@mars-sea/dsh-commandcode-provider 0.11.17 → 0.12.0

package/lib/index.js

@@ -12,6 +12,90 @@ import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { createServer } from "node:http";
 import { createServer as createServer$1 } from "node:net";
 import { WebError } from "@deepseek-ai/dsh-web";
+//#region src/cost-facts.ts
+const zeroCostTokens = () => ({
+	uncachedInputTokens: 0,
+	outputTokens: 0,
+	cacheReadTokens: 0,
+	cacheWriteTokens: 0
+});
+const COST_TOKEN_KEYS = [
+	"uncachedInputTokens",
+	"outputTokens",
+	"cacheReadTokens",
+	"cacheWriteTokens"
+];
+function peakHour(at, windows) {
+	const time = new Date(at);
+	return time.getUTCDay() !== 0 && time.getUTCDay() !== 6 && windows.some(([start, end]) => time.getUTCHours() >= start && time.getUTCHours() < end);
+}
+/**
+* All prompt billing buckets determine a request's band, never cumulative
+* session input.
+*
+* A tiered model returns the matching band and does NOT then apply `peak`: the
+* page publishes those two dimensions independently and no row carries both
+* today, so the combination becoming real is visible before it reaches a user.
+* This ordering is a latent choice, not a verified upstream rule.
+*/
+function requestRates(price, at, contextTokens, table) {
+	const tier = price.contextTiers?.find((tier) => tier.maxContext === void 0 || contextTokens <= tier.maxContext);
+	if (tier !== void 0) return tier;
+	return price.peak !== void 0 && at !== null && peakHour(at, table.peakHours) ? price.peak : price;
+}
+/** Cache version and wire guard: changing bands/rates must refold historical groups. */
+function pricingKey(table) {
+	const rates = (r) => [
+		r.inputCost,
+		r.outputCost,
+		r.cacheReadCost,
+		r.cacheWriteCost ?? null
+	];
+	const canonical = JSON.stringify([
+		"commandCodeCost-v1",
+		table.peakHours,
+		table.models.map((p) => [
+			p.id,
+			p.slug,
+			p.free === true,
+			rates(p),
+			p.peak ? rates(p.peak) : null,
+			p.contextTiers?.map((t) => [t.maxContext ?? null, rates(t)]) ?? null
+		])
+	]);
+	let hash = 2166136261;
+	for (const c of canonical) hash = Math.imul(hash ^ c.charCodeAt(0), 16777619) >>> 0;
+	return hash;
+}
+/** Only safe to merge requests whose billing classification is identical. */
+function costGroupKey(group, table) {
+	const price = table.models.find((p) => p.id === group.model || p.slug === group.model);
+	return JSON.stringify([
+		group.provider,
+		group.model,
+		price === void 0 ? null : requestRates(price, group.at, group.contextTokens, table),
+		group.at === null
+	]);
+}
+//#endregion
+//#region src/plan-tiers.ts
+/** Shared plan-tier presentation facts; safe to inline into the browser bundle. */
+const PLAN_TIER_ORDER = [
+	"go",
+	"goat",
+	"pro",
+	"provider",
+	"max"
+];
+const PLAN_LABELS = {
+	go: "Go",
+	goat: "GOAT",
+	pro: "Pro",
+	provider: "Provider",
+	max: "Max"
+};
+const PLAN_ORDER = Object.fromEntries(PLAN_TIER_ORDER.map((tier, index) => [tier, index]));
+//#endregion
 //#region src/capabilities.ts
 /**
 * Static capability snapshot for the Command Code provider: model →
@@ -19,7 +103,7 @@ import { WebError } from "@deepseek-ai/dsh-web";
 * subscription-plan labels, deals, and hourly (peak/off-peak) pricing.
 *
 * Everything here is synced from official sources — the command-code CLI
-* bundle's model table (`dist/cli.mjs`, re-verified at command-code@1.66.0) and
+* bundle's model table (`dist/cli.mjs`, re-verified at command-code@1.68.0) and
 * the official plan/pricing/model docs; see the dsh-commandcode-upstream skill
 * for the extraction procedures. Keeping the snapshot in its own module
 * confines those frequent sync diffs here: src/adapter.ts holds only the stable
@@ -103,6 +187,13 @@ const KNOWN_EFFORTS = {
 		"xhigh",
 		"max"
 	],
+	"claude-sonnet-5-5": [
+		"low",
+		"medium",
+		"high",
+		"xhigh",
+		"max"
+	],
 	"deepseek/deepseek-v4-flash-fast": [
 		"low",
 		"high",
@@ -113,6 +204,11 @@ const KNOWN_EFFORTS = {
 		"high",
 		"max"
 	],
+	"deepseek/deepseek-v4.1-flash-fast": [
+		"low",
+		"high",
+		"max"
+	],
 	"deepseek/deepseek-v4-flash": ["high", "max"],
 	"deepseek/deepseek-v4-flash-vision-exp": ["high", "max"],
 	"deepseek/deepseek-v4-pro": ["high", "max"],
@@ -348,8 +444,10 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"claude-opus-5",
 	"claude-sonnet-4-6",
 	"claude-sonnet-5",
+	"claude-sonnet-5-5",
 	"deepseek/deepseek-v4-flash-vision-exp",
 	"deepseek/deepseek-v4.1-flash",
+	"deepseek/deepseek-v4.1-flash-fast",
 	"google/gemini-3.1-flash-lite",
 	"google/gemini-3.5-flash",
 	"google/gemini-3.5-flash-lite",
@@ -395,12 +493,13 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 ]);
 /**
 * Models WITHOUT a zero-data-retention upstream, per the official CLI's own
-* registry (`command-code@1.66.0` `dist/cli.mjs`): `modelSupportsZdr(id)` is
+* registry (`command-code@1.68.0` `dist/cli.mjs`): `modelSupportsZdr(id)` is
 * exactly `!nonZdrSet.has(canonicalize(id))`, and `knownModelSupportsZdr`
 * carries the same membership in the sibling route table — the UNION of both
 * is this set. Reading only the sibling route table would drop `meituan/
-* LongCat-2.0` and `stealth/pixel-canary`, which each appear in
-* `modelSupportsZdr` alone. The official docs (commandcode.ai/docs/resources/
+* LongCat-2.0`, which appears in `modelSupportsZdr` alone (re-read from the
+* 1.66.0 / 1.67.0 / 1.68.0 artifacts on 2026-09-29: the two stealth-preview
+* rows sit in BOTH sets, so LongCat is the only divergence). The official docs (commandcode.ai/docs/resources/
 * zdr) put it in prose — "99% of our models have ZDR-capable upstreams … only
 * a small handful of models are affected" — so the CLI's exclusion list is
 * the only per-model evidence there is; a ZDR request naming one of these
@@ -422,12 +521,15 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 * (its `zdr:{only:[…]}` provider routes and the per-provider `zdr`/`noTraining`
 * flags) is upstream-internal routing, not a per-model contract, so this table
 * is the snapshot of the exclusion set and nothing more. It is a rare change:
-* 20 members held across 1.62.0 → 1.64.0, and 1.65.0 and 1.66.0 each added
-* exactly one (the two stealth-preview models below).
+* 20 members held across 1.62.0 → 1.64.0, 1.65.0 and 1.66.0 each added exactly
+* one (the two stealth-preview models below), 1.67.0 added one
+* (`deepseek/deepseek-v4.1-flash-fast`), and 1.68.0 changed nothing — 23
+* members as of 2026-09-29.
 */
 const KNOWN_NON_ZDR_MODELS = /* @__PURE__ */ new Set([
 	"MiniMaxAI/MiniMax-M3",
 	"Qwen/Qwen3.8-Max-0902",
+	"deepseek/deepseek-v4.1-flash-fast",
 	"meituan/LongCat-2.0",
 	"meta/muse-spark-1.1",
 	"meta/muse-spark-1.2",
@@ -539,8 +641,8 @@ function requiresMessagesEndpoint(modelId) {
 * `/docs/plans/max` and `/docs/resources/pricing-limits`). Each plan's model
 * list is a superset of the one below it: Go ⊂ GOAT ⊂ Pro ⊂ Provider/Max.
 * Models absent from every plan list (Claude Opus/Fable, Fugu Ultra) are
-* Provider-tier. Re-verified at command-code@1.66.0 (2026-09-27): 82 catalog
-* ids at 52/60/74/82 cumulative, a strict superset chain — every release since
+* Provider-tier. Re-verified at command-code@1.68.0 (2026-09-29): 84 catalog
+* ids at 53/62/76/84 cumulative, a strict superset chain — every release since
 * 1.49.0 has been additive with no tier move, and per-entry tags below name the
 * release that added each row.
 *
@@ -568,6 +670,7 @@ const KNOWN_PLANS = {
 	"Qwen/Qwen3.8-Omni-Flash": "go",
 	"deepseek/deepseek-v4-flash-fast": "go",
 	"deepseek/deepseek-v4.1-flash": "go",
+	"deepseek/deepseek-v4.1-flash-fast": "go",
 	"deepseek/deepseek-v4-flash": "go",
 	"deepseek/deepseek-v4-flash-vision-exp": "go",
 	"deepseek/deepseek-v4-pro": "go",
@@ -605,6 +708,7 @@ const KNOWN_PLANS = {
 	"zai-org/GLM-5.2": "go",
 	"zai-org/GLM-5.2-Fast": "go",
 	"zai-org/GLM-5.3": "go",
+	"claude-sonnet-5-5": "goat",
 	"google/gemini-3.7-flash": "goat",
 	"google/gemini-3.8-flash": "goat",
 	"gpt-5.6-sol": "goat",
@@ -636,25 +740,6 @@ const KNOWN_PLANS = {
 	"gpt-6-astra": "provider",
 	"sakana/fugu-ultra": "provider"
 };
-/** Official display labels for each plan tier. */
-const PLAN_LABELS = {
-	go: "Go",
-	goat: "GOAT",
-	pro: "Pro",
-	provider: "Provider",
-	max: "Max"
-};
-/**
-* Plan-tier sort weights, low to high. Models outside the snapshot (unknown
-* plans) sort after every known tier, keeping known models predictable.
-*/
-const PLAN_ORDER = {
-	go: 0,
-	goat: 1,
-	pro: 2,
-	provider: 3,
-	max: 4
-};
 /**
 * Whether a model is free (requests cost no credits), per the pricing page's
 * deals (`KNOWN_DEALS` `free: true`). Free models lead the picker regardless
@@ -682,7 +767,7 @@ function compareByPlan(a, b) {
 /**
 * Subscription plan table, synced from the official CLI bundle's plan maps
 * (located by the `"individual-go"` key in `dist/cli.mjs`, re-verified unchanged
-* through command-code@1.66.0): subscription `planId` prefix → display name and
+* through command-code@1.68.0): subscription `planId` prefix → display name and
 * the plan's monthly credit total. This is the account's own subscription
 * (from `/alpha/billing/subscriptions`) — distinct from {@link KNOWN_PLANS},
 * which maps catalog models to their minimum tier.
@@ -812,7 +897,7 @@ const KNOWN_DEALS = {
 * charges by the hour: peak hours are 01:00–04:00 and 06:00–10:00 UTC (7h per
 * weekday, full price) **Monday to Friday only**; the other 17 hours of a
 * weekday and every hour of Saturday/Sunday (UTC) are off-peak at half price.
-* Exactly four models carry the page's `timeOfDay` block (the four rows below).
+* Exactly five models carry the page's `timeOfDay` block (the five rows below).
 * The picker shows the *current* state as a compact label (`Peak`/`Half`)
 * matching the English noun style of the other markers (`Image`, `FREE`), so a
 * developer can tell at a glance whether calling the model right now is cheap
@@ -837,7 +922,8 @@ const KNOWN_PEAK_PRICING = /* @__PURE__ */ new Set([
 	"deepseek/deepseek-v4-pro",
 	"deepseek/deepseek-v4-flash",
 	"deepseek/deepseek-v4-flash-vision-exp",
-	"deepseek/deepseek-v4.1-flash"
+	"deepseek/deepseek-v4.1-flash",
+	"deepseek/deepseek-v4.1-flash-fast"
 ]);
 /**
 * Peak hours (UTC, hour-of-day range end-exclusive): 01–03 and 06–09.
@@ -860,11 +946,7 @@ const PEAK_HOUR_RANGES = [[1, 4], [6, 10]];
 * the one in {@link KNOWN_PEAK_PRICING} still gets the right half of the day.
 */
 function isPeakPricingHour(now = Date.now()) {
-	const at = new Date(now);
-	const day = at.getUTCDay();
-	if (day === 0 || day === 6) return false;
-	const hour = at.getUTCHours();
-	return PEAK_HOUR_RANGES.some(([start, end]) => hour >= start && hour < end);
+	return peakHour(now, PEAK_HOUR_RANGES);
 }
 /**
 * As {@link isPeakPricingHour}, plus the {@link KNOWN_PEAK_PRICING} membership
@@ -945,6 +1027,27 @@ function capabilityDescription(modelId, contextWindow, now = Date.now()) {
 //#endregion
 //#region src/model-prices.ts
 /**
+* The plan tiers a per-model allowance exists for, cheapest first. Ordering
+* matters: {@link allowanceTierForWeight} matches a tier weight against these
+* rather than against hard-coded numbers, so this table and the subscription
+* table cannot drift apart silently.
+*/
+const ALLOWANCE_TIERS = ["goat", "pro"];
+/**
+* Which allowance bracket a plan-tier weight belongs to, or undefined when that
+* plan has no per-model allowance.
+*
+* Weights come from `KNOWN_SUBSCRIPTION_PLANS` (go 0 · goat 1 · pro 2 ·
+* provider 3 · max/ultra 4) and {@link PLAN_ORDER} is the same scale, which is
+* what makes the lookup exact: Go, Provider, Max and Ultra have no published
+* allowance, and answering with a neighbouring tier's figure would be a
+* fabricated number rather than a missing one.
+*/
+function allowanceTierForWeight(tierWeight) {
+	if (tierWeight === void 0) return void 0;
+	return ALLOWANCE_TIERS.find((tier) => PLAN_ORDER[tier] === tierWeight);
+}
+/**
 * Every price row the page publishes, ordered by its own slug.
 *
 * Note on the GPT rows: `gpt-5.3-codex`, `gpt-5.4`, `gpt-5.4-mini` and
@@ -964,7 +1067,11 @@ const MODEL_PRICE_ROWS = [
 			50,
 			1,
 			12.5
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "claude-fable-5-1",
@@ -973,7 +1080,11 @@ const MODEL_PRICE_ROWS = [
 			50,
 			.25,
 			12.5
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "claude-haiku-4-5",
@@ -982,7 +1093,11 @@ const MODEL_PRICE_ROWS = [
 			5,
 			.1,
 			1.25
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "claude-opus-4-6",
@@ -991,7 +1106,11 @@ const MODEL_PRICE_ROWS = [
 			25,
 			.5,
 			6.25
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "claude-opus-4-7",
@@ -1000,7 +1119,11 @@ const MODEL_PRICE_ROWS = [
 			25,
 			.5,
 			6.25
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "claude-opus-4-8",
@@ -1009,7 +1132,11 @@ const MODEL_PRICE_ROWS = [
 			25,
 			.5,
 			6.25
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "claude-opus-5",
@@ -1018,7 +1145,11 @@ const MODEL_PRICE_ROWS = [
 			25,
 			.5,
 			6.25
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "claude-opus-5-5",
@@ -1027,7 +1158,11 @@ const MODEL_PRICE_ROWS = [
 			20,
 			.2,
 			5
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "claude-sonnet-4-6",
@@ -1036,7 +1171,11 @@ const MODEL_PRICE_ROWS = [
 			15,
 			.3,
 			3.75
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "claude-sonnet-5",
@@ -1045,7 +1184,24 @@ const MODEL_PRICE_ROWS = [
 			10,
 			.2,
 			2.5
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
+	},
+	{
+		id: "claude-sonnet-5-5",
+		rates: [
+			2,
+			10,
+			.2,
+			2.5
+		],
+		allowance: {
+			goat: 10,
+			pro: 20
+		}
 	},
 	{
 		id: "deepseek-v4-flash",
@@ -1058,7 +1214,11 @@ const MODEL_PRICE_ROWS = [
 			.3,
 			1.2,
 			.006
-		]
+		],
+		allowance: {
+			goat: 60,
+			pro: 70
+		}
 	},
 	{
 		id: "deepseek-v4-flash-fast",
@@ -1066,7 +1226,11 @@ const MODEL_PRICE_ROWS = [
 			.28,
 			.56,
 			.07
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "deepseek-v4-flash-vision-exp",
@@ -1079,7 +1243,11 @@ const MODEL_PRICE_ROWS = [
 			.3,
 			1.2,
 			.006
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "deepseek-v4-pro",
@@ -1092,7 +1260,11 @@ const MODEL_PRICE_ROWS = [
 			1.32,
 			3.96,
 			.044
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "deepseek-v4.1-flash",
@@ -1105,7 +1277,28 @@ const MODEL_PRICE_ROWS = [
 			.3,
 			1.2,
 			.006
-		]
+		],
+		allowance: {
+			goat: 60,
+			pro: 70
+		}
+	},
+	{
+		id: "deepseek-v4.1-flash-fast",
+		rates: [
+			.16,
+			.58,
+			.016
+		],
+		peak: [
+			.32,
+			1.16,
+			.032
+		],
+		allowance: {
+			goat: 60,
+			pro: 70
+		}
 	},
 	{
 		id: "fugu-ultra",
@@ -1113,7 +1306,11 @@ const MODEL_PRICE_ROWS = [
 			5,
 			30,
 			.5
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "gemini-3.1-flash-lite",
@@ -1121,7 +1318,11 @@ const MODEL_PRICE_ROWS = [
 			.25,
 			1.5,
 			.03
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "gemini-3.5-flash",
@@ -1129,7 +1330,11 @@ const MODEL_PRICE_ROWS = [
 			1.5,
 			9,
 			.15
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "gemini-3.5-flash-lite",
@@ -1137,7 +1342,11 @@ const MODEL_PRICE_ROWS = [
 			.3,
 			2.5,
 			.03
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "gemini-3.6-flash",
@@ -1145,7 +1354,11 @@ const MODEL_PRICE_ROWS = [
 			1.5,
 			7.5,
 			.15
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "gemini-3.7-flash",
@@ -1154,7 +1367,11 @@ const MODEL_PRICE_ROWS = [
 			7.5,
 			.15,
 			.08334
-		]
+		],
+		allowance: {
+			goat: 40,
+			pro: 50
+		}
 	},
 	{
 		id: "gemini-3.8-flash",
@@ -1162,7 +1379,11 @@ const MODEL_PRICE_ROWS = [
 			1.5,
 			7.5,
 			.15
-		]
+		],
+		allowance: {
+			goat: 40,
+			pro: 50
+		}
 	},
 	{
 		id: "glm-5",
@@ -1170,7 +1391,11 @@ const MODEL_PRICE_ROWS = [
 			1,
 			3.2,
 			.2
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "glm-5.1",
@@ -1178,7 +1403,11 @@ const MODEL_PRICE_ROWS = [
 			1.4,
 			4.4,
 			.26
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "glm-5.2",
@@ -1186,7 +1415,11 @@ const MODEL_PRICE_ROWS = [
 			1.4,
 			4.4,
 			.26
-		]
+		],
+		allowance: {
+			goat: 70,
+			pro: 80
+		}
 	},
 	{
 		id: "glm-5.2-fast",
@@ -1194,7 +1427,11 @@ const MODEL_PRICE_ROWS = [
 			3,
 			10.25,
 			.5
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "glm-5.3",
@@ -1202,7 +1439,11 @@ const MODEL_PRICE_ROWS = [
 			1.4,
 			4.4,
 			.26
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "glm-5.3-flash",
@@ -1210,7 +1451,11 @@ const MODEL_PRICE_ROWS = [
 			.15,
 			.5,
 			.03
-		]
+		],
+		allowance: {
+			goat: 40,
+			pro: 50
+		}
 	},
 	{
 		id: "glm-5.3-flashx",
@@ -1218,7 +1463,11 @@ const MODEL_PRICE_ROWS = [
 			.37,
 			1.25,
 			.075
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "gpt-5.3-codex",
@@ -1227,7 +1476,11 @@ const MODEL_PRICE_ROWS = [
 			8,
 			.5,
 			0
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "gpt-5.4",
@@ -1236,7 +1489,11 @@ const MODEL_PRICE_ROWS = [
 			15,
 			.25,
 			0
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "gpt-5.4-mini",
@@ -1245,7 +1502,11 @@ const MODEL_PRICE_ROWS = [
 			4.5,
 			.075,
 			0
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "gpt-5.5",
@@ -1254,7 +1515,11 @@ const MODEL_PRICE_ROWS = [
 			30,
 			.5,
 			0
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "gpt-5.6-luna",
@@ -1264,6 +1529,10 @@ const MODEL_PRICE_ROWS = [
 			.02,
 			.25
 		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		},
 		contextTiers: [{
 			"maxContext": 272e3,
 			"rates": [
@@ -1287,6 +1556,10 @@ const MODEL_PRICE_ROWS = [
 			.5,
 			6.25
 		],
+		allowance: {
+			goat: 70,
+			pro: 80
+		},
 		contextTiers: [{
 			"maxContext": 272e3,
 			"rates": [
@@ -1310,6 +1583,10 @@ const MODEL_PRICE_ROWS = [
 			.2,
 			2.5
 		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		},
 		contextTiers: [{
 			"maxContext": 272e3,
 			"rates": [
@@ -1333,6 +1610,10 @@ const MODEL_PRICE_ROWS = [
 			1,
 			12.5
 		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		},
 		contextTiers: [{
 			"maxContext": 272e3,
 			"rates": [
@@ -1356,6 +1637,10 @@ const MODEL_PRICE_ROWS = [
 			.01,
 			.125
 		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		},
 		contextTiers: [{
 			"maxContext": 272e3,
 			"rates": [
@@ -1379,6 +1664,10 @@ const MODEL_PRICE_ROWS = [
 			.2,
 			2.5
 		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		},
 		contextTiers: [{
 			"maxContext": 272e3,
 			"rates": [
@@ -1400,7 +1689,11 @@ const MODEL_PRICE_ROWS = [
 			2,
 			6,
 			.5
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "grok-4.6",
@@ -1409,6 +1702,10 @@ const MODEL_PRICE_ROWS = [
 			6,
 			.5
 		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		},
 		contextTiers: [{
 			"maxContext": 2e5,
 			"rates": [
@@ -1429,18 +1726,39 @@ const MODEL_PRICE_ROWS = [
 			3.6,
 			.3
 		],
+		listRates: [
+			2,
+			6,
+			.5
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		},
 		contextTiers: [{
 			"maxContext": 2e5,
 			"rates": [
 				1.2,
 				3.6,
 				.3
+			],
+			"listRates": [
+				2,
+				6,
+				.5
 			]
-		}, { "rates": [
-			2.4,
-			7.2,
-			.6
-		] }]
+		}, {
+			"rates": [
+				2.4,
+				7.2,
+				.6
+			],
+			"listRates": [
+				4,
+				12,
+				1
+			]
+		}]
 	},
 	{
 		id: "inkling",
@@ -1448,7 +1766,11 @@ const MODEL_PRICE_ROWS = [
 			1,
 			4.05,
 			.17
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "inkling-small",
@@ -1456,7 +1778,11 @@ const MODEL_PRICE_ROWS = [
 			.5,
 			1.2,
 			.1
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "kimi-k2.5",
@@ -1464,7 +1790,11 @@ const MODEL_PRICE_ROWS = [
 			.6,
 			3,
 			.1
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "kimi-k2.6",
@@ -1472,7 +1802,11 @@ const MODEL_PRICE_ROWS = [
 			.95,
 			4,
 			.16
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "kimi-k2.7-code",
@@ -1480,7 +1814,11 @@ const MODEL_PRICE_ROWS = [
 			.95,
 			4,
 			.19
-		]
+		],
+		allowance: {
+			goat: 60,
+			pro: 70
+		}
 	},
 	{
 		id: "kimi-k2.7-code-highspeed",
@@ -1488,7 +1826,11 @@ const MODEL_PRICE_ROWS = [
 			1.9,
 			8,
 			.38
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "kimi-k3",
@@ -1496,7 +1838,11 @@ const MODEL_PRICE_ROWS = [
 			3,
 			15,
 			.3
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "longcat-2.0",
@@ -1504,7 +1850,11 @@ const MODEL_PRICE_ROWS = [
 			.3,
 			1.2,
 			.006
-		]
+		],
+		allowance: {
+			goat: 50,
+			pro: 60
+		}
 	},
 	{
 		id: "mimo-v2.5",
@@ -1512,7 +1862,16 @@ const MODEL_PRICE_ROWS = [
 			.14,
 			.28,
 			.0028
-		]
+		],
+		listRates: [
+			.8,
+			4,
+			.16
+		],
+		allowance: {
+			goat: 30,
+			pro: 40
+		}
 	},
 	{
 		id: "mimo-v2.5-pro",
@@ -1520,7 +1879,16 @@ const MODEL_PRICE_ROWS = [
 			.435,
 			.87,
 			.0036
-		]
+		],
+		listRates: [
+			2,
+			6,
+			.4
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "mimo-v2.6-flash",
@@ -1528,7 +1896,11 @@ const MODEL_PRICE_ROWS = [
 			.14,
 			.28,
 			.0028
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "mimo-v2.6-pro",
@@ -1536,7 +1908,11 @@ const MODEL_PRICE_ROWS = [
 			.435,
 			.87,
 			.0036
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "mimo-v2.6-pro-ultraspeed",
@@ -1544,7 +1920,11 @@ const MODEL_PRICE_ROWS = [
 			4.35,
 			8.7,
 			.036
-		]
+		],
+		allowance: {
+			goat: 10,
+			pro: 20
+		}
 	},
 	{
 		id: "minimax-m2.5",
@@ -1552,7 +1932,11 @@ const MODEL_PRICE_ROWS = [
 			.3,
 			1.2,
 			.03
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "minimax-m2.7",
@@ -1560,7 +1944,11 @@ const MODEL_PRICE_ROWS = [
 			.3,
 			1.2,
 			.06
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "minimax-m3",
@@ -1568,7 +1956,16 @@ const MODEL_PRICE_ROWS = [
 			.3,
 			1.2,
 			.06
-		]
+		],
+		listRates: [
+			.6,
+			2.4,
+			.12
+		],
+		allowance: {
+			goat: 47,
+			pro: 57
+		}
 	},
 	{
 		id: "muse-spark-1.1",
@@ -1576,7 +1973,11 @@ const MODEL_PRICE_ROWS = [
 			1.25,
 			4.25,
 			.15
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "muse-spark-1.2",
@@ -1584,7 +1985,11 @@ const MODEL_PRICE_ROWS = [
 			1.25,
 			4.25,
 			.15
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "muse-spark-1.2-contributor",
@@ -1592,7 +1997,11 @@ const MODEL_PRICE_ROWS = [
 			.1,
 			.2,
 			.002
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "muse-spark-1.3",
@@ -1600,7 +2009,11 @@ const MODEL_PRICE_ROWS = [
 			1.25,
 			4.25,
 			.15
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "muse-spark-1.3-contributor",
@@ -1608,7 +2021,11 @@ const MODEL_PRICE_ROWS = [
 			.1,
 			.2,
 			.002
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "nemotron-3-ultra",
@@ -1616,7 +2033,11 @@ const MODEL_PRICE_ROWS = [
 			.6,
 			2.4,
 			.12
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "qwen-3.6-max",
@@ -1625,7 +2046,11 @@ const MODEL_PRICE_ROWS = [
 			7.8,
 			.26,
 			1.63
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "qwen-3.6-plus",
@@ -1634,6 +2059,10 @@ const MODEL_PRICE_ROWS = [
 			3,
 			.1
 		],
+		allowance: {
+			goat: 33,
+			pro: 43
+		},
 		contextTiers: [{
 			"maxContext": 256e3,
 			"rates": [
@@ -1655,6 +2084,10 @@ const MODEL_PRICE_ROWS = [
 			.006,
 			.038
 		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		},
 		contextTiers: [
 			{
 				"maxContext": 32e3,
@@ -1689,7 +2122,11 @@ const MODEL_PRICE_ROWS = [
 			7.5,
 			.5,
 			3.13
-		]
+		],
+		allowance: {
+			goat: 33,
+			pro: 43
+		}
 	},
 	{
 		id: "qwen-3.7-plus",
@@ -1699,6 +2136,10 @@ const MODEL_PRICE_ROWS = [
 			.08,
 			.5
 		],
+		allowance: {
+			goat: 33,
+			pro: 43
+		},
 		contextTiers: [{
 			"maxContext": 256e3,
 			"rates": [
@@ -1720,7 +2161,11 @@ const MODEL_PRICE_ROWS = [
 			.4,
 			3,
 			.04
-		]
+		],
+		allowance: {
+			goat: 70,
+			pro: 80
+		}
 	},
 	{
 		id: "qwen-3.8-flash",
@@ -1728,7 +2173,11 @@ const MODEL_PRICE_ROWS = [
 			.16,
 			.47,
 			.016
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "qwen-3.8-max",
@@ -1737,7 +2186,11 @@ const MODEL_PRICE_ROWS = [
 			6,
 			.25,
 			2.5
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "qwen-3.8-max-0902",
@@ -1745,7 +2198,11 @@ const MODEL_PRICE_ROWS = [
 			2,
 			6,
 			.25
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "qwen-3.8-omni-flash",
@@ -1753,7 +2210,11 @@ const MODEL_PRICE_ROWS = [
 			.15,
 			.47,
 			.016
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "step-3.5-flash",
@@ -1761,7 +2222,11 @@ const MODEL_PRICE_ROWS = [
 			.09,
 			.3,
 			.02
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "step-3.7-flash",
@@ -1769,7 +2234,11 @@ const MODEL_PRICE_ROWS = [
 			.2,
 			1.15,
 			.04
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "step-5-preview",
@@ -1777,7 +2246,11 @@ const MODEL_PRICE_ROWS = [
 			1,
 			2.7,
 			.05
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "tencent/hy3-paid",
@@ -1785,7 +2258,11 @@ const MODEL_PRICE_ROWS = [
 			.14,
 			.58,
 			.035
-		]
+		],
+		allowance: {
+			goat: 70,
+			pro: 80
+		}
 	},
 	{
 		id: "tencent/hy4-preview",
@@ -1793,7 +2270,11 @@ const MODEL_PRICE_ROWS = [
 			.834,
 			2.501,
 			.042
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "typesafe/jev",
@@ -1801,7 +2282,11 @@ const MODEL_PRICE_ROWS = [
 			.042,
 			0,
 			0
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	}
 ];
 /**
@@ -1854,16 +2339,23 @@ function ratesOf(values) {
 	if (values[3] !== void 0) rates.cacheWriteCost = values[3];
 	return rates;
 }
-/** Build the full price row the browser prices a session with. */
-function wireRow(id, slug, row) {
+/**
+* Build the full price row the browser prices a session with.
+*
+* Every figure switches together: once the deal stops being live, the base
+* rates AND each context band come from the pre-discount set, so a session
+* priced after a promotion ends can never mix the two.
+*/
+function wireRow(id, slug, row, now) {
+	const promotional = dealLabel(id, now) !== void 0;
 	const price = {
 		id,
 		slug,
-		...ratesOf(row.rates)
+		...ratesOf(promotional ? row.rates : row.listRates ?? row.rates)
 	};
 	if (row.peak !== void 0) price.peak = ratesOf(row.peak);
 	if (row.contextTiers !== void 0) price.contextTiers = row.contextTiers.map((tier) => ({
-		...ratesOf(tier.rates),
+		...ratesOf(promotional ? tier.rates : tier.listRates ?? tier.rates),
 		...tier.maxContext === void 0 ? {} : { maxContext: tier.maxContext }
 	}));
 	return price;
@@ -1878,8 +2370,13 @@ function wireRow(id, slug, row) {
 * explicitly at zero so the composer can say so instead of showing nothing; the
 * peak windows travel with the table so the browser applies the very schedule
 * this snapshot knows instead of restating it.
+*
+* `now` (defaults to `Date.now()`) resolves lapsed promotions: a discounted row
+* whose `expiresAt` has passed is served at its pre-discount `listRates`, the
+* same instant {@link dealLabel} stops showing its badge. The table is rebuilt
+* per request, so that switch needs no redeploy.
 */
-function modelPriceTable() {
+function modelPriceTable(now = Date.now()) {
 	const bySlug = new Map(MODEL_PRICE_ROWS.map((row) => [row.id, row]));
 	const known = new Set(bySlug.keys());
 	const models = [];
@@ -1901,86 +2398,56 @@ function modelPriceTable() {
 		const row = bySlug.get(slug);
 		if (row === void 0) continue;
 		claimed.add(slug);
-		models.push(wireRow(catalogId, slug, row));
+		models.push(wireRow(catalogId, slug, row, now));
 	}
 	for (const row of MODEL_PRICE_ROWS) {
 		if (claimed.has(row.id)) continue;
-		models.push(wireRow(row.id, row.id, row));
+		models.push(wireRow(row.id, row.id, row, now));
 	}
 	return {
 		models,
 		peakHours: PEAK_HOUR_RANGES.map(([start, end]) => [start, end])
 	};
 }
-//#endregion
-//#region src/cost-facts.ts
-const zeroCostTokens = () => ({
-	uncachedInputTokens: 0,
-	outputTokens: 0,
-	cacheReadTokens: 0,
-	cacheWriteTokens: 0
-});
-const COST_TOKEN_KEYS = [
-	"uncachedInputTokens",
-	"outputTokens",
-	"cacheReadTokens",
-	"cacheWriteTokens"
-];
-function peakHour(at, windows) {
-	const time = new Date(at);
-	return time.getUTCDay() !== 0 && time.getUTCDay() !== 6 && windows.some(([start, end]) => time.getUTCHours() >= start && time.getUTCHours() < end);
-}
+/** Slug-keyed view of the rows, built once: neither table nor allowance mutates. */
+const ROWS_BY_SLUG = new Map(MODEL_PRICE_ROWS.map((row) => [row.id, row]));
+const KNOWN_SLUGS = new Set(ROWS_BY_SLUG.keys());
 /**
-* All prompt billing buckets determine a request's band, never cumulative
-* session input.
+* The per-model monthly allowance for a CATALOG model id, or undefined when the
+* page carries none (a model without a price row, or the free stealth previews
+* the estimator array omits).
 *
-* A tiered model returns the matching band and does NOT then apply `peak`: the
-* page publishes those two dimensions independently and no row carries both
-* today, so the combination becoming real is visible before it reaches a user.
-* This ordering is a latent choice, not a verified upstream rule.
-*/
-function requestRates(price, at, contextTokens, table) {
-	const tier = price.contextTiers?.find((tier) => tier.maxContext === void 0 || contextTokens <= tier.maxContext);
-	if (tier !== void 0) return tier;
-	return price.peak !== void 0 && at !== null && peakHour(at, table.peakHours) ? price.peak : price;
+* Resolution rides the same slug rules as the price table, so
+* `MiniMaxAI/MiniMax-M3` finds the row the page files under `minimax-m3` — the
+* settings page must not grow a second mapping that can drift from this one.
+* The settings page asks for a model only while rendering a list it already
+* has, so this stays a pure lookup with no clock: an allowance is not
+* time-dependent (a plan's figure does not lapse the way a promotional rate
+* does; when the page re-prices it, the next sync carries it).
+*/
+function modelAllowanceFor(modelId) {
+	const slug = priceSlugFor(modelId, KNOWN_SLUGS);
+	if (slug === void 0) return void 0;
+	return ROWS_BY_SLUG.get(slug)?.allowance;
 }
-/** Cache version and wire guard: changing bands/rates must refold historical groups. */
-function pricingKey(table) {
-	const rates = (r) => [
-		r.inputCost,
-		r.outputCost,
-		r.cacheReadCost,
-		r.cacheWriteCost ?? null
-	];
-	const canonical = JSON.stringify([
-		"commandCodeCost-v1",
-		table.peakHours,
-		table.models.map((p) => [
-			p.id,
-			p.slug,
-			p.free === true,
-			rates(p),
-			p.peak ? rates(p.peak) : null,
-			p.contextTiers?.map((t) => [t.maxContext ?? null, rates(t)]) ?? null
-		])
-	]);
-	let hash = 2166136261;
-	for (const c of canonical) hash = Math.imul(hash ^ c.charCodeAt(0), 16777619) >>> 0;
-	return hash;
+//#endregion
+//#region src/wire-guards.ts
+/** Non-throwing value guards for untrusted provider payloads. */
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-/** Only safe to merge requests whose billing classification is identical. */
-function costGroupKey(group, table) {
-	const price = table.models.find((p) => p.id === group.model || p.slug === group.model);
-	return JSON.stringify([
-		group.provider,
-		group.model,
-		price === void 0 ? null : requestRates(price, group.at, group.contextTokens, table),
-		group.at === null
-	]);
+function stringValue(value) {
+	return typeof value === "string" ? value : void 0;
+}
+function numberValue(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function booleanValue(value) {
+	return typeof value === "boolean" ? value : void 0;
 }
 //#endregion
 //#region src/cost-projection.ts
-const record$2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? v : void 0;
+const record$2 = (v) => isRecord(v) ? v : void 0;
 const finite = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
 function tokensOf(value) {
 	const u = record$2(value);
@@ -2069,11 +2536,18 @@ function createCostProjection(table = modelPriceTable()) {
 				...g,
 				tokens: { ...g.tokens }
 			}));
+			const byKey = /* @__PURE__ */ new Map();
+			groups.forEach((g, i) => {
+				const key = costGroupKey(g, table);
+				if (!byKey.has(key)) byKey.set(key, i);
+			});
+			const groupKey = costGroupKey(group, table);
 			if (previous) {
-				const old = groups.find((g) => costGroupKey(g, table) === costGroupKey(previous, table));
-				if (old) for (const k of COST_TOKEN_KEYS) old.tokens[k] -= previous.tokens[k];
+				const old = byKey.get(costGroupKey(previous, table));
+				if (old !== void 0) for (const k of COST_TOKEN_KEYS) groups[old].tokens[k] -= previous.tokens[k];
 			}
-			let target = groups.find((g) => costGroupKey(g, table) === costGroupKey(group, table));
+			const targetIdx = byKey.get(groupKey);
+			let target = targetIdx === void 0 ? void 0 : groups[targetIdx];
 			if (!target) {
 				target = {
 					...group,
@@ -2143,24 +2617,18 @@ const IDENTITY_ENCODING_HEADER = { "accept-encoding": "identity" };
 * @module dsh-commandcode-provider/accounts
 */
 /**
-* Upper bound on the retry wait this pool attaches to the all-exhausted
-* `RATE_LIMIT` error. Must equal the `backoff.maxDelayMs` in the adapter's
-* `providerRetryPolicy` (which imports it from here): dsh-llm-retry honors a
-* provider-specified wait verbatim only at or below that cap — a LONGER one
-* makes the executor abandon the retry instead of falling back to local backoff
-* (in normal mode), turning "poll until the window opens" into "fail now".
+* Upper bound on the retry wait attached to the all-exhausted `RATE_LIMIT`.
+* Must equal the adapter's `backoff.maxDelayMs`: dsh-llm-retry honors a
+* provider wait verbatim only at or below that cap — a longer one abandons the
+* retry instead of falling back to local backoff, turning "poll until the
+* window opens" into "fail now".
 */
 const RETRY_MAX_DELAY_MS = 9e5;
 /**
 * How long an explicitly selected account's rate-limit mark may stand before
-* its window is probed again.
-*
-* A 429 whose reset was never learned marks the key `unknown`, which
-* {@link accountUsable} refuses — for a key nobody asked for that is correct
-* (only the all-marked pass clears it, and it costs one billing call), but for
-* the user's own pinned account a single 429 would demote it until the process
-* restarts (issue #51). Once per interval per key bounds a probe endpoint that
-* keeps failing; a successful probe resolves the mark for good.
+* its window is probed again. Without this, a single 429 on the user's pinned
+* account demotes it until the process restarts (issue #51); probing at most
+* once per interval per key bounds a probe endpoint that keeps failing.
 */
 const EXPLICIT_ACCOUNT_PROBE_INTERVAL_MS = 6e4;
 /** A labeled, human-readable clock reading for error messages. */
@@ -2265,26 +2733,18 @@ var CommandCodeAccountPool = class {
 		return out;
 	}
 	/**
-	* Hand out the key for a request: the model-routed account when the request's
-	* model matches a rule (and that account is usable), else the manually
-	* preferred account when usable, else the first usable account in rotation
-	* order. Returns `undefined` when no account resolves any key at all, or when
-	* an account this request already used is still UNMARKED — that rejection is
-	* the honest answer, so the caller's own rejection surfaces as itself. Throws
-	* `RATE_LIMIT` (naming the earliest window reset) or `INVALID_CREDENTIAL`
-	* when accounts exist but every one of them is marked.
+	* Hand out the key for a request: the model-routed account when usable, else
+	* the manually preferred account when usable, else the first usable account
+	* in rotation order. Returns `undefined` when no account resolves any key,
+	* or when an account this request already used is still UNMARKED — the
+	* caller's own rejection is the honest answer then. Throws `RATE_LIMIT` /
+	* `INVALID_CREDENTIAL` when every account is marked.
 	*
-	* `options.model` is the request's model id; routing rules re-read per
-	* resolution, so a settings change applies live. `options.tried` lists the
-	* keys this request has already used — the just-rejected one included — and
-	* they are removed from the resolution entirely, which is what lets one
-	* request walk a four-account pool: a rejection that does not mark the key
-	* (no credits, a model outside the account's plan) would otherwise be offered
-	* again on every attempt and the accounts behind it never reached.
-	*
-	* An explicit selection (the pin or a model rule) that a rate-limit mark would
-	* demote is probed before the fallback serves, so "falls back while exhausted"
-	* never becomes "stays demoted until the process restarts" (issue #51).
+	* `options.tried` lists the keys this request already used; they are removed
+	* from the resolution entirely, which is what lets one request walk a
+	* four-account pool. An explicit selection (pin or model rule) that a
+	* rate-limit mark would demote is probed first, so a fallback never becomes
+	* permanent (issue #51). Rules re-read per resolution, so settings apply live.
 	*/
 	async resolveKey(options) {
 		const accounts = await this.resolvedAccounts();
@@ -2320,18 +2780,7 @@ var CommandCodeAccountPool = class {
 				this.states.delete(account.key);
 				return;
 			}
-			if (probe.resetAt > 0) this.states.set(account.key, {
-				kind: "cooldown",
-				cause: "window",
-				reason: account.state?.reason ?? "usage window exhausted (429)",
-				until: probe.resetAt
-			});
-			else if (account.state?.kind !== "cooldown") this.states.set(account.key, {
-				kind: "unknown",
-				cause: "window",
-				reason: account.state?.reason ?? "usage window exhausted (429)",
-				until: 0
-			});
+			this.stampWindowMark(account, probe);
 		}));
 		const latestAccounts = await this.resolvedAccounts();
 		const revived = selectActiveAccount(tried === void 0 || tried.length === 0 ? latestAccounts : latestAccounts.filter((account) => !tried.includes(account.key)), preferred);
@@ -2464,6 +2913,18 @@ var CommandCodeAccountPool = class {
 				state: void 0
 			};
 		}
+		this.stampWindowMark(account, probe);
+	}
+	/**
+	* Stamp a probe-read window onto one key. A known reset becomes a cooldown
+	* that expires by itself; without one the mark stays `unknown`, so a later
+	* probe can still learn it — and a mark that already carries a cooldown
+	* keeps it, never trading a known reset for an unknown one. The cause is
+	* `window` either way: a probe that read a window as exceeded IS window
+	* evidence, whatever the key was marked for. An `until: 0` cooldown would
+	* read as "never usable again" to {@link accountUsable}, so `unknown` it is.
+	*/
+	stampWindowMark(account, probe) {
 		if (probe.resetAt > 0) this.states.set(account.key, {
 			kind: "cooldown",
 			cause: "window",
@@ -2647,12 +3108,12 @@ function commandCodeImageTokens(modelId, width, height) {
 	return imageTokenCost(imageTokenFamily(modelId), width, height);
 }
 /**
-* Anthropic: the image is first scaled so its long edge is at most 1568 px
-* (never enlarged), then charged roughly one token per 750 pixels.
+* Anthropic: the image is first scaled to the request long edge (never
+* enlarged), then charged roughly one token per 750 pixels.
 * Source: Anthropic vision documentation, "Image size and token usage".
 */
 function anthropicImageTokens(width, height) {
-	const projected = longEdgeDimensions(width, height, 1568);
+	const projected = longEdgeDimensions(width, height, REQUEST_IMAGE_MAX_LONG_EDGE);
 	return Math.max(1, Math.ceil(projected.width * projected.height / 750));
 }
 /**
@@ -2944,17 +3405,52 @@ function openStreamTrace(scope, options = {}) {
 * Owns the two chat transports (`/alpha/generate`, `/provider/v1/chat/completions`),
 * message conversion, SSE/JSONL parsing, the catalog + its on-disk cache, and
 * the pre-stream account rotation loop. The wire protocol is
-* reverse-engineered (command-code@1.28.4, re-verified through 1.66.0);
+* reverse-engineered (command-code@1.28.4, re-verified through 1.68.0);
 * AGENTS.md holds the full protocol record.
 *
 * The adapter is deliberately free of cordis/schemastery: it receives a
 * per-request options thunk and an API-key resolver from the plugin entry
 * (src/index.ts), so a settings change reaches the very next request.
 */
-const COMMAND_CODE_CLI_VERSION = "1.66.0";
+/** Keep the two user-facing languages and error metadata together. */
+function bilingual(code, en, zh, options) {
+	return new LlmError(`${en}；${zh}`, code, options);
+}
+const COMMAND_CODE_CLI_VERSION = "1.68.0";
 const DEFAULT_API_BASE = "https://api.commandcode.ai";
-const DEFAULT_GENERATE_MAX_TOKENS = 64e3;
-const DEFAULT_MAX_OUTPUT_TOKENS = 65536;
+/**
+* The output budget this bundle asks for, and the ceiling it will never exceed.
+*
+* 131 072, chosen against a measured provider limit rather than a round guess.
+* Probing `/alpha/generate` directly on 2026-09-28: 64 000 → 200, 131 072 → 200,
+* 196 608 → 200, **200 000 → 200, 200 704 → 400**, 1 000 000 → 400. The server
+* therefore caps `max_tokens` at 200 000, and it does so identically for a
+* 262 144-window model (`stealth/pixel-canary`) and a 1 000 000-window one
+* (`stealth/space-bunny-alpha`) — the cap is global, not per model. 131 072
+* keeps a 35 % margin under it while covering the real output ceiling of the
+* models that have one (Claude 64 K, Gemini 64 K, several at 128 K).
+*
+* The old 64 000 was never a provider requirement: it cost nothing in latency
+* (a 64 000 request answered headers in 1.28 s against 1.57 s for 131 072) but
+* it did cap what a model could ever say in one turn.
+*
+* This is only an UPPER bound. `requestContextBudget` lowers it per request
+* from the prompt actually being sent, so raising the ceiling cannot push a
+* large session over its window.
+*/
+const DEFAULT_GENERATE_MAX_TOKENS = 131072;
+/**
+* The fallback when the catalog carries no output ceiling for a model.
+*
+* `/provider/v1/models` publishes only `context_length` — no output limit — so
+* the catalog cannot learn one per model and derives a stand-in from the
+* window instead. Kept equal to {@link DEFAULT_GENERATE_MAX_TOKENS} on purpose:
+* a lower value here would silently re-cap every request through
+* `Math.min(contextLength, this)` before the ceiling above is ever consulted.
+*/
+const DEFAULT_MAX_OUTPUT_TOKENS = 131072;
+/** Preserve a small usable answer budget when the heuristic overshoots. */
+const MIN_CONTEXT_OUTPUT_TOKENS = 1024;
 const MODELS_TIMEOUT_MS = 1e4;
 /** How long the picker's plan-filter billing facts stay cached before refetching. */
 const BILLING_ACCESS_TTL_MS = 3e5;
@@ -2971,20 +3467,29 @@ const ACTIVE_SUBSCRIPTION_STATUSES = /* @__PURE__ */ new Set([
 	"trialing",
 	"past_due"
 ]);
-/** Head-of-request timeout: how long to wait for the first response byte. */
-const DEFAULT_REQUEST_TIMEOUT_MS = 6e4;
+/**
+* Head-of-request timeout: how long to wait for the first response byte.
+*
+* 300 s, and that number is the official CLI's, not a round choice. Decompiled
+* from `command-code@1.66.0`: its `createNodeTransport` fetch passes only the
+* caller's `signal` and sets no timeout at all, so the model request inherits
+* Node/undici's own default — measured at 301.0 s against a local server that
+* accepts the connection and never sends headers. The previous 60 s default was
+* five times stricter than the CLI it emulates, and being stricter only ever
+* costs legitimate requests: a slow upstream first token on the Provider API
+* route can outlast 60 s, and the official CLI simply waits it out. Measured
+* headers (2026-09-28, 26 250-token prompt, `max_tokens: 16` to separate the
+* header from the generation): `/alpha/generate` 2.12 / 2.56 / 2.75 s,
+* `/provider/v1/chat/completions` 5.52 / 2.98 / 3.70 s — a ~1.1 s median gap
+* with the Provider API route varying over a 2.5 s span against the CLI route's
+* 0.6 s. A gateway that is genuinely dead now takes longer to name itself,
+* which is what the consecutive-timeout streak exists to bound (three
+* attempts, then a diagnosis instead of another re-send).
+*/
+const DEFAULT_REQUEST_TIMEOUT_MS = 3e5;
 /** Stream idle timeout: a generation that stalls this long is a dead connection. */
 const DEFAULT_STREAM_IDLE_TIMEOUT_MS = 3e5;
 const MODEL_CACHE_VERSION = 1;
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function stringValue(value) {
-	return typeof value === "string" ? value : void 0;
-}
-function numberValue(value) {
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
 /** Hash one request value without retaining or logging its contents. */
 function fingerprintValue(value) {
 	let serialized;
@@ -3076,9 +3581,6 @@ function failureWithRequestId(error, metadata) {
 		...error.cause === void 0 ? {} : { cause: error.cause }
 	});
 }
-function booleanValue(value) {
-	return typeof value === "boolean" ? value : void 0;
-}
 /**
 * Thinking text carried by an OpenRouter-shaped `reasoning_details` array,
 * concatenated in the order the gateway sent it.
@@ -3160,6 +3662,78 @@ const CLI_CONTEXT_OVERFLOW_PATTERN = /prompt is too long|context.*(length|window
 function isContextOverflowDetail(detail) {
 	return isContextWindowExceededError(detail) || CLI_CONTEXT_OVERFLOW_PATTERN.test(detail);
 }
+/** A gateway refusal observed for an over-reserved request, but not unique to that cause. */
+const AMBIGUOUS_SIZE_REJECTION = /\bmodel could not complete the request\b/i;
+/**
+* The advice floor for a Provider-API timeout: doubling a 60 s budget is still
+* short for a slow upstream first token, so the suggestion never goes below 5
+* minutes. Capped by `RETRY_MAX_DELAY_MS` rather than the schema's timer
+* ceiling on purpose — a single header wait that outlasts the whole retry
+* backoff is not a budget, and clamping to the engine constant would also pull
+* a runtime dependency into the bundle.
+*/
+const MIN_SUGGESTED_TIMEOUT_MS = 3e5;
+/**
+* Why one attempt saw no response headers, and what the user can do about it.
+*
+* The TRANSPORT is the reliable signal; the request size is not — and the
+* mechanism is read straight out of the official CLI rather than inferred from
+* a timing. `createNodeTransport` passes only the caller's `signal` and sets no
+* timeout, so the two routes differ in WHO answers the headers:
+* `/alpha/generate` has the gateway answer them before the model starts, while
+* `/provider/v1/chat/completions` cannot answer until its upstream emits a
+* first token, so whatever that upstream is doing is charged to the header
+* wait. Measured 2026-09-28 (26 250-token prompt, `max_tokens: 16`):
+* `/alpha/generate` 2.12 / 2.56 / 2.75 s, `/provider/v1/chat/completions`
+* 5.52 / 2.98 / 3.70 s — a ~1.1 s median gap, with the Provider API route
+* swinging across 2.5 s where the CLI route moved 0.6 s. A larger prompt moves
+* neither, which is why an earlier draft that branched on a 1 MiB body
+* threshold was wrong: size is not the variable here. Only the route decides.
+*
+* @param protocol - the transport the attempt used.
+* @param timeoutMs - the header budget that just expired.
+*/
+function headersTimeoutAdvice(protocol, timeoutMs) {
+	if (protocol === "openai") return {
+		cause: "upstream-first-token",
+		suggestionMs: Math.min(RETRY_MAX_DELAY_MS, Math.max(timeoutMs * 2, MIN_SUGGESTED_TIMEOUT_MS))
+	};
+	return { cause: "gateway" };
+}
+/**
+* How many consecutive header timeouts on ONE unchanged payload stop being a
+* blip. The retry policy whitelists `TIMEOUT` with `maxRetries: 1000` and a
+* 500 ms → 15 min backoff, which is right for a provider that says when to
+* come back but wrong for a gateway that simply never answers: the reporter
+* saw the identical multi-megabyte body re-sent for hours (issue #67) instead
+* of a diagnosis. Three is where a 60 s budget has already spent three
+* minutes waiting, so the cost of being wrong is bounded and the user gets an
+* answer either way.
+*/
+const MAX_CONSECUTIVE_HEADER_TIMEOUTS = 3;
+/** UTF-8 byte length, computed only on the timeout path so a large body is encoded once, not per attempt. */
+function utf8ByteLength(text) {
+	return new TextEncoder().encode(text).length;
+}
+/**
+* The thrown headers timeout, worded for the cause it actually has.
+*
+* Every earlier version of this message said "通常是网络或代理问题" for both
+* transports, which is actively wrong for a large `/provider/v1/chat/completions`
+* prompt: there the model simply needs longer than any budget, and a user sent
+* to check their proxy never finds anything. The code stays `TIMEOUT` (still
+* retryable) in both branches — only the diagnosis and the advice change.
+*/
+function headersTimeoutError(input) {
+	const { protocol, endpoint, timeoutMs, cause } = input;
+	const megabytes = `${(utf8ByteLength(input.body) / 1048576).toFixed(1)} MB`;
+	const advice = headersTimeoutAdvice(protocol, timeoutMs);
+	if (advice.cause === "upstream-first-token") {
+		const suggestion = advice.suggestionMs ?? timeoutMs;
+		return bilingual("TIMEOUT", `Command Code API request to ${endpoint} did not respond within ${timeoutMs}ms: this route withholds response headers until the upstream model emits its first token, and it did not start within the budget. Raise "Request timeout" in the plugin's advanced settings to ${suggestion}ms, or compact the session or start a new one. The request body was ${megabytes}, but size is not the cause here — a slow upstream is. ${errorChain(cause)}`, `Command Code API 请求在 ${timeoutMs} 毫秒内未收到响应：该路由要等上游模型吐出第一个 token 才返回响应头，而上游在预算内没有开始作答。可在插件「高级」设置里把「请求超时」调到 ${suggestion} 毫秒，或压缩上下文 / 新开会话。本次请求体约 ${megabytes}，但体积不是原因——慢的是上游。（${errorChain(cause)}）`, { cause });
+	}
+	return bilingual("TIMEOUT", `Command Code API request to ${endpoint} did not respond within ${timeoutMs}ms: the gateway returned no response headers at all — it answers headers itself before the model replies. This is usually provider queueing, a Go-plan capacity limit, or a network/proxy path problem; a longer timeout will not help, but retrying usually recovers. The request body was ${megabytes}, and size is not the cause on this route. ${errorChain(cause)}`, `Command Code API 请求在 ${timeoutMs} 毫秒内未收到响应：网关完全没有返回响应头——它会在模型开始回答前先返回响应头。这通常是服务商排队、Go 套餐容量限制，或网络/代理链路问题；调大超时不会有帮助，重试通常可恢复。本次请求体约 ${megabytes}，而在该路由上体积不是原因。（${errorChain(cause)}）`, { cause });
+}
 /**
 * Whether one rejection says "ZDR requested, no ZDR-capable upstream": the
 * provider spells the code `cmd_zdr_no_providers` in JSON error bodies and
@@ -3203,7 +3777,7 @@ function streamErrorToLlmError(value, fallbackMessage) {
 		message
 	].filter((part) => part !== void 0 && part !== "").join(" ");
 	const statusOption = statusCode !== void 0 ? { status: statusCode } : void 0;
-	if (isContextOverflowDetail(detail)) return new LlmError(`Command Code stream error: ${message}；Command Code API 拒绝了这次请求：内容超出模型上下文窗口。正在压缩上下文后重试；如仍失败，请新建会话或减少上下文`, CONTEXT_WINDOW_EXCEEDED_CODE, statusOption);
+	if (isContextOverflowDetail(detail)) return bilingual(CONTEXT_WINDOW_EXCEEDED_CODE, `Command Code stream error: ${message}`, "Command Code API 拒绝了这次请求：内容超出模型上下文窗口。正在压缩上下文后重试；如仍失败，请新建会话或减少上下文", statusOption);
 	const terminal = hasTerminalStreamMarker(detail);
 	if (!(isRetryable === true || (isRetryable === false || terminal ? false : statusCode !== void 0 ? statusCode !== void 0 && (statusCode === 429 || statusCode >= 500) : true))) return new LlmError(`Command Code stream error: ${message}`, "PROVIDER_STREAM_ERROR", statusOption);
 	return new LlmError(`Command Code stream error: ${message}`, "SERVER", statusOption);
@@ -3581,9 +4155,9 @@ const ENGINE_IMAGE_POLICY = {
 * dsh-llm-retry. On a profile that does not mount that plugin the failure is
 * terminal — every shipped profile reaches it through dsh-base.
 */
-function imageOffloadRequired(missing) {
+function imageOffloadRequired(missing, reason = "budget") {
 	const options = { offloadImages: missing };
-	return new LlmError(`commandcode request images exceed the route budget; ${missing} more oldest occurrence(s) must be offloaded.`, IMAGE_OFFLOAD_REQUIRED_CODE, options);
+	return new LlmError(reason === "cache" ? `commandcode cache-aware image history: ${missing} already-seen oldest image occurrence(s) must be offloaded before replay.` : `commandcode request images exceed the route budget; ${missing} more oldest occurrence(s) must be offloaded.`, IMAGE_OFFLOAD_REQUIRED_CODE, options);
 }
 /** The budget in the shape the core counter takes (representation + the rung). */
 function coreBudget(budget) {
@@ -3609,17 +4183,40 @@ const imageVersionBytes = (block) => block.attachment.bytes;
 * otherwise the 413 retry could reintroduce images the first rung had already
 * evicted.
 */
-function withSurfaceOffload(options, policy, budget) {
+function withSurfaceOffload(options, policy, budget, cacheOffloadModel) {
 	const marked = policy.projectOffloadedImages(options.messages, (ref) => offloadedImageText(ref));
 	const messages = marked === options.messages ? options.messages : [...marked];
-	const missing = policy.requiredImageOffload(messages, coreBudget(budget), imageVersionBytes);
-	if (missing > 0) throw imageOffloadRequired(missing);
+	const budgetMissing = policy.requiredImageOffload(messages, coreBudget(budget), imageVersionBytes);
+	const cacheMissing = cacheOffloadModel === void 0 ? 0 : seenImageOffloadCount(messages, cacheOffloadModel);
+	const missing = Math.max(budgetMissing, cacheMissing);
+	if (missing > 0) throw imageOffloadRequired(missing, cacheMissing > budgetMissing ? "cache" : "budget");
 	return messages === options.messages ? options : {
 		...options,
 		messages
 	};
 }
 /**
+* Count retained images already followed by an answer from this same model.
+* The current tool result's image has not yet been seen by the model and must
+* stay on the wire. The engine can only offload durable user/tool input nodes;
+* assistant output and request-only input have no selectable surface event.
+*/
+function seenImageOffloadCount(messages, model) {
+	let lastAnswer = -1;
+	for (let index = 0; index < messages.length; index++) {
+		const message = messages[index];
+		if (message.role === "assistant" && message.source.kind === "model" && message.source.provider === "commandcode" && message.source.model === model) lastAnswer = index;
+	}
+	if (lastAnswer < 0) return 0;
+	let count = 0;
+	for (let index = 0; index < lastAnswer; index++) {
+		const message = messages[index];
+		if (message.role !== "user" && message.role !== "tool" || message.id === void 0) continue;
+		for (const block of message.content) if (block.type === "image") count++;
+	}
+	return count;
+}
+/**
 * One image's bytes for the wire: the attachment service's REQUEST VERSION.
 *
 * `readImage()` answers the stored original, which is what admission accepted —
@@ -3630,7 +4227,7 @@ function withSurfaceOffload(options, policy, budget) {
 * the point here, the encoded bytes).
 */
 async function readRequestImage(attachments, ref) {
-	return (await attachments.readImageRequest(ref, requestImageTarget(ref))).data;
+	return attachments.readImageRequest(ref, requestImageTarget(ref));
 }
 /**
 * Price one request occurrence.
@@ -3661,23 +4258,25 @@ function priceRequestImage(block, model, imageCapable) {
 	};
 }
 /**
-* Convert one image reference to the Command Code wire format, as the official
-* CLI does: `{ type: 'image', source: { type: 'base64', media_type, data } }`.
-* Bytes come from the durable attachment service; the media type is the one
-* verified at save time.
+* Convert one image reference to the final `/alpha/generate` wire format.
+* The official CLI accepts a base64 source internally, then toWireMessages()
+* sends a data URL plus mimeType. Use the request version's media type because
+* readImageRequest() can transcode the stored image to JPEG or WebP.
 */
 async function imageToCommandCode(ref, readImage) {
-	const data = await readImage(ref);
+	const version = await readImage(ref);
 	return {
 		type: "image",
-		source: {
-			type: "base64",
-			media_type: ref.mediaType,
-			data: Buffer.from(data).toString("base64")
-		}
+		image: `data:${version.mediaType};base64,${Buffer.from(version.data).toString("base64")}`,
+		mimeType: version.mediaType
 	};
 }
-async function messagesToCC(messages, readImage) {
+/**
+* The common pairing and image-carrier ordering for both transports. Each
+* codec owns its wire shape: CLI content blocks and Chat Completions
+* reasoning/tool calls differ beyond the image envelope.
+*/
+async function convertMessages(messages, readImage, codec) {
 	const out = [];
 	const { ids: paired, names: toolNames } = pairedToolCalls(messages);
 	const wireIds = wireToolCallIds(paired);
@@ -3686,6 +4285,10 @@ async function messagesToCC(messages, readImage) {
 		for (const message of pendingImages) out.push(message);
 		pendingImages.length = 0;
 	};
+	const encodeImage = (ref) => {
+		if (!readImage) throw new LlmError("Image input requires the durable attachment service", "UNSUPPORTED_CONTENT");
+		return codec.encodeImage(ref, readImage);
+	};
 	for (const message of messages) {
 		if (message.role === "system") continue;
 		const result = toolResultOf(message);
@@ -3697,86 +4300,88 @@ async function messagesToCC(messages, readImage) {
 					type: "text",
 					text: block.text
 				});
-				if (block.type === "image") {
-					if (!readImage) throw new LlmError("Image input requires the durable attachment service", "UNSUPPORTED_CONTENT");
-					parts.push(await imageToCommandCode(block.attachment, readImage));
-				}
+				if (block.type === "image") parts.push(await encodeImage(block.attachment));
 			}
-			if (parts.length === 0) continue;
-			out.push({
-				role: "user",
-				content: parts
-			});
+			if (parts.length > 0) out.push(codec.encodeUser(parts));
 			continue;
 		}
 		if (message.role === "assistant") {
 			flushPendingImages();
-			const parts = [];
-			for (const block of message.content) if (block.type === "text") parts.push({
-				type: "text",
-				text: block.text
-			});
-			else if (block.type === "reasoning") parts.push({
-				type: "reasoning",
-				text: block.text
-			});
-			else if (block.type === "tool-call" && paired.has(block.id)) parts.push({
-				type: "tool-call",
-				toolCallId: wireIds.get(block.id) ?? block.id,
-				toolName: block.name,
-				input: recordOrEmpty(block.arguments)
-			});
-			if (parts.length > 0) out.push({
-				role: "assistant",
-				content: parts
-			});
+			const assistant = codec.encodeAssistant(message, paired, wireIds);
+			if (assistant !== void 0) out.push(assistant);
 			continue;
 		}
-		if (result) {
-			if (!paired.has(result.toolCallId)) continue;
-			const media = toolResultMedia(result);
-			const wireToolCallId = wireIds.get(result.toolCallId) ?? result.toolCallId;
-			out.push({
-				role: "tool",
-				content: [{
-					type: "tool-result",
-					toolCallId: wireToolCallId,
-					toolName: toolNames.get(result.toolCallId) || "unknown",
-					output: result.isError ? {
-						type: "error-text",
-						value: toolResultTextForWire(media)
-					} : {
-						type: "text",
-						value: toolResultTextForWire(media)
-					}
-				}]
-			});
-			if (media.images.length > 0) {
-				if (!readImage) throw new LlmError("Image input requires the durable attachment service", "UNSUPPORTED_CONTENT");
-				const carried = [{
-					type: "text",
-					text: toolResultImageNote(media, wireToolCallId)
-				}];
-				for (const attachment of media.images) carried.push(await imageToCommandCode(attachment, readImage));
-				pendingImages.push({
-					role: "user",
-					content: carried
-				});
-			}
+		if (!result || !paired.has(result.toolCallId)) continue;
+		const media = toolResultMedia(result);
+		const wireId = wireIds.get(result.toolCallId) ?? result.toolCallId;
+		out.push(codec.encodeTool(result, media, wireId, toolNames.get(result.toolCallId) || "unknown"));
+		if (media.images.length > 0) {
+			const carried = [{
+				type: "text",
+				text: toolResultImageNote(media, wireId)
+			}];
+			for (const attachment of media.images) carried.push(await encodeImage(attachment));
+			pendingImages.push(codec.encodeUser(carried));
 		}
 	}
 	flushPendingImages();
 	return out;
 }
+const ccMessageCodec = {
+	encodeImage: imageToCommandCode,
+	encodeUser: (parts) => ({
+		role: "user",
+		content: parts
+	}),
+	encodeAssistant: (message, paired, wireIds) => {
+		const parts = [];
+		for (const block of message.content) if (block.type === "text") parts.push({
+			type: "text",
+			text: block.text
+		});
+		else if (block.type === "reasoning") parts.push({
+			type: "reasoning",
+			text: block.text
+		});
+		else if (block.type === "tool-call" && paired.has(block.id)) parts.push({
+			type: "tool-call",
+			toolCallId: wireIds.get(block.id) ?? block.id,
+			toolName: block.name,
+			input: recordOrEmpty(block.arguments)
+		});
+		return parts.length > 0 ? {
+			role: "assistant",
+			content: parts
+		} : void 0;
+	},
+	encodeTool: (result, media, wireId, toolName) => ({
+		role: "tool",
+		content: [{
+			type: "tool-result",
+			toolCallId: wireId,
+			toolName,
+			output: result.isError ? {
+				type: "error-text",
+				value: toolResultTextForWire(media)
+			} : {
+				type: "text",
+				value: toolResultTextForWire(media)
+			}
+		}]
+	})
+};
+async function messagesToCC(messages, readImage) {
+	return convertMessages(messages, readImage, ccMessageCodec);
+}
 /**
 * Convert one image reference to the OpenAI Chat Completions wire format:
 * `{ type: 'image_url', image_url: { url: 'data:...;base64,...' } }`.
 */
 async function imageToOpenAI(ref, readImage) {
-	const data = await readImage(ref);
+	const version = await readImage(ref);
 	return {
 		type: "image_url",
-		image_url: { url: `data:${ref.mediaType};base64,${Buffer.from(data).toString("base64")}` }
+		image_url: { url: `data:${version.mediaType};base64,${Buffer.from(version.data).toString("base64")}` }
 	};
 }
 /**
@@ -3789,89 +4394,45 @@ async function imageToOpenAI(ref, readImage) {
 * on assistant messages. Only tool calls with a paired tool result are
 * replayed (same policy as the CLI path).
 */
-async function messagesToOpenAI(messages, readImage) {
-	const out = [];
-	const { ids: paired } = pairedToolCalls(messages);
-	const wireIds = wireToolCallIds(paired);
-	const pendingImages = [];
-	const flushPendingImages = () => {
-		for (const message of pendingImages) out.push(message);
-		pendingImages.length = 0;
-	};
-	for (const message of messages) {
-		if (message.role === "system") continue;
-		const result = toolResultOf(message);
-		if (message.role === "user" && !result) {
-			flushPendingImages();
-			const parts = [];
-			for (const block of message.content) {
-				if (block.type === "text") parts.push({
-					type: "text",
-					text: block.text
-				});
-				if (block.type === "image") {
-					if (!readImage) throw new LlmError("Image input requires the durable attachment service", "UNSUPPORTED_CONTENT");
-					parts.push(await imageToOpenAI(block.attachment, readImage));
-				}
-			}
-			if (parts.length === 0) continue;
-			if (!parts.some((part) => part.type === "image_url") && parts.length === 1) out.push({
-				role: "user",
-				content: parts[0].text
-			});
-			else out.push({
-				role: "user",
-				content: parts
-			});
-			continue;
-		}
-		if (message.role === "assistant") {
-			flushPendingImages();
-			const text = message.content.filter((block) => block.type === "text").map((block) => block.text).join("");
-			const reasoning = message.content.filter((block) => block.type === "reasoning").map((block) => block.text).join("");
-			const toolCalls = message.content.filter((block) => block.type === "tool-call" && paired.has(block.id)).map((block) => ({
-				id: wireIds.get(block.id) ?? block.id,
-				type: "function",
-				function: {
-					name: block.name,
-					arguments: block.arguments
-				}
-			}));
-			if (text === "" && reasoning === "" && toolCalls.length === 0) continue;
-			const assistant = {
-				role: "assistant",
-				content: text === "" ? null : text
-			};
-			if (reasoning !== "") assistant.reasoning_content = reasoning;
-			if (toolCalls.length > 0) assistant.tool_calls = toolCalls;
-			out.push(assistant);
-			continue;
-		}
-		if (result) {
-			if (!paired.has(result.toolCallId)) continue;
-			const media = toolResultMedia(result);
-			const wireToolCallId = wireIds.get(result.toolCallId) ?? result.toolCallId;
-			out.push({
-				role: "tool",
-				tool_call_id: wireToolCallId,
-				content: toolResultTextForWire(media)
-			});
-			if (media.images.length > 0) {
-				if (!readImage) throw new LlmError("Image input requires the durable attachment service", "UNSUPPORTED_CONTENT");
-				const carried = [{
-					type: "text",
-					text: toolResultImageNote(media, wireToolCallId)
-				}];
-				for (const attachment of media.images) carried.push(await imageToOpenAI(attachment, readImage));
-				pendingImages.push({
-					role: "user",
-					content: carried
-				});
+const openAiMessageCodec = {
+	encodeImage: imageToOpenAI,
+	encodeUser: (parts) => {
+		return !parts.some((part) => part.type === "image_url") && parts.length === 1 ? {
+			role: "user",
+			content: parts[0].text
+		} : {
+			role: "user",
+			content: parts
+		};
+	},
+	encodeAssistant: (message, paired, wireIds) => {
+		const text = message.content.filter((block) => block.type === "text").map((block) => block.text).join("");
+		const reasoning = message.content.filter((block) => block.type === "reasoning").map((block) => block.text).join("");
+		const toolCalls = message.content.filter((block) => block.type === "tool-call" && paired.has(block.id)).map((block) => ({
+			id: wireIds.get(block.id) ?? block.id,
+			type: "function",
+			function: {
+				name: block.name,
+				arguments: block.arguments
 			}
-		}
-	}
-	flushPendingImages();
-	return out;
+		}));
+		if (text === "" && reasoning === "" && toolCalls.length === 0) return void 0;
+		const assistant = {
+			role: "assistant",
+			content: text === "" ? null : text
+		};
+		if (reasoning !== "") assistant.reasoning_content = reasoning;
+		if (toolCalls.length > 0) assistant.tool_calls = toolCalls;
+		return assistant;
+	},
+	encodeTool: (_result, media, wireId) => ({
+		role: "tool",
+		tool_call_id: wireId,
+		content: toolResultTextForWire(media)
+	})
+};
+async function messagesToOpenAI(messages, readImage) {
+	return convertMessages(messages, readImage, openAiMessageCodec);
 }
 /** Account endpoints fetched by one `getUsage()` run (see the classification there). */
 const USAGE_ENDPOINT_COUNT = 4;
@@ -4060,6 +4621,41 @@ async function buildOpenAIBody(options, facts) {
 	};
 }
 /**
+* Estimate the text the selected transport actually sends. JSON framing and
+* punctuation each get a token; ordinary ASCII words get one, with an extra
+* allowance for long identifiers. UTF-8 bytes / 4 tracks the measured CJK
+* case better than the engine's UTF-16 characters / 4. This is a heuristic,
+* never proof that a prompt cannot fit: a valid long English prompt can still
+* be larger under this estimate than under the provider's tokenizer.
+*/
+function estimateWireInputTokens(protocol, body, messages, model) {
+	const params = protocol === "cli" ? recordOrEmpty(body.params) : body;
+	const wire = JSON.stringify(params, (_key, value) => typeof value === "string" && /^data:[^,]*;base64,/.test(value) ? "[image]" : value);
+	let tokens = 0;
+	for (const match of wire.matchAll(/[A-Za-z0-9_]+|[^\x00-\x7f]+|[^\s]/gu)) {
+		const part = match[0];
+		if (/^[A-Za-z0-9_]+$/.test(part)) tokens += 1 + Math.ceil(Math.max(0, part.length - 12) / 4);
+		else if (part.charCodeAt(0) > 127) tokens += Math.ceil(Buffer.byteLength(part) / 4);
+		else tokens += 1;
+	}
+	for (const message of messages) for (const block of message.content) if (block.type === "image") tokens += priceRequestImage(block, model, true).visualTokens;
+	return tokens;
+}
+function requestContextBudget(protocol, body, messages, model, contextWindow, requestedMaxTokens) {
+	if (contextWindow === void 0) return {
+		maxTokens: requestedMaxTokens,
+		sizePressure: false
+	};
+	const estimatedInput = estimateWireInputTokens(protocol, body, messages, model);
+	const headroom = Math.min(16384, Math.max(2048, Math.ceil(contextWindow * .02)));
+	const available = Math.floor(contextWindow - estimatedInput - headroom);
+	const floor = Math.min(requestedMaxTokens, MIN_CONTEXT_OUTPUT_TOKENS, Math.max(1, Math.floor(contextWindow / 8)));
+	return {
+		maxTokens: Math.min(requestedMaxTokens, Math.max(floor, available)),
+		sizePressure: estimatedInput >= contextWindow / 4 && estimatedInput + requestedMaxTokens + headroom >= contextWindow
+	};
+}
+/**
 * One pre-stream connect attempt: POST the body and wait for response
 * headers only (`requestTimeoutMs` must never bound the body stream). Returns
 * the live response plus its cleanup, or the rejection facts for the rotation
@@ -4108,19 +4704,26 @@ async function connectGenerate(deps, key, protocol, body) {
 		...zdr ? { "x-cmd-zdr": "1" } : {},
 		...attributionHeaders()
 	};
+	const serializedBody = JSON.stringify(body);
 	try {
 		response = await fetchImpl(endpoint, {
 			method: "POST",
 			headers,
-			body: JSON.stringify(body),
+			body: serializedBody,
 			signal: connectAbort.signal
 		});
 		clearTimeout(connectTimer);
 	} catch (error) {
 		cleanup();
 		if (options.signal?.aborted) throw error;
-		if (connectTimedOut || error instanceof DOMException && error.name === "TimeoutError") throw new LlmError(`Command Code API request to ${endpoint} did not respond within ${connection.requestTimeoutMs}ms: ${errorChain(error)}；Command Code API 请求在 ${connection.requestTimeoutMs} 毫秒内未收到响应——通常是网络或代理问题，请检查后重试`, "TIMEOUT", { cause: error });
-		throw new LlmError(`Command Code API request to ${endpoint} failed: ${errorChain(error)}；Command Code API 请求连接失败——通常是网络或代理问题，请检查网络或代理设置后重试`, "TRANSPORT", { cause: error });
+		if (connectTimedOut || error instanceof DOMException && error.name === "TimeoutError") throw headersTimeoutError({
+			protocol,
+			endpoint,
+			body: serializedBody,
+			timeoutMs: connection.requestTimeoutMs,
+			cause: error
+		});
+		throw bilingual("TRANSPORT", `Command Code API request to ${endpoint} failed: ${errorChain(error)}`, "Command Code API 请求连接失败——通常是网络或代理问题，请检查网络或代理设置后重试", { cause: error });
 	}
 	deps.onResponse(response);
 	if (!response.ok) {
@@ -4226,6 +4829,13 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	billingAccess = /* @__PURE__ */ new Map();
 	billingAccessInflight = /* @__PURE__ */ new Map();
 	protocolCache = /* @__PURE__ */ new Map();
+	/**
+	* Consecutive header timeouts for the last request shape, counted ACROSS
+	* `stream()` calls: dsh-llm-retry re-invokes this same instance, so this is
+	* the only place a streak can live. One slot rather than a map is the point —
+	* the claim is "consecutive", and a single record cannot grow.
+	*/
+	headerTimeoutStreak;
 	constructor(deps) {
 		super();
 		this.deps = deps;
@@ -4234,6 +4844,32 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		this.surfaceOffload = deps.imageOffload ?? ENGINE_IMAGE_POLICY;
 	}
 	/**
+	* Grade one failed attempt: a headers timeout that repeats on an unchanged
+	* payload eventually leaves the retryable whitelist.
+	*
+	* `providerRetryPolicy()` cannot express this itself — dsh-llm's
+	* `NormalRetryPolicyConfig` carries a single scalar `maxRetries` next to the
+	* code list, so there is no per-code limit to lower. Escalating from here is
+	* the only way to keep `RATE_LIMIT` / `SERVER` / `TRANSPORT` retryable (each
+	* carries a real "try again later" signal) while stopping the one code that,
+	* repeated unchanged, only burns the user's session.
+	*
+	* @returns the error to surface: unchanged for any other failure, the
+	* original timeout below the threshold, and a terminal one at it.
+	*/
+	gradeHeaderTimeout(error, protocol, body, timeoutMs) {
+		if (!(error instanceof LlmError && error.code === "TIMEOUT")) return error;
+		const fingerprint = `${protocol}:${fingerprintValue(body).sha256}`;
+		const count = this.headerTimeoutStreak?.fingerprint === fingerprint ? this.headerTimeoutStreak.count + 1 : 1;
+		this.headerTimeoutStreak = {
+			fingerprint,
+			count
+		};
+		if (count < MAX_CONSECUTIVE_HEADER_TIMEOUTS) return error;
+		this.headerTimeoutStreak = void 0;
+		return bilingual("PROVIDER_HTTP_ERROR", `Command Code API stopped retrying: the gateway returned no response headers on ${count} consecutive attempts at the same request, each after the full ${timeoutMs}ms budget, so this is not a network blip — it is provider queueing, a Go-plan capacity limit, or a network/proxy path problem. Resending the identical payload again is unlikely to help; wait for the provider to recover, or switch model or account.`, `Command Code API 已停止重试：同一请求连续 ${count} 次在 ${timeoutMs} 毫秒内都没有收到任何响应头，这不是网络抖动，而是服务商排队、Go 套餐容量限制或网络/代理链路问题。继续原样重发同一个请求通常无济于事——可以等服务商恢复，或换模型/换账号。`);
+	}
+	/**
 	* Display metadata for the picker's provider group header. The base class
 	* returns the raw route id (`commandcode`, all lowercase) as the name, which
 	* is what the model selector shows as this group's sticky title; return the
@@ -4300,16 +4936,13 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	async loadCatalog(signal) {
 		const { apiBase, modelsCachePath } = this.deps.options();
 		try {
-			const response = await this.fetchImpl(`${apiBase}/provider/v1/models`, {
-				headers: {
-					accept: "application/json",
-					...IDENTITY_ENCODING_HEADER,
-					...attributionHeaders()
-				},
-				signal: signal ?? AbortSignal.timeout(1e4)
-			});
-			if (!response.ok) throw new Error(`models endpoint returned ${response.status}`);
-			this.catalog = parseCatalogResponse(await response.json());
+			const { status, record } = await this.fetchJson(`${apiBase}/provider/v1/models`, {
+				accept: "application/json",
+				...IDENTITY_ENCODING_HEADER,
+				...attributionHeaders()
+			}, MODELS_TIMEOUT_MS, signal);
+			if (status < 200 || status >= 300) throw new Error(`models endpoint returned ${status}`);
+			this.catalog = parseCatalogResponse(record);
 			await writeModelsCache(modelsCachePath, this.catalog).catch(() => void 0);
 		} catch (error) {
 			if (signal?.aborted) throw error;
@@ -4340,6 +4973,31 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			return allow === void 0 || allow.has(model.id);
 		}).map(toInfo).sort(compareByPlan);
 	}
+	/**
+	* The per-model allowance bracket this account POOL falls into, or undefined
+	* when there is nothing honest to show.
+	*
+	* The pricing page publishes a per-model monthly allowance for GOAT and Pro
+	* only — its own words are "the boost is a per-model allowance, so it lives on
+	* the plans that have them" — so a pool whose highest plan is Go, Provider,
+	* Max or Ultra gets undefined rather than a neighbouring tier's figure. Taking
+	* the HIGHEST tier matches the question the picker already answers for a pool
+	* (see `modelVisibleForAnyAccount`): what the user can reach, not what the one
+	* account serving this request happens to be. The fail-open shape is the same
+	* too — an unreachable billing endpoint yields undefined, which hides the
+	* allowance instead of inventing one.
+	*/
+	async allowanceTier() {
+		const accesses = await this.loadPoolBillingAccess();
+		if (accesses === void 0) return void 0;
+		let highest;
+		for (const access of accesses) {
+			const weight = access?.tierWeight;
+			if (weight === void 0) continue;
+			if (highest === void 0 || weight > highest) highest = weight;
+		}
+		return allowanceTierForWeight(highest);
+	}
 	async resolveModel(provider, model, signal) {
 		const entry = this.catalog.find((m) => m.id === model) ?? (await this.loadCatalog(signal)).find((m) => m.id === model);
 		const efforts = KNOWN_EFFORTS[model];
@@ -4375,21 +5033,19 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		};
 	}
 	/**
-	* Fetch one account endpoint and parse its JSON body. Returns the HTTP
-	* status alongside the parsed record so each caller applies its own failure
-	* accounting: the billing probe fails open silently, the usage report books
-	* failures per endpoint. Non-2xx and invalid JSON bodies come back without a
-	* record; only a fetch failure propagates to the caller.
+	* Fetch one JSON GET and return its HTTP status with a parsed record. The
+	* catalog, billing probe, and usage report each apply their own failure
+	* policy. Non-2xx and invalid JSON bodies come back without a record; only
+	* a fetch failure propagates to the caller.
 	*
-	* `timeoutMs` is the caller's budget for this one request. The default is the
-	* CATALOG probe's short cap, which fits the picker's fail-open reads; the
-	* usage report deliberately passes the connection's own request budget so an
-	* account query is not held to a stricter (and invisible) limit than chat.
+	* `timeoutMs` is the caller's budget, unless it provides its own signal.
+	* The usage report passes the connection's request budget rather than the
+	* catalog/picker's shorter default.
 	*/
-	async fetchEndpointJson(url, headers, timeoutMs = MODELS_TIMEOUT_MS) {
+	async fetchJson(url, headers, timeoutMs = MODELS_TIMEOUT_MS, signal) {
 		const response = await this.fetchImpl(url, {
 			headers,
-			signal: AbortSignal.timeout(timeoutMs)
+			signal: signal ?? AbortSignal.timeout(timeoutMs)
 		});
 		if (!response.ok) return { status: response.status };
 		let parsed;
@@ -4475,7 +5131,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			const connection = this.deps.options();
 			const headers = await this.accountHeaders(apiKey);
 			const base = connection.apiBase;
-			const getJson = async (path) => (await this.fetchEndpointJson(`${base}${path}`, headers)).record;
+			const getJson = async (path) => (await this.fetchJson(`${base}${path}`, headers)).record;
 			const whoami = await getJson("/alpha/whoami");
 			const orgData = whoami && isRecord(whoami.org) ? whoami.org : void 0;
 			const orgId = orgData === void 0 ? void 0 : stringValue(orgData.id);
@@ -4582,7 +5238,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		const failed = [];
 		const getJson = async (path) => {
 			try {
-				const { status, record, invalidResponse } = await this.fetchEndpointJson(`${base}${path}`, headers, connection.requestTimeoutMs);
+				const { status, record, invalidResponse } = await this.fetchJson(`${base}${path}`, headers, connection.requestTimeoutMs);
 				if (record === void 0) {
 					failures.push(`${path}: HTTP ${status}${invalidResponse ? " returned an unreadable or invalid JSON body" : ""}`);
 					failed.push(invalidResponse ? {
@@ -4655,13 +5311,8 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	async probeWindowLimits(apiKey) {
 		try {
 			const connection = this.deps.options();
-			const response = await this.fetchImpl(`${connection.apiBase}/alpha/billing/credits`, {
-				headers: await this.accountHeaders(apiKey),
-				signal: AbortSignal.timeout(MODELS_TIMEOUT_MS)
-			});
-			if (!response.ok) return void 0;
-			const parsed = await response.json();
-			if (!isRecord(parsed)) return void 0;
+			const { record: parsed } = await this.fetchJson(`${connection.apiBase}/alpha/billing/credits`, await this.accountHeaders(apiKey));
+			if (parsed === void 0) return void 0;
 			const windowLimits = isRecord(parsed.windowLimits) ? parsed.windowLimits : void 0;
 			if (windowLimits === void 0) return void 0;
 			let reported = false;
@@ -4696,25 +5347,34 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		}
 		const connection = this.deps.options();
 		let apiKey = await this.deps.resolveApiKey(connection, options.model);
-		const modelMax = this.catalog.find((m) => m.id === options.model)?.maxTokens ?? 65536;
-		const maxTokens = Math.min(options.maxTokens ?? modelMax, modelMax, DEFAULT_GENERATE_MAX_TOKENS);
+		const modelEntry = this.catalog.find((m) => m.id === options.model);
+		const modelMax = modelEntry?.maxTokens ?? 131072;
+		const requestedMaxTokens = Math.min(options.maxTokens ?? modelMax, modelMax, DEFAULT_GENERATE_MAX_TOKENS);
+		let maxTokens = requestedMaxTokens;
+		let contextBudget = {
+			maxTokens,
+			sizePressure: false
+		};
 		const effort = options.reasoningEffort;
 		const supported = KNOWN_EFFORTS[options.model];
 		const reasoningEffort = effort && effort !== "off" && supported?.includes(effort) ? effort : void 0;
 		const systemText = [options.system ?? "", ...options.messages.filter((m) => m.role === "system").map((m) => m.content.map(blockText).filter(Boolean).join("\n"))].filter(Boolean).join("\n\n");
 		let protocol = this.resolveProtocol(apiKey, options.model);
-		let requestOptions = withSurfaceOffload(options, this.surfaceOffload, REQUEST_IMAGE_BUDGETS[0]);
-		const buildBody = async (target) => target === "cli" ? buildCliBody(requestOptions, connection, {
-			maxTokens,
-			reasoningEffort,
-			systemText,
-			readImage
-		}) : buildOpenAIBody(requestOptions, {
-			maxTokens,
-			reasoningEffort,
-			systemText,
-			readImage
-		});
+		let requestOptions = withSurfaceOffload(options, this.surfaceOffload, REQUEST_IMAGE_BUDGETS[0], connection.offloadSeenImagesForCache === true && protocol === "cli" ? options.model : void 0);
+		const buildBody = async (target) => {
+			const facts = {
+				maxTokens: requestedMaxTokens,
+				reasoningEffort,
+				systemText,
+				readImage
+			};
+			const built = target === "cli" ? await buildCliBody(requestOptions, connection, facts) : await buildOpenAIBody(requestOptions, facts);
+			contextBudget = requestContextBudget(target, built, requestOptions.messages, options.model, modelEntry?.contextWindow, requestedMaxTokens);
+			maxTokens = contextBudget.maxTokens;
+			if (target === "cli") recordOrEmpty(built.params).max_tokens = maxTokens;
+			else built.max_tokens = maxTokens;
+			return built;
+		};
 		let body = await buildBody(protocol);
 		const trace = openStreamTrace(`${options.provider}/${options.model}`);
 		const tried = /* @__PURE__ */ new Set();
@@ -4728,6 +5388,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			connection,
 			fetchImpl: this.fetchImpl,
 			onResponse: (response) => {
+				this.headerTimeoutStreak = void 0;
 				responseMetadata = {
 					protocol,
 					headers: responseIdentifiers(response.headers)
@@ -4763,9 +5424,11 @@ var CommandCodeAdapter = class extends LlmAdapter {
 					connected = attempt;
 					break;
 				}
-				if (protocol === "openai" && isUpgradeRequiredError(attempt.status, attempt.errText)) {
+				const providerError = parseProviderError(attempt.errText);
+				if (protocol === "openai" && isUpgradeRequiredError(attempt.status, attempt.errText, providerError)) {
 					protocol = "cli";
 					this.rememberProtocol(apiKey, true);
+					requestOptions = withSurfaceOffload(options, this.surfaceOffload, REQUEST_IMAGE_BUDGETS[0], connection.offloadSeenImagesForCache === true ? options.model : void 0);
 					body = await buildBody("cli");
 					continue;
 				}
@@ -4774,7 +5437,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 					if (missing > 0) throw imageOffloadRequired(missing);
 				}
 				const rotate = this.deps.rotateApiKey;
-				const rejection = classifyAccountRejection(attempt.status, attempt.errText);
+				const rejection = classifyAccountRejection(attempt.status, attempt.errText, providerError);
 				if (rejection !== void 0 && rotate !== void 0 && options.signal?.aborted !== true && tried.size < MAX_ACCOUNT_ROTATIONS) {
 					const next = await rotate(apiKey, rejection.reason, connection, options.model, {
 						tried: [...tried],
@@ -4790,9 +5453,9 @@ var CommandCodeAdapter = class extends LlmAdapter {
 					const wait = reset === void 0 ? 0 : Math.min(Math.max(1e3, reset - Date.now()), RETRY_MAX_DELAY_MS);
 					const when = reset === void 0 ? void 0 : new Date(reset).toISOString();
 					const window = rejection.reason === "rate-limit";
-					throw new LlmError((window ? "llm-commandcode: the Command Code account is rate limited" : "llm-commandcode: the Command Code account is rate limited (429) — the provider did not report an exhausted usage window") + (when === void 0 ? "" : ` — the provider reports it resets at ${when}`) + (window ? "；当前 Command Code 账户已被限流" : "；当前 Command Code 账户被限流（429），服务商未报告用量窗口用尽") + (when === void 0 ? "" : `，服务商给出的重置时间为 ${when}`), "RATE_LIMIT", wait > 0 ? { providerRetryAfterMs: wait } : void 0);
+					throw bilingual("RATE_LIMIT", (window ? "llm-commandcode: the Command Code account is rate limited" : "llm-commandcode: the Command Code account is rate limited (429) — the provider did not report an exhausted usage window") + (when === void 0 ? "" : ` — the provider reports it resets at ${when}`), (window ? "当前 Command Code 账户已被限流" : "当前 Command Code 账户被限流（429），服务商未报告用量窗口用尽") + (when === void 0 ? "" : `，服务商给出的重置时间为 ${when}`), wait > 0 ? { providerRetryAfterMs: wait } : void 0);
 				}
-				throw generateHttpError(attempt.status, attempt.errText, attempt.retryAfterMs);
+				throw generateHttpError(attempt.status, attempt.errText, attempt.retryAfterMs, providerError, contextBudget.sizePressure);
 			}
 		} catch (error) {
 			trace.record("connect-error", {
@@ -4800,7 +5463,8 @@ var CommandCodeAdapter = class extends LlmAdapter {
 				responseMetadata
 			});
 			trace.close();
-			throw options.signal?.aborted ? error : failureWithRequestId(error, responseMetadata);
+			if (options.signal?.aborted) throw error;
+			throw failureWithRequestId(this.gradeHeaderTimeout(error, protocol, body, connection.requestTimeoutMs), responseMetadata);
 		}
 		if (connected === void 0) throw new LlmError("Command Code API connection failed without a response", "TRANSPORT");
 		const { response, cleanup } = connected;
@@ -4860,7 +5524,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 						silentMs: Date.now() - lastChunkAt,
 						message: errorChain(error)
 					});
-					throw new LlmError(`Command Code API stream from ${connection.apiBase} failed while reading: ${errorChain(error)}；Command Code API 流式响应中途断开——网络波动所致，重试通常可恢复`, "TRANSPORT", { cause: error });
+					throw bilingual("TRANSPORT", `Command Code API stream from ${connection.apiBase} failed while reading: ${errorChain(error)}`, "Command Code API 流式响应中途断开——网络波动所致，重试通常可恢复", { cause: error });
 				} finally {
 					clearIdle();
 				}
@@ -4875,7 +5539,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 						idleFired,
 						buffered: buffer.length
 					});
-					if (idleFired) throw new LlmError(`Command Code API stream from ${connection.apiBase} was idle for ${connection.streamIdleTimeoutMs}ms (no events) and was treated as a dead connection；Command Code API 流式响应已 ${connection.streamIdleTimeoutMs} 毫秒无任何事件，被判定为死连接——长思考模型可在设置中调大流空闲超时`, "TIMEOUT");
+					if (idleFired) throw bilingual("TIMEOUT", `Command Code API stream from ${connection.apiBase} was idle for ${connection.streamIdleTimeoutMs}ms (no events) and was treated as a dead connection`, `Command Code API 流式响应已 ${connection.streamIdleTimeoutMs} 毫秒无任何事件，被判定为死连接——长思考模型可在设置中调大流空闲超时`);
 					if (buffer.trim()) yield* handle(parseStreamEventLine(buffer));
 					break;
 				}
@@ -4933,8 +5597,8 @@ var CommandCodeAdapter = class extends LlmAdapter {
 					responseMetadata
 				});
 				endRecorded = true;
-				if (!asm.sawContent) throw new LlmError("Command Code returned an empty response；Command Code 返回了空响应，重试通常可恢复", "EMPTY_RESPONSE");
-				throw new LlmError(`Command Code API stream from ${connection.apiBase} ended before its finish event (${detail}) — the response was closed mid-generation, so this is not the model stopping by itself；Command Code API 流式响应在结束事件之前被关闭（生成中途断流），并非模型主动结束——请重试；若频繁出现，可用 ${STREAM_TRACE_ENV}=<文件路径> 抓取原始流以定位断流原因`, "STREAM_CLOSED");
+				if (!asm.sawContent) throw bilingual("EMPTY_RESPONSE", "Command Code returned an empty response", "Command Code 返回了空响应，重试通常可恢复");
+				throw bilingual("STREAM_CLOSED", `Command Code API stream from ${connection.apiBase} ended before its finish event (${detail}) — the response was closed mid-generation, so this is not the model stopping by itself`, `Command Code API 流式响应在结束事件之前被关闭（生成中途断流），并非模型主动结束——请重试；若频繁出现，可用 ${STREAM_TRACE_ENV}=<文件路径> 抓取原始流以定位断流原因`);
 			}
 		} catch (error) {
 			if (!usageEmitted && usage !== void 0) yield {
@@ -4963,44 +5627,39 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		}
 	}
 };
-/**
-* Map a pre-stream generate HTTP failure onto a stable LlmError. Command
-* Code folds several business rejections into 403 (plan limits, CLI version,
-* model access): prefer the machine-readable `error.code` when present; the
-* status alone cannot distinguish them. The status also decides the failure
-* CODE via {@link httpErrorCode}, which is what the retry policy routes on —
-* a transient 5xx must not be reported as a permanent provider rejection. A
-* 429's `Retry-After` header rides along as `providerRetryAfterMs` so
-* dsh-llm-retry can wait exactly that long instead of guessing at the backoff
-* cadence — capped at RETRY_MAX_DELAY_MS, because in normal mode a longer
-* attached wait makes the executor abandon the retry outright.
-*
-* One body is read, not just its status: a client-side rejection whose
-* `error.code`/`type`/`message` names the model context window is reported as
-* `CONTEXT_WINDOW_EXCEEDED`, because that failure has a recovery the harness
-* performs and a generic provider error does not. Every message built here is
-* bilingual — the harness renders it verbatim in its retry chrome.
-*/
-function generateHttpError(status, errText, retryAfterMs) {
-	let providerCode;
-	let providerDetail = "";
+/** Parse a rejected body once, retaining the nested/root distinction. */
+function parseProviderError(errText) {
 	try {
 		const parsed = JSON.parse(errText);
-		if (isRecord(parsed) && isRecord(parsed.error)) {
-			providerCode = stringValue(parsed.error.code);
-			providerDetail = [
-				stringValue(parsed.error.code),
-				stringValue(parsed.error.type),
-				stringValue(parsed.error.message)
-			].filter((part) => part !== void 0 && part !== "").join(" ");
-		}
-	} catch {}
+		if (!isRecord(parsed)) return {};
+		const nested = isRecord(parsed.error) ? parsed.error : void 0;
+		const body = nested ?? parsed;
+		return {
+			root: parsed,
+			nested,
+			code: stringValue(body.code),
+			type: stringValue(body.type),
+			message: stringValue(body.message),
+			rateLimit: isRecord(body.rateLimit) ? body.rateLimit : void 0
+		};
+	} catch {
+		return {};
+	}
+}
+function generateHttpError(status, errText, retryAfterMs, parsed = parseProviderError(errText), sizePressure = false) {
+	const providerCode = parsed.nested === void 0 ? void 0 : parsed.code;
+	const providerDetail = parsed.nested === void 0 ? "" : [
+		parsed.code,
+		parsed.type,
+		parsed.message
+	].filter((part) => part !== void 0 && part !== "").join(" ");
 	const detail = providerCode ?? `HTTP ${status}`;
 	const overflowDetail = providerDetail !== "" ? providerDetail : errText.slice(0, 500);
-	if (status < 500 && isContextOverflowDetail(overflowDetail)) return new LlmError(`Command Code API error ${status}: the request exceeds the model's context window — this session is being compacted and the request retried；Command Code API 返回 ${status}：请求内容超出模型上下文窗口——正在压缩上下文后重试；如仍失败，请新建会话或减少上下文`, CONTEXT_WINDOW_EXCEEDED_CODE, { status });
-	if (status === 422 && isZdrNoProviders(providerCode, providerDetail, errText)) return new LlmError(`Command Code API error 422 (${detail}): zero data retention is enforced but no ZDR-capable upstream is available for this model — turn the ZDR setting off (or use another model)；Command Code API 返回 422：已开启零数据保留（ZDR），但该模型当前没有可用的 ZDR 上游——请关闭 ZDR 开关，或改用其他模型`, "PROVIDER_HTTP_ERROR", { status: 422 });
-	if (status === 401) return new LlmError(`Command Code API error 401 (${detail}): the API key is missing or invalid — check the key stored for COMMANDCODE_API_KEY (Models page) or the auth file；Command Code API 返回 401：API 密钥缺失或无效——请在设置页检查 COMMANDCODE_API_KEY 存储的密钥，或检查 auth 文件`, "INVALID_CREDENTIAL", { status: 401 });
-	if (status === 413) return new LlmError("Command Code API error 413: the request body exceeds the provider's size limit (the cap is undocumented, measured at about 50 MB) — the session history is too large to send, usually because of accumulated image attachments. Start a new session, or drop the image-heavy part of this one, and retry；Command Code API 返回 413：请求体超过服务端的体积上限（官方未公开，实测约 50 MB）——会话历史过大，通常是历史图片累积所致。请新建会话，或移除本会话中图片较多的部分后重试", "PROVIDER_HTTP_ERROR", { status: 413 });
+	if (status < 500 && isContextOverflowDetail(overflowDetail)) return bilingual(CONTEXT_WINDOW_EXCEEDED_CODE, `Command Code API error ${status}: the request exceeds the model's context window — this session is being compacted and the request retried`, `Command Code API 返回 ${status}：请求内容超出模型上下文窗口——正在压缩上下文后重试；如仍失败，请新建会话或减少上下文`, { status });
+	if (status === 400 && sizePressure && AMBIGUOUS_SIZE_REJECTION.test(providerDetail) && /\bprovider_error\b/i.test(providerDetail)) return bilingual(CONTEXT_WINDOW_EXCEEDED_CODE, "Command Code API error 400: the provider could not complete a request near the model context limit — compacting the session and retrying", "Command Code API 返回 400：请求接近模型上下文上限，服务商无法完成——正在压缩上下文后重试", { status });
+	if (status === 422 && isZdrNoProviders(providerCode, providerDetail, errText)) return bilingual("PROVIDER_HTTP_ERROR", `Command Code API error 422 (${detail}): zero data retention is enforced but no ZDR-capable upstream is available for this model — turn the ZDR setting off (or use another model)`, "Command Code API 返回 422：已开启零数据保留（ZDR），但该模型当前没有可用的 ZDR 上游——请关闭 ZDR 开关，或改用其他模型", { status: 422 });
+	if (status === 401) return bilingual("INVALID_CREDENTIAL", `Command Code API error 401 (${detail}): the API key is missing or invalid — check the key stored for COMMANDCODE_API_KEY (Models page) or the auth file`, "Command Code API 返回 401：API 密钥缺失或无效——请在设置页检查 COMMANDCODE_API_KEY 存储的密钥，或检查 auth 文件", { status: 401 });
+	if (status === 413) return bilingual("PROVIDER_HTTP_ERROR", "Command Code API error 413: the request body exceeds the provider's size limit (the cap is undocumented, measured at about 50 MB) — the session history is too large to send, usually because of accumulated image attachments. Start a new session, or drop the image-heavy part of this one, and retry", "Command Code API 返回 413：请求体超过服务端的体积上限（官方未公开，实测约 50 MB）——会话历史过大，通常是历史图片累积所致。请新建会话，或移除本会话中图片较多的部分后重试", { status: 413 });
 	return new LlmError(`Command Code API error ${status}${detail === `HTTP ${status}` ? "" : ` (${detail})`}: ${errText.slice(0, 500)}`, httpErrorCode(status), {
 		status,
 		...retryAfterMs !== void 0 && retryAfterMs > 0 && retryAfterMs <= 9e5 ? { providerRetryAfterMs: retryAfterMs } : {}
@@ -5276,9 +5935,9 @@ function mapFinishReason(reason) {
 /** A terminal marker without text or tools is a failed attempt, not a completed turn. */
 function emptyCompletionError(reason, maxTokens, usage) {
 	const detail = `finish_reason=${reason ?? "unknown"}, max_tokens=${maxTokens}, outputTokens=${usage?.outputTokens ?? "unknown"}, reasoningTokens=${usage?.reasoningTokens ?? "unknown"}`;
-	if (mapFinishReason(reason).kind === "max-tokens") return new LlmError(`Command Code reached the output token limit without producing answer text or a tool call (${detail})；Command Code 已达到输出 token 上限，但没有生成正文或工具调用；请调整思考强度，或在模型和接口上限内增加输出预算`, "OUTPUT_TOKEN_LIMIT");
-	if (reason === "content_filter" || reason === "content-filter") return new LlmError(`Command Code filtered the response (${detail})；Command Code 拦截了响应，未生成正文或工具调用`, "CONTENT_FILTER");
-	return new LlmError(`Command Code finished without producing answer text or a tool call (${detail})；Command Code 返回了空响应（可能只有思考内容），重试通常可恢复`, "EMPTY_RESPONSE");
+	if (mapFinishReason(reason).kind === "max-tokens") return bilingual("OUTPUT_TOKEN_LIMIT", `Command Code reached the output token limit without producing answer text or a tool call (${detail})`, "Command Code 已达到输出 token 上限，但没有生成正文或工具调用；请调整思考强度，或在模型和接口上限内增加输出预算");
+	if (reason === "content_filter" || reason === "content-filter") return bilingual("CONTENT_FILTER", `Command Code filtered the response (${detail})`, "Command Code 拦截了响应，未生成正文或工具调用");
+	return bilingual("EMPTY_RESPONSE", `Command Code finished without producing answer text or a tool call (${detail})`, "Command Code 返回了空响应（可能只有思考内容），重试通常可恢复");
 }
 /**
 * Classify a pre-stream rejection that is about the ACCOUNT rather than about
@@ -5322,9 +5981,10 @@ const ACCOUNT_UNAVAILABLE_CODES = /* @__PURE__ */ new Set([
 	"PREMIUM_CREDITS_EXHAUSTED",
 	"MODEL_NOT_IN_PLAN"
 ]);
-function classifyAccountRejection(status, errText) {
-	if (status === 429 || readProviderErrorCode(errText)?.toUpperCase() === "RATE_LIMITED") {
-		const evidence = readWindowLimitEvidence(errText);
+function classifyAccountRejection(status, errText, parsed = parseProviderError(errText)) {
+	const code = (parsed.code ?? parsed.type)?.toUpperCase();
+	if (status === 429 || code === "RATE_LIMITED") {
+		const evidence = readWindowLimitEvidence(errText, parsed);
 		if (evidence.window === void 0) return { reason: "throttled" };
 		return evidence.resetAtMs === void 0 ? { reason: "rate-limit" } : {
 			reason: "rate-limit",
@@ -5332,23 +5992,11 @@ function classifyAccountRejection(status, errText) {
 		};
 	}
 	if (status === 401) return { reason: "invalid-credential" };
-	const code = readProviderErrorCode(errText)?.toUpperCase();
 	if (code !== void 0 && ACCOUNT_UNAVAILABLE_CODES.has(code)) return { reason: "unavailable" };
 	if (status < 400 || status >= 500) return void 0;
 	const lower = errText.toLowerCase().replaceAll("_", " ");
 	if (lower.includes("insufficient credits") || lower.includes("premium credits exhausted") || lower.includes("model not in plan") || /insufficient (credit|balance)/.test(lower) || /out of credit/.test(lower) || /not (available|included)[^.]{0,40}plan/.test(lower) || lower.includes("upgrade your plan")) return { reason: "unavailable" };
 }
-/** The machine-readable `error.code`/`error.type` of a pre-stream failure body. */
-function readProviderErrorCode(errText) {
-	try {
-		const parsed = JSON.parse(errText);
-		if (!isRecord(parsed)) return void 0;
-		const error = isRecord(parsed.error) ? parsed.error : parsed;
-		return stringValue(error.code) ?? stringValue(error.type);
-	} catch {
-		return;
-	}
-}
 /**
 * How far ahead a provider-published reset may be and still be trusted.
 *
@@ -5376,20 +6024,10 @@ const MAX_TRUSTED_RESET_MS = 2592e6;
 * message is honored as the fallback. Either can be present without the other;
 * the window label is what decides the classification.
 */
-function readWindowLimitEvidence(errText) {
-	let named;
-	let message = "";
-	let seconds;
-	try {
-		const parsed = JSON.parse(errText);
-		if (isRecord(parsed)) {
-			const error = isRecord(parsed.error) ? parsed.error : parsed;
-			const rateLimit = isRecord(error.rateLimit) ? error.rateLimit : void 0;
-			named = stringValue(rateLimit?.window);
-			message = stringValue(error.message) ?? stringValue(parsed.message) ?? "";
-			seconds = numberValue(rateLimit?.reset);
-		}
-	} catch {}
+function readWindowLimitEvidence(errText, parsed) {
+	const named = stringValue(parsed.rateLimit?.window);
+	const message = parsed.message ?? stringValue(parsed.root?.message) ?? "";
+	const seconds = numberValue(parsed.rateLimit?.reset);
 	const window = named === "fiveHour" || named === "weekly" || named === "daily" ? named : /usage limit for your plan/i.test(message) || /usage limit for your plan/i.test(errText) ? /weekly/i.test(message) ? "weekly" : "fiveHour" : void 0;
 	const stamp = /resets at (\d{4}-\d{2}-\d{2}T[\d:.]+Z)/i.exec(message)?.[1] ?? /resets at (\d{4}-\d{2}-\d{2}T[\d:.]+Z)/i.exec(errText)?.[1];
 	const stamped = stamp === void 0 ? void 0 : Date.parse(stamp);
@@ -5407,24 +6045,15 @@ function readWindowLimitEvidence(errText) {
 * other 4xx/5xx must surface as ordinary errors so real account/model
 * problems are not masked.
 */
-function isUpgradeRequiredError(status, errText) {
+function isUpgradeRequiredError(status, errText, parsed = parseProviderError(errText)) {
 	if (status !== 403) return false;
 	const lower = errText.toLowerCase();
 	if (lower.includes("upgrade_required")) return true;
 	if (lower.includes("go plan") && lower.includes("api access")) return true;
 	if (lower.includes("only plan without api access")) return true;
 	if (lower.includes("upgrade to goat or higher")) return true;
-	try {
-		const parsed = JSON.parse(errText);
-		if (isRecord(parsed)) {
-			const error = isRecord(parsed.error) ? parsed.error : parsed;
-			if ((stringValue(error.code) ?? stringValue(error.type))?.toLowerCase() === "upgrade_required") return true;
-			const message = stringValue(error.message) ?? "";
-			if (message.toLowerCase().includes("go plan") && message.toLowerCase().includes("api access")) return true;
-		}
-	} catch {
-		return false;
-	}
+	if ((parsed.code ?? parsed.type)?.toLowerCase() === "upgrade_required") return true;
+	if (parsed.message?.toLowerCase().includes("go plan") && parsed.message.toLowerCase().includes("api access")) return true;
 	return false;
 }
 /** Map an OpenAI Chat Completions usage payload to harness disjoint counts. */
@@ -5532,33 +6161,42 @@ function commandCopy(locale, key) {
 	return commandcodeCommand[locale][key] ?? commandcodeCommand.en[key] ?? key;
 }
 //#endregion
-//#region src/commands.ts
-function money(value) {
-	return `$${value.toFixed(4)}`;
-}
-/** Compact dollar amount (2 decimals), for the summary and window rows. */
-function moneyShort(value) {
+//#region src/display-format.ts
+/** Shared, dependency-free formatting for Host commands and browser surfaces. */
+function formatMoney(value) {
 	return `$${value.toFixed(2)}`;
 }
-/** Format a large token count compactly (1.9M style). */
-function tokensCompact(value) {
+function formatMoneyExact(value) {
+	return `$${value.toFixed(4)}`;
+}
+function formatTokensCompact(value) {
 	if (value >= 1e9) return `${(value / 1e9).toFixed(1)}B`;
 	if (value >= 1e6) return `${(value / 1e6).toFixed(1)}M`;
 	if (value >= 1e3) return `${(value / 1e3).toFixed(1)}K`;
 	return String(value);
 }
-/**
-* Success-rate percentage (already in percent units): at most two decimals,
-* trailing zeros trimmed — mirrors `formatSuccessRate` in
-* `./client/usage.ts`, which the settings card uses.
-*/
-function successRateText(value) {
+/** The input is already in percent units; callers add the percent sign. */
+function formatSuccessRate(value) {
 	return String(Number(value.toFixed(2)));
 }
+/** One window's fill ratio in [0, 1]; zero when uncapped. */
+function windowRatio(used, cap) {
+	if (cap <= 0) return 0;
+	return Math.max(0, Math.min(1, used / cap));
+}
+/** Local date-time, with the empty state chosen by the caller. */
+function formatResetAt(ms) {
+	return ms <= 0 ? "" : new Date(ms).toLocaleString();
+}
+//#endregion
+//#region src/commands.ts
+const money = formatMoneyExact;
+const moneyShort = formatMoney;
+const tokensCompact = formatTokensCompact;
+const successRateText = formatSuccessRate;
 /** A local date, or `n/a` when the provider published no reset time. */
 function resetLabel(ms) {
-	if (ms <= 0) return "n/a";
-	return new Date(ms).toLocaleString();
+	return formatResetAt(ms) || "n/a";
 }
 /**
 * A 10-cell horizontal bar: `██████████` for 100%, `███░░░░░░░` for ~33%.
@@ -5566,7 +6204,7 @@ function resetLabel(ms) {
 */
 function bar(used, cap) {
 	if (cap <= 0) return "—";
-	const ratio = Math.max(0, Math.min(1, used / cap));
+	const ratio = windowRatio(used, cap);
 	const filled = Math.round(ratio * 10);
 	return "█".repeat(filled) + "░".repeat(10 - filled);
 }
@@ -5849,7 +6487,7 @@ const MODELS_ENDPOINT = "commandcode/models";
 * separate instance so catalog boundary errors name `commandcode/models`,
 * not the report endpoint.
 */
-const { record: catalogRecord, stringField: catalogString } = makeBoundaryValidator("commandcode/models result:");
+const { record: catalogRecord, stringField: catalogString, numberField: catalogNumber } = makeBoundaryValidator("commandcode/models result:");
 /** Parse one untrusted boundary value into a {@link CommandCodeCatalogModel}. */
 function parseCatalogModel(value) {
 	const source = catalogRecord(value, "model");
@@ -5858,6 +6496,7 @@ function parseCatalogModel(value) {
 		name: catalogString(source, "name", "model.name")
 	};
 	if (source.tier !== void 0) model.tier = catalogString(source, "tier", "model.tier");
+	if (source.allowance !== void 0) model.allowance = catalogNumber(source, "allowance", "model.allowance");
 	return model;
 }
 /** Parse the wire result into a {@link CommandCodeCatalog}. */
@@ -5999,12 +6638,17 @@ function loginDescriptor(endpoint, method) {
 		}]
 	} : descriptor;
 }
-/** The three login descriptors, shared verbatim by Host registration and Client mount. */
-const LOGIN_DESCRIPTORS = [
-	loginDescriptor(LOGIN_BEGIN_ENDPOINT, "loginBegin"),
-	loginDescriptor(LOGIN_STATUS_ENDPOINT, "loginStatus"),
-	loginDescriptor(LOGIN_CANCEL_ENDPOINT, "loginCancel")
-];
+/** The Host-face contribution fragment registered on `ctx.typert`. */
+const LOGIN_HOST_CONTRIBUTION = {
+	package: REMOTE_PACKAGE,
+	face: "host",
+	schemas: [],
+	invocations: [
+		loginDescriptor(LOGIN_BEGIN_ENDPOINT, "loginBegin"),
+		loginDescriptor(LOGIN_STATUS_ENDPOINT, "loginStatus"),
+		loginDescriptor(LOGIN_CANCEL_ENDPOINT, "loginCancel")
+	]
+};
 //#endregion
 //#region src/usage-remote.ts
 /**
@@ -6093,7 +6737,7 @@ function applyUsageRemote(ctx, deps) {
 				...USAGE_HOST_CONTRIBUTION.invocations,
 				MODELS_DESCRIPTOR,
 				PRICES_DESCRIPTOR,
-				...LOGIN_DESCRIPTORS
+				...LOGIN_HOST_CONTRIBUTION.invocations
 			]
 		});
 		remoteCtx.effect(() => () => void unregister(), "dsh-commandcode-provider: usage remote");
@@ -6810,22 +7454,8 @@ var CommandCodeSearchProvider = class {
 const ACTIVE_ACCOUNT_AUTO = "auto";
 /** The selector value meaning "no language override — follow the shell locale". */
 const LANG_AUTO = "auto";
-/** Tier display names, mirroring the web dropdown's headings (`model-select.ts`). */
-const TIER_TITLES = {
-	go: "Go",
-	goat: "GOAT",
-	pro: "Pro",
-	provider: "Provider",
-	max: "Max"
-};
 /** Tiers in picker order; a model outside this set joins the "Other" group. */
-const TIER_ORDER = [
-	"go",
-	"goat",
-	"pro",
-	"provider",
-	"max"
-];
+const TIER_ORDER = PLAN_TIER_ORDER;
 /** The group holding models this build's catalog does not know. */
 const OTHER_GROUP_ID = "models-other";
 /**
@@ -6883,8 +7513,8 @@ function buildCommandCodeTuiSection(deps) {
 	const extras = [.../* @__PURE__ */ new Set([...stored, ...Object.keys(overrides)])].filter((id) => !known.has(id));
 	const tierGroups = TIER_ORDER.filter((tier) => choices.some((choice) => choice.tier === tier)).map((tier) => ({
 		id: `models-${tier}`,
-		title: `${TIER_TITLES[tier] ?? tier} models`,
-		descriptions: { zh: `${TIER_TITLES[tier] ?? tier} 模型` }
+		title: `${PLAN_LABELS[tier] ?? tier} models`,
+		descriptions: { zh: `${PLAN_LABELS[tier] ?? tier} 模型` }
 	}));
 	const unranked = choices.filter((choice) => tierRank(choice.tier) === TIER_ORDER.length);
 	const otherGroup = unranked.length > 0 || extras.length > 0 ? [{
@@ -6989,6 +7619,20 @@ function buildCommandCodeTuiSection(deps) {
 					value: text.trim() === "true"
 				})
 			},
+			{
+				path: ["offloadSeenImagesForCache"],
+				group: "advanced",
+				kind: "boolean",
+				label: "Stop replaying images already seen",
+				descriptions: { zh: "已看过的图片不再重复发送" },
+				hint: "CLI transport only. After this model has answered, durably replace older images with text to keep later prompt text cacheable. Old pixels need a fresh file read or attachment to inspect again. Off by default.",
+				hintDescriptions: { zh: "仅 CLI 传输。模型看过图片并回复后，永久用文字替代旧图，以保留后续文本缓存；重看旧图需要重新读取文件或附加。默认关闭。" },
+				format: (value) => value === true ? "true" : "false",
+				parse: (text) => ({
+					kind: "set",
+					value: text.trim() === "true"
+				})
+			},
 			{
 				path: ["filterModelsByPlan"],
 				group: "models",
@@ -7149,27 +7793,18 @@ function applyCommandCodeTuiSettings(ctx, deps) {
 * A bounded retry budget for `TRANSPORT` failures (issue #39, second report).
 *
 * The route policy (`providerRetryPolicy` in `./adapter.ts`) is near-unbounded
-* on purpose — 1000 attempts doubling to a 15-minute cap — because it exists
-* for failures the provider ASKS to have retried, where the wait is the point.
-* A connection that cannot be established is not that: either a blip the first
-* few attempts absorb, or an outage no in-request waiting fixes (and its waits
-* count BEFORE each attempt, so attempt 11 alone already waits 512 s). So
-* transport failures get their own budget; waiting out a real outage is the
-* user's call, and the next send starts a fresh budget.
-*
-* Not counted here: the pre-stream recovery the ADAPTER performs inside one
-* `stream()` call (account rotation, the 413 image-budget step-down, the
-* Provider-API → CLI switch) — invisible to the caller and bounded on its own.
-* This budget caps only the harness's retry loop.
+* on purpose — 1000 attempts doubling to a 15-minute cap — for failures the
+* provider ASKS to have retried. A connection that cannot be established is
+* not that: a blip the first few attempts absorb, or an outage no in-request
+* waiting fixes (attempt 11 alone already waits 512 s). So transport failures
+* get their own budget, cleared at each new STEP (one step = one model
+* request). `agent/status` → `idle` is NOT the reset (one `running` phase spans
+* a turn's steps), and neither is `assistant/attempt` (appended for the FAILED
+* attempt itself, which would clear the budget on every failure).
 *
-* Reset rule: the budget clears at each new STEP (one step = one model request).
-* `agent/status` → `idle` is NOT it, though it looks natural: the loop's
-* `setPhase` emits it only on a status CHANGE, and a turn's steps all run inside
-* one `running` phase, so a reset there would fail every later step of an outage
-* turn at once instead of retrying each. `assistant/attempt` is wrong the other
-* way — the loop appends it for the FAILED attempt itself, before dispatching
-* `agent/request-error`, so resetting on it would clear the budget on every
-* failure and restore the very loop this module exists to stop.
+* Not counted here: the adapter's in-`stream()` pre-stream recovery (account
+* rotation, the 413 step-down, the Provider-API → CLI switch) — invisible to
+* the caller and bounded on its own.
 *
 * @module
 */
@@ -7251,7 +7886,7 @@ function transportBudgetMessage(failureMessage, maxRetries) {
 * Mark one schema field volatile.
 *
 * `.volatile()` is unconditional: it is a schemastery 3.18.3 feature and the
-* only supported engine (`dsh 0.1.7-rc.2`) pins `~3.18.4`, so the method is
+* only supported engine (`dsh 0.2.0-rc.1`) pins `~3.18.4`, so the method is
 * always present. It is reached through a structural member so the caller's
 * declared field type survives — the mark changes what the schema PARSES to (a
 * live reference), not the plugin-facing `Config` shape.
@@ -7348,6 +7983,7 @@ const Config = z.object(markVolatileFields({
 	modelsCachePath: z.string(),
 	requestTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
 	streamIdleTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
+	offloadSeenImagesForCache: z.boolean().default(false),
 	transportMaxRetries: z.number().min(0).max(50),
 	filterModelsByPlan: z.boolean(),
 	visibleModels: z.array(z.string()),
@@ -7380,8 +8016,9 @@ function resolveAdapterOptions(config) {
 		apiBase: config.apiBase ?? "https://api.commandcode.ai",
 		workingDir: config.workingDir ?? process.cwd(),
 		modelsCachePath: config.modelsCachePath ?? DEFAULT_MODELS_CACHE_PATH,
-		requestTimeoutMs: config.requestTimeoutMs ?? 6e4,
+		requestTimeoutMs: config.requestTimeoutMs ?? 3e5,
 		streamIdleTimeoutMs: config.streamIdleTimeoutMs ?? 3e5,
+		offloadSeenImagesForCache: config.offloadSeenImagesForCache === true,
 		filterModelsByPlan: config.filterModelsByPlan ?? true,
 		visibleModels: Array.isArray(config.visibleModels) ? config.visibleModels.filter((id) => typeof id === "string" && id !== "") : void 0,
 		modelVisibility: readModelVisibility(config.modelVisibility),
@@ -7555,12 +8192,16 @@ function apply(ctx, config) {
 	});
 	ctx.effect(() => () => loginFlow.dispose(), "dsh-commandcode-provider: login flow");
 	const catalogForEditors = async () => {
-		return { models: (await adapter.listModels(PROVIDER, { unfiltered: true })).map((model) => {
+		const models = await adapter.listModels(PROVIDER, { unfiltered: true });
+		const bracket = await adapter.allowanceTier();
+		return { models: models.map((model) => {
 			const tier = KNOWN_PLANS[model.id];
+			const allowance = bracket === void 0 ? void 0 : modelAllowanceFor(model.id)?.[bracket];
 			return {
 				id: model.id,
 				name: model.name.replace(/\s*\(CC\)$/, ""),
-				...tier === void 0 ? {} : { tier }
+				...tier === void 0 ? {} : { tier },
+				...allowance === void 0 ? {} : { allowance }
 			};
 		}) };
 	};