@mars-sea/dsh-commandcode-provider 0.14.4 → 0.15.0

package/lib/index.js

@@ -123,13 +123,15 @@ const PLAN_ORDER = Object.fromEntries(PLAN_TIER_ORDER.map((tier, index) => [tier
 * subscription-plan labels, deals, and hourly (peak/off-peak) pricing.
 *
 * Everything here is synced from official sources — the command-code CLI
-* bundle's model table (`dist/cli.mjs`, re-verified at command-code@1.84.0), the
+* bundle's model table (`dist/cli.mjs`, re-verified at command-code@1.86.3), the
 * live model catalog (`GET /provider/v1/models?view=client`, the authority for
 * capability fields since 1.82.4), and the official plan/pricing/model docs; see
 * the dsh-commandcode-upstream skill for the extraction procedures. The
-* 2026-10-20 sync is catalog-only: the CLI artifact stayed at 1.84.0 while the
-* catalog added the MiniMax M3.1 Flash launch pair and dropped the Stealth Cat
-* Jam preview. Keeping the snapshot in its own module
+* 2026-10-21 sync moves the CLI from 1.84.0 to 1.86.1 and picks up the Ornith
+* 1.5 122B launch pair in the catalog, the ZDR exclusion-set prune and the
+* MiniMax M3.1 Flash promo extension. The follow-up check later that day moves
+* the pinned constant to 1.86.3 (request header only): 1.86.2/1.86.3 leave
+* every snapshot here untouched, so no data in this file moved for them. Keeping the snapshot in its own module
 * confines those frequent sync diffs here: src/adapter.ts holds only the stable
 * wire/runtime logic. The read helpers live here too, for the same reason.
 *
@@ -589,6 +591,8 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"moonshotai/Kimi-K2.7-Code",
 	"moonshotai/Kimi-K2.7-Code-Highspeed",
 	"moonshotai/Kimi-K3",
+	"ornith/ornith-1.5-122b",
+	"ornith/ornith-1.5-122b:free",
 	"sakana/fugu-ultra",
 	"stepfun/Step-3.7-Flash",
 	"stepfun/Step-5-Preview",
@@ -633,7 +637,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 * request can still name it. At the 1.84.0 sync both this row and
 * `stealth/cat-jam:free` were also served by the `?view=client` catalog, which
 * is where the 1.82.4 verdict came from; the catalog stopped serving cat-jam on
-* 2026-10-20, so the artifact's exclusion set is now its only evidence.
+* 2026-10-20, and the artifact followed at 1.86.1 (see the prune note below).
 *
 * command-code@1.82.4 moved the authority for this verdict: `knownModelSupportsZdr`
 * no longer negates a bundled Set, it returns `resolveKnownCatalogModel({model,
@@ -672,38 +676,44 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 * neither source alone is complete, which is why this set is not simply "what
 * the CLI says".
 *
-* The 2026-10-20 catalog-only sync changes no membership: `stealth/cat-jam:free`
+* The 2026-10-20 catalog-only sync changed no membership: `stealth/cat-jam:free`
 * left both catalog views (its `zdr:false` verdict is no longer served), but the
-* 1.84.0 artifact's exclusion set still names it and this set is the union, so
-* membership stays at 25. The MiniMax M3.1 Flash launch pair is ZDR-covered
+* 1.84.0 artifact's exclusion set still named it and this set is the union, so
+* membership stayed at 25. The MiniMax M3.1 Flash launch pair is ZDR-covered
 * (`zdr:true` on both ids) and joins no set.
+*
+* 2026-10-21 (command-code@1.86.1 sync) prunes the set 25 -> 18, and for the
+* first time the two sources agree exactly: the 1.86.1 artifact's
+* `modelSupportsZdr` set and the live catalog's `zdr:false` rows are the same 18
+* ids (`knownModelSupportsZdr` is gone from the artifact). +3: `claude-fable-5`,
+* `claude-fable-5-1` and `tencent/hy4-preview`. -10: the nine models the catalog
+* flipped to `zdr:true` (Muse Spark 1.1 / 1.2 / 1.3, Muse Wonder 1.0, Grok 4.5 /
+* 4.6, MiMo V2.6 Flash / Pro, GLM-5.2 Fast) plus `stealth/cat-jam:free`, which
+* no source serves any more. Cat-jam is removed by explicit decision (see the
+* decision record, chapter 7 item 13): keeping a retired id in the negative set
+* is defense for stale sessions, not evidence, and the 1.86.1 artifact itself
+* dropped it. A verdict flip here is positive evidence, never "listed before,
+* absent now".
 */
 const KNOWN_NON_ZDR_MODELS = /* @__PURE__ */ new Set([
 	"MiniMaxAI/MiniMax-M3",
 	"Qwen/Qwen3.8-Max-0902",
+	"claude-fable-5",
+	"claude-fable-5-1",
 	"deepseek/deepseek-v4.1-flash-fast",
-	"meta/muse-spark-1.1",
-	"meta/muse-spark-1.2",
+	"meituan/LongCat-2.0",
 	"meta/muse-spark-1.2-contributor",
-	"meta/muse-spark-1.3",
 	"meta/muse-spark-1.3-contributor",
-	"meta/muse-wonder-1.0",
-	"meituan/LongCat-2.0",
 	"minimax/minimax-m3-free",
 	"poolside/laguna-s-2.1-free",
 	"reflection/beam:free",
 	"sakana/fugu-ultra",
 	"stealth/glyph-cluster:free",
-	"stealth/cat-jam:free",
 	"stepfun/Step-3.7-Flash",
 	"stepfun/Step-5-Preview",
-	"xai/grok-4.5",
-	"xai/grok-4.6",
-	"xiaomi/mimo-v2.6-flash",
-	"xiaomi/mimo-v2.6-pro",
+	"tencent/hy4-preview",
 	"xiaomi/mimo-v2.6-pro-ultraspeed",
-	"z-ai/glm-5.3-flashx",
-	"zai-org/GLM-5.2-Fast"
+	"z-ai/glm-5.3-flashx"
 ]);
 /**
 * Whether the CLI snapshot lists a ZDR-capable upstream for `modelId`. This is
@@ -742,7 +752,9 @@ const KNOWN_THINKING_MODELS = /* @__PURE__ */ new Set([
 	"thinkingmachines/inkling",
 	"thinkingmachines/inkling-small",
 	"poolside/laguna-s-2.1-free",
-	"meituan/LongCat-2.0"
+	"meituan/LongCat-2.0",
+	"ornith/ornith-1.5-122b",
+	"ornith/ornith-1.5-122b:free"
 ]);
 /**
 * Catalog models the Provider API serves ONLY through `/provider/v1/messages`
@@ -873,11 +885,12 @@ const MODEL_OUTPUT_TOKEN_LIMITS = /* @__PURE__ */ new Map([
 	["meta/muse-spark-1.3", 131072],
 	["meta/muse-spark-1.3-contributor", 131072],
 	["meta/muse-wonder-1.0", 131072],
-	["minimax/minimax-m3.1-flash", 512e3],
-	["minimax/minimax-m3.1-flash:free", 512e3],
+	["minimax/minimax-m3.1-flash", 524288],
+	["minimax/minimax-m3.1-flash:free", 524288],
 	["MiniMaxAI/MiniMax-M2.5", 131072],
 	["MiniMaxAI/MiniMax-M2.7", 131072],
-	["MiniMaxAI/MiniMax-M3", 512e3],
+	["MiniMaxAI/MiniMax-M3", 524288],
+	["mistral/mistral-large-4", 262144],
 	["moonshotai/Kimi-K2.6", 262144],
 	["moonshotai/Kimi-K2.7-Code", 262144],
 	["moonshotai/Kimi-K2.7-Code-Highspeed", 262144],
@@ -920,8 +933,8 @@ const MODEL_OUTPUT_TOKEN_LIMITS = /* @__PURE__ */ new Map([
 * `/docs/plans/max` and `/docs/resources/pricing-limits`). Each plan's model
 * list is a superset of the one below it: Go ⊂ GOAT ⊂ Pro ⊂ Provider/Max.
 * Models absent from every plan list (Claude Opus/Fable, Fugu Ultra) are
-* Provider-tier. Re-verified at command-code@1.82.4 (2026-10-16) against the
-* live `?view=client` catalog: 93 ids, still a strict superset chain. Mistral
+* Provider-tier. Re-verified at command-code@1.86.3 (2026-10-21) against the
+* live `?view=client` catalog: 104 ids, still a strict superset chain. Mistral
 * Large 4
 * (1.75.0) was the only addition at the 1.77.0 check; the 1.78.0/1.79.0 pair
 * added Claude Haiku 5.5 at Pro and the free Glyph Cluster preview at Go.
@@ -930,11 +943,12 @@ const MODEL_OUTPUT_TOKEN_LIMITS = /* @__PURE__ */ new Map([
 * train adds Qwen 3.8 Max Prime at GOAT plus Muse Spark Open, Nemotron 3.5
 * Super VL and the free Cat Jam preview at Go, and drops Ling 3.0 Flash Sante,
 * which left the live catalog. Every other
-* tier is unchanged.
+* tier is unchanged. The 1.86.1 sync (2026-10-21) adds only the Ornith 1.5 122B
+* launch pair at Go.
 * The only removals since 1.49.0 are the two retired stealth previews (Pixel
-* Canary at 1.73.1, Space Bunny Alpha at 1.74.3) and Ling 3.0 Flash Sante
-* (2026-10-16). Per-entry tags below name the
-* releases that added or moved each row.
+* Canary at 1.73.1, Space Bunny Alpha at 1.74.3), Ling 3.0 Flash Sante
+* (2026-10-16) and the retired Cat Jam preview (2026-10-20). Per-entry tags
+* below name the releases that added or moved each row.
 *
 * The Provider API exposes no plan metadata, so this snapshot is the source of
 * truth for the picker's plan annotation — it answers "which plan do I need to
@@ -982,6 +996,8 @@ const KNOWN_PLANS = {
 	"moonshotai/Kimi-K3": "go",
 	"nvidia/nemotron-3-ultra-550b-a55b": "go",
 	"nvidia/nemotron-3.5-super-vl": "go",
+	"ornith/ornith-1.5-122b": "go",
+	"ornith/ornith-1.5-122b:free": "go",
 	"poolside/laguna-s-2.1-free": "go",
 	"reflection/beam:free": "go",
 	"stepfun/Step-3.5-Flash": "go",
@@ -1176,7 +1192,7 @@ const KNOWN_DEALS = {
 	"minimax/minimax-m3.1-flash:free": {
 		label: "FREE",
 		free: true,
-		expiresAt: "2026-10-21T10:45:00Z"
+		expiresAt: "2026-10-22T10:45:00Z"
 	},
 	"xiaomi/mimo-v2.5-pro": { label: "99% off" },
 	"xiaomi/mimo-v2.5": { label: "98% off" },
@@ -1191,6 +1207,11 @@ const KNOWN_DEALS = {
 	"stealth/glyph-cluster:free": {
 		label: "FREE",
 		free: true
+	},
+	"ornith/ornith-1.5-122b:free": {
+		label: "FREE",
+		free: true,
+		expiresAt: "2026-10-22T06:00:00Z"
 	}
 };
 /**
@@ -1628,8 +1649,8 @@ const MODEL_PRICE_ROWS = [
 		],
 		allowance: {
 			go: 10,
-			goat: 80,
-			pro: 90
+			goat: 100,
+			pro: 110
 		}
 	},
 	{
@@ -2540,6 +2561,19 @@ const MODEL_PRICE_ROWS = [
 			pro: 30
 		}
 	},
+	{
+		id: "ornith-1.5-122b",
+		rates: [
+			.16,
+			.64,
+			.02
+		],
+		allowance: {
+			go: 6,
+			goat: 20,
+			pro: 30
+		}
+	},
 	{
 		id: "qwen-3.6-max",
 		rates: [
@@ -3000,10 +3034,10 @@ function recordOrEmpty(value) {
 }
 //#endregion
 //#region src/cost-projection.ts
-const record$3 = (v) => isRecord(v) ? v : void 0;
+const record$4 = (v) => isRecord(v) ? v : void 0;
 const finite = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
 function tokensOf$1(value) {
-	const u = record$3(value);
+	const u = record$4(value);
 	if (!u || !finite(u.inputTokens) || !finite(u.outputTokens)) return void 0;
 	if (u.cacheReadTokens !== void 0 && !finite(u.cacheReadTokens) || u.cacheWriteTokens !== void 0 && !finite(u.cacheWriteTokens)) return void 0;
 	return {
@@ -3015,14 +3049,14 @@ function tokensOf$1(value) {
 }
 /** The four buckets of an already-parsed record, or undefined when one is missing. */
 function costTokensOf(value) {
-	const t = record$3(value);
+	const t = record$4(value);
 	if (!t || !COST_TOKEN_KEYS.every((k) => finite(t[k]))) return void 0;
 	return t;
 }
 /** Current v2 settlements store the last usage in their stream; v1 stores chunk events. */
 function usageOf(type, data) {
 	if (type === "assistant/chunk") {
-		const chunk = record$3(data.chunk);
+		const chunk = record$4(data.chunk);
 		return chunk?.type === "usage" ? tokensOf$1(chunk.usage) : void 0;
 	}
 	if (type !== "assistant/message" && type !== "assistant/attempt") return void 0;
@@ -3030,19 +3064,19 @@ function usageOf(type, data) {
 	if (direct !== void 0) return direct;
 	if (!Array.isArray(data.stream)) return void 0;
 	for (let i = data.stream.length - 1; i >= 0; i--) {
-		const item = record$3(data.stream[i]);
-		const chunk = item?.type === "chunk" ? record$3(item.chunk) : void 0;
+		const item = record$4(data.stream[i]);
+		const chunk = item?.type === "chunk" ? record$4(item.chunk) : void 0;
 		if (chunk?.type === "usage") return tokensOf$1(chunk.usage);
 	}
 }
 function parseState(value) {
-	const s = record$3(value), facts = record$3(s?.facts);
+	const s = record$4(value), facts = record$4(s?.facts);
 	if (!s || !facts || !finite(facts.pricingKey) || !Array.isArray(facts.groups)) throw new TypeError("invalid commandCodeCost state");
 	const group = (v) => {
-		const g = record$3(v);
+		const g = record$4(v);
 		return !!g && typeof g.provider === "string" && typeof g.model === "string" && (g.at === null || finite(g.at)) && finite(g.contextTokens) && costTokensOf(g.tokens) !== void 0;
 	};
-	const sel = record$3(s.selection), last = record$3(s.last);
+	const sel = record$4(s.selection), last = record$4(s.last);
 	const summaryTokens = facts.summaryTokens === void 0 ? zeroCostTokens() : costTokensOf(facts.summaryTokens);
 	if (summaryTokens === void 0 || !(s.selection === null || sel && typeof sel.provider === "string" && typeof sel.model === "string") || !(s.at === null || finite(s.at)) || !facts.groups.every(group) || !(s.last === null || last && finite(last.turn) && finite(last.step) && group(last.group))) throw new TypeError("invalid commandCodeCost state");
 	return {
@@ -3099,10 +3133,10 @@ function createCostProjection(table = modelPriceTable()) {
 			}
 		}),
 		apply(state, event) {
-			const data = record$3(event.data);
+			const data = record$4(event.data);
 			if (!data) return state;
 			if (event.type === "request/header") {
-				const config = record$3(record$3(data.header)?.config);
+				const config = record$4(record$4(data.header)?.config);
 				return {
 					...state,
 					selection: config && typeof config.provider === "string" && typeof config.model === "string" ? {
@@ -3194,10 +3228,10 @@ function installCostProjection(ctx) {
 //#endregion
 //#region src/analytics.ts
 /** 在宿主内折叠原始历史；每次请求保留计价时间和上下文，禁止使用已合并的会话成本桶。 */
-const record$2 = (v) => isRecord(v) ? v : void 0;
+const record$3 = (v) => isRecord(v) ? v : void 0;
 const number = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
 function tokensOf(v) {
-	const u = record$2(v);
+	const u = record$3(v);
 	if (!u || !number(u.inputTokens) || !number(u.outputTokens)) return void 0;
 	if (u.cacheReadTokens !== void 0 && !number(u.cacheReadTokens) || u.cacheWriteTokens !== void 0 && !number(u.cacheWriteTokens)) return void 0;
 	return {
@@ -3227,10 +3261,10 @@ function foldRequests(session, log) {
 		if (listed) facts.push(current);
 	};
 	for (const event of log.events) {
-		const d = record$2(event.data);
+		const d = record$3(event.data);
 		if (!d) continue;
 		if (event.type === "request/header") {
-			const config = record$2(record$2(d.header)?.config);
+			const config = record$3(record$3(d.header)?.config);
 			provider = typeof config?.provider === "string" ? config.provider : "";
 			model = typeof config?.model === "string" ? config.model : "";
 			if (current && current.outcome === "unknown") {
@@ -3274,7 +3308,7 @@ function foldRequests(session, log) {
 		}
 		if (!current) continue;
 		if (event.type === "turn/end" && d.turn === turn) {
-			const reason = record$2(d.reason)?.kind;
+			const reason = record$3(d.reason)?.kind;
 			if (current.outcome === "unknown") {
 				if (reason === "error") current.outcome = "failed";
 				else if (reason === "aborted") current.outcome = "cancelled";
@@ -3292,11 +3326,11 @@ function foldRequests(session, log) {
 			"assistant/attempt",
 			"assistant/chunk"
 		].includes(event.type)) continue;
-		const chunk = record$2(d.chunk);
+		const chunk = record$3(d.chunk);
 		let tokens = tokensOf(d.usage);
 		if (event.type === "assistant/chunk" && chunk?.type === "usage") tokens = tokensOf(chunk.usage);
 		if (tokens === void 0 && Array.isArray(d.stream)) for (let i = d.stream.length - 1; i >= 0; i--) {
-			const item = record$2(d.stream[i]), c = item?.type === "chunk" ? record$2(item.chunk) : void 0;
+			const item = record$3(d.stream[i]), c = item?.type === "chunk" ? record$3(item.chunk) : void 0;
 			if (c?.type === "usage") {
 				tokens = tokensOf(c.usage);
 				if (tokens) break;
@@ -3949,6 +3983,29 @@ const RETRY_MAX_DELAY_MS = 9e5;
 * once per interval per key bounds a probe endpoint that keeps failing.
 */
 const EXPLICIT_ACCOUNT_PROBE_INTERVAL_MS = 6e4;
+/**
+* How long a model-scoped `unavailable` rejection demotes an account.
+*
+* `unavailable` (no credits, or a model outside this account's plan) is a fact
+* about the balance or the model, NOT about the key — a credits-empty account
+* still serves `:free` models, which is why it must never become a permanent
+* account mark. But not remembering it at all made EVERY later request pick
+* the same doomed account first: one wasted round trip per step, and in a pool
+* where that account was the fallback, the user's error became "insufficient
+* credits" from an account they never chose (issue #51's remaining half,
+* live-probed 2026-10-21: a $0.0874 balance rejects every paid model with
+* `400 insufficient credits` while free models still answer 200).
+*
+* So the mark is a PREFERENCE, not a ban, and it is scoped per model to keep
+* the free-model escape hatch intact. Five minutes is long enough to stop a
+* single turn's steps from re-hitting the same rejection and short enough that
+* a top-up takes effect without a restart.
+*/
+const MODEL_UNAVAILABLE_TTL_MS = 3e5;
+/** One model-scoped soft mark's Map key (NUL keeps the two halves unambiguous). */
+function modelUnavailableKey(apiKey, model) {
+	return `${apiKey}\u0000${model}`;
+}
 /** A labeled, human-readable clock reading for error messages. */
 function clockLabel(ms) {
 	return new Date(ms).toLocaleString();
@@ -4019,6 +4076,11 @@ var CommandCodeAccountPool = class CommandCodeAccountPool {
 	states = /* @__PURE__ */ new Map();
 	/** 当前网关与密钥的显式探测时间，限制失败探测的频率。 */
 	explicitProbes = /* @__PURE__ */ new Map();
+	/**
+	* 模型级 `unavailable` 软标记：`key\0model` → 过期时刻（毫秒）。
+	* 只影响选择顺序，从不参与 {@link accountUsable}，所以免费模型仍可用。
+	*/
+	modelUnavailable = /* @__PURE__ */ new Map();
 	scopedStates = /* @__PURE__ */ new Map();
 	constructor(deps) {
 		this.deps = deps;
@@ -4030,7 +4092,8 @@ var CommandCodeAccountPool = class CommandCodeAccountPool {
 		if (shared === void 0) {
 			shared = {
 				states: /* @__PURE__ */ new Map(),
-				probes: /* @__PURE__ */ new Map()
+				probes: /* @__PURE__ */ new Map(),
+				modelUnavailable: /* @__PURE__ */ new Map()
 			};
 			this.scopedStates.set(context.apiBase, shared);
 		}
@@ -4043,6 +4106,7 @@ var CommandCodeAccountPool = class CommandCodeAccountPool {
 		});
 		scoped.states = shared.states;
 		scoped.explicitProbes = shared.probes;
+		scoped.modelUnavailable = shared.modelUnavailable;
 		scoped.scopedStates = this.scopedStates;
 		return scoped;
 	}
@@ -4109,11 +4173,13 @@ var CommandCodeAccountPool = class CommandCodeAccountPool {
 			if (selectActiveAccount(accounts, preferred) !== void 0) return void 0;
 			throw allAccountsUnusable(accounts);
 		}
-		const routed = selectAccountForModel(available, options?.model ?? "", this.deps.modelAccountRules?.());
+		const model = options?.model ?? "";
+		const serveable = this.withoutModelUnavailable(available, model);
+		const routed = selectAccountForModel(serveable, model, this.deps.modelAccountRules?.());
 		if (routed !== void 0) return this.pick(routed);
-		const chosen = selectActiveAccount(available, preferred);
+		const chosen = selectActiveAccount(serveable, preferred);
 		if (chosen !== void 0) {
-			const revived = await this.reviveExplicit(available, options?.model ?? "", preferred, chosen);
+			const revived = await this.reviveExplicit(available, model, preferred, chosen);
 			return this.pick(revived ?? chosen);
 		}
 		await this.probeAllMarked(available);
@@ -4166,13 +4232,15 @@ var CommandCodeAccountPool = class CommandCodeAccountPool {
 	* keeps its window unknown on purpose, so a probe can still find out.
 	*/
 	markRejected(apiKey, rejection, resetAtMs) {
-		if (rejection === "invalid-credential") this.states.set(apiKey, {
-			kind: "disabled",
-			cause: "auth",
-			reason: "invalid API key (401)",
-			until: 0
-		});
-		else if (rejection === "throttled") this.states.set(apiKey, {
+		if (rejection === "invalid-credential") {
+			this.states.set(apiKey, {
+				kind: "disabled",
+				cause: "auth",
+				reason: "invalid API key (401)",
+				until: 0
+			});
+			this.clearModelUnavailable(apiKey);
+		} else if (rejection === "throttled") this.states.set(apiKey, {
 			kind: "unknown",
 			cause: "throttle",
 			reason: "rate limited (429)",
@@ -4192,6 +4260,46 @@ var CommandCodeAccountPool = class CommandCodeAccountPool {
 		});
 	}
 	/**
+	* Record a model-scoped `unavailable` rejection (no credits, or a model
+	* outside this account's plan) as a SHORT-LIVED PREFERENCE demotion.
+	*
+	* 职责：让同一模型的后续请求先跳过这个账号，而不是每一步都重撞一次
+	* `400 insufficient credits`；同时刻意不写进 `states`，所以
+	* {@link accountUsable} 与 {@link activeAccount} 都不受影响——余额为空的
+	* 账号仍然能服务 `:free` 模型，账号卡片也不会把它标成"不可用"。
+	*
+	* 为什么按时限而非永久：余额/套餐是可以不换密钥就改变的事实（充值、升级），
+	* 而进程内没有任何事件能通知这改变，所以只能靠时钟自行恢复。
+	*/
+	markModelUnavailable(apiKey, model) {
+		if (model === "") return;
+		const now = this.now();
+		this.modelUnavailable.set(modelUnavailableKey(apiKey, model), now + MODEL_UNAVAILABLE_TTL_MS);
+		for (const [key, until] of this.modelUnavailable) if (until <= now) this.modelUnavailable.delete(key);
+	}
+	/** Drop every model-scoped mark for one key (a new credential invalidates them). */
+	clearModelUnavailable(apiKey) {
+		const prefix = `${apiKey}\u0000`;
+		for (const key of this.modelUnavailable.keys()) if (key.startsWith(prefix)) this.modelUnavailable.delete(key);
+	}
+	/**
+	* The candidates for THIS model, in preference order: accounts without a live
+	* model-scoped mark first, everything else after them.
+	*
+	* 为什么要"排后"而不是"剔除"：软标记只是偏好（见
+	* {@link markModelUnavailable}）。全部候选都被标记时必须退回全量，否则唯一
+	* 账号的池子会变成"没有可用账号"，把一次余额不足误报成额度耗尽。
+	*/
+	withoutModelUnavailable(accounts, model) {
+		if (model === "") return accounts;
+		const now = this.now();
+		const healthy = accounts.filter((account) => {
+			const until = this.modelUnavailable.get(modelUnavailableKey(account.key, model));
+			return until === void 0 || until <= now;
+		});
+		return healthy.length > 0 ? healthy : accounts;
+	}
+	/**
 	* One account's key: literal → credential seam → auth file (default slot).
 	*
 	* Every source is normalized here, at the single point where a slot's key
@@ -4463,6 +4571,18 @@ function parseOutputCeiling(detail) {
 	return Number.isSafeInteger(ceiling) && ceiling > 0 ? ceiling : void 0;
 }
 /**
+* The gateway's cap on the request's JSON STRUCTURE: `JSON node count
+* cannot exceed 32768` (issue #96). A structural limit, not a token one —
+* a session heavy in messages, tool calls and images trips it while well
+* inside the context window, so it needs its own wording: reported as the
+* generic refusal, the one sentence naming the actual cap was dropped and
+* the user had no lever at all; reported as a context overflow, the
+* harness would compact tokens and resend a structure that still exceeds
+* the cap. The stated limit is captured because the gateway owns the
+* number and it can move.
+*/
+const JSON_NODE_LIMIT_REJECTION = /JSON node count cannot exceed\s+(\d+)/i;
+/**
 * Whether one rejection says "ZDR requested, no ZDR-capable upstream": the
 * provider spells the code `cmd_zdr_no_providers` in JSON error bodies and
 * `CMD_ZDR_NO_PROVIDERS` in plain-text ones (the official CLI's own
@@ -4603,6 +4723,8 @@ function generateHttpError(status, errText, retryAfterMs, parsed = parseProvider
 		return bilingual("PROVIDER_HTTP_ERROR", `Command Code API error ${status}: this request's max_tokens is not valid for this model` + (stated ? ` (${stated})` : "") + " — the session is not oversized, so compacting it will not help; lower \"Max output tokens\" or pick a model with a larger output ceiling", `Command Code API 返回 ${status}：本次请求的 max_tokens 对该模型不合法` + (stated ? `（${stated}）` : "") + "——会话内容并未超长，压缩上下文无效；请调低「最大输出 token」或改用输出上限更大的模型", { status });
 	}
 	if (status < 500 && isContextOverflowDetail(overflowDetail)) return bilingual(CONTEXT_WINDOW_EXCEEDED_CODE, `Command Code API error ${status}: the request exceeds the model's context window — this session is being compacted and the request retried`, `Command Code API 返回 ${status}：请求内容超出模型上下文窗口——正在压缩上下文后重试；如仍失败，请新建会话或减少上下文`, { status });
+	const nodeLimit = status < 500 ? JSON_NODE_LIMIT_REJECTION.exec(overflowDetail)?.[1] : void 0;
+	if (nodeLimit !== void 0) return bilingual("PROVIDER_HTTP_ERROR", `Command Code API error ${status}: the request exceeds the gateway's JSON node limit (node count cannot exceed ${nodeLimit}) — the cap is on the request's structure, not its token length, so compacting the session usually will not be enough; start a new session, or reduce the messages and images in this one`, `Command Code API 返回 ${status}：请求超过网关的 JSON 节点数上限（节点数不能超过 ${nodeLimit}）——限制的是请求结构，不是 token 长度，压缩上下文通常不足以降到该上限以内；请新建会话，或减少本会话中的消息与图片`, { status });
 	if (status === 422 && isZdrNoProviders(providerCode, providerDetail, errText)) return bilingual("PROVIDER_HTTP_ERROR", `Command Code API error 422 (${detail}): zero data retention is enforced but no ZDR-capable upstream is available for this model — turn the ZDR setting off (or use another model)`, "Command Code API 返回 422：已开启零数据保留（ZDR），但该模型当前没有可用的 ZDR 上游——请关闭 ZDR 开关，或改用其他模型", { status: 422 });
 	if (status === 401) return bilingual("INVALID_CREDENTIAL", `Command Code API error 401 (${detail}): the API key is missing or invalid — check the key stored for COMMANDCODE_API_KEY (Models page) or the auth file`, "Command Code API 返回 401：API 密钥缺失或无效——请在设置页检查 COMMANDCODE_API_KEY 存储的密钥，或检查 auth 文件", { status: 401 });
 	if (status === 413) return bilingual("PROVIDER_HTTP_ERROR", "Command Code API error 413: the request body exceeds the provider's size limit (the cap is undocumented, measured at about 50 MB) — the session history is too large to send, usually because of accumulated image attachments. Start a new session, or drop the image-heavy part of this one, and retry", "Command Code API 返回 413：请求体超过服务端的体积上限（官方未公开，实测约 50 MB）——会话历史过大，通常是历史图片累积所致。请新建会话，或移除本会话中图片较多的部分后重试", { status: 413 });
@@ -6361,7 +6483,7 @@ var GatewayFacts = class {
 * per-request options thunk and an API-key resolver from the plugin entry
 * (src/index.ts), so a settings change reaches the very next request.
 */
-const COMMAND_CODE_CLI_VERSION = "1.84.0";
+const COMMAND_CODE_CLI_VERSION = "1.86.3";
 const DEFAULT_API_BASE = "https://api.commandcode.ai";
 /**
 * The output budget this bundle asks for, and the ceiling it will never exceed.
@@ -8964,7 +9086,7 @@ const USAGE_REPORT_ENDPOINT = "commandcode/report";
 * The shared read/validate helpers for the usage report endpoint, prefixed
 * so rejection messages name the offending boundary.
 */
-const { reject: reject$1, record: record$1, stringField: stringField$1, numberField, booleanField } = makeBoundaryValidator("commandcode/report result:");
+const { reject: reject$2, record: record$2, stringField: stringField$2, numberField: numberField$1, booleanField } = makeBoundaryValidator("commandcode/report result:");
 /**
 * Parse one quota window, or undefined when the frame carries no such window.
 *
@@ -8975,12 +9097,12 @@ const { reject: reject$1, record: record$1, stringField: stringField$1, numberFi
 */
 function windowLimit(value, field) {
 	if (value === void 0) return void 0;
-	const source = record$1(value, field);
+	const source = record$2(value, field);
 	return {
-		used: numberField(source, "used", `${field}.used`),
-		cap: numberField(source, "cap", `${field}.cap`),
+		used: numberField$1(source, "used", `${field}.used`),
+		cap: numberField$1(source, "cap", `${field}.cap`),
 		exceeded: booleanField(source, "exceeded", `${field}.exceeded`),
-		resetAt: numberField(source, "resetAt", `${field}.resetAt`)
+		resetAt: numberField$1(source, "resetAt", `${field}.resetAt`)
 	};
 }
 /**
@@ -8989,44 +9111,44 @@ function windowLimit(value, field) {
 * malformed frame fails the boundary instead of rendering garbage.
 */
 function parseUsageReport(value) {
-	const source = record$1(value, "report");
+	const source = record$2(value, "report");
 	const failures = source.failures;
-	if (!Array.isArray(failures) || failures.some((entry) => typeof entry !== "string")) reject$1("failures");
+	if (!Array.isArray(failures) || failures.some((entry) => typeof entry !== "string")) reject$2("failures");
 	const report = { failures };
 	if (source.blocked !== void 0) {
 		const blocked = source.blocked;
 		if (blocked === "invalid-key" || blocked === "service-unavailable" || blocked === "invalid-response" || blocked === "network") report.blocked = blocked;
-		else reject$1("blocked");
+		else reject$2("blocked");
 	}
 	if (source.account !== void 0) {
-		const account = record$1(source.account, "account");
+		const account = record$2(source.account, "account");
 		report.account = {
-			id: stringField$1(account, "id", "account.id"),
-			name: stringField$1(account, "name", "account.name"),
-			userName: stringField$1(account, "userName", "account.userName")
+			id: stringField$2(account, "id", "account.id"),
+			name: stringField$2(account, "name", "account.name"),
+			userName: stringField$2(account, "userName", "account.userName")
 		};
 	}
 	if (source.usage !== void 0) {
-		const usage = record$1(source.usage, "usage");
+		const usage = record$2(source.usage, "usage");
 		report.usage = {
-			totalCount: numberField(usage, "totalCount", "usage.totalCount"),
-			totalCost: numberField(usage, "totalCost", "usage.totalCost"),
-			successRate: numberField(usage, "successRate", "usage.successRate"),
-			completedCount: numberField(usage, "completedCount", "usage.completedCount"),
-			failedCount: numberField(usage, "failedCount", "usage.failedCount"),
-			totalTokensIn: numberField(usage, "totalTokensIn", "usage.totalTokensIn"),
-			totalTokensOut: numberField(usage, "totalTokensOut", "usage.totalTokensOut"),
-			totalCredits: numberField(usage, "totalCredits", "usage.totalCredits"),
-			periodBasis: stringField$1(usage, "periodBasis", "usage.periodBasis")
+			totalCount: numberField$1(usage, "totalCount", "usage.totalCount"),
+			totalCost: numberField$1(usage, "totalCost", "usage.totalCost"),
+			successRate: numberField$1(usage, "successRate", "usage.successRate"),
+			completedCount: numberField$1(usage, "completedCount", "usage.completedCount"),
+			failedCount: numberField$1(usage, "failedCount", "usage.failedCount"),
+			totalTokensIn: numberField$1(usage, "totalTokensIn", "usage.totalTokensIn"),
+			totalTokensOut: numberField$1(usage, "totalTokensOut", "usage.totalTokensOut"),
+			totalCredits: numberField$1(usage, "totalCredits", "usage.totalCredits"),
+			periodBasis: stringField$2(usage, "periodBasis", "usage.periodBasis")
 		};
-		if (usage.periodStart !== void 0) report.usage.periodStart = numberField(usage, "periodStart", "usage.periodStart");
+		if (usage.periodStart !== void 0) report.usage.periodStart = numberField$1(usage, "periodStart", "usage.periodStart");
 	}
 	if (source.credits !== void 0) {
-		const credits = record$1(source.credits, "credits");
+		const credits = record$2(source.credits, "credits");
 		const parsed = {
-			monthlyCredits: numberField(credits, "monthlyCredits", "credits.monthlyCredits"),
-			purchasedCredits: numberField(credits, "purchasedCredits", "credits.purchasedCredits"),
-			freeCredits: numberField(credits, "freeCredits", "credits.freeCredits")
+			monthlyCredits: numberField$1(credits, "monthlyCredits", "credits.monthlyCredits"),
+			purchasedCredits: numberField$1(credits, "purchasedCredits", "credits.purchasedCredits"),
+			freeCredits: numberField$1(credits, "freeCredits", "credits.freeCredits")
 		};
 		if (credits.monthlyReported !== void 0) parsed.monthlyReported = booleanField(credits, "monthlyReported", "credits.monthlyReported");
 		for (const flag of ["purchasedReported", "freeReported"]) if (credits[flag] !== void 0) parsed[flag] = booleanField(credits, flag, `credits.${flag}`);
@@ -9037,38 +9159,38 @@ function parseUsageReport(value) {
 		report.credits = parsed;
 	}
 	if (source.plan !== void 0) {
-		const plan = record$1(source.plan, "plan");
+		const plan = record$2(source.plan, "plan");
 		const monthly = plan.monthlyCredits;
-		if (monthly !== null && (typeof monthly !== "number" || !Number.isFinite(monthly))) reject$1("plan.monthlyCredits");
+		if (monthly !== null && (typeof monthly !== "number" || !Number.isFinite(monthly))) reject$2("plan.monthlyCredits");
 		report.plan = {
-			planId: stringField$1(plan, "planId", "plan.planId"),
-			name: stringField$1(plan, "name", "plan.name"),
-			status: stringField$1(plan, "status", "plan.status"),
+			planId: stringField$2(plan, "planId", "plan.planId"),
+			name: stringField$2(plan, "name", "plan.name"),
+			status: stringField$2(plan, "status", "plan.status"),
 			monthlyCredits: monthly,
-			currentPeriodEnd: numberField(plan, "currentPeriodEnd", "plan.currentPeriodEnd")
+			currentPeriodEnd: numberField$1(plan, "currentPeriodEnd", "plan.currentPeriodEnd")
 		};
-		if (plan.currentPeriodStart !== void 0) report.plan.currentPeriodStart = numberField(plan, "currentPeriodStart", "plan.currentPeriodStart");
+		if (plan.currentPeriodStart !== void 0) report.plan.currentPeriodStart = numberField$1(plan, "currentPeriodStart", "plan.currentPeriodStart");
 	}
 	return report;
 }
 /** Parse one untrusted boundary value into a {@link CommandCodeAccountUsage}. */
 function parseAccountUsage(value) {
-	const source = record$1(value, "account");
+	const source = record$2(value, "account");
 	return {
-		id: stringField$1(source, "id", "account.id"),
-		label: stringField$1(source, "label", "account.label"),
+		id: stringField$2(source, "id", "account.id"),
+		label: stringField$2(source, "label", "account.label"),
 		configured: booleanField(source, "configured", "account.configured"),
 		active: booleanField(source, "active", "account.active"),
-		mark: stringField$1(source, "mark", "account.mark"),
-		cooldownUntil: numberField(source, "cooldownUntil", "account.cooldownUntil"),
+		mark: stringField$2(source, "mark", "account.mark"),
+		cooldownUntil: numberField$1(source, "cooldownUntil", "account.cooldownUntil"),
 		report: parseUsageReport(source.report)
 	};
 }
 /** Parse the wire result into a {@link CommandCodeAccountsReport}. */
 function parseAccountsReport(value) {
-	const accounts = record$1(value, "result").accounts;
+	const accounts = record$2(value, "result").accounts;
 	if (Array.isArray(accounts)) return { accounts: accounts.map(parseAccountUsage) };
-	return reject$1("accounts");
+	return reject$2("accounts");
 }
 /**
 * The strict result codec both halves attach to the descriptor. Hand-rolled:
@@ -9201,36 +9323,36 @@ const REASONS = [
 ];
 /** The shared read/validate helpers, prefixed with the login endpoint so
 * rejection messages name the offending boundary. */
-const { reject, record, stringField } = makeBoundaryValidator("commandcode/login result:");
+const { reject: reject$1, record: record$1, stringField: stringField$1 } = makeBoundaryValidator("commandcode/login result:");
 /**
 * Parse one untrusted boundary value into a {@link CommandCodeLoginStatus}.
 * Every field is shape-checked so a malformed frame fails the boundary
 * instead of leaking into the page.
 */
 function parseLoginStatus(value) {
-	const source = record(value, "status");
+	const source = record$1(value, "status");
 	const state = source.state;
 	if (state === "idle" || state === "waiting" || state === "success" || state === "failed") {
 		const status = { state };
-		if (source.authUrl !== void 0) status.authUrl = stringField(source, "authUrl", "authUrl");
-		if (source.userName !== void 0) status.userName = stringField(source, "userName", "userName");
-		if (source.keyName !== void 0) status.keyName = stringField(source, "keyName", "keyName");
+		if (source.authUrl !== void 0) status.authUrl = stringField$1(source, "authUrl", "authUrl");
+		if (source.userName !== void 0) status.userName = stringField$1(source, "userName", "userName");
+		if (source.keyName !== void 0) status.keyName = stringField$1(source, "keyName", "keyName");
 		if (source.reason !== void 0) {
 			const reason = source.reason;
 			if (typeof reason === "string" && REASONS.includes(reason)) status.reason = reason;
-			else reject("reason");
+			else reject$1("reason");
 		}
-		if (source.message !== void 0) status.message = stringField(source, "message", "message");
+		if (source.message !== void 0) status.message = stringField$1(source, "message", "message");
 		return status;
 	}
-	return reject("state");
+	return reject$1("state");
 }
 /** The strict result codec shared by all three login endpoints. */
 const loginStatusSchema = { parse: parseLoginStatus };
 /** Optional account target; the Host still checks it against saved slots. */
 const loginTargetSchema = { parse(value) {
 	if (value === void 0 || typeof value === "string") return value;
-	return reject("targetRef");
+	return reject$1("targetRef");
 } };
 /** Build one login invocation descriptor. Only begin accepts an account ref. */
 function loginDescriptor(endpoint, method) {
@@ -9389,6 +9511,31 @@ const ENROLLMENT_DESCRIPTORS = [
 	}
 ];
 //#endregion
+//#region src/service-probe-wire.ts
+/** Canonical `<namespace>/<method>` endpoint of the probe Remote. */
+const PROBE_ENDPOINT = "commandcode/probe";
+const OUTCOMES = [
+	"ok",
+	"http-error",
+	"timeout",
+	"unreachable"
+];
+const { reject, record, stringField, numberField } = makeBoundaryValidator("commandcode/probe result:");
+/** Strict result codec, shared verbatim by the Host registration and Client mount. */
+function parseProbeResult(value) {
+	const source = record(value, "result");
+	const outcome = stringField(source, "outcome", "outcome");
+	if (!OUTCOMES.includes(outcome)) reject("outcome");
+	return {
+		outcome,
+		status: numberField(source, "status", "status"),
+		latencyMs: numberField(source, "latencyMs", "latencyMs"),
+		checkedAt: numberField(source, "checkedAt", "checkedAt")
+	};
+}
+/** The one invocation descriptor, shared by the Host registration and the Client mount. */
+const PROBE_DESCRIPTOR = makeRemoteDescriptor(PROBE_ENDPOINT, "probe", `${REMOTE_PACKAGE}#CommandCodeProbeResult`, { parse: parseProbeResult });
+//#endregion
 //#region src/usage-remote.ts
 /**
 * The Remote receiver: a Cordis service the Gateway resolves by key
@@ -9439,6 +9586,17 @@ var CommandCodeUsageService = class extends TypertRemoteService {
 	async prices() {
 		return (this.deps.prices ?? modelPriceTable)();
 	}
+	/**
+	* One live connectivity probe of the configured API base, run on this Host.
+	* The status page's own data lags by design (Upptime publishes on change or
+	* once a day), so this is the only real-time half of the status row. The
+	* plugin entry wires the probe; a programmatic setup without it gets an
+	* explicit failure, which the row renders as unknown.
+	*/
+	async probe() {
+		if (this.deps.probe === void 0) throw new Error("宿主未提供连通性探测");
+		return this.deps.probe();
+	}
 	async analytics(query) {
 		if (!this.deps.analytics) throw new Error("宿主不支持模型分析，请更新插件");
 		return this.deps.analytics(query, this.ctx.invocation?.signal);
@@ -9533,6 +9691,7 @@ function applyUsageRemote(ctx, deps) {
 				MODELS_DESCRIPTOR,
 				PRICES_DESCRIPTOR,
 				ANALYTICS_DESCRIPTOR,
+				PROBE_DESCRIPTOR,
 				...LOGIN_HOST_CONTRIBUTION.invocations,
 				...ENROLLMENT_DESCRIPTORS
 			]
@@ -9540,6 +9699,93 @@ function applyUsageRemote(ctx, deps) {
 		remoteCtx.effect(() => () => void unregister(), "dsh-commandcode-provider: usage remote");
 	});
 }
+/**
+* HTTP statuses Upptime's default monitor accepts as `up` (from
+* `uptime-monitor`'s `expectedStatusCodes` fallback). Kept in sync with the
+* page's monitor rather than invented here: a 401 or 404 means the endpoint
+* answered but is not the surface the official check calls healthy.
+*/
+const UP_STATUSES = /* @__PURE__ */ new Set([
+	200,
+	201,
+	202,
+	203,
+	204,
+	205,
+	206,
+	207,
+	208,
+	226,
+	300,
+	301,
+	302,
+	303,
+	304,
+	305,
+	306,
+	307,
+	308
+]);
+/** Turn the response status into the outcome the row renders. */
+function probeOutcomeForStatus(status) {
+	return UP_STATUSES.has(status) ? "ok" : "http-error";
+}
+/**
+* Probe the configured API base once. Never rejects: an invalid base, a
+* timeout and a transport failure all resolve to an outcome.
+*
+* `redirect: 'manual'` keeps the classification on the FIRST response, exactly
+* like the monitor's HTTP client; following a redirect would report the final
+* destination's status as if it were the API's own.
+*/
+async function probeCommandCode(options) {
+	const now = options.now ?? Date.now;
+	let url;
+	try {
+		url = new URL("/", options.apiBase).toString();
+	} catch {
+		return {
+			outcome: "unreachable",
+			status: 0,
+			latencyMs: 0,
+			checkedAt: now()
+		};
+	}
+	const controller = new AbortController();
+	let timedOut = false;
+	const timer = setTimeout(() => {
+		timedOut = true;
+		controller.abort();
+	}, options.timeoutMs ?? 5e3);
+	const started = Date.now();
+	try {
+		const response = await (options.fetchImpl ?? fetch)(url, {
+			method: "GET",
+			redirect: "manual",
+			signal: controller.signal,
+			headers: { accept: "*/*" }
+		});
+		const latencyMs = Math.max(0, Date.now() - started);
+		try {
+			await response.body?.cancel();
+		} catch {}
+		return {
+			outcome: probeOutcomeForStatus(response.status),
+			status: response.status,
+			latencyMs,
+			checkedAt: now()
+		};
+	} catch {
+		return {
+			outcome: timedOut ? "timeout" : "unreachable",
+			status: 0,
+			latencyMs: 0,
+			checkedAt: now()
+		};
+	} finally {
+		clearTimeout(timer);
+	}
+}
 //#endregion
 //#region src/login.ts
 /**
@@ -11662,6 +11908,7 @@ function apply(ctx, config) {
 		rotateApiKey: async (rejectedKey, rejection, connection, model, rotation) => {
 			const accounts = scopedPool(connection);
 			if (rejection !== "unavailable") accounts.markRejected(rejectedKey, rejection, rotation?.resetAtMs);
+			else if (model !== void 0) accounts.markModelUnavailable(rejectedKey, model);
 			const tried = rotation?.tried?.length ? rotation.tried : [rejectedKey];
 			const resolved = await accounts.resolveKey(model === void 0 ? { tried } : {
 				tried,
@@ -11816,7 +12063,8 @@ function apply(ctx, config) {
 		login: loginFlow,
 		enrollment,
 		listModels: catalogForEditors,
-		analytics: createAnalyticsReader(ctx, adapter)
+		analytics: createAnalyticsReader(ctx, adapter),
+		probe: () => probeCommandCode({ apiBase: options().apiBase })
 	});
 	const selectionLogger = {
 		warn: (message) => {