npm - @mars-sea/dsh-commandcode-provider - Versions diffs - 0.11.17 → 0.12.1 - Mend

@mars-sea/dsh-commandcode-provider 0.11.17 → 0.12.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (9) hide show

package/lib/index.js CHANGED Viewed

@@ -6,12 +6,96 @@ import { CONTEXT_WINDOW_EXCEEDED_CODE, IMAGE_OFFLOAD_REQUIRED_CODE, LlmAdapter,
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
 import { launchEnvironmentOf } from "@deepseek-ai/dsh-launch-environment";
 import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
-import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { appendFile, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { createServer } from "node:http";
 import { createServer as createServer$1 } from "node:net";
 import { WebError } from "@deepseek-ai/dsh-web";
+//#region src/cost-facts.ts
+const zeroCostTokens = () => ({
+	uncachedInputTokens: 0,
+	outputTokens: 0,
+	cacheReadTokens: 0,
+	cacheWriteTokens: 0
+});
+const COST_TOKEN_KEYS = [
+	"uncachedInputTokens",
+	"outputTokens",
+	"cacheReadTokens",
+	"cacheWriteTokens"
+];
+function peakHour(at, windows) {
+	const time = new Date(at);
+	return time.getUTCDay() !== 0 && time.getUTCDay() !== 6 && windows.some(([start, end]) => time.getUTCHours() >= start && time.getUTCHours() < end);
+}
+/**
+* All prompt billing buckets determine a request's band, never cumulative
+* session input.
+*
+* A tiered model returns the matching band and does NOT then apply `peak`: the
+* page publishes those two dimensions independently and no row carries both
+* today, so the combination becoming real is visible before it reaches a user.
+* This ordering is a latent choice, not a verified upstream rule.
+*/
+function requestRates(price, at, contextTokens, table) {
+	const tier = price.contextTiers?.find((tier) => tier.maxContext === void 0 || contextTokens <= tier.maxContext);
+	if (tier !== void 0) return tier;
+	return price.peak !== void 0 && at !== null && peakHour(at, table.peakHours) ? price.peak : price;
+}
+/** Cache version and wire guard: changing bands/rates must refold historical groups. */
+function pricingKey(table) {
+	const rates = (r) => [
+		r.inputCost,
+		r.outputCost,
+		r.cacheReadCost,
+		r.cacheWriteCost ?? null
+	];
+	const canonical = JSON.stringify([
+		"commandCodeCost-v1",
+		table.peakHours,
+		table.models.map((p) => [
+			p.id,
+			p.slug,
+			p.free === true,
+			rates(p),
+			p.peak ? rates(p.peak) : null,
+			p.contextTiers?.map((t) => [t.maxContext ?? null, rates(t)]) ?? null
+		])
+	]);
+	let hash = 2166136261;
+	for (const c of canonical) hash = Math.imul(hash ^ c.charCodeAt(0), 16777619) >>> 0;
+	return hash;
+}
+/** Only safe to merge requests whose billing classification is identical. */
+function costGroupKey(group, table) {
+	const price = table.models.find((p) => p.id === group.model || p.slug === group.model);
+	return JSON.stringify([
+		group.provider,
+		group.model,
+		price === void 0 ? null : requestRates(price, group.at, group.contextTokens, table),
+		group.at === null
+	]);
+}
+//#endregion
+//#region src/plan-tiers.ts
+/** Shared plan-tier presentation facts; safe to inline into the browser bundle. */
+const PLAN_TIER_ORDER = [
+	"go",
+	"goat",
+	"pro",
+	"provider",
+	"max"
+];
+const PLAN_LABELS = {
+	go: "Go",
+	goat: "GOAT",
+	pro: "Pro",
+	provider: "Provider",
+	max: "Max"
+};
+const PLAN_ORDER = Object.fromEntries(PLAN_TIER_ORDER.map((tier, index) => [tier, index]));
+//#endregion
 //#region src/capabilities.ts
 /**
 * Static capability snapshot for the Command Code provider: model →
@@ -19,7 +103,7 @@ import { WebError } from "@deepseek-ai/dsh-web";
 * subscription-plan labels, deals, and hourly (peak/off-peak) pricing.
 *
 * Everything here is synced from official sources — the command-code CLI
-* bundle's model table (`dist/cli.mjs`, re-verified at command-code@1.66.0) and
+* bundle's model table (`dist/cli.mjs`, re-verified at command-code@1.72.1) and
 * the official plan/pricing/model docs; see the dsh-commandcode-upstream skill
 * for the extraction procedures. Keeping the snapshot in its own module
 * confines those frequent sync diffs here: src/adapter.ts holds only the stable
@@ -103,6 +187,13 @@ const KNOWN_EFFORTS = {
 		"xhigh",
 		"max"
 	],
+	"claude-sonnet-5-5": [
+		"low",
+		"medium",
+		"high",
+		"xhigh",
+		"max"
+	],
 	"deepseek/deepseek-v4-flash-fast": [
 		"low",
 		"high",
@@ -113,6 +204,11 @@ const KNOWN_EFFORTS = {
 		"high",
 		"max"
 	],
+	"deepseek/deepseek-v4.1-flash-fast": [
+		"low",
+		"high",
+		"max"
+	],
 	"deepseek/deepseek-v4-flash": ["high", "max"],
 	"deepseek/deepseek-v4-flash-vision-exp": ["high", "max"],
 	"deepseek/deepseek-v4-pro": ["high", "max"],
@@ -312,6 +408,18 @@ const KNOWN_EFFORTS = {
 		"low",
 		"medium",
 		"xhigh"
+	],
+	"gpt-6.1-sol": [
+		"low",
+		"medium",
+		"high",
+		"xhigh",
+		"max"
+	],
+	"inclusionai/ling-3.1-flash:free": [
+		"low",
+		"medium",
+		"high"
 	]
 };
 /**
@@ -348,8 +456,10 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"claude-opus-5",
 	"claude-sonnet-4-6",
 	"claude-sonnet-5",
+	"claude-sonnet-5-5",
 	"deepseek/deepseek-v4-flash-vision-exp",
 	"deepseek/deepseek-v4.1-flash",
+	"deepseek/deepseek-v4.1-flash-fast",
 	"google/gemini-3.1-flash-lite",
 	"google/gemini-3.5-flash",
 	"google/gemini-3.5-flash-lite",
@@ -366,6 +476,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"gpt-6-astra",
 	"gpt-6-luna",
 	"gpt-6-sol",
+	"gpt-6.1-sol",
 	"meta/muse-spark-1.1",
 	"meta/muse-spark-1.2",
 	"meta/muse-spark-1.2-contributor",
@@ -395,12 +506,13 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 ]);
 /**
 * Models WITHOUT a zero-data-retention upstream, per the official CLI's own
-* registry (`command-code@1.66.0` `dist/cli.mjs`): `modelSupportsZdr(id)` is
+* registry (`command-code@1.72.1` `dist/cli.mjs`): `modelSupportsZdr(id)` is
 * exactly `!nonZdrSet.has(canonicalize(id))`, and `knownModelSupportsZdr`
 * carries the same membership in the sibling route table — the UNION of both
 * is this set. Reading only the sibling route table would drop `meituan/
-* LongCat-2.0` and `stealth/pixel-canary`, which each appear in
-* `modelSupportsZdr` alone. The official docs (commandcode.ai/docs/resources/
+* LongCat-2.0`, which appears in `modelSupportsZdr` alone (re-read from the
+* 1.66.0 / 1.67.0 / 1.68.0 artifacts on 2026-09-29: the two stealth-preview
+* rows sit in BOTH sets, so LongCat is the only divergence). The official docs (commandcode.ai/docs/resources/
 * zdr) put it in prose — "99% of our models have ZDR-capable upstreams … only
 * a small handful of models are affected" — so the CLI's exclusion list is
 * the only per-model evidence there is; a ZDR request naming one of these
@@ -422,12 +534,15 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 * (its `zdr:{only:[…]}` provider routes and the per-provider `zdr`/`noTraining`
 * flags) is upstream-internal routing, not a per-model contract, so this table
 * is the snapshot of the exclusion set and nothing more. It is a rare change:
-* 20 members held across 1.62.0 → 1.64.0, and 1.65.0 and 1.66.0 each added
-* exactly one (the two stealth-preview models below).
+* 20 members held across 1.62.0 → 1.64.0, 1.65.0 and 1.66.0 each added exactly
+* one (the two stealth-preview models below), 1.67.0 added one
+* (`deepseek/deepseek-v4.1-flash-fast`), and 1.68.0 changed nothing — 23
+* members as of 2026-09-29.
 */
 const KNOWN_NON_ZDR_MODELS = /* @__PURE__ */ new Set([
 	"MiniMaxAI/MiniMax-M3",
 	"Qwen/Qwen3.8-Max-0902",
+	"deepseek/deepseek-v4.1-flash-fast",
 	"meituan/LongCat-2.0",
 	"meta/muse-spark-1.1",
 	"meta/muse-spark-1.2",
@@ -492,16 +607,22 @@ const KNOWN_THINKING_MODELS = /* @__PURE__ */ new Set([
 /**
 * Catalog models the Provider API serves ONLY through `/provider/v1/messages`
 * (Anthropic Messages shape). Every other model in the catalog answers on
-* `/provider/v1/chat/completions`; these reject it outright with HTTP 400
-* `Model "<id>" must be called via /provider/v1/messages (Anthropic Messages
-* shape)`.
+* `/provider/v1/chat/completions`.
 *
-* Measured 2026-09-16 against the live catalog (command-code@1.54.0): all 69
-* models were posted to `/provider/v1/chat/completions`; exactly these eight
-* — the whole Claude family then — refused, and every one of them is routed
-* normally by `/alpha/generate` (a lower-plan key gets the ordinary
-* `MODEL_NOT_IN_PLAN` 403 there, never a routing error). So the CLI transport
-* is a complete fallback and the adapter does not need a Messages transport.
+* Measured 2026-09-16 (command-code@1.54.0, 69 models posted to
+* `/provider/v1/chat/completions`): exactly the then-entire Claude family
+* refused with HTTP 400 `Model "<id>" must be called via
+* /provider/v1/messages (Anthropic Messages shape)`, and every one of them is
+* routed normally by `/alpha/generate`.
+*
+* Re-measured 2026-09-29 against the 84-model catalog: the same ten
+* `claude-*` ids are the only ones carrying `supported_endpoints:
+* ["/messages"]`, and posting a non-Claude model to the endpoint answers 400
+* `Model "<id>" is not supported on this endpoint. Use
+* /provider/v1/chat/completions for OpenAI and OSS models.` The adapter routes
+* on that field when the catalog supplies it, so this set is the FALLBACK for
+* a cached or hand-built catalog, not the primary source — see
+* `requiresMessagesEndpoint()`.
 *
 * Note what this list is NOT: it is not a plan gate. `claude-sonnet-5` is
 * Pro-tier and `claude-opus-4-8` Provider-tier, so the accounts entitled to
@@ -510,20 +631,21 @@ const KNOWN_THINKING_MODELS = /* @__PURE__ */ new Set([
 * request before this snapshot existed.
 *
 * `requiresMessagesEndpoint()` additionally treats any `claude-*` id as
-* Messages-only, so a Claude model added upstream (`claude-opus-5-5` in
-* command-code@1.64.0 was the first this snapshot missed) is still routed
-* correctly by an un-updated plugin instead of hard-failing with the 400
-* above. The worst case of that rule going stale the other way (upstream
-* teaching `/provider/v1/chat/completions` to serve Claude) is one model
-* riding the CLI transport it already works on.
+* Messages-only, so a Claude model added upstream is still routed correctly
+* by an un-updated plugin instead of hard-failing with the 400 above. The
+* worst case of that rule going stale the other way (upstream teaching
+* `/provider/v1/chat/completions` to serve Claude) is one model riding a
+* transport it already works on.
 *
 * Keep in sync when models ship (see the dsh-commandcode-upstream skill).
 */
 const MESSAGES_ONLY_MODELS = /* @__PURE__ */ new Set([
+	"claude-sonnet-5-5",
 	"claude-sonnet-5",
 	"claude-sonnet-4-6",
 	"claude-fable-5-1",
 	"claude-fable-5",
+	"claude-opus-5-5",
 	"claude-opus-5",
 	"claude-opus-4-8",
 	"claude-opus-4-7",
@@ -534,13 +656,140 @@ function requiresMessagesEndpoint(modelId) {
 	return MESSAGES_ONLY_MODELS.has(modelId) || modelId.startsWith("claude-");
 }
 /**
+* Per-model output ceilings, which `/provider/v1/models` does NOT publish (it
+* carries `context_length` and `supported_endpoints` only) while every endpoint
+* refuses a larger `max_tokens` per model. Sending the context window as the
+* output budget is what produced issue #71: `claude-sonnet-5-5` has a
+* 1 000 000-token window and a 128 000-token ceiling, the adapter derived
+* 131072, and the endpoint refused every request of a fresh process.
+*
+* **Generated — do not hand-edit.** `scripts/sync-output-limits.mjs` rewrites
+* this literal from models.dev; run it after a catalog sync, and use its
+* `--check` in CI. Command Code resells these models through their VENDOR's own
+* API, so the vendor's published ceiling is the value recorded: 76 of the 86
+* catalog ids as of 2026-09-30. Each row carries a comment naming the entry it
+* came from.
+*
+* Two of those 76 rest on more than a vendor lookup. `gpt-6.1-sol` (128000) comes
+* from OpenAI's own row and is corroborated by every other provider carrying it.
+* `inclusionai/ling-3.1-flash:free` (32768) is hand-recorded in the script's
+* `MANUAL_CEILINGS`: models.dev has no `ling-3.1` entry yet, so it takes the Ling
+* family's uniform ceiling. Both are still correctable — a stricter gateway costs
+* one refused request, and `streamRequest()` remembers what the endpoint said.
+*
+* The 10 unlisted models are ones no vendor publishes and the aggregators
+* disagree about. They are NOT a gap: a refusal states the ceiling in full, and
+* `streamRequest()` reads it off, retries once and remembers it for the model
+* (issue #71). A vendor figure the gateway turns out to be stricter than costs
+* one round trip; a conservative guess costs half of every answer, forever —
+* which is why the unlisted path defers to the endpoint rather than to a
+* fallback here.
+*
+* An unlisted Messages-route model still falls back to
+* {@link DEFAULT_MESSAGES_MAX_TOKENS} before any request is made, so a ceiling
+* is never absent when the body is built.
+*/
+const MODEL_OUTPUT_TOKEN_LIMITS = /* @__PURE__ */ new Map([
+	["claude-fable-5", 128e3],
+	["claude-fable-5-1", 128e3],
+	["claude-haiku-4-5-20251001", 64e3],
+	["claude-opus-4-7", 128e3],
+	["claude-opus-4-8", 128e3],
+	["claude-opus-5", 128e3],
+	["claude-opus-5-5", 128e3],
+	["claude-sonnet-4-6", 128e3],
+	["claude-sonnet-5", 128e3],
+	["claude-sonnet-5-5", 128e3],
+	["deepseek/deepseek-v4-flash", 393216],
+	["deepseek/deepseek-v4-flash-vision-exp", 393216],
+	["deepseek/deepseek-v4-pro", 393216],
+	["google/gemini-3.1-flash-lite", 65536],
+	["google/gemini-3.5-flash", 65536],
+	["google/gemini-3.5-flash-lite", 65536],
+	["google/gemini-3.6-flash", 65536],
+	["google/gemini-3.7-flash", 65536],
+	["google/gemini-3.8-flash", 65536],
+	["gpt-5.3-codex", 128e3],
+	["gpt-5.4", 128e3],
+	["gpt-5.4-mini", 128e3],
+	["gpt-5.5", 128e3],
+	["gpt-5.6-luna", 128e3],
+	["gpt-5.6-sol", 128e3],
+	["gpt-5.6-terra", 128e3],
+	["gpt-6-astra", 128e3],
+	["gpt-6-luna", 128e3],
+	["gpt-6-sol", 128e3],
+	["gpt-6.1-sol", 128e3],
+	["inclusionai/ling-3.0-flash-sante:free", 32768],
+	["inclusionai/ling-3.1-flash:free", 32768],
+	["meituan/LongCat-2.0", 131072],
+	["meta/muse-spark-1.1", 131072],
+	["meta/muse-spark-1.2", 131072],
+	["meta/muse-spark-1.2-contributor", 131072],
+	["meta/muse-spark-1.3", 131072],
+	["meta/muse-spark-1.3-contributor", 131072],
+	["MiniMaxAI/MiniMax-M2.5", 131072],
+	["MiniMaxAI/MiniMax-M2.7", 131072],
+	["MiniMaxAI/MiniMax-M3", 512e3],
+	["moonshotai/Kimi-K2.6", 262144],
+	["moonshotai/Kimi-K2.7-Code", 262144],
+	["moonshotai/Kimi-K2.7-Code-Highspeed", 262144],
+	["moonshotai/Kimi-K3", 1048576],
+	["nvidia/nemotron-3-ultra-550b-a55b", 65536],
+	["poolside/laguna-s-2.1-free", 32768],
+	["Qwen/Qwen3.6-Max-Preview", 65536],
+	["Qwen/Qwen3.6-Plus", 65536],
+	["Qwen/Qwen3.7-Flash", 131072],
+	["Qwen/Qwen3.7-Max", 131072],
+	["Qwen/Qwen3.7-Plus", 131072],
+	["Qwen/Qwen3.8-Flash", 131072],
+	["Qwen/Qwen3.8-Max", 131072],
+	["Qwen/Qwen3.8-Omni-Flash", 131072],
+	["sakana/fugu-ultra", 1e6],
+	["stealth/pixel-canary", 131072],
+	["stealth/space-bunny-alpha", 524288],
+	["stepfun/Step-3.5-Flash", 256e3],
+	["stepfun/Step-3.7-Flash", 256e3],
+	["stepfun/Step-5-Preview", 65536],
+	["thinkingmachines/inkling", 65536],
+	["xai/grok-4.5", 5e5],
+	["xai/grok-4.6", 5e5],
+	["xai/grok-4.7", 5e5],
+	["xiaomi/mimo-v2.5", 131072],
+	["xiaomi/mimo-v2.5-pro", 131072],
+	["xiaomi/mimo-v2.6-flash", 131072],
+	["xiaomi/mimo-v2.6-pro", 131072],
+	["xiaomi/mimo-v2.6-pro-ultraspeed", 131072],
+	["z-ai/glm-5.3-flash", 131072],
+	["z-ai/glm-5.3-flashx", 131072],
+	["zai-org/GLM-5", 131072],
+	["zai-org/GLM-5.1", 131072],
+	["zai-org/GLM-5.2", 131072],
+	["zai-org/GLM-5.3", 131072]
+]);
+/**
+* Output ceiling for a Messages-route model that {@link MODEL_OUTPUT_TOKEN_LIMITS}
+* does not carry — today only models no vendor publishes yet. Deliberately
+* conservative: a 400 on `max_tokens` is a wasted round trip on every request,
+* whereas a lower ceiling only shortens an answer, and the endpoint states the
+* real one the first time it refuses, at which point the runtime overrides this
+* anyway (issue #71).
+*
+* 64 000 is not arbitrary: it is `claude-haiku-4-5-20251001`'s actual ceiling,
+* the lowest in the Claude family. A Claude model added to the catalog before
+* its row exists here therefore answers at a size the family really supports,
+* and is corrected upward on its first rejection rather than clamped here
+* forever.
+*/
+const DEFAULT_MESSAGES_MAX_TOKENS = 64e3;
+/**
 * The minimum subscription plan a model is included in, per the official plan
 * pages (`/docs/plans/go`, `/docs/plans/goat`, `/docs/plans/pro`,
 * `/docs/plans/max` and `/docs/resources/pricing-limits`). Each plan's model
 * list is a superset of the one below it: Go ⊂ GOAT ⊂ Pro ⊂ Provider/Max.
 * Models absent from every plan list (Claude Opus/Fable, Fugu Ultra) are
-* Provider-tier. Re-verified at command-code@1.66.0 (2026-09-27): 82 catalog
-* ids at 52/60/74/82 cumulative, a strict superset chain — every release since
+* Provider-tier. Re-verified at command-code@1.72.1 (2026-09-30): 86 catalog
+* ids at 53/62/76/84 cumulative, a strict superset chain — every release since
 * 1.49.0 has been additive with no tier move, and per-entry tags below name the
 * release that added each row.
 *
@@ -568,6 +817,7 @@ const KNOWN_PLANS = {
 	"Qwen/Qwen3.8-Omni-Flash": "go",
 	"deepseek/deepseek-v4-flash-fast": "go",
 	"deepseek/deepseek-v4.1-flash": "go",
+	"deepseek/deepseek-v4.1-flash-fast": "go",
 	"deepseek/deepseek-v4-flash": "go",
 	"deepseek/deepseek-v4-flash-vision-exp": "go",
 	"deepseek/deepseek-v4-pro": "go",
@@ -575,6 +825,7 @@ const KNOWN_PLANS = {
 	"gpt-6-luna": "go",
 	"meituan/LongCat-2.0": "go",
 	"inclusionai/ling-3.0-flash-sante:free": "go",
+	"inclusionai/ling-3.1-flash:free": "go",
 	"meta/muse-spark-1.2-contributor": "go",
 	"meta/muse-spark-1.3-contributor": "go",
 	"moonshotai/Kimi-K2.5": "go",
@@ -605,6 +856,7 @@ const KNOWN_PLANS = {
 	"zai-org/GLM-5.2": "go",
 	"zai-org/GLM-5.2-Fast": "go",
 	"zai-org/GLM-5.3": "go",
+	"claude-sonnet-5-5": "goat",
 	"google/gemini-3.7-flash": "goat",
 	"google/gemini-3.8-flash": "goat",
 	"gpt-5.6-sol": "goat",
@@ -634,26 +886,8 @@ const KNOWN_PLANS = {
 	"claude-opus-5-5": "provider",
 	"claude-opus-5": "provider",
 	"gpt-6-astra": "provider",
-	"sakana/fugu-ultra": "provider"
-};
-/** Official display labels for each plan tier. */
-const PLAN_LABELS = {
-	go: "Go",
-	goat: "GOAT",
-	pro: "Pro",
-	provider: "Provider",
-	max: "Max"
-};
-/**
-* Plan-tier sort weights, low to high. Models outside the snapshot (unknown
-* plans) sort after every known tier, keeping known models predictable.
-*/
-const PLAN_ORDER = {
-	go: 0,
-	goat: 1,
-	pro: 2,
-	provider: 3,
-	max: 4
+	"sakana/fugu-ultra": "provider",
+	"gpt-6.1-sol": "max"
 };
 /**
 * Whether a model is free (requests cost no credits), per the pricing page's
@@ -682,7 +916,7 @@ function compareByPlan(a, b) {
 /**
 * Subscription plan table, synced from the official CLI bundle's plan maps
 * (located by the `"individual-go"` key in `dist/cli.mjs`, re-verified unchanged
-* through command-code@1.66.0): subscription `planId` prefix → display name and
+* through command-code@1.72.1): subscription `planId` prefix → display name and
 * the plan's monthly credit total. This is the account's own subscription
 * (from `/alpha/billing/subscriptions`) — distinct from {@link KNOWN_PLANS},
 * which maps catalog models to their minimum tier.
@@ -697,6 +931,11 @@ const KNOWN_SUBSCRIPTION_PLANS = {
 		monthlyCredits: 10,
 		tierWeight: 0
 	},
+	"individual-go-v1": {
+		name: "Go",
+		monthlyCredits: 10,
+		tierWeight: 0
+	},
 	"individual-goat": {
 		name: "GOAT",
 		monthlyCredits: 70,
@@ -785,10 +1024,6 @@ const KNOWN_DEALS = {
 	"MiniMaxAI/MiniMax-M3": { label: "50% off" },
 	"xiaomi/mimo-v2.5-pro": { label: "99% off" },
 	"xiaomi/mimo-v2.5": { label: "98% off" },
-	"xai/grok-4.7": {
-		label: "40% off",
-		expiresAt: "2026-09-27T23:59:59.999Z"
-	},
 	"poolside/laguna-s-2.1-free": {
 		label: "FREE",
 		free: true
@@ -797,6 +1032,10 @@ const KNOWN_DEALS = {
 		label: "FREE",
 		free: true
 	},
+	"inclusionai/ling-3.1-flash:free": {
+		label: "FREE",
+		free: true
+	},
 	"stealth/space-bunny-alpha": {
 		label: "FREE",
 		free: true
@@ -812,7 +1051,7 @@ const KNOWN_DEALS = {
 * charges by the hour: peak hours are 01:00–04:00 and 06:00–10:00 UTC (7h per
 * weekday, full price) **Monday to Friday only**; the other 17 hours of a
 * weekday and every hour of Saturday/Sunday (UTC) are off-peak at half price.
-* Exactly four models carry the page's `timeOfDay` block (the four rows below).
+* Exactly five models carry the page's `timeOfDay` block (the five rows below).
 * The picker shows the *current* state as a compact label (`Peak`/`Half`)
 * matching the English noun style of the other markers (`Image`, `FREE`), so a
 * developer can tell at a glance whether calling the model right now is cheap
@@ -837,7 +1076,8 @@ const KNOWN_PEAK_PRICING = /* @__PURE__ */ new Set([
 	"deepseek/deepseek-v4-pro",
 	"deepseek/deepseek-v4-flash",
 	"deepseek/deepseek-v4-flash-vision-exp",
-	"deepseek/deepseek-v4.1-flash"
+	"deepseek/deepseek-v4.1-flash",
+	"deepseek/deepseek-v4.1-flash-fast"
 ]);
 /**
 * Peak hours (UTC, hour-of-day range end-exclusive): 01–03 and 06–09.
@@ -860,11 +1100,7 @@ const PEAK_HOUR_RANGES = [[1, 4], [6, 10]];
 * the one in {@link KNOWN_PEAK_PRICING} still gets the right half of the day.
 */
 function isPeakPricingHour(now = Date.now()) {
-	const at = new Date(now);
-	const day = at.getUTCDay();
-	if (day === 0 || day === 6) return false;
-	const hour = at.getUTCHours();
-	return PEAK_HOUR_RANGES.some(([start, end]) => hour >= start && hour < end);
+	return peakHour(now, PEAK_HOUR_RANGES);
 }
 /**
 * As {@link isPeakPricingHour}, plus the {@link KNOWN_PEAK_PRICING} membership
@@ -945,6 +1181,27 @@ function capabilityDescription(modelId, contextWindow, now = Date.now()) {
 //#endregion
 //#region src/model-prices.ts
 /**
+* The plan tiers a per-model allowance exists for, cheapest first. Ordering
+* matters: {@link allowanceTierForWeight} matches a tier weight against these
+* rather than against hard-coded numbers, so this table and the subscription
+* table cannot drift apart silently.
+*/
+const ALLOWANCE_TIERS = ["goat", "pro"];
+/**
+* Which allowance bracket a plan-tier weight belongs to, or undefined when that
+* plan has no per-model allowance.
+*
+* Weights come from `KNOWN_SUBSCRIPTION_PLANS` (go 0 · goat 1 · pro 2 ·
+* provider 3 · max/ultra 4) and {@link PLAN_ORDER} is the same scale, which is
+* what makes the lookup exact: Go, Provider, Max and Ultra have no published
+* allowance, and answering with a neighbouring tier's figure would be a
+* fabricated number rather than a missing one.
+*/
+function allowanceTierForWeight(tierWeight) {
+	if (tierWeight === void 0) return void 0;
+	return ALLOWANCE_TIERS.find((tier) => PLAN_ORDER[tier] === tierWeight);
+}
+/**
 * Every price row the page publishes, ordered by its own slug.
 *
 * Note on the GPT rows: `gpt-5.3-codex`, `gpt-5.4`, `gpt-5.4-mini` and
@@ -964,7 +1221,11 @@ const MODEL_PRICE_ROWS = [
 			50,
 			1,
 			12.5
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "claude-fable-5-1",
@@ -973,7 +1234,11 @@ const MODEL_PRICE_ROWS = [
 			50,
 			.25,
 			12.5
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "claude-haiku-4-5",
@@ -982,7 +1247,11 @@ const MODEL_PRICE_ROWS = [
 			5,
 			.1,
 			1.25
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "claude-opus-4-6",
@@ -991,7 +1260,11 @@ const MODEL_PRICE_ROWS = [
 			25,
 			.5,
 			6.25
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "claude-opus-4-7",
@@ -1000,7 +1273,11 @@ const MODEL_PRICE_ROWS = [
 			25,
 			.5,
 			6.25
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "claude-opus-4-8",
@@ -1009,7 +1286,11 @@ const MODEL_PRICE_ROWS = [
 			25,
 			.5,
 			6.25
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "claude-opus-5",
@@ -1018,7 +1299,11 @@ const MODEL_PRICE_ROWS = [
 			25,
 			.5,
 			6.25
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "claude-opus-5-5",
@@ -1027,7 +1312,11 @@ const MODEL_PRICE_ROWS = [
 			20,
 			.2,
 			5
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "claude-sonnet-4-6",
@@ -1036,7 +1325,11 @@ const MODEL_PRICE_ROWS = [
 			15,
 			.3,
 			3.75
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "claude-sonnet-5",
@@ -1045,7 +1338,24 @@ const MODEL_PRICE_ROWS = [
 			10,
 			.2,
 			2.5
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
+	},
+	{
+		id: "claude-sonnet-5-5",
+		rates: [
+			2,
+			10,
+			.2,
+			2.5
+		],
+		allowance: {
+			goat: 10,
+			pro: 20
+		}
 	},
 	{
 		id: "deepseek-v4-flash",
@@ -1058,7 +1368,11 @@ const MODEL_PRICE_ROWS = [
 			.3,
 			1.2,
 			.006
-		]
+		],
+		allowance: {
+			goat: 60,
+			pro: 70
+		}
 	},
 	{
 		id: "deepseek-v4-flash-fast",
@@ -1066,7 +1380,11 @@ const MODEL_PRICE_ROWS = [
 			.28,
 			.56,
 			.07
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "deepseek-v4-flash-vision-exp",
@@ -1079,7 +1397,11 @@ const MODEL_PRICE_ROWS = [
 			.3,
 			1.2,
 			.006
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "deepseek-v4-pro",
@@ -1092,7 +1414,11 @@ const MODEL_PRICE_ROWS = [
 			1.32,
 			3.96,
 			.044
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "deepseek-v4.1-flash",
@@ -1105,7 +1431,28 @@ const MODEL_PRICE_ROWS = [
 			.3,
 			1.2,
 			.006
-		]
+		],
+		allowance: {
+			goat: 60,
+			pro: 70
+		}
+	},
+	{
+		id: "deepseek-v4.1-flash-fast",
+		rates: [
+			.16,
+			.58,
+			.016
+		],
+		peak: [
+			.32,
+			1.16,
+			.032
+		],
+		allowance: {
+			goat: 60,
+			pro: 70
+		}
 	},
 	{
 		id: "fugu-ultra",
@@ -1113,7 +1460,11 @@ const MODEL_PRICE_ROWS = [
 			5,
 			30,
 			.5
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "gemini-3.1-flash-lite",
@@ -1121,7 +1472,11 @@ const MODEL_PRICE_ROWS = [
 			.25,
 			1.5,
 			.03
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "gemini-3.5-flash",
@@ -1129,7 +1484,11 @@ const MODEL_PRICE_ROWS = [
 			1.5,
 			9,
 			.15
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "gemini-3.5-flash-lite",
@@ -1137,7 +1496,11 @@ const MODEL_PRICE_ROWS = [
 			.3,
 			2.5,
 			.03
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "gemini-3.6-flash",
@@ -1145,7 +1508,11 @@ const MODEL_PRICE_ROWS = [
 			1.5,
 			7.5,
 			.15
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "gemini-3.7-flash",
@@ -1154,7 +1521,11 @@ const MODEL_PRICE_ROWS = [
 			7.5,
 			.15,
 			.08334
-		]
+		],
+		allowance: {
+			goat: 40,
+			pro: 50
+		}
 	},
 	{
 		id: "gemini-3.8-flash",
@@ -1162,7 +1533,11 @@ const MODEL_PRICE_ROWS = [
 			1.5,
 			7.5,
 			.15
-		]
+		],
+		allowance: {
+			goat: 40,
+			pro: 50
+		}
 	},
 	{
 		id: "glm-5",
@@ -1170,7 +1545,11 @@ const MODEL_PRICE_ROWS = [
 			1,
 			3.2,
 			.2
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "glm-5.1",
@@ -1178,7 +1557,11 @@ const MODEL_PRICE_ROWS = [
 			1.4,
 			4.4,
 			.26
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "glm-5.2",
@@ -1186,7 +1569,11 @@ const MODEL_PRICE_ROWS = [
 			1.4,
 			4.4,
 			.26
-		]
+		],
+		allowance: {
+			goat: 70,
+			pro: 80
+		}
 	},
 	{
 		id: "glm-5.2-fast",
@@ -1194,7 +1581,11 @@ const MODEL_PRICE_ROWS = [
 			3,
 			10.25,
 			.5
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "glm-5.3",
@@ -1202,7 +1593,11 @@ const MODEL_PRICE_ROWS = [
 			1.4,
 			4.4,
 			.26
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "glm-5.3-flash",
@@ -1210,7 +1605,11 @@ const MODEL_PRICE_ROWS = [
 			.15,
 			.5,
 			.03
-		]
+		],
+		allowance: {
+			goat: 40,
+			pro: 50
+		}
 	},
 	{
 		id: "glm-5.3-flashx",
@@ -1218,7 +1617,11 @@ const MODEL_PRICE_ROWS = [
 			.37,
 			1.25,
 			.075
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "gpt-5.3-codex",
@@ -1227,7 +1630,11 @@ const MODEL_PRICE_ROWS = [
 			8,
 			.5,
 			0
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "gpt-5.4",
@@ -1236,7 +1643,11 @@ const MODEL_PRICE_ROWS = [
 			15,
 			.25,
 			0
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "gpt-5.4-mini",
@@ -1245,7 +1656,11 @@ const MODEL_PRICE_ROWS = [
 			4.5,
 			.075,
 			0
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "gpt-5.5",
@@ -1254,7 +1669,11 @@ const MODEL_PRICE_ROWS = [
 			30,
 			.5,
 			0
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "gpt-5.6-luna",
@@ -1264,6 +1683,10 @@ const MODEL_PRICE_ROWS = [
 			.02,
 			.25
 		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		},
 		contextTiers: [{
 			"maxContext": 272e3,
 			"rates": [
@@ -1287,6 +1710,10 @@ const MODEL_PRICE_ROWS = [
 			.5,
 			6.25
 		],
+		allowance: {
+			goat: 70,
+			pro: 80
+		},
 		contextTiers: [{
 			"maxContext": 272e3,
 			"rates": [
@@ -1310,6 +1737,10 @@ const MODEL_PRICE_ROWS = [
 			.2,
 			2.5
 		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		},
 		contextTiers: [{
 			"maxContext": 272e3,
 			"rates": [
@@ -1333,6 +1764,10 @@ const MODEL_PRICE_ROWS = [
 			1,
 			12.5
 		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		},
 		contextTiers: [{
 			"maxContext": 272e3,
 			"rates": [
@@ -1348,6 +1783,33 @@ const MODEL_PRICE_ROWS = [
 			25
 		] }]
 	},
+	{
+		id: "gpt-6.1-sol",
+		rates: [
+			2,
+			10,
+			.1,
+			2.5
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		},
+		contextTiers: [{
+			"maxContext": 272e3,
+			"rates": [
+				2,
+				10,
+				.1,
+				2.5
+			]
+		}, { "rates": [
+			4,
+			15,
+			.2,
+			5
+		] }]
+	},
 	{
 		id: "gpt-6-luna",
 		rates: [
@@ -1356,6 +1818,10 @@ const MODEL_PRICE_ROWS = [
 			.01,
 			.125
 		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		},
 		contextTiers: [{
 			"maxContext": 272e3,
 			"rates": [
@@ -1379,6 +1845,10 @@ const MODEL_PRICE_ROWS = [
 			.2,
 			2.5
 		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		},
 		contextTiers: [{
 			"maxContext": 272e3,
 			"rates": [
@@ -1400,7 +1870,11 @@ const MODEL_PRICE_ROWS = [
 			2,
 			6,
 			.5
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "grok-4.6",
@@ -1409,6 +1883,10 @@ const MODEL_PRICE_ROWS = [
 			6,
 			.5
 		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		},
 		contextTiers: [{
 			"maxContext": 2e5,
 			"rates": [
@@ -1425,21 +1903,25 @@ const MODEL_PRICE_ROWS = [
 	{
 		id: "grok-4.7",
 		rates: [
-			1.2,
-			3.6,
-			.3
+			2,
+			6,
+			.5
 		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		},
 		contextTiers: [{
 			"maxContext": 2e5,
 			"rates": [
-				1.2,
-				3.6,
-				.3
+				2,
+				6,
+				.5
 			]
 		}, { "rates": [
-			2.4,
-			7.2,
-			.6
+			4,
+			12,
+			1
 		] }]
 	},
 	{
@@ -1448,7 +1930,11 @@ const MODEL_PRICE_ROWS = [
 			1,
 			4.05,
 			.17
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "inkling-small",
@@ -1456,7 +1942,11 @@ const MODEL_PRICE_ROWS = [
 			.5,
 			1.2,
 			.1
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "kimi-k2.5",
@@ -1464,7 +1954,11 @@ const MODEL_PRICE_ROWS = [
 			.6,
 			3,
 			.1
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "kimi-k2.6",
@@ -1472,7 +1966,11 @@ const MODEL_PRICE_ROWS = [
 			.95,
 			4,
 			.16
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "kimi-k2.7-code",
@@ -1480,7 +1978,11 @@ const MODEL_PRICE_ROWS = [
 			.95,
 			4,
 			.19
-		]
+		],
+		allowance: {
+			goat: 60,
+			pro: 70
+		}
 	},
 	{
 		id: "kimi-k2.7-code-highspeed",
@@ -1488,7 +1990,11 @@ const MODEL_PRICE_ROWS = [
 			1.9,
 			8,
 			.38
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "kimi-k3",
@@ -1496,7 +2002,11 @@ const MODEL_PRICE_ROWS = [
 			3,
 			15,
 			.3
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "longcat-2.0",
@@ -1504,7 +2014,11 @@ const MODEL_PRICE_ROWS = [
 			.3,
 			1.2,
 			.006
-		]
+		],
+		allowance: {
+			goat: 50,
+			pro: 60
+		}
 	},
 	{
 		id: "mimo-v2.5",
@@ -1512,7 +2026,16 @@ const MODEL_PRICE_ROWS = [
 			.14,
 			.28,
 			.0028
-		]
+		],
+		listRates: [
+			.8,
+			4,
+			.16
+		],
+		allowance: {
+			goat: 30,
+			pro: 40
+		}
 	},
 	{
 		id: "mimo-v2.5-pro",
@@ -1520,7 +2043,16 @@ const MODEL_PRICE_ROWS = [
 			.435,
 			.87,
 			.0036
-		]
+		],
+		listRates: [
+			2,
+			6,
+			.4
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "mimo-v2.6-flash",
@@ -1528,7 +2060,11 @@ const MODEL_PRICE_ROWS = [
 			.14,
 			.28,
 			.0028
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "mimo-v2.6-pro",
@@ -1536,7 +2072,11 @@ const MODEL_PRICE_ROWS = [
 			.435,
 			.87,
 			.0036
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "mimo-v2.6-pro-ultraspeed",
@@ -1544,7 +2084,11 @@ const MODEL_PRICE_ROWS = [
 			4.35,
 			8.7,
 			.036
-		]
+		],
+		allowance: {
+			goat: 10,
+			pro: 20
+		}
 	},
 	{
 		id: "minimax-m2.5",
@@ -1552,7 +2096,11 @@ const MODEL_PRICE_ROWS = [
 			.3,
 			1.2,
 			.03
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "minimax-m2.7",
@@ -1560,7 +2108,11 @@ const MODEL_PRICE_ROWS = [
 			.3,
 			1.2,
 			.06
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "minimax-m3",
@@ -1568,7 +2120,16 @@ const MODEL_PRICE_ROWS = [
 			.3,
 			1.2,
 			.06
-		]
+		],
+		listRates: [
+			.6,
+			2.4,
+			.12
+		],
+		allowance: {
+			goat: 47,
+			pro: 57
+		}
 	},
 	{
 		id: "muse-spark-1.1",
@@ -1576,7 +2137,11 @@ const MODEL_PRICE_ROWS = [
 			1.25,
 			4.25,
 			.15
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 20
+		}
 	},
 	{
 		id: "muse-spark-1.2",
@@ -1584,7 +2149,11 @@ const MODEL_PRICE_ROWS = [
 			1.25,
 			4.25,
 			.15
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "muse-spark-1.2-contributor",
@@ -1592,7 +2161,11 @@ const MODEL_PRICE_ROWS = [
 			.1,
 			.2,
 			.002
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "muse-spark-1.3",
@@ -1600,7 +2173,11 @@ const MODEL_PRICE_ROWS = [
 			1.25,
 			4.25,
 			.15
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "muse-spark-1.3-contributor",
@@ -1608,7 +2185,11 @@ const MODEL_PRICE_ROWS = [
 			.1,
 			.2,
 			.002
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "nemotron-3-ultra",
@@ -1616,7 +2197,11 @@ const MODEL_PRICE_ROWS = [
 			.6,
 			2.4,
 			.12
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "qwen-3.6-max",
@@ -1625,7 +2210,11 @@ const MODEL_PRICE_ROWS = [
 			7.8,
 			.26,
 			1.63
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "qwen-3.6-plus",
@@ -1634,6 +2223,10 @@ const MODEL_PRICE_ROWS = [
 			3,
 			.1
 		],
+		allowance: {
+			goat: 33,
+			pro: 43
+		},
 		contextTiers: [{
 			"maxContext": 256e3,
 			"rates": [
@@ -1655,6 +2248,10 @@ const MODEL_PRICE_ROWS = [
 			.006,
 			.038
 		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		},
 		contextTiers: [
 			{
 				"maxContext": 32e3,
@@ -1689,7 +2286,11 @@ const MODEL_PRICE_ROWS = [
 			7.5,
 			.5,
 			3.13
-		]
+		],
+		allowance: {
+			goat: 33,
+			pro: 43
+		}
 	},
 	{
 		id: "qwen-3.7-plus",
@@ -1699,6 +2300,10 @@ const MODEL_PRICE_ROWS = [
 			.08,
 			.5
 		],
+		allowance: {
+			goat: 33,
+			pro: 43
+		},
 		contextTiers: [{
 			"maxContext": 256e3,
 			"rates": [
@@ -1720,7 +2325,11 @@ const MODEL_PRICE_ROWS = [
 			.4,
 			3,
 			.04
-		]
+		],
+		allowance: {
+			goat: 70,
+			pro: 80
+		}
 	},
 	{
 		id: "qwen-3.8-flash",
@@ -1728,7 +2337,11 @@ const MODEL_PRICE_ROWS = [
 			.16,
 			.47,
 			.016
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "qwen-3.8-max",
@@ -1737,7 +2350,11 @@ const MODEL_PRICE_ROWS = [
 			6,
 			.25,
 			2.5
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "qwen-3.8-max-0902",
@@ -1745,7 +2362,11 @@ const MODEL_PRICE_ROWS = [
 			2,
 			6,
 			.25
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "qwen-3.8-omni-flash",
@@ -1753,7 +2374,11 @@ const MODEL_PRICE_ROWS = [
 			.15,
 			.47,
 			.016
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "step-3.5-flash",
@@ -1761,7 +2386,11 @@ const MODEL_PRICE_ROWS = [
 			.09,
 			.3,
 			.02
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "step-3.7-flash",
@@ -1769,7 +2398,11 @@ const MODEL_PRICE_ROWS = [
 			.2,
 			1.15,
 			.04
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "step-5-preview",
@@ -1777,7 +2410,11 @@ const MODEL_PRICE_ROWS = [
 			1,
 			2.7,
 			.05
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "tencent/hy3-paid",
@@ -1785,7 +2422,11 @@ const MODEL_PRICE_ROWS = [
 			.14,
 			.58,
 			.035
-		]
+		],
+		allowance: {
+			goat: 70,
+			pro: 80
+		}
 	},
 	{
 		id: "tencent/hy4-preview",
@@ -1793,7 +2434,11 @@ const MODEL_PRICE_ROWS = [
 			.834,
 			2.501,
 			.042
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	},
 	{
 		id: "typesafe/jev",
@@ -1801,7 +2446,11 @@ const MODEL_PRICE_ROWS = [
 			.042,
 			0,
 			0
-		]
+		],
+		allowance: {
+			goat: 20,
+			pro: 30
+		}
 	}
 ];
 /**
@@ -1854,16 +2503,23 @@ function ratesOf(values) {
 	if (values[3] !== void 0) rates.cacheWriteCost = values[3];
 	return rates;
 }
-/** Build the full price row the browser prices a session with. */
-function wireRow(id, slug, row) {
+/**
+* Build the full price row the browser prices a session with.
+*
+* Every figure switches together: once the deal stops being live, the base
+* rates AND each context band come from the pre-discount set, so a session
+* priced after a promotion ends can never mix the two.
+*/
+function wireRow(id, slug, row, now) {
+	const promotional = dealLabel(id, now) !== void 0;
 	const price = {
 		id,
 		slug,
-		...ratesOf(row.rates)
+		...ratesOf(promotional ? row.rates : row.listRates ?? row.rates)
 	};
 	if (row.peak !== void 0) price.peak = ratesOf(row.peak);
 	if (row.contextTiers !== void 0) price.contextTiers = row.contextTiers.map((tier) => ({
-		...ratesOf(tier.rates),
+		...ratesOf(promotional ? tier.rates : tier.listRates ?? tier.rates),
 		...tier.maxContext === void 0 ? {} : { maxContext: tier.maxContext }
 	}));
 	return price;
@@ -1878,8 +2534,13 @@ function wireRow(id, slug, row) {
 * explicitly at zero so the composer can say so instead of showing nothing; the
 * peak windows travel with the table so the browser applies the very schedule
 * this snapshot knows instead of restating it.
+*
+* `now` (defaults to `Date.now()`) resolves lapsed promotions: a discounted row
+* whose `expiresAt` has passed is served at its pre-discount `listRates`, the
+* same instant {@link dealLabel} stops showing its badge. The table is rebuilt
+* per request, so that switch needs no redeploy.
 */
-function modelPriceTable() {
+function modelPriceTable(now = Date.now()) {
 	const bySlug = new Map(MODEL_PRICE_ROWS.map((row) => [row.id, row]));
 	const known = new Set(bySlug.keys());
 	const models = [];
@@ -1901,86 +2562,56 @@ function modelPriceTable() {
 		const row = bySlug.get(slug);
 		if (row === void 0) continue;
 		claimed.add(slug);
-		models.push(wireRow(catalogId, slug, row));
+		models.push(wireRow(catalogId, slug, row, now));
 	}
 	for (const row of MODEL_PRICE_ROWS) {
 		if (claimed.has(row.id)) continue;
-		models.push(wireRow(row.id, row.id, row));
+		models.push(wireRow(row.id, row.id, row, now));
 	}
 	return {
 		models,
 		peakHours: PEAK_HOUR_RANGES.map(([start, end]) => [start, end])
 	};
 }
-//#endregion
-//#region src/cost-facts.ts
-const zeroCostTokens = () => ({
-	uncachedInputTokens: 0,
-	outputTokens: 0,
-	cacheReadTokens: 0,
-	cacheWriteTokens: 0
-});
-const COST_TOKEN_KEYS = [
-	"uncachedInputTokens",
-	"outputTokens",
-	"cacheReadTokens",
-	"cacheWriteTokens"
-];
-function peakHour(at, windows) {
-	const time = new Date(at);
-	return time.getUTCDay() !== 0 && time.getUTCDay() !== 6 && windows.some(([start, end]) => time.getUTCHours() >= start && time.getUTCHours() < end);
-}
+/** Slug-keyed view of the rows, built once: neither table nor allowance mutates. */
+const ROWS_BY_SLUG = new Map(MODEL_PRICE_ROWS.map((row) => [row.id, row]));
+const KNOWN_SLUGS = new Set(ROWS_BY_SLUG.keys());
 /**
-* All prompt billing buckets determine a request's band, never cumulative
-* session input.
+* The per-model monthly allowance for a CATALOG model id, or undefined when the
+* page carries none (a model without a price row, or the free stealth previews
+* the estimator array omits).
 *
-* A tiered model returns the matching band and does NOT then apply `peak`: the
-* page publishes those two dimensions independently and no row carries both
-* today, so the combination becoming real is visible before it reaches a user.
-* This ordering is a latent choice, not a verified upstream rule.
-*/
-function requestRates(price, at, contextTokens, table) {
-	const tier = price.contextTiers?.find((tier) => tier.maxContext === void 0 || contextTokens <= tier.maxContext);
-	if (tier !== void 0) return tier;
-	return price.peak !== void 0 && at !== null && peakHour(at, table.peakHours) ? price.peak : price;
+* Resolution rides the same slug rules as the price table, so
+* `MiniMaxAI/MiniMax-M3` finds the row the page files under `minimax-m3` — the
+* settings page must not grow a second mapping that can drift from this one.
+* The settings page asks for a model only while rendering a list it already
+* has, so this stays a pure lookup with no clock: an allowance is not
+* time-dependent (a plan's figure does not lapse the way a promotional rate
+* does; when the page re-prices it, the next sync carries it).
+*/
+function modelAllowanceFor(modelId) {
+	const slug = priceSlugFor(modelId, KNOWN_SLUGS);
+	if (slug === void 0) return void 0;
+	return ROWS_BY_SLUG.get(slug)?.allowance;
+}
+//#endregion
+//#region src/wire-guards.ts
+/** Non-throwing value guards for untrusted provider payloads. */
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-/** Cache version and wire guard: changing bands/rates must refold historical groups. */
-function pricingKey(table) {
-	const rates = (r) => [
-		r.inputCost,
-		r.outputCost,
-		r.cacheReadCost,
-		r.cacheWriteCost ?? null
-	];
-	const canonical = JSON.stringify([
-		"commandCodeCost-v1",
-		table.peakHours,
-		table.models.map((p) => [
-			p.id,
-			p.slug,
-			p.free === true,
-			rates(p),
-			p.peak ? rates(p.peak) : null,
-			p.contextTiers?.map((t) => [t.maxContext ?? null, rates(t)]) ?? null
-		])
-	]);
-	let hash = 2166136261;
-	for (const c of canonical) hash = Math.imul(hash ^ c.charCodeAt(0), 16777619) >>> 0;
-	return hash;
+function stringValue(value) {
+	return typeof value === "string" ? value : void 0;
 }
-/** Only safe to merge requests whose billing classification is identical. */
-function costGroupKey(group, table) {
-	const price = table.models.find((p) => p.id === group.model || p.slug === group.model);
-	return JSON.stringify([
-		group.provider,
-		group.model,
-		price === void 0 ? null : requestRates(price, group.at, group.contextTokens, table),
-		group.at === null
-	]);
+function numberValue(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function booleanValue(value) {
+	return typeof value === "boolean" ? value : void 0;
 }
 //#endregion
 //#region src/cost-projection.ts
-const record$2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? v : void 0;
+const record$2 = (v) => isRecord(v) ? v : void 0;
 const finite = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
 function tokensOf(value) {
 	const u = record$2(value);
@@ -2069,11 +2700,18 @@ function createCostProjection(table = modelPriceTable()) {
 				...g,
 				tokens: { ...g.tokens }
 			}));
+			const byKey = /* @__PURE__ */ new Map();
+			groups.forEach((g, i) => {
+				const key = costGroupKey(g, table);
+				if (!byKey.has(key)) byKey.set(key, i);
+			});
+			const groupKey = costGroupKey(group, table);
 			if (previous) {
-				const old = groups.find((g) => costGroupKey(g, table) === costGroupKey(previous, table));
-				if (old) for (const k of COST_TOKEN_KEYS) old.tokens[k] -= previous.tokens[k];
+				const old = byKey.get(costGroupKey(previous, table));
+				if (old !== void 0) for (const k of COST_TOKEN_KEYS) groups[old].tokens[k] -= previous.tokens[k];
 			}
-			let target = groups.find((g) => costGroupKey(g, table) === costGroupKey(group, table));
+			const targetIdx = byKey.get(groupKey);
+			let target = targetIdx === void 0 ? void 0 : groups[targetIdx];
 			if (!target) {
 				target = {
 					...group,
@@ -2122,6 +2760,27 @@ function installCostProjection(ctx) {
 * JSON, SSE, and pre-stream error bodies undecoded.
 */
 const IDENTITY_ENCODING_HEADER = { "accept-encoding": "identity" };
+const THROTTLED_CODE = "THROTTLED";
+const boundedCodes = /* @__PURE__ */ new Set([
+	"EMPTY_RESPONSE",
+	"SERVER",
+	"TIMEOUT",
+	THROTTLED_CODE
+]);
+const counts$1 = /* @__PURE__ */ new WeakMap();
+function absorbTransientFailure(agent, code) {
+	if (!boundedCodes.has(code)) return "ignored";
+	const used = counts$1.get(agent) ?? 0;
+	if (used >= 3) return "exhausted";
+	counts$1.set(agent, used + 1);
+	return "retry";
+}
+function resetTransientFailures(agent) {
+	counts$1.delete(agent);
+}
+function transientBudgetMessage(code, message) {
+	return `Command Code 请求在 3 次自动重试后仍失败，已停止重试（${code}）。请稍后重新发送；若反复出现，请检查服务状态或请求耗时诊断。 原因：${message}`;
+}
 //#endregion
 //#region src/accounts.ts
 /**
@@ -2143,24 +2802,18 @@ const IDENTITY_ENCODING_HEADER = { "accept-encoding": "identity" };
 * @module dsh-commandcode-provider/accounts
 */
 /**
-* Upper bound on the retry wait this pool attaches to the all-exhausted
-* `RATE_LIMIT` error. Must equal the `backoff.maxDelayMs` in the adapter's
-* `providerRetryPolicy` (which imports it from here): dsh-llm-retry honors a
-* provider-specified wait verbatim only at or below that cap — a LONGER one
-* makes the executor abandon the retry instead of falling back to local backoff
-* (in normal mode), turning "poll until the window opens" into "fail now".
+* Upper bound on the retry wait attached to the all-exhausted `RATE_LIMIT`.
+* Must equal the adapter's `backoff.maxDelayMs`: dsh-llm-retry honors a
+* provider wait verbatim only at or below that cap — a longer one abandons the
+* retry instead of falling back to local backoff, turning "poll until the
+* window opens" into "fail now".
 */
 const RETRY_MAX_DELAY_MS = 9e5;
 /**
 * How long an explicitly selected account's rate-limit mark may stand before
-* its window is probed again.
-*
-* A 429 whose reset was never learned marks the key `unknown`, which
-* {@link accountUsable} refuses — for a key nobody asked for that is correct
-* (only the all-marked pass clears it, and it costs one billing call), but for
-* the user's own pinned account a single 429 would demote it until the process
-* restarts (issue #51). Once per interval per key bounds a probe endpoint that
-* keeps failing; a successful probe resolves the mark for good.
+* its window is probed again. Without this, a single 429 on the user's pinned
+* account demotes it until the process restarts (issue #51); probing at most
+* once per interval per key bounds a probe endpoint that keeps failing.
 */
 const EXPLICIT_ACCOUNT_PROBE_INTERVAL_MS = 6e4;
 /** A labeled, human-readable clock reading for error messages. */
@@ -2265,26 +2918,18 @@ var CommandCodeAccountPool = class {
 		return out;
 	}
 	/**
-	* Hand out the key for a request: the model-routed account when the request's
-	* model matches a rule (and that account is usable), else the manually
-	* preferred account when usable, else the first usable account in rotation
-	* order. Returns `undefined` when no account resolves any key at all, or when
-	* an account this request already used is still UNMARKED — that rejection is
-	* the honest answer, so the caller's own rejection surfaces as itself. Throws
-	* `RATE_LIMIT` (naming the earliest window reset) or `INVALID_CREDENTIAL`
-	* when accounts exist but every one of them is marked.
+	* Hand out the key for a request: the model-routed account when usable, else
+	* the manually preferred account when usable, else the first usable account
+	* in rotation order. Returns `undefined` when no account resolves any key,
+	* or when an account this request already used is still UNMARKED — the
+	* caller's own rejection is the honest answer then. Throws `RATE_LIMIT` /
+	* `INVALID_CREDENTIAL` when every account is marked.
 	*
-	* `options.model` is the request's model id; routing rules re-read per
-	* resolution, so a settings change applies live. `options.tried` lists the
-	* keys this request has already used — the just-rejected one included — and
-	* they are removed from the resolution entirely, which is what lets one
-	* request walk a four-account pool: a rejection that does not mark the key
-	* (no credits, a model outside the account's plan) would otherwise be offered
-	* again on every attempt and the accounts behind it never reached.
-	*
-	* An explicit selection (the pin or a model rule) that a rate-limit mark would
-	* demote is probed before the fallback serves, so "falls back while exhausted"
-	* never becomes "stays demoted until the process restarts" (issue #51).
+	* `options.tried` lists the keys this request already used; they are removed
+	* from the resolution entirely, which is what lets one request walk a
+	* four-account pool. An explicit selection (pin or model rule) that a
+	* rate-limit mark would demote is probed first, so a fallback never becomes
+	* permanent (issue #51). Rules re-read per resolution, so settings apply live.
 	*/
 	async resolveKey(options) {
 		const accounts = await this.resolvedAccounts();
@@ -2320,18 +2965,7 @@ var CommandCodeAccountPool = class {
 				this.states.delete(account.key);
 				return;
 			}
-			if (probe.resetAt > 0) this.states.set(account.key, {
-				kind: "cooldown",
-				cause: "window",
-				reason: account.state?.reason ?? "usage window exhausted (429)",
-				until: probe.resetAt
-			});
-			else if (account.state?.kind !== "cooldown") this.states.set(account.key, {
-				kind: "unknown",
-				cause: "window",
-				reason: account.state?.reason ?? "usage window exhausted (429)",
-				until: 0
-			});
+			this.stampWindowMark(account, probe);
 		}));
 		const latestAccounts = await this.resolvedAccounts();
 		const revived = selectActiveAccount(tried === void 0 || tried.length === 0 ? latestAccounts : latestAccounts.filter((account) => !tried.includes(account.key)), preferred);
@@ -2464,6 +3098,18 @@ var CommandCodeAccountPool = class {
 				state: void 0
 			};
 		}
+		this.stampWindowMark(account, probe);
+	}
+	/**
+	* Stamp a probe-read window onto one key. A known reset becomes a cooldown
+	* that expires by itself; without one the mark stays `unknown`, so a later
+	* probe can still learn it — and a mark that already carries a cooldown
+	* keeps it, never trading a known reset for an unknown one. The cause is
+	* `window` either way: a probe that read a window as exceeded IS window
+	* evidence, whatever the key was marked for. An `until: 0` cooldown would
+	* read as "never usable again" to {@link accountUsable}, so `unknown` it is.
+	*/
+	stampWindowMark(account, probe) {
 		if (probe.resetAt > 0) this.states.set(account.key, {
 			kind: "cooldown",
 			cause: "window",
@@ -2512,7 +3158,7 @@ var CommandCodeAccountPool = class {
 function allAccountsUnusable(accounts) {
 	if (accounts.filter((account) => account.state?.kind === "disabled").length === accounts.length) return new LlmError(`llm-commandcode: every configured Command Code account (${accounts.length}) was rejected with 401 — check the stored API keys (Models page / settings) or the auth file；已配置的 ${accounts.length} 个 Command Code 账户密钥均被拒绝（401）——请在设置页检查存储的 API 密钥，或重新运行 command-code login`, "INVALID_CREDENTIAL");
 	const windowMarked = accounts.map((account) => account.state).filter((state) => state !== void 0).filter((state) => state.cause === "window");
-	if (windowMarked.length === 0) return new LlmError(`llm-commandcode: all ${accounts.length} Command Code account(s) are rate limited (429) — the provider did not report an exhausted usage window; retrying；全部 ${accounts.length} 个 Command Code 账户被限流（429）——服务商未报告用量窗口用尽，正在重试`, "RATE_LIMIT");
+	if (windowMarked.length === 0) return new LlmError(`llm-commandcode: all ${accounts.length} Command Code account(s) are rate limited (429) — the provider did not report an exhausted usage window; retrying；全部 ${accounts.length} 个 Command Code 账户被限流（429）——服务商未报告用量窗口用尽，正在重试`, THROTTLED_CODE);
 	const resets = windowMarked.filter((state) => state.kind === "cooldown" && state.until > 0).map((state) => state.until);
 	const earliest = resets.length > 0 ? Math.min(...resets) : 0;
 	const wait = earliest > 0 ? Math.max(1e3, earliest - Date.now()) : 0;
@@ -2647,12 +3293,12 @@ function commandCodeImageTokens(modelId, width, height) {
 	return imageTokenCost(imageTokenFamily(modelId), width, height);
 }
 /**
-* Anthropic: the image is first scaled so its long edge is at most 1568 px
-* (never enlarged), then charged roughly one token per 750 pixels.
+* Anthropic: the image is first scaled to the request long edge (never
+* enlarged), then charged roughly one token per 750 pixels.
 * Source: Anthropic vision documentation, "Image size and token usage".
 */
 function anthropicImageTokens(width, height) {
-	const projected = longEdgeDimensions(width, height, 1568);
+	const projected = longEdgeDimensions(width, height, REQUEST_IMAGE_MAX_LONG_EDGE);
 	return Math.max(1, Math.ceil(projected.width * projected.height / 750));
 }
 /**
@@ -2933,6 +3579,95 @@ function openStreamTrace(scope, options = {}) {
 	};
 }
 //#endregion
+//#region src/request-timing.ts
+/** 请求耗时只记录阶段、计数和状态；不记录消息、凭据、请求头或错误正文。 */
+const REQUEST_TIMING_ENV = "DSH_COMMANDCODE_TIMING";
+/** 每次生成独立计时；可注入时钟验证顺序，不依赖真实等待。 */
+var RequestTiming = class {
+	sink;
+	now;
+	started;
+	summary;
+	constructor(model, sink, now = () => performance.now()) {
+		this.sink = sink;
+		this.now = now;
+		this.started = now();
+		this.summary = {
+			version: 1,
+			startedAt: Date.now(),
+			model,
+			outcome: "cancelled",
+			totalMs: 0,
+			phasesMs: {
+				credentials: 0,
+				images: 0,
+				body: 0,
+				serialization: 0,
+				headers: 0
+			},
+			attempts: []
+		};
+	}
+	/** 返回结束函数，确保成功和异常都计入同一阶段。阶段可嵌套，不能直接相加。 */
+	phase(name) {
+		if (!this.sink) return () => {};
+		const start = this.now();
+		return () => {
+			this.summary.phasesMs[name] += this.now() - start;
+		};
+	}
+	attempt(protocol, bodyBytes) {
+		if (!this.sink) return () => {};
+		const start = this.now();
+		const attempt = {
+			protocol,
+			bodyBytes,
+			headersMs: 0
+		};
+		this.summary.attempts.push(attempt);
+		return (status) => {
+			Object.assign(attempt, {
+				headersMs: this.now() - start,
+				...status === void 0 ? {} : { status }
+			});
+			this.summary.phasesMs.headers += attempt.headersMs;
+		};
+	}
+	first(kind) {
+		if (this.sink && this.summary[kind] === void 0) this.summary[kind] = this.now() - this.started;
+	}
+	async close(outcome, errorCode) {
+		if (!this.sink) return;
+		this.summary.outcome = outcome;
+		this.summary.totalMs = this.now() - this.started;
+		if (errorCode !== void 0) this.summary.errorCode = errorCode;
+		try {
+			await this.sink(this.summary);
+		} catch {}
+	}
+};
+/** 与原始流诊断独立开关，便于仅收集数值耗时。 */
+function openRequestTiming(model, sink) {
+	if (sink) return new RequestTiming(model, sink);
+	const raw = process.env[REQUEST_TIMING_ENV]?.trim();
+	if (!raw || [
+		"0",
+		"false",
+		"no",
+		"off"
+	].includes(raw.toLowerCase())) return new RequestTiming(model);
+	const path = [
+		"1",
+		"true",
+		"yes",
+		"on"
+	].includes(raw.toLowerCase()) ? join(tmpdir(), "dsh-commandcode-timing.jsonl") : raw;
+	return new RequestTiming(model, async (summary) => {
+		await mkdir(dirname(path), { recursive: true });
+		await appendFile(path, `${JSON.stringify(summary)}\n`, { mode: 384 });
+	});
+}
+//#endregion
 //#region src/adapter.ts
 /**
 * DeepSeek Harness LLM adapter for the Command Code Provider API.
@@ -2941,21 +3676,151 @@ function openStreamTrace(scope, options = {}) {
 * community-maintained integration; you need your own Command Code account
 * and API key or subscription, and Command Code's terms apply.
 *
-* Owns the two chat transports (`/alpha/generate`, `/provider/v1/chat/completions`),
+* Owns the three chat transports (`/alpha/generate`, `/provider/v1/chat/completions`,
+* `/provider/v1/messages`),
 * message conversion, SSE/JSONL parsing, the catalog + its on-disk cache, and
 * the pre-stream account rotation loop. The wire protocol is
-* reverse-engineered (command-code@1.28.4, re-verified through 1.66.0);
-* AGENTS.md holds the full protocol record.
+* reverse-engineered (command-code@1.28.4, re-verified through 1.72.1);
+* docs/agent-reference/adapter-protocol.md holds the full protocol record.
 *
 * The adapter is deliberately free of cordis/schemastery: it receives a
 * per-request options thunk and an API-key resolver from the plugin entry
 * (src/index.ts), so a settings change reaches the very next request.
 */
-const COMMAND_CODE_CLI_VERSION = "1.66.0";
+/**
+* Output ceilings the endpoint has named in a live rejection, per model.
+*
+* The snapshot in ./capabilities.ts carries the vendor-published ceiling for
+* 74 of the 84 catalog models (see scripts/sync-output-limits.mjs). The other
+* 10 are models no vendor publishes yet, and a gateway is free to sit below
+* the vendor figure even where one exists — so this map is the correction
+* channel, not a fallback of last resort: the endpoint states the model's own
+* ceiling in its rejection, so one wasted round trip is enough to know it for
+* the rest of the process.
+*
+* Shared by adapters for the same gateway, but not across apiBase values: a
+* proxy can enforce a smaller ceiling for the same model id. Only ever tightens
+* within that gateway, so a stale catalog row cannot undo a live refusal.
+*/
+const learnedOutputLimits = /* @__PURE__ */ new Map();
+/**
+* Output ceilings the CATALOG published, per model.
+*
+* `/provider/v1/models` carries `max_output_tokens` in its schema and the
+* official pi provider already prefers it, but the endpoint does not send it
+* yet — so this is empty today and fills in on its own the day it does. It sits
+* above the models.dev snapshot and below what a live rejection proved, because
+* that ordering is also the order of trust: the gateway knows its own ceiling,
+* a rejection proves it, and models.dev is a third party describing the same
+* model. Restored from the on-disk catalog cache so a published ceiling
+* survives a restart without waiting for the next catalog fetch.
+*/
+const publishedOutputLimits = /* @__PURE__ */ new Map();
+/** Keep model facts from one gateway from constraining another gateway. */
+function outputLimitsFor(store, apiBase) {
+	let limits = store.get(apiBase);
+	if (limits === void 0) {
+		limits = /* @__PURE__ */ new Map();
+		store.set(apiBase, limits);
+	}
+	return limits;
+}
+/**
+* The output ceiling this gateway route sends for `modelId`.
+*
+* `/provider/v1/models` publishes `context_length` and `supported_endpoints`
+* but no output cap today, while each endpoint refuses a larger `max_tokens` per
+* model — the Messages endpoint names its own in the rejection (`max_tokens:
+* 200000 > 128000, which is the maximum allowed number of output tokens for
+* claude-sonnet-5-5`). What the endpoint has already named wins, then the
+* catalog's own figure once it publishes one, then the snapshot, then — for
+* the Messages-route models only — the conservative value, because the ceilings
+* actually observed are below the global default and assuming otherwise would
+* fail every request.
+*/
+function modelOutputTokenLimit(apiBase, modelId) {
+	const learned = outputLimitsFor(learnedOutputLimits, apiBase).get(modelId);
+	const known = outputLimitsFor(publishedOutputLimits, apiBase).get(modelId) ?? MODEL_OUTPUT_TOKEN_LIMITS.get(modelId);
+	if (learned !== void 0 && (known === void 0 || learned < known)) return learned;
+	if (known !== void 0) return known;
+	return requiresMessagesEndpoint(modelId) ? DEFAULT_MESSAGES_MAX_TOKENS : DEFAULT_MAX_OUTPUT_TOKENS;
+}
+/**
+* Record a ceiling the endpoint just stated, if it is one this route can act
+* on: a real number, and one below what the next request would otherwise send.
+* A ceiling at or above the current budget describes a request that was not
+* refused for being too large, and acting on it would be a guess.
+*/
+function noteOutputCeiling(apiBase, modelId, ceiling) {
+	if (!Number.isSafeInteger(ceiling) || ceiling <= 0) return false;
+	if (ceiling >= modelOutputTokenLimit(apiBase, modelId)) return false;
+	outputLimitsFor(learnedOutputLimits, apiBase).set(modelId, ceiling);
+	return true;
+}
+/**
+* The ceiling to retry this turn with, when `error` is a request-side output
+* refusal the route can act on — else undefined, meaning surface it.
+*
+* Read from the message, so it covers both shapes the same refusal arrives in:
+* an HTTP 400 (`PROVIDER_HTTP_ERROR`) and an in-stream error frame
+* (`PROVIDER_STREAM_ERROR`). Both carry the endpoint's wording, and both are
+* already classified as output refusals rather than context overflows by the
+* time they reach here.
+*
+* Recording is what makes the retry pay off: the ceiling is kept for this
+* gateway and model, so a refused turn leaves its next request correct.
+*/
+function outputCeilingRefusal(apiBase, modelId, error) {
+	if (!(error instanceof LlmError)) return void 0;
+	const detail = error.message;
+	if (!OUTPUT_LIMIT_REJECTION.test(detail)) return void 0;
+	const stated = parseOutputCeiling(detail);
+	if (stated === void 0) return void 0;
+	return noteOutputCeiling(apiBase, modelId, stated) ? stated : void 0;
+}
+/** Keep the two user-facing languages and error metadata together. */
+function bilingual(code, en, zh, options) {
+	return new LlmError(`${en}；${zh}`, code, options);
+}
+const COMMAND_CODE_CLI_VERSION = "1.72.1";
 const DEFAULT_API_BASE = "https://api.commandcode.ai";
-const DEFAULT_GENERATE_MAX_TOKENS = 64e3;
-const DEFAULT_MAX_OUTPUT_TOKENS = 65536;
+/**
+* The output budget this bundle asks for, and the ceiling it will never exceed.
+*
+* 131 072, chosen against a measured provider limit rather than a round guess.
+* Probing `/alpha/generate` directly on 2026-09-28: 64 000 → 200, 131 072 → 200,
+* 196 608 → 200, **200 000 → 200, 200 704 → 400**, 1 000 000 → 400. The server
+* therefore caps `max_tokens` at 200 000, and it does so identically for a
+* 262 144-window model (`stealth/pixel-canary`) and a 1 000 000-window one
+* (`stealth/space-bunny-alpha`) — the cap is global, not per model. 131 072
+* keeps a 35 % margin under it while covering the real output ceiling of the
+* models that have one (Claude 64 K, Gemini 64 K, several at 128 K).
+*
+* The old 64 000 was never a provider requirement: it cost nothing in latency
+* (a 64 000 request answered headers in 1.28 s against 1.57 s for 131 072) but
+* it did cap what a model could ever say in one turn.
+*
+* This is only an UPPER bound. `requestContextBudget` lowers it per request
+* from the prompt actually being sent, so raising the ceiling cannot push a
+* large session over its window.
+*/
+const DEFAULT_GENERATE_MAX_TOKENS = 131072;
+/**
+* The fallback when the catalog carries no output ceiling for a model.
+*
+* `/provider/v1/models` publishes only `context_length` — no output limit — so
+* the catalog cannot learn one per model and derives a stand-in from the
+* window instead. Kept equal to {@link DEFAULT_GENERATE_MAX_TOKENS} on purpose:
+* a lower value here would silently re-cap every request through
+* `Math.min(contextLength, this)` before the ceiling above is ever consulted.
+*/
+const DEFAULT_MAX_OUTPUT_TOKENS = 131072;
+/** Preserve a small usable answer budget when the heuristic overshoots. */
+const MIN_CONTEXT_OUTPUT_TOKENS = 1024;
 const MODELS_TIMEOUT_MS = 1e4;
+/** 目录短期复用；刷新失败只短暂退避，避免反复阻塞模型选择器。 */
+const MODEL_CATALOG_TTL_MS = 3e5;
+const MODEL_CATALOG_RETRY_MS = 1e4;
 /** How long the picker's plan-filter billing facts stay cached before refetching. */
 const BILLING_ACCESS_TTL_MS = 3e5;
 /** The entry-plan tier weight (`individual-go` in KNOWN_SUBSCRIPTION_PLANS). */
@@ -2971,19 +3836,70 @@ const ACTIVE_SUBSCRIPTION_STATUSES = /* @__PURE__ */ new Set([
 	"trialing",
 	"past_due"
 ]);
-/** Head-of-request timeout: how long to wait for the first response byte. */
-const DEFAULT_REQUEST_TIMEOUT_MS = 6e4;
+/**
+* Head-of-request timeout: how long to wait for the first response byte.
+*
+* 300 s, and that number is the official CLI's, not a round choice. Decompiled
+* from `command-code@1.66.0`: its `createNodeTransport` fetch passes only the
+* caller's `signal` and sets no timeout at all, so the model request inherits
+* Node/undici's own default — measured at 301.0 s against a local server that
+* accepts the connection and never sends headers. The previous 60 s default was
+* five times stricter than the CLI it emulates, and being stricter only ever
+* costs legitimate requests: a slow upstream first token on the Provider API
+* route can outlast 60 s, and the official CLI simply waits it out. Measured
+* headers (2026-09-28, 26 250-token prompt, `max_tokens: 16` to separate the
+* header from the generation): `/alpha/generate` 2.12 / 2.56 / 2.75 s,
+* `/provider/v1/chat/completions` 5.52 / 2.98 / 3.70 s — a ~1.1 s median gap
+* with the Provider API route varying over a 2.5 s span against the CLI route's
+* 0.6 s. A gateway that is genuinely dead now takes longer to name itself,
+* which is what the consecutive-timeout streak exists to bound (three
+* attempts, then a diagnosis instead of another re-send).
+*/
+const DEFAULT_REQUEST_TIMEOUT_MS = 3e5;
 /** Stream idle timeout: a generation that stalls this long is a dead connection. */
 const DEFAULT_STREAM_IDLE_TIMEOUT_MS = 3e5;
-const MODEL_CACHE_VERSION = 1;
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function stringValue(value) {
-	return typeof value === "string" ? value : void 0;
-}
-function numberValue(value) {
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+/** Version 3 binds cached catalog facts to their gateway; older files lack a safe source. */
+const MODEL_CACHE_VERSION = 3;
+/**
+* A lone UTF-16 surrogate half: a high surrogate not followed by a low one, or
+* a low surrogate not preceded by a high one. Such a half is not a character —
+* it only arises from a truncated slice, a lossy decode, or a lone `\uD83D`
+* escape — and it survives `JSON.stringify` as an escape (`"\ud83d"`) rather
+* than failing locally, so the request leaves the process carrying a string no
+* UTF-8 consumer can round-trip. Providers running strict decoders reject it.
+*
+* This is the same expression `@earendil-works/pi-ai` applies to every outgoing
+* string on this endpoint. Valid astral characters (emoji and anything else
+* outside the BMP) are PAIRED surrogates and pass through untouched.
+*/
+const LONE_SURROGATE_PATTERN = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
+/**
+* A cheap pre-test for "this string contains any surrogate code unit at all",
+* paired or not. The exact pattern above needs lookaround, which V8 cannot
+* optimize into a fast scan; this one is a plain range test. Real prompts are
+* overwhelmingly ASCII-plus-CJK with no surrogates, so the common case pays one
+* linear scan instead of the lookaround pass. Measured on a 412 KB request
+* body: 1.40 ms with the exact pattern alone against 0.77 ms with this gate,
+* where a bare `JSON.stringify` is 0.59 ms.
+*/
+const ANY_SURROGATE_PATTERN = /[\uD800-\uDFFF]/;
+/**
+* Drop lone surrogate halves from one outgoing string.
+*
+* Applied at the single point a request body is serialized, so every field of
+* every transport is covered — system text, message content, tool schemas and
+* tool results alike — instead of enumerating the fields that can carry text
+* and missing one. The value is returned unchanged whenever it holds no
+* surrogate at all, which is the ordinary case.
+*
+* The `test()` call deliberately uses the flagless {@link ANY_SURROGATE_PATTERN}:
+* a global regex is stateful, so testing with one would advance `lastIndex` and
+* make consecutive calls on the same string alternate between true and false.
+* `replace()` resets `lastIndex` itself, so the global pattern is safe there.
+*/
+function sanitizeSurrogates(value) {
+	if (typeof value !== "string") return value;
+	return ANY_SURROGATE_PATTERN.test(value) ? value.replace(LONE_SURROGATE_PATTERN, "") : value;
 }
 /** Hash one request value without retaining or logging its contents. */
 function fingerprintValue(value) {
@@ -3076,9 +3992,6 @@ function failureWithRequestId(error, metadata) {
 		...error.cause === void 0 ? {} : { cause: error.cause }
 	});
 }
-function booleanValue(value) {
-	return typeof value === "boolean" ? value : void 0;
-}
 /**
 * Thinking text carried by an OpenRouter-shaped `reasoning_details` array,
 * concatenated in the order the gateway sent it.
@@ -3160,6 +4073,109 @@ const CLI_CONTEXT_OVERFLOW_PATTERN = /prompt is too long|context.*(length|window
 function isContextOverflowDetail(detail) {
 	return isContextWindowExceededError(detail) || CLI_CONTEXT_OVERFLOW_PATTERN.test(detail);
 }
+/** A gateway refusal observed for an over-reserved request, but not unique to that cause. */
+const AMBIGUOUS_SIZE_REJECTION = /\bmodel could not complete the request\b/i;
+/**
+* A request-side `max_tokens` refusal, told apart from a context overflow that
+* mentions the same field. Kept narrow on purpose: the overflow pattern also
+* matches a bare `max_tokens`, so this must name the specific shapes the
+* endpoint uses — a ceiling comparison, its prose about output tokens, or a
+* request-validation error on the field.
+*/
+const OUTPUT_LIMIT_REJECTION = new RegExp([
+	"max_tokens:\\s*\\d+\\s*>\\s*\\d+",
+	"maximum allowed number of output tokens",
+	"invalid input[^\\n]*max_tokens",
+	"expected number[^\\n]*at max_tokens"
+].join("|"), "i");
+/**
+* The output ceiling the endpoint states in a `max_tokens` refusal, read off
+* its own comparison: `max_tokens: 131072 > 128000` yields 128000.
+*
+* Only the comparison form is parsed. The other shapes
+* {@link OUTPUT_LIMIT_REJECTION} matches — a bare validation error, or the
+* prose without the numbers — name no ceiling, and guessing one would be worse
+* than failing: a fabricated value is indistinguishable from a real one at the
+* point where it decides the next request's budget.
+*/
+function parseOutputCeiling(detail) {
+	const stated = /max_tokens:\s*\d+\s*>\s*(\d+)/i.exec(detail)?.[1];
+	if (stated === void 0) return void 0;
+	const ceiling = Number(stated);
+	return Number.isSafeInteger(ceiling) && ceiling > 0 ? ceiling : void 0;
+}
+/**
+* The advice floor for a Provider-API timeout: doubling a 60 s budget is still
+* short for a slow upstream first token, so the suggestion never goes below 5
+* minutes. Capped by `RETRY_MAX_DELAY_MS` rather than the schema's timer
+* ceiling on purpose — a single header wait that outlasts the whole retry
+* backoff is not a budget, and clamping to the engine constant would also pull
+* a runtime dependency into the bundle.
+*/
+const MIN_SUGGESTED_TIMEOUT_MS = 3e5;
+/**
+* Why one attempt saw no response headers, and what the user can do about it.
+*
+* The TRANSPORT is the reliable signal; the request size is not — and the
+* mechanism is read straight out of the official CLI rather than inferred from
+* a timing. `createNodeTransport` passes only the caller's `signal` and sets no
+* timeout, so the two routes differ in WHO answers the headers:
+* `/alpha/generate` has the gateway answer them before the model starts, while
+* `/provider/v1/chat/completions` cannot answer until its upstream emits a
+* first token, so whatever that upstream is doing is charged to the header
+* wait. Measured 2026-09-28 (26 250-token prompt, `max_tokens: 16`):
+* `/alpha/generate` 2.12 / 2.56 / 2.75 s, `/provider/v1/chat/completions`
+* 5.52 / 2.98 / 3.70 s — a ~1.1 s median gap, with the Provider API route
+* swinging across 2.5 s where the CLI route moved 0.6 s. A larger prompt moves
+* neither, which is why an earlier draft that branched on a 1 MiB body
+* threshold was wrong: size is not the variable here. Only the route decides.
+*
+* @param protocol - the transport the attempt used.
+* @param timeoutMs - the header budget that just expired.
+*/
+function headersTimeoutAdvice(protocol, timeoutMs) {
+	if (protocol === "openai") return {
+		cause: "upstream-first-token",
+		suggestionMs: Math.min(RETRY_MAX_DELAY_MS, Math.max(timeoutMs * 2, MIN_SUGGESTED_TIMEOUT_MS))
+	};
+	return { cause: "gateway" };
+}
+/**
+* How many consecutive header timeouts on ONE unchanged payload stop being a
+* blip. The retry policy whitelists `TIMEOUT` with `maxRetries: 1000` and a
+* 500 ms → 15 min backoff, which is right for a provider that says when to
+* come back but wrong for a gateway that simply never answers: the reporter
+* saw the identical multi-megabyte body re-sent for hours (issue #67) instead
+* of a diagnosis. Three is where a 60 s budget has already spent three
+* minutes waiting, so the cost of being wrong is bounded and the user gets an
+* answer either way.
+*/
+const MAX_CONSECUTIVE_HEADER_TIMEOUTS = 3;
+/** Streak key for a session-less call, so those keep the old single-slot semantics instead of never escalating. */
+const GLOBAL_HEADER_TIMEOUT_KEY = "\0global";
+/** UTF-8 byte length, computed only on the timeout path so a large body is encoded once, not per attempt. */
+function utf8ByteLength(text) {
+	return new TextEncoder().encode(text).length;
+}
+/**
+* The thrown headers timeout, worded for the cause it actually has.
+*
+* Every earlier version of this message said "通常是网络或代理问题" for both
+* transports, which is actively wrong for a large `/provider/v1/chat/completions`
+* prompt: there the model simply needs longer than any budget, and a user sent
+* to check their proxy never finds anything. The code stays `TIMEOUT` (still
+* retryable) in both branches — only the diagnosis and the advice change.
+*/
+function headersTimeoutError(input) {
+	const { protocol, endpoint, timeoutMs, cause } = input;
+	const megabytes = `${(utf8ByteLength(input.body) / 1048576).toFixed(1)} MB`;
+	const advice = headersTimeoutAdvice(protocol, timeoutMs);
+	if (advice.cause === "upstream-first-token") {
+		const suggestion = advice.suggestionMs ?? timeoutMs;
+		return bilingual("TIMEOUT", `Command Code API request to ${endpoint} did not respond within ${timeoutMs}ms: this route withholds response headers until the upstream model emits its first token, and it did not start within the budget. Raise "Request timeout" in the plugin's advanced settings to ${suggestion}ms, or compact the session or start a new one. The request body was ${megabytes}, but size is not the cause here — a slow upstream is. ${errorChain(cause)}`, `Command Code API 请求在 ${timeoutMs} 毫秒内未收到响应：该路由要等上游模型吐出第一个 token 才返回响应头，而上游在预算内没有开始作答。可在插件「高级」设置里把「请求超时」调到 ${suggestion} 毫秒，或压缩上下文 / 新开会话。本次请求体约 ${megabytes}，但体积不是原因——慢的是上游。（${errorChain(cause)}）`, { cause });
+	}
+	return bilingual("TIMEOUT", `Command Code API request to ${endpoint} did not respond within ${timeoutMs}ms: the gateway returned no response headers at all — it answers headers itself before the model replies. This is usually provider queueing, a Go-plan capacity limit, or a network/proxy path problem; a longer timeout will not help, but retrying usually recovers. The request body was ${megabytes}, and size is not the cause on this route. ${errorChain(cause)}`, `Command Code API 请求在 ${timeoutMs} 毫秒内未收到响应：网关完全没有返回响应头——它会在模型开始回答前先返回响应头。这通常是服务商排队、Go 套餐容量限制，或网络/代理链路问题；调大超时不会有帮助，重试通常可恢复。本次请求体约 ${megabytes}，而在该路由上体积不是原因。（${errorChain(cause)}）`, { cause });
+}
 /**
 * Whether one rejection says "ZDR requested, no ZDR-capable upstream": the
 * provider spells the code `cmd_zdr_no_providers` in JSON error bodies and
@@ -3203,9 +4219,21 @@ function streamErrorToLlmError(value, fallbackMessage) {
 		message
 	].filter((part) => part !== void 0 && part !== "").join(" ");
 	const statusOption = statusCode !== void 0 ? { status: statusCode } : void 0;
-	if (isContextOverflowDetail(detail)) return new LlmError(`Command Code stream error: ${message}；Command Code API 拒绝了这次请求：内容超出模型上下文窗口。正在压缩上下文后重试；如仍失败，请新建会话或减少上下文`, CONTEXT_WINDOW_EXCEEDED_CODE, statusOption);
+	if (OUTPUT_LIMIT_REJECTION.test(detail)) {
+		const stated = /max_tokens:\s*\d+\s*>\s*\d+/i.exec(detail)?.[0];
+		return bilingual("PROVIDER_STREAM_ERROR", `Command Code refused the request's max_tokens for this model` + (stated !== void 0 ? ` (${stated})` : "") + " — the session is not oversized, so compacting it will not help; lower \"Max output tokens\" or pick a model with a larger output ceiling", `Command Code 拒绝了本次请求的 max_tokens（该模型的输出上限更低）` + (stated !== void 0 ? `（${stated}）` : "") + "——会话内容并未超长，压缩上下文无效；请调低「最大输出 token」或改用输出上限更大的模型", statusOption);
+	}
+	if (isContextOverflowDetail(detail)) return bilingual(CONTEXT_WINDOW_EXCEEDED_CODE, `Command Code stream error: ${message}`, "Command Code API 拒绝了这次请求：内容超出模型上下文窗口。正在压缩上下文后重试；如仍失败，请新建会话或减少上下文", statusOption);
 	const terminal = hasTerminalStreamMarker(detail);
 	if (!(isRetryable === true || (isRetryable === false || terminal ? false : statusCode !== void 0 ? statusCode !== void 0 && (statusCode === 429 || statusCode >= 500) : true))) return new LlmError(`Command Code stream error: ${message}`, "PROVIDER_STREAM_ERROR", statusOption);
+	const rejection = classifyAccountRejection(statusCode ?? 0, JSON.stringify(value) ?? message);
+	if (rejection?.reason === "rate-limit" || rejection?.reason === "throttled") {
+		const wait = rejection.resetAtMs === void 0 ? 0 : Math.min(RETRY_MAX_DELAY_MS, Math.max(1e3, rejection.resetAtMs - Date.now()));
+		return bilingual(rejection.reason === "rate-limit" ? "RATE_LIMIT" : THROTTLED_CODE, `Command Code stream error: ${message}`, rejection.reason === "rate-limit" ? "Command Code 用量窗口已限流，等待恢复" : "Command Code 请求暂时被限流，正在重试", {
+			...statusOption,
+			...wait > 0 ? { providerRetryAfterMs: wait } : {}
+		});
+	}
 	return new LlmError(`Command Code stream error: ${message}`, "SERVER", statusOption);
 }
 function recordOrEmpty(value) {
@@ -3370,8 +4398,9 @@ function resolveAuthFileApiKey() {
 		return apiKeyFromCredentialRecord(parsed.commandcode) ?? apiKeyFromCredentialRecord(parsed["command-code"]);
 	} catch {}
 }
-function parseCatalogResponse(value) {
+function parseCatalogResponse(value, apiBase) {
 	if (!isRecord(value) || value.object !== "list" || !Array.isArray(value.data)) throw new LlmError("Unexpected Command Code models response shape", "PROVIDER_PROTOCOL_ERROR");
+	publishedOutputLimits.set(apiBase, /* @__PURE__ */ new Map());
 	const models = [];
 	for (const entry of value.data) {
 		if (!isRecord(entry)) continue;
@@ -3379,33 +4408,52 @@ function parseCatalogResponse(value) {
 		const name = stringValue(entry.name);
 		const contextLength = numberValue(entry.context_length);
 		if (!id || !name || !contextLength || contextLength <= 0) continue;
+		const endpoints = Array.isArray(entry.supported_endpoints) ? entry.supported_endpoints.filter((item) => typeof item === "string") : [];
+		const published = numberValue(entry.max_output_tokens);
+		if (published !== void 0 && published > 0) outputLimitsFor(publishedOutputLimits, apiBase).set(id, published);
 		models.push({
 			id,
 			name,
 			contextWindow: contextLength,
-			maxTokens: Math.min(contextLength, DEFAULT_MAX_OUTPUT_TOKENS)
+			maxTokens: Math.min(contextLength, modelOutputTokenLimit(apiBase, id)),
+			...published !== void 0 && published > 0 ? { publishedMaxTokens: published } : {},
+			supportedEndpoints: endpoints
 		});
 	}
 	if (models.length === 0) throw new LlmError("Command Code returned an empty model catalog", "PROVIDER_PROTOCOL_ERROR");
 	return models;
 }
-async function readModelsCache(cachePath) {
+async function readModelsCache(cachePath, apiBase) {
 	const parsed = JSON.parse(await readFile(cachePath, "utf-8"));
-	if (!isRecord(parsed) || parsed.version !== MODEL_CACHE_VERSION || !Array.isArray(parsed.models)) throw new Error(`Invalid model cache at ${cachePath}`);
-	return parsed.models;
+	if (!isRecord(parsed) || parsed.version !== MODEL_CACHE_VERSION || parsed.apiBase !== apiBase || !Array.isArray(parsed.models)) throw new Error(`Invalid model cache at ${cachePath}`);
+	publishedOutputLimits.set(apiBase, /* @__PURE__ */ new Map());
+	return parsed.models.map((entry) => {
+		const model = isRecord(entry) ? entry : {};
+		const endpoints = Array.isArray(model.supportedEndpoints) ? model.supportedEndpoints.filter((item) => typeof item === "string") : [];
+		const id = stringValue(model.id);
+		const published = numberValue(model.publishedMaxTokens);
+		if (id !== void 0 && published !== void 0 && published > 0) outputLimitsFor(publishedOutputLimits, apiBase).set(id, published);
+		const contextWindow = numberValue(model.contextWindow);
+		return {
+			...model,
+			supportedEndpoints: endpoints,
+			maxTokens: id === void 0 || contextWindow === void 0 ? numberValue(model.maxTokens) ?? 131072 : Math.min(contextWindow, modelOutputTokenLimit(apiBase, id))
+		};
+	});
 }
-async function writeModelsCache(cachePath, models) {
+async function writeModelsCache(cachePath, apiBase, models, mayCommit) {
 	await mkdir(dirname(cachePath), { recursive: true });
-	const tmp = `${cachePath}.${process.pid}.tmp`;
+	const tmp = `${cachePath}.${process.pid}.${randomUUID()}.tmp`;
 	try {
 		await writeFile(tmp, `${JSON.stringify({
 			version: MODEL_CACHE_VERSION,
+			apiBase,
 			models
 		}, null, 2)}\n`, {
 			encoding: "utf-8",
 			mode: 384
 		});
-		await rename(tmp, cachePath);
+		if (mayCommit()) await rename(tmp, cachePath);
 	} finally {
 		await rm(tmp, { force: true }).catch(() => void 0);
 	}
@@ -3581,9 +4629,9 @@ const ENGINE_IMAGE_POLICY = {
 * dsh-llm-retry. On a profile that does not mount that plugin the failure is
 * terminal — every shipped profile reaches it through dsh-base.
 */
-function imageOffloadRequired(missing) {
+function imageOffloadRequired(missing, reason = "budget") {
 	const options = { offloadImages: missing };
-	return new LlmError(`commandcode request images exceed the route budget; ${missing} more oldest occurrence(s) must be offloaded.`, IMAGE_OFFLOAD_REQUIRED_CODE, options);
+	return new LlmError(reason === "cache" ? `commandcode cache-aware image history: ${missing} already-seen oldest image occurrence(s) must be offloaded before replay.` : `commandcode request images exceed the route budget; ${missing} more oldest occurrence(s) must be offloaded.`, IMAGE_OFFLOAD_REQUIRED_CODE, options);
 }
 /** The budget in the shape the core counter takes (representation + the rung). */
 function coreBudget(budget) {
@@ -3609,17 +4657,40 @@ const imageVersionBytes = (block) => block.attachment.bytes;
 * otherwise the 413 retry could reintroduce images the first rung had already
 * evicted.
 */
-function withSurfaceOffload(options, policy, budget) {
+function withSurfaceOffload(options, policy, budget, cacheOffloadModel) {
 	const marked = policy.projectOffloadedImages(options.messages, (ref) => offloadedImageText(ref));
 	const messages = marked === options.messages ? options.messages : [...marked];
-	const missing = policy.requiredImageOffload(messages, coreBudget(budget), imageVersionBytes);
-	if (missing > 0) throw imageOffloadRequired(missing);
+	const budgetMissing = policy.requiredImageOffload(messages, coreBudget(budget), imageVersionBytes);
+	const cacheMissing = cacheOffloadModel === void 0 ? 0 : seenImageOffloadCount(messages, cacheOffloadModel);
+	const missing = Math.max(budgetMissing, cacheMissing);
+	if (missing > 0) throw imageOffloadRequired(missing, cacheMissing > budgetMissing ? "cache" : "budget");
 	return messages === options.messages ? options : {
 		...options,
 		messages
 	};
 }
 /**
+* Count retained images already followed by an answer from this same model.
+* The current tool result's image has not yet been seen by the model and must
+* stay on the wire. The engine can only offload durable user/tool input nodes;
+* assistant output and request-only input have no selectable surface event.
+*/
+function seenImageOffloadCount(messages, model) {
+	let lastAnswer = -1;
+	for (let index = 0; index < messages.length; index++) {
+		const message = messages[index];
+		if (message.role === "assistant" && message.source.kind === "model" && message.source.provider === "commandcode" && message.source.model === model) lastAnswer = index;
+	}
+	if (lastAnswer < 0) return 0;
+	let count = 0;
+	for (let index = 0; index < lastAnswer; index++) {
+		const message = messages[index];
+		if (message.role !== "user" && message.role !== "tool" || message.id === void 0) continue;
+		for (const block of message.content) if (block.type === "image") count++;
+	}
+	return count;
+}
+/**
 * One image's bytes for the wire: the attachment service's REQUEST VERSION.
 *
 * `readImage()` answers the stored original, which is what admission accepted —
@@ -3630,7 +4701,39 @@ function withSurfaceOffload(options, policy, budget) {
 * the point here, the encoded bytes).
 */
 async function readRequestImage(attachments, ref) {
-	return (await attachments.readImageRequest(ref, requestImageTarget(ref))).data;
+	return attachments.readImageRequest(ref, requestImageTarget(ref));
+}
+/** 同一次生成及其协议切换共享图片读取，最多同时准备四张，避免内存峰值失控。 */
+function requestImages(attachments, signal, timing) {
+	const cache = /* @__PURE__ */ new Map();
+	const read = (ref) => {
+		signal?.throwIfAborted();
+		const key = JSON.stringify([ref.attachmentId, requestImageTarget(ref)]);
+		let pending = cache.get(key);
+		if (!pending) {
+			pending = readRequestImage(attachments, ref);
+			cache.set(key, pending);
+		}
+		return pending;
+	};
+	read.prepare = async (refs) => {
+		if (refs.length === 0) return;
+		const finishImages = timing.phase("images");
+		let cursor = 0;
+		try {
+			const workers = Array.from({ length: Math.min(4, refs.length) }, async () => {
+				while (cursor < refs.length) {
+					signal?.throwIfAborted();
+					await read(refs[cursor++]);
+				}
+			});
+			const failure = (await Promise.allSettled(workers)).find((result) => result.status === "rejected");
+			if (failure?.status === "rejected") throw failure.reason;
+		} finally {
+			finishImages();
+		}
+	};
+	return read;
 }
 /**
 * Price one request occurrence.
@@ -3661,31 +4764,58 @@ function priceRequestImage(block, model, imageCapable) {
 	};
 }
 /**
-* Convert one image reference to the Command Code wire format, as the official
-* CLI does: `{ type: 'image', source: { type: 'base64', media_type, data } }`.
-* Bytes come from the durable attachment service; the media type is the one
-* verified at save time.
+* Convert one image reference to the final `/alpha/generate` wire format.
+* The official CLI accepts a base64 source internally, then toWireMessages()
+* sends a data URL plus mimeType. Use the request version's media type because
+* readImageRequest() can transcode the stored image to JPEG or WebP.
 */
 async function imageToCommandCode(ref, readImage) {
-	const data = await readImage(ref);
+	const version = await readImage(ref);
 	return {
 		type: "image",
-		source: {
-			type: "base64",
-			media_type: ref.mediaType,
-			data: Buffer.from(data).toString("base64")
-		}
+		image: `data:${version.mediaType};base64,${Buffer.from(version.data).toString("base64")}`,
+		mimeType: version.mediaType
 	};
 }
-async function messagesToCC(messages, readImage) {
+/**
+* The signature recorded for the reasoning block at `position` of a
+* historical assistant message, or undefined when the message was produced
+* by another route or an older plugin version.
+*/
+function messagesSignatureAt(message, position) {
+	const replay = message.source?.replayState;
+	if (!isRecord(replay) || !Array.isArray(replay.blocks)) return void 0;
+	const entry = replay.blocks[position];
+	return isRecord(entry) ? stringValue(entry.signature) : void 0;
+}
+/**
+* The common pairing and image-carrier ordering for both transports. Each
+* codec owns its wire shape: CLI content blocks and Chat Completions
+* reasoning/tool calls differ beyond the image envelope.
+*/
+async function convertMessages(messages, readImage, codec) {
 	const out = [];
 	const { ids: paired, names: toolNames } = pairedToolCalls(messages);
+	if (readImage?.prepare) {
+		const refs = [];
+		for (const message of messages) {
+			const result = toolResultOf(message);
+			if (message.role === "user" && !result) {
+				for (const block of message.content) if (block.type === "image") refs.push(block.attachment);
+			} else if (result && paired.has(result.toolCallId)) refs.push(...toolResultMedia(result).images);
+		}
+		await readImage.prepare(refs);
+	}
 	const wireIds = wireToolCallIds(paired);
 	const pendingImages = [];
 	const flushPendingImages = () => {
 		for (const message of pendingImages) out.push(message);
 		pendingImages.length = 0;
 	};
+	const encodeImage = (ref) => {
+		if (!readImage) throw new LlmError("Image input requires the durable attachment service", "UNSUPPORTED_CONTENT");
+		return codec.encodeImage(ref, readImage);
+	};
 	for (const message of messages) {
 		if (message.role === "system") continue;
 		const result = toolResultOf(message);
@@ -3697,86 +4827,89 @@ async function messagesToCC(messages, readImage) {
 					type: "text",
 					text: block.text
 				});
-				if (block.type === "image") {
-					if (!readImage) throw new LlmError("Image input requires the durable attachment service", "UNSUPPORTED_CONTENT");
-					parts.push(await imageToCommandCode(block.attachment, readImage));
-				}
+				if (block.type === "image") parts.push(await encodeImage(block.attachment));
 			}
-			if (parts.length === 0) continue;
-			out.push({
-				role: "user",
-				content: parts
-			});
+			if (parts.length > 0) out.push(codec.encodeUser(parts));
 			continue;
 		}
 		if (message.role === "assistant") {
 			flushPendingImages();
-			const parts = [];
-			for (const block of message.content) if (block.type === "text") parts.push({
-				type: "text",
-				text: block.text
-			});
-			else if (block.type === "reasoning") parts.push({
-				type: "reasoning",
-				text: block.text
-			});
-			else if (block.type === "tool-call" && paired.has(block.id)) parts.push({
-				type: "tool-call",
-				toolCallId: wireIds.get(block.id) ?? block.id,
-				toolName: block.name,
-				input: recordOrEmpty(block.arguments)
-			});
-			if (parts.length > 0) out.push({
-				role: "assistant",
-				content: parts
-			});
+			const assistant = codec.encodeAssistant(message, paired, wireIds);
+			if (assistant !== void 0) out.push(assistant);
 			continue;
 		}
-		if (result) {
-			if (!paired.has(result.toolCallId)) continue;
-			const media = toolResultMedia(result);
-			const wireToolCallId = wireIds.get(result.toolCallId) ?? result.toolCallId;
-			out.push({
-				role: "tool",
-				content: [{
-					type: "tool-result",
-					toolCallId: wireToolCallId,
-					toolName: toolNames.get(result.toolCallId) || "unknown",
-					output: result.isError ? {
-						type: "error-text",
-						value: toolResultTextForWire(media)
-					} : {
-						type: "text",
-						value: toolResultTextForWire(media)
-					}
-				}]
-			});
-			if (media.images.length > 0) {
-				if (!readImage) throw new LlmError("Image input requires the durable attachment service", "UNSUPPORTED_CONTENT");
-				const carried = [{
-					type: "text",
-					text: toolResultImageNote(media, wireToolCallId)
-				}];
-				for (const attachment of media.images) carried.push(await imageToCommandCode(attachment, readImage));
-				pendingImages.push({
-					role: "user",
-					content: carried
-				});
-			}
+		if (!result || !paired.has(result.toolCallId)) continue;
+		const media = toolResultMedia(result);
+		const wireId = wireIds.get(result.toolCallId) ?? result.toolCallId;
+		out.push(await codec.encodeTool(result, media, wireId, toolNames.get(result.toolCallId) || "unknown", readImage));
+		if (!codec.carriesToolResultMedia && media.images.length > 0) {
+			const carried = [{
+				type: "text",
+				text: toolResultImageNote(media, wireId)
+			}];
+			for (const attachment of media.images) carried.push(await encodeImage(attachment));
+			pendingImages.push(codec.encodeUser(carried));
 		}
 	}
 	flushPendingImages();
 	return out;
 }
+const ccMessageCodec = {
+	carriesToolResultMedia: false,
+	encodeImage: imageToCommandCode,
+	encodeUser: (parts) => ({
+		role: "user",
+		content: parts
+	}),
+	encodeAssistant: (message, paired, wireIds) => {
+		const parts = [];
+		for (const block of message.content) if (block.type === "text") parts.push({
+			type: "text",
+			text: block.text
+		});
+		else if (block.type === "reasoning") parts.push({
+			type: "reasoning",
+			text: block.text
+		});
+		else if (block.type === "tool-call" && paired.has(block.id)) parts.push({
+			type: "tool-call",
+			toolCallId: wireIds.get(block.id) ?? block.id,
+			toolName: block.name,
+			input: recordOrEmpty(block.arguments)
+		});
+		return parts.length > 0 ? {
+			role: "assistant",
+			content: parts
+		} : void 0;
+	},
+	encodeTool: (result, media, wireId, toolName) => ({
+		role: "tool",
+		content: [{
+			type: "tool-result",
+			toolCallId: wireId,
+			toolName,
+			output: result.isError ? {
+				type: "error-text",
+				value: toolResultTextForWire(media)
+			} : {
+				type: "text",
+				value: toolResultTextForWire(media)
+			}
+		}]
+	})
+};
+async function messagesToCC(messages, readImage) {
+	return convertMessages(messages, readImage, ccMessageCodec);
+}
 /**
 * Convert one image reference to the OpenAI Chat Completions wire format:
 * `{ type: 'image_url', image_url: { url: 'data:...;base64,...' } }`.
 */
 async function imageToOpenAI(ref, readImage) {
-	const data = await readImage(ref);
+	const version = await readImage(ref);
 	return {
 		type: "image_url",
-		image_url: { url: `data:${ref.mediaType};base64,${Buffer.from(data).toString("base64")}` }
+		image_url: { url: `data:${version.mediaType};base64,${Buffer.from(version.data).toString("base64")}` }
 	};
 }
 /**
@@ -3789,89 +4922,159 @@ async function imageToOpenAI(ref, readImage) {
 * on assistant messages. Only tool calls with a paired tool result are
 * replayed (same policy as the CLI path).
 */
+const openAiMessageCodec = {
+	carriesToolResultMedia: false,
+	encodeImage: imageToOpenAI,
+	encodeUser: (parts) => {
+		return !parts.some((part) => part.type === "image_url") && parts.length === 1 ? {
+			role: "user",
+			content: parts[0].text
+		} : {
+			role: "user",
+			content: parts
+		};
+	},
+	encodeAssistant: (message, paired, wireIds) => {
+		const text = message.content.filter((block) => block.type === "text").map((block) => block.text).join("");
+		const reasoning = message.content.filter((block) => block.type === "reasoning").map((block) => block.text).join("");
+		const toolCalls = message.content.filter((block) => block.type === "tool-call" && paired.has(block.id)).map((block) => ({
+			id: wireIds.get(block.id) ?? block.id,
+			type: "function",
+			function: {
+				name: block.name,
+				arguments: block.arguments
+			}
+		}));
+		if (text === "" && reasoning === "" && toolCalls.length === 0) return void 0;
+		const assistant = {
+			role: "assistant",
+			content: text === "" ? null : text
+		};
+		if (reasoning !== "") assistant.reasoning_content = reasoning;
+		if (toolCalls.length > 0) assistant.tool_calls = toolCalls;
+		return assistant;
+	},
+	encodeTool: (_result, media, wireId) => ({
+		role: "tool",
+		tool_call_id: wireId,
+		content: toolResultTextForWire(media)
+	})
+};
 async function messagesToOpenAI(messages, readImage) {
-	const out = [];
-	const { ids: paired } = pairedToolCalls(messages);
-	const wireIds = wireToolCallIds(paired);
-	const pendingImages = [];
-	const flushPendingImages = () => {
-		for (const message of pendingImages) out.push(message);
-		pendingImages.length = 0;
+	return convertMessages(messages, readImage, openAiMessageCodec);
+}
+/**
+* Convert one image reference to the Messages wire shape. Unlike the other two
+* transports this one keeps the native media type rather than a data URL, and
+* it may be used INSIDE a tool result — `tool_result.content` accepts image
+* blocks, which is why this codec sets `carriesToolResultMedia`.
+*/
+async function imageToMessages(ref, readImage) {
+	const version = await readImage(ref);
+	return {
+		type: "image",
+		source: {
+			type: "base64",
+			media_type: version.mediaType,
+			data: Buffer.from(version.data).toString("base64")
+		}
 	};
-	for (const message of messages) {
-		if (message.role === "system") continue;
-		const result = toolResultOf(message);
-		if (message.role === "user" && !result) {
-			flushPendingImages();
-			const parts = [];
-			for (const block of message.content) {
-				if (block.type === "text") parts.push({
+}
+/** A tool call's `arguments` is a raw JSON string in the harness, an object here. */
+function parseToolArguments(raw) {
+	try {
+		const parsed = JSON.parse(raw);
+		return isRecord(parsed) ? parsed : {};
+	} catch {
+		return {};
+	}
+}
+/**
+* Convert harness messages to the Anthropic Messages request shape.
+*
+* Differences from the other two transports, all measured against the live
+* endpoint on 2026-09-29:
+*
+* - Content is always a block array; there is no string shorthand, so a
+*   single-text user turn is still `{ role: 'user', content: [{type:'text'…}] }`.
+* - Tool results live in a `user` turn as `tool_result` blocks (not a
+*   `role: 'tool'` message) and may carry images natively, so no image is
+*   split into a separate user message here.
+* - A replayed `thinking` block is only valid WITH its `signature`: the
+*   endpoint answers `thinking.signature: Field required` without it, and
+*   `each thinking block must contain thinking` when the text is empty and
+*   the signature is blank. A reasoning block with no recorded signature is
+*   therefore dropped rather than sent — replaying it would fail the request,
+*   while omitting it is accepted (verified 200 both ways).
+* - The conversation must end with a user turn; the endpoint refuses an
+*   assistant prefill (`This model does not support assistant message
+*   prefill`), which `convertMessages` already guarantees for a tool loop.
+*/
+const messagesMessageCodec = {
+	carriesToolResultMedia: true,
+	encodeImage: imageToMessages,
+	encodeUser: (parts) => ({
+		role: "user",
+		content: parts
+	}),
+	encodeAssistant: (message, paired, wireIds) => {
+		const parts = [];
+		let position = 0;
+		for (const block of message.content) {
+			if (block.type === "text") {
+				parts.push({
 					type: "text",
 					text: block.text
 				});
-				if (block.type === "image") {
-					if (!readImage) throw new LlmError("Image input requires the durable attachment service", "UNSUPPORTED_CONTENT");
-					parts.push(await imageToOpenAI(block.attachment, readImage));
-				}
+				position++;
+				continue;
 			}
-			if (parts.length === 0) continue;
-			if (!parts.some((part) => part.type === "image_url") && parts.length === 1) out.push({
-				role: "user",
-				content: parts[0].text
-			});
-			else out.push({
-				role: "user",
-				content: parts
-			});
-			continue;
-		}
-		if (message.role === "assistant") {
-			flushPendingImages();
-			const text = message.content.filter((block) => block.type === "text").map((block) => block.text).join("");
-			const reasoning = message.content.filter((block) => block.type === "reasoning").map((block) => block.text).join("");
-			const toolCalls = message.content.filter((block) => block.type === "tool-call" && paired.has(block.id)).map((block) => ({
-				id: wireIds.get(block.id) ?? block.id,
-				type: "function",
-				function: {
+			if (block.type === "reasoning") {
+				const signature = messagesSignatureAt(message, position);
+				if (signature !== void 0) parts.push({
+					type: "thinking",
+					thinking: block.text,
+					signature
+				});
+				position++;
+				continue;
+			}
+			if (block.type === "tool-call" && paired.has(block.id)) {
+				parts.push({
+					type: "tool_use",
+					id: wireIds.get(block.id) ?? block.id,
 					name: block.name,
-					arguments: block.arguments
-				}
-			}));
-			if (text === "" && reasoning === "" && toolCalls.length === 0) continue;
-			const assistant = {
-				role: "assistant",
-				content: text === "" ? null : text
-			};
-			if (reasoning !== "") assistant.reasoning_content = reasoning;
-			if (toolCalls.length > 0) assistant.tool_calls = toolCalls;
-			out.push(assistant);
-			continue;
-		}
-		if (result) {
-			if (!paired.has(result.toolCallId)) continue;
-			const media = toolResultMedia(result);
-			const wireToolCallId = wireIds.get(result.toolCallId) ?? result.toolCallId;
-			out.push({
-				role: "tool",
-				tool_call_id: wireToolCallId,
-				content: toolResultTextForWire(media)
-			});
-			if (media.images.length > 0) {
-				if (!readImage) throw new LlmError("Image input requires the durable attachment service", "UNSUPPORTED_CONTENT");
-				const carried = [{
-					type: "text",
-					text: toolResultImageNote(media, wireToolCallId)
-				}];
-				for (const attachment of media.images) carried.push(await imageToOpenAI(attachment, readImage));
-				pendingImages.push({
-					role: "user",
-					content: carried
+					input: parseToolArguments(block.arguments)
 				});
+				position++;
 			}
 		}
+		return parts.length > 0 ? {
+			role: "assistant",
+			content: parts
+		} : void 0;
+	},
+	encodeTool: async (result, media, wireId, _toolName, readImage) => {
+		const content = [];
+		if (readImage) for (const attachment of media.images) content.push(await imageToMessages(attachment, readImage));
+		content.push({
+			type: "text",
+			text: toolResultTextForWire(media)
+		});
+		const toolResult = {
+			type: "tool_result",
+			tool_use_id: wireId,
+			content
+		};
+		if (result.isError) toolResult.is_error = true;
+		return {
+			role: "user",
+			content: [toolResult]
+		};
 	}
-	flushPendingImages();
-	return out;
+};
+async function messagesToMessages(messages, readImage) {
+	return convertMessages(messages, readImage, messagesMessageCodec);
 }
 /** Account endpoints fetched by one `getUsage()` run (see the classification there). */
 const USAGE_ENDPOINT_COUNT = 4;
@@ -4000,6 +5203,50 @@ function cliSystem(systemText) {
 		cache_control: { type: "ephemeral" }
 	}];
 }
+/**
+* The Anthropic ephemeral cache marker, shared by every breakpoint this route
+* sets. One object is reused across positions because it is only ever
+* serialized, never mutated.
+*
+* No `ttl` is sent: the default 5-minute entry covers a continuously advancing
+* session, and `ttl: "1h"` is a separate billable tier whose read/write prices
+* are identical — it would only lengthen survival, not reduce cost.
+*/
+const EPHEMERAL_CACHE_CONTROL = { type: "ephemeral" };
+/**
+* Content-block types that may carry the rolling breakpoint. Matches what the
+* official Command Code provider for pi marks through
+* `@earendil-works/pi-ai`'s `anthropic-messages` transport (its own list also
+* holds pi-internal `tool_addition` / `tool_removal`, which this route never
+* emits). Assistant-side blocks are deliberately excluded: a breakpoint on a
+* `thinking` or `tool_use` block caches a prefix the next turn invalidates.
+*/
+const CACHEABLE_BLOCK_TYPES = /* @__PURE__ */ new Set([
+	"text",
+	"image",
+	"tool_result"
+]);
+/**
+* Mark the last user turn as the rolling cache breakpoint.
+*
+* Anthropic caching is explicit — a prefix is stored only when a
+* `cache_control` marker names it — so an unmarked route re-prefills the whole
+* replayed history at the full input price on every turn. Measured cost of that
+* omission on a 10-turn session: $0.5648, all of it at the undiscounted
+* $2/M input rate, against $0.1869 with the three breakpoints this route sets.
+*
+* The final user message is the rolling boundary: DSH resends the whole
+* history each turn, so a marker here grows with the conversation, whereas a
+* fixed `system`-only marker would leave every later turn's history
+* uncached. {@link messagesMessageCodec} renders both user input and tool
+* results as `role: 'user'`, so this covers a tool loop's trailing turn too.
+*/
+function markLastUserCacheControl(messages) {
+	const last = messages[messages.length - 1];
+	if (!isRecord(last) || last.role !== "user" || !Array.isArray(last.content)) return;
+	const lastBlock = last.content[last.content.length - 1];
+	if (isRecord(lastBlock) && typeof lastBlock.type === "string" && CACHEABLE_BLOCK_TYPES.has(lastBlock.type)) lastBlock.cache_control = EPHEMERAL_CACHE_CONTROL;
+}
 /** Build the legacy CLI (`/alpha/generate`) request body for one call. */
 async function buildCliBody(options, connection, facts) {
 	return {
@@ -4060,6 +5307,108 @@ async function buildOpenAIBody(options, facts) {
 	};
 }
 /**
+* Build the Anthropic Messages request body for one call.
+*
+* Measured deviations from DeepSeek's own Messages API (the shape
+* `dsh-llm-deepseek` implements), all confirmed on 2026-09-29:
+*
+* - `thinking` accepts ONLY `{ type: 'adaptive' }` here. `enabled` and
+*   `disabled` are refused with `"thinking.type.enabled" is not supported for
+*   this model. Use "thinking.type.adaptive" and "output_config.effort" to
+*   control thinking behavior.`, and a `between_tools` value fails validation
+*   outright. The model reasons on its own; this switch only admits it.
+* - Reasoning strength travels in `output_config.effort`, whose accepted
+*   values are `low | medium | high | xhigh | max` — there is no `none`, and
+*   `xhigh` is absent from DeepSeek's own type.
+* - `stop_sequences` is a real field here, but this adapter still rejects
+*   `GenerateOptions.stop` in `stream()` because Command Code documents no
+*   equivalent for the other two transports.
+* - **`temperature` is never sent.** Adaptive thinking constrains it to 1:
+*   `` `temperature` may only be set to 1 when thinking is enabled or in
+*   adaptive mode `` (measured 2026-09-29 — every request carrying the other
+*   transports' 0.3 default was refused with HTTP 400). Omitting the field
+*   is the only way to honour both the thinking switch and a caller that
+*   asked for a temperature, so Claude loses sampling control on this route
+*   because the endpoint, not this adapter, removed it.
+* - `system` travels as a one-block ARRAY carrying `cache_control`, not as the
+*   bare string the other two transports send. Anthropic's caching is opt-in
+*   per block, and this route is the only Claude path, so the marker is what
+*   makes a session's replayed history bill at the cache-read rate instead of
+*   the full input rate. See {@link EPHEMERAL_CACHE_CONTROL}.
+*/
+async function buildMessagesBody(options, facts) {
+	const body = {
+		model: options.model,
+		max_tokens: facts.maxTokens,
+		stream: true,
+		messages: await messagesToMessages(options.messages, facts.readImage)
+	};
+	if (facts.selectableEffort) body.thinking = { type: "adaptive" };
+	if (facts.systemText) body.system = [{
+		type: "text",
+		text: facts.systemText,
+		cache_control: EPHEMERAL_CACHE_CONTROL
+	}];
+	if (facts.reasoningEffort) body.output_config = { effort: facts.reasoningEffort };
+	const tools = (options.tools ?? []).map((tool) => ({
+		name: tool.name,
+		description: tool.description,
+		input_schema: toolParametersSchema(tool.parameters)
+	}));
+	if (tools.length > 0) {
+		tools[tools.length - 1].cache_control = EPHEMERAL_CACHE_CONTROL;
+		body.tools = tools;
+	}
+	markLastUserCacheControl(body.messages);
+	return body;
+}
+/**
+* Estimate the text the selected transport actually sends. JSON framing and
+* punctuation each get a token; ordinary ASCII words get one, with an extra
+* allowance for long identifiers. UTF-8 bytes / 4 tracks the measured CJK
+* case better than the engine's UTF-16 characters / 4. This is a heuristic,
+* never proof that a prompt cannot fit: a valid long English prompt can still
+* be larger under this estimate than under the provider's tokenizer.
+*/
+function estimateWireInputTokens(protocol, body, messages, model) {
+	const params = protocol === "cli" ? recordOrEmpty(body.params) : body;
+	const wire = JSON.stringify(params, (_key, value) => typeof value === "string" && /^data:[^,]*;base64,/.test(value) ? "[image]" : value);
+	let tokens = 0;
+	for (const match of wire.matchAll(/[A-Za-z0-9_]+|[^\x00-\x7f]+|[^\s]/gu)) {
+		const part = match[0];
+		if (/^[A-Za-z0-9_]+$/.test(part)) tokens += 1 + Math.ceil(Math.max(0, part.length - 12) / 4);
+		else if (part.charCodeAt(0) > 127) tokens += Math.ceil(Buffer.byteLength(part) / 4);
+		else tokens += 1;
+	}
+	for (const message of messages) for (const block of message.content) if (block.type === "image") tokens += priceRequestImage(block, model, true).visualTokens;
+	return tokens;
+}
+function requestContextBudget(protocol, body, messages, model, contextWindow, requestedMaxTokens) {
+	if (contextWindow === void 0) return {
+		maxTokens: requestedMaxTokens,
+		sizePressure: false
+	};
+	const estimatedInput = estimateWireInputTokens(protocol, body, messages, model);
+	const headroom = Math.min(16384, Math.max(2048, Math.ceil(contextWindow * .02)));
+	const available = Math.floor(contextWindow - estimatedInput - headroom);
+	const floor = Math.min(requestedMaxTokens, MIN_CONTEXT_OUTPUT_TOKENS, Math.max(1, Math.floor(contextWindow / 8)));
+	return {
+		maxTokens: Math.min(requestedMaxTokens, Math.max(floor, available)),
+		sizePressure: estimatedInput >= contextWindow / 4 && estimatedInput + requestedMaxTokens + headroom >= contextWindow
+	};
+}
+/**
+* One connect attempt's inputs: everything `connectGenerate` needs beyond
+* the per-attempt key and protocol. Passed explicitly (not closed over) so
+* the rotation loop's mutation of `protocol`/`body` stays visible at the
+* call site.
+*/
+/** The generate endpoint one protocol posts to. */
+function protocolEndpoint(protocol, apiBase) {
+	if (protocol === "cli") return `${apiBase}/alpha/generate`;
+	return protocol === "messages" ? `${apiBase}/provider/v1/messages` : `${apiBase}/provider/v1/chat/completions`;
+}
+/**
 * One pre-stream connect attempt: POST the body and wait for response
 * headers only (`requestTimeoutMs` must never bound the body stream). Returns
 * the live response plus its cleanup, or the rejection facts for the rotation
@@ -4067,11 +5416,11 @@ async function buildOpenAIBody(options, facts) {
 * on success the caller-abort listener outlives the connect phase (it aborts a
 * stalled body read), so the streaming tail calls cleanup.
 */
-async function connectGenerate(deps, key, protocol, body) {
+async function connectGenerate(deps, key, protocol, serializedBody) {
 	const { options, connection, fetchImpl } = deps;
 	const connectAbort = new AbortController();
 	let connectTimedOut = false;
-	const endpoint = protocol === "cli" ? `${connection.apiBase}/alpha/generate` : `${connection.apiBase}/provider/v1/chat/completions`;
+	const endpoint = protocolEndpoint(protocol, connection.apiBase);
 	const connectTimer = setTimeout(() => {
 		connectTimedOut = true;
 		connectAbort.abort(new DOMException(`Command Code API request to ${endpoint} did not respond within ${connection.requestTimeoutMs}ms`, "TimeoutError"));
@@ -4089,38 +5438,46 @@ async function connectGenerate(deps, key, protocol, body) {
 	};
 	let response;
 	const zdr = connection.zdr === true;
-	const headers = protocol === "cli" ? {
+	const sharedHeaders = {
 		"Content-Type": "application/json",
 		...IDENTITY_ENCODING_HEADER,
 		Authorization: `Bearer ${key}`,
+		...zdr ? { "x-cmd-zdr": "1" } : {},
+		...attributionHeaders()
+	};
+	const headers = protocol === "cli" ? {
+		...sharedHeaders,
 		"x-command-code-version": COMMAND_CODE_CLI_VERSION,
 		"x-cli-environment": "production",
 		"x-project-slug": projectSlugFromPath(connection.workingDir),
 		"x-taste-learning": "true",
-		"x-co-flag": "false",
-		...zdr ? { "x-cmd-zdr": "1" } : {},
-		...attributionHeaders()
+		"x-co-flag": "false"
 	} : {
-		"Content-Type": "application/json",
-		...IDENTITY_ENCODING_HEADER,
-		Authorization: `Bearer ${key}`,
-		Accept: "text/event-stream",
-		...zdr ? { "x-cmd-zdr": "1" } : {},
-		...attributionHeaders()
+		...sharedHeaders,
+		Accept: "text/event-stream"
 	};
+	const finishHeaders = deps.timing.attempt(protocol, Buffer.byteLength(serializedBody));
 	try {
 		response = await fetchImpl(endpoint, {
 			method: "POST",
 			headers,
-			body: JSON.stringify(body),
+			body: serializedBody,
 			signal: connectAbort.signal
 		});
+		finishHeaders(response.status);
 		clearTimeout(connectTimer);
 	} catch (error) {
+		finishHeaders();
 		cleanup();
 		if (options.signal?.aborted) throw error;
-		if (connectTimedOut || error instanceof DOMException && error.name === "TimeoutError") throw new LlmError(`Command Code API request to ${endpoint} did not respond within ${connection.requestTimeoutMs}ms: ${errorChain(error)}；Command Code API 请求在 ${connection.requestTimeoutMs} 毫秒内未收到响应——通常是网络或代理问题，请检查后重试`, "TIMEOUT", { cause: error });
-		throw new LlmError(`Command Code API request to ${endpoint} failed: ${errorChain(error)}；Command Code API 请求连接失败——通常是网络或代理问题，请检查网络或代理设置后重试`, "TRANSPORT", { cause: error });
+		if (connectTimedOut || error instanceof DOMException && error.name === "TimeoutError") throw headersTimeoutError({
+			protocol,
+			endpoint,
+			body: serializedBody,
+			timeoutMs: connection.requestTimeoutMs,
+			cause: error
+		});
+		throw bilingual("TRANSPORT", `Command Code API request to ${endpoint} failed: ${errorChain(error)}`, "Command Code API 请求连接失败——通常是网络或代理问题，请检查网络或代理设置后重试", { cause: error });
 	}
 	deps.onResponse(response);
 	if (!response.ok) {
@@ -4152,7 +5509,9 @@ function createBlockAssembler() {
 		sawContent: false,
 		finishReason: void 0,
 		cliCacheWriteTokens: void 0,
-		openAiToolCalls: []
+		openAiToolCalls: [],
+		messagesBlocks: /* @__PURE__ */ new Map(),
+		replayBlocks: []
 	};
 }
 function* closeText(asm) {
@@ -4213,9 +5572,10 @@ function* emitOpenAiToolCalls(asm) {
 	}
 	asm.openAiToolCalls.length = 0;
 }
-var CommandCodeAdapter = class extends LlmAdapter {
+var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 	deps;
 	catalog = [];
+	catalogState;
 	fetchImpl;
 	resolveAttachments;
 	/**
@@ -4226,6 +5586,25 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	billingAccess = /* @__PURE__ */ new Map();
 	billingAccessInflight = /* @__PURE__ */ new Map();
 	protocolCache = /* @__PURE__ */ new Map();
+	/** Namespace account-derived facts by gateway without exposing the key. */
+	accountCacheKey(apiBase, apiKey) {
+		return JSON.stringify([apiBase, apiKey]);
+	}
+	/**
+	* Consecutive header timeouts for the last request shape, counted ACROSS
+	* `stream()` calls: dsh-llm-retry re-invokes this same instance, so this is
+	* the only place a streak can live. Keyed by `sessionId` (not by `agent`:
+	* `GenerateOptions` carries no agent reference, only `sessionId`) so
+	* concurrent sessions on this one shared adapter instance cannot clear or
+	* inflate each other's count. A call with no `sessionId` (a one-shot,
+	* session-less caller) falls back to {@link GLOBAL_HEADER_TIMEOUT_KEY},
+	* matching the old single-slot behavior for exactly that case. Bounded by
+	* {@link MAX_HEADER_TIMEOUT_STREAK_ENTRIES} with FIFO eviction (`Map`
+	* preserves insertion order) since the key space is per-session rather than
+	* per-account/model, so it is not naturally small like `protocolCache`.
+	*/
+	headerTimeoutStreaks = /* @__PURE__ */ new Map();
+	static MAX_HEADER_TIMEOUT_STREAK_ENTRIES = 200;
 	constructor(deps) {
 		super();
 		this.deps = deps;
@@ -4234,6 +5613,38 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		this.surfaceOffload = deps.imageOffload ?? ENGINE_IMAGE_POLICY;
 	}
 	/**
+	* Grade one failed attempt: a headers timeout that repeats on an unchanged
+	* payload eventually leaves the retryable whitelist.
+	*
+	* `providerRetryPolicy()` cannot express this itself — dsh-llm's
+	* `NormalRetryPolicyConfig` carries one `maxRetries` for every listed code.
+	* Escalating here stops repeated identical header timeouts with a specific
+	* diagnosis; the agent listener separately caps ordinary transient errors.
+	*
+	* @returns the error to surface: unchanged for any other failure, the
+	* original timeout below the threshold, and a terminal one at it.
+	*/
+	gradeHeaderTimeout(error, protocol, body, timeoutMs, sessionId) {
+		if (!(error instanceof LlmError && error.code === "TIMEOUT")) return error;
+		const key = sessionId ?? GLOBAL_HEADER_TIMEOUT_KEY;
+		const fingerprint = `${protocol}:${fingerprintValue(body).sha256}`;
+		const previous = this.headerTimeoutStreaks.get(key);
+		const count = previous?.fingerprint === fingerprint ? previous.count + 1 : 1;
+		if (previous === void 0) {
+			if (this.headerTimeoutStreaks.size >= CommandCodeAdapter.MAX_HEADER_TIMEOUT_STREAK_ENTRIES) {
+				const oldest = this.headerTimeoutStreaks.keys().next().value;
+				if (oldest !== void 0) this.headerTimeoutStreaks.delete(oldest);
+			}
+		} else this.headerTimeoutStreaks.delete(key);
+		this.headerTimeoutStreaks.set(key, {
+			fingerprint,
+			count
+		});
+		if (count < MAX_CONSECUTIVE_HEADER_TIMEOUTS) return error;
+		this.headerTimeoutStreaks.delete(key);
+		return bilingual("PROVIDER_HTTP_ERROR", `Command Code API stopped retrying: the gateway returned no response headers on ${count} consecutive attempts at the same request, each after the full ${timeoutMs}ms budget, so this is not a network blip — it is provider queueing, a Go-plan capacity limit, or a network/proxy path problem. Resending the identical payload again is unlikely to help; wait for the provider to recover, or switch model or account.`, `Command Code API 已停止重试：同一请求连续 ${count} 次在 ${timeoutMs} 毫秒内都没有收到任何响应头，这不是网络抖动，而是服务商排队、Go 套餐容量限制或网络/代理链路问题。继续原样重发同一个请求通常无济于事——可以等服务商恢复，或换模型/换账号。`);
+	}
+	/**
 	* Display metadata for the picker's provider group header. The base class
 	* returns the raw route id (`commandcode`, all lowercase) as the name, which
 	* is what the model selector shows as this group's sticky title; return the
@@ -4247,12 +5658,11 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		};
 	}
 	/**
-	* Near-unbounded retry for transient failures only (`mode: 'normal'` with
-	* an explicit 1000-attempt cap — opencode-style persistence without the
-	* unbounded loop): `RATE_LIMIT`/`SERVER`/`TIMEOUT`/`TRANSPORT`/
-	* `EMPTY_RESPONSE` retry up to 1000 times with waits doubling from 500 ms
-	* and capping at 15 minutes (±10% jitter), so an exhausted 5-hour window
-	* recovers in-session instead of failing after two tries. Permanent failures
+	* The official executor owns backoff and provider reset waits. Its high
+	* route-wide cap lets a confirmed `RATE_LIMIT` window recover in-session;
+	* our request-error listener limits `SERVER`/`TIMEOUT`/`EMPTY_RESPONSE`/
+	* `THROTTLED` to three retries and `TRANSPORT` to its separate budget.
+	* Waits double from 500 ms and cap at 15 minutes (±10% jitter). Permanent failures
 	* (an invalid key's `INVALID_CREDENTIAL`, `UNSUPPORTED_CONTENT`, plan
 	* rejections) are absent from the whitelist and surface immediately instead
 	* of looping. Waits the pool/adapter attach as `providerRetryAfterMs` are
@@ -4270,6 +5680,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			retryableCodes: [
 				"EMPTY_RESPONSE",
 				"RATE_LIMIT",
+				THROTTLED_CODE,
 				"SERVER",
 				"TIMEOUT",
 				"TRANSPORT"
@@ -4296,26 +5707,61 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		const imageCapable = KNOWN_IMAGE_MODELS.has(model);
 		return { priceImages: (images) => images.map((image) => priceRequestImage(image, model, imageCapable)) };
 	}
-	/** Refresh the catalog (live fetch, cache fallback) and return it. */
+	/** 地址或缓存文件变化时丢弃旧目录，防止旧网关的路由声明影响新请求。 */
+	currentCatalogState(connection = this.deps.options()) {
+		const { apiBase, modelsCachePath } = connection;
+		const source = JSON.stringify([apiBase, modelsCachePath]);
+		if (this.catalogState?.source !== source) {
+			this.catalog = [];
+			this.catalogState = {
+				source,
+				expiresAt: 0
+			};
+		}
+		return this.catalogState;
+	}
+	/** 共享一次刷新；调用者取消只结束自己的等待，不取消其他调用者的请求。 */
 	async loadCatalog(signal) {
-		const { apiBase, modelsCachePath } = this.deps.options();
-		try {
-			const response = await this.fetchImpl(`${apiBase}/provider/v1/models`, {
-				headers: {
-					accept: "application/json",
-					...IDENTITY_ENCODING_HEADER,
-					...attributionHeaders()
-				},
-				signal: signal ?? AbortSignal.timeout(1e4)
+		signal?.throwIfAborted();
+		const connection = this.deps.options();
+		const state = this.currentCatalogState(connection);
+		if (Date.now() < state.expiresAt) return this.catalog;
+		const { apiBase, modelsCachePath } = connection;
+		if (!state.inflight) {
+			const fallback = this.catalog;
+			state.inflight = (async () => {
+				let models;
+				let ttl = MODEL_CATALOG_TTL_MS;
+				try {
+					const { status, record } = await this.fetchJson(`${apiBase}/provider/v1/models`, {
+						accept: "application/json",
+						...IDENTITY_ENCODING_HEADER,
+						...attributionHeaders()
+					}, MODELS_TIMEOUT_MS);
+					if (status < 200 || status >= 300) throw new Error(`models endpoint returned ${status}`);
+					models = parseCatalogResponse(record, apiBase);
+					if (this.catalogState === state) await writeModelsCache(modelsCachePath, apiBase, models, () => this.catalogState === state).catch(() => void 0);
+				} catch {
+					ttl = MODEL_CATALOG_RETRY_MS;
+					models = await readModelsCache(modelsCachePath, apiBase).catch(() => fallback);
+				}
+				if (this.catalogState === state) {
+					this.catalog = models;
+					state.expiresAt = Date.now() + ttl;
+				}
+				return models;
+			})().finally(() => {
+				delete state.inflight;
 			});
-			if (!response.ok) throw new Error(`models endpoint returned ${response.status}`);
-			this.catalog = parseCatalogResponse(await response.json());
-			await writeModelsCache(modelsCachePath, this.catalog).catch(() => void 0);
-		} catch (error) {
-			if (signal?.aborted) throw error;
-			this.catalog = await readModelsCache(modelsCachePath).catch(() => this.catalog);
 		}
-		return this.catalog;
+		if (!signal) return state.inflight;
+		const inflight = state.inflight;
+		return new Promise((resolve, reject) => {
+			const abort = () => reject(signal.reason);
+			signal.addEventListener("abort", abort, { once: true });
+			inflight.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+			if (signal.aborted) abort();
+		});
 	}
 	async listModels(provider, opts) {
 		const catalog = await this.loadCatalog();
@@ -4340,7 +5786,33 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			return allow === void 0 || allow.has(model.id);
 		}).map(toInfo).sort(compareByPlan);
 	}
+	/**
+	* The per-model allowance bracket this account POOL falls into, or undefined
+	* when there is nothing honest to show.
+	*
+	* The pricing page publishes a per-model monthly allowance for GOAT and Pro
+	* only — its own words are "the boost is a per-model allowance, so it lives on
+	* the plans that have them" — so a pool whose highest plan is Go, Provider,
+	* Max or Ultra gets undefined rather than a neighbouring tier's figure. Taking
+	* the HIGHEST tier matches the question the picker already answers for a pool
+	* (see `modelVisibleForAnyAccount`): what the user can reach, not what the one
+	* account serving this request happens to be. The fail-open shape is the same
+	* too — an unreachable billing endpoint yields undefined, which hides the
+	* allowance instead of inventing one.
+	*/
+	async allowanceTier() {
+		const accesses = await this.loadPoolBillingAccess();
+		if (accesses === void 0) return void 0;
+		let highest;
+		for (const access of accesses) {
+			const weight = access?.tierWeight;
+			if (weight === void 0) continue;
+			if (highest === void 0 || weight > highest) highest = weight;
+		}
+		return allowanceTierForWeight(highest);
+	}
 	async resolveModel(provider, model, signal) {
+		this.currentCatalogState();
 		const entry = this.catalog.find((m) => m.id === model) ?? (await this.loadCatalog(signal)).find((m) => m.id === model);
 		const efforts = KNOWN_EFFORTS[model];
 		const vision = KNOWN_IMAGE_MODELS.has(model);
@@ -4375,21 +5847,19 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		};
 	}
 	/**
-	* Fetch one account endpoint and parse its JSON body. Returns the HTTP
-	* status alongside the parsed record so each caller applies its own failure
-	* accounting: the billing probe fails open silently, the usage report books
-	* failures per endpoint. Non-2xx and invalid JSON bodies come back without a
-	* record; only a fetch failure propagates to the caller.
+	* Fetch one JSON GET and return its HTTP status with a parsed record. The
+	* catalog, billing probe, and usage report each apply their own failure
+	* policy. Non-2xx and invalid JSON bodies come back without a record; only
+	* a fetch failure propagates to the caller.
 	*
-	* `timeoutMs` is the caller's budget for this one request. The default is the
-	* CATALOG probe's short cap, which fits the picker's fail-open reads; the
-	* usage report deliberately passes the connection's own request budget so an
-	* account query is not held to a stricter (and invisible) limit than chat.
+	* `timeoutMs` is the caller's budget, unless it provides its own signal.
+	* The usage report passes the connection's request budget rather than the
+	* catalog/picker's shorter default.
 	*/
-	async fetchEndpointJson(url, headers, timeoutMs = MODELS_TIMEOUT_MS) {
+	async fetchJson(url, headers, timeoutMs = MODELS_TIMEOUT_MS, signal) {
 		const response = await this.fetchImpl(url, {
 			headers,
-			signal: AbortSignal.timeout(timeoutMs)
+			signal: signal ?? AbortSignal.timeout(timeoutMs)
 		});
 		if (!response.ok) return { status: response.status };
 		let parsed;
@@ -4420,7 +5890,8 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	async loadPoolBillingAccess() {
 		const keys = await this.poolAccountKeys();
 		if (keys.length === 0) return void 0;
-		return Promise.all(keys.map((key) => this.loadBillingAccessForKey(key)));
+		const apiBase = this.deps.options().apiBase;
+		return Promise.all(keys.map((key) => this.loadBillingAccessForKey(apiBase, key)));
 	}
 	/**
 	* The API keys the picker's plan filter must consult: every account the host
@@ -4444,21 +5915,22 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	* shared across concurrent callers. `undefined` means "unknown — show
 	* everything" (fail-open).
 	*/
-	async loadBillingAccessForKey(apiKey) {
-		const cached = this.billingAccess.get(apiKey);
+	async loadBillingAccessForKey(apiBase, apiKey) {
+		const cacheKey = this.accountCacheKey(apiBase, apiKey);
+		const cached = this.billingAccess.get(cacheKey);
 		if (cached !== void 0 && Date.now() - cached.at < 3e5) return cached.value;
-		const existing = this.billingAccessInflight.get(apiKey);
+		const existing = this.billingAccessInflight.get(cacheKey);
 		if (existing !== void 0) return existing;
-		const inflight = this.fetchBillingAccess(apiKey).then((value) => {
-			this.billingAccess.set(apiKey, {
+		const inflight = this.fetchBillingAccess(apiBase, apiKey).then((value) => {
+			this.billingAccess.set(cacheKey, {
 				value,
 				at: Date.now()
 			});
 			return value;
 		}).finally(() => {
-			this.billingAccessInflight.delete(apiKey);
+			this.billingAccessInflight.delete(cacheKey);
 		});
-		this.billingAccessInflight.set(apiKey, inflight);
+		this.billingAccessInflight.set(cacheKey, inflight);
 		return inflight;
 	}
 	/**
@@ -4470,12 +5942,10 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	* fallback (the CLI stamps plan identity from it too). Any failure resolves
 	* to `undefined` (fail-open) rather than breaking the picker.
 	*/
-	async fetchBillingAccess(apiKey) {
+	async fetchBillingAccess(apiBase, apiKey) {
 		try {
-			const connection = this.deps.options();
 			const headers = await this.accountHeaders(apiKey);
-			const base = connection.apiBase;
-			const getJson = async (path) => (await this.fetchEndpointJson(`${base}${path}`, headers)).record;
+			const getJson = async (path) => (await this.fetchJson(`${apiBase}${path}`, headers)).record;
 			const whoami = await getJson("/alpha/whoami");
 			const orgData = whoami && isRecord(whoami.org) ? whoami.org : void 0;
 			const orgId = orgData === void 0 ? void 0 : stringValue(orgData.id);
@@ -4497,50 +5967,65 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		}
 	}
 	/** Fresh cached billing tier weight for a key, or undefined when not known. */
-	cachedBillingTierWeight(apiKey) {
-		const hit = this.billingAccess.get(apiKey);
+	cachedBillingTierWeight(apiBase, apiKey) {
+		const hit = this.billingAccess.get(this.accountCacheKey(apiBase, apiKey));
 		if (hit === void 0 || Date.now() - hit.at >= 3e5) return void 0;
 		return hit.value?.tierWeight;
 	}
 	/** Cached protocol decision for a key, or undefined when expired/unknown. */
-	cachedProtocolUseCli(apiKey) {
-		const hit = this.protocolCache.get(apiKey);
+	cachedProtocol(apiBase, apiKey) {
+		const hit = this.protocolCache.get(this.accountCacheKey(apiBase, apiKey));
 		if (hit === void 0 || Date.now() - hit.at >= 9e5) return void 0;
-		return hit.useCli;
+		return hit.protocol;
 	}
-	rememberProtocol(apiKey, useCli) {
-		this.protocolCache.set(apiKey, {
-			useCli,
+	rememberProtocol(apiBase, apiKey, protocol) {
+		this.protocolCache.set(this.accountCacheKey(apiBase, apiKey), {
+			protocol,
 			at: Date.now()
 		});
 	}
 	/**
-	* Choose the initial protocol for one request. A fresh protocol cache entry
-	* wins; otherwise a cached (not network-fetched) billing tier of Go is
-	* treated as CLI-only. Unknown accounts default to Provider API and fall
-	* back only after an `upgrade_required` rejection.
+	* True when the catalog routes `model` to `/provider/v1/messages`.
+	*
+	* The catalog's own `supported_endpoints` is authoritative (it is what
+	* upstream publishes per model); `requiresMessagesEndpoint()` — the
+	* `claude-*` prefix rule — is the fallback for a catalog entry that carries
+	* no route list, which is the shape every pre-1.55 cache file has.
+	*/
+	routesToMessages(model) {
+		const entry = this.catalog.find((candidate) => candidate.id === model);
+		if (entry !== void 0 && entry.supportedEndpoints.length > 0) return entry.supportedEndpoints.includes("/messages");
+		return requiresMessagesEndpoint(model);
+	}
+	/**
+	* Choose the initial protocol for one request.
 	*
-	* Models the Provider API serves ONLY through `/provider/v1/messages` (the
-	* Claude family — `requiresMessagesEndpoint()`) always take the CLI
-	* transport, on any tier and even under a forced `'openai'` preference:
-	* that option is documented as "prefer the Provider API, still fall back",
-	* and the 400 these models answer with is not a preference to be honoured
-	* but a hard refusal. `/alpha/generate` routes every one of them, so this
-	* costs nothing.
+	* Models the Provider API serves only through `/provider/v1/messages` (the
+	* Claude family) take the Messages transport on any tier and even under a
+	* forced `'openai'` preference: that option is documented as "prefer the
+	* Provider API, still fall back", and the 400 these models answer with on
+	* Chat Completions (`Model "<id>" must be called via /provider/v1/messages`)
+	* is a hard refusal, not a preference to honour.
 	*
 	* That decision is deliberately NOT written to `protocolCache`, which is
-	* keyed by API key alone: remembering it would pin the whole ACCOUNT to the
-	* CLI transport and drag every other model off it until the entry expired.
+	* keyed by gateway and API key: it depends on the model, not just the account, so
+	* remembering it would pin the whole ACCOUNT to one transport and drag
+	* every other model along (issue #46).
+	*
+	* Otherwise a fresh protocol cache entry wins, then a cached (not
+	* network-fetched) billing tier of Go — the one plan without Provider API
+	* access. Unknown accounts default to Chat Completions and fall back to the
+	* CLI transport only after an `upgrade_required` rejection.
 	*/
-	resolveProtocol(apiKey, model) {
+	resolveProtocol(apiBase, apiKey, model) {
 		const forced = this.deps.options().protocol;
 		if (forced === "cli") return forced;
-		if (requiresMessagesEndpoint(model)) return "cli";
+		if (this.routesToMessages(model)) return "messages";
 		if (forced === "openai") return forced;
-		const cached = this.cachedProtocolUseCli(apiKey);
-		if (cached !== void 0) return cached ? "cli" : "openai";
-		if (this.cachedBillingTierWeight(apiKey) === GO_TIER_WEIGHT) {
-			this.rememberProtocol(apiKey, true);
+		const cached = this.cachedProtocol(apiBase, apiKey);
+		if (cached !== void 0) return cached;
+		if (this.cachedBillingTierWeight(apiBase, apiKey) === GO_TIER_WEIGHT) {
+			this.rememberProtocol(apiBase, apiKey, "cli");
 			return "cli";
 		}
 		return "openai";
@@ -4582,7 +6067,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		const failed = [];
 		const getJson = async (path) => {
 			try {
-				const { status, record, invalidResponse } = await this.fetchEndpointJson(`${base}${path}`, headers, connection.requestTimeoutMs);
+				const { status, record, invalidResponse } = await this.fetchJson(`${base}${path}`, headers, connection.requestTimeoutMs);
 				if (record === void 0) {
 					failures.push(`${path}: HTTP ${status}${invalidResponse ? " returned an unreadable or invalid JSON body" : ""}`);
 					failed.push(invalidResponse ? {
@@ -4655,13 +6140,8 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	async probeWindowLimits(apiKey) {
 		try {
 			const connection = this.deps.options();
-			const response = await this.fetchImpl(`${connection.apiBase}/alpha/billing/credits`, {
-				headers: await this.accountHeaders(apiKey),
-				signal: AbortSignal.timeout(MODELS_TIMEOUT_MS)
-			});
-			if (!response.ok) return void 0;
-			const parsed = await response.json();
-			if (!isRecord(parsed)) return void 0;
+			const { record: parsed } = await this.fetchJson(`${connection.apiBase}/alpha/billing/credits`, await this.accountHeaders(apiKey));
+			if (parsed === void 0) return void 0;
 			const windowLimits = isRecord(parsed.windowLimits) ? parsed.windowLimits : void 0;
 			if (windowLimits === void 0) return void 0;
 			let reported = false;
@@ -4685,6 +6165,59 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		}
 	}
 	async *stream(options) {
+		const timing = openRequestTiming(options.model, this.deps.onRequestTiming);
+		let outcome = "cancelled";
+		let errorCode;
+		try {
+			for await (const chunk of this.streamRequest(options, timing)) {
+				if (chunk.type === "text-delta" || chunk.type === "reasoning-delta" || chunk.type === "tool-call-delta") timing.first("firstContentMs");
+				if (chunk.type === "finish") outcome = "finished";
+				yield chunk;
+			}
+		} catch (error) {
+			outcome = options.signal?.aborted ? "aborted" : "error";
+			errorCode = error instanceof LlmError ? error.code : "unknown";
+			throw error;
+		} finally {
+			await timing.close(outcome, errorCode);
+		}
+	}
+	/**
+	* One turn, with at most one output-ceiling downshift.
+	*
+	* The ceiling a model accepts is not published anywhere the request can be
+	* built from (see `modelOutputTokenLimit`), and the endpoint states it only
+	* by refusing. That refusal is worth one retry rather than a failed turn: the
+	* harness's own recovery for it — compact the context — cannot help, because
+	* nothing about the context is wrong, and resending the identical request
+	* would be refused identically (issue #71). Reading the stated ceiling off
+	* the rejection turns one wasted turn into one, for good: it is recorded
+	* process-wide, so the next request for this model is built correctly
+	* without spending the round trip again.
+	*
+	* Only BEFORE the first chunk reaches the host. Once a delta has been
+	* delivered the answer is already partly on screen, and a second request
+	* would duplicate it — so from that point the error stands and says what is
+	* actually wrong. One downshift per turn, and a second refusal surfaces.
+	*/
+	async *streamRequest(options, timing) {
+		for (let attempt = 0;; attempt++) {
+			const connection = this.deps.options();
+			let delivered = false;
+			try {
+				for await (const chunk of this.streamAttempt(options, timing, connection)) {
+					delivered = true;
+					yield chunk;
+				}
+				return;
+			} catch (error) {
+				const ceiling = delivered ? void 0 : outputCeilingRefusal(connection.apiBase, options.model, error);
+				if (attempt > 0 || ceiling === void 0) throw error;
+			}
+		}
+	}
+	async *streamAttempt(options, timing, connection) {
+		this.currentCatalogState(connection);
 		if (options.stop?.length) throw new LlmError("Command Code adapter does not support stop sequences", "UNSUPPORTED_OPTION");
 		const hasImages = options.messages.some(hasImageContent);
 		let readImage;
@@ -4692,30 +6225,51 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			if (!KNOWN_IMAGE_MODELS.has(options.model)) throw new LlmError(`Command Code model "${options.model}" does not support image input; switch to a Vision-capable model (see the model registry)`, "UNSUPPORTED_CONTENT");
 			const attachments = this.resolveAttachments?.();
 			if (attachments === void 0) throw new LlmError("Command Code image input requires the durable attachment service", "UNSUPPORTED_CONTENT");
-			readImage = (ref) => readRequestImage(attachments, ref);
+			readImage = requestImages(attachments, options.signal, timing);
 		}
-		const connection = this.deps.options();
-		let apiKey = await this.deps.resolveApiKey(connection, options.model);
-		const modelMax = this.catalog.find((m) => m.id === options.model)?.maxTokens ?? 65536;
-		const maxTokens = Math.min(options.maxTokens ?? modelMax, modelMax, DEFAULT_GENERATE_MAX_TOKENS);
+		const finishCredentials = timing.phase("credentials");
+		let apiKey;
+		try {
+			apiKey = await this.deps.resolveApiKey(connection, options.model);
+		} finally {
+			finishCredentials();
+		}
+		const modelEntry = this.catalog.find((m) => m.id === options.model);
+		const modelMax = Math.min(modelEntry?.maxTokens ?? Infinity, modelOutputTokenLimit(connection.apiBase, options.model));
+		const requestedMaxTokens = Math.min(options.maxTokens ?? modelMax, modelMax, DEFAULT_GENERATE_MAX_TOKENS);
+		let maxTokens = requestedMaxTokens;
+		let contextBudget = {
+			maxTokens,
+			sizePressure: false
+		};
 		const effort = options.reasoningEffort;
 		const supported = KNOWN_EFFORTS[options.model];
 		const reasoningEffort = effort && effort !== "off" && supported?.includes(effort) ? effort : void 0;
 		const systemText = [options.system ?? "", ...options.messages.filter((m) => m.role === "system").map((m) => m.content.map(blockText).filter(Boolean).join("\n"))].filter(Boolean).join("\n\n");
-		let protocol = this.resolveProtocol(apiKey, options.model);
-		let requestOptions = withSurfaceOffload(options, this.surfaceOffload, REQUEST_IMAGE_BUDGETS[0]);
-		const buildBody = async (target) => target === "cli" ? buildCliBody(requestOptions, connection, {
-			maxTokens,
-			reasoningEffort,
-			systemText,
-			readImage
-		}) : buildOpenAIBody(requestOptions, {
-			maxTokens,
-			reasoningEffort,
-			systemText,
-			readImage
-		});
+		let protocol = this.resolveProtocol(connection.apiBase, apiKey, options.model);
+		let requestOptions = withSurfaceOffload(options, this.surfaceOffload, REQUEST_IMAGE_BUDGETS[0], connection.offloadSeenImagesForCache === true && protocol === "cli" ? options.model : void 0);
+		const buildBody = async (target) => {
+			const finishBody = timing.phase("body");
+			try {
+				const facts = {
+					maxTokens: requestedMaxTokens,
+					reasoningEffort,
+					selectableEffort: supported !== void 0 && supported.length > 0,
+					systemText,
+					readImage
+				};
+				const built = target === "cli" ? await buildCliBody(requestOptions, connection, facts) : target === "messages" ? await buildMessagesBody(requestOptions, facts) : await buildOpenAIBody(requestOptions, facts);
+				contextBudget = requestContextBudget(target, built, requestOptions.messages, options.model, modelEntry?.contextWindow, requestedMaxTokens);
+				maxTokens = contextBudget.maxTokens;
+				if (target === "cli") recordOrEmpty(built.params).max_tokens = maxTokens;
+				else built.max_tokens = maxTokens;
+				return built;
+			} finally {
+				finishBody();
+			}
+		};
 		let body = await buildBody(protocol);
+		const serializedBodies = /* @__PURE__ */ new WeakMap();
 		const trace = openStreamTrace(`${options.provider}/${options.model}`);
 		const tried = /* @__PURE__ */ new Set();
 		let attemptNumber = 0;
@@ -4727,14 +6281,16 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			options,
 			connection,
 			fetchImpl: this.fetchImpl,
+			timing,
 			onResponse: (response) => {
+				this.headerTimeoutStreaks.delete(options.sessionId ?? GLOBAL_HEADER_TIMEOUT_KEY);
 				responseMetadata = {
 					protocol,
 					headers: responseIdentifiers(response.headers)
 				};
 				trace.record("response", {
 					protocol,
-					endpoint: protocol === "cli" ? `${connection.apiBase}/alpha/generate` : `${connection.apiBase}/provider/v1/chat/completions`,
+					endpoint: protocolEndpoint(protocol, connection.apiBase),
 					status: response.status,
 					attempt: attemptNumber,
 					accountsTried: tried.size,
@@ -4758,14 +6314,27 @@ var CommandCodeAdapter = class extends LlmAdapter {
 					sessionId: options.sessionId,
 					...requestFingerprint(protocol, body)
 				});
-				const attempt = await connectGenerate(connectDeps, apiKey, protocol, body);
+				let serialized = serializedBodies.get(body);
+				if (serialized === void 0) {
+					const finishSerialization = timing.phase("serialization");
+					try {
+						serialized = JSON.stringify(body, (_key, value) => sanitizeSurrogates(value));
+					} finally {
+						finishSerialization();
+					}
+					serializedBodies.set(body, serialized);
+				}
+				const attempt = await connectGenerate(connectDeps, apiKey, protocol, serialized);
 				if ("response" in attempt) {
 					connected = attempt;
 					break;
 				}
-				if (protocol === "openai" && isUpgradeRequiredError(attempt.status, attempt.errText)) {
+				const providerError = parseProviderError(attempt.errText);
+				if (protocol !== "cli" && isUpgradeRequiredError(attempt.status, attempt.errText, providerError)) {
+					const wasMessages = protocol === "messages";
 					protocol = "cli";
-					this.rememberProtocol(apiKey, true);
+					if (!wasMessages) this.rememberProtocol(connection.apiBase, apiKey, "cli");
+					requestOptions = withSurfaceOffload(options, this.surfaceOffload, REQUEST_IMAGE_BUDGETS[0], connection.offloadSeenImagesForCache === true ? options.model : void 0);
 					body = await buildBody("cli");
 					continue;
 				}
@@ -4774,7 +6343,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 					if (missing > 0) throw imageOffloadRequired(missing);
 				}
 				const rotate = this.deps.rotateApiKey;
-				const rejection = classifyAccountRejection(attempt.status, attempt.errText);
+				const rejection = classifyAccountRejection(attempt.status, attempt.errText, providerError);
 				if (rejection !== void 0 && rotate !== void 0 && options.signal?.aborted !== true && tried.size < MAX_ACCOUNT_ROTATIONS) {
 					const next = await rotate(apiKey, rejection.reason, connection, options.model, {
 						tried: [...tried],
@@ -4782,17 +6351,26 @@ var CommandCodeAdapter = class extends LlmAdapter {
 					});
 					if (next !== void 0 && !tried.has(next)) {
 						apiKey = next;
+						const nextProtocol = this.resolveProtocol(connection.apiBase, apiKey, options.model);
+						if (nextProtocol !== protocol) {
+							protocol = nextProtocol;
+							requestOptions = withSurfaceOffload(options, this.surfaceOffload, REQUEST_IMAGE_BUDGETS[0], connection.offloadSeenImagesForCache === true && protocol === "cli" ? options.model : void 0);
+							body = await buildBody(protocol);
+						}
 						continue;
 					}
 				}
-				if (rejection !== void 0 && (rejection.reason === "rate-limit" || rejection.reason === "throttled") && (rejection.resetAtMs !== void 0 || attempt.status !== 429)) {
+				if (rejection !== void 0 && (rejection.reason === "rate-limit" || rejection.reason === "throttled")) {
 					const reset = rejection.resetAtMs;
-					const wait = reset === void 0 ? 0 : Math.min(Math.max(1e3, reset - Date.now()), RETRY_MAX_DELAY_MS);
+					const wait = reset === void 0 ? attempt.retryAfterMs ?? 0 : Math.min(Math.max(1e3, reset - Date.now()), RETRY_MAX_DELAY_MS);
 					const when = reset === void 0 ? void 0 : new Date(reset).toISOString();
 					const window = rejection.reason === "rate-limit";
-					throw new LlmError((window ? "llm-commandcode: the Command Code account is rate limited" : "llm-commandcode: the Command Code account is rate limited (429) — the provider did not report an exhausted usage window") + (when === void 0 ? "" : ` — the provider reports it resets at ${when}`) + (window ? "；当前 Command Code 账户已被限流" : "；当前 Command Code 账户被限流（429），服务商未报告用量窗口用尽") + (when === void 0 ? "" : `，服务商给出的重置时间为 ${when}`), "RATE_LIMIT", wait > 0 ? { providerRetryAfterMs: wait } : void 0);
+					throw bilingual(window ? "RATE_LIMIT" : THROTTLED_CODE, (window ? "llm-commandcode: the Command Code account is rate limited" : "llm-commandcode: the Command Code account is rate limited (429) — the provider did not report an exhausted usage window") + (when === void 0 ? "" : ` — the provider reports it resets at ${when}`), (window ? "当前 Command Code 账户已被限流" : "当前 Command Code 账户被限流（429），服务商未报告用量窗口用尽") + (when === void 0 ? "" : `，服务商给出的重置时间为 ${when}`), {
+						status: attempt.status,
+						...wait > 0 && wait <= 9e5 ? { providerRetryAfterMs: wait } : {}
+					});
 				}
-				throw generateHttpError(attempt.status, attempt.errText, attempt.retryAfterMs);
+				throw generateHttpError(attempt.status, attempt.errText, attempt.retryAfterMs, providerError, contextBudget.sizePressure);
 			}
 		} catch (error) {
 			trace.record("connect-error", {
@@ -4800,7 +6378,8 @@ var CommandCodeAdapter = class extends LlmAdapter {
 				responseMetadata
 			});
 			trace.close();
-			throw options.signal?.aborted ? error : failureWithRequestId(error, responseMetadata);
+			if (options.signal?.aborted) throw error;
+			throw failureWithRequestId(this.gradeHeaderTimeout(error, protocol, body, connection.requestTimeoutMs, options.sessionId), responseMetadata);
 		}
 		if (connected === void 0) throw new LlmError("Command Code API connection failed without a response", "TRANSPORT");
 		const { response, cleanup } = connected;
@@ -4860,7 +6439,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 						silentMs: Date.now() - lastChunkAt,
 						message: errorChain(error)
 					});
-					throw new LlmError(`Command Code API stream from ${connection.apiBase} failed while reading: ${errorChain(error)}；Command Code API 流式响应中途断开——网络波动所致，重试通常可恢复`, "TRANSPORT", { cause: error });
+					throw bilingual("TRANSPORT", `Command Code API stream from ${connection.apiBase} failed while reading: ${errorChain(error)}`, "Command Code API 流式响应中途断开——网络波动所致，重试通常可恢复", { cause: error });
 				} finally {
 					clearIdle();
 				}
@@ -4875,11 +6454,12 @@ var CommandCodeAdapter = class extends LlmAdapter {
 						idleFired,
 						buffered: buffer.length
 					});
-					if (idleFired) throw new LlmError(`Command Code API stream from ${connection.apiBase} was idle for ${connection.streamIdleTimeoutMs}ms (no events) and was treated as a dead connection；Command Code API 流式响应已 ${connection.streamIdleTimeoutMs} 毫秒无任何事件，被判定为死连接——长思考模型可在设置中调大流空闲超时`, "TIMEOUT");
+					if (idleFired) throw bilingual("TIMEOUT", `Command Code API stream from ${connection.apiBase} was idle for ${connection.streamIdleTimeoutMs}ms (no events) and was treated as a dead connection`, `Command Code API 流式响应已 ${connection.streamIdleTimeoutMs} 毫秒无任何事件，被判定为死连接——长思考模型可在设置中调大流空闲超时`);
 					if (buffer.trim()) yield* handle(parseStreamEventLine(buffer));
 					break;
 				}
 				const text = decoder.decode(value, { stream: true });
+				if (value.byteLength > 0) timing.first("firstByteMs");
 				buffer += text;
 				chunkCount += 1;
 				totalBytes += value.byteLength;
@@ -4917,9 +6497,13 @@ var CommandCodeAdapter = class extends LlmAdapter {
 				});
 				endRecorded = true;
 				if (failure !== void 0) throw failure;
-				yield hasResponseIdentifiers(responseMetadata) ? {
+				const replayBlocks = asm.replayBlocks;
+				yield hasResponseIdentifiers(responseMetadata) || replayBlocks.length > 0 ? {
 					...finish,
-					replayState: { response: responseMetadata }
+					replayState: {
+						response: responseMetadata,
+						...replayBlocks.length > 0 ? { blocks: replayBlocks } : {}
+					}
 				} : finish;
 			} else {
 				const elapsed = Date.now() - streamStartedAt;
@@ -4933,8 +6517,8 @@ var CommandCodeAdapter = class extends LlmAdapter {
 					responseMetadata
 				});
 				endRecorded = true;
-				if (!asm.sawContent) throw new LlmError("Command Code returned an empty response；Command Code 返回了空响应，重试通常可恢复", "EMPTY_RESPONSE");
-				throw new LlmError(`Command Code API stream from ${connection.apiBase} ended before its finish event (${detail}) — the response was closed mid-generation, so this is not the model stopping by itself；Command Code API 流式响应在结束事件之前被关闭（生成中途断流），并非模型主动结束——请重试；若频繁出现，可用 ${STREAM_TRACE_ENV}=<文件路径> 抓取原始流以定位断流原因`, "STREAM_CLOSED");
+				if (!asm.sawContent) throw bilingual("EMPTY_RESPONSE", "Command Code returned an empty response", "Command Code 返回了空响应，重试通常可恢复");
+				throw bilingual("STREAM_CLOSED", `Command Code API stream from ${connection.apiBase} ended before its finish event (${detail}) — the response was closed mid-generation, so this is not the model stopping by itself`, `Command Code API 流式响应在结束事件之前被关闭（生成中途断流），并非模型主动结束——请重试；若频繁出现，可用 ${STREAM_TRACE_ENV}=<文件路径> 抓取原始流以定位断流原因`);
 			}
 		} catch (error) {
 			if (!usageEmitted && usage !== void 0) yield {
@@ -4964,43 +6548,66 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	}
 };
 /**
-* Map a pre-stream generate HTTP failure onto a stable LlmError. Command
-* Code folds several business rejections into 403 (plan limits, CLI version,
-* model access): prefer the machine-readable `error.code` when present; the
-* status alone cannot distinguish them. The status also decides the failure
-* CODE via {@link httpErrorCode}, which is what the retry policy routes on —
-* a transient 5xx must not be reported as a permanent provider rejection. A
-* 429's `Retry-After` header rides along as `providerRetryAfterMs` so
-* dsh-llm-retry can wait exactly that long instead of guessing at the backoff
-* cadence — capped at RETRY_MAX_DELAY_MS, because in normal mode a longer
-* attached wait makes the executor abandon the retry outright.
-*
-* One body is read, not just its status: a client-side rejection whose
-* `error.code`/`type`/`message` names the model context window is reported as
-* `CONTEXT_WINDOW_EXCEEDED`, because that failure has a recovery the harness
-* performs and a generic provider error does not. Every message built here is
-* bilingual — the harness renders it verbatim in its retry chrome.
-*/
-function generateHttpError(status, errText, retryAfterMs) {
-	let providerCode;
-	let providerDetail = "";
+* Unwrap one level of a double-encoded provider message.
+*
+* The Messages endpoint sometimes reports a rejection with `error.message`
+* holding a whole JSON document rather than the sentence
+* (`{"type":"error","error":{"type":"invalid_request_error","message":"{\"type\":
+* \"error\",…}"},"request_id":"req_…"}`, measured 2026-09-29). Showing that blob
+* to the user hides the actual refusal, so one nesting level is peeled; the
+* outer text is returned unchanged when it is not JSON or carries no message.
+*/
+function unwrapProviderMessage(raw) {
+	if (raw === void 0) return void 0;
+	const trimmed = raw.trim();
+	if (!trimmed.startsWith("{")) return raw;
+	try {
+		const inner = JSON.parse(trimmed);
+		if (!isRecord(inner)) return raw;
+		return stringValue(((isRecord(inner.error) ? inner.error : void 0) ?? inner).message) ?? raw;
+	} catch {
+		return raw;
+	}
+}
+/** Parse a rejected body once, retaining the nested/root distinction. */
+function parseProviderError(errText) {
 	try {
 		const parsed = JSON.parse(errText);
-		if (isRecord(parsed) && isRecord(parsed.error)) {
-			providerCode = stringValue(parsed.error.code);
-			providerDetail = [
-				stringValue(parsed.error.code),
-				stringValue(parsed.error.type),
-				stringValue(parsed.error.message)
-			].filter((part) => part !== void 0 && part !== "").join(" ");
-		}
-	} catch {}
+		if (!isRecord(parsed)) return { message: errText };
+		const nested = isRecord(parsed.error) ? parsed.error : void 0;
+		const body = nested ?? parsed;
+		const rawMessage = stringValue(body.message);
+		return {
+			root: parsed,
+			nested,
+			code: stringValue(body.code),
+			type: stringValue(body.type),
+			rawMessage,
+			message: unwrapProviderMessage(rawMessage) ?? errText,
+			rateLimit: isRecord(body.rateLimit) ? body.rateLimit : void 0
+		};
+	} catch {
+		return { message: errText };
+	}
+}
+function generateHttpError(status, errText, retryAfterMs, parsed = parseProviderError(errText), sizePressure = false) {
+	const providerCode = parsed.nested === void 0 ? void 0 : parsed.code;
+	const providerDetail = parsed.nested === void 0 ? "" : [
+		parsed.code,
+		parsed.type,
+		parsed.rawMessage ?? parsed.message
+	].filter((part) => part !== void 0 && part !== "").join(" ");
 	const detail = providerCode ?? `HTTP ${status}`;
 	const overflowDetail = providerDetail !== "" ? providerDetail : errText.slice(0, 500);
-	if (status < 500 && isContextOverflowDetail(overflowDetail)) return new LlmError(`Command Code API error ${status}: the request exceeds the model's context window — this session is being compacted and the request retried；Command Code API 返回 ${status}：请求内容超出模型上下文窗口——正在压缩上下文后重试；如仍失败，请新建会话或减少上下文`, CONTEXT_WINDOW_EXCEEDED_CODE, { status });
-	if (status === 422 && isZdrNoProviders(providerCode, providerDetail, errText)) return new LlmError(`Command Code API error 422 (${detail}): zero data retention is enforced but no ZDR-capable upstream is available for this model — turn the ZDR setting off (or use another model)；Command Code API 返回 422：已开启零数据保留（ZDR），但该模型当前没有可用的 ZDR 上游——请关闭 ZDR 开关，或改用其他模型`, "PROVIDER_HTTP_ERROR", { status: 422 });
-	if (status === 401) return new LlmError(`Command Code API error 401 (${detail}): the API key is missing or invalid — check the key stored for COMMANDCODE_API_KEY (Models page) or the auth file；Command Code API 返回 401：API 密钥缺失或无效——请在设置页检查 COMMANDCODE_API_KEY 存储的密钥，或检查 auth 文件`, "INVALID_CREDENTIAL", { status: 401 });
-	if (status === 413) return new LlmError("Command Code API error 413: the request body exceeds the provider's size limit (the cap is undocumented, measured at about 50 MB) — the session history is too large to send, usually because of accumulated image attachments. Start a new session, or drop the image-heavy part of this one, and retry；Command Code API 返回 413：请求体超过服务端的体积上限（官方未公开，实测约 50 MB）——会话历史过大，通常是历史图片累积所致。请新建会话，或移除本会话中图片较多的部分后重试", "PROVIDER_HTTP_ERROR", { status: 413 });
+	if (status < 500 && OUTPUT_LIMIT_REJECTION.test(overflowDetail)) {
+		const stated = /max_tokens:\s*\d+\s*>\s*\d+/.exec(overflowDetail)?.[0] ?? (parsed.message !== void 0 && parsed.message.length <= 200 ? parsed.message : void 0);
+		return bilingual("PROVIDER_HTTP_ERROR", `Command Code API error ${status}: this request's max_tokens is not valid for this model` + (stated ? ` (${stated})` : "") + " — the session is not oversized, so compacting it will not help; lower \"Max output tokens\" or pick a model with a larger output ceiling", `Command Code API 返回 ${status}：本次请求的 max_tokens 对该模型不合法` + (stated ? `（${stated}）` : "") + "——会话内容并未超长，压缩上下文无效；请调低「最大输出 token」或改用输出上限更大的模型", { status });
+	}
+	if (status < 500 && isContextOverflowDetail(overflowDetail)) return bilingual(CONTEXT_WINDOW_EXCEEDED_CODE, `Command Code API error ${status}: the request exceeds the model's context window — this session is being compacted and the request retried`, `Command Code API 返回 ${status}：请求内容超出模型上下文窗口——正在压缩上下文后重试；如仍失败，请新建会话或减少上下文`, { status });
+	if (status === 400 && sizePressure && AMBIGUOUS_SIZE_REJECTION.test(providerDetail) && /\bprovider_error\b/i.test(providerDetail)) return bilingual(CONTEXT_WINDOW_EXCEEDED_CODE, "Command Code API error 400: the provider could not complete a request near the model context limit — compacting the session and retrying", "Command Code API 返回 400：请求接近模型上下文上限，服务商无法完成——正在压缩上下文后重试", { status });
+	if (status === 422 && isZdrNoProviders(providerCode, providerDetail, errText)) return bilingual("PROVIDER_HTTP_ERROR", `Command Code API error 422 (${detail}): zero data retention is enforced but no ZDR-capable upstream is available for this model — turn the ZDR setting off (or use another model)`, "Command Code API 返回 422：已开启零数据保留（ZDR），但该模型当前没有可用的 ZDR 上游——请关闭 ZDR 开关，或改用其他模型", { status: 422 });
+	if (status === 401) return bilingual("INVALID_CREDENTIAL", `Command Code API error 401 (${detail}): the API key is missing or invalid — check the key stored for COMMANDCODE_API_KEY (Models page) or the auth file`, "Command Code API 返回 401：API 密钥缺失或无效——请在设置页检查 COMMANDCODE_API_KEY 存储的密钥，或检查 auth 文件", { status: 401 });
+	if (status === 413) return bilingual("PROVIDER_HTTP_ERROR", "Command Code API error 413: the request body exceeds the provider's size limit (the cap is undocumented, measured at about 50 MB) — the session history is too large to send, usually because of accumulated image attachments. Start a new session, or drop the image-heavy part of this one, and retry", "Command Code API 返回 413：请求体超过服务端的体积上限（官方未公开，实测约 50 MB）——会话历史过大，通常是历史图片累积所致。请新建会话，或移除本会话中图片较多的部分后重试", { status: 413 });
 	return new LlmError(`Command Code API error ${status}${detail === `HTTP ${status}` ? "" : ` (${detail})`}: ${errText.slice(0, 500)}`, httpErrorCode(status), {
 		status,
 		...retryAfterMs !== void 0 && retryAfterMs > 0 && retryAfterMs <= 9e5 ? { providerRetryAfterMs: retryAfterMs } : {}
@@ -5019,7 +6626,7 @@ function generateHttpError(status, errText, retryAfterMs) {
 * rejection repeats identically on every attempt.
 */
 function httpErrorCode(status) {
-	if (status === 429) return "RATE_LIMIT";
+	if (status === 429) return THROTTLED_CODE;
 	if (status === 408) return "TIMEOUT";
 	if (status >= 500) return "SERVER";
 	return "PROVIDER_HTTP_ERROR";
@@ -5239,8 +6846,195 @@ function handleOpenAIEvent(asm, event) {
 	return chunks;
 }
 /** Dispatch one parsed stream event to the active transport's handler. */
+/**
+* Messages `usage` → the harness meter.
+*
+* The field names are the Anthropic ones, and unlike Chat Completions
+* `input_tokens` already excludes cache reads and writes, so it is mapped
+* as-is rather than reduced (the shape `dsh-llm-deepseek` implements).
+* Measured 2026-09-29: `{ input_tokens, cache_creation_input_tokens,
+* cache_read_input_tokens, output_tokens, output_tokens_details:
+* { thinking_tokens } }`, plus gateway additions the meter ignores.
+*/
+function mapMessagesUsage(raw) {
+	if (!isRecord(raw)) return void 0;
+	const inputTokens = numberValue(raw.input_tokens) ?? 0;
+	const outputTokens = numberValue(raw.output_tokens) ?? 0;
+	const cacheRead = numberValue(raw.cache_read_input_tokens) ?? 0;
+	const cacheWrite = numberValue(raw.cache_creation_input_tokens) ?? 0;
+	const reasoningTokens = numberValue((isRecord(raw.output_tokens_details) ? raw.output_tokens_details : void 0)?.thinking_tokens);
+	const usage = {
+		inputTokens: Math.max(0, inputTokens),
+		outputTokens,
+		cacheReadTokens: cacheRead
+	};
+	if (cacheWrite > 0) usage.cacheWriteTokens = cacheWrite;
+	if (reasoningTokens !== void 0) usage.reasoningTokens = reasoningTokens;
+	return usage;
+}
+/** The harness block type one Messages content block maps to. */
+function messagesBlockType(native) {
+	if (native.type === "text") return "text";
+	if (native.type === "thinking") return "reasoning";
+	if (native.type === "tool_use") return "tool-call";
+}
+/**
+* Handle one Messages-transport stream event, appending harness StreamChunks.
+*
+* The event sequence is the Anthropic one measured on 2026-09-29:
+* `message_start`, then per content block `content_block_start` /
+* `content_block_delta`* / `content_block_stop`, then `message_delta`
+* (carrying `stop_reason` and the final usage) and `message_stop`. A `ping`
+* keepalive interleaves freely and carries no content. The terminal chunks are
+* NOT emitted here: `stream()` holds the success finish until it has validated
+* the assembled answer, and it attaches the replay envelope.
+*/
+function handleMessagesEvent(asm, event) {
+	const chunks = [];
+	if (!isRecord(event)) return chunks;
+	switch (event.type) {
+		case "message_start": {
+			const usage = mapMessagesUsage((isRecord(event.message) ? event.message : void 0)?.usage);
+			if (usage) chunks.push({
+				type: "usage",
+				usage
+			});
+			break;
+		}
+		case "content_block_start": {
+			const wireIndex = numberValue(event.index);
+			const native = isRecord(event.content_block) ? event.content_block : void 0;
+			const type = native ? messagesBlockType(native) : void 0;
+			if (wireIndex === void 0 || type === void 0) break;
+			const chunkIndex = asm.nextIndex++;
+			const state = {
+				type,
+				text: stringValue(native?.text) ?? "",
+				signature: stringValue(native?.signature) ?? "",
+				json: "",
+				id: stringValue(native?.id) ?? "",
+				name: stringValue(native?.name) ?? "",
+				chunkIndex
+			};
+			asm.messagesBlocks.set(wireIndex, state);
+			asm.replayBlocks[chunkIndex] = { type };
+			chunks.push({
+				type: "block-start",
+				index: chunkIndex,
+				blockType: type
+			});
+			if (type === "tool-call" && state.id !== "") chunks.push({
+				type: "tool-call-delta",
+				index: chunkIndex,
+				id: ToolCallId(state.id),
+				name: state.name,
+				argumentsDelta: ""
+			});
+			break;
+		}
+		case "content_block_delta": {
+			const wireIndex = numberValue(event.index);
+			const state = wireIndex === void 0 ? void 0 : asm.messagesBlocks.get(wireIndex);
+			const delta = isRecord(event.delta) ? event.delta : void 0;
+			if (!state || !delta) break;
+			const index = state.chunkIndex;
+			if (delta.type === "text_delta" && state.type === "text") {
+				const text = stringValue(delta.text) ?? "";
+				state.text += text;
+				if (text.trim() !== "") asm.sawContent = true;
+				chunks.push({
+					type: "text-delta",
+					index,
+					text
+				});
+			} else if (delta.type === "thinking_delta" && state.type === "reasoning") {
+				const text = stringValue(delta.thinking) ?? "";
+				state.text += text;
+				chunks.push({
+					type: "reasoning-delta",
+					index,
+					text
+				});
+			} else if (delta.type === "signature_delta" && state.type === "reasoning") {
+				state.signature += stringValue(delta.signature) ?? "";
+				const entry = asm.replayBlocks[index];
+				if (entry) entry.signature = state.signature;
+			} else if (delta.type === "input_json_delta" && state.type === "tool-call") {
+				const fragment = stringValue(delta.partial_json) ?? "";
+				state.json += fragment;
+				chunks.push({
+					type: "tool-call-delta",
+					index,
+					id: ToolCallId(state.id),
+					name: state.name,
+					argumentsDelta: fragment
+				});
+			}
+			break;
+		}
+		case "content_block_stop": {
+			const wireIndex = numberValue(event.index);
+			if (wireIndex === void 0) break;
+			const state = asm.messagesBlocks.get(wireIndex);
+			if (!state) break;
+			asm.messagesBlocks.delete(wireIndex);
+			const index = state.chunkIndex;
+			if (state.type === "text") {
+				if (state.text.trim() !== "") asm.sawContent = true;
+				chunks.push({
+					type: "block-end",
+					index,
+					block: {
+						type: "text",
+						text: state.text
+					}
+				});
+			} else if (state.type === "reasoning") chunks.push({
+				type: "block-end",
+				index,
+				block: {
+					type: "reasoning",
+					text: state.text
+				}
+			});
+			else {
+				if (state.id !== "") asm.sawContent = true;
+				chunks.push({
+					type: "block-end",
+					index,
+					block: {
+						type: "tool-call",
+						id: ToolCallId(state.id),
+						name: state.name,
+						arguments: state.json || "{}"
+					}
+				});
+			}
+			break;
+		}
+		case "message_delta": {
+			const reason = stringValue((isRecord(event.delta) ? event.delta : void 0)?.stop_reason);
+			if (reason !== void 0) asm.finishReason = reason;
+			const usage = mapMessagesUsage(event.usage);
+			if (usage) chunks.push({
+				type: "usage",
+				usage
+			});
+			chunks.push({
+				type: "finish",
+				reason: mapFinishReason(reason)
+			});
+			break;
+		}
+		case "message_stop":
+		case "ping": break;
+		case "error": throw streamErrorToLlmError(event.error ?? event, stringValue(event.message));
+	}
+	return chunks;
+}
 function handleEvent(asm, protocol, event) {
-	return protocol === "openai" ? handleOpenAIEvent(asm, event) : handleCliEvent(asm, event);
+	if (protocol === "cli") return handleCliEvent(asm, event);
+	return protocol === "messages" ? handleMessagesEvent(asm, event) : handleOpenAIEvent(asm, event);
 }
 /**
 * Parse an HTTP `Retry-After` value (delay-seconds or an HTTP-date) into
@@ -5269,16 +7063,16 @@ function parseRetryAfterMs(value, now = Date.now()) {
 * one function serves both — a new reason cannot drift between them.
 */
 function mapFinishReason(reason) {
-	if (reason === "tool-calls" || reason === "tool_calls") return { kind: "tool-calls" };
+	if (reason === "tool-calls" || reason === "tool_calls" || reason === "tool_use") return { kind: "tool-calls" };
 	if (reason === "length" || reason === "max_tokens" || reason === "max-tokens" || reason === "max_output_tokens") return { kind: "max-tokens" };
 	return { kind: "stop" };
 }
 /** A terminal marker without text or tools is a failed attempt, not a completed turn. */
 function emptyCompletionError(reason, maxTokens, usage) {
 	const detail = `finish_reason=${reason ?? "unknown"}, max_tokens=${maxTokens}, outputTokens=${usage?.outputTokens ?? "unknown"}, reasoningTokens=${usage?.reasoningTokens ?? "unknown"}`;
-	if (mapFinishReason(reason).kind === "max-tokens") return new LlmError(`Command Code reached the output token limit without producing answer text or a tool call (${detail})；Command Code 已达到输出 token 上限，但没有生成正文或工具调用；请调整思考强度，或在模型和接口上限内增加输出预算`, "OUTPUT_TOKEN_LIMIT");
-	if (reason === "content_filter" || reason === "content-filter") return new LlmError(`Command Code filtered the response (${detail})；Command Code 拦截了响应，未生成正文或工具调用`, "CONTENT_FILTER");
-	return new LlmError(`Command Code finished without producing answer text or a tool call (${detail})；Command Code 返回了空响应（可能只有思考内容），重试通常可恢复`, "EMPTY_RESPONSE");
+	if (mapFinishReason(reason).kind === "max-tokens") return bilingual("OUTPUT_TOKEN_LIMIT", `Command Code reached the output token limit without producing answer text or a tool call (${detail})`, "Command Code 已达到输出 token 上限，但没有生成正文或工具调用；请调整思考强度，或在模型和接口上限内增加输出预算");
+	if (reason === "content_filter" || reason === "content-filter") return bilingual("CONTENT_FILTER", `Command Code filtered the response (${detail})`, "Command Code 拦截了响应，未生成正文或工具调用");
+	return bilingual("EMPTY_RESPONSE", `Command Code finished without producing answer text or a tool call (${detail})`, "Command Code 返回了空响应（可能只有思考内容），重试通常可恢复");
 }
 /**
 * Classify a pre-stream rejection that is about the ACCOUNT rather than about
@@ -5322,9 +7116,10 @@ const ACCOUNT_UNAVAILABLE_CODES = /* @__PURE__ */ new Set([
 	"PREMIUM_CREDITS_EXHAUSTED",
 	"MODEL_NOT_IN_PLAN"
 ]);
-function classifyAccountRejection(status, errText) {
-	if (status === 429 || readProviderErrorCode(errText)?.toUpperCase() === "RATE_LIMITED") {
-		const evidence = readWindowLimitEvidence(errText);
+function classifyAccountRejection(status, errText, parsed = parseProviderError(errText)) {
+	const code = (parsed.code ?? parsed.type)?.toUpperCase();
+	if (status === 429 || code === "RATE_LIMITED") {
+		const evidence = readWindowLimitEvidence(errText, parsed);
 		if (evidence.window === void 0) return { reason: "throttled" };
 		return evidence.resetAtMs === void 0 ? { reason: "rate-limit" } : {
 			reason: "rate-limit",
@@ -5332,23 +7127,11 @@ function classifyAccountRejection(status, errText) {
 		};
 	}
 	if (status === 401) return { reason: "invalid-credential" };
-	const code = readProviderErrorCode(errText)?.toUpperCase();
 	if (code !== void 0 && ACCOUNT_UNAVAILABLE_CODES.has(code)) return { reason: "unavailable" };
 	if (status < 400 || status >= 500) return void 0;
 	const lower = errText.toLowerCase().replaceAll("_", " ");
 	if (lower.includes("insufficient credits") || lower.includes("premium credits exhausted") || lower.includes("model not in plan") || /insufficient (credit|balance)/.test(lower) || /out of credit/.test(lower) || /not (available|included)[^.]{0,40}plan/.test(lower) || lower.includes("upgrade your plan")) return { reason: "unavailable" };
 }
-/** The machine-readable `error.code`/`error.type` of a pre-stream failure body. */
-function readProviderErrorCode(errText) {
-	try {
-		const parsed = JSON.parse(errText);
-		if (!isRecord(parsed)) return void 0;
-		const error = isRecord(parsed.error) ? parsed.error : parsed;
-		return stringValue(error.code) ?? stringValue(error.type);
-	} catch {
-		return;
-	}
-}
 /**
 * How far ahead a provider-published reset may be and still be trusted.
 *
@@ -5376,20 +7159,10 @@ const MAX_TRUSTED_RESET_MS = 2592e6;
 * message is honored as the fallback. Either can be present without the other;
 * the window label is what decides the classification.
 */
-function readWindowLimitEvidence(errText) {
-	let named;
-	let message = "";
-	let seconds;
-	try {
-		const parsed = JSON.parse(errText);
-		if (isRecord(parsed)) {
-			const error = isRecord(parsed.error) ? parsed.error : parsed;
-			const rateLimit = isRecord(error.rateLimit) ? error.rateLimit : void 0;
-			named = stringValue(rateLimit?.window);
-			message = stringValue(error.message) ?? stringValue(parsed.message) ?? "";
-			seconds = numberValue(rateLimit?.reset);
-		}
-	} catch {}
+function readWindowLimitEvidence(errText, parsed) {
+	const named = stringValue(parsed.rateLimit?.window);
+	const message = parsed.message ?? stringValue(parsed.root?.message) ?? "";
+	const seconds = numberValue(parsed.rateLimit?.reset);
 	const window = named === "fiveHour" || named === "weekly" || named === "daily" ? named : /usage limit for your plan/i.test(message) || /usage limit for your plan/i.test(errText) ? /weekly/i.test(message) ? "weekly" : "fiveHour" : void 0;
 	const stamp = /resets at (\d{4}-\d{2}-\d{2}T[\d:.]+Z)/i.exec(message)?.[1] ?? /resets at (\d{4}-\d{2}-\d{2}T[\d:.]+Z)/i.exec(errText)?.[1];
 	const stamped = stamp === void 0 ? void 0 : Date.parse(stamp);
@@ -5407,24 +7180,15 @@ function readWindowLimitEvidence(errText) {
 * other 4xx/5xx must surface as ordinary errors so real account/model
 * problems are not masked.
 */
-function isUpgradeRequiredError(status, errText) {
+function isUpgradeRequiredError(status, errText, parsed = parseProviderError(errText)) {
 	if (status !== 403) return false;
 	const lower = errText.toLowerCase();
 	if (lower.includes("upgrade_required")) return true;
 	if (lower.includes("go plan") && lower.includes("api access")) return true;
 	if (lower.includes("only plan without api access")) return true;
 	if (lower.includes("upgrade to goat or higher")) return true;
-	try {
-		const parsed = JSON.parse(errText);
-		if (isRecord(parsed)) {
-			const error = isRecord(parsed.error) ? parsed.error : parsed;
-			if ((stringValue(error.code) ?? stringValue(error.type))?.toLowerCase() === "upgrade_required") return true;
-			const message = stringValue(error.message) ?? "";
-			if (message.toLowerCase().includes("go plan") && message.toLowerCase().includes("api access")) return true;
-		}
-	} catch {
-		return false;
-	}
+	if ((parsed.code ?? parsed.type)?.toLowerCase() === "upgrade_required") return true;
+	if (parsed.message?.toLowerCase().includes("go plan") && parsed.message.toLowerCase().includes("api access")) return true;
 	return false;
 }
 /** Map an OpenAI Chat Completions usage payload to harness disjoint counts. */
@@ -5532,33 +7296,42 @@ function commandCopy(locale, key) {
 	return commandcodeCommand[locale][key] ?? commandcodeCommand.en[key] ?? key;
 }
 //#endregion
-//#region src/commands.ts
-function money(value) {
-	return `$${value.toFixed(4)}`;
-}
-/** Compact dollar amount (2 decimals), for the summary and window rows. */
-function moneyShort(value) {
+//#region src/display-format.ts
+/** Shared, dependency-free formatting for Host commands and browser surfaces. */
+function formatMoney(value) {
 	return `$${value.toFixed(2)}`;
 }
-/** Format a large token count compactly (1.9M style). */
-function tokensCompact(value) {
+function formatMoneyExact(value) {
+	return `$${value.toFixed(4)}`;
+}
+function formatTokensCompact(value) {
 	if (value >= 1e9) return `${(value / 1e9).toFixed(1)}B`;
 	if (value >= 1e6) return `${(value / 1e6).toFixed(1)}M`;
 	if (value >= 1e3) return `${(value / 1e3).toFixed(1)}K`;
 	return String(value);
 }
-/**
-* Success-rate percentage (already in percent units): at most two decimals,
-* trailing zeros trimmed — mirrors `formatSuccessRate` in
-* `./client/usage.ts`, which the settings card uses.
-*/
-function successRateText(value) {
+/** The input is already in percent units; callers add the percent sign. */
+function formatSuccessRate(value) {
 	return String(Number(value.toFixed(2)));
 }
+/** One window's fill ratio in [0, 1]; zero when uncapped. */
+function windowRatio(used, cap) {
+	if (cap <= 0) return 0;
+	return Math.max(0, Math.min(1, used / cap));
+}
+/** Local date-time, with the empty state chosen by the caller. */
+function formatResetAt(ms) {
+	return ms <= 0 ? "" : new Date(ms).toLocaleString();
+}
+//#endregion
+//#region src/commands.ts
+const money = formatMoneyExact;
+const moneyShort = formatMoney;
+const tokensCompact = formatTokensCompact;
+const successRateText = formatSuccessRate;
 /** A local date, or `n/a` when the provider published no reset time. */
 function resetLabel(ms) {
-	if (ms <= 0) return "n/a";
-	return new Date(ms).toLocaleString();
+	return formatResetAt(ms) || "n/a";
 }
 /**
 * A 10-cell horizontal bar: `██████████` for 100%, `███░░░░░░░` for ~33%.
@@ -5566,7 +7339,7 @@ function resetLabel(ms) {
 */
 function bar(used, cap) {
 	if (cap <= 0) return "—";
-	const ratio = Math.max(0, Math.min(1, used / cap));
+	const ratio = windowRatio(used, cap);
 	const filled = Math.round(ratio * 10);
 	return "█".repeat(filled) + "░".repeat(10 - filled);
 }
@@ -5849,7 +7622,7 @@ const MODELS_ENDPOINT = "commandcode/models";
 * separate instance so catalog boundary errors name `commandcode/models`,
 * not the report endpoint.
 */
-const { record: catalogRecord, stringField: catalogString } = makeBoundaryValidator("commandcode/models result:");
+const { record: catalogRecord, stringField: catalogString, numberField: catalogNumber } = makeBoundaryValidator("commandcode/models result:");
 /** Parse one untrusted boundary value into a {@link CommandCodeCatalogModel}. */
 function parseCatalogModel(value) {
 	const source = catalogRecord(value, "model");
@@ -5858,6 +7631,7 @@ function parseCatalogModel(value) {
 		name: catalogString(source, "name", "model.name")
 	};
 	if (source.tier !== void 0) model.tier = catalogString(source, "tier", "model.tier");
+	if (source.allowance !== void 0) model.allowance = catalogNumber(source, "allowance", "model.allowance");
 	return model;
 }
 /** Parse the wire result into a {@link CommandCodeCatalog}. */
@@ -5999,12 +7773,17 @@ function loginDescriptor(endpoint, method) {
 		}]
 	} : descriptor;
 }
-/** The three login descriptors, shared verbatim by Host registration and Client mount. */
-const LOGIN_DESCRIPTORS = [
-	loginDescriptor(LOGIN_BEGIN_ENDPOINT, "loginBegin"),
-	loginDescriptor(LOGIN_STATUS_ENDPOINT, "loginStatus"),
-	loginDescriptor(LOGIN_CANCEL_ENDPOINT, "loginCancel")
-];
+/** The Host-face contribution fragment registered on `ctx.typert`. */
+const LOGIN_HOST_CONTRIBUTION = {
+	package: REMOTE_PACKAGE,
+	face: "host",
+	schemas: [],
+	invocations: [
+		loginDescriptor(LOGIN_BEGIN_ENDPOINT, "loginBegin"),
+		loginDescriptor(LOGIN_STATUS_ENDPOINT, "loginStatus"),
+		loginDescriptor(LOGIN_CANCEL_ENDPOINT, "loginCancel")
+	]
+};
 //#endregion
 //#region src/usage-remote.ts
 /**
@@ -6093,7 +7872,7 @@ function applyUsageRemote(ctx, deps) {
 				...USAGE_HOST_CONTRIBUTION.invocations,
 				MODELS_DESCRIPTOR,
 				PRICES_DESCRIPTOR,
-				...LOGIN_DESCRIPTORS
+				...LOGIN_HOST_CONTRIBUTION.invocations
 			]
 		});
 		remoteCtx.effect(() => () => void unregister(), "dsh-commandcode-provider: usage remote");
@@ -6810,22 +8589,8 @@ var CommandCodeSearchProvider = class {
 const ACTIVE_ACCOUNT_AUTO = "auto";
 /** The selector value meaning "no language override — follow the shell locale". */
 const LANG_AUTO = "auto";
-/** Tier display names, mirroring the web dropdown's headings (`model-select.ts`). */
-const TIER_TITLES = {
-	go: "Go",
-	goat: "GOAT",
-	pro: "Pro",
-	provider: "Provider",
-	max: "Max"
-};
 /** Tiers in picker order; a model outside this set joins the "Other" group. */
-const TIER_ORDER = [
-	"go",
-	"goat",
-	"pro",
-	"provider",
-	"max"
-];
+const TIER_ORDER = PLAN_TIER_ORDER;
 /** The group holding models this build's catalog does not know. */
 const OTHER_GROUP_ID = "models-other";
 /**
@@ -6883,8 +8648,8 @@ function buildCommandCodeTuiSection(deps) {
 	const extras = [.../* @__PURE__ */ new Set([...stored, ...Object.keys(overrides)])].filter((id) => !known.has(id));
 	const tierGroups = TIER_ORDER.filter((tier) => choices.some((choice) => choice.tier === tier)).map((tier) => ({
 		id: `models-${tier}`,
-		title: `${TIER_TITLES[tier] ?? tier} models`,
-		descriptions: { zh: `${TIER_TITLES[tier] ?? tier} 模型` }
+		title: `${PLAN_LABELS[tier] ?? tier} models`,
+		descriptions: { zh: `${PLAN_LABELS[tier] ?? tier} 模型` }
 	}));
 	const unranked = choices.filter((choice) => tierRank(choice.tier) === TIER_ORDER.length);
 	const otherGroup = unranked.length > 0 || extras.length > 0 ? [{
@@ -6989,6 +8754,20 @@ function buildCommandCodeTuiSection(deps) {
 					value: text.trim() === "true"
 				})
 			},
+			{
+				path: ["offloadSeenImagesForCache"],
+				group: "advanced",
+				kind: "boolean",
+				label: "Stop replaying images already seen",
+				descriptions: { zh: "已看过的图片不再重复发送" },
+				hint: "CLI transport only. After this model has answered, durably replace older images with text to keep later prompt text cacheable. Old pixels need a fresh file read or attachment to inspect again. Off by default.",
+				hintDescriptions: { zh: "仅 CLI 传输。模型看过图片并回复后，永久用文字替代旧图，以保留后续文本缓存；重看旧图需要重新读取文件或附加。默认关闭。" },
+				format: (value) => value === true ? "true" : "false",
+				parse: (text) => ({
+					kind: "set",
+					value: text.trim() === "true"
+				})
+			},
 			{
 				path: ["filterModelsByPlan"],
 				group: "models",
@@ -7149,27 +8928,18 @@ function applyCommandCodeTuiSettings(ctx, deps) {
 * A bounded retry budget for `TRANSPORT` failures (issue #39, second report).
 *
 * The route policy (`providerRetryPolicy` in `./adapter.ts`) is near-unbounded
-* on purpose — 1000 attempts doubling to a 15-minute cap — because it exists
-* for failures the provider ASKS to have retried, where the wait is the point.
-* A connection that cannot be established is not that: either a blip the first
-* few attempts absorb, or an outage no in-request waiting fixes (and its waits
-* count BEFORE each attempt, so attempt 11 alone already waits 512 s). So
-* transport failures get their own budget; waiting out a real outage is the
-* user's call, and the next send starts a fresh budget.
-*
-* Not counted here: the pre-stream recovery the ADAPTER performs inside one
-* `stream()` call (account rotation, the 413 image-budget step-down, the
-* Provider-API → CLI switch) — invisible to the caller and bounded on its own.
-* This budget caps only the harness's retry loop.
-*
-* Reset rule: the budget clears at each new STEP (one step = one model request).
-* `agent/status` → `idle` is NOT it, though it looks natural: the loop's
-* `setPhase` emits it only on a status CHANGE, and a turn's steps all run inside
-* one `running` phase, so a reset there would fail every later step of an outage
-* turn at once instead of retrying each. `assistant/attempt` is wrong the other
-* way — the loop appends it for the FAILED attempt itself, before dispatching
-* `agent/request-error`, so resetting on it would clear the budget on every
-* failure and restore the very loop this module exists to stop.
+* on purpose — 1000 attempts doubling to a 15-minute cap — for failures the
+* provider ASKS to have retried. A connection that cannot be established is
+* not that: a blip the first few attempts absorb, or an outage no in-request
+* waiting fixes (attempt 11 alone already waits 512 s). So transport failures
+* get their own budget, cleared at each new STEP (one step = one model
+* request). `agent/status` → `idle` is NOT the reset (one `running` phase spans
+* a turn's steps), and neither is `assistant/attempt` (appended for the FAILED
+* attempt itself, which would clear the budget on every failure).
+*
+* Not counted here: the adapter's in-`stream()` pre-stream recovery (account
+* rotation, the 413 step-down, the Provider-API → CLI switch) — invisible to
+* the caller and bounded on its own.
 *
 * @module
 */
@@ -7251,7 +9021,7 @@ function transportBudgetMessage(failureMessage, maxRetries) {
 * Mark one schema field volatile.
 *
 * `.volatile()` is unconditional: it is a schemastery 3.18.3 feature and the
-* only supported engine (`dsh 0.1.7-rc.2`) pins `~3.18.4`, so the method is
+* only supported engine (`dsh 0.2.0-rc.2`) pins `~3.18.4`, so the method is
 * always present. It is reached through a structural member so the caller's
 * declared field type survives — the mark changes what the schema PARSES to (a
 * live reference), not the plugin-facing `Config` shape.
@@ -7348,6 +9118,7 @@ const Config = z.object(markVolatileFields({
 	modelsCachePath: z.string(),
 	requestTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
 	streamIdleTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
+	offloadSeenImagesForCache: z.boolean().default(false),
 	transportMaxRetries: z.number().min(0).max(50),
 	filterModelsByPlan: z.boolean(),
 	visibleModels: z.array(z.string()),
@@ -7380,8 +9151,9 @@ function resolveAdapterOptions(config) {
 		apiBase: config.apiBase ?? "https://api.commandcode.ai",
 		workingDir: config.workingDir ?? process.cwd(),
 		modelsCachePath: config.modelsCachePath ?? DEFAULT_MODELS_CACHE_PATH,
-		requestTimeoutMs: config.requestTimeoutMs ?? 6e4,
+		requestTimeoutMs: config.requestTimeoutMs ?? 3e5,
 		streamIdleTimeoutMs: config.streamIdleTimeoutMs ?? 3e5,
+		offloadSeenImagesForCache: config.offloadSeenImagesForCache === true,
 		filterModelsByPlan: config.filterModelsByPlan ?? true,
 		visibleModels: Array.isArray(config.visibleModels) ? config.visibleModels.filter((id) => typeof id === "string" && id !== "") : void 0,
 		modelVisibility: readModelVisibility(config.modelVisibility),
@@ -7483,10 +9255,13 @@ function apply(ctx, config) {
 		return Math.min(Math.trunc(value), 50);
 	};
 	const sessionAgents = /* @__PURE__ */ new WeakMap();
-	ctx.on("agent/request-error", async ({ agent, failure, signal }, next) => {
-		if (signal.aborted) return next();
+	ctx.on("agent/request-error", async ({ agent, provider, failure, signal }, next) => {
+		if (signal.aborted || provider !== "commandcode") return next();
 		const session = Reflect.get(agent, "session");
 		if (typeof session === "object" && session !== null) sessionAgents.set(session, agent);
+		const transient = absorbTransientFailure(agent, failure.code);
+		if (transient === "exhausted") throw new Error(transientBudgetMessage(failure.code, failure.message));
+		if (transient === "retry") return next();
 		const decision = absorbTransportFailure(agent, failure.code, transportMaxRetries());
 		if (decision === "ignored") return next();
 		if (decision === "retry") return { kind: "retry" };
@@ -7502,10 +9277,16 @@ function apply(ctx, config) {
 		}
 		if (action !== "reset") return;
 		const agent = sessionAgents.get(session);
-		if (agent !== void 0) resetTransportFailures(agent);
+		if (agent !== void 0) {
+			resetTransportFailures(agent);
+			resetTransientFailures(agent);
+		}
 	});
 	ctx.on("agent/status", ({ agent, status }) => {
-		if (status === "idle") resetTransportFailures(agent);
+		if (status === "idle") {
+			resetTransportFailures(agent);
+			resetTransientFailures(agent);
+		}
 	});
 	const usageReports = async () => {
 		const described = await pool.describeAccounts();
@@ -7555,12 +9336,16 @@ function apply(ctx, config) {
 	});
 	ctx.effect(() => () => loginFlow.dispose(), "dsh-commandcode-provider: login flow");
 	const catalogForEditors = async () => {
-		return { models: (await adapter.listModels(PROVIDER, { unfiltered: true })).map((model) => {
+		const models = await adapter.listModels(PROVIDER, { unfiltered: true });
+		const bracket = await adapter.allowanceTier();
+		return { models: models.map((model) => {
 			const tier = KNOWN_PLANS[model.id];
+			const allowance = bracket === void 0 ? void 0 : modelAllowanceFor(model.id)?.[bracket];
 			return {
 				id: model.id,
 				name: model.name.replace(/\s*\(CC\)$/, ""),
-				...tier === void 0 ? {} : { tier }
+				...tier === void 0 ? {} : { tier },
+				...allowance === void 0 ? {} : { allowance }
 			};
 		}) };
 	};