@mars-sea/dsh-commandcode-provider 0.13.4 → 0.14.1

package/lib/index.js

@@ -103,7 +103,7 @@ const PLAN_ORDER = Object.fromEntries(PLAN_TIER_ORDER.map((tier, index) => [tier
 * subscription-plan labels, deals, and hourly (peak/off-peak) pricing.
 *
 * Everything here is synced from official sources — the command-code CLI
-* bundle's model table (`dist/cli.mjs`, re-verified at command-code@1.82.5) and
+* bundle's model table (`dist/cli.mjs`, re-verified at command-code@1.84.0) and
 * the official plan/pricing/model docs; see the dsh-commandcode-upstream skill
 * for the extraction procedures. Keeping the snapshot in its own module
 * confines those frequent sync diffs here: src/adapter.ts holds only the stable
@@ -315,6 +315,13 @@ const KNOWN_EFFORTS = {
 		"medium",
 		"high"
 	],
+	"reflection/beam:free": [
+		"low",
+		"medium",
+		"high",
+		"xhigh",
+		"max"
+	],
 	"sakana/fugu-ultra": ["high", "xhigh"],
 	"stepfun/Step-5-Preview": [
 		"low",
@@ -622,9 +629,13 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 * what the current CLI says.
 *
 * 1.82.4 then reversed 1.74.1's removal of `meituan/LongCat-2.0:free` and added
-* the `stealth/cat-jam:free` preview, taking this set to 24 members — the size
-* of the live catalog's `zdr:false` list. The canonical helper set still carries
-* 23 because `cat-jam:free` postdates the artifact's embedded snapshot.
+* the `stealth/cat-jam:free` preview, taking this set to 24 members. The 1.84.0
+* sync (2026-10-16) moves it to 25 with no verdict flip: LongCat's exclusion
+* followed its rename to the paid id, and the free `reflection/beam:free`
+* preview joined on catalog evidence alone. The authoritative membership is the
+* UNION of the artifact's exclusion set and the catalog's `zdr:false` list —
+* neither source alone is complete, which is why this set is not simply "what
+* the CLI says".
 */
 const KNOWN_NON_ZDR_MODELS = /* @__PURE__ */ new Set([
 	"MiniMaxAI/MiniMax-M3",
@@ -636,9 +647,10 @@ const KNOWN_NON_ZDR_MODELS = /* @__PURE__ */ new Set([
 	"meta/muse-spark-1.3",
 	"meta/muse-spark-1.3-contributor",
 	"meta/muse-wonder-1.0",
-	"meituan/LongCat-2.0:free",
+	"meituan/LongCat-2.0",
 	"minimax/minimax-m3-free",
 	"poolside/laguna-s-2.1-free",
+	"reflection/beam:free",
 	"sakana/fugu-ultra",
 	"stealth/glyph-cluster:free",
 	"stealth/cat-jam:free",
@@ -792,6 +804,7 @@ const MODEL_OUTPUT_TOKEN_LIMITS = /* @__PURE__ */ new Map([
 	["claude-sonnet-5", 128e3],
 	["claude-sonnet-5-5", 128e3],
 	["deepseek/deepseek-v4-flash", 393216],
+	["deepseek/deepseek-v4-flash-fast", 384e3],
 	["deepseek/deepseek-v4-flash-vision-exp", 393216],
 	["deepseek/deepseek-v4-pro", 393216],
 	["google/gemini-3.1-flash-lite", 65536],
@@ -835,11 +848,13 @@ const MODEL_OUTPUT_TOKEN_LIMITS = /* @__PURE__ */ new Map([
 	["Qwen/Qwen3.7-Plus", 131072],
 	["Qwen/Qwen3.8-Flash", 131072],
 	["Qwen/Qwen3.8-Max", 131072],
+	["Qwen/Qwen3.8-Max-0902", 131072],
 	["Qwen/Qwen3.8-Omni-Flash", 131072],
 	["sakana/fugu-ultra", 1e6],
 	["stepfun/Step-3.5-Flash", 256e3],
 	["stepfun/Step-3.7-Flash", 256e3],
 	["stepfun/Step-5-Preview", 65536],
+	["tencent/hy3-paid", 128e3],
 	["thinkingmachines/inkling", 65536],
 	["xai/grok-4.5", 5e5],
 	["xai/grok-4.6", 5e5],
@@ -923,6 +938,7 @@ const KNOWN_PLANS = {
 	"nvidia/nemotron-3-ultra-550b-a55b": "go",
 	"nvidia/nemotron-3.5-super-vl": "go",
 	"poolside/laguna-s-2.1-free": "go",
+	"reflection/beam:free": "go",
 	"stepfun/Step-3.5-Flash": "go",
 	"stepfun/Step-3.7-Flash": "go",
 	"stepfun/Step-5-Preview": "go",
@@ -1119,6 +1135,10 @@ const KNOWN_DEALS = {
 		label: "FREE",
 		free: true
 	},
+	"reflection/beam:free": {
+		label: "FREE",
+		free: true
+	},
 	"stealth/cat-jam:free": {
 		label: "FREE",
 		free: true
@@ -1563,8 +1583,8 @@ const MODEL_PRICE_ROWS = [
 		],
 		allowance: {
 			go: 10,
-			goat: 100,
-			pro: 100
+			goat: 80,
+			pro: 90
 		}
 	},
 	{
@@ -1764,8 +1784,8 @@ const MODEL_PRICE_ROWS = [
 		],
 		allowance: {
 			go: 10,
-			goat: 100,
-			pro: 100
+			goat: 80,
+			pro: 90
 		}
 	},
 	{
@@ -3676,6 +3696,140 @@ function effectiveContextWindow(catalog, model, options) {
 	if (isValidContextWindow(options.contextWindow)) return options.contextWindow;
 	return catalog;
 }
+//#endregion
+//#region src/output-budget.ts
+/**
+* Output-budget bounds shared by the Host, the browser settings page and the
+* adapter (issue #74).
+*
+* The module stays pure (no node imports) so the client bundle can inline it,
+* exactly like `context-window.ts`. The report behind issue #74 asked for a
+* knob that stops the adapter from writing `max_tokens` at all; that is the
+* `0` sentinel here rather than a separate `null` spelling, because the value
+* travels through one numeric settings field on both surfaces.
+*/
+/**
+* The output budget this bundle asks for, and the ceiling it will never exceed.
+*
+* 131 072, chosen against a measured provider limit rather than a round guess.
+* Probing `/alpha/generate` directly on 2026-09-28: 64 000 → 200, 131 072 → 200,
+* 196 608 → 200, **200 000 → 200, 200 704 → 400**, 1 000 000 → 400. The server
+* therefore caps `max_tokens` at 200 000, and it does so identically for a
+* 262 144-window model (`stealth/pixel-canary`, retired by Command Code on
+* 2026-10-01 and named here only as the probe's subject) and a 1 000 000-window
+* one (`stealth/space-bunny-alpha`) — the cap is global, not per model. 131 072
+* keeps a 35 % margin under it while covering the real output ceiling of the
+* models that have one (Claude 64 K, Gemini 64 K, several at 128 K).
+*
+* The old 64 000 was never a provider requirement: it cost nothing in latency
+* (a 64 000 request answered headers in 1.28 s against 1.57 s for 131 072) but
+* it did cap what a model could ever say in one turn.
+*
+* No client-side clamp is applied on top of this: an earlier version pre-shrank
+* `max_tokens` from an estimate of the prompt already sent (`requestContextBudget()`,
+* issue #67), but that estimate over-corrected on ordinary long conversations —
+* exactly the "output gets cut short as the conversation grows" symptom issue #74
+* reported — while a live A/B probe (2026-09-30, `stealth/space-bunny-alpha`,
+* ~19.6% over its 1,000,000-token window with no client-side shrink) showed the
+* endpoint answers a genuine overflow with an unambiguous `400 … exceeds the
+* model's context window`, which `isContextOverflowDetail()` classifies as
+* `CONTEXT_WINDOW_EXCEEDED` independently of this constant.
+*
+* A user-set positive budget can only TIGHTEN this, never raise it — a figure
+* above the cap would be refused by the gateway anyway, so the settings field
+* refuses it at the input instead of spending a round trip to learn that.
+*
+* Lives here rather than in `adapter.ts` so the browser settings page can bound
+* its input by the same figure the Host enforces; `adapter.ts` re-exports it
+* under its historical name.
+*/
+const MAX_OUTPUT_TOKEN_LIMIT = 131072;
+/**
+* Whether a value can serve as a user output budget: the omit sentinel, or a
+* whole token count inside the gateway's own ceiling.
+*
+* Programmatically built connections can bypass schemastery normalization, so
+* the resolve step re-judges every value here and drops an out-of-range one
+* back to "unset" instead of letting the request carry a budget the gateway
+* refuses.
+*/
+function isValidMaxOutputTokens(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && value <= 131072;
+}
+/**
+* Apply a user output budget to a derived one.
+*
+* `undefined` means the user set nothing, so the derived ceiling stands
+* unchanged — the default path, and the one every existing profile takes.
+* {@link OMIT_OUTPUT_TOKENS} is a wire instruction rather than a number, so it
+* also leaves the derived budget alone; {@link omitOutputTokens} is what turns
+* it into an absent field.
+*/
+function applyMaxOutputTokens(derived, configured) {
+	if (configured === void 0 || configured === 0) return derived;
+	return Math.min(derived, configured);
+}
+/**
+* Whether this attempt must send no `max_tokens` field at all.
+*
+* Two guards narrow this beyond the user's own setting, and both are
+* correctness requirements rather than conveniences:
+*
+* - The Messages route is excluded deliberately: the endpoint rejects a body
+*   without the field (`Invalid input: expected number, received undefined at
+*   max_tokens`), so omitting it there would not lengthen an answer, it would
+*   make the whole Claude family unusable. The CLI and OpenAI transports accept
+*   an absent field, which is where the setting does what it promises.
+* - An explicit per-call budget from the host is an instruction, not a default,
+*   so it wins over the plugin-wide setting. `session-title` is the concrete
+*   case: it asks for 64 tokens precisely because its output must stay bounded,
+*   and dropping the field there would let a title generation run long instead
+*   of making a long answer fit (issue #88's fix depends on that bound).
+*/
+function omitOutputTokens(configured, protocol, hostRequestedTokens) {
+	if (configured !== 0) return false;
+	if (protocol === "messages") return false;
+	return hostRequestedTokens === void 0;
+}
+//#endregion
+//#region src/readable-error.ts
+/**
+* Readable error text for the settings page AND the Host-side failure paths.
+*
+* @module dsh-commandcode-provider/readable-error
+*/
+/**
+* Turn a caught value into readable text.
+*
+* `error instanceof Error ? error.message : String(error)` degrades to the
+* literal string `[object Object]` for a plain object with no `Error`
+* prototype — which is exactly what a Remote call across the webview/host
+* boundary can hand back: `dsh-typert-protocol` serializes a rejection for
+* the wire, and a structurally-cloned value loses its prototype chain even
+* when the host threw a real `Error` (issue #74). Reading a `message` string
+* off the plain object first recovers the original text in that case; only a
+* value with neither an `Error` prototype nor a usable `message` field falls
+* through to a JSON dump.
+*
+* Shared by both halves on purpose. The browser client needs it for rejections
+* that crossed the RPC boundary, and the Host needs it for values that reached
+* it from a transport, a JSON body, or a user-thrown non-Error — the same
+* degradation, one owner.
+*/
+function readableErrorText(error) {
+	if (error instanceof Error) return error.message;
+	if (typeof error === "string") return error;
+	if (error !== null && typeof error === "object") {
+		const message = error.message;
+		if (typeof message === "string" && message !== "") return message;
+		try {
+			return JSON.stringify(error);
+		} catch {
+			return Object.prototype.toString.call(error);
+		}
+	}
+	return String(error);
+}
 const THROTTLED_CODE = "THROTTLED";
 const boundedCodes = /* @__PURE__ */ new Set([
 	"EMPTY_RESPONSE",
@@ -6144,37 +6298,15 @@ var GatewayFacts = class {
 * per-request options thunk and an API-key resolver from the plugin entry
 * (src/index.ts), so a settings change reaches the very next request.
 */
-const COMMAND_CODE_CLI_VERSION = "1.82.5";
+const COMMAND_CODE_CLI_VERSION = "1.84.0";
 const DEFAULT_API_BASE = "https://api.commandcode.ai";
 /**
 * The output budget this bundle asks for, and the ceiling it will never exceed.
-*
-* 131 072, chosen against a measured provider limit rather than a round guess.
-* Probing `/alpha/generate` directly on 2026-09-28: 64 000 → 200, 131 072 → 200,
-* 196 608 → 200, **200 000 → 200, 200 704 → 400**, 1 000 000 → 400. The server
-* therefore caps `max_tokens` at 200 000, and it does so identically for a
-* 262 144-window model (`stealth/pixel-canary`, retired by Command Code on
-* 2026-10-01 and named here only as the probe's subject) and a 1 000 000-window
-* one (`stealth/space-bunny-alpha`) — the cap is global, not per model. 131 072
-* keeps a 35 % margin under it while covering the real output ceiling of the
-* models that have one (Claude 64 K, Gemini 64 K, several at 128 K).
-*
-* The old 64 000 was never a provider requirement: it cost nothing in latency
-* (a 64 000 request answered headers in 1.28 s against 1.57 s for 131 072) but
-* it did cap what a model could ever say in one turn.
-*
-* No client-side clamp is applied on top of this: an earlier version pre-shrank
-* `max_tokens` from an estimate of the prompt already sent (`requestContextBudget()`,
-* issue #67), but that estimate over-corrected on ordinary long conversations —
-* exactly the "output gets cut short as the conversation grows" symptom issue #74
-* reported — while a live A/B probe (2026-09-30, `stealth/space-bunny-alpha`,
-* ~19.6% over its 1,000,000-token window with no client-side shrink) showed the
-* endpoint answers a genuine overflow with an unambiguous `400 … exceeds the
-* model's context window`, which `isContextOverflowDetail()` below already
-* classifies as `CONTEXT_WINDOW_EXCEEDED` independently of this constant. See
-* [决策记录](../docs/决策记录.md).
+* The figure and its probe evidence live in `./output-budget.ts` — the module
+* the browser settings page also bounds its input by — and are re-exported here
+* under the historical name so existing importers are unaffected.
 */
-const DEFAULT_GENERATE_MAX_TOKENS = 131072;
+const DEFAULT_GENERATE_MAX_TOKENS = MAX_OUTPUT_TOKEN_LIMIT;
 const MODELS_TIMEOUT_MS = 1e4;
 /** How long the picker's plan-filter billing facts stay cached before refetching. */
 const BILLING_ACCESS_TTL_MS = 3e5;
@@ -7405,7 +7537,7 @@ async function buildCliBody(options, connection, facts) {
 				input_schema: toolParametersSchema(tool.parameters)
 			})),
 			system: cliSystem(facts.systemText),
-			max_tokens: facts.maxTokens,
+			...facts.omitMaxTokens ? {} : { max_tokens: facts.maxTokens },
 			temperature: options.temperature ?? .3,
 			stream: true,
 			...facts.reasoningEffort ? { reasoning_effort: facts.reasoningEffort } : {}
@@ -7431,7 +7563,7 @@ async function buildOpenAIBody(options, facts) {
 		model: options.model,
 		messages: openAiMessages,
 		...openAiTools.length > 0 ? { tools: openAiTools } : {},
-		max_tokens: facts.maxTokens,
+		...facts.omitMaxTokens ? {} : { max_tokens: facts.maxTokens },
 		temperature: options.temperature ?? .3,
 		stream: true,
 		...facts.reasoningEffort ? { reasoning_effort: facts.reasoningEffort } : {}
@@ -7494,6 +7626,16 @@ async function buildMessagesBody(options, facts) {
 	return body;
 }
 /**
+* Write the output budget into an already-built body, each transport in its own
+* shape (the CLI route nests it under `params`). Used to keep a REBUILT body's
+* figure in step with the budget without duplicating the nesting knowledge, and
+* only called when the field is not being omitted (issue #74).
+*/
+function assignMaxTokens(body, target, maxTokens) {
+	if (target === "cli") recordOrEmpty(body.params).max_tokens = maxTokens;
+	else body.max_tokens = maxTokens;
+}
+/**
 * One connect attempt's inputs: everything `connectGenerate` needs beyond
 * the per-attempt key and protocol. Passed explicitly (not closed over) so
 * the rotation loop's mutation of `protocol`/`body` stays visible at the
@@ -7857,7 +7999,7 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 			toolUpdate: "addition-only",
 			...entry !== void 0 && contextWindow !== void 0 ? {
 				context: { contextWindow },
-				defaultMaxTokens: Math.min(catalogModelMaxTokens(connection.apiBase, entry, contextWindow), DEFAULT_GENERATE_MAX_TOKENS)
+				defaultMaxTokens: applyMaxOutputTokens(Math.min(catalogModelMaxTokens(connection.apiBase, entry, contextWindow), DEFAULT_GENERATE_MAX_TOKENS), connection.maxOutputTokens)
 			} : {},
 			...efforts ? { reasoning: { efforts: efforts.map((effort) => ({
 				id: ReasoningEffortId(effort),
@@ -8137,7 +8279,7 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 				}
 				return record;
 			} catch (error) {
-				failures.push(`${path}: ${error instanceof Error ? error.message : String(error)}`);
+				failures.push(`${path}: ${readableErrorText(error)}`);
 				failed.push({ kind: "transport" });
 				return;
 			}
@@ -8281,7 +8423,7 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 		options.signal?.throwIfAborted();
 		const modelEntry = catalog.find((row) => row.id === options.model);
 		const modelMax = modelEntry === void 0 ? facts.fallbackLimit : catalogModelMaxTokens(connection.apiBase, modelEntry, effectiveContextWindow(modelEntry.contextWindow, options.model, connection));
-		const initialMax = Math.min(options.maxTokens ?? Infinity, modelMax, DEFAULT_GENERATE_MAX_TOKENS);
+		const initialMax = applyMaxOutputTokens(Math.min(options.maxTokens ?? Infinity, modelMax, DEFAULT_GENERATE_MAX_TOKENS), connection.maxOutputTokens);
 		const budget = {
 			max: initialMax,
 			sent: initialMax
@@ -8332,17 +8474,16 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 		const buildBody = async (target) => {
 			const finishBody = timing.phase("body");
 			try {
+				const omitMaxTokens = omitOutputTokens(connection.maxOutputTokens, target, options.maxTokens);
 				const facts = {
 					maxTokens,
+					omitMaxTokens,
 					reasoningEffort,
 					selectableEffort: supported !== void 0 && supported.length > 0,
 					systemText,
 					readImage
 				};
-				const built = target === "cli" ? await buildCliBody(requestOptions, connection, facts) : target === "messages" ? await buildMessagesBody(requestOptions, facts) : await buildOpenAIBody(requestOptions, facts);
-				if (target === "cli") recordOrEmpty(built.params).max_tokens = maxTokens;
-				else built.max_tokens = maxTokens;
-				return built;
+				return target === "cli" ? await buildCliBody(requestOptions, connection, facts) : target === "messages" ? await buildMessagesBody(requestOptions, facts) : await buildOpenAIBody(requestOptions, facts);
 			} finally {
 				finishBody();
 			}
@@ -8392,8 +8533,7 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 				if (lower < maxTokens) {
 					maxTokens = lower;
 					budget.max = Math.min(budget.max, lower);
-					if (protocol === "cli") recordOrEmpty(body.params).max_tokens = lower;
-					else body.max_tokens = lower;
+					if (!omitOutputTokens(connection.maxOutputTokens, protocol, options.maxTokens)) assignMaxTokens(body, protocol, lower);
 					serializedBodies.delete(body);
 				}
 				budget.sent = maxTokens;
@@ -8707,7 +8847,7 @@ function commandDefinition(deps) {
 					text: renderReport(await adapter.getUsage(), locale)
 				};
 			} catch (error) {
-				const message = error instanceof Error ? error.message : String(error);
+				const message = readableErrorText(error);
 				return {
 					kind: "error",
 					text: commandCopy(locale, "errorText").replace("{message}", message)
@@ -9025,6 +9165,30 @@ const LOGIN_HOST_CONTRIBUTION = {
 };
 //#endregion
 //#region src/enrollment-wire.ts
+const ENROLLMENT_MESSAGE_KEYS = [
+	"enrollmentCreating",
+	"enrollmentWaiting",
+	"enrollmentWriting",
+	"enrollmentNaming",
+	"enrollmentNameFailed",
+	"enrollmentFinished",
+	"enrollmentCancelling",
+	"enrollmentCancelled",
+	"enrollmentCancelledCleaned",
+	"enrollmentFailed",
+	"enrollmentFailedCleaned",
+	"enrollmentCleanupPending",
+	"enrollmentCleanupFailed",
+	"enrollmentRecordNaming",
+	"enrollmentRecordCleanup",
+	"enrollmentBeginFailed",
+	"enrollmentCancelUnconfirmed",
+	"enrollmentNameRequestFailed",
+	"enrollmentCleanupRequestFailed",
+	"enrollmentDisconnected",
+	"enrollmentHostUnavailable",
+	"enrollmentStatusUnavailable"
+];
 const guard = makeBoundaryValidator("commandcode/enrollment");
 const phases = [
 	"creating",
@@ -9041,11 +9205,13 @@ function parseEnrollmentState(value) {
 	const source = guard.record(value, "state");
 	const phase = source.phase;
 	if (!phases.includes(phase)) return guard.reject("phase");
+	const messageKey = source.messageKey;
+	if (!ENROLLMENT_MESSAGE_KEYS.includes(messageKey)) return guard.reject("messageKey");
 	const state = {
 		id: guard.stringField(source, "id", "id"),
 		ref: guard.stringField(source, "ref", "ref"),
 		phase,
-		message: guard.stringField(source, "message", "message")
+		messageKey
 	};
 	for (const field of ["authUrl", "suggestedName"]) if (source[field] !== void 0) state[field] = guard.stringField(source, field, field);
 	return state;
@@ -9737,7 +9903,7 @@ var CommandCodeLoginFlow = class {
 			this.setStatus({
 				state: "failed",
 				reason: "unavailable",
-				message: error instanceof Error ? error.message : String(error)
+				message: readableErrorText(error)
 			});
 			return;
 		}
@@ -9846,7 +10012,7 @@ var AccountEnrollmentManager = class {
 				id: input.id,
 				ref: "",
 				phase: "creating",
-				message: "正在创建账号"
+				messageKey: "enrollmentCreating"
 			}
 		};
 		this.tasks.set(input.id, task);
@@ -9854,7 +10020,7 @@ var AccountEnrollmentManager = class {
 			task.state = {
 				...task.state,
 				phase: "cleanup-needed",
-				message: "收尾未完成，请重试"
+				messageKey: "enrollmentCleanupPending"
 			};
 		});
 		return task.state;
@@ -9884,7 +10050,7 @@ var AccountEnrollmentManager = class {
 					id,
 					ref: "",
 					phase: "cancelled",
-					message: "已取消"
+					messageKey: "enrollmentCancelled"
 				}
 			};
 			this.tasks.set(id, task);
@@ -9897,7 +10063,7 @@ var AccountEnrollmentManager = class {
 		task.state = {
 			...task.state,
 			phase: "cancelling",
-			message: "正在等待写入结束并清理"
+			messageKey: "enrollmentCancelling"
 		};
 		await task.flow?.cancelAndDrain();
 		await task.work;
@@ -9934,14 +10100,14 @@ var AccountEnrollmentManager = class {
 				id,
 				ref: record.ref,
 				phase: "finished",
-				message: "账号开通完成"
+				messageKey: "enrollmentFinished"
 			});
 		} catch {
 			return this.publish(task, {
 				id,
 				ref: record.ref,
 				phase: "naming",
-				message: "账号已登录，名称保存失败，请重试或接受已有名称",
+				messageKey: "enrollmentNameFailed",
 				...name ? { suggestedName: name } : {}
 			});
 		}
@@ -9967,7 +10133,7 @@ var AccountEnrollmentManager = class {
 			task.state = {
 				...task.state,
 				phase: "cleanup-needed",
-				message: "清理未完成，请重试"
+				messageKey: "enrollmentCleanupFailed"
 			};
 		});
 		await task.work;
@@ -10035,7 +10201,7 @@ var AccountEnrollmentManager = class {
 						if (!task.cancelled && status.state === "waiting") task.state = {
 							...task.state,
 							phase: "waiting",
-							message: "等待浏览器登录",
+							messageKey: "enrollmentWaiting",
 							...status.authUrl ? { authUrl: status.authUrl } : {}
 						};
 						if (task.cancelled) flow.cancelAndDrain();
@@ -10051,7 +10217,7 @@ var AccountEnrollmentManager = class {
 			task.state = {
 				...task.state,
 				phase: "naming",
-				message: "账号已登录，正在保存名称",
+				messageKey: "enrollmentNaming",
 				...suggested ? { suggestedName: suggested } : {}
 			};
 			try {
@@ -10064,7 +10230,7 @@ var AccountEnrollmentManager = class {
 				if (task.state.phase === "finished") return;
 				task.state = {
 					...task.state,
-					message: "账号已登录，名称保存失败，请重试或接受已有名称"
+					messageKey: "enrollmentNameFailed"
 				};
 				return;
 			}
@@ -10076,7 +10242,7 @@ var AccountEnrollmentManager = class {
 			else task.state = {
 				...task.state,
 				phase: task.cancelled ? "cancelled" : "failed",
-				message: task.cancelled ? "已取消" : "账号开通失败，未创建账号"
+				messageKey: task.cancelled ? "enrollmentCancelled" : "enrollmentFailed"
 			};
 		} finally {
 			task.flow?.dispose();
@@ -10087,7 +10253,7 @@ var AccountEnrollmentManager = class {
 		task.state = {
 			...task.state,
 			phase: "writing",
-			message: "正在保存凭据"
+			messageKey: "enrollmentWriting"
 		};
 		task.writeStarted = true;
 		await this.deps.set(task.state.ref, key);
@@ -10128,7 +10294,7 @@ var AccountEnrollmentManager = class {
 			id,
 			ref,
 			phase: task.cancelled ? "cancelled" : "failed",
-			message: task.cancelled ? "已取消并清理" : "开通失败，已清理临时账号"
+			messageKey: task.cancelled ? "enrollmentCancelledCleaned" : "enrollmentFailedCleaned"
 		};
 	}
 	settings() {
@@ -10177,12 +10343,134 @@ var AccountEnrollmentManager = class {
 			id: record.id,
 			ref: record.ref,
 			phase: record.phase === "naming" ? "naming" : "cleanup-needed",
-			message: record.phase === "naming" ? "已登录账号等待确认名称" : "账号开通收尾未完成，请重试",
+			messageKey: record.phase === "naming" ? "enrollmentRecordNaming" : "enrollmentRecordCleanup",
 			...record.phase === "naming" ? { suggestedName: record.label } : {}
 		};
 	}
 };
 //#endregion
+//#region src/config-volatile.ts
+/**
+* Volatile-config helpers for dsh 0.1.7's schema-derived profile Config.
+*
+* 0.1.7's `settings.describe()` projects each entry's schema through
+* `volatileForm()`, so a form contains ONLY nodes carrying `meta.volatile`
+* and a form edit is refused unless its path lies beneath a marked node. The
+* loader then resolves each marked field into a frozen `{ get() }` reference
+* that is written IN PLACE (no remount) and announced with
+* `loader/volatile-update`. Two helpers keep the rest of the plugin reading a
+* PLAIN `Config`: `markVolatile()` applies the mark, and
+* `unwrapVolatileConfig()` reads every top-level field through its reference
+* when one is present — FRESH per call, because a reference's identity is
+* stable while its value changes.
+*
+* Only TOP-LEVEL fields are marked (a form write names a top-level path such
+* as `accounts` or `modelVisibility.<id>`), so one unwrap level is complete.
+* The literal `apiKey` secret stays unmarked on purpose: no settings surface
+* writes it — page and TUI both write keys through the credentials seam — so a
+* config-file edit to it reloading the fiber is correct for a secret literal.
+*
+* `volatileWrite()` is the third helper and the only WRITE in this module: it
+* commits into a reference that belongs to ANOTHER plugin entry (`ctx.web`'s
+* `searchProvider`), which no host API addresses directly. It is the degraded
+* path behind `ctx.settings.update()`; see its own note for why the disk-backed
+* path is preferred.
+*
+* @module dsh-commandcode-provider/config-volatile
+*/
+/**
+* Mark one schema field volatile.
+*
+* `.volatile()` is unconditional: it is a schemastery 3.18.3 feature and the
+* supported engine ships `~3.18.5`, so the
+* method is always present. It is reached through a structural member so the caller's
+* declared field type survives — the mark changes what the schema PARSES to (a
+* live reference), not the plugin-facing `Config` shape.
+*/
+function markVolatile(schema) {
+	return schema.volatile();
+}
+/**
+* Mark every field of a Config field dict volatile, except the named
+* composition-only secrets (`apiKey` here, which no settings surface writes).
+*/
+function markVolatileFields(fields, skip = []) {
+	return Object.fromEntries(Object.entries(fields).map(([name, schema]) => [name, skip.includes(name) ? schema : markVolatile(schema)]));
+}
+/**
+* Whether a resolved config value is a volatile reference.
+*
+* Duck-typed on the two properties `createVolatile` produces (frozen object
+* with a `get` method) rather than cosmokit's private `write` symbol, because
+* cosmokit is not a peer of this bundle. Config values are plain parsed JSON
+* (or `!!jsExpr` wrappers), which are never frozen, so the test cannot
+* misfire on an ordinary field.
+*/
+function isVolatileRef(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && Object.isFrozen(value) && typeof value.get === "function";
+}
+/**
+* The commit protocol cosmokit's `createVolatile` installs on every reference.
+*
+* `Symbol.for` — not a local `Symbol()` — because cosmokit registers it
+* globally precisely so copies of the shared library loaded twice (ESM/CJS, two
+* node_modules trees) still recognize each other's references. Reaching it
+* through the global registry is what lets this bundle commit a value without
+* taking `@deepseek-ai/cosmokit` as a dependency.
+*/
+const VOLATILE_WRITE = Symbol.for("cosmokit.volatile.write");
+/**
+* Commit a value into a RUNNING volatile reference and verify it landed.
+*
+* This is the DEGRADED write path, and it is deliberately second choice: the
+* reference is the live config the owner reads per call, but the value never
+* reaches the profile document, so the next loader commit for that entry (any
+* `loader/volatile-update`, including one caused by an unrelated field of the
+* same entry) re-resolves the raw config and overwrites it. The official
+* `ctx.settings.update()` path exists to avoid exactly that; this one keeps the
+* CURRENT process coherent when settings is unavailable or refuses the write.
+*
+* Reading back is not optional: the write method is an internal protocol, so a
+* future cosmokit that renames the symbol, hides it, or changes the value shape
+* must degrade to "not applied" instead of silently pretending success.
+*
+* @param ref - Candidate volatile reference; anything else returns `false`.
+* @param value - Value to commit.
+* @returns Whether the reference now reads back as `value`.
+*/
+function volatileWrite(ref, value) {
+	if (!isVolatileRef(ref)) return false;
+	const write = ref[VOLATILE_WRITE];
+	if (typeof write !== "function") return false;
+	try {
+		write.call(ref, value);
+	} catch {
+		return false;
+	}
+	try {
+		return Object.is(ref.get(), value);
+	} catch {
+		return false;
+	}
+}
+/**
+* Read one config object as PLAIN values.
+*
+* Every top-level field found to be a volatile reference is read through
+* `.get()` — freshly on every call, so a live update lands on the very next
+* read (the loader resolves EVERY marked node into a reference, unset fields
+* included, so a loader-parsed config always yields a fresh object here). The
+* pass-through for a field that is not a reference is what keeps the unmarked
+* `apiKey` literal readable.
+*/
+function unwrapVolatileConfig(config) {
+	const source = config;
+	if (typeof source !== "object" || source === null) return config;
+	const plain = {};
+	for (const [field, value] of Object.entries(source)) plain[field] = isVolatileRef(value) ? value.get() : value;
+	return plain;
+}
+//#endregion
 //#region src/web-search.ts
 /**
 * Command Code web-search provider over `ctx.web`.
@@ -10195,6 +10483,15 @@ var AccountEnrollmentManager = class {
 * therefore reuses the plugin's existing credential chain and `apiBase`, so
 * the model-facing `web_search` tool needs no separate configuration.
 *
+* The second half of this module is the SELECTION seam: which registered search
+* backend `ctx.web` actually runs. That seam has TWO engine shapes, and both are
+* supported. dsh 0.2.1-rc.2 turned the choice into a per-call `Volatile` field of
+* the `web` profile entry, so it is changed through the host settings service
+* rather than by assigning a runtime field. Engines up to and including
+* 0.2.1-alpha.4 kept it in the private instance field `searchProviderId`, which
+* has no settings surface and can only be assigned in memory — see
+* {@link createCommandCodeSearchSelection}.
+*
 * @module dsh-commandcode-provider/web-search
 */
 /** Stable id this provider registers under in `ctx.web`. */
@@ -10206,54 +10503,326 @@ const COMMANDCODE_SEARCH_PROVIDER_ID = "commandcode";
 * PREVIOUSLY selected backend, never this default (issue #26).
 */
 const DEFAULT_WEB_SEARCH_PROVIDER_ID = "deepseek-official";
+/**
+* Profile entry id whose volatile `searchProvider` selects the search backend.
+*
+* The hosting profile declares it in `dsh-base`'s cordis patch as
+* `- id: web` / `name: '@deepseek-ai/dsh-web'`, and the shipped web-search
+* settings page addresses the very same namespace — that page and this plugin
+* are therefore two writers of ONE field (see
+* {@link createCommandCodeSearchSelection} for how they avoid fighting).
+*/
+const WEB_SELECTION_NAMESPACE = "web";
 /** Fresh selection state: the plugin starts out not owning the selection. */
 function commandCodeSearchSelection() {
 	return {
 		owner: false,
-		displaced: void 0,
-		preexisting: false
+		preexisting: false,
+		foreign: void 0,
+		displaced: void 0
 	};
 }
+/** Read one member of a plain object or array without trusting its shape. */
+function member(value, key) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	return value[key];
+}
+/** A string member, or `undefined` for anything else (including `null`). */
+function text(value) {
+	return typeof value === "string" ? value : void 0;
+}
+/** The settings row describing the `web` entry, when the host serves one. */
+function selectionRow(settings) {
+	let rows;
+	try {
+		rows = settings.describe();
+	} catch {
+		return;
+	}
+	if (!Array.isArray(rows)) return void 0;
+	return rows.find((row) => text(member(row, "ns")) === "web");
+}
 /**
-* Reach one end of the `webSearch` toggle without trampling sibling search
-* providers (issue #26).
+* The volatile reference backing `web.searchProvider`.
 *
-* - Enabling writes `commandcode` and remembers whatever it displaced. When
-*   the plugin already owns the selection, the original `displaced` is kept —
-*   the field currently holds our own id, which must never be mistaken for the
-*   user's backend.
-* - Disabling hands the selection back to the remembered backend only when
-*   this plugin actually took it over. A fresh boot straight into
-*   `webSearch: false`, or a `preexisting` field, leaves it ALONE: writing the
-*   empty memory back would clear the user's own `searchProvider: commandcode`
-*   pin and hand the selection to dsh-web's auto-select, where a second usable
-*   provider makes every later search throw `WEB_PROVIDER_AMBIGUOUS`.
+* `config` is a TypeScript-private parameter property on `WebRuntime`, so at
+* runtime it is an ordinary own field — the only handle to a reference the host
+* exposes no public accessor for. Reading it structurally means a hardened
+* runtime degrades to "not writable" instead of throwing.
+*/
+function searchProviderRef(web) {
+	return member(member(web, "config"), "searchProvider");
+}
+/**
+* The pre-rc.2 instance field, or `undefined` when this runtime does not carry
+* it.
 *
-* Never throws: like the low-level rewrite, a hardened runtime shape degrades
-* to registered-but-unselected.
+* An OWN property is the discriminator, not a value test: a runtime of the
+* reference shape never has `searchProviderId` at all, so the two shapes cannot
+* both answer and neither needs to be preferred over the other.
 */
-function applyCommandCodeSearchSelection(web, state, enable) {
-	try {
-		const field = web;
-		if (enable) {
-			if (state.owner) {
-				field.searchProviderId = COMMANDCODE_SEARCH_PROVIDER_ID;
+function legacySearchField(web) {
+	if (!Object.prototype.hasOwnProperty.call(web, "searchProviderId")) return void 0;
+	const shaped = web;
+	return {
+		read: () => text(shaped.searchProviderId),
+		write: (value) => {
+			try {
+				shaped.searchProviderId = value;
+				return true;
+			} catch {
+				return false;
+			}
+		}
+	};
+}
+/** Observe the live selection; `undefined` when nothing can be observed. */
+function readView(deps) {
+	const settings = deps.settings();
+	if (settings !== void 0) {
+		const row = selectionRow(settings);
+		if (row !== void 0) {
+			const user = member(row, "user");
+			return {
+				configured: text(member(member(row, "value"), "searchProvider")),
+				pinned: text(member(user, "searchProvider")),
+				base: text(member(member(row, "base"), "searchProvider")),
+				user: typeof user === "object" && user !== null && !Array.isArray(user) ? { ...user } : {},
+				persistent: true
+			};
+		}
+	}
+	const ref = searchProviderRef(deps.web);
+	if (isVolatileRef(ref)) {
+		let current;
+		try {
+			current = ref.get();
+		} catch {
+			return;
+		}
+		if (current !== void 0 && typeof current !== "string") return void 0;
+		return {
+			configured: current,
+			pinned: void 0,
+			base: void 0,
+			user: {},
+			persistent: false
+		};
+	}
+	const legacy = legacySearchField(deps.web);
+	if (legacy === void 0) return void 0;
+	return {
+		configured: legacy.read(),
+		pinned: void 0,
+		base: void 0,
+		user: {},
+		persistent: false
+	};
+}
+/**
+* The selection seam over `ctx.web`.
+*
+* ## Why settings rather than the runtime instance
+*
+* 0.2.1-rc.2's `WebRuntime` reads `this.config.searchProvider.get()` on EVERY
+* search and fetch, and the loader commits a settings write into that same
+* reference in place (`Entry._commitVolatile`) without remounting the entry.
+* Writing the reference directly therefore works, but leaves the value out of
+* the profile: the next commit for that entry — including one caused by an
+* unrelated field such as `fetchProvider` — re-resolves the raw config and
+* overwrites it. `ctx.settings.update()` / `replace()` is the documented path
+* and the one the shipped web-search settings page uses, so this plugin takes
+* it first and falls back to the reference only when settings is unavailable or
+* refuses (see `volatileWrite`).
+*
+* ## Two engine shapes
+*
+* Everything above describes an rc.2+ runtime, where the selection is a
+* reference. PRE-rc.2 engines (0.2.0-rc.2 and the 0.2.1 alphas) have neither
+* that reference nor a settings row for `web`: there the selection is the
+* private instance field `searchProviderId`, memory-only by nature. Those
+* engines therefore run the degraded path BY CONSTRUCTION — no profile write
+* exists for it and the user layer is unreadable, so a foreign pin cannot be
+* seen and the takeover/restore semantics are the ones this plugin shipped
+* before rc.2: remember the displaced backend, hand back only what we took. The
+* shape is resolved per observation, so one build serves both.
+*
+* ## Two writers, one field
+*
+* The shipped web-search settings page writes `web.searchProvider` too
+* (`deepseek-search-api` / `deepseek-official`). This seam never displaces a
+* pin it did not write: a non-`commandcode` value in the USER LAYER stops the
+* takeover, the value is recorded on {@link CommandCodeSearchSelection.foreign}
+* and named in one `info` line, and the provider stays registered but
+* unselected. A value the user layer does not carry is the deployment's own
+* default, and taking it over is the toggle's whole purpose. A user-layer
+* `commandcode` is treated as ours: nothing else writes that id, so it can only
+* be a previous run of this plugin or a deliberate manual pin, and turning the
+* toggle off restores the composed default in both cases.
+*
+* @param deps - the running `web` service, a settings resolver, and a log sink.
+* @returns a synchronous handle; failures are logged, never thrown.
+*/
+function createCommandCodeSearchSelection(deps) {
+	const state = commandCodeSearchSelection();
+	let pending;
+	let activeKey;
+	let running = false;
+	let closed = false;
+	let waiters = [];
+	const warn = (message) => {
+		try {
+			deps.logger.warn(message);
+		} catch {}
+	};
+	const info = (message) => {
+		try {
+			deps.logger.info(message);
+		} catch {}
+	};
+	/**
+	* Commit the selection in memory; the last resort before giving up.
+	*
+	* The volatile reference is tried first because on an rc.2+ runtime that is
+	* what `search()` reads. A PRE-rc.2 runtime carries no reference at all, and
+	* there the private instance field IS the seam — the fallback is a different
+	* engine shape, not a second-best copy of the same write.
+	*/
+	const memoryWrite = (value) => {
+		if (volatileWrite(searchProviderRef(deps.web), value)) return true;
+		if (legacySearchField(deps.web)?.write(value) === true) return true;
+		warn("llm-commandcode: web search selection could not be applied (settings refused the write and the running web runtime is not writable); the provider stays registered but unselected");
+		return false;
+	};
+	/** Run one intent against a FRESH observation; never throws. */
+	const perform = async (intent) => {
+		let view;
+		try {
+			view = readView(deps);
+		} catch {
+			view = void 0;
+		}
+		if (view === void 0) return;
+		const settings = view.persistent ? deps.settings() : void 0;
+		if (intent.kind === "take") {
+			if (view.pinned !== void 0 && view.pinned !== "commandcode") return;
+			if (settings !== void 0) try {
+				await settings.update("web", { searchProvider: COMMANDCODE_SEARCH_PROVIDER_ID });
 				return;
+			} catch (error) {
+				warn(`llm-commandcode: writing web.searchProvider through settings failed (${error instanceof Error ? error.message : String(error)}); falling back to the running config`);
 			}
-			const prior = field.searchProviderId;
-			state.preexisting = prior === COMMANDCODE_SEARCH_PROVIDER_ID;
-			state.displaced = state.preexisting ? void 0 : prior;
-			field.searchProviderId = COMMANDCODE_SEARCH_PROVIDER_ID;
-			state.owner = true;
+			memoryWrite(COMMANDCODE_SEARCH_PROVIDER_ID);
 			return;
 		}
-		if (state.owner) {
+		if (view.pinned !== void 0 && view.pinned !== "commandcode") return;
+		if (settings !== void 0) {
+			const section = { ...view.user };
+			delete section.searchProvider;
+			if (view.base !== void 0) section.searchProvider = view.base;
+			try {
+				await settings.replace("web", section);
+				return;
+			} catch (error) {
+				warn(`llm-commandcode: restoring web.searchProvider through settings failed (${error instanceof Error ? error.message : String(error)}); falling back to the running config`);
+			}
+		}
+		memoryWrite(intent.displaced);
+	};
+	const flush = () => {
+		const done = waiters;
+		waiters = [];
+		for (const resolve of done) resolve();
+	};
+	const drain = async () => {
+		running = true;
+		try {
+			while (pending !== void 0 && !closed) {
+				const item = pending;
+				pending = void 0;
+				activeKey = item.key;
+				await perform(item.intent);
+			}
+		} finally {
+			running = false;
+			activeKey = void 0;
+			flush();
+		}
+	};
+	/**
+	* Queue one intent, skipping an identical one already queued or in flight. A
+	* later DIFFERENT intent replaces the queued one: the toggle is a state, not a
+	* log, so only the newest position has to land.
+	*/
+	const submit = (key, intent) => {
+		if (closed) return;
+		if (key === activeKey && pending === void 0) return;
+		if (pending?.key === key) return;
+		pending = {
+			key,
+			intent
+		};
+		if (!running) drain();
+	};
+	const apply = (enable) => {
+		try {
+			const view = readView(deps);
+			if (view === void 0) return;
+			if (!enable) {
+				if (!state.owner) return;
+				state.owner = false;
+				if (state.preexisting) {
+					state.preexisting = false;
+					return;
+				}
+				submit("restore", {
+					kind: "restore",
+					displaced: state.displaced
+				});
+				return;
+			}
+			if (view.pinned !== void 0 && view.pinned !== "commandcode") {
+				if (state.foreign !== view.pinned) {
+					state.foreign = view.pinned;
+					info(`llm-commandcode: web search backend "${view.pinned}" was chosen in the web-search settings page; leaving that explicit choice in place, so the commandcode provider stays registered but unselected`);
+				}
+				state.owner = false;
+				state.preexisting = false;
+				return;
+			}
+			state.foreign = void 0;
+			if (view.configured === "commandcode") {
+				state.owner = view.pinned === "commandcode" || !view.persistent && state.owner;
+				state.preexisting = !state.owner;
+				if (state.owner && state.displaced === void 0) state.displaced = view.base;
+				return;
+			}
+			state.displaced = view.configured;
+			state.preexisting = false;
+			state.owner = true;
+			submit("take", {
+				kind: "take",
+				displaced: view.configured
+			});
+		} catch (error) {
+			warn(`llm-commandcode: aligning the web search selection failed (${error instanceof Error ? error.message : String(error)})`);
+		}
+	};
+	return {
+		state,
+		apply,
+		settled: () => running || pending !== void 0 ? new Promise((resolve) => {
+			waiters.push(resolve);
+		}) : Promise.resolve(),
+		release: () => {
+			closed = true;
+			pending = void 0;
+			if (state.owner && !state.preexisting) memoryWrite(state.displaced);
 			state.owner = false;
-			if (!state.preexisting) field.searchProviderId = state.displaced;
 			state.preexisting = false;
-			return;
+			if (!running) flush();
 		}
-	} catch {}
+	};
 }
 /** Command Code's lower/upper bound on `numResults` (from the CLI's `web_search` schema). */
 const MIN_NUM_RESULTS = 1;
@@ -10337,7 +10906,7 @@ var CommandCodeSearchProvider = class {
 			});
 		} catch (error) {
 			if (signal?.aborted === true || isAbortError(error)) throw searchAborted(signal, error);
-			throw new WebError(`Command Code web search request failed: ${error instanceof Error ? error.message : String(error)}`, "WEB_PROVIDER_ERROR", { cause: error });
+			throw new WebError(`Command Code web search request failed: ${readableErrorText(error)}`, "WEB_PROVIDER_ERROR", { cause: error });
 		}
 		if (!response.ok) {
 			let message = `Command Code web search failed (HTTP ${response.status})`;
@@ -10391,7 +10960,7 @@ var CommandCodeSearchProvider = class {
 				if (code === "MISSING_CREDENTIAL") throw new WebError(error.message, "WEB_PROVIDER_CREDENTIAL_MISSING", { cause: error });
 				if (code === "INVALID_CREDENTIAL" || code === "RATE_LIMIT") throw new WebError(error.message, "WEB_PROVIDER_ERROR", { cause: error });
 			}
-			throw new WebError(`Command Code web search credential resolution failed: ${error instanceof Error ? error.message : String(error)}`, "WEB_PROVIDER_ERROR", { cause: error });
+			throw new WebError(`Command Code web search credential resolution failed: ${readableErrorText(error)}`, "WEB_PROVIDER_ERROR", { cause: error });
 		}
 		if (key === void 0 || key.length === 0) throw new WebError("Command Code web search has no API key; store COMMANDCODE_API_KEY through the credentials service (the web Models page writes it), export it in the launching environment, set config.apiKey, or run `command-code login` to write ~/.commandcode/auth.json", "WEB_PROVIDER_CREDENTIAL_MISSING");
 		return key;
@@ -10722,7 +11291,7 @@ function applyCommandCodeTuiSettings(ctx, deps) {
 				dispose: service.register(section)
 			};
 		} catch (error) {
-			ctx.logger?.warn(`llm-commandcode: could not register the dsh-TUI settings section: ${error instanceof Error ? error.message : String(error)}`);
+			ctx.logger?.warn(`llm-commandcode: could not register the dsh-TUI settings section: ${readableErrorText(error)}`);
 		}
 	};
 	refresh();
@@ -10805,78 +11374,6 @@ function transportBudgetMessage(failureMessage, maxRetries) {
 	return `${failureMessage}；Command Code API 连接在连续重试后仍失败——已停止重试以免整轮卡死。插件已自动重试 ${maxRetries} 次。通常说明当前网络到 api.commandcode.ai 的连接不通，常见原因是代理未生效：DSH 只读取环境变量 HTTPS_PROXY/HTTP_PROXY（系统代理/PAC 不会被读取），请确认启动 DSH 的终端里已导出代理，或先关闭代理直连后重试。网络恢复后直接重发即可 — Command Code API transport still failed after ${maxRetries} automatic retries, which were stopped so the turn could not stall for minutes. This is a connectivity problem between this machine and api.commandcode.ai, not a context-window or request-size rejection. Common cause: the proxy is not reaching the harness — DSH reads HTTPS_PROXY/HTTP_PROXY from the environment only (a Windows system proxy/PAC setting is not consulted), so export it in the launching shell, or turn the proxy off and retry. Resend when the network recovers; the budget is per request and has been reset`;
 }
 //#endregion
-//#region src/config-volatile.ts
-/**
-* Volatile-config helpers for dsh 0.1.7's schema-derived profile Config.
-*
-* 0.1.7's `settings.describe()` projects each entry's schema through
-* `volatileForm()`, so a form contains ONLY nodes carrying `meta.volatile`
-* and a form edit is refused unless its path lies beneath a marked node. The
-* loader then resolves each marked field into a frozen `{ get() }` reference
-* that is written IN PLACE (no remount) and announced with
-* `loader/volatile-update`. Two helpers keep the rest of the plugin reading a
-* PLAIN `Config`: `markVolatile()` applies the mark, and
-* `unwrapVolatileConfig()` reads every top-level field through its reference
-* when one is present — FRESH per call, because a reference's identity is
-* stable while its value changes.
-*
-* Only TOP-LEVEL fields are marked (a form write names a top-level path such
-* as `accounts` or `modelVisibility.<id>`), so one unwrap level is complete.
-* The literal `apiKey` secret stays unmarked on purpose: no settings surface
-* writes it — page and TUI both write keys through the credentials seam — so a
-* config-file edit to it reloading the fiber is correct for a secret literal.
-*
-* @module dsh-commandcode-provider/config-volatile
-*/
-/**
-* Mark one schema field volatile.
-*
-* `.volatile()` is unconditional: it is a schemastery 3.18.3 feature and every
-* supported engine ships `~3.18.4` or `~3.18.5-alpha.1`, so the
-* method is always present. It is reached through a structural member so the caller's
-* declared field type survives — the mark changes what the schema PARSES to (a
-* live reference), not the plugin-facing `Config` shape.
-*/
-function markVolatile(schema) {
-	return schema.volatile();
-}
-/**
-* Mark every field of a Config field dict volatile, except the named
-* composition-only secrets (`apiKey` here, which no settings surface writes).
-*/
-function markVolatileFields(fields, skip = []) {
-	return Object.fromEntries(Object.entries(fields).map(([name, schema]) => [name, skip.includes(name) ? schema : markVolatile(schema)]));
-}
-/**
-* Whether a resolved config value is a volatile reference.
-*
-* Duck-typed on the two properties `createVolatile` produces (frozen object
-* with a `get` method) rather than cosmokit's private `write` symbol, because
-* cosmokit is not a peer of this bundle. Config values are plain parsed JSON
-* (or `!!jsExpr` wrappers), which are never frozen, so the test cannot
-* misfire on an ordinary field.
-*/
-function isVolatileRef(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value) && Object.isFrozen(value) && typeof value.get === "function";
-}
-/**
-* Read one config object as PLAIN values.
-*
-* Every top-level field found to be a volatile reference is read through
-* `.get()` — freshly on every call, so a live update lands on the very next
-* read (the loader resolves EVERY marked node into a reference, unset fields
-* included, so a loader-parsed config always yields a fresh object here). The
-* pass-through for a field that is not a reference is what keeps the unmarked
-* `apiKey` literal readable.
-*/
-function unwrapVolatileConfig(config) {
-	const source = config;
-	if (typeof source !== "object" || source === null) return config;
-	const plain = {};
-	for (const [field, value] of Object.entries(source)) plain[field] = isVolatileRef(value) ? value.get() : value;
-	return plain;
-}
-//#endregion
 //#region src/index.ts
 /**
 * dsh-commandcode-provider — DeepSeek Harness LLM provider plugin for Command
@@ -10936,6 +11433,7 @@ const Config = z.object(markVolatileFields({
 	modelVisibility: z.dict(z.boolean()),
 	contextWindow: z.number().min(1).max(CONTEXT_WINDOW_MAX).step(1),
 	contextWindowOverrides: z.dict(z.number().min(1).max(CONTEXT_WINDOW_MAX).step(1)),
+	maxOutputTokens: z.number().min(0).max(MAX_OUTPUT_TOKEN_LIMIT).step(1),
 	webSearch: z.boolean().default(true),
 	showSidebarQuota: z.boolean().default(false),
 	accounts: z.array(z.object({
@@ -10983,6 +11481,7 @@ function resolveAdapterOptions(config) {
 		modelVisibility: readModelVisibility(config.modelVisibility),
 		contextWindow: isValidContextWindow(config.contextWindow) ? config.contextWindow : void 0,
 		contextWindowOverrides: readContextWindowOverrides(config.contextWindowOverrides),
+		maxOutputTokens: isValidMaxOutputTokens(config.maxOutputTokens) ? config.maxOutputTokens : void 0,
 		zdr: config.zdr === true
 	};
 }
@@ -11143,7 +11642,7 @@ function apply(ctx, config) {
 			else try {
 				report = await adapter.getUsage(account.key, connection);
 			} catch (error) {
-				report = { failures: [error instanceof Error ? error.message : String(error)] };
+				report = { failures: [readableErrorText(error)] };
 			}
 			const state = account?.state;
 			const usable = accountUsable(state);
@@ -11225,13 +11724,24 @@ function apply(ctx, config) {
 		listModels: catalogForEditors,
 		analytics: createAnalyticsReader(ctx, adapter)
 	});
-	const searchSelection = commandCodeSearchSelection();
+	const selectionLogger = {
+		warn: (message) => {
+			ctx.logger.warn(message);
+		},
+		info: (message) => {
+			ctx.logger.info(message);
+		}
+	};
+	let searchSelection;
 	const applySearchSelection = (enabled) => {
-		if (webRuntime !== void 0) applyCommandCodeSearchSelection(webRuntime, searchSelection, enabled);
+		searchSelection?.apply(enabled);
 	};
-	let webRuntime;
 	ctx.inject(["web"], (webCtx) => {
-		webRuntime = webCtx.web;
+		searchSelection = createCommandCodeSearchSelection({
+			web: webCtx.web,
+			settings: () => ctx.get("settings"),
+			logger: selectionLogger
+		});
 		webCtx.web.registerSearchProvider(new CommandCodeSearchProvider({
 			resolveKey: async (apiBase) => {
 				const connection = options();
@@ -11243,8 +11753,8 @@ function apply(ctx, config) {
 		}));
 		applySearchSelection(current().webSearch ?? true);
 		webCtx.effect(() => () => {
-			webRuntime = void 0;
-			applyCommandCodeSearchSelection(webCtx.web, searchSelection, false);
+			searchSelection?.release();
+			searchSelection = void 0;
 		}, "dsh-commandcode-provider: web search selection");
 	});
 	let refreshTuiSettings;
@@ -11289,6 +11799,7 @@ function apply(ctx, config) {
 				dispose();
 			};
 		}, "dsh-commandcode-provider: settings auto-form policy");
+		applySearchSelection(current().webSearch ?? true);
 	});
 	const loaderEvents = ctx;
 	ctx.effect(() => {
@@ -11302,6 +11813,6 @@ function apply(ctx, config) {
 	}, "dsh-commandcode-provider: volatile config updates");
 }
 //#endregion
-export { ACTIVE_ACCOUNT_AUTO, BILLING_ACCESS_TTL_MS, COMMANDCODE_SEARCH_PROVIDER_ID, COMMAND_CODE_CLI_VERSION, CommandCodeAccountPool, CommandCodeAdapter, CommandCodeLoginFlow, CommandCodeSearchProvider, CommandCodeUsageService, Config, DEFAULT_API_BASE, DEFAULT_GENERATE_MAX_TOKENS, DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_MODELS_CACHE_PATH, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_WEB_SEARCH_PROVIDER_ID, KNOWN_DEALS, KNOWN_EFFORTS, KNOWN_IMAGE_MODELS, KNOWN_NON_ZDR_MODELS, KNOWN_PEAK_PRICING, KNOWN_PLANS, KNOWN_SUBSCRIPTION_PLANS, KNOWN_THINKING_MODELS, LANG_AUTO, LOGIN_ALLOWED_ORIGINS, LOGIN_BEGIN_ENDPOINT, LOGIN_BODY_LIMIT_BYTES, LOGIN_CANCEL_ENDPOINT, LOGIN_MAX_PORT_ATTEMPTS, LOGIN_START_PORT, LOGIN_STATUS_ENDPOINT, LOGIN_TIMEOUT_MS, PLAN_LABELS, PLAN_ORDER, PROVIDER, USAGE_REPORT_ENDPOINT, accountUsable, apply, applyCommandCodeSearchSelection, applyCommandCodeTuiSettings, applyCommands, applyUsageRemote, buildCommandAuthUrl, buildCommandCodeTuiSection, capabilityDescription, commandCodeSearchSelection, commandDefinition, compareByPlan, dealLabel, formatContext, inject, loginStatusSchema, matchModelRule, modelVisibleInPlan, name, parseLoginStatus, peakPricingLabel, peakPricingState, planLabel, projectSlugFromPath, resolveAdapterOptions, resolveAuthFileApiKey, selectAccountForModel, selectActiveAccount, studioBaseForApiBase, subscriptionPlanInfo, supportsZeroDataRetention, usageReportSchema, validateCommandApiKey };
+export { ACTIVE_ACCOUNT_AUTO, BILLING_ACCESS_TTL_MS, COMMANDCODE_SEARCH_PROVIDER_ID, COMMAND_CODE_CLI_VERSION, CommandCodeAccountPool, CommandCodeAdapter, CommandCodeLoginFlow, CommandCodeSearchProvider, CommandCodeUsageService, Config, DEFAULT_API_BASE, DEFAULT_GENERATE_MAX_TOKENS, DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_MODELS_CACHE_PATH, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_WEB_SEARCH_PROVIDER_ID, KNOWN_DEALS, KNOWN_EFFORTS, KNOWN_IMAGE_MODELS, KNOWN_NON_ZDR_MODELS, KNOWN_PEAK_PRICING, KNOWN_PLANS, KNOWN_SUBSCRIPTION_PLANS, KNOWN_THINKING_MODELS, LANG_AUTO, LOGIN_ALLOWED_ORIGINS, LOGIN_BEGIN_ENDPOINT, LOGIN_BODY_LIMIT_BYTES, LOGIN_CANCEL_ENDPOINT, LOGIN_MAX_PORT_ATTEMPTS, LOGIN_START_PORT, LOGIN_STATUS_ENDPOINT, LOGIN_TIMEOUT_MS, PLAN_LABELS, PLAN_ORDER, PROVIDER, USAGE_REPORT_ENDPOINT, WEB_SELECTION_NAMESPACE, accountUsable, apply, applyCommandCodeTuiSettings, applyCommands, applyUsageRemote, buildCommandAuthUrl, buildCommandCodeTuiSection, capabilityDescription, commandCodeSearchSelection, commandDefinition, compareByPlan, createCommandCodeSearchSelection, dealLabel, formatContext, inject, loginStatusSchema, matchModelRule, modelVisibleInPlan, name, parseLoginStatus, peakPricingLabel, peakPricingState, planLabel, projectSlugFromPath, resolveAdapterOptions, resolveAuthFileApiKey, selectAccountForModel, selectActiveAccount, studioBaseForApiBase, subscriptionPlanInfo, supportsZeroDataRetention, usageReportSchema, validateCommandApiKey };
 
 //# sourceMappingURL=index.js.map