (source.free !== void 0) price.free = priceBoolean(source, "free", "model.free");
+	return price;
+}
+/** Parse the wire result into a {@link CommandCodePriceTable}. */
+function parsePriceTable(value) {
+	const source = priceRecord(value, "result");
+	const models = source.models;
+	if (!Array.isArray(models)) priceReject("models");
+	const peakHours = source.peakHours;
+	if (!Array.isArray(peakHours)) priceReject("peakHours");
+	return {
+		models: models.map(parseModelPrice),
+		peakHours: peakHours.map((window) => {
+			if (!Array.isArray(window) || window.length !== 2) priceReject("peakHours[]");
+			const [start, end] = window;
+			if (typeof start !== "number" || typeof end !== "number") priceReject("peakHours[]");
+			return [start, end];
+		})
+	};
+}
+/**
+* The price-table invocation descriptor, sharing the same `commandcodeUsage`
+* service and `commandcode` namespace as the report and catalog endpoints.
+*/
+const PRICES_DESCRIPTOR = makeRemoteDescriptor(PRICES_ENDPOINT, "prices", `${USAGE_REMOTE_PACKAGE}#CommandCodePriceTable`, { parse: parsePriceTable });
 //#endregion
 //#region src/login-wire.ts
 /** The canonical endpoint paths of the three login Remotes. */
@@ -3232,6 +4535,15 @@ var CommandCodeUsageService = class extends TypertRemoteService {
 		return this.deps.listModels?.() ?? { models: [] };
 	}
 	/**
+	* The model price table the composer prices an in-progress session with.
+	* Static vendored data (the official pricing page's rates), served Host-side
+	* so the browser bundle never carries a copy that could drift from the
+	* snapshot, and so a price update reaches an open page without a rebuild.
+	*/
+	async prices() {
+		return (this.deps.prices ?? modelPriceTable)();
+	}
+	/**
 	* Start (or rejoin) a browser-login attempt and return its fresh status —
 	* `waiting` carrying the Studio URL. Rejects when the flow cannot start
 	* (no free loopback port, disposed plugin); the Gateway folds the throw
@@ -3268,6 +4580,7 @@ function applyUsageRemote(ctx, deps) {
 			invocations: [
 				...USAGE_HOST_CONTRIBUTION.invocations,
 				MODELS_DESCRIPTOR,
+				PRICES_DESCRIPTOR,
 				...LOGIN_DESCRIPTORS
 			]
 		});
@@ -4325,6 +5638,7 @@ const Config = z.object({
 	*/
 	modelVisibility: z.dict(z.boolean()),
 	webSearch: z.boolean().default(true),
+	showSidebarQuota: z.boolean().default(false),
 	accounts: z.array(z.object({
 		label: z.string(),
 		apiKeyEnv: z.string().role("credential-ref"),
@@ -4370,6 +5684,7 @@ function readModelVisibility(raw) {
 	return entries.length === 0 ? void 0 : Object.fromEntries(entries);
 }
 function apply(ctx, config) {
+	installCostProjection(ctx);
 	let current = () => config;
 	let lastRaw;
 	let lastGood;