@mars-sea/dsh-commandcode-provider 0.15.3 → 0.15.5

package/CHANGELOG.md

@@ -4,6 +4,53 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.15.5] - 2026-10-27
+
+
+### Changed
+
+- **请求路径与账户读取的一批性能优化（线上字节不变）。**
+  - `streamAttempt()` 的凭据解析与正文装配改为并发：两者互不依赖（正文从不携带密钥，健康账号池的解析只读内存），从前却是严格串行，带图请求因此把图片读取与 JSON 装配整个排在 `resolveApiKey()` 之后。与密钥无关的通道判断先算成 `provisionalProtocol`，凭据返回后目标一致即复用，不一致才重建一次（与既有协议回退、账号轮换同价）。代价是 Go 计划/已学 CLI 通道的账号每次请求会多装配一次正文（线上字节不变，纯 CPU 开销）。图片预算的**会计**仍先于任何 I/O 执行，但**抛错**推迟到凭据与真实通道落定之后：预算门与缓存门一次算全、一次抛出。
+  - `listModels()` 在**本进程联网成功过**该网关目录时不再等一次联网刷新，改用内存中的行立即返回、后台刷新留给下次打开；进程首次加载仍照旧等待。新判据 `GatewayFacts.loaded()` 以「来源」为准而不是「内存里有行」：`snapshot()` 从磁盘灌入的行、以及刷新失败后的空目录都不算热数据（磁盘副本没有年龄校验）。`resolveModel()` 与 `stream()` 不变，仍等真实刷新。
+  - `gradeHeaderTimeout()` 的指纹改用**已经序列化好的实发字符串**求摘要（`sha256Hex()`），不再对 `body` 重新 `JSON.stringify`：超时是最常重复的路径，而带图历史可达数 MB。这也更准确——实发字符串就是网关看到的字节，重新 stringify 会在 surrogate 清洗真的删掉过字符时描述到不同的字节，把一次连续超时拆成两条 streak。
+  - `toolParametersSchema()` 的根节点结果按 `parameters` 对象身份记忆化（`WeakMap`）。每个通道在每次尝试时都重建工具列表，而账号轮换、协议回退、降档重试都会让同一批 schema 再走一遍。同时纠正原注释「每条路径都返回副本」——`type: 'object'` 快路径一直返回调用方自己的对象，调用方靠它拿到同一个已冻结的 schema。
+  - 用量卡片与选择器的套餐过滤共享账户端点响应：两处读的是同一批端点、同一个账号，成功响应按 `[apiBase, key, 完整 URL]` 记入短命表（`ACCOUNT_FACTS_TTL_MS` 30 秒）。实际共享的是 `whoami` 与 `subscriptions`——`credits` 的 URL 形状带 `orgId`，两处不同，不会互相命中。只缓存成功响应（失败必须重试，否则报告的 `failures` 与 `classifyTotalFailure` 结论会描述一次没真正发出的请求）；`/alpha/usage/summary` 明确不共享——那是用户正盯着、旁边写着读取时间的数字。
+  - 用量刷新区分自动与显式路径：`refresh({ auto: true })` 用于账户卡片首屏、面板首屏与面板 tick（injected 面因此分成 `refreshUsageAuto()` 与 `refreshUsage()` 两个入口），可在 `USAGE_AUTO_REFRESH_COALESCE_MS`（5 秒）内复用刚刚读到的结果；按钮、保存、换凭据等显式调用不查合并窗口（请求在途时仍按既有 `inFlight` 规则折叠），`fetchedAt` 因此仍如实反映读取时刻。
+  - 面板自动刷新在文档隐藏时跳过读取但照旧重排定时器，重新可见立即补读一次（该补读走 auto，5 秒内仍可能被合并）；首屏仍无条件读取。可见性做成可注入接缝（`AutoRefreshVisibility`），非浏览器环境视为始终可见；监听句柄随循环状态放在模块层，任意卸载顺序都能解绑。
+- **设置页账户卡片：账期与更新时间并入余额标签行。** 「月额度剩余」标签右接账期区间、同行右侧显示「更新于」；原单独一行的「官方账期用量 …」与底部重复的「账期截止」删除。账期未对齐时标签改接订阅自身的「账期截止」日期，不再显示「统计周期未确认」（额度面板不变）；余额没取到时该行仍保留，区间前补「官方账期用量」。底部只在部分接口失败时显示「部分数据未取到」。
+
+- **同步上游两处：Command Code 目录新增 `gpt-6.1-terra`，DSH `0.2.1-rc.4` 补入验证矩阵。**
+  - **Command Code（CLI 版本不变，仍 `1.88.0`）**：2026-10-27 复核 npm `latest` 与官网 changelog 均无新 CLI 版本（最新条目仍是 `1.87.3`）；服务端目录 `?view=client` 的 `catalogVersion` 由 `f41a48ed…` 变为 `7f405e24…`，默认视图 93 → 94、client 视图 105 → 106，唯一新增行是 `gpt-6.1-terra`（GPT-6.1 Terra）：1,050,000 上下文、文本 + 图像、推理档位 `low`/`medium`/`high`/`xhigh`/`max`、最低计划 Pro、`$1/$5`（≤272K 上下文）与 `$2/$7.5`（>272K）、缓存读取 `$0.05`/`$0.1`、缓存写入 `$1.25`/`$2.5`、月度额度 Go `$6`／GOAT `$20`／Pro `$20`，ZDR 默认覆盖，无促销、无峰值时段、无输出上限公布值。官方 models 页与 pricing 页均已上架，`1.88.0` 的 CLI 注册表尚未收录（审计 `incomplete`，能力字段以 `?view=client` 目录为准）。快照 +1：`KNOWN_PLANS` 93 → 94、`KNOWN_EFFORTS` 66 → 67、`KNOWN_IMAGE_MODELS` 72 → 73、内置价格行 93 → 94；ZDR 例外集（18）、自动思考模型表（16）、订阅表（9）、促销（4）、输出上限表（79）不变。`scripts/sync-model-prices.mjs` 重跑（页面 94 行，diff 仅新增该行）。
+  - **DSH `0.2.1-rc.4`**：npm `next` 于北京时间 2026-10-26 23:28（`2026-10-26T15:28:13Z`）从 `0.2.1-rc.3` 前进到 `0.2.1-rc.4`，`latest` 仍是 `0.2.1-rc.2`；GitHub 无对应 tag/release（均 404），`master` 停在 10-23，产物内构建哈希 `ec17a2c` 在公开仓库不可见——官方没有发布说明。产物级全量比对 235 个双版本包，实质变化仅 4 处：`dsh-mcp-client` 的资源能力探测（服务器未声明 `resources` 时直接返回空列表）、`dsh-client-ui-conversation` 的 View 标签提示框（按字符宽度估算、仅溢出时显示）与「更多会话视图」文案精简、`dsh-llm-deepseek-account` 的一条日志级别（`console.info` → `console.error`）、`dsh-mcp-resources` 的文档；另有 3 个包仅构建元数据（commit 短哈希、版本串）变化。插件导入的宿主包（`llm`／`settings`／`credentials`／`client-*`／`web`／`typert`／`api-remotes`／`attachment`／`commands`／`timeout`／`launch-environment`／`app-boot`）全部零功能变化。`dsh.compatibility.dshReleases` 补入 `0.2.1-rc.4`（三条实测记录），`test:engine`／`test:install` 矩阵随之变为 3 个引擎。
+
+### Fixed
+
+- **图片预算门不再抢在凭据之前抛错。** 预算门只做会计，凭据解析失败时先报 `MISSING_CREDENTIAL`：避免宿主对一次根本发不出去的请求先做不可逆的持久化图片卸载。预算门与缓存门在凭据与真实通道落定后一次算全（`max(预算, 缓存)`），不再退化成两步卸载，也不会把 cache 溢出报成 budget。（`src/adapter.ts`）
+- **`loaded()` 只认联网来源。** `snapshot()` 灌入的磁盘行与刷新失败后的空目录都不再被当成选择器首屏：冷启动"先聊天再开选择器"不会画出无年龄校验的旧目录，刷新失败后也不会先闪一次空列表。（`src/gateway-facts.ts`）
+- **可见性监听按任意卸载顺序解绑。** `unsubscribe` 句柄从函数局部提升到模块层，启动循环的 surface 先卸载时不再泄漏 `visibilitychange` 监听。（`src/client/panel.ts`）
+- **账户卡片首屏接线补真实渲染测试。** 新增 `tests/accounts-card-render.test.ts`（`react-test-renderer`）：首屏必须调 `onRefreshAuto()`、刷新按钮必须调 `onRefresh()`；把组件改回旧接线时该用例失败。此前只有"两个入口存在"的断言，回退后测试仍全绿。
+- **非安全上下文（`http://` 局域网访问）下设置页不再整块空白（issue #102）。** 页面身份原来直接取 `crypto.randomUUID()`，而该 API 只在安全上下文存在：以 `http://<局域网 IP>:3080` 打开时它是 `undefined`，控制器又在 `AccountsCard` 的 `useState(createEnrollment)` 惰性初始化里构造，异常被设置页插槽的错误边界接住——左侧「Command Code」标签正常、右侧内容区空白且无任何提示。新增 `src/client/random-id.ts` 的 `randomId()`：`randomUUID` 可用时照旧，否则退回非安全上下文同样可用的 `crypto.getRandomValues`，按 RFC 4122 拼出同形 v4；`AccountEnrollmentController` 的默认 `newId` 改用它。页面身份只是宿主把开通过程绑到单个浏览器页面的分组键，不参与鉴权，因此不要求 HTTPS。（`src/client/random-id.ts`、`src/client/enrollment.ts`）
+
+  用例：`tests/adapter.test.ts` 新增「凭据解析与图片读取并行」「目录已在内存时不再等一次联网刷新」「超时定级复用已序列化的正文」「同一份工具 schema 只归一化一次」「用量卡片与选择器共享同一份账户事实」「凭据缺失时预算门不抢跑」「双超限一次报数」；`tests/gateway-facts.test.ts` 新增 4 条 `loaded()` 来源判据；`tests/panel.test.ts` 与 `tests/usage-client.test.ts` 新增自动/显式刷新、可见性与任意卸载顺序解绑用例；`tests/accounts-card-render.test.ts` 新增 2 条真实渲染接线用例。**验证边界**：`npm run typecheck` 退出码 0；`npm ci` 干净安装后 `npm test` **1125／1125** 通过；`npm run build` 重建 `lib/`。未在真实宿主中人工验证。
+
+  issue #102 的用例：`tests/random-id.test.ts` 3 条——安全上下文走平台 `randomUUID`（哨兵值分辨分支，不走自行拼装）、非安全上下文退回 `getRandomValues` 时 100 个身份互不相同且为 v4、非安全上下文下构造 `AccountEnrollmentController` 并把页面身份带给宿主。三处定向变异各命中一条：关闭快速路径只失败第一条，把版本位置 0 只失败后两条，把默认 `newId` 改回 `() => crypto.randomUUID()` 只失败第三条。**验证边界**：`npm run typecheck` 退出码 0；`npm ci` 干净安装后 `npm test` **1129／1129** 通过；`npm run build` 重建 `lib/`（`lib/client.js` 含 `randomId`，`lib/index.js` 与 `lib/index.d.ts` 字节不变）。未在真实 NAS／局域网环境人工验证。
+
+   **本轮（2026-10-27 上游同步）验证**：`npm run typecheck` 退出码 0；`npm test` **1126／1126** 通过、0 失败；`npm run build` 两段 `Build complete`，`lib/index.js` 已重建（含 `gpt-6.1-terra`）；`npm run test:engine` **3/3**（`0.2.1-rc.2`／`0.2.1-rc.3`／`0.2.1-rc.4`，宿主准入 preflight 全部放行，末行 `engine-load smoke passed on all 3 declared-compatible engines`）；`npm run test:install` **3/3**（pnpm 10.34.5）；`npm run test:pack` 16 文件（版本 0.15.4）。未做真实账号登录、付费生成、服务端协议验证与浏览器渲染。
+
+## [0.15.4] - 2026-10-24
+
+### Changed
+
+- **同步 Command Code CLI `1.87.3` → `1.88.0`（纯请求头同步）。** `1.88.0` 于 `2026-10-24T02:55Z` 发布，官方变更日志还没有条目（最新 CLI 条目仍是 `1.87.3`），因此结论来自产物级静态比对：端点集合、自定义请求头、`/alpha/generate` 调用点、`promptCache` / `reasoning_effort` / `max_tokens` 字面量、模型注册表字段、推理档位、订阅表与 ZDR（零数据保留）例外集逐项相同（审计 `cliDiff` 的 efforts / subscriptions / zdrExceptions 三类全空）；注册表唯一变化是 `xiaomi/mimo-v2.5` 与 `xiaomi/mimo-v2.5-pro` 增加 `hidden: true`，与 10-23 目录隐藏这两行一致。`COMMAND_CODE_CLI_VERSION` 只随请求头更新，运行时行为不变。
+
+- **新增 `moonshotai/Kimi-K3.1-Pro`（服务端目录先行，CLI 产物尚未收录）。** `catalogVersion` 由 `02bfc7ac…` 变为 `f41a48ed…`，默认目录 92 → 93、`?view=client` 104 → 105，唯一新增行就是 Kimi K3.1 Pro：1,048,576 上下文、文本 + 图像、推理档位 `low` / `high` / `max`、最低计划 Go、`$2/$10/$0.2`、月度额度 Go `$6` / GOAT `$20` / Pro `$30`，无促销、无峰值时段、无上下文分档，ZDR 默认覆盖。官方 models 页、pricing 页与 go/goat/pro 计划页均已上架；`1.88.0` 的 CLI 注册表还没写这一行，审计把「absent from CLI registry」报成 error——能力字段以 `?view=client` 目录为准。快照随之 +1：`KNOWN_PLANS` 92 → 93、`KNOWN_EFFORTS` 65 → 66、`KNOWN_IMAGE_MODELS` 71 → 72、内置价格行 92 → 93；ZDR 例外集（18）、自动思考模型表（16）、输出上限表（79）、订阅表（9）、促销（4）与峰值定价（4）不变。
+
+### Verification
+
+- `npm run typecheck` 退出码 0；`npm test` **1107／1107** 通过、0 失败；`npm run build` 两段 `Build complete`，`lib/index.js` 与 `lib/index.d.ts` 已重建（含 `1.88.0` 与 `kimi-k3.1-pro`）。
+- 上游公开 GET 采集 14 个源全部 HTTP 200；审计状态 `incomplete` 的 3 条 error 为 Kimi K3.1 Pro 不在 CLI 产物注册表，以及 MiniMax M3.1 Flash 与 Ornith 1.5 122B 的已知定价别名缺失，均非抓取失败。
+- **未做**：真实账号登录、付费生成、服务端协议验证与浏览器渲染。
+
 ## [0.15.3] - 2026-10-24
 
 ### Changed

package/README.md

@@ -61,7 +61,7 @@ Unofficial [DeepSeek Harness](https://deepseek-harness.github.io/deepseek-harnes
 dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
 ```
 
-This build admits **dsh `>=0.2.1-rc.2 <0.2.2-0`** — every RC of the `0.2.1` channel from `0.2.1-rc.2` onward. `0.2.1-rc.2` is what npm `latest` runs and `0.2.1-rc.3` ships on `next`; both are covered by the full engine matrix (`npm run test:engine`, `npm run test:install`). A later `0.2.1-rc.4` is admitted without a plugin update, but stays unverified until a record is added to `dsh.compatibility.dshReleases`. The next minor is deliberately excluded, `0.2.2-rc.*` included — the upper bound is written `<0.2.2-0` for exactly that reason. A profile on `0.2.0-rc.2`, `0.2.1-alpha.5` or older must upgrade its engine first. Compatibility details — the `engines.dsh` admission rule, package pairings, evidence — live in [engine compatibility](docs/agent-reference/engine-compatibility.md).
+This build admits **dsh `>=0.2.1-rc.2 <0.2.2-0`** — every RC of the `0.2.1` channel from `0.2.1-rc.2` onward. `0.2.1-rc.2` is what npm `latest` runs and `0.2.1-rc.4` ships on `next`; `0.2.1-rc.2`, `0.2.1-rc.3` and `0.2.1-rc.4` are all covered by the full engine matrix (`npm run test:engine`, `npm run test:install`). A later `0.2.1-rc.5` is admitted without a plugin update, but stays unverified until a record is added to `dsh.compatibility.dshReleases`. The next minor is deliberately excluded, `0.2.2-rc.*` included — the upper bound is written `<0.2.2-0` for exactly that reason. A profile on `0.2.0-rc.2`, `0.2.1-alpha.5` or older must upgrade its engine first. Compatibility details — the `engines.dsh` admission rule, package pairings, evidence — live in [engine compatibility](docs/agent-reference/engine-compatibility.md).
 
 **Older dsh releases** are no longer supported: the last plugin release for dsh 0.1.7 is `0.11.17`, for 0.1.2–0.1.6 it is `0.11.11`, and for the 0.5.0-era line `0.9.1` — all installed by exact version, none maintained.
 

package/README.zh-CN.md

@@ -61,7 +61,7 @@
 dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
 ```
 
-本构建准入 **dsh `>=0.2.1-rc.2 <0.2.2-0`** —— `0.2.1` 通道中 `0.2.1-rc.2` 及以后的每个 RC。`0.2.1-rc.2` 是 npm `latest` 指向的版本，`0.2.1-rc.3` 挂在 `next`；两者都跑过完整引擎矩阵（`npm run test:engine`、`npm run test:install`）。更晚的 `0.2.1-rc.4` 无需更新插件即可准入，但在 `dsh.compatibility.dshReleases` 补上记录之前不算已验证。下一个 minor 被刻意排除（含 `0.2.2-rc.*`）—— 区间上界写成 `<0.2.2-0` 正是为了这一点。使用 `0.2.0-rc.2`、`0.2.1-alpha.5` 或更早版本的配置需先升级引擎，再安装本构建。兼容性细节 —— `engines.dsh` 准入规则、按引擎配对的包版本、验证证据 —— 见[引擎兼容](docs/agent-reference/engine-compatibility.md)。
+本构建准入 **dsh `>=0.2.1-rc.2 <0.2.2-0`** —— `0.2.1` 通道中 `0.2.1-rc.2` 及以后的每个 RC。`0.2.1-rc.2` 是 npm `latest` 指向的版本，`0.2.1-rc.4` 挂在 `next`；`0.2.1-rc.2`、`0.2.1-rc.3` 与 `0.2.1-rc.4` 都跑过完整引擎矩阵（`npm run test:engine`、`npm run test:install`）。更晚的 `0.2.1-rc.5` 无需更新插件即可准入，但在 `dsh.compatibility.dshReleases` 补上记录之前不算已验证。下一个 minor 被刻意排除（含 `0.2.2-rc.*`）—— 区间上界写成 `<0.2.2-0` 正是为了这一点。使用 `0.2.0-rc.2`、`0.2.1-alpha.5` 或更早版本的配置需先升级引擎，再安装本构建。兼容性细节 —— `engines.dsh` 准入规则、按引擎配对的包版本、验证证据 —— 见[引擎兼容](docs/agent-reference/engine-compatibility.md)。
 
 **更早的 dsh 版本**已不再支持：覆盖 dsh 0.1.7 的最后一个插件版本是 `0.11.17`，0.1.2–0.1.6 线的最后一个版本是 `0.11.11`，0.5.0 时代 Harness 线的最后一个版本是 `0.9.1` —— 三者都按精确版本安装，且都不再维护。
 

package/lib/client.js

@@ -1856,6 +1856,8 @@ window.__ModuleLoader__.load({
 			generation = 0;
 			inFlight = false;
 			disposed = false;
+			/** When the last fetch SETTLED successfully, for {@link USAGE_AUTO_REFRESH_COALESCE_MS}. */
+			settledAt;
 			constructor(remote) {
 				this.remote = remote;
 			}
@@ -1877,9 +1879,16 @@ window.__ModuleLoader__.load({
 			/**
 			* Fetch (or refetch) the report. Concurrent refreshes collapse onto one
 			* request; a superseded fetch's late result is dropped, never published.
+			*
+			* `auto` marks a refresh nobody asked for — a surface appearing, or the
+			* background tick. Those also reuse a result fetched within
+			* {@link USAGE_AUTO_REFRESH_COALESCE_MS}, because two surfaces mounting a
+			* second apart are asking the same question. Every other caller is a user
+			* action and always goes to the wire.
 			*/
-			async refresh() {
+			async refresh(options) {
 				if (this.disposed || this.inFlight) return;
+				if (options?.auto === true && this.current.status === "ready" && this.settledAt !== void 0 && Date.now() - this.settledAt < 5e3) return;
 				const generation = ++this.generation;
 				this.inFlight = true;
 				this.current = {
@@ -1891,13 +1900,16 @@ window.__ModuleLoader__.load({
 				try {
 					const response = await this.remote.report();
 					if (this.disposed || generation !== this.generation) return;
-					if (response.ok) this.current = {
-						status: "ready",
-						report: response.value,
-						error: void 0,
-						fetchedAt: Date.now()
-					};
-					else this.current = {
+					if (response.ok) {
+						const fetchedAt = Date.now();
+						this.settledAt = fetchedAt;
+						this.current = {
+							status: "ready",
+							report: response.value,
+							error: void 0,
+							fetchedAt
+						};
+					} else this.current = {
 						...this.current,
 						status: "error",
 						error: response.error.message
@@ -2887,6 +2899,23 @@ window.__ModuleLoader__.load({
 			]
 		};
 		//#endregion
+		//#region src/client/random-id.ts
+		/**
+		* 页面身份（issue #102）。`crypto.randomUUID` 是安全上下文专属：局域网里用
+		* `http://<ip>:3080` 打开设置页时它是 `undefined`，而这里在控制器构造期就调用，
+		* 异常会落到设置页插槽的错误边界上，整块内容变成空白。`crypto.getRandomValues`
+		* 在非安全上下文同样可用，因此只在 `randomUUID` 不可用时按 RFC 4122 自行拼一个 v4。
+		*/
+		function randomId() {
+			const source = globalThis.crypto;
+			if (typeof source.randomUUID === "function") return source.randomUUID();
+			const bytes = source.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+			bytes[6] = bytes[6] & 15 | 64;
+			bytes[8] = bytes[8] & 63 | 128;
+			const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+			return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+		}
+		//#endregion
 		//#region src/client/enrollment.ts
 		const live = (state) => [
 			"creating",
@@ -2912,7 +2941,7 @@ window.__ModuleLoader__.load({
 			watch;
 			ready;
 			openedPage = false;
-			constructor(remote, changed, pollMs = 750, newId = () => crypto.randomUUID(), openPage = openLoginPage) {
+			constructor(remote, changed, pollMs = 750, newId = randomId, openPage = openLoginPage) {
 				this.remote = remote;
 				this.changed = changed;
 				this.pollMs = pollMs;
@@ -3243,7 +3272,6 @@ window.__ModuleLoader__.load({
 			usageCost: "花费",
 			usageCompleted: "成功",
 			usageBillingPeriod: "官方账期用量",
-			usagePeriodUnknown: "官方用量汇总，统计周期未确认",
 			usageTokens: "Token",
 			usageTokensIn: "入",
 			usageTokensOut: "出",
@@ -3330,7 +3358,7 @@ window.__ModuleLoader__.load({
 			accountEnrollmentCleanupRetry: "重试清理",
 			accountRefSeparator: "：",
 			accountModels: "专用模型",
-			accountModelsHint: "选中的模型优先由此账户处理，不可用时仍会自动切换；一个模型只归属一个账户。",
+			accountModelsHint: "选中即专属：优先此账户处理，不可用时自动切换",
 			accountModelOwner: "属于 {name}",
 			modelPick: "选择模型…",
 			modelCount: "已选 {count} 个模型",
@@ -3515,7 +3543,6 @@ window.__ModuleLoader__.load({
 			usageCost: "Spend",
 			usageCompleted: "Completed",
 			usageBillingPeriod: "Official billing-period usage",
-			usagePeriodUnknown: "Official usage summary; the billing period is unconfirmed",
 			usageTokens: "Tokens",
 			usageTokensIn: "in",
 			usageTokensOut: "out",
@@ -3602,7 +3629,7 @@ window.__ModuleLoader__.load({
 			accountEnrollmentCleanupRetry: "Retry cleanup",
 			accountRefSeparator: ": ",
 			accountModels: "Dedicated models",
-			accountModelsHint: "These models prefer this account and still switch when it is unavailable; a model belongs to one account.",
+			accountModelsHint: "Selected models are dedicated to this account and still switch when unavailable",
 			accountModelOwner: "on {name}",
 			modelPick: "Choose models…",
 			modelCount: "{count} models selected",
@@ -3837,7 +3864,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region package.json
-		var version = "0.15.3";
+		var version = "0.15.5";
 		var repository = {
 			"type": "git",
 			"url": "git+https://github.com/Mars-Sea/dsh-commandcode-provider.git"
@@ -4877,6 +4904,19 @@ window.__ModuleLoader__.load({
 				]
 			});
 		}
+		/**
+		* Left text of the balance label row: the billing period, stated once per card.
+		* 用量汇总与订阅起点对齐时给完整区间；对不上（或用量汇总没取到）时退回订阅
+		* 自身的截止日，它不依赖对齐也可靠。余额没取到时没有「月额度剩余」可挂，完整
+		* 区间前补回「官方账期用量」，避免一串裸日期没有上下文。
+		*/
+		function balanceLabelText(report, t) {
+			const plan = report.plan;
+			const usagePeriod = formatUsageBillingPeriod(report.usage?.periodStart, plan?.currentPeriodStart, plan?.currentPeriodEnd);
+			const periodText = usagePeriod !== "" ? usagePeriod : plan !== void 0 && plan.currentPeriodEnd > 0 ? `${t("usagePeriodEnd")} ${new Date(plan.currentPeriodEnd).toLocaleDateString()}` : "";
+			if (report.credits !== void 0) return periodText !== "" ? `${t("usageMonthlyLeft")} · ${periodText}` : t("usageMonthlyLeft");
+			return usagePeriod !== "" ? `${t("usageBillingPeriod")} ${usagePeriod}` : periodText;
+		}
 		/** One pool account's facts (identity, totals, credits, window limits). */
 		function AccountReport({ entry, fetchedAt, t, headless = false }) {
 			const report = entry.report;
@@ -4886,9 +4926,12 @@ window.__ModuleLoader__.load({
 			const plan = report.plan;
 			const planName = plan?.name ?? "";
 			const planStatus = plan !== void 0 && plan.status !== "" && plan.status !== "active" ? plan.status : "";
-			const showPeriod = plan !== void 0 && plan.currentPeriodEnd > 0;
 			const showPartial = report.failures.length > 0 && report.blocked === void 0;
-			const usagePeriod = formatUsageBillingPeriod(report.usage?.periodStart, plan?.currentPeriodStart, plan?.currentPeriodEnd);
+			const label = balanceLabelText(report, t);
+			const updatedText = fetchedAt === void 0 ? "" : `${t("usageUpdated")} ${new Date(fetchedAt).toLocaleTimeString(void 0, {
+				hour: "2-digit",
+				minute: "2-digit"
+			})}`;
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				className: "cc-accountReport",
 				children: [
@@ -4927,26 +4970,33 @@ window.__ModuleLoader__.load({
 							children: report.failures.join(" · ")
 						}) : null]
 					}) : null,
-					credits !== void 0 ? (() => {
-						const monthlyKnown = credits.monthlyReported !== false;
-						const depleted = monthlyKnown && credits.monthlyCredits <= 0;
+					(() => {
+						const monthlyKnown = credits !== void 0 && credits.monthlyReported !== false;
+						const depleted = credits !== void 0 && monthlyKnown && credits.monthlyCredits <= 0;
+						if (label === "" && updatedText === "") return null;
 						return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 							className: depleted ? "cc-balance cc-balanceEmpty" : "cc-balance",
 							children: [
 								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-									className: "cc-balanceMain",
+									className: "cc-balanceRow",
 									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 										className: "cc-balanceLabel",
-										children: t("usageMonthlyLeft")
-									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										children: label
+									}), updatedText !== "" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "cc-balanceLabel",
+										children: updatedText
+									}) : null]
+								}),
+								credits !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									className: "cc-balanceRow",
+									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 										className: "cc-balanceValue",
 										children: monthlyKnown ? formatMoney(Math.max(0, credits.monthlyCredits)) : "—"
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "cc-balanceSub",
+										children: `${t("usagePurchased")} ${credits.purchasedReported === false ? "—" : formatMoney(credits.purchasedCredits)} · ${t("usageFree")} ${credits.freeReported === false ? "—" : formatMoney(credits.freeCredits)}`
 									})]
-								}),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-									className: "cc-balanceSub",
-									children: `${t("usagePurchased")} ${credits.purchasedReported === false ? "—" : formatMoney(credits.purchasedCredits)} · ${t("usageFree")} ${credits.freeReported === false ? "—" : formatMoney(credits.freeCredits)}`
-								}),
+								}) : null,
 								depleted ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 									className: "cc-balanceNote",
 									role: "status",
@@ -4954,11 +5004,7 @@ window.__ModuleLoader__.load({
 								}) : null
 							]
 						});
-					})() : null,
-					report.usage !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-						className: "cc-usageUpdated",
-						children: usagePeriod ? `${t("usageBillingPeriod")} ${usagePeriod}` : t("usagePeriodUnknown")
-					}) : null,
+					})(),
 					report.usage !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "cc-usageStats cc-usageStatsActivity",
 						children: [
@@ -5000,35 +5046,10 @@ window.__ModuleLoader__.load({
 							t
 						}) : null]
 					}) : null,
-					showPeriod || showPartial || fetchedAt !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-						className: "cc-usageMeta",
-						children: [
-							showPeriod ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
-								className: "cc-usageUpdated",
-								children: [
-									t("usagePeriodEnd"),
-									" ",
-									new Date(plan.currentPeriodEnd).toLocaleDateString()
-								]
-							}) : null,
-							showPartial ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-								className: "cc-usagePartial",
-								title: report.failures.join("; "),
-								children: t("usagePartial")
-							}) : null,
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { className: "cc-usageMetaSpacer" }),
-							fetchedAt !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
-								className: "cc-usageUpdated",
-								children: [
-									t("usageUpdated"),
-									" ",
-									new Date(fetchedAt).toLocaleTimeString(void 0, {
-										hour: "2-digit",
-										minute: "2-digit"
-									})
-								]
-							}) : null
-						]
+					showPartial ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "cc-usagePartial",
+						title: report.failures.join("; "),
+						children: t("usagePartial")
 					}) : null
 				]
 			});
@@ -6459,8 +6480,13 @@ window.__ModuleLoader__.load({
 		* The unified account card: every account the pool rotates through, one row
 		* each, with its status and quota inline — so one account's facts no longer
 		* have to be cross-read across separate surfaces.
+		*
+		* Exported for the render test (`tests/accounts-card-render.test.ts`) that pins
+		* the first-paint auto-refresh wiring against a real React tree: the page mounts
+		* this card, and a test that only checks the injected function exists cannot see
+		* the card reaching for it.
 		*/
-		function AccountsCard({ t, state, usage, login, disabled, actions, onRefresh, openAnalytics, createEnrollment, expanded, onToggle }) {
+		function AccountsCard({ t, state, usage, login, disabled, actions, onRefresh, onRefreshAuto, openAnalytics, createEnrollment, expanded, onToggle }) {
 			const [adding, setAdding] = (0, react.useState)(false);
 			const [enrollment] = (0, react.useState)(createEnrollment);
 			const snapshot = (0, react.useSyncExternalStore)(enrollment.store.subscribe, enrollment.store.getSnapshot);
@@ -6471,8 +6497,8 @@ window.__ModuleLoader__.load({
 			const closeAdd = (0, react.useCallback)(() => setAdding(false), []);
 			const { loading, shouldRefresh } = usageCardState(usage);
 			(0, react.useEffect)(() => {
-				if (shouldRefresh) onRefresh();
-			}, [shouldRefresh, onRefresh]);
+				if (shouldRefresh) onRefreshAuto();
+			}, [shouldRefresh, onRefreshAuto]);
 			const rows = accountRows(state, usage, t).filter((row) => row.ref === void 0 || !state.accountEnrollmentRefs.includes(row.ref));
 			const multi = rows.length > 1;
 			const pinnedRow = rows.find((row) => row.id === state.activeAccount);
@@ -6960,6 +6986,7 @@ window.__ModuleLoader__.load({
 						disabled,
 						actions,
 						onRefresh: props.refreshUsage,
+						onRefreshAuto: props.refreshUsageAuto,
 						openAnalytics: props.openAnalytics,
 						createEnrollment: props.createEnrollment,
 						...foldProps("accounts")
@@ -7899,6 +7926,14 @@ window.__ModuleLoader__.load({
 			set: (callback, ms) => setTimeout(callback, ms),
 			clear: (handle) => clearTimeout(handle)
 		};
+		const DOCUMENT_VISIBILITY = {
+			isVisible: () => typeof document === "undefined" ? true : document.visibilityState !== "hidden",
+			subscribe: (onChange) => {
+				if (typeof document === "undefined") return () => void 0;
+				document.addEventListener("visibilitychange", onChange);
+				return () => document.removeEventListener("visibilitychange", onChange);
+			}
+		};
 		/** Live mount count of {@link startPanelAutoRefresh}. */
 		let references = 0;
 		/** Owner ticket of the running loop, if any. */
@@ -7908,6 +7943,16 @@ window.__ModuleLoader__.load({
 		/** Pending timer handle of the running loop. */
 		let handle;
 		/**
+		* Unsubscribe of the visibility listener owned by the RUNNING loop.
+		*
+		* Module-level on purpose: only the surface that started the loop receives the
+		* subscribe handle, but that surface is not necessarily the last to unmount.
+		* Keeping the handle on the same layer as `activeTicket`/`handle` lets any
+		* teardown order release it; a function-local handle leaked the listener
+		* whenever the starter unmounted first.
+		*/
+		let visibilityUnsubscribe;
+		/**
 		* Start the shared auto refresh. One fetch when the surface appears (the sidebar
 		* row is the point of the panel — it must be current, not wait for a click), then
 		* a tick every {@link PANEL_AUTO_REFRESH_MS} while a surface stays mounted.
@@ -7917,22 +7962,37 @@ window.__ModuleLoader__.load({
 		* tick goes through `usage.refresh()`, which collapses a concurrent fetch onto
 		* the in-flight one. Returns the disposer that drops this surface's reference.
 		*
+		* A hidden document is still mounted, so its ticks are SKIPPED: a background
+		* tab must not keep paying for a four-call report nobody reads. The tick is
+		* rescheduled either way, so the loop survives, and becoming visible again
+		* fetches at once — the data on screen is by then older than a tick would have
+		* left it. The first paint still fetches unconditionally: it is the moment the
+		* row appears, and there is nothing to show without it.
+		*
 		* @param usage - the shared usage controller.
 		* @param isConfigured - whether a credential exists right now (re-read per tick).
 		* @param timer - timer seam for tests.
+		* @param visibility - visibility seam; see {@link AutoRefreshVisibility}.
 		*/
-		function startPanelAutoRefresh(usage, isConfigured, timer = REAL_TIMER) {
+		function startPanelAutoRefresh(usage, isConfigured, timer = REAL_TIMER, visibility = DOCUMENT_VISIBILITY) {
 			references += 1;
 			const ticket = ++ticketSeq;
+			const fetch = () => {
+				if (isConfigured()) usage.refresh({ auto: true });
+			};
 			const tick = () => {
 				if (activeTicket !== ticket) return;
-				if (isConfigured()) usage.refresh();
+				if (visibility.isVisible()) fetch();
 				handle = timer.set(tick, PANEL_AUTO_REFRESH_MS);
 			};
 			if (activeTicket === void 0) {
 				activeTicket = ticket;
 				handle = timer.set(tick, PANEL_AUTO_REFRESH_MS);
-				if (isConfigured()) usage.refresh();
+				fetch();
+				visibilityUnsubscribe = visibility.subscribe?.(() => {
+					if (activeTicket !== ticket || !visibility.isVisible()) return;
+					fetch();
+				});
 			}
 			let stopped = false;
 			return () => {
@@ -7941,6 +8001,8 @@ window.__ModuleLoader__.load({
 				references -= 1;
 				if (references > 0) return;
 				activeTicket = void 0;
+				visibilityUnsubscribe?.();
+				visibilityUnsubscribe = void 0;
 				if (handle !== void 0) {
 					timer.clear(handle);
 					handle = void 0;
@@ -10463,13 +10525,14 @@ window.__ModuleLoader__.load({
 .cc-usageStats{grid-template-columns:repeat(auto-fit,minmax(120px,1fr));gap:8px;display:grid}
 .cc-usageStatsActivity{grid-template-columns:repeat(4,minmax(0,1fr))}
 @container (max-width:460px){.cc-usageStatsActivity{grid-template-columns:repeat(2,minmax(0,1fr))}}
-.cc-balance{flex-wrap:wrap;justify-content:space-between;align-items:flex-end;gap:4px 16px;display:flex}
-.cc-balanceMain{flex-direction:column;gap:2px;display:flex}
+.cc-balance{flex-direction:column;gap:2px;display:flex}
+/* 两行左右分栏：标签行左账期、右更新时间；数值行左剩余、右已购与赠送。 */
+.cc-balanceRow{flex-wrap:wrap;justify-content:space-between;align-items:baseline;gap:4px 16px;display:flex}
 .cc-balanceLabel{color:var(--dsw-alias-label-secondary);font-size:12px;line-height:18px}
 .cc-balanceValue{color:var(--dsw-alias-label-primary);font-size:20px;font-weight:600;line-height:28px;font-variant-numeric:tabular-nums}
 .cc-balanceSub{color:var(--dsw-alias-label-secondary);font-size:12px;line-height:18px;font-variant-numeric:tabular-nums}
 .cc-balanceEmpty .cc-balanceValue{color:var(--dsw-alias-state-error-primary)}
-.cc-balanceNote{flex-basis:100%;margin:0;color:var(--dsw-alias-state-error-primary);font-size:12px;line-height:18px}
+.cc-balanceNote{margin:0;color:var(--dsw-alias-state-error-primary);font-size:12px;line-height:18px}
 .cc-usageStat{min-width:0;flex-direction:column;gap:2px;display:flex;padding:10px 12px;border-radius:8px;background:var(--dsw-alias-bg-module-platform)}
 .cc-usageStatLabel{color:var(--dsw-alias-label-secondary);font-size:12px;line-height:18px}
 .cc-usageStatValue{color:var(--dsw-alias-label-primary);font-size:16px;font-weight:500;line-height:24px;font-variant-numeric:tabular-nums}
@@ -10484,9 +10547,6 @@ window.__ModuleLoader__.load({
 .cc-usageBarFill{background:var(--dsw-alias-brand-primary);border-radius:999px;height:100%;transition:width .3s ease}
 .cc-usageBarFillWarn{background:var(--dsw-alias-state-error-primary)}
 .cc-usageWindowReset{color:var(--dsw-alias-label-secondary);margin:0;font-size:12px;line-height:18px}
-.cc-usageMeta{align-items:center;gap:8px;display:flex}
-.cc-usageMetaSpacer{flex:1}
-.cc-usageUpdated{color:var(--dsw-alias-label-secondary);margin:0;font-size:12px;line-height:18px}
 .cc-usagePartial{color:var(--dsw-alias-state-error-primary);margin:0;font-size:12px;line-height:18px}
 .cc-notices{flex-direction:column;gap:8px;display:flex;margin-bottom:12px}
 .cc-section>.cc-notice{margin-top:12px}
@@ -11176,6 +11236,7 @@ window.__ModuleLoader__.load({
 				discard: () => controller.discard(),
 				refreshCredentials: () => void controller.refreshCredentials(),
 				refreshUsage: () => void usageController.refresh(),
+				refreshUsageAuto: () => void usageController.refresh({ auto: true }),
 				...typeof ctx.get("layout")?.selectPanel === "function" ? { openAnalytics } : {},
 				beginLogin: (targetRef) => void loginController.begin(targetRef),
 				cancelLogin: () => void loginController.cancel(),

package/lib/index.d.ts

@@ -61,7 +61,7 @@ type CommandCodeProtocol = 'cli' | 'openai' | 'messages';
 declare const DEFAULT_MAX_OUTPUT_TOKENS = 131072;
 //#endregion
 //#region src/adapter.d.ts
-declare const COMMAND_CODE_CLI_VERSION = "1.87.3";
+declare const COMMAND_CODE_CLI_VERSION = "1.88.0";
 declare const DEFAULT_API_BASE = "https://api.commandcode.ai";
 /**
  * The output budget this bundle asks for, and the ceiling it will never exceed.
@@ -382,6 +382,25 @@ declare class CommandCodeAdapter<C extends CommandCodeConnectionOptions = Comman
   private readonly surfaceOffload;
   private readonly billingAccess;
   private readonly billingAccessInflight;
+  /**
+   * Successful account-endpoint responses, keyed by gateway + key + exact URL.
+   *
+   * The settings card and the picker's advisory plan filter ask the SAME three
+   * endpoints about the SAME account (`/alpha/whoami`, then credits and
+   * subscriptions in parallel). Here that is four round trips per surface for
+   * two answers — and the card refreshes on a timer, so the picker keeps paying
+   * for rows it already has. Sharing the raw responses removes the duplicate
+   * without either surface having to know about the other: whoever asks second
+   * within {@link ACCOUNT_FACTS_TTL_MS} reads the same record instead of the
+   * wire.
+   *
+   * Only SUCCESSFUL records are kept. A failure must be retried rather than
+   * replayed, or an endpoint that recovered a second ago would keep reporting
+   * yesterday's outage — and the usage report's per-endpoint `failures` and
+   * {@link classifyTotalFailure} verdict would describe a request this process
+   * never made.
+   */
+  private readonly accountJson;
   private readonly protocolCache;
   /** Namespace account-derived facts by gateway without exposing the key. */
   private accountCacheKey;
@@ -488,8 +507,24 @@ declare class CommandCodeAdapter<C extends CommandCodeConnectionOptions = Comman
    */
   allowanceTier(): Promise<'go' | 'goat' | 'pro' | undefined>;
   resolveModel(provider: string, model: string, signal?: AbortSignal): Promise<LlmResolvedModelInfo>;
+  /**
+   * Resolve and validate the key one account-endpoint call will use.
+   *
+   * Every account endpoint runs the chat path's own `assertUsableApiKey` check,
+   * or a key carrying a character no HTTP header can hold throws inside `fetch`
+   * BEFORE any I/O — once per endpoint — and the report reads as "the network is
+   * down". The credential reference is read structurally: it belongs to the
+   * host's resolved options, not to this adapter's connection type, and it only
+   * names the key in the rejection message.
+   *
+   * Separate from {@link accountHeadersFor} so a caller that also needs to key a
+   * cache by the same identity does not have to resolve the key twice.
+   */
+  private usableAccountKey;
   /** The headers every authenticated account endpoint shares. */
   private accountHeaders;
+  /** Headers for an already-validated key; see {@link usableAccountKey}. */
+  private accountHeadersFor;
   /**
    * Fetch one JSON GET and return its HTTP status with a parsed record. The
    * catalog, billing probe, and usage report each apply their own failure
@@ -524,6 +559,23 @@ declare class CommandCodeAdapter<C extends CommandCodeConnectionOptions = Comman
    * everything" (fail-open).
    */
   private loadBillingAccessForKey;
+  /**
+   * One account-endpoint GET, served from {@link accountJson} when `share` and
+   * the same URL answered successfully within {@link ACCOUNT_FACTS_TTL_MS}.
+   *
+   * `timeoutMs` is the CALLER's budget; a cache hit spends none of it. Failures
+   * are never cached, so this can only ever save a request that would have
+   * re-read an answer this process already had.
+   *
+   * `share: false` marks a VOLATILE endpoint — one whose answer is the number
+   * the user is actually looking at, and which must therefore never be replayed
+   * from an earlier request. The usage card's summary is exactly that: its
+   * headline counts and cost are the reason the card exists, and stamping a
+   * cached copy with the current time would misreport when they were read.
+   * Identity and billing facts are the opposite: a plan tier or an org id that
+   * is 30 s old is still the truth, and those are what the picker duplicates.
+   */
+  private accountJsonGet;
   /**
    * The billing facts behind the picker's plan filter, mirroring the CLI's
    * `createBilling` flow: whoami yields the org id, then the subscriptions
@@ -1165,10 +1217,9 @@ declare const KNOWN_THINKING_MODELS: ReadonlySet<string>;
  * `/docs/plans/max` and `/docs/resources/pricing-limits`). Each plan's model
  * list is a superset of the one below it: Go ⊂ GOAT ⊂ Pro ⊂ Provider/Max.
  * Models absent from every plan list (Claude Opus/Fable, Fugu Ultra) are
- * Provider-tier. Re-verified at command-code@1.87.1 (2026-10-22) against the
- * live `?view=client` catalog: 104 ids, still a strict superset chain. Mistral
- * Large 4
- * (1.75.0) was the only addition at the 1.77.0 check; the 1.78.0/1.79.0 pair
+ * Provider-tier. Re-verified at command-code@1.88.0 (2026-10-27) against the
+ * live `?view=client` catalog: 106 ids, still a strict superset chain. Mistral
+ * Large 4 (1.75.0) was the only addition at the 1.77.0 check; the 1.78.0/1.79.0 pair
  * added Claude Haiku 5.5 at Pro and the free Glyph Cluster preview at Go.
  * 1.79.2 lowers Haiku 5.5's minimum plan to GOAT; 1.80.0 adds Muse Wonder at
  * Max; 1.82.0 adds Gemini 4 Argon at Pro and nothing else moves. The 1.82.4
@@ -1177,7 +1228,8 @@ declare const KNOWN_THINKING_MODELS: ReadonlySet<string>;
  * which left the live catalog. Every other
  * tier is unchanged. The 1.86.1 sync (2026-10-21) adds only the Ornith 1.5 122B
  * launch pair at Go; the 1.87.1 check (2026-10-22) adds no model and moves no
- * tier.
+ * tier, the 2026-10-24 check adds only Kimi K3.1 Pro at Go, and the 2026-10-27
+ * check adds only GPT-6.1 Terra at Pro.
  * The only removals since 1.49.0 are the two retired stealth previews (Pixel
  * Canary at 1.73.1, Space Bunny Alpha at 1.74.3), Ling 3.0 Flash Sante
  * (2026-10-16) and the retired Cat Jam preview (2026-10-20). Per-entry tags

package/lib/index.js

@@ -123,7 +123,7 @@ const PLAN_ORDER = Object.fromEntries(PLAN_TIER_ORDER.map((tier, index) => [tier
 * subscription-plan labels, deals, and hourly (peak/off-peak) pricing.
 *
 * Everything here is synced from official sources — the command-code CLI
-* bundle's model table (`dist/cli.mjs`, re-verified at command-code@1.87.1), the
+* bundle's model table (`dist/cli.mjs`, re-verified at command-code@1.88.0), the
 * live model catalog (`GET /provider/v1/models?view=client`, the authority for
 * capability fields since 1.82.4), and the official plan/pricing/model docs; see
 * the dsh-commandcode-upstream skill for the extraction procedures. The
@@ -131,10 +131,18 @@ const PLAN_ORDER = Object.fromEntries(PLAN_TIER_ORDER.map((tier, index) => [tier
 * 1.5 122B launch pair in the catalog, the ZDR exclusion-set prune and the
 * MiniMax M3.1 Flash promo extension; the follow-up check later that day moved
 * the pinned constant to 1.86.3 (request header only). The 2026-10-22 check
-* moves it to 1.87.1: the CLI bundle's registry, effort map, subscription plans
-* and ZDR exception set are identical, and the live catalog's capability fields
-* did not move either, so the only data added here is one output-limit row
-* (`thinkingmachines/inkling-small`). Keeping the snapshot in its own module
+* moved it to 1.87.1 (one output-limit row: `thinkingmachines/inkling-small`),
+* and the 2026-10-23 check to 1.87.3 with every snapshot unchanged apart from
+* the four retired catalog rows. The 2026-10-24 check moves it to 1.88.0 — a
+* silent artifact-only release — and picks up the one row that did move in the
+* catalog: Kimi K3.1 Pro (`moonshotai/Kimi-K3.1-Pro`, 1M context, text + image,
+* efforts `low/high/max`, Go tier, `$2/$10/$0.2`). The 1.88.0 artifact does not
+* name that row yet; the default catalog, `?view=client`, the models docs page
+* and the pricing page all do, so the capability fields come from the catalog
+* as usual. The 2026-10-27 check finds the CLI still at 1.88.0 and one more
+* catalog-only addition, GPT-6.1 Terra (`gpt-6.1-terra`): 1.05M context, text +
+* image, the same five-level effort set, Pro tier, `$1/$5` up to a 272K context
+* step and `$2/$7.5` beyond. Keeping the snapshot in its own module
 * confines those frequent sync diffs here: src/adapter.ts holds only the stable
 * wire/runtime logic. The read helpers live here too, for the same reason.
 *
@@ -339,6 +347,11 @@ const KNOWN_EFFORTS = {
 		"high",
 		"max"
 	],
+	"moonshotai/Kimi-K3.1-Pro": [
+		"low",
+		"high",
+		"max"
+	],
 	"google/gemini-3.8-flash": [
 		"low",
 		"medium",
@@ -489,6 +502,13 @@ const KNOWN_EFFORTS = {
 		"xhigh",
 		"max"
 	],
+	"gpt-6.1-terra": [
+		"low",
+		"medium",
+		"high",
+		"xhigh",
+		"max"
+	],
 	"inclusionai/ling-3.1-flash": [
 		"low",
 		"medium",
@@ -571,6 +591,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"gpt-6-luna",
 	"gpt-6-sol",
 	"gpt-6.1-sol",
+	"gpt-6.1-terra",
 	"meta/muse-spark-1.1",
 	"meta/muse-spark-1.2",
 	"meta/muse-spark-1.2-contributor",
@@ -586,6 +607,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"moonshotai/Kimi-K2.7-Code",
 	"moonshotai/Kimi-K2.7-Code-Highspeed",
 	"moonshotai/Kimi-K3",
+	"moonshotai/Kimi-K3.1-Pro",
 	"ornith/ornith-1.5-122b",
 	"sakana/fugu-ultra",
 	"stepfun/Step-3.7-Flash",
@@ -923,10 +945,9 @@ const MODEL_OUTPUT_TOKEN_LIMITS = /* @__PURE__ */ new Map([
 * `/docs/plans/max` and `/docs/resources/pricing-limits`). Each plan's model
 * list is a superset of the one below it: Go ⊂ GOAT ⊂ Pro ⊂ Provider/Max.
 * Models absent from every plan list (Claude Opus/Fable, Fugu Ultra) are
-* Provider-tier. Re-verified at command-code@1.87.1 (2026-10-22) against the
-* live `?view=client` catalog: 104 ids, still a strict superset chain. Mistral
-* Large 4
-* (1.75.0) was the only addition at the 1.77.0 check; the 1.78.0/1.79.0 pair
+* Provider-tier. Re-verified at command-code@1.88.0 (2026-10-27) against the
+* live `?view=client` catalog: 106 ids, still a strict superset chain. Mistral
+* Large 4 (1.75.0) was the only addition at the 1.77.0 check; the 1.78.0/1.79.0 pair
 * added Claude Haiku 5.5 at Pro and the free Glyph Cluster preview at Go.
 * 1.79.2 lowers Haiku 5.5's minimum plan to GOAT; 1.80.0 adds Muse Wonder at
 * Max; 1.82.0 adds Gemini 4 Argon at Pro and nothing else moves. The 1.82.4
@@ -935,7 +956,8 @@ const MODEL_OUTPUT_TOKEN_LIMITS = /* @__PURE__ */ new Map([
 * which left the live catalog. Every other
 * tier is unchanged. The 1.86.1 sync (2026-10-21) adds only the Ornith 1.5 122B
 * launch pair at Go; the 1.87.1 check (2026-10-22) adds no model and moves no
-* tier.
+* tier, the 2026-10-24 check adds only Kimi K3.1 Pro at Go, and the 2026-10-27
+* check adds only GPT-6.1 Terra at Pro.
 * The only removals since 1.49.0 are the two retired stealth previews (Pixel
 * Canary at 1.73.1, Space Bunny Alpha at 1.74.3), Ling 3.0 Flash Sante
 * (2026-10-16) and the retired Cat Jam preview (2026-10-20). Per-entry tags
@@ -984,6 +1006,7 @@ const KNOWN_PLANS = {
 	"moonshotai/Kimi-K2.7-Code": "go",
 	"moonshotai/Kimi-K2.7-Code-Highspeed": "go",
 	"moonshotai/Kimi-K3": "go",
+	"moonshotai/Kimi-K3.1-Pro": "go",
 	"nvidia/nemotron-3-ultra-550b-a55b": "go",
 	"nvidia/nemotron-3.5-super-vl": "go",
 	"ornith/ornith-1.5-122b": "go",
@@ -1031,6 +1054,7 @@ const KNOWN_PLANS = {
 	"gpt-5.5": "pro",
 	"gpt-5.6-terra": "pro",
 	"gpt-6-sol": "pro",
+	"gpt-6.1-terra": "pro",
 	"meta/muse-spark-1.1": "pro",
 	"claude-fable-5-1": "provider",
 	"claude-fable-5": "provider",
@@ -2094,6 +2118,34 @@ const MODEL_PRICE_ROWS = [
 			5
 		] }]
 	},
+	{
+		id: "gpt-6.1-terra",
+		rates: [
+			1,
+			5,
+			.05,
+			1.25
+		],
+		allowance: {
+			go: 6,
+			goat: 20,
+			pro: 20
+		},
+		contextTiers: [{
+			"maxContext": 272e3,
+			"rates": [
+				1,
+				5,
+				.05,
+				1.25
+			]
+		}, { "rates": [
+			2,
+			7.5,
+			.1,
+			2.5
+		] }]
+	},
 	{
 		id: "grok-4.5",
 		rates: [
@@ -2248,6 +2300,19 @@ const MODEL_PRICE_ROWS = [
 			pro: 30
 		}
 	},
+	{
+		id: "kimi-k3.1-pro",
+		rates: [
+			2,
+			10,
+			.2
+		],
+		allowance: {
+			go: 6,
+			goat: 20,
+			pro: 30
+		}
+	},
 	{
 		id: "ling-3.1-flash",
 		rates: [
@@ -6344,7 +6409,8 @@ var GatewayFacts = class {
 		if (this.state?.source !== identity) this.state = {
 			source: identity,
 			rows: [],
-			expiresAt: 0
+			expiresAt: 0,
+			origin: "none"
 		};
 		return this.state;
 	}
@@ -6353,6 +6419,20 @@ var GatewayFacts = class {
 		const row = this.forSource(source).rows.find((candidate) => candidate.id === model);
 		return row === void 0 ? void 0 : copyRows([row])[0];
 	}
+	/**
+	* 本进程**联网成功过**的目录；否则返回 undefined。
+	*
+	* 判据是来源而不是「内存里有行」：`snapshot()` 会把磁盘缓存写进同一份
+	* `state.rows`（生成路径需要它），若只看行数，冷启动先发过一次聊天再打开
+	* 选择器时，首屏拿到的就是没有年龄校验的磁盘副本——正是本方法要排除的东西。
+	* 空目录同样返回 undefined：刷新失败后的空行（`expiresAt` 已进入重试窗口）
+	* 不能让选择器把「暂时读不到」画成「没有模型」，调用方应回落到 `refresh()`。
+	*/
+	loaded(source) {
+		const state = this.forSource(source);
+		if (state.origin !== "network" || state.rows.length === 0) return void 0;
+		return copyRows(state.rows);
+	}
 	/** 生成只读取本地目录；捕获状态后不再转向实例的新来源。 */
 	async snapshot(source) {
 		const state = this.forSource(source);
@@ -6360,7 +6440,10 @@ var GatewayFacts = class {
 		state.disk ??= readCache(source).catch(() => []);
 		const rows = await state.disk;
 		if (state.rows.length > 0 || state.expiresAt > 0) return copyRows(state.rows);
-		if (state.inflight === void 0) state.rows = rows;
+		if (state.inflight === void 0) {
+			state.rows = rows;
+			if (rows.length > 0 && state.origin === "none") state.origin = "disk";
+		}
 		return copyRows(rows);
 	}
 	async refresh(source, signal) {
@@ -6373,8 +6456,10 @@ var GatewayFacts = class {
 			const mayPublish = () => this.state === state && generations.get(source.apiBase) === generation;
 			state.inflight = (async () => {
 				let rows, ttl = MODEL_CATALOG_TTL_MS;
+				let network = false;
 				try {
 					rows = parseCatalog$1(await this.fetchCatalog(source), source.apiBase);
+					network = true;
 					if (mayPublish()) {
 						publish(source.apiBase, rows);
 						await writeCache(source, rows, mayPublish).catch(() => void 0);
@@ -6386,6 +6471,8 @@ var GatewayFacts = class {
 				}
 				state.rows = rows;
 				state.expiresAt = Date.now() + ttl;
+				if (network) state.origin = "network";
+				else if (state.origin === "none" && rows.length > 0) state.origin = "disk";
 				return rows;
 			})().finally(() => {
 				delete state.inflight;
@@ -6422,7 +6509,7 @@ var GatewayFacts = class {
 * per-request options thunk and an API-key resolver from the plugin entry
 * (src/index.ts), so a settings change reaches the very next request.
 */
-const COMMAND_CODE_CLI_VERSION = "1.87.3";
+const COMMAND_CODE_CLI_VERSION = "1.88.0";
 const DEFAULT_API_BASE = "https://api.commandcode.ai";
 /**
 * The output budget this bundle asks for, and the ceiling it will never exceed.
@@ -6436,6 +6523,17 @@ const MODELS_TIMEOUT_MS = 1e4;
 /** How long the picker's plan-filter billing facts stay cached before refetching. */
 const BILLING_ACCESS_TTL_MS = 3e5;
 /**
+* How long the raw account facts captured by one usage-report run stay usable
+* for the picker's advisory plan filter.
+*
+* This is much shorter than {@link BILLING_ACCESS_TTL_MS} because it only ever
+* removes a DUPLICATE read: the picker and the settings card ask the same three
+* endpoints about the same key, and whichever ran last already paid for them.
+* Anything older than this window is simply fetched again — the filter is
+* fail-open advisory data, so a miss costs one round trip and nothing else.
+*/
+const ACCOUNT_FACTS_TTL_MS = 3e4;
+/**
 * How long a learned CLI-only protocol preference stays cached per account.
 * After this TTL a request may probe Provider API again, so an upgraded Go
 * account can recover without a restart.
@@ -6527,9 +6625,13 @@ function fingerprintValue(value) {
 	}
 	return {
 		bytes: Buffer.byteLength(serialized),
-		sha256: createHash("sha256").update(serialized).digest("hex")
+		sha256: sha256Hex(serialized)
 	};
 }
+/** Digest of already-serialized text: no second stringify, no retained copy. */
+function sha256Hex(serialized) {
+	return createHash("sha256").update(serialized).digest("hex");
+}
 /**
 * Structural request facts for issue #64's cache diagnosis.
 *
@@ -6645,6 +6747,16 @@ function headersTimeoutError(input) {
 /** How deep a root `$ref` / combinator chain is followed while normalizing. */
 const SCHEMA_NORMALIZE_MAX_DEPTH = 4;
 /**
+* Depth-0 normalization results, keyed by the caller's own `parameters` object.
+*
+* {@link toolParametersSchema} only ever reads the root, so a schema that has
+* already been normalized returns the identical answer however many times it is
+* asked. The tool list is rebuilt for EVERY attempt — a rotation or a protocol
+* fallback rebuilds it again — and the objects come from the harness, so they
+* stay identical for the life of a turn: identity is an exact key.
+*/
+const TOOL_SCHEMA_CACHE = /* @__PURE__ */ new WeakMap();
+/**
 * Whether a type-less node is object-shaped enough to be one with the type
 * declared: `properties`/`required`/`additionalProperties` only make sense on
 * an object, and a schema carrying them was meant to be one.
@@ -6690,7 +6802,7 @@ function mergeCombinatorBranches(node, depth) {
 		const objectBranches = [];
 		for (const branch of branches) {
 			if (!isRecord(branch)) continue;
-			objectBranches.push(toolParametersSchema(branch, depth + 1));
+			objectBranches.push(normalizeToolParameters(branch, depth + 1));
 		}
 		if (objectBranches.length === 0) continue;
 		sawBranch = true;
@@ -6720,10 +6832,32 @@ function mergeCombinatorBranches(node, depth) {
 * resolved/merged; anything else (an array/scalar root, or no schema at all)
 * degrades to a permissive free-form object, because a request the provider
 * refuses helps no one and the tool's own description is still in the prompt.
-* Only the root is touched and every path returns a copy: the harness may
-* deep-freeze the caller's schema.
-*/
-function toolParametersSchema(parameters, depth = 0) {
+*
+* Only the ROOT is touched. The object-root fast path deliberately returns the
+* caller's own object: an already-normalized schema is the common case, the
+* function has always answered with that same identity, and callers rely on it
+* to get the same frozen schema they handed in. Everything this function
+* CONSTRUCTS is a fresh object, so no caller can mutate another's schema.
+*
+* The ROOT is memoized per `parameters` object, because every transport rebuilds
+* its tool list on every attempt — on a rotating or downshifting request the
+* same handful of tool schemas is walked four, five, six times for an answer
+* that cannot have changed. The tool objects come from the harness and are
+* stable for the life of a turn, so a WeakMap keyed on identity is exact: a
+* genuinely different schema is a different object and misses. Nested
+* `$ref`/combinator branches are reached through {@link normalizeToolParameters}
+* and are not memoized; only the root is asked for on a hot path.
+*/
+function toolParametersSchema(parameters) {
+	if (!isRecord(parameters)) return normalizeToolParameters(parameters, 0);
+	const cached = TOOL_SCHEMA_CACHE.get(parameters);
+	if (cached !== void 0) return cached;
+	const normalized = normalizeToolParameters(parameters, 0);
+	TOOL_SCHEMA_CACHE.set(parameters, normalized);
+	return normalized;
+}
+/** Depth-0 normalization of {@link toolParametersSchema}; see its memo there. */
+function normalizeToolParameters(parameters, depth) {
 	if (!isRecord(parameters)) return {
 		type: "object",
 		properties: {},
@@ -6739,7 +6873,7 @@ function toolParametersSchema(parameters, depth = 0) {
 			const target = resolveLocalRef(parameters, parameters.$ref);
 			if (target !== void 0) {
 				const { $ref: _ref, ...rest } = parameters;
-				return toolParametersSchema({
+				return normalizeToolParameters({
 					...target,
 					...rest
 				}, depth + 1);
@@ -6975,26 +7109,47 @@ function coreBudget(budget) {
 */
 const imageVersionBytes = (block) => block.attachment.bytes;
 /**
+* The accounting half of the image gate: project the surface's durable offload
+* marks and count what the byte budget still needs — WITHOUT throwing.
+*
+* The throw has to wait until the credential is known. A request that cannot
+* authenticate must not trigger a durable (irreversible) image offload before
+* the caller learns the key is missing; keeping the count pure lets
+* `streamAttempt()` run it before ANY I/O and report ONE error later, once the
+* real transport is known.
+*/
+function projectSurfaceBudget(options, policy, budget) {
+	const marked = policy.projectOffloadedImages(options.messages, (ref) => offloadedImageText(ref));
+	const messages = marked === options.messages ? options.messages : [...marked];
+	return {
+		options: messages === options.messages ? options : {
+			...options,
+			messages
+		},
+		budgetMissing: policy.requiredImageOffload(messages, coreBudget(budget), imageVersionBytes)
+	};
+}
+/**
 * Request options under one budget rung: the surface's durable marks become
 * placeholder text, and an over-budget history FAILS with the count to offload
 * instead of being evicted here. Throws rather than returning, so no caller can
 * accidentally send a body this route already knows is too large.
 *
+* This is the one-shot form (budget + cache in a single error) used by the 413
+* downshift and the protocol fallback. `streamAttempt()`'s first pass uses
+* {@link projectSurfaceBudget} instead, because there the throw must wait for
+* the credential.
+*
 * The next rung is applied to the CURRENT projection, never to the raw history —
 * otherwise the 413 retry could reintroduce images the first rung had already
 * evicted.
 */
 function withSurfaceOffload(options, policy, budget, cacheOffloadModel) {
-	const marked = policy.projectOffloadedImages(options.messages, (ref) => offloadedImageText(ref));
-	const messages = marked === options.messages ? options.messages : [...marked];
-	const budgetMissing = policy.requiredImageOffload(messages, coreBudget(budget), imageVersionBytes);
-	const cacheMissing = cacheOffloadModel === void 0 ? 0 : seenImageOffloadCount(messages, cacheOffloadModel);
-	const missing = Math.max(budgetMissing, cacheMissing);
-	if (missing > 0) throw imageOffloadRequired(missing, cacheMissing > budgetMissing ? "cache" : "budget");
-	return messages === options.messages ? options : {
-		...options,
-		messages
-	};
+	const projected = projectSurfaceBudget(options, policy, budget);
+	const cacheMissing = cacheOffloadModel === void 0 ? 0 : seenImageOffloadCount(projected.options.messages, cacheOffloadModel);
+	const missing = Math.max(projected.budgetMissing, cacheMissing);
+	if (missing > 0) throw imageOffloadRequired(missing, cacheMissing > projected.budgetMissing ? "cache" : "budget");
+	return projected.options;
 }
 /**
 * Count retained images already followed by an answer from this same model.
@@ -7952,6 +8107,25 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 	surfaceOffload;
 	billingAccess = /* @__PURE__ */ new Map();
 	billingAccessInflight = /* @__PURE__ */ new Map();
+	/**
+	* Successful account-endpoint responses, keyed by gateway + key + exact URL.
+	*
+	* The settings card and the picker's advisory plan filter ask the SAME three
+	* endpoints about the SAME account (`/alpha/whoami`, then credits and
+	* subscriptions in parallel). Here that is four round trips per surface for
+	* two answers — and the card refreshes on a timer, so the picker keeps paying
+	* for rows it already has. Sharing the raw responses removes the duplicate
+	* without either surface having to know about the other: whoever asks second
+	* within {@link ACCOUNT_FACTS_TTL_MS} reads the same record instead of the
+	* wire.
+	*
+	* Only SUCCESSFUL records are kept. A failure must be retried rather than
+	* replayed, or an endpoint that recovered a second ago would keep reporting
+	* yesterday's outage — and the usage report's per-endpoint `failures` and
+	* {@link classifyTotalFailure} verdict would describe a request this process
+	* never made.
+	*/
+	accountJson = /* @__PURE__ */ new Map();
 	protocolCache = /* @__PURE__ */ new Map();
 	/** Namespace account-derived facts by gateway without exposing the key. */
 	accountCacheKey(apiBase, apiKey) {
@@ -7991,10 +8165,10 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 	* @returns the error to surface: unchanged for any other failure, the
 	* original timeout below the threshold, and a terminal one at it.
 	*/
-	gradeHeaderTimeout(error, protocol, body, timeoutMs, sessionId) {
+	gradeHeaderTimeout(error, protocol, body, timeoutMs, sessionId, sent) {
 		if (!(error instanceof LlmError && error.code === "TIMEOUT")) return error;
 		const key = sessionId ?? GLOBAL_HEADER_TIMEOUT_KEY;
-		const fingerprint = `${protocol}:${fingerprintValue(body).sha256}`;
+		const fingerprint = `${protocol}:${sent === void 0 ? fingerprintValue(body).sha256 : sha256Hex(sent)}`;
 		const previous = this.headerTimeoutStreaks.get(key);
 		const count = previous?.fingerprint === fingerprint ? previous.count + 1 : 1;
 		if (previous === void 0) {
@@ -8097,7 +8271,9 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 	}
 	async listModels(provider, opts) {
 		const connection = { ...this.deps.options() };
-		const catalog = await this.gatewayFacts.refresh(connection);
+		const cached = this.gatewayFacts.loaded(connection);
+		const catalog = cached ?? await this.gatewayFacts.refresh(connection);
+		if (cached !== void 0) this.gatewayFacts.refresh(connection).catch(() => void 0);
 		const toInfo = (model) => {
 			const vision = KNOWN_IMAGE_MODELS.has(model.id);
 			return {
@@ -8162,13 +8338,33 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 			})) } } : {}
 		};
 	}
-	/** The headers every authenticated account endpoint shares. */
-	async accountHeaders(apiKey) {
+	/**
+	* Resolve and validate the key one account-endpoint call will use.
+	*
+	* Every account endpoint runs the chat path's own `assertUsableApiKey` check,
+	* or a key carrying a character no HTTP header can hold throws inside `fetch`
+	* BEFORE any I/O — once per endpoint — and the report reads as "the network is
+	* down". The credential reference is read structurally: it belongs to the
+	* host's resolved options, not to this adapter's connection type, and it only
+	* names the key in the rejection message.
+	*
+	* Separate from {@link accountHeadersFor} so a caller that also needs to key a
+	* cache by the same identity does not have to resolve the key twice.
+	*/
+	async usableAccountKey(apiKey) {
 		const connection = this.deps.options();
 		const raw = apiKey ?? await this.deps.resolveApiKey(connection);
 		const named = connection.apiKeyEnv;
+		return assertUsableApiKey(raw, "llm-commandcode", typeof named === "string" && named !== "" ? named : "the stored credential");
+	}
+	/** The headers every authenticated account endpoint shares. */
+	async accountHeaders(apiKey) {
+		return this.accountHeadersFor(await this.usableAccountKey(apiKey));
+	}
+	/** Headers for an already-validated key; see {@link usableAccountKey}. */
+	accountHeadersFor(key) {
 		return {
-			Authorization: `Bearer ${assertUsableApiKey(raw, "llm-commandcode", typeof named === "string" && named !== "" ? named : "the stored credential")}`,
+			Authorization: `Bearer ${key}`,
 			...IDENTITY_ENCODING_HEADER,
 			"x-command-code-version": COMMAND_CODE_CLI_VERSION,
 			"x-cli-environment": "production",
@@ -8288,6 +8484,42 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 		return inflight;
 	}
 	/**
+	* One account-endpoint GET, served from {@link accountJson} when `share` and
+	* the same URL answered successfully within {@link ACCOUNT_FACTS_TTL_MS}.
+	*
+	* `timeoutMs` is the CALLER's budget; a cache hit spends none of it. Failures
+	* are never cached, so this can only ever save a request that would have
+	* re-read an answer this process already had.
+	*
+	* `share: false` marks a VOLATILE endpoint — one whose answer is the number
+	* the user is actually looking at, and which must therefore never be replayed
+	* from an earlier request. The usage card's summary is exactly that: its
+	* headline counts and cost are the reason the card exists, and stamping a
+	* cached copy with the current time would misreport when they were read.
+	* Identity and billing facts are the opposite: a plan tier or an org id that
+	* is 30 s old is still the truth, and those are what the picker duplicates.
+	*/
+	async accountJsonGet(apiBase, apiKey, path, timeoutMs, share = true) {
+		const cacheKey = JSON.stringify([
+			apiBase,
+			apiKey,
+			path
+		]);
+		if (share) {
+			const hit = this.accountJson.get(cacheKey);
+			if (hit !== void 0 && Date.now() - hit.at < ACCOUNT_FACTS_TTL_MS) return {
+				status: 200,
+				record: hit.record
+			};
+		}
+		const answer = await this.fetchJson(`${apiBase}${path}`, this.accountHeadersFor(apiKey), timeoutMs);
+		if (share && answer.record !== void 0) this.accountJson.set(cacheKey, {
+			record: answer.record,
+			at: Date.now()
+		});
+		return answer;
+	}
+	/**
 	* The billing facts behind the picker's plan filter, mirroring the CLI's
 	* `createBilling` flow: whoami yields the org id, then the subscriptions
 	* and credits endpoints answer in parallel. The plan id is honored only
@@ -8298,8 +8530,8 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 	*/
 	async fetchBillingAccess(apiBase, apiKey) {
 		try {
-			const headers = await this.accountHeaders(apiKey);
-			const getJson = async (path) => (await this.fetchJson(`${apiBase}${path}`, headers)).record;
+			const key = await this.usableAccountKey(apiKey);
+			const getJson = async (path) => (await this.accountJsonGet(apiBase, key, path, MODELS_TIMEOUT_MS)).record;
 			const whoami = await getJson("/alpha/whoami");
 			const orgData = whoami && isRecord(whoami.org) ? whoami.org : void 0;
 			const orgId = orgData === void 0 ? void 0 : stringValue(orgData.id);
@@ -8406,9 +8638,9 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 	async getUsage(apiKey, capturedConnection) {
 		const connection = capturedConnection ?? { ...this.deps.options() };
 		const base = connection.apiBase;
-		let headers;
+		let key;
 		try {
-			headers = await this.accountHeaders(apiKey);
+			key = await this.usableAccountKey(apiKey);
 		} catch (error) {
 			if (error instanceof LlmError && error.code === "INVALID_CREDENTIAL") return {
 				failures: [error.message],
@@ -8418,9 +8650,9 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 		}
 		const failures = [];
 		const failed = [];
-		const getJson = async (path) => {
+		const getJson = async (path, share = true) => {
 			try {
-				const { status, record, responseFailure } = await this.fetchJson(`${base}${path}`, headers, connection.requestTimeoutMs);
+				const { status, record, responseFailure } = await this.accountJsonGet(base, key, path, connection.requestTimeoutMs, share);
 				if (record === void 0) {
 					failures.push(`${path}: HTTP ${status}${responseFailure ? `；${responseFailure}` : ""}`);
 					failed.push(responseFailure ? {
@@ -8454,7 +8686,7 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 		const rawStart = subData?.currentPeriodStart;
 		const periodStart = periodTimestampValue(rawStart);
 		const validStart = periodStart > 0 && Number.isFinite(new Date(periodStart).getTime());
-		const totals = parseUsageTotals(await getJson(scopedPath("/alpha/usage/summary", validStart ? String(rawStart) : void 0)));
+		const totals = parseUsageTotals(await getJson(scopedPath("/alpha/usage/summary", validStart ? String(rawStart) : void 0), false));
 		if (totals !== void 0) report.usage = totals;
 		const limits = parseCreditLimits(credits);
 		if (limits !== void 0) report.credits = limits;
@@ -8609,23 +8841,15 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 			if (attachments === void 0) throw new LlmError("Command Code image input requires the durable attachment service", "UNSUPPORTED_CONTENT");
 			readImage = requestImages(attachments, options.signal, timing);
 		}
-		const finishCredentials = timing.phase("credentials");
-		let apiKey;
-		try {
-			apiKey = await this.deps.resolveApiKey(connection, options.model);
-		} finally {
-			finishCredentials();
-		}
-		options.signal?.throwIfAborted();
 		let maxTokens = Math.min(budget.max, learnedOutputLimit(connection.apiBase, options.model));
+		const builtMaxTokens = maxTokens;
 		const supported = KNOWN_EFFORTS[options.model];
 		const effort = options.purpose === "session-title" && supported?.includes("off") ? "off" : options.reasoningEffort;
 		const declared = effort !== void 0 && supported?.includes(effort) ? effort : void 0;
 		const reasoningEffort = effort === "off" && declared === void 0 ? void 0 : declared;
 		const systemText = [options.system ?? "", ...options.messages.filter((m) => m.role === "system").map((m) => m.content.map(blockText).filter(Boolean).join("\n"))].filter(Boolean).join("\n\n");
-		let protocol = this.resolveProtocol(connection, apiKey, options.model, modelEntry);
-		let messagesPermissionRejection;
-		let requestOptions = withSurfaceOffload(options, this.surfaceOffload, REQUEST_IMAGE_BUDGETS[0], connection.offloadSeenImagesForCache === true && protocol === "cli" ? options.model : void 0);
+		const projected = projectSurfaceBudget(options, this.surfaceOffload, REQUEST_IMAGE_BUDGETS[0]);
+		let requestOptions = projected.options;
 		const buildBody = async (target) => {
 			const finishBody = timing.phase("body");
 			try {
@@ -8643,7 +8867,30 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 				finishBody();
 			}
 		};
-		let body = await buildBody(protocol);
+		const provisionalProtocol = connection.protocol === "cli" ? "cli" : this.routesToMessages(options.model, modelEntry) ? "messages" : "openai";
+		const finishCredentials = timing.phase("credentials");
+		const credentials = this.deps.resolveApiKey(connection, options.model);
+		credentials.catch(() => void 0);
+		const provisionalBody = connection.offloadSeenImagesForCache === true || projected.budgetMissing > 0 ? void 0 : buildBody(provisionalProtocol);
+		provisionalBody?.catch(() => void 0);
+		let apiKey;
+		try {
+			apiKey = await credentials;
+		} finally {
+			finishCredentials();
+		}
+		options.signal?.throwIfAborted();
+		maxTokens = Math.min(budget.max, learnedOutputLimit(connection.apiBase, options.model));
+		let protocol = this.resolveProtocol(connection, apiKey, options.model, modelEntry);
+		const cacheMissing = protocol === "cli" && connection.offloadSeenImagesForCache === true ? seenImageOffloadCount(requestOptions.messages, options.model) : 0;
+		const missing = Math.max(projected.budgetMissing, cacheMissing);
+		if (missing > 0) throw imageOffloadRequired(missing, cacheMissing > projected.budgetMissing ? "cache" : "budget");
+		let messagesPermissionRejection;
+		let body = provisionalBody !== void 0 && protocol === provisionalProtocol ? await provisionalBody : await buildBody(protocol);
+		if (maxTokens !== builtMaxTokens) {
+			budget.max = Math.min(budget.max, maxTokens);
+			if (!omitOutputTokens(connection.maxOutputTokens, protocol, options.maxTokens)) assignMaxTokens(body, protocol, maxTokens);
+		}
 		const serializedBodies = /* @__PURE__ */ new WeakMap();
 		const trace = openStreamTrace(`${options.provider}/${options.model}`);
 		const tried = /* @__PURE__ */ new Set();
@@ -8765,7 +9012,7 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 			});
 			trace.close();
 			if (options.signal?.aborted) throw error;
-			throw failureWithRequestId(this.gradeHeaderTimeout(error, protocol, body, connection.requestTimeoutMs, options.sessionId), responseMetadata);
+			throw failureWithRequestId(this.gradeHeaderTimeout(error, protocol, body, connection.requestTimeoutMs, options.sessionId, serializedBodies.get(body)), responseMetadata);
 		}
 		if (connected === void 0) throw new LlmError("Command Code API connection failed without a response", "TRANSPORT");
 		const { response, cleanup } = connected;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mars-sea/dsh-commandcode-provider",
-  "version": "0.15.3",
+  "version": "0.15.5",
   "description": "Unofficial DeepSeek Harness LLM provider plugin for Command Code, ported from pi-commandcode-provider (MIT). Registers the 'commandcode' provider route with a Models-page card and live model catalog.",
   "icon": "./icon.svg",
   "type": "module",
@@ -24,7 +24,8 @@
     "compatibility": {
       "dshReleases": {
         "0.2.1-rc.2": "compatible",
-        "0.2.1-rc.3": "compatible"
+        "0.2.1-rc.3": "compatible",
+        "0.2.1-rc.4": "compatible"
       },
       "dsh": ">=0.2.1-rc.2 <0.2.2-0"
     },
@@ -141,10 +142,15 @@
     "@deepseek-ai/schemastery": "~3.18.5",
     "@types/node": "^22.0.0",
     "@types/react": "^18.3.1",
+    "@types/react-test-renderer": "^19.3.0",
     "parse5": "8.0.1",
     "react": "^18.2.0",
+    "react-test-renderer": "^18.3.1",
     "tsdown": "^0.22.2",
     "tsx": "^4.23.12",
     "typescript": "^6.0.3"
+  },
+  "overrides": {
+    "zod": "^4.6.6"
   }
 }