dsh-cliworker-now 0.7.6 → 0.7.8

package/lib/types/client/zcode-login-link.js

@@ -0,0 +1,194 @@
+const nativePrompt = 'Open this URL to sign in:';
+const maxLineLength = 8_192;
+// Fixed endpoints observed from the official CLI's provider-specific device
+// flows. Preserve the server-returned URL; never construct or rewrite one.
+const nativeEndpoints = {
+    zai: {
+        prefix: /^https:\/\/chat\.z\.ai(?::443)?\/api\/oauth\/authorize\?/,
+        origin: 'https://chat.z.ai',
+        path: '/api/oauth/authorize',
+        parameters: ['client_id', 'redirect_uri', 'state', 'response_type'],
+    },
+    bigmodel: {
+        prefix: /^https:\/\/bigmodel\.cn(?::443)?\/login\?/,
+        origin: 'https://bigmodel.cn',
+        path: '/login',
+        parameters: ['appId', 'redirect', 'state'],
+    },
+};
+/** Validate only the observed native authorization endpoint; return the original bytes. */
+function nativeLoginUrl(line, provider) {
+    // Older callers retain their Z.AI-only contract. Unknown providers never
+    // broaden navigation to either region or a caller-supplied destination.
+    const selected = provider === undefined ? 'zai' : provider;
+    if (selected !== 'zai' && selected !== 'bigmodel')
+        return undefined;
+    const endpoint = nativeEndpoints[selected];
+    if (line.length > maxLineLength || !endpoint.prefix.test(line) || /[\s\p{C}<>"'\\#]/u.test(line))
+        return undefined;
+    try {
+        const url = new URL(line);
+        if (url.protocol !== 'https:' ||
+            url.origin !== endpoint.origin ||
+            url.pathname !== endpoint.path ||
+            url.username ||
+            url.password ||
+            url.hash ||
+            (url.port && url.port !== '443'))
+            return undefined;
+        for (const parameter of endpoint.parameters) {
+            const values = url.searchParams.getAll(parameter);
+            if (values.length !== 1 || !values[0]?.trim())
+                return undefined;
+        }
+        return line;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The caller must enable this only for a ZCode login session and pass the selected
+ * provider so one region cannot open the other region's URL. URLs stay in memory.
+ * Accept a single complete line immediately after the fixed native --no-browser
+ * prompt. SGR/cursor visibility do not affect text. The observed ConPTY blank
+ * screen initialization is accepted only before any prompt/URL text; arbitrary
+ * cursor edits do not become trusted text. OSC payloads are never stored.
+ */
+export function createZcodeLoginLinkParser(provider) {
+    let mode = 'text';
+    let line = '';
+    let invalidLine = false;
+    let carriageReturn = false;
+    let csiParameters = true;
+    let csiLength = 0;
+    let csiSequence = '';
+    let oscCommand = '';
+    let oscCommandComplete = false;
+    let oscInitialization = false;
+    let awaitingUrl = false;
+    let previousUrl;
+    const reset = () => {
+        mode = 'text';
+        line = '';
+        invalidLine = false;
+        carriageReturn = false;
+        csiParameters = true;
+        csiLength = 0;
+        csiSequence = '';
+        oscCommand = '';
+        oscCommandComplete = false;
+        oscInitialization = false;
+        awaitingUrl = false;
+        previousUrl = undefined;
+    };
+    const finishLine = () => {
+        const complete = invalidLine ? '' : line.trim();
+        line = '';
+        invalidLine = false;
+        carriageReturn = false;
+        if (complete === nativePrompt) {
+            awaitingUrl = true;
+            return undefined;
+        }
+        const candidate = awaitingUrl ? nativeLoginUrl(complete, provider) : undefined;
+        awaitingUrl = false;
+        if (!candidate || candidate === previousUrl)
+            return undefined;
+        previousUrl = candidate;
+        return candidate;
+    };
+    return {
+        reset,
+        write(chunk) {
+            let result;
+            for (const character of chunk) {
+                if (mode === 'osc' || mode === 'osc-escape') {
+                    if (character === '\x07' || (mode === 'osc-escape' && character === '\\')) {
+                        // Only startup OSC 0/2 title metadata is inert here. In particular,
+                        // OSC 8 hyperlink targets never supply or decorate a login link.
+                        if (!oscInitialization || !oscCommandComplete || !['0', '2'].includes(oscCommand))
+                            invalidLine = true;
+                        mode = 'text';
+                    }
+                    else {
+                        if (!oscCommandComplete) {
+                            if (character === ';')
+                                oscCommandComplete = true;
+                            else if (oscCommand.length < 2)
+                                oscCommand += character;
+                            else
+                                oscInitialization = false;
+                        }
+                        mode = character === '\x1b' ? 'osc-escape' : 'osc';
+                    }
+                    continue;
+                }
+                if (mode === 'escape') {
+                    if (character === '[') {
+                        mode = 'csi';
+                        csiParameters = true;
+                        csiLength = 0;
+                        csiSequence = '';
+                        continue;
+                    }
+                    if (character === ']') {
+                        oscInitialization = !line && !awaitingUrl && !invalidLine;
+                        oscCommand = '';
+                        oscCommandComplete = false;
+                        mode = 'osc';
+                    }
+                    else {
+                        invalidLine = true;
+                        mode = 'text';
+                    }
+                    if (character !== '\n')
+                        continue;
+                }
+                else if (mode === 'csi') {
+                    csiLength++;
+                    if (character >= '@' && character <= '~') {
+                        const sequence = csiSequence + character;
+                        const decoration = character === 'm' && csiParameters;
+                        const visibility = /^\?25[hl]$/.test(sequence);
+                        const initialization = !line && !awaitingUrl && !invalidLine && /^(?:2J|0?K|(?:1;1)?H)$/.test(sequence);
+                        if (csiLength > 64 || (!decoration && !visibility && !initialization))
+                            invalidLine = true;
+                        mode = 'text';
+                        continue;
+                    }
+                    csiParameters &&= /^[0-9;:]$/.test(character);
+                    if (csiLength <= 64)
+                        csiSequence += character;
+                    if (character !== '\n')
+                        continue;
+                    invalidLine = true;
+                    mode = 'text';
+                }
+                if (character === '\n') {
+                    const found = finishLine();
+                    if (found)
+                        result = found;
+                    continue;
+                }
+                if (carriageReturn)
+                    invalidLine = true;
+                carriageReturn = character === '\r';
+                if (carriageReturn)
+                    continue;
+                if (character === '\x1b') {
+                    mode = 'escape';
+                    continue;
+                }
+                if (/[\p{C}]/u.test(character))
+                    invalidLine = true;
+                if (line.length + character.length > maxLineLength)
+                    invalidLine = true;
+                if (!invalidLine)
+                    line += character;
+            }
+            return result;
+        },
+    };
+}
+//# sourceMappingURL=zcode-login-link.js.map

package/lib/types/client/zcode-login-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zcode-login-link.js","sourceRoot":"","sources":["../../../src/client/zcode-login-link.ts"],"names":[],"mappings":"AAEA,MAAM,YAAY,GAAG,2BAA2B,CAAA;AAChD,MAAM,aAAa,GAAG,KAAK,CAAA;AAC3B,4EAA4E;AAC5E,2EAA2E;AAC3E,MAAM,eAAe,GAAG;IACtB,GAAG,EAAE;QACH,MAAM,EAAE,0DAA0D;QAClE,MAAM,EAAE,mBAAmB;QAC3B,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,CAAC;KACpE;IACD,QAAQ,EAAE;QACR,MAAM,EAAE,2CAA2C;QACnD,MAAM,EAAE,qBAAqB;QAC7B,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC;KAC3C;CACO,CAAA;AAEV,2FAA2F;AAC3F,SAAS,cAAc,CAAC,IAAY,EAAE,QAAwC;IAC5E,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,QAAQ,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC1D,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IACnE,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9F,OAAO,SAAS,CAAA;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAA;QACzB,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAC9B,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI;YAC9B,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,IAAI;YACR,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC;YAEhC,OAAO,SAAS,CAAA;QAClB,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YACjD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;gBAAE,OAAO,SAAS,CAAA;QACjE,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAA6B;IACtE,IAAI,IAAI,GAAqD,MAAM,CAAA;IACnE,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,cAAc,GAAG,KAAK,CAAA;IAC1B,IAAI,aAAa,GAAG,IAAI,CAAA;IACxB,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,IAAI,WAAW,GAAG,EAAE,CAAA;IACpB,IAAI,UAAU,GAAG,EAAE,CAAA;IACnB,IAAI,kBAAkB,GAAG,KAAK,CAAA;IAC9B,IAAI,iBAAiB,GAAG,KAAK,CAAA;IAC7B,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,WAA+B,CAAA;IAEnC,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,GAAG,MAAM,CAAA;QACb,IAAI,GAAG,EAAE,CAAA;QACT,WAAW,GAAG,KAAK,CAAA;QACnB,cAAc,GAAG,KAAK,CAAA;QACtB,aAAa,GAAG,IAAI,CAAA;QACpB,SAAS,GAAG,CAAC,CAAA;QACb,WAAW,GAAG,EAAE,CAAA;QAChB,UAAU,GAAG,EAAE,CAAA;QACf,kBAAkB,GAAG,KAAK,CAAA;QAC1B,iBAAiB,GAAG,KAAK,CAAA;QACzB,WAAW,GAAG,KAAK,CAAA;QACnB,WAAW,GAAG,SAAS,CAAA;IACzB,CAAC,CAAA;IACD,MAAM,UAAU,GAAG,GAAuB,EAAE;QAC1C,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;QAC/C,IAAI,GAAG,EAAE,CAAA;QACT,WAAW,GAAG,KAAK,CAAA;QACnB,cAAc,GAAG,KAAK,CAAA;QACtB,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC9B,WAAW,GAAG,IAAI,CAAA;YAClB,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC9E,WAAW,GAAG,KAAK,CAAA;QACnB,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,WAAW;YAAE,OAAO,SAAS,CAAA;QAC7D,WAAW,GAAG,SAAS,CAAA;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;IACD,OAAO;QACL,KAAK;QACL,KAAK,CAAC,KAAK;YACT,IAAI,MAA0B,CAAA;YAC9B,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;gBAC9B,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC5C,IAAI,SAAS,KAAK,MAAM,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,SAAS,KAAK,IAAI,CAAC,EAAE,CAAC;wBAC1E,oEAAoE;wBACpE,iEAAiE;wBACjE,IAAI,CAAC,iBAAiB,IAAI,CAAC,kBAAkB,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;4BAC/E,WAAW,GAAG,IAAI,CAAA;wBACpB,IAAI,GAAG,MAAM,CAAA;oBACf,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,kBAAkB,EAAE,CAAC;4BACxB,IAAI,SAAS,KAAK,GAAG;gCAAE,kBAAkB,GAAG,IAAI,CAAA;iCAC3C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;gCAAE,UAAU,IAAI,SAAS,CAAA;;gCAClD,iBAAiB,GAAG,KAAK,CAAA;wBAChC,CAAC;wBACD,IAAI,GAAG,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;oBACpD,CAAC;oBACD,SAAQ;gBACV,CAAC;gBACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;wBACtB,IAAI,GAAG,KAAK,CAAA;wBACZ,aAAa,GAAG,IAAI,CAAA;wBACpB,SAAS,GAAG,CAAC,CAAA;wBACb,WAAW,GAAG,EAAE,CAAA;wBAChB,SAAQ;oBACV,CAAC;oBACD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;wBACtB,iBAAiB,GAAG,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAA;wBACzD,UAAU,GAAG,EAAE,CAAA;wBACf,kBAAkB,GAAG,KAAK,CAAA;wBAC1B,IAAI,GAAG,KAAK,CAAA;oBACd,CAAC;yBAAM,CAAC;wBACN,WAAW,GAAG,IAAI,CAAA;wBAClB,IAAI,GAAG,MAAM,CAAA;oBACf,CAAC;oBACD,IAAI,SAAS,KAAK,IAAI;wBAAE,SAAQ;gBAClC,CAAC;qBAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;oBAC1B,SAAS,EAAE,CAAA;oBACX,IAAI,SAAS,IAAI,GAAG,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;wBACzC,MAAM,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAA;wBACxC,MAAM,UAAU,GAAG,SAAS,KAAK,GAAG,IAAI,aAAa,CAAA;wBACrD,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;wBAC9C,MAAM,cAAc,GAClB,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,IAAI,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;wBAClF,IAAI,SAAS,GAAG,EAAE,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,CAAC;4BAAE,WAAW,GAAG,IAAI,CAAA;wBACzF,IAAI,GAAG,MAAM,CAAA;wBACb,SAAQ;oBACV,CAAC;oBACD,aAAa,KAAK,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;oBAC7C,IAAI,SAAS,IAAI,EAAE;wBAAE,WAAW,IAAI,SAAS,CAAA;oBAC7C,IAAI,SAAS,KAAK,IAAI;wBAAE,SAAQ;oBAChC,WAAW,GAAG,IAAI,CAAA;oBAClB,IAAI,GAAG,MAAM,CAAA;gBACf,CAAC;gBACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;oBACvB,MAAM,KAAK,GAAG,UAAU,EAAE,CAAA;oBAC1B,IAAI,KAAK;wBAAE,MAAM,GAAG,KAAK,CAAA;oBACzB,SAAQ;gBACV,CAAC;gBACD,IAAI,cAAc;oBAAE,WAAW,GAAG,IAAI,CAAA;gBACtC,cAAc,GAAG,SAAS,KAAK,IAAI,CAAA;gBACnC,IAAI,cAAc;oBAAE,SAAQ;gBAC5B,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;oBACzB,IAAI,GAAG,QAAQ,CAAA;oBACf,SAAQ;gBACV,CAAC;gBACD,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;oBAAE,WAAW,GAAG,IAAI,CAAA;gBAClD,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,aAAa;oBAAE,WAAW,GAAG,IAAI,CAAA;gBACtE,IAAI,CAAC,WAAW;oBAAE,IAAI,IAAI,SAAS,CAAA;YACrC,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAA;AACH,CAAC"}

package/lib/types/host/account-models.d.mts

@@ -1,15 +1,23 @@
 export interface AccountModelScope {
   state: 'supported' | 'denied' | 'unknown'
   source: 'account-models' | 'configured-custom' | 'verified-route' | 'unknown'
-  models: { id: string; name?: string; cost: 'free' | 'paid' | 'unknown' }[]
+  /** Safe metadata classification; absent when the server did not establish a specific cause. */
+  denialReason?: 'authentication' | 'quota'
+  /** Endpoint explicitly returned 404/405; never inferred from network or parse errors. */
+  catalogUnavailable?: boolean
+  /** Successful metadata response contained an explicitly empty raw model array. */
+  catalogEmpty?: boolean
+  models: { id: string; name?: string; cost: 'free' | 'paid' | 'unknown'; reasoningEfforts?: string[] }[]
 }
 export interface AccountModelInput {
   provider: string
   credential: { type: 'api' | 'oauth'; key?: string; access?: string; expires?: number; accountId?: string }
   baseUrl?: string
+  /** Installed Codex app-server version from its initialize handshake, never a guessed model version. */
+  codexClientVersion?: string
   apiType?: string
   /** Mirror a native route that explicitly sends both Anthropic auth headers. */
-  anthropicAuth?: 'api-key-and-bearer'
+  anthropicAuth?: 'api-key-and-bearer' | 'bearer'
   customModelIds?: string[]
   verifiedModelIds?: string[]
 }

package/lib/types/host/account-models.mjs

@@ -1,7 +1,12 @@
 // Read-only account metadata. Never refresh OAuth, submit prompts, or return
 // credentials, account IDs, headers, endpoint URLs, or raw exception messages.
 const unknown = () => ({ state: 'unknown', source: 'unknown', models: [] })
-const denied = () => ({ state: 'denied', source: 'unknown', models: [] })
+const denied = (denialReason) => ({
+  state: 'denied',
+  source: 'unknown',
+  models: [],
+  ...(denialReason ? { denialReason } : {}),
+})
 const validId = (id) => typeof id === 'string' && !!id && id.length <= 1024 && !/[\s\x00-\x1f]/.test(id)
 const object = (value) => value && typeof value === 'object' && !Array.isArray(value)
 const unavailable = (model) =>
@@ -13,6 +18,7 @@ const unavailable = (model) =>
   model.disabled === true ||
   model.upgrade_required === true ||
   model.visibility === 'hidden' ||
+  model.visibility === 'hide' ||
   model.visibility === 'none'
 const numericRate = (value) =>
   typeof value === 'number'
@@ -55,6 +61,7 @@ function normalize(payload, oauth, token) {
   if (!list) return undefined
   const result = new Map()
   for (const model of list) {
+    // Availability NUX is informational text, not an account denial.
     if (!object(model) || unavailable(model)) continue
     const id = model.slug ?? model.id
     if (
@@ -65,6 +72,14 @@ function normalize(payload, oauth, token) {
     )
       continue
     const name = model.display_name ?? model.name
+    const reasoningEfforts =
+      oauth && Array.isArray(model.supported_reasoning_levels)
+        ? [...new Set(model.supported_reasoning_levels.flatMap((level) =>
+            object(level) && typeof level.effort === 'string' && /^[a-z]+$/.test(level.effort)
+              ? [level.effort]
+              : [],
+          ))]
+        : []
     result.set(id, {
       id,
       ...(typeof name === 'string' &&
@@ -75,6 +90,7 @@ function normalize(payload, oauth, token) {
         ? { name }
         : {}),
       cost: costFor(model, oauth),
+      ...(reasoningEfforts.length ? { reasoningEfforts } : {}),
     })
   }
   return [...result.values()]
@@ -124,8 +140,17 @@ export async function probeAccountModels(input, options = {}) {
   if (typeof token !== 'string' || !token.trim() || token.trimStart().startsWith('!')) return unknown()
   // Near-expiry credentials cannot reliably finish the query. Do not renew them.
   if (oauth && (typeof credential.expires !== 'number' || credential.expires <= Date.now() + 30000))
-    return denied()
+    return denied('authentication')
   const codex = oauth && ['openai', 'openai-codex'].includes(input.provider)
+  if (
+    input.codexClientVersion !== undefined &&
+    (typeof input.codexClientVersion !== 'string' || input.codexClientVersion.length > 64 ||
+      !/^\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?$/.test(input.codexClientVersion))
+  )
+    return unknown()
+  // Other native client integrations retain their existing compatibility query.
+  // discoverCodexModels always requires and supplies its own handshake version.
+  const codexVersion = input.codexClientVersion ?? '0.144.1'
   // xAI/other subscription catalogs do not expose a verified per-account scope
   // contract here. Do not turn an OAuth login into their whole public catalog.
   if (oauth && !codex) return unknown()
@@ -142,8 +167,8 @@ export async function probeAccountModels(input, options = {}) {
     if (input.apiType === 'anthropic-messages' && !oauth) {
       // ZCode's native Anthropic factory sends both headers. Other callers keep
       // the ordinary x-api-key contract unless they explicitly mirror that route.
-      if (input.anthropicAuth !== 'api-key-and-bearer') delete headers.Authorization
-      headers['x-api-key'] = token
+      if (!['api-key-and-bearer', 'bearer'].includes(input.anthropicAuth)) delete headers.Authorization
+      if (input.anthropicAuth !== 'bearer') headers['x-api-key'] = token
       headers['anthropic-version'] = '2023-06-01'
     }
     if (codex) {
@@ -157,12 +182,12 @@ export async function probeAccountModels(input, options = {}) {
       }
       if (typeof accountId === 'string' && accountId) headers['chatgpt-account-id'] = accountId
       headers['OpenAI-Beta'] = 'responses=experimental'
-      headers.originator = 'pi'
-      headers.version = '0.144.1'
+      headers.originator = input.codexClientVersion ? 'cli_worker_models' : 'pi'
+      headers.version = codexVersion
     }
     const fetcher = options.fetch ?? globalThis.fetch
     const request = async (path) => {
-      const target = `${base}${path}${codex && path !== '/wham/usage' ? '?client_version=0.144.1' : ''}`
+      const target = `${base}${path}${codex && path !== '/wham/usage' ? `?client_version=${encodeURIComponent(codexVersion)}` : ''}`
       const response = await fetcher(target, { method: 'GET', headers, signal, redirect: 'error' })
       if (!response.ok) {
         await response.body?.cancel()
@@ -179,7 +204,7 @@ export async function probeAccountModels(input, options = {}) {
             : '/models',
         ]) {
       modelResponse = await request(path)
-      if (modelResponse.status === 401 || modelResponse.status === 403) return denied()
+      if (modelResponse.status === 401 || modelResponse.status === 403) return denied('authentication')
       if (modelResponse.status >= 200 && modelResponse.status < 300) break
       if (![404, 405].includes(modelResponse.status)) return unknown()
     }
@@ -191,7 +216,7 @@ export async function probeAccountModels(input, options = {}) {
         return ['invalid_api_key', 'authentication_failed', 'unauthorized', 'forbidden', 401, 403].includes(
           code,
         )
-          ? denied()
+          ? denied('authentication')
           : unknown()
       }
       const models = normalize(envelope, oauth, token)
@@ -199,13 +224,11 @@ export async function probeAccountModels(input, options = {}) {
       if (codex) {
         const usage = await request('/wham/usage')
         const rate = usage.payload?.rate_limit
-        if (
-          usage.status === 401 ||
-          usage.status === 403 ||
-          rate?.allowed === false ||
-          rate?.limit_reached === true
-        )
-          return denied()
+        if (usage.status === 401 || usage.status === 403) return denied('authentication')
+        // Only the authenticated usage response establishes exhausted quota.
+        // Keep an unclassified denial distinct from expiry/401/403 and network failure.
+        if (usage.status === 200 && rate?.limit_reached === true) return denied('quota')
+        if (rate?.allowed === false || rate?.limit_reached === true) return denied()
         // A catalog/menu is not evidence that the account has an executable quota.
         if (usage.status !== 200 || rate?.allowed !== true || rate?.limit_reached !== false) return unknown()
         const plan =
@@ -236,7 +259,12 @@ export async function probeAccountModels(input, options = {}) {
       ) {
         for (const model of models) if (model.cost === 'free') model.cost = 'unknown'
       }
-      return { state: 'supported', source: 'account-models', models }
+      return {
+        state: 'supported',
+        source: 'account-models',
+        models,
+        ...(!codex && entries(envelope)?.length === 0 ? { catalogEmpty: true } : {}),
+      }
     }
     if (!oauth && [404, 405].includes(modelResponse?.status)) {
       // Declaring a custom model is not an account entitlement proof.
@@ -250,7 +278,10 @@ export async function probeAccountModels(input, options = {}) {
           models: verified.map((id) => ({ id, cost: 'unknown' })),
         }
     }
-    return unknown()
+    return {
+      ...unknown(),
+      ...([404, 405].includes(modelResponse?.status) ? { catalogUnavailable: true } : {}),
+    }
   } catch {
     return unknown()
   } finally {

package/lib/types/host/accounts.d.ts

@@ -1,6 +1,6 @@
 import { type ProcessBackend, type RuntimeConfig } from './process.ts';
 import { type CliId } from '../shared/types.ts';
-import type { AccountAction, AccountFrame, AccountSource, AccountStatus } from '../shared/accounts.ts';
+import type { AccountAction, AccountFrame, AccountSource, AccountStatus, ZCodeLoginProvider } from '../shared/accounts.ts';
 import { type AccountIdentitySource } from './account-identity.ts';
 /** User-only auth processes. Only allowlisted identity metadata leaves the Host. */
 export declare class AccountManager {
@@ -10,6 +10,7 @@ export declare class AccountManager {
     private readonly sessions;
     private readonly reserved;
     private readonly unsafeQueries;
+    private readonly unsafeTerminals;
     private readonly statusQueries;
     private readonly pending;
     private readonly parents;
@@ -21,7 +22,7 @@ export declare class AccountManager {
     status(cli: CliId, cwd: string, signal: AbortSignal): Promise<AccountStatus>;
     private readStatus;
     private hasCustomExecutable;
-    start(parent: string, cli: CliId, action: AccountAction, cwd: string, signal: AbortSignal, source?: AccountSource): Promise<{
+    start(parent: string, cli: CliId, action: AccountAction, cwd: string, signal: AbortSignal, source?: AccountSource, provider?: ZCodeLoginProvider): Promise<{
         id: string;
         instruction: string;
     }>;