@mars-sea/dsh-commandcode-provider 0.15.4 → 0.16.0

package/lib/index.js

@@ -123,7 +123,7 @@ const PLAN_ORDER = Object.fromEntries(PLAN_TIER_ORDER.map((tier, index) => [tier
 * subscription-plan labels, deals, and hourly (peak/off-peak) pricing.
 *
 * Everything here is synced from official sources — the command-code CLI
-* bundle's model table (`dist/cli.mjs`, re-verified at command-code@1.88.0), the
+* bundle's model table (`dist/cli.mjs`, re-verified at command-code@1.88.1), the
 * live model catalog (`GET /provider/v1/models?view=client`, the authority for
 * capability fields since 1.82.4), and the official plan/pricing/model docs; see
 * the dsh-commandcode-upstream skill for the extraction procedures. The
@@ -139,7 +139,13 @@ const PLAN_ORDER = Object.fromEntries(PLAN_TIER_ORDER.map((tier, index) => [tier
 * efforts `low/high/max`, Go tier, `$2/$10/$0.2`). The 1.88.0 artifact does not
 * name that row yet; the default catalog, `?view=client`, the models docs page
 * and the pricing page all do, so the capability fields come from the catalog
-* as usual. Keeping the snapshot in its own module
+* as usual. The 2026-10-27 check finds the CLI still at 1.88.0 and one more
+* catalog-only addition, GPT-6.1 Terra (`gpt-6.1-terra`): 1.05M context, text +
+* image, the same five-level effort set, Pro tier, `$1/$5` up to a 272K context
+* step and `$2/$7.5` beyond. The 2026-10-28 check moves the constant to 1.88.1,
+* whose registry now names both catalog-only rows (Kimi K3.1 Pro and GPT-6.1
+* Terra) with efforts and context identical to this snapshot, so no table
+* changes. Keeping the snapshot in its own module
 * confines those frequent sync diffs here: src/adapter.ts holds only the stable
 * wire/runtime logic. The read helpers live here too, for the same reason.
 *
@@ -499,6 +505,13 @@ const KNOWN_EFFORTS = {
 		"xhigh",
 		"max"
 	],
+	"gpt-6.1-terra": [
+		"low",
+		"medium",
+		"high",
+		"xhigh",
+		"max"
+	],
 	"inclusionai/ling-3.1-flash": [
 		"low",
 		"medium",
@@ -581,6 +594,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"gpt-6-luna",
 	"gpt-6-sol",
 	"gpt-6.1-sol",
+	"gpt-6.1-terra",
 	"meta/muse-spark-1.1",
 	"meta/muse-spark-1.2",
 	"meta/muse-spark-1.2-contributor",
@@ -934,10 +948,9 @@ const MODEL_OUTPUT_TOKEN_LIMITS = /* @__PURE__ */ new Map([
 * `/docs/plans/max` and `/docs/resources/pricing-limits`). Each plan's model
 * list is a superset of the one below it: Go ⊂ GOAT ⊂ Pro ⊂ Provider/Max.
 * Models absent from every plan list (Claude Opus/Fable, Fugu Ultra) are
-* Provider-tier. Re-verified at command-code@1.88.0 (2026-10-24) against the
-* live `?view=client` catalog: 105 ids, still a strict superset chain. Mistral
-* Large 4
-* (1.75.0) was the only addition at the 1.77.0 check; the 1.78.0/1.79.0 pair
+* Provider-tier. Re-verified at command-code@1.88.1 (2026-10-28) against the
+* live `?view=client` catalog: 106 ids, still a strict superset chain. Mistral
+* Large 4 (1.75.0) was the only addition at the 1.77.0 check; the 1.78.0/1.79.0 pair
 * added Claude Haiku 5.5 at Pro and the free Glyph Cluster preview at Go.
 * 1.79.2 lowers Haiku 5.5's minimum plan to GOAT; 1.80.0 adds Muse Wonder at
 * Max; 1.82.0 adds Gemini 4 Argon at Pro and nothing else moves. The 1.82.4
@@ -946,7 +959,8 @@ const MODEL_OUTPUT_TOKEN_LIMITS = /* @__PURE__ */ new Map([
 * which left the live catalog. Every other
 * tier is unchanged. The 1.86.1 sync (2026-10-21) adds only the Ornith 1.5 122B
 * launch pair at Go; the 1.87.1 check (2026-10-22) adds no model and moves no
-* tier, and the 2026-10-24 check adds only Kimi K3.1 Pro at Go.
+* tier, the 2026-10-24 check adds only Kimi K3.1 Pro at Go, and the 2026-10-27
+* check adds only GPT-6.1 Terra at Pro.
 * The only removals since 1.49.0 are the two retired stealth previews (Pixel
 * Canary at 1.73.1, Space Bunny Alpha at 1.74.3), Ling 3.0 Flash Sante
 * (2026-10-16) and the retired Cat Jam preview (2026-10-20). Per-entry tags
@@ -1043,6 +1057,7 @@ const KNOWN_PLANS = {
 	"gpt-5.5": "pro",
 	"gpt-5.6-terra": "pro",
 	"gpt-6-sol": "pro",
+	"gpt-6.1-terra": "pro",
 	"meta/muse-spark-1.1": "pro",
 	"claude-fable-5-1": "provider",
 	"claude-fable-5": "provider",
@@ -2106,6 +2121,34 @@ const MODEL_PRICE_ROWS = [
 			5
 		] }]
 	},
+	{
+		id: "gpt-6.1-terra",
+		rates: [
+			1,
+			5,
+			.05,
+			1.25
+		],
+		allowance: {
+			go: 6,
+			goat: 20,
+			pro: 20
+		},
+		contextTiers: [{
+			"maxContext": 272e3,
+			"rates": [
+				1,
+				5,
+				.05,
+				1.25
+			]
+		}, { "rates": [
+			2,
+			7.5,
+			.1,
+			2.5
+		] }]
+	},
 	{
 		id: "grok-4.5",
 		rates: [
@@ -4224,6 +4267,29 @@ var CommandCodeAccountPool = class CommandCodeAccountPool {
 		});
 	}
 	/**
+	* 用量报告读到的窗口结论（设置页账号卡片、`/commandcode` 拉取的
+	* `/alpha/billing/credits`）：某个窗口已超限，就按探测的同一口径给这个密钥
+	* 打标记——有可信重置时刻记为到期自动恢复的 `cooldown`，否则为 `unknown`。
+	*
+	* 为什么需要（issue #105）：轮转原本只认真实请求的拒绝，进程重启或冷却过早
+	* 到期后，卡片明明显示「每周 100%」，自动模式和「当前使用」徽标仍选列表第一个
+	* 账号，下一个请求白撞一次拒绝才换号。报告本来就要拉这个接口，把结论记进池里
+	* 不增加任何请求。
+	*
+	* 只加不减：窗口未超限时不清除已有标记。限流（throttle）或消费上限这类拒绝
+	* 在窗口数据里看不到（issue #54），据此清标记会让每次刷新卡片都换来一次注定
+	* 被拒的请求；清除仍只走有节流的探测路径。401 禁用的密钥不改。
+	*/
+	noteWindowReport(apiKey, verdict) {
+		if (verdict === void 0 || !verdict.exceeded) return;
+		const state = this.states.get(apiKey);
+		if (state?.kind === "disabled") return;
+		this.stampWindowMark({
+			key: apiKey,
+			state
+		}, verdict);
+	}
+	/**
 	* Record a model-scoped `unavailable` rejection (no credits, or a model
 	* outside this account's plan) as a SHORT-LIVED PREFERENCE demotion.
 	*
@@ -6369,7 +6435,8 @@ var GatewayFacts = class {
 		if (this.state?.source !== identity) this.state = {
 			source: identity,
 			rows: [],
-			expiresAt: 0
+			expiresAt: 0,
+			origin: "none"
 		};
 		return this.state;
 	}
@@ -6378,6 +6445,20 @@ var GatewayFacts = class {
 		const row = this.forSource(source).rows.find((candidate) => candidate.id === model);
 		return row === void 0 ? void 0 : copyRows([row])[0];
 	}
+	/**
+	* 本进程**联网成功过**的目录；否则返回 undefined。
+	*
+	* 判据是来源而不是「内存里有行」：`snapshot()` 会把磁盘缓存写进同一份
+	* `state.rows`（生成路径需要它），若只看行数，冷启动先发过一次聊天再打开
+	* 选择器时，首屏拿到的就是没有年龄校验的磁盘副本——正是本方法要排除的东西。
+	* 空目录同样返回 undefined：刷新失败后的空行（`expiresAt` 已进入重试窗口）
+	* 不能让选择器把「暂时读不到」画成「没有模型」，调用方应回落到 `refresh()`。
+	*/
+	loaded(source) {
+		const state = this.forSource(source);
+		if (state.origin !== "network" || state.rows.length === 0) return void 0;
+		return copyRows(state.rows);
+	}
 	/** 生成只读取本地目录；捕获状态后不再转向实例的新来源。 */
 	async snapshot(source) {
 		const state = this.forSource(source);
@@ -6385,7 +6466,10 @@ var GatewayFacts = class {
 		state.disk ??= readCache(source).catch(() => []);
 		const rows = await state.disk;
 		if (state.rows.length > 0 || state.expiresAt > 0) return copyRows(state.rows);
-		if (state.inflight === void 0) state.rows = rows;
+		if (state.inflight === void 0) {
+			state.rows = rows;
+			if (rows.length > 0 && state.origin === "none") state.origin = "disk";
+		}
 		return copyRows(rows);
 	}
 	async refresh(source, signal) {
@@ -6398,8 +6482,10 @@ var GatewayFacts = class {
 			const mayPublish = () => this.state === state && generations.get(source.apiBase) === generation;
 			state.inflight = (async () => {
 				let rows, ttl = MODEL_CATALOG_TTL_MS;
+				let network = false;
 				try {
 					rows = parseCatalog$1(await this.fetchCatalog(source), source.apiBase);
+					network = true;
 					if (mayPublish()) {
 						publish(source.apiBase, rows);
 						await writeCache(source, rows, mayPublish).catch(() => void 0);
@@ -6411,6 +6497,8 @@ var GatewayFacts = class {
 				}
 				state.rows = rows;
 				state.expiresAt = Date.now() + ttl;
+				if (network) state.origin = "network";
+				else if (state.origin === "none" && rows.length > 0) state.origin = "disk";
 				return rows;
 			})().finally(() => {
 				delete state.inflight;
@@ -6447,7 +6535,7 @@ var GatewayFacts = class {
 * per-request options thunk and an API-key resolver from the plugin entry
 * (src/index.ts), so a settings change reaches the very next request.
 */
-const COMMAND_CODE_CLI_VERSION = "1.88.0";
+const COMMAND_CODE_CLI_VERSION = "1.88.1";
 const DEFAULT_API_BASE = "https://api.commandcode.ai";
 /**
 * The output budget this bundle asks for, and the ceiling it will never exceed.
@@ -6461,6 +6549,17 @@ const MODELS_TIMEOUT_MS = 1e4;
 /** How long the picker's plan-filter billing facts stay cached before refetching. */
 const BILLING_ACCESS_TTL_MS = 3e5;
 /**
+* How long the raw account facts captured by one usage-report run stay usable
+* for the picker's advisory plan filter.
+*
+* This is much shorter than {@link BILLING_ACCESS_TTL_MS} because it only ever
+* removes a DUPLICATE read: the picker and the settings card ask the same three
+* endpoints about the same key, and whichever ran last already paid for them.
+* Anything older than this window is simply fetched again — the filter is
+* fail-open advisory data, so a miss costs one round trip and nothing else.
+*/
+const ACCOUNT_FACTS_TTL_MS = 3e4;
+/**
 * How long a learned CLI-only protocol preference stays cached per account.
 * After this TTL a request may probe Provider API again, so an upgraded Go
 * account can recover without a restart.
@@ -6552,9 +6651,13 @@ function fingerprintValue(value) {
 	}
 	return {
 		bytes: Buffer.byteLength(serialized),
-		sha256: createHash("sha256").update(serialized).digest("hex")
+		sha256: sha256Hex(serialized)
 	};
 }
+/** Digest of already-serialized text: no second stringify, no retained copy. */
+function sha256Hex(serialized) {
+	return createHash("sha256").update(serialized).digest("hex");
+}
 /**
 * Structural request facts for issue #64's cache diagnosis.
 *
@@ -6670,6 +6773,16 @@ function headersTimeoutError(input) {
 /** How deep a root `$ref` / combinator chain is followed while normalizing. */
 const SCHEMA_NORMALIZE_MAX_DEPTH = 4;
 /**
+* Depth-0 normalization results, keyed by the caller's own `parameters` object.
+*
+* {@link toolParametersSchema} only ever reads the root, so a schema that has
+* already been normalized returns the identical answer however many times it is
+* asked. The tool list is rebuilt for EVERY attempt — a rotation or a protocol
+* fallback rebuilds it again — and the objects come from the harness, so they
+* stay identical for the life of a turn: identity is an exact key.
+*/
+const TOOL_SCHEMA_CACHE = /* @__PURE__ */ new WeakMap();
+/**
 * Whether a type-less node is object-shaped enough to be one with the type
 * declared: `properties`/`required`/`additionalProperties` only make sense on
 * an object, and a schema carrying them was meant to be one.
@@ -6715,7 +6828,7 @@ function mergeCombinatorBranches(node, depth) {
 		const objectBranches = [];
 		for (const branch of branches) {
 			if (!isRecord(branch)) continue;
-			objectBranches.push(toolParametersSchema(branch, depth + 1));
+			objectBranches.push(normalizeToolParameters(branch, depth + 1));
 		}
 		if (objectBranches.length === 0) continue;
 		sawBranch = true;
@@ -6745,10 +6858,32 @@ function mergeCombinatorBranches(node, depth) {
 * resolved/merged; anything else (an array/scalar root, or no schema at all)
 * degrades to a permissive free-form object, because a request the provider
 * refuses helps no one and the tool's own description is still in the prompt.
-* Only the root is touched and every path returns a copy: the harness may
-* deep-freeze the caller's schema.
-*/
-function toolParametersSchema(parameters, depth = 0) {
+*
+* Only the ROOT is touched. The object-root fast path deliberately returns the
+* caller's own object: an already-normalized schema is the common case, the
+* function has always answered with that same identity, and callers rely on it
+* to get the same frozen schema they handed in. Everything this function
+* CONSTRUCTS is a fresh object, so no caller can mutate another's schema.
+*
+* The ROOT is memoized per `parameters` object, because every transport rebuilds
+* its tool list on every attempt — on a rotating or downshifting request the
+* same handful of tool schemas is walked four, five, six times for an answer
+* that cannot have changed. The tool objects come from the harness and are
+* stable for the life of a turn, so a WeakMap keyed on identity is exact: a
+* genuinely different schema is a different object and misses. Nested
+* `$ref`/combinator branches are reached through {@link normalizeToolParameters}
+* and are not memoized; only the root is asked for on a hot path.
+*/
+function toolParametersSchema(parameters) {
+	if (!isRecord(parameters)) return normalizeToolParameters(parameters, 0);
+	const cached = TOOL_SCHEMA_CACHE.get(parameters);
+	if (cached !== void 0) return cached;
+	const normalized = normalizeToolParameters(parameters, 0);
+	TOOL_SCHEMA_CACHE.set(parameters, normalized);
+	return normalized;
+}
+/** Depth-0 normalization of {@link toolParametersSchema}; see its memo there. */
+function normalizeToolParameters(parameters, depth) {
 	if (!isRecord(parameters)) return {
 		type: "object",
 		properties: {},
@@ -6764,7 +6899,7 @@ function toolParametersSchema(parameters, depth = 0) {
 			const target = resolveLocalRef(parameters, parameters.$ref);
 			if (target !== void 0) {
 				const { $ref: _ref, ...rest } = parameters;
-				return toolParametersSchema({
+				return normalizeToolParameters({
 					...target,
 					...rest
 				}, depth + 1);
@@ -7000,26 +7135,47 @@ function coreBudget(budget) {
 */
 const imageVersionBytes = (block) => block.attachment.bytes;
 /**
+* The accounting half of the image gate: project the surface's durable offload
+* marks and count what the byte budget still needs — WITHOUT throwing.
+*
+* The throw has to wait until the credential is known. A request that cannot
+* authenticate must not trigger a durable (irreversible) image offload before
+* the caller learns the key is missing; keeping the count pure lets
+* `streamAttempt()` run it before ANY I/O and report ONE error later, once the
+* real transport is known.
+*/
+function projectSurfaceBudget(options, policy, budget) {
+	const marked = policy.projectOffloadedImages(options.messages, (ref) => offloadedImageText(ref));
+	const messages = marked === options.messages ? options.messages : [...marked];
+	return {
+		options: messages === options.messages ? options : {
+			...options,
+			messages
+		},
+		budgetMissing: policy.requiredImageOffload(messages, coreBudget(budget), imageVersionBytes)
+	};
+}
+/**
 * Request options under one budget rung: the surface's durable marks become
 * placeholder text, and an over-budget history FAILS with the count to offload
 * instead of being evicted here. Throws rather than returning, so no caller can
 * accidentally send a body this route already knows is too large.
 *
+* This is the one-shot form (budget + cache in a single error) used by the 413
+* downshift and the protocol fallback. `streamAttempt()`'s first pass uses
+* {@link projectSurfaceBudget} instead, because there the throw must wait for
+* the credential.
+*
 * The next rung is applied to the CURRENT projection, never to the raw history —
 * otherwise the 413 retry could reintroduce images the first rung had already
 * evicted.
 */
 function withSurfaceOffload(options, policy, budget, cacheOffloadModel) {
-	const marked = policy.projectOffloadedImages(options.messages, (ref) => offloadedImageText(ref));
-	const messages = marked === options.messages ? options.messages : [...marked];
-	const budgetMissing = policy.requiredImageOffload(messages, coreBudget(budget), imageVersionBytes);
-	const cacheMissing = cacheOffloadModel === void 0 ? 0 : seenImageOffloadCount(messages, cacheOffloadModel);
-	const missing = Math.max(budgetMissing, cacheMissing);
-	if (missing > 0) throw imageOffloadRequired(missing, cacheMissing > budgetMissing ? "cache" : "budget");
-	return messages === options.messages ? options : {
-		...options,
-		messages
-	};
+	const projected = projectSurfaceBudget(options, policy, budget);
+	const cacheMissing = cacheOffloadModel === void 0 ? 0 : seenImageOffloadCount(projected.options.messages, cacheOffloadModel);
+	const missing = Math.max(projected.budgetMissing, cacheMissing);
+	if (missing > 0) throw imageOffloadRequired(missing, cacheMissing > projected.budgetMissing ? "cache" : "budget");
+	return projected.options;
 }
 /**
 * Count retained images already followed by an answer from this same model.
@@ -7494,6 +7650,33 @@ function parseWindowLimit(value) {
 	};
 }
 /**
+* 把已解析的用量窗口归结为账号池能用的结论：任一窗口超限即 `exceeded`，
+* `resetAt` 取超限窗口里最晚的重置时刻（真正卡住账号的那个）。
+*
+* 职责：`probeWindowLimits()`（池的探测）与用量报告（设置页卡片、`/commandcode`）
+* 读的是同一个 `/alpha/billing/credits`，两条路径必须得出同一结论，否则卡片显示
+* 「每周 100%」而池仍把它当可用（issue #105）。
+*
+* 一个窗口都没报告时返回 undefined：无从判断，调用方保持原标记不动。
+*/
+function windowVerdict(windows, now = Date.now()) {
+	let reported = false;
+	let exceeded = false;
+	let resetAt = 0;
+	for (const window of windows) {
+		if (window === void 0) continue;
+		reported = true;
+		if (!window.exceeded) continue;
+		exceeded = true;
+		if (window.resetAt > 0 && window.resetAt - now <= 2592e6) resetAt = Math.max(resetAt, window.resetAt);
+	}
+	if (!reported) return void 0;
+	return {
+		exceeded,
+		resetAt: exceeded ? resetAt : 0
+	};
+}
+/**
 * Parse one billing/credits payload into the report's credits section.
 * Returns undefined when the endpoint answered nothing usable.
 */
@@ -7977,6 +8160,25 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 	surfaceOffload;
 	billingAccess = /* @__PURE__ */ new Map();
 	billingAccessInflight = /* @__PURE__ */ new Map();
+	/**
+	* Successful account-endpoint responses, keyed by gateway + key + exact URL.
+	*
+	* The settings card and the picker's advisory plan filter ask the SAME three
+	* endpoints about the SAME account (`/alpha/whoami`, then credits and
+	* subscriptions in parallel). Here that is four round trips per surface for
+	* two answers — and the card refreshes on a timer, so the picker keeps paying
+	* for rows it already has. Sharing the raw responses removes the duplicate
+	* without either surface having to know about the other: whoever asks second
+	* within {@link ACCOUNT_FACTS_TTL_MS} reads the same record instead of the
+	* wire.
+	*
+	* Only SUCCESSFUL records are kept. A failure must be retried rather than
+	* replayed, or an endpoint that recovered a second ago would keep reporting
+	* yesterday's outage — and the usage report's per-endpoint `failures` and
+	* {@link classifyTotalFailure} verdict would describe a request this process
+	* never made.
+	*/
+	accountJson = /* @__PURE__ */ new Map();
 	protocolCache = /* @__PURE__ */ new Map();
 	/** Namespace account-derived facts by gateway without exposing the key. */
 	accountCacheKey(apiBase, apiKey) {
@@ -8016,10 +8218,10 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 	* @returns the error to surface: unchanged for any other failure, the
 	* original timeout below the threshold, and a terminal one at it.
 	*/
-	gradeHeaderTimeout(error, protocol, body, timeoutMs, sessionId) {
+	gradeHeaderTimeout(error, protocol, body, timeoutMs, sessionId, sent) {
 		if (!(error instanceof LlmError && error.code === "TIMEOUT")) return error;
 		const key = sessionId ?? GLOBAL_HEADER_TIMEOUT_KEY;
-		const fingerprint = `${protocol}:${fingerprintValue(body).sha256}`;
+		const fingerprint = `${protocol}:${sent === void 0 ? fingerprintValue(body).sha256 : sha256Hex(sent)}`;
 		const previous = this.headerTimeoutStreaks.get(key);
 		const count = previous?.fingerprint === fingerprint ? previous.count + 1 : 1;
 		if (previous === void 0) {
@@ -8122,7 +8324,9 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 	}
 	async listModels(provider, opts) {
 		const connection = { ...this.deps.options() };
-		const catalog = await this.gatewayFacts.refresh(connection);
+		const cached = this.gatewayFacts.loaded(connection);
+		const catalog = cached ?? await this.gatewayFacts.refresh(connection);
+		if (cached !== void 0) this.gatewayFacts.refresh(connection).catch(() => void 0);
 		const toInfo = (model) => {
 			const vision = KNOWN_IMAGE_MODELS.has(model.id);
 			return {
@@ -8187,13 +8391,33 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 			})) } } : {}
 		};
 	}
-	/** The headers every authenticated account endpoint shares. */
-	async accountHeaders(apiKey) {
+	/**
+	* Resolve and validate the key one account-endpoint call will use.
+	*
+	* Every account endpoint runs the chat path's own `assertUsableApiKey` check,
+	* or a key carrying a character no HTTP header can hold throws inside `fetch`
+	* BEFORE any I/O — once per endpoint — and the report reads as "the network is
+	* down". The credential reference is read structurally: it belongs to the
+	* host's resolved options, not to this adapter's connection type, and it only
+	* names the key in the rejection message.
+	*
+	* Separate from {@link accountHeadersFor} so a caller that also needs to key a
+	* cache by the same identity does not have to resolve the key twice.
+	*/
+	async usableAccountKey(apiKey) {
 		const connection = this.deps.options();
 		const raw = apiKey ?? await this.deps.resolveApiKey(connection);
 		const named = connection.apiKeyEnv;
+		return assertUsableApiKey(raw, "llm-commandcode", typeof named === "string" && named !== "" ? named : "the stored credential");
+	}
+	/** The headers every authenticated account endpoint shares. */
+	async accountHeaders(apiKey) {
+		return this.accountHeadersFor(await this.usableAccountKey(apiKey));
+	}
+	/** Headers for an already-validated key; see {@link usableAccountKey}. */
+	accountHeadersFor(key) {
 		return {
-			Authorization: `Bearer ${assertUsableApiKey(raw, "llm-commandcode", typeof named === "string" && named !== "" ? named : "the stored credential")}`,
+			Authorization: `Bearer ${key}`,
 			...IDENTITY_ENCODING_HEADER,
 			"x-command-code-version": COMMAND_CODE_CLI_VERSION,
 			"x-cli-environment": "production",
@@ -8313,6 +8537,42 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 		return inflight;
 	}
 	/**
+	* One account-endpoint GET, served from {@link accountJson} when `share` and
+	* the same URL answered successfully within {@link ACCOUNT_FACTS_TTL_MS}.
+	*
+	* `timeoutMs` is the CALLER's budget; a cache hit spends none of it. Failures
+	* are never cached, so this can only ever save a request that would have
+	* re-read an answer this process already had.
+	*
+	* `share: false` marks a VOLATILE endpoint — one whose answer is the number
+	* the user is actually looking at, and which must therefore never be replayed
+	* from an earlier request. The usage card's summary is exactly that: its
+	* headline counts and cost are the reason the card exists, and stamping a
+	* cached copy with the current time would misreport when they were read.
+	* Identity and billing facts are the opposite: a plan tier or an org id that
+	* is 30 s old is still the truth, and those are what the picker duplicates.
+	*/
+	async accountJsonGet(apiBase, apiKey, path, timeoutMs, share = true) {
+		const cacheKey = JSON.stringify([
+			apiBase,
+			apiKey,
+			path
+		]);
+		if (share) {
+			const hit = this.accountJson.get(cacheKey);
+			if (hit !== void 0 && Date.now() - hit.at < ACCOUNT_FACTS_TTL_MS) return {
+				status: 200,
+				record: hit.record
+			};
+		}
+		const answer = await this.fetchJson(`${apiBase}${path}`, this.accountHeadersFor(apiKey), timeoutMs);
+		if (share && answer.record !== void 0) this.accountJson.set(cacheKey, {
+			record: answer.record,
+			at: Date.now()
+		});
+		return answer;
+	}
+	/**
 	* The billing facts behind the picker's plan filter, mirroring the CLI's
 	* `createBilling` flow: whoami yields the org id, then the subscriptions
 	* and credits endpoints answer in parallel. The plan id is honored only
@@ -8323,8 +8583,8 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 	*/
 	async fetchBillingAccess(apiBase, apiKey) {
 		try {
-			const headers = await this.accountHeaders(apiKey);
-			const getJson = async (path) => (await this.fetchJson(`${apiBase}${path}`, headers)).record;
+			const key = await this.usableAccountKey(apiKey);
+			const getJson = async (path) => (await this.accountJsonGet(apiBase, key, path, MODELS_TIMEOUT_MS)).record;
 			const whoami = await getJson("/alpha/whoami");
 			const orgData = whoami && isRecord(whoami.org) ? whoami.org : void 0;
 			const orgId = orgData === void 0 ? void 0 : stringValue(orgData.id);
@@ -8431,9 +8691,9 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 	async getUsage(apiKey, capturedConnection) {
 		const connection = capturedConnection ?? { ...this.deps.options() };
 		const base = connection.apiBase;
-		let headers;
+		let key;
 		try {
-			headers = await this.accountHeaders(apiKey);
+			key = await this.usableAccountKey(apiKey);
 		} catch (error) {
 			if (error instanceof LlmError && error.code === "INVALID_CREDENTIAL") return {
 				failures: [error.message],
@@ -8443,9 +8703,9 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 		}
 		const failures = [];
 		const failed = [];
-		const getJson = async (path) => {
+		const getJson = async (path, share = true) => {
 			try {
-				const { status, record, responseFailure } = await this.fetchJson(`${base}${path}`, headers, connection.requestTimeoutMs);
+				const { status, record, responseFailure } = await this.accountJsonGet(base, key, path, connection.requestTimeoutMs, share);
 				if (record === void 0) {
 					failures.push(`${path}: HTTP ${status}${responseFailure ? `；${responseFailure}` : ""}`);
 					failed.push(responseFailure ? {
@@ -8479,7 +8739,7 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 		const rawStart = subData?.currentPeriodStart;
 		const periodStart = periodTimestampValue(rawStart);
 		const validStart = periodStart > 0 && Number.isFinite(new Date(periodStart).getTime());
-		const totals = parseUsageTotals(await getJson(scopedPath("/alpha/usage/summary", validStart ? String(rawStart) : void 0)));
+		const totals = parseUsageTotals(await getJson(scopedPath("/alpha/usage/summary", validStart ? String(rawStart) : void 0), false));
 		if (totals !== void 0) report.usage = totals;
 		const limits = parseCreditLimits(credits);
 		if (limits !== void 0) report.credits = limits;
@@ -8528,22 +8788,7 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 			if (parsed === void 0) return void 0;
 			const windowLimits = isRecord(parsed.windowLimits) ? parsed.windowLimits : void 0;
 			if (windowLimits === void 0) return void 0;
-			let reported = false;
-			let exceeded = false;
-			let resetAt = 0;
-			for (const raw of [windowLimits.fiveHour, windowLimits.weekly]) {
-				const window = isRecord(raw) ? parseWindowLimit(raw) : void 0;
-				if (window === void 0) continue;
-				reported = true;
-				if (!window.exceeded) continue;
-				exceeded = true;
-				if (window.resetAt > 0 && window.resetAt - Date.now() <= 2592e6) resetAt = Math.max(resetAt, window.resetAt);
-			}
-			if (!reported) return void 0;
-			return {
-				exceeded,
-				resetAt: exceeded ? resetAt : 0
-			};
+			return windowVerdict([windowLimits.fiveHour, windowLimits.weekly].map((raw) => isRecord(raw) ? parseWindowLimit(raw) : void 0));
 		} catch {
 			return;
 		}
@@ -8634,23 +8879,15 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 			if (attachments === void 0) throw new LlmError("Command Code image input requires the durable attachment service", "UNSUPPORTED_CONTENT");
 			readImage = requestImages(attachments, options.signal, timing);
 		}
-		const finishCredentials = timing.phase("credentials");
-		let apiKey;
-		try {
-			apiKey = await this.deps.resolveApiKey(connection, options.model);
-		} finally {
-			finishCredentials();
-		}
-		options.signal?.throwIfAborted();
 		let maxTokens = Math.min(budget.max, learnedOutputLimit(connection.apiBase, options.model));
+		const builtMaxTokens = maxTokens;
 		const supported = KNOWN_EFFORTS[options.model];
 		const effort = options.purpose === "session-title" && supported?.includes("off") ? "off" : options.reasoningEffort;
 		const declared = effort !== void 0 && supported?.includes(effort) ? effort : void 0;
 		const reasoningEffort = effort === "off" && declared === void 0 ? void 0 : declared;
 		const systemText = [options.system ?? "", ...options.messages.filter((m) => m.role === "system").map((m) => m.content.map(blockText).filter(Boolean).join("\n"))].filter(Boolean).join("\n\n");
-		let protocol = this.resolveProtocol(connection, apiKey, options.model, modelEntry);
-		let messagesPermissionRejection;
-		let requestOptions = withSurfaceOffload(options, this.surfaceOffload, REQUEST_IMAGE_BUDGETS[0], connection.offloadSeenImagesForCache === true && protocol === "cli" ? options.model : void 0);
+		const projected = projectSurfaceBudget(options, this.surfaceOffload, REQUEST_IMAGE_BUDGETS[0]);
+		let requestOptions = projected.options;
 		const buildBody = async (target) => {
 			const finishBody = timing.phase("body");
 			try {
@@ -8668,7 +8905,30 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 				finishBody();
 			}
 		};
-		let body = await buildBody(protocol);
+		const provisionalProtocol = connection.protocol === "cli" ? "cli" : this.routesToMessages(options.model, modelEntry) ? "messages" : "openai";
+		const finishCredentials = timing.phase("credentials");
+		const credentials = this.deps.resolveApiKey(connection, options.model);
+		credentials.catch(() => void 0);
+		const provisionalBody = connection.offloadSeenImagesForCache === true || projected.budgetMissing > 0 ? void 0 : buildBody(provisionalProtocol);
+		provisionalBody?.catch(() => void 0);
+		let apiKey;
+		try {
+			apiKey = await credentials;
+		} finally {
+			finishCredentials();
+		}
+		options.signal?.throwIfAborted();
+		maxTokens = Math.min(budget.max, learnedOutputLimit(connection.apiBase, options.model));
+		let protocol = this.resolveProtocol(connection, apiKey, options.model, modelEntry);
+		const cacheMissing = protocol === "cli" && connection.offloadSeenImagesForCache === true ? seenImageOffloadCount(requestOptions.messages, options.model) : 0;
+		const missing = Math.max(projected.budgetMissing, cacheMissing);
+		if (missing > 0) throw imageOffloadRequired(missing, cacheMissing > projected.budgetMissing ? "cache" : "budget");
+		let messagesPermissionRejection;
+		let body = provisionalBody !== void 0 && protocol === provisionalProtocol ? await provisionalBody : await buildBody(protocol);
+		if (maxTokens !== builtMaxTokens) {
+			budget.max = Math.min(budget.max, maxTokens);
+			if (!omitOutputTokens(connection.maxOutputTokens, protocol, options.maxTokens)) assignMaxTokens(body, protocol, maxTokens);
+		}
 		const serializedBodies = /* @__PURE__ */ new WeakMap();
 		const trace = openStreamTrace(`${options.provider}/${options.model}`);
 		const tried = /* @__PURE__ */ new Set();
@@ -8790,7 +9050,7 @@ var CommandCodeAdapter = class CommandCodeAdapter extends LlmAdapter {
 			});
 			trace.close();
 			if (options.signal?.aborted) throw error;
-			throw failureWithRequestId(this.gradeHeaderTimeout(error, protocol, body, connection.requestTimeoutMs, options.sessionId), responseMetadata);
+			throw failureWithRequestId(this.gradeHeaderTimeout(error, protocol, body, connection.requestTimeoutMs, options.sessionId, serializedBodies.get(body)), responseMetadata);
 		}
 		if (connected === void 0) throw new LlmError("Command Code API connection failed without a response", "TRANSPORT");
 		const { response, cleanup } = connected;
@@ -11888,18 +12148,24 @@ function apply(ctx, config) {
 	const usageReports = async () => {
 		const connection = options();
 		const accounts = scopedPool(connection);
+		const keyed = new Map((await accounts.describeAccounts()).map((account) => [account.slot.id, account.key]));
+		const reports = await Promise.all(connection.accountSelection.slots.map(async (slot) => {
+			const key = keyed.get(slot.id);
+			if (key === void 0) return { failures: [] };
+			try {
+				const report = await adapter.getUsage(key, connection);
+				if (report.credits !== void 0) accounts.noteWindowReport(key, windowVerdict([report.credits.fiveHour, report.credits.weekly]));
+				return report;
+			} catch (error) {
+				return { failures: [readableErrorText(error)] };
+			}
+		}));
 		const active = await accounts.activeAccount();
 		const described = await accounts.describeAccounts();
 		const byId = new Map(described.map((account) => [account.slot.id, account]));
-		return { accounts: await Promise.all(connection.accountSelection.slots.map(async (slot) => {
+		return { accounts: connection.accountSelection.slots.map((slot, index) => {
 			const account = byId.get(slot.id);
-			let report;
-			if (account === void 0) report = { failures: [] };
-			else try {
-				report = await adapter.getUsage(account.key, connection);
-			} catch (error) {
-				report = { failures: [readableErrorText(error)] };
-			}
+			const report = reports[index] ?? { failures: [] };
 			const state = account?.state;
 			const usable = accountUsable(state);
 			return {
@@ -11911,7 +12177,7 @@ function apply(ctx, config) {
 				cooldownUntil: !usable && state?.kind === "cooldown" ? state.until : 0,
 				report
 			};
-		})) };
+		}) };
 	};
 	const commandLocale = () => pickCommandLocale(current().lang);
 	ctx.inject(["commands"], (commandCtx) => {