@mars-sea/dsh-commandcode-provider 0.14.5 → 0.15.0

package/lib/index.js

@@ -123,13 +123,15 @@ const PLAN_ORDER = Object.fromEntries(PLAN_TIER_ORDER.map((tier, index) => [tier
 * subscription-plan labels, deals, and hourly (peak/off-peak) pricing.
 *
 * Everything here is synced from official sources — the command-code CLI
-* bundle's model table (`dist/cli.mjs`, re-verified at command-code@1.86.1), the
+* bundle's model table (`dist/cli.mjs`, re-verified at command-code@1.86.3), the
 * live model catalog (`GET /provider/v1/models?view=client`, the authority for
 * capability fields since 1.82.4), and the official plan/pricing/model docs; see
 * the dsh-commandcode-upstream skill for the extraction procedures. The
 * 2026-10-21 sync moves the CLI from 1.84.0 to 1.86.1 and picks up the Ornith
 * 1.5 122B launch pair in the catalog, the ZDR exclusion-set prune and the
-* MiniMax M3.1 Flash promo extension. Keeping the snapshot in its own module
+* MiniMax M3.1 Flash promo extension. The follow-up check later that day moves
+* the pinned constant to 1.86.3 (request header only): 1.86.2/1.86.3 leave
+* every snapshot here untouched, so no data in this file moved for them. Keeping the snapshot in its own module
 * confines those frequent sync diffs here: src/adapter.ts holds only the stable
 * wire/runtime logic. The read helpers live here too, for the same reason.
 *
@@ -931,7 +933,7 @@ const MODEL_OUTPUT_TOKEN_LIMITS = /* @__PURE__ */ new Map([
 * `/docs/plans/max` and `/docs/resources/pricing-limits`). Each plan's model
 * list is a superset of the one below it: Go ⊂ GOAT ⊂ Pro ⊂ Provider/Max.
 * Models absent from every plan list (Claude Opus/Fable, Fugu Ultra) are
-* Provider-tier. Re-verified at command-code@1.86.1 (2026-10-21) against the
+* Provider-tier. Re-verified at command-code@1.86.3 (2026-10-21) against the
 * live `?view=client` catalog: 104 ids, still a strict superset chain. Mistral
 * Large 4
 * (1.75.0) was the only addition at the 1.77.0 check; the 1.78.0/1.79.0 pair
@@ -3032,10 +3034,10 @@ function recordOrEmpty(value) {
 }
 //#endregion
 //#region src/cost-projection.ts
-const record$3 = (v) => isRecord(v) ? v : void 0;
+const record$4 = (v) => isRecord(v) ? v : void 0;
 const finite = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
 function tokensOf$1(value) {
-	const u = record$3(value);
+	const u = record$4(value);
 	if (!u || !finite(u.inputTokens) || !finite(u.outputTokens)) return void 0;
 	if (u.cacheReadTokens !== void 0 && !finite(u.cacheReadTokens) || u.cacheWriteTokens !== void 0 && !finite(u.cacheWriteTokens)) return void 0;
 	return {
@@ -3047,14 +3049,14 @@ function tokensOf$1(value) {
 }
 /** The four buckets of an already-parsed record, or undefined when one is missing. */
 function costTokensOf(value) {
-	const t = record$3(value);
+	const t = record$4(value);
 	if (!t || !COST_TOKEN_KEYS.every((k) => finite(t[k]))) return void 0;
 	return t;
 }
 /** Current v2 settlements store the last usage in their stream; v1 stores chunk events. */
 function usageOf(type, data) {
 	if (type === "assistant/chunk") {
-		const chunk = record$3(data.chunk);
+		const chunk = record$4(data.chunk);
 		return chunk?.type === "usage" ? tokensOf$1(chunk.usage) : void 0;
 	}
 	if (type !== "assistant/message" && type !== "assistant/attempt") return void 0;
@@ -3062,19 +3064,19 @@ function usageOf(type, data) {
 	if (direct !== void 0) return direct;
 	if (!Array.isArray(data.stream)) return void 0;
 	for (let i = data.stream.length - 1; i >= 0; i--) {
-		const item = record$3(data.stream[i]);
-		const chunk = item?.type === "chunk" ? record$3(item.chunk) : void 0;
+		const item = record$4(data.stream[i]);
+		const chunk = item?.type === "chunk" ? record$4(item.chunk) : void 0;
 		if (chunk?.type === "usage") return tokensOf$1(chunk.usage);
 	}
 }
 function parseState(value) {
-	const s = record$3(value), facts = record$3(s?.facts);
+	const s = record$4(value), facts = record$4(s?.facts);
 	if (!s || !facts || !finite(facts.pricingKey) || !Array.isArray(facts.groups)) throw new TypeError("invalid commandCodeCost state");
 	const group = (v) => {
-		const g = record$3(v);
+		const g = record$4(v);
 		return !!g && typeof g.provider === "string" && typeof g.model === "string" && (g.at === null || finite(g.at)) && finite(g.contextTokens) && costTokensOf(g.tokens) !== void 0;
 	};
-	const sel = record$3(s.selection), last = record$3(s.last);
+	const sel = record$4(s.selection), last = record$4(s.last);
 	const summaryTokens = facts.summaryTokens === void 0 ? zeroCostTokens() : costTokensOf(facts.summaryTokens);
 	if (summaryTokens === void 0 || !(s.selection === null || sel && typeof sel.provider === "string" && typeof sel.model === "string") || !(s.at === null || finite(s.at)) || !facts.groups.every(group) || !(s.last === null || last && finite(last.turn) && finite(last.step) && group(last.group))) throw new TypeError("invalid commandCodeCost state");
 	return {
@@ -3131,10 +3133,10 @@ function createCostProjection(table = modelPriceTable()) {
 			}
 		}),
 		apply(state, event) {
-			const data = record$3(event.data);
+			const data = record$4(event.data);
 			if (!data) return state;
 			if (event.type === "request/header") {
-				const config = record$3(record$3(data.header)?.config);
+				const config = record$4(record$4(data.header)?.config);
 				return {
 					...state,
 					selection: config && typeof config.provider === "string" && typeof config.model === "string" ? {
@@ -3226,10 +3228,10 @@ function installCostProjection(ctx) {
 //#endregion
 //#region src/analytics.ts
 /** 在宿主内折叠原始历史；每次请求保留计价时间和上下文，禁止使用已合并的会话成本桶。 */
-const record$2 = (v) => isRecord(v) ? v : void 0;
+const record$3 = (v) => isRecord(v) ? v : void 0;
 const number = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
 function tokensOf(v) {
-	const u = record$2(v);
+	const u = record$3(v);
 	if (!u || !number(u.inputTokens) || !number(u.outputTokens)) return void 0;
 	if (u.cacheReadTokens !== void 0 && !number(u.cacheReadTokens) || u.cacheWriteTokens !== void 0 && !number(u.cacheWriteTokens)) return void 0;
 	return {
@@ -3259,10 +3261,10 @@ function foldRequests(session, log) {
 		if (listed) facts.push(current);
 	};
 	for (const event of log.events) {
-		const d = record$2(event.data);
+		const d = record$3(event.data);
 		if (!d) continue;
 		if (event.type === "request/header") {
-			const config = record$2(record$2(d.header)?.config);
+			const config = record$3(record$3(d.header)?.config);
 			provider = typeof config?.provider === "string" ? config.provider : "";
 			model = typeof config?.model === "string" ? config.model : "";
 			if (current && current.outcome === "unknown") {
@@ -3306,7 +3308,7 @@ function foldRequests(session, log) {
 		}
 		if (!current) continue;
 		if (event.type === "turn/end" && d.turn === turn) {
-			const reason = record$2(d.reason)?.kind;
+			const reason = record$3(d.reason)?.kind;
 			if (current.outcome === "unknown") {
 				if (reason === "error") current.outcome = "failed";
 				else if (reason === "aborted") current.outcome = "cancelled";
@@ -3324,11 +3326,11 @@ function foldRequests(session, log) {
 			"assistant/attempt",
 			"assistant/chunk"
 		].includes(event.type)) continue;
-		const chunk = record$2(d.chunk);
+		const chunk = record$3(d.chunk);
 		let tokens = tokensOf(d.usage);
 		if (event.type === "assistant/chunk" && chunk?.type === "usage") tokens = tokensOf(chunk.usage);
 		if (tokens === void 0 && Array.isArray(d.stream)) for (let i = d.stream.length - 1; i >= 0; i--) {
-			const item = record$2(d.stream[i]), c = item?.type === "chunk" ? record$2(item.chunk) : void 0;
+			const item = record$3(d.stream[i]), c = item?.type === "chunk" ? record$3(item.chunk) : void 0;
 			if (c?.type === "usage") {
 				tokens = tokensOf(c.usage);
 				if (tokens) break;
@@ -3981,6 +3983,29 @@ const RETRY_MAX_DELAY_MS = 9e5;
 * once per interval per key bounds a probe endpoint that keeps failing.
 */
 const EXPLICIT_ACCOUNT_PROBE_INTERVAL_MS = 6e4;
+/**
+* How long a model-scoped `unavailable` rejection demotes an account.
+*
+* `unavailable` (no credits, or a model outside this account's plan) is a fact
+* about the balance or the model, NOT about the key — a credits-empty account
+* still serves `:free` models, which is why it must never become a permanent
+* account mark. But not remembering it at all made EVERY later request pick
+* the same doomed account first: one wasted round trip per step, and in a pool
+* where that account was the fallback, the user's error became "insufficient
+* credits" from an account they never chose (issue #51's remaining half,
+* live-probed 2026-10-21: a $0.0874 balance rejects every paid model with
+* `400 insufficient credits` while free models still answer 200).
+*
+* So the mark is a PREFERENCE, not a ban, and it is scoped per model to keep
+* the free-model escape hatch intact. Five minutes is long enough to stop a
+* single turn's steps from re-hitting the same rejection and short enough that
+* a top-up takes effect without a restart.
+*/
+const MODEL_UNAVAILABLE_TTL_MS = 3e5;
+/** One model-scoped soft mark's Map key (NUL keeps the two halves unambiguous). */
+function modelUnavailableKey(apiKey, model) {
+	return `${apiKey}\u0000${model}`;
+}
 /** A labeled, human-readable clock reading for error messages. */
 function clockLabel(ms) {
 	return new Date(ms).toLocaleString();
@@ -4051,6 +4076,11 @@ var CommandCodeAccountPool = class CommandCodeAccountPool {
 	states = /* @__PURE__ */ new Map();
 	/** 当前网关与密钥的显式探测时间，限制失败探测的频率。 */
 	explicitProbes = /* @__PURE__ */ new Map();
+	/**
+	* 模型级 `unavailable` 软标记：`key\0model` → 过期时刻（毫秒）。
+	* 只影响选择顺序，从不参与 {@link accountUsable}，所以免费模型仍可用。
+	*/
+	modelUnavailable = /* @__PURE__ */ new Map();
 	scopedStates = /* @__PURE__ */ new Map();
 	constructor(deps) {
 		this.deps = deps;
@@ -4062,7 +4092,8 @@ var CommandCodeAccountPool = class CommandCodeAccountPool {
 		if (shared === void 0) {
 			shared = {
 				states: /* @__PURE__ */ new Map(),
-				probes: /* @__PURE__ */ new Map()
+				probes: /* @__PURE__ */ new Map(),
+				modelUnavailable: /* @__PURE__ */ new Map()
 			};
 			this.scopedStates.set(context.apiBase, shared);
 		}
@@ -4075,6 +4106,7 @@ var CommandCodeAccountPool = class CommandCodeAccountPool {
 		});
 		scoped.states = shared.states;
 		scoped.explicitProbes = shared.probes;
+		scoped.modelUnavailable = shared.modelUnavailable;
 		scoped.scopedStates = this.scopedStates;
 		return scoped;
 	}
@@ -4141,11 +4173,13 @@ var CommandCodeAccountPool = class CommandCodeAccountPool {
 			if (selectActiveAccount(accounts, preferred) !== void 0) return void 0;
 			throw allAccountsUnusable(accounts);
 		}
-		const routed = selectAccountForModel(available, options?.model ?? "", this.deps.modelAccountRules?.());
+		const model = options?.model ?? "";
+		const serveable = this.withoutModelUnavailable(available, model);
+		const routed = selectAccountForModel(serveable, model, this.deps.modelAccountRules?.());
 		if (routed !== void 0) return this.pick(routed);
-		const chosen = selectActiveAccount(available, preferred);
+		const chosen = selectActiveAccount(serveable, preferred);
 		if (chosen !== void 0) {
-			const revived = await this.reviveExplicit(available, options?.model ?? "", preferred, chosen);
+			const revived = await this.reviveExplicit(available, model, preferred, chosen);
 			return this.pick(revived ?? chosen);
 		}
 		await this.probeAllMarked(available);
@@ -4198,13 +4232,15 @@ var CommandCodeAccountPool = class CommandCodeAccountPool {
 	* keeps its window unknown on purpose, so a probe can still find out.
 	*/
 	markRejected(apiKey, rejection, resetAtMs) {
-		if (rejection === "invalid-credential") this.states.set(apiKey, {
-			kind: "disabled",
-			cause: "auth",
-			reason: "invalid API key (401)",
-			until: 0
-		});
-		else if (rejection === "throttled") this.states.set(apiKey, {
+		if (rejection === "invalid-credential") {
+			this.states.set(apiKey, {
+				kind: "disabled",
+				cause: "auth",
+				reason: "invalid API key (401)",
+				until: 0
+			});
+			this.clearModelUnavailable(apiKey);
+		} else if (rejection === "throttled") this.states.set(apiKey, {
 			kind: "unknown",
 			cause: "throttle",
 			reason: "rate limited (429)",
@@ -4224,6 +4260,46 @@ var CommandCodeAccountPool = class CommandCodeAccountPool {
 		});
 	}
 	/**
+	* Record a model-scoped `unavailable` rejection (no credits, or a model
+	* outside this account's plan) as a SHORT-LIVED PREFERENCE demotion.
+	*
+	* 职责：让同一模型的后续请求先跳过这个账号，而不是每一步都重撞一次
+	* `400 insufficient credits`；同时刻意不写进 `states`，所以
+	* {@link accountUsable} 与 {@link activeAccount} 都不受影响——余额为空的
+	* 账号仍然能服务 `:free` 模型，账号卡片也不会把它标成"不可用"。
+	*
+	* 为什么按时限而非永久：余额/套餐是可以不换密钥就改变的事实（充值、升级），
+	* 而进程内没有任何事件能通知这改变，所以只能靠时钟自行恢复。
+	*/
+	markModelUnavailable(apiKey, model) {
+		if (model === "") return;
+		const now = this.now();
+		this.modelUnavailable.set(modelUnavailableKey(apiKey, model), now + MODEL_UNAVAILABLE_TTL_MS);
+		for (const [key, until] of this.modelUnavailable) if (until <= now) this.modelUnavailable.delete(key);
+	}
+	/** Drop every model-scoped mark for one key (a new credential invalidates them). */
+	clearModelUnavailable(apiKey) {
+		const prefix = `${apiKey}\u0000`;
+		for (const key of this.modelUnavailable.keys()) if (key.startsWith(prefix)) this.modelUnavailable.delete(key);
+	}
+	/**
+	* The candidates for THIS model, in preference order: accounts without a live
+	* model-scoped mark first, everything else after them.
+	*
+	* 为什么要"排后"而不是"剔除"：软标记只是偏好（见
+	* {@link markModelUnavailable}）。全部候选都被标记时必须退回全量，否则唯一
+	* 账号的池子会变成"没有可用账号"，把一次余额不足误报成额度耗尽。
+	*/
+	withoutModelUnavailable(accounts, model) {
+		if (model === "") return accounts;
+		const now = this.now();
+		const healthy = accounts.filter((account) => {
+			const until = this.modelUnavailable.get(modelUnavailableKey(account.key, model));
+			return until === void 0 || until <= now;
+		});
+		return healthy.length > 0 ? healthy : accounts;
+	}
+	/**
 	* One account's key: literal → credential seam → auth file (default slot).
 	*
 	* Every source is normalized here, at the single point where a slot's key
@@ -4495,6 +4571,18 @@ function parseOutputCeiling(detail) {
 	return Number.isSafeInteger(ceiling) && ceiling > 0 ? ceiling : void 0;
 }
 /**
+* The gateway's cap on the request's JSON STRUCTURE: `JSON node count
+* cannot exceed 32768` (issue #96). A structural limit, not a token one —
+* a session heavy in messages, tool calls and images trips it while well
+* inside the context window, so it needs its own wording: reported as the
+* generic refusal, the one sentence naming the actual cap was dropped and
+* the user had no lever at all; reported as a context overflow, the
+* harness would compact tokens and resend a structure that still exceeds
+* the cap. The stated limit is captured because the gateway owns the
+* number and it can move.
+*/
+const JSON_NODE_LIMIT_REJECTION = /JSON node count cannot exceed\s+(\d+)/i;
+/**
 * Whether one rejection says "ZDR requested, no ZDR-capable upstream": the
 * provider spells the code `cmd_zdr_no_providers` in JSON error bodies and
 * `CMD_ZDR_NO_PROVIDERS` in plain-text ones (the official CLI's own
@@ -4635,6 +4723,8 @@ function generateHttpError(status, errText, retryAfterMs, parsed = parseProvider
 		return bilingual("PROVIDER_HTTP_ERROR", `Command Code API error ${status}: this request's max_tokens is not valid for this model` + (stated ? ` (${stated})` : "") + " — the session is not oversized, so compacting it will not help; lower \"Max output tokens\" or pick a model with a larger output ceiling", `Command Code API 返回 ${status}：本次请求的 max_tokens 对该模型不合法` + (stated ? `（${stated}）` : "") + "——会话内容并未超长，压缩上下文无效；请调低「最大输出 token」或改用输出上限更大的模型", { status });
 	}
 	if (status < 500 && isContextOverflowDetail(overflowDetail)) return bilingual(CONTEXT_WINDOW_EXCEEDED_CODE, `Command Code API error ${status}: the request exceeds the model's context window — this session is being compacted and the request retried`, `Command Code API 返回 ${status}：请求内容超出模型上下文窗口——正在压缩上下文后重试；如仍失败，请新建会话或减少上下文`, { status });
+	const nodeLimit = status < 500 ? JSON_NODE_LIMIT_REJECTION.exec(overflowDetail)?.[1] : void 0;
+	if (nodeLimit !== void 0) return bilingual("PROVIDER_HTTP_ERROR", `Command Code API error ${status}: the request exceeds the gateway's JSON node limit (node count cannot exceed ${nodeLimit}) — the cap is on the request's structure, not its token length, so compacting the session usually will not be enough; start a new session, or reduce the messages and images in this one`, `Command Code API 返回 ${status}：请求超过网关的 JSON 节点数上限（节点数不能超过 ${nodeLimit}）——限制的是请求结构，不是 token 长度，压缩上下文通常不足以降到该上限以内；请新建会话，或减少本会话中的消息与图片`, { status });
 	if (status === 422 && isZdrNoProviders(providerCode, providerDetail, errText)) return bilingual("PROVIDER_HTTP_ERROR", `Command Code API error 422 (${detail}): zero data retention is enforced but no ZDR-capable upstream is available for this model — turn the ZDR setting off (or use another model)`, "Command Code API 返回 422：已开启零数据保留（ZDR），但该模型当前没有可用的 ZDR 上游——请关闭 ZDR 开关，或改用其他模型", { status: 422 });
 	if (status === 401) return bilingual("INVALID_CREDENTIAL", `Command Code API error 401 (${detail}): the API key is missing or invalid — check the key stored for COMMANDCODE_API_KEY (Models page) or the auth file`, "Command Code API 返回 401：API 密钥缺失或无效——请在设置页检查 COMMANDCODE_API_KEY 存储的密钥，或检查 auth 文件", { status: 401 });
 	if (status === 413) return bilingual("PROVIDER_HTTP_ERROR", "Command Code API error 413: the request body exceeds the provider's size limit (the cap is undocumented, measured at about 50 MB) — the session history is too large to send, usually because of accumulated image attachments. Start a new session, or drop the image-heavy part of this one, and retry", "Command Code API 返回 413：请求体超过服务端的体积上限（官方未公开，实测约 50 MB）——会话历史过大，通常是历史图片累积所致。请新建会话，或移除本会话中图片较多的部分后重试", { status: 413 });
@@ -6393,7 +6483,7 @@ var GatewayFacts = class {
 * per-request options thunk and an API-key resolver from the plugin entry
 * (src/index.ts), so a settings change reaches the very next request.
 */
-const COMMAND_CODE_CLI_VERSION = "1.86.1";
+const COMMAND_CODE_CLI_VERSION = "1.86.3";
 const DEFAULT_API_BASE = "https://api.commandcode.ai";
 /**
 * The output budget this bundle asks for, and the ceiling it will never exceed.
@@ -8996,7 +9086,7 @@ const USAGE_REPORT_ENDPOINT = "commandcode/report";
 * The shared read/validate helpers for the usage report endpoint, prefixed
 * so rejection messages name the offending boundary.
 */
-const { reject: reject$1, record: record$1, stringField: stringField$1, numberField, booleanField } = makeBoundaryValidator("commandcode/report result:");
+const { reject: reject$2, record: record$2, stringField: stringField$2, numberField: numberField$1, booleanField } = makeBoundaryValidator("commandcode/report result:");
 /**
 * Parse one quota window, or undefined when the frame carries no such window.
 *
@@ -9007,12 +9097,12 @@ const { reject: reject$1, record: record$1, stringField: stringField$1, numberFi
 */
 function windowLimit(value, field) {
 	if (value === void 0) return void 0;
-	const source = record$1(value, field);
+	const source = record$2(value, field);
 	return {
-		used: numberField(source, "used", `${field}.used`),
-		cap: numberField(source, "cap", `${field}.cap`),
+		used: numberField$1(source, "used", `${field}.used`),
+		cap: numberField$1(source, "cap", `${field}.cap`),
 		exceeded: booleanField(source, "exceeded", `${field}.exceeded`),
-		resetAt: numberField(source, "resetAt", `${field}.resetAt`)
+		resetAt: numberField$1(source, "resetAt", `${field}.resetAt`)
 	};
 }
 /**
@@ -9021,44 +9111,44 @@ function windowLimit(value, field) {
 * malformed frame fails the boundary instead of rendering garbage.
 */
 function parseUsageReport(value) {
-	const source = record$1(value, "report");
+	const source = record$2(value, "report");
 	const failures = source.failures;
-	if (!Array.isArray(failures) || failures.some((entry) => typeof entry !== "string")) reject$1("failures");
+	if (!Array.isArray(failures) || failures.some((entry) => typeof entry !== "string")) reject$2("failures");
 	const report = { failures };
 	if (source.blocked !== void 0) {
 		const blocked = source.blocked;
 		if (blocked === "invalid-key" || blocked === "service-unavailable" || blocked === "invalid-response" || blocked === "network") report.blocked = blocked;
-		else reject$1("blocked");
+		else reject$2("blocked");
 	}
 	if (source.account !== void 0) {
-		const account = record$1(source.account, "account");
+		const account = record$2(source.account, "account");
 		report.account = {
-			id: stringField$1(account, "id", "account.id"),
-			name: stringField$1(account, "name", "account.name"),
-			userName: stringField$1(account, "userName", "account.userName")
+			id: stringField$2(account, "id", "account.id"),
+			name: stringField$2(account, "name", "account.name"),
+			userName: stringField$2(account, "userName", "account.userName")
 		};
 	}
 	if (source.usage !== void 0) {
-		const usage = record$1(source.usage, "usage");
+		const usage = record$2(source.usage, "usage");
 		report.usage = {
-			totalCount: numberField(usage, "totalCount", "usage.totalCount"),
-			totalCost: numberField(usage, "totalCost", "usage.totalCost"),
-			successRate: numberField(usage, "successRate", "usage.successRate"),
-			completedCount: numberField(usage, "completedCount", "usage.completedCount"),
-			failedCount: numberField(usage, "failedCount", "usage.failedCount"),
-			totalTokensIn: numberField(usage, "totalTokensIn", "usage.totalTokensIn"),
-			totalTokensOut: numberField(usage, "totalTokensOut", "usage.totalTokensOut"),
-			totalCredits: numberField(usage, "totalCredits", "usage.totalCredits"),
-			periodBasis: stringField$1(usage, "periodBasis", "usage.periodBasis")
+			totalCount: numberField$1(usage, "totalCount", "usage.totalCount"),
+			totalCost: numberField$1(usage, "totalCost", "usage.totalCost"),
+			successRate: numberField$1(usage, "successRate", "usage.successRate"),
+			completedCount: numberField$1(usage, "completedCount", "usage.completedCount"),
+			failedCount: numberField$1(usage, "failedCount", "usage.failedCount"),
+			totalTokensIn: numberField$1(usage, "totalTokensIn", "usage.totalTokensIn"),
+			totalTokensOut: numberField$1(usage, "totalTokensOut", "usage.totalTokensOut"),
+			totalCredits: numberField$1(usage, "totalCredits", "usage.totalCredits"),
+			periodBasis: stringField$2(usage, "periodBasis", "usage.periodBasis")
 		};
-		if (usage.periodStart !== void 0) report.usage.periodStart = numberField(usage, "periodStart", "usage.periodStart");
+		if (usage.periodStart !== void 0) report.usage.periodStart = numberField$1(usage, "periodStart", "usage.periodStart");
 	}
 	if (source.credits !== void 0) {
-		const credits = record$1(source.credits, "credits");
+		const credits = record$2(source.credits, "credits");
 		const parsed = {
-			monthlyCredits: numberField(credits, "monthlyCredits", "credits.monthlyCredits"),
-			purchasedCredits: numberField(credits, "purchasedCredits", "credits.purchasedCredits"),
-			freeCredits: numberField(credits, "freeCredits", "credits.freeCredits")
+			monthlyCredits: numberField$1(credits, "monthlyCredits", "credits.monthlyCredits"),
+			purchasedCredits: numberField$1(credits, "purchasedCredits", "credits.purchasedCredits"),
+			freeCredits: numberField$1(credits, "freeCredits", "credits.freeCredits")
 		};
 		if (credits.monthlyReported !== void 0) parsed.monthlyReported = booleanField(credits, "monthlyReported", "credits.monthlyReported");
 		for (const flag of ["purchasedReported", "freeReported"]) if (credits[flag] !== void 0) parsed[flag] = booleanField(credits, flag, `credits.${flag}`);
@@ -9069,38 +9159,38 @@ function parseUsageReport(value) {
 		report.credits = parsed;
 	}
 	if (source.plan !== void 0) {
-		const plan = record$1(source.plan, "plan");
+		const plan = record$2(source.plan, "plan");
 		const monthly = plan.monthlyCredits;
-		if (monthly !== null && (typeof monthly !== "number" || !Number.isFinite(monthly))) reject$1("plan.monthlyCredits");
+		if (monthly !== null && (typeof monthly !== "number" || !Number.isFinite(monthly))) reject$2("plan.monthlyCredits");
 		report.plan = {
-			planId: stringField$1(plan, "planId", "plan.planId"),
-			name: stringField$1(plan, "name", "plan.name"),
-			status: stringField$1(plan, "status", "plan.status"),
+			planId: stringField$2(plan, "planId", "plan.planId"),
+			name: stringField$2(plan, "name", "plan.name"),
+			status: stringField$2(plan, "status", "plan.status"),
 			monthlyCredits: monthly,
-			currentPeriodEnd: numberField(plan, "currentPeriodEnd", "plan.currentPeriodEnd")
+			currentPeriodEnd: numberField$1(plan, "currentPeriodEnd", "plan.currentPeriodEnd")
 		};
-		if (plan.currentPeriodStart !== void 0) report.plan.currentPeriodStart = numberField(plan, "currentPeriodStart", "plan.currentPeriodStart");
+		if (plan.currentPeriodStart !== void 0) report.plan.currentPeriodStart = numberField$1(plan, "currentPeriodStart", "plan.currentPeriodStart");
 	}
 	return report;
 }
 /** Parse one untrusted boundary value into a {@link CommandCodeAccountUsage}. */
 function parseAccountUsage(value) {
-	const source = record$1(value, "account");
+	const source = record$2(value, "account");
 	return {
-		id: stringField$1(source, "id", "account.id"),
-		label: stringField$1(source, "label", "account.label"),
+		id: stringField$2(source, "id", "account.id"),
+		label: stringField$2(source, "label", "account.label"),
 		configured: booleanField(source, "configured", "account.configured"),
 		active: booleanField(source, "active", "account.active"),
-		mark: stringField$1(source, "mark", "account.mark"),
-		cooldownUntil: numberField(source, "cooldownUntil", "account.cooldownUntil"),
+		mark: stringField$2(source, "mark", "account.mark"),
+		cooldownUntil: numberField$1(source, "cooldownUntil", "account.cooldownUntil"),
 		report: parseUsageReport(source.report)
 	};
 }
 /** Parse the wire result into a {@link CommandCodeAccountsReport}. */
 function parseAccountsReport(value) {
-	const accounts = record$1(value, "result").accounts;
+	const accounts = record$2(value, "result").accounts;
 	if (Array.isArray(accounts)) return { accounts: accounts.map(parseAccountUsage) };
-	return reject$1("accounts");
+	return reject$2("accounts");
 }
 /**
 * The strict result codec both halves attach to the descriptor. Hand-rolled:
@@ -9233,36 +9323,36 @@ const REASONS = [
 ];
 /** The shared read/validate helpers, prefixed with the login endpoint so
 * rejection messages name the offending boundary. */
-const { reject, record, stringField } = makeBoundaryValidator("commandcode/login result:");
+const { reject: reject$1, record: record$1, stringField: stringField$1 } = makeBoundaryValidator("commandcode/login result:");
 /**
 * Parse one untrusted boundary value into a {@link CommandCodeLoginStatus}.
 * Every field is shape-checked so a malformed frame fails the boundary
 * instead of leaking into the page.
 */
 function parseLoginStatus(value) {
-	const source = record(value, "status");
+	const source = record$1(value, "status");
 	const state = source.state;
 	if (state === "idle" || state === "waiting" || state === "success" || state === "failed") {
 		const status = { state };
-		if (source.authUrl !== void 0) status.authUrl = stringField(source, "authUrl", "authUrl");
-		if (source.userName !== void 0) status.userName = stringField(source, "userName", "userName");
-		if (source.keyName !== void 0) status.keyName = stringField(source, "keyName", "keyName");
+		if (source.authUrl !== void 0) status.authUrl = stringField$1(source, "authUrl", "authUrl");
+		if (source.userName !== void 0) status.userName = stringField$1(source, "userName", "userName");
+		if (source.keyName !== void 0) status.keyName = stringField$1(source, "keyName", "keyName");
 		if (source.reason !== void 0) {
 			const reason = source.reason;
 			if (typeof reason === "string" && REASONS.includes(reason)) status.reason = reason;
-			else reject("reason");
+			else reject$1("reason");
 		}
-		if (source.message !== void 0) status.message = stringField(source, "message", "message");
+		if (source.message !== void 0) status.message = stringField$1(source, "message", "message");
 		return status;
 	}
-	return reject("state");
+	return reject$1("state");
 }
 /** The strict result codec shared by all three login endpoints. */
 const loginStatusSchema = { parse: parseLoginStatus };
 /** Optional account target; the Host still checks it against saved slots. */
 const loginTargetSchema = { parse(value) {
 	if (value === void 0 || typeof value === "string") return value;
-	return reject("targetRef");
+	return reject$1("targetRef");
 } };
 /** Build one login invocation descriptor. Only begin accepts an account ref. */
 function loginDescriptor(endpoint, method) {
@@ -9421,6 +9511,31 @@ const ENROLLMENT_DESCRIPTORS = [
 	}
 ];
 //#endregion
+//#region src/service-probe-wire.ts
+/** Canonical `<namespace>/<method>` endpoint of the probe Remote. */
+const PROBE_ENDPOINT = "commandcode/probe";
+const OUTCOMES = [
+	"ok",
+	"http-error",
+	"timeout",
+	"unreachable"
+];
+const { reject, record, stringField, numberField } = makeBoundaryValidator("commandcode/probe result:");
+/** Strict result codec, shared verbatim by the Host registration and Client mount. */
+function parseProbeResult(value) {
+	const source = record(value, "result");
+	const outcome = stringField(source, "outcome", "outcome");
+	if (!OUTCOMES.includes(outcome)) reject("outcome");
+	return {
+		outcome,
+		status: numberField(source, "status", "status"),
+		latencyMs: numberField(source, "latencyMs", "latencyMs"),
+		checkedAt: numberField(source, "checkedAt", "checkedAt")
+	};
+}
+/** The one invocation descriptor, shared by the Host registration and the Client mount. */
+const PROBE_DESCRIPTOR = makeRemoteDescriptor(PROBE_ENDPOINT, "probe", `${REMOTE_PACKAGE}#CommandCodeProbeResult`, { parse: parseProbeResult });
+//#endregion
 //#region src/usage-remote.ts
 /**
 * The Remote receiver: a Cordis service the Gateway resolves by key
@@ -9471,6 +9586,17 @@ var CommandCodeUsageService = class extends TypertRemoteService {
 	async prices() {
 		return (this.deps.prices ?? modelPriceTable)();
 	}
+	/**
+	* One live connectivity probe of the configured API base, run on this Host.
+	* The status page's own data lags by design (Upptime publishes on change or
+	* once a day), so this is the only real-time half of the status row. The
+	* plugin entry wires the probe; a programmatic setup without it gets an
+	* explicit failure, which the row renders as unknown.
+	*/
+	async probe() {
+		if (this.deps.probe === void 0) throw new Error("宿主未提供连通性探测");
+		return this.deps.probe();
+	}
 	async analytics(query) {
 		if (!this.deps.analytics) throw new Error("宿主不支持模型分析，请更新插件");
 		return this.deps.analytics(query, this.ctx.invocation?.signal);
@@ -9565,6 +9691,7 @@ function applyUsageRemote(ctx, deps) {
 				MODELS_DESCRIPTOR,
 				PRICES_DESCRIPTOR,
 				ANALYTICS_DESCRIPTOR,
+				PROBE_DESCRIPTOR,
 				...LOGIN_HOST_CONTRIBUTION.invocations,
 				...ENROLLMENT_DESCRIPTORS
 			]
@@ -9572,6 +9699,93 @@ function applyUsageRemote(ctx, deps) {
 		remoteCtx.effect(() => () => void unregister(), "dsh-commandcode-provider: usage remote");
 	});
 }
+/**
+* HTTP statuses Upptime's default monitor accepts as `up` (from
+* `uptime-monitor`'s `expectedStatusCodes` fallback). Kept in sync with the
+* page's monitor rather than invented here: a 401 or 404 means the endpoint
+* answered but is not the surface the official check calls healthy.
+*/
+const UP_STATUSES = /* @__PURE__ */ new Set([
+	200,
+	201,
+	202,
+	203,
+	204,
+	205,
+	206,
+	207,
+	208,
+	226,
+	300,
+	301,
+	302,
+	303,
+	304,
+	305,
+	306,
+	307,
+	308
+]);
+/** Turn the response status into the outcome the row renders. */
+function probeOutcomeForStatus(status) {
+	return UP_STATUSES.has(status) ? "ok" : "http-error";
+}
+/**
+* Probe the configured API base once. Never rejects: an invalid base, a
+* timeout and a transport failure all resolve to an outcome.
+*
+* `redirect: 'manual'` keeps the classification on the FIRST response, exactly
+* like the monitor's HTTP client; following a redirect would report the final
+* destination's status as if it were the API's own.
+*/
+async function probeCommandCode(options) {
+	const now = options.now ?? Date.now;
+	let url;
+	try {
+		url = new URL("/", options.apiBase).toString();
+	} catch {
+		return {
+			outcome: "unreachable",
+			status: 0,
+			latencyMs: 0,
+			checkedAt: now()
+		};
+	}
+	const controller = new AbortController();
+	let timedOut = false;
+	const timer = setTimeout(() => {
+		timedOut = true;
+		controller.abort();
+	}, options.timeoutMs ?? 5e3);
+	const started = Date.now();
+	try {
+		const response = await (options.fetchImpl ?? fetch)(url, {
+			method: "GET",
+			redirect: "manual",
+			signal: controller.signal,
+			headers: { accept: "*/*" }
+		});
+		const latencyMs = Math.max(0, Date.now() - started);
+		try {
+			await response.body?.cancel();
+		} catch {}
+		return {
+			outcome: probeOutcomeForStatus(response.status),
+			status: response.status,
+			latencyMs,
+			checkedAt: now()
+		};
+	} catch {
+		return {
+			outcome: timedOut ? "timeout" : "unreachable",
+			status: 0,
+			latencyMs: 0,
+			checkedAt: now()
+		};
+	} finally {
+		clearTimeout(timer);
+	}
+}
 //#endregion
 //#region src/login.ts
 /**
@@ -11694,6 +11908,7 @@ function apply(ctx, config) {
 		rotateApiKey: async (rejectedKey, rejection, connection, model, rotation) => {
 			const accounts = scopedPool(connection);
 			if (rejection !== "unavailable") accounts.markRejected(rejectedKey, rejection, rotation?.resetAtMs);
+			else if (model !== void 0) accounts.markModelUnavailable(rejectedKey, model);
 			const tried = rotation?.tried?.length ? rotation.tried : [rejectedKey];
 			const resolved = await accounts.resolveKey(model === void 0 ? { tried } : {
 				tried,
@@ -11848,7 +12063,8 @@ function apply(ctx, config) {
 		login: loginFlow,
 		enrollment,
 		listModels: catalogForEditors,
-		analytics: createAnalyticsReader(ctx, adapter)
+		analytics: createAnalyticsReader(ctx, adapter),
+		probe: () => probeCommandCode({ apiBase: options().apiBase })
 	});
 	const selectionLogger = {
 		warn: (message) => {