dsh-codearts 0.0.0-stage → 0.3.0

package/lib/usage-Cn1Bzmxj.mjs

@@ -0,0 +1,2223 @@
+import { createHash, createHmac, createPrivateKey, createSign, generateKeyPairSync, randomBytes } from "node:crypto";
+import { chmod, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import http from "node:http";
+import { existsSync } from "node:fs";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region src/dpop.ts
+/**
+* DPoP（RFC 9449）证明 JWT：ES256 + P-256，供 oauth2/tokens 请求头使用。
+* 翻译自 codearts2api 的 internal/upstream/dpop.go。
+*
+* 关键约束：refresh_token 与首次换取时的 DPoP 公钥绑定，刷新时必须复用同一
+* 私钥，否则 STS 报 InvalidDPoPHeader。因此该私钥必须随 refresh_token 一起落盘。
+*
+* @module dsh-codearts/dpop
+*/
+const P256_ORDER = BigInt("0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551");
+const P256_HALF = P256_ORDER >> 1n;
+/** 生成新的 DPoP 私钥（JWK）。 */
+function newDPoPPrivateJWK() {
+	const { privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+	const jwk = privateKey.export({ format: "jwk" });
+	return {
+		kty: jwk.kty,
+		crv: jwk.crv,
+		x: jwk.x,
+		y: jwk.y,
+		d: jwk.d
+	};
+}
+function privateKeyFromJWK(jwk) {
+	return createPrivateKey({
+		key: jwk,
+		format: "jwk"
+	});
+}
+function b64u(buf) {
+	return Buffer.from(buf).toString("base64url");
+}
+/**
+* 生成 DPoP proof JWT（htm=POST，htu=token 端点）。
+* 低 S 归一化以兼容服务端校验。
+*/
+function signDpopProof(jwk, htu) {
+	const key = privateKeyFromJWK(jwk);
+	const header = {
+		alg: "ES256",
+		typ: "dpop+jwt",
+		jwk: {
+			kty: "EC",
+			crv: "P-256",
+			x: jwk.x,
+			y: jwk.y
+		}
+	};
+	const headerJSON = Buffer.from(JSON.stringify(header));
+	const payload = {
+		htm: "POST",
+		htu,
+		iat: Math.floor(Date.now() / 1e3),
+		jti: randomBytes(16).toString("hex")
+	};
+	const payloadJSON = Buffer.from(JSON.stringify(payload));
+	const input = `${b64u(headerJSON)}.${b64u(payloadJSON)}`;
+	const sig = createSign("SHA256").update(input).sign({
+		key,
+		dsaEncoding: "ieee-p1363"
+	});
+	let s = sig.subarray(32, 64);
+	let sBig = BigInt(`0x${s.toString("hex")}`);
+	if (sBig > P256_HALF) {
+		sBig = P256_ORDER - sBig;
+		s = Buffer.from(sBig.toString(16).padStart(64, "0"), "hex");
+	}
+	return `${input}.${b64u(Buffer.concat([sig.subarray(0, 32), s]))}`;
+}
+//#endregion
+//#region src/oauth.ts
+/**
+* CodeArts OAuth2（PKCE）登录 + 刷新，翻译自 codearts2api 的
+* internal/server/oauth.go / cmd/login/main.go / internal/upstream/client.go。
+*
+* 登录：本地起 127.0.0.1 回调服务 → 浏览器跳 codearts.huaweicloud.com/authorize
+* → 用户登录 → 华为回调带 code → 用 code + PKCE verifier + DPoP 私钥换
+* security_token + 临时 AK/SK + refresh_token。
+*
+* 刷新：refresh_token 与 client_id、DPoP 私钥三者绑定，刷新时原样复用。
+*
+* @module dsh-codearts/oauth
+*/
+const CLIENT_ID = "codearts-agent";
+const PLUGIN_NAME = "snap_AIIDE";
+const PLUGIN_VERSION = "5.2.0";
+const SNAP_HOST$1 = "https://snap-access.cn-north-4.myhuaweicloud.com";
+const STS_HOST = "https://sts.cn-north-4.myhuaweicloud.com";
+const PORTAL = "https://codearts.huaweicloud.com/portal";
+const REDIRECT_PATH = "/oauth/callback";
+function defaultLoginConfig() {
+	return {
+		clientId: CLIENT_ID,
+		snapHost: SNAP_HOST$1,
+		stsHost: STS_HOST,
+		portal: PORTAL
+	};
+}
+function randomHex(n) {
+	return randomBytes(n).toString("hex");
+}
+function pkce() {
+	const verifier = base64url(randomBytes(64));
+	return {
+		verifier,
+		challenge: createHash("sha256").update(verifier).digest("base64url"),
+		method: "S256"
+	};
+}
+function base64url(buf) {
+	return buf.toString("base64url");
+}
+/** 构造华为授权页 URL（浏览器打开，用户登录后回调本机）。 */
+function buildAuthorizeURL(cfg, ticketId, challenge, method, port) {
+	const q = new URLSearchParams();
+	q.set("theme", "2");
+	q.set("locale", "zh-cn");
+	q.set("uri_scheme", cfg.clientId);
+	q.set("client_id", cfg.clientId);
+	q.set("port", String(port));
+	q.set("code_challenge", challenge);
+	q.set("code_challenge_method", "SHA-256");
+	q.set("ticket_id", ticketId);
+	q.set("plugin-name", PLUGIN_NAME);
+	q.set("plugin-version", PLUGIN_VERSION);
+	return `${cfg.portal}/authorize?${q.toString()}`;
+}
+/** 换 token 请求体：application/x-www-form-urlencoded（与华为 STS 一致）。 */
+function buildTokenBody(cfg, params) {
+	return new URLSearchParams({
+		client_id: cfg.clientId,
+		...params
+	}).toString();
+}
+/** 用授权 code 换 token。 */
+async function exchangeCode(cfg, code, verifier, port, dpopJWK, abort) {
+	const htu = `${cfg.stsHost}/v1/oauth2/tokens`;
+	const dpop = signDpopProof(dpopJWK, htu);
+	const body = buildTokenBody(cfg, {
+		code,
+		code_verifier: verifier,
+		grant_type: "authorization_code",
+		redirect_uri: `http://127.0.0.1:${port}${REDIRECT_PATH}`
+	});
+	const res = await fetch(`${htu}`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/x-www-form-urlencoded",
+			"DPoP": dpop,
+			"plugin-name": PLUGIN_NAME,
+			"plugin-version": PLUGIN_VERSION
+		},
+		body,
+		signal: abort
+	});
+	if (!res.ok) {
+		const text = await res.text();
+		throw new Error(`exchange code failed: ${res.status} ${text}`);
+	}
+	return parseToken(await res.json(), dpopJWK, cfg.clientId);
+}
+/** 用 refresh_token 续期。 */
+async function refreshToken(cfg, prev, abort) {
+	const htu = `${cfg.stsHost}/v1/oauth2/tokens`;
+	const dpop = signDpopProof(prev.dpopPrivateKey, htu);
+	const body = buildTokenBody(cfg, {
+		grant_type: "refresh_token",
+		refresh_token: prev.refreshToken
+	});
+	const res = await fetch(`${htu}`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/x-www-form-urlencoded",
+			"DPoP": dpop,
+			"plugin-name": PLUGIN_NAME,
+			"plugin-version": PLUGIN_VERSION
+		},
+		body,
+		signal: abort
+	});
+	if (!res.ok) {
+		const text = await res.text();
+		throw new Error(`refresh token failed: ${res.status} ${text}`);
+	}
+	return parseToken(await res.json(), prev.dpopPrivateKey, prev.clientId, prev);
+}
+function parseToken(json, dpopJWK, clientId, prev) {
+	const cred = json.credentials ?? {};
+	return {
+		userId: json.user_id ?? prev?.userId ?? "",
+		userName: json.user_name ?? prev?.userName ?? "",
+		domainId: json.domain_id ?? prev?.domainId ?? "",
+		securityToken: cred.security_token ?? cred.SecurityToken ?? "",
+		accessKeyId: cred.access_key_id ?? cred.AccessKeyID ?? "",
+		secretAccessKey: cred.secret_access_key ?? cred.SecretAccessKey ?? "",
+		expiration: cred.expiration ?? cred.Expiration ?? "",
+		refreshToken: json.refresh_token ?? json.RefreshToken ?? prev?.refreshToken ?? "",
+		clientId,
+		dpopPrivateKey: dpopJWK
+	};
+}
+async function startLogin(cfg = defaultLoginConfig()) {
+	const ticketId = randomHex(16);
+	const { verifier, challenge, method } = pkce();
+	const dpopJWK = newDPoPPrivateJWK();
+	const codeCh = await new Promise((resolve) => {
+		const server = http.createServer();
+		const waiters = [];
+		server.on("request", (req, res) => {
+			const u = new URL(req.url ?? "/", "http://127.0.0.1");
+			if (u.pathname !== REDIRECT_PATH) {
+				res.writeHead(404).end();
+				return;
+			}
+			const code = u.searchParams.get("code");
+			const redirect = u.searchParams.get("redirect");
+			if (!code && redirect) {
+				res.writeHead(307, { Location: redirect }).end();
+				return;
+			}
+			if (!code) {
+				let body = "";
+				req.on("data", (c) => body += c);
+				req.on("end", () => {
+					finish(new URLSearchParams(body).get("code"));
+				});
+				return;
+			}
+			finish(code);
+			function finish(c) {
+				res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+				res.end("<h3>CodeArts 登录成功，可关闭此页面。</h3>");
+				if (c) for (const w of waiters.splice(0)) w(c);
+			}
+		});
+		server.listen(0, "127.0.0.1", () => {
+			const port = server.address().port;
+			resolve({
+				port,
+				server,
+				take: () => new Promise((r) => waiters.push(r))
+			});
+		});
+	});
+	const url = buildAuthorizeURL(cfg, ticketId, challenge, method, codeCh.port);
+	const promise = (async () => {
+		const timer = setTimeout(() => codeCh.server.close(), 3e5);
+		try {
+			return await exchangeCode(cfg, await codeCh.take(), verifier, codeCh.port, dpopJWK);
+		} finally {
+			clearTimeout(timer);
+			codeCh.server.close();
+		}
+	})();
+	return {
+		url,
+		port: codeCh.port,
+		promise,
+		close: () => codeCh.server.close()
+	};
+}
+//#endregion
+//#region src/auth.ts
+/**
+* CodeArts credential store.
+*
+* 真实 CodeArts 桌面端聊天需要：STS `security_token` + 临时 AK/SK（HMAC 签名）
+* + refresh_token（绑定 DPoP 私钥用于续期）。本模块持久化这全套 OAuth 凭证，
+* 并提供自动续期。同时也保留"手动粘贴 security_token"的兜底（但无 AK/SK 时只能
+* 作为降级态，聊天会被 APIG 拒）。
+*
+* @module dsh-codearts/auth
+*/
+/** 福利领取的上限；失败无所谓，卡住登录才是问题。 */
+const CLAIM_TIMEOUT_MS = 15e3;
+/** 两条凭证里较新的一条（`storedAt` 缺失视为最旧）。 */
+function newerCredential(a, b) {
+	const at = typeof a.storedAt === "number" ? a.storedAt : 0;
+	return (typeof b.storedAt === "number" ? b.storedAt : 0) > at ? b : a;
+}
+/** 从 OAuthToken 落库。 */
+function credentialFromOAuth(t, label) {
+	return {
+		token: t.securityToken,
+		accessKeyId: t.accessKeyId,
+		secretAccessKey: t.secretAccessKey,
+		refreshToken: t.refreshToken,
+		dpopPrivateKey: t.dpopPrivateKey,
+		clientId: t.clientId,
+		expiration: t.expiration,
+		userId: t.userId,
+		userName: t.userName,
+		domainId: t.domainId,
+		label: label ?? t.userName ?? t.userId,
+		storedAt: Date.now()
+	};
+}
+function codeartsAuthPath(home) {
+	const base = home ?? process.env.DSH_HOME ?? join(homedir(), ".dsh");
+	return join(base, ".codearts-auth.json");
+}
+async function loadCredential(path) {
+	try {
+		const raw = await readFile(path, "utf8");
+		const parsed = JSON.parse(raw);
+		if (typeof parsed.token !== "string" || parsed.token.length === 0) return void 0;
+		return {
+			...parsed,
+			token: parsed.token
+		};
+	} catch {
+		return;
+	}
+}
+/** 原子写一个 JSON 文件（0600）。 */
+async function writeJsonAtomic(path, value) {
+	await mkdir(dirname(path), { recursive: true });
+	const body = JSON.stringify(value, null, 2);
+	const tmp = `${path}.${process.pid}-${Math.random().toString(36).slice(2, 10)}.tmp`;
+	try {
+		await writeFile(tmp, body, { mode: 384 });
+		await chmod(tmp, 384).catch(() => {});
+		await rename(tmp, path);
+	} catch {
+		await unlink(tmp).catch(() => {});
+		await writeFile(path, body, { mode: 384 });
+	}
+}
+async function saveCredential(path, cred) {
+	await writeJsonAtomic(path, cred);
+}
+async function clearCredential(path) {
+	try {
+		await unlink(path);
+	} catch {}
+}
+/**
+* 领取限时福利（幂等）；无 AK/SK 时静默跳过。
+*
+* 必须带超时：领取失败不该拖住登录/续期。早先没传 signal，claimBenefit 的
+* fetch 就没有任何超时 —— 福利接口一旦不响应，ensureFresh() 永远不返回，
+* 跟着卡死的是整个聊天请求。
+*/
+async function claimIfPossible(cred) {
+	if (!cred.accessKeyId || !cred.secretAccessKey) return;
+	try {
+		const { claimBenefit } = await Promise.resolve().then(() => upstream_exports);
+		await claimBenefit({
+			token: cred.token,
+			accessKeyId: cred.accessKeyId,
+			secretAccessKey: cred.secretAccessKey,
+			securityToken: cred.token
+		}, AbortSignal.timeout(CLAIM_TIMEOUT_MS));
+	} catch {}
+}
+/** 续期判定：距过期不足 5 分钟就去刷。 */
+const REFRESH_SKEW_MS = 3e5;
+var CodeArtsCredentialStore = class {
+	_current;
+	_path;
+	/** 正在进行的刷新。并发请求必须共用它，不能各刷一次。 */
+	_inflight;
+	/**
+	* 凭证代际。重登/清除会推进它，让还在飞的刷新发现自己过期，
+	* 从而不把刷新结果写回去覆盖掉刚拿到的新凭证。
+	*/
+	_gen = 0;
+	/** 作废在飞的刷新；任何直接写凭证的路径都要先调它。 */
+	invalidateInflight() {
+		this._gen += 1;
+		this._inflight = void 0;
+	}
+	constructor(path) {
+		this._path = path;
+	}
+	setPath(path) {
+		this.invalidateInflight();
+		this._current = void 0;
+		this._path = path;
+	}
+	/** 给 shim 用：返回签名所需全套。 */
+	async resolve() {
+		const cred = await this.ensureFresh();
+		if (cred === void 0) return void 0;
+		return {
+			token: cred.token,
+			accessKeyId: cred.accessKeyId,
+			secretAccessKey: cred.secretAccessKey,
+			securityToken: cred.token
+		};
+	}
+	async current() {
+		return this._current ??= await loadCredential(this._path);
+	}
+	/** 从 OAuth 登录结果落库。 */
+	async setFromOAuth(t, label) {
+		this.invalidateInflight();
+		const cred = credentialFromOAuth(t, label);
+		await saveCredential(this._path, cred);
+		this._current = cred;
+		await this.claimIfPossible(cred);
+	}
+	/** 领取限时福利（幂等）；无 AK/SK 时静默跳过。 */
+	async claimIfPossible(cred) {
+		await claimIfPossible(cred);
+	}
+	/** 手动粘贴 security_token（降级态，无 AK/SK）。 */
+	async set(token, label) {
+		this.invalidateInflight();
+		const cred = {
+			token: token.trim(),
+			label,
+			storedAt: Date.now()
+		};
+		await saveCredential(this._path, cred);
+		this._current = cred;
+	}
+	async clear() {
+		this.invalidateInflight();
+		this._current = void 0;
+		await clearCredential(this._path);
+	}
+	async hasCredential() {
+		return await this.current() !== void 0;
+	}
+	/**
+	* 自动续期：若距过期不足 5 分钟且具备 refresh 条件，则刷新并落库。
+	* 返回当前（可能已刷新）凭证。
+	*/
+	async ensureFresh() {
+		const gen = this._gen;
+		const cred = this._current ?? await loadCredential(this._path);
+		if (this._gen !== gen) return this._current;
+		this._current = cred;
+		if (!cred) return void 0;
+		if (!cred.refreshToken || !cred.dpopPrivateKey || !cred.clientId) return cred;
+		const exp = cred.expiration ? Date.parse(cred.expiration) : NaN;
+		if (!(Number.isNaN(exp) ? false : exp - Date.now() < 3e5)) return cred;
+		return this._inflight ??= this.refresh(cred, {
+			refreshToken: cred.refreshToken,
+			dpopPrivateKey: cred.dpopPrivateKey,
+			clientId: cred.clientId
+		}).finally(() => {
+			this._inflight = void 0;
+		});
+	}
+	/** 真正去刷一次；失败则把凭证标成 stale 落库，让卡片提示重新登录。 */
+	async refresh(cred, mat) {
+		const gen = this._gen;
+		/**
+		* 这次刷新的结果还能不能往回写。光看代际号不够：重登是异步落库的，可能在
+		* 本次刷新启动**之后**才把 _current 换掉，那时代际号已经来不及拦。所以还要
+		* 确认「当前凭证仍然是这次刷新的那一份」。
+		*/
+		const stillCurrent = () => this._gen === gen && this._current === cred;
+		try {
+			const next = credentialFromOAuth(await refreshToken(defaultLoginConfig(), {
+				userId: cred.userId ?? "",
+				userName: cred.userName ?? "",
+				domainId: "",
+				securityToken: cred.token,
+				accessKeyId: cred.accessKeyId ?? "",
+				secretAccessKey: cred.secretAccessKey ?? "",
+				expiration: cred.expiration ?? "",
+				refreshToken: mat.refreshToken,
+				clientId: mat.clientId,
+				dpopPrivateKey: mat.dpopPrivateKey
+			}), cred.label);
+			if (!stillCurrent()) return next;
+			await saveCredential(this._path, next);
+			this._current = next;
+			await this.claimIfPossible(next);
+			return next;
+		} catch {
+			cred.stale = true;
+			if (!stillCurrent()) return cred;
+			this._current = cred;
+			try {
+				await saveCredential(this._path, cred);
+			} catch {}
+			return cred;
+		}
+	}
+};
+/**
+* 手工粘贴 token 的降级账号固定用这个 id：再粘一次是**覆盖**，而不是又加一个。
+*/
+const MANUAL_ACCOUNT_ID = "manual";
+function codeartsAccountsPath(home) {
+	const base = home ?? process.env.DSH_HOME ?? join(homedir(), ".dsh");
+	return join(base, ".codearts-accounts.json");
+}
+/**
+* 账号的自然键，按稳定性依次退让：
+*
+* 1. `userId` —— 最理想，同一个人永远同一个键。
+* 2. `userName`。
+* 3. **DPoP 公钥**。实测上游的 token 响应里 `user_id` / `user_name` **都是空串**
+*    （2026-09-30 用真实账号核对），所以前两级拿不到。DPoP 密钥由每次登录生成、
+*    续期时原样复用，因此「同一次登录」内稳定、不同账号必然不同 —— 比拿 token
+*    做键好，因为 token 每次续期都会轮换。
+* 4. 最后才退回 token 哈希（手工粘贴的降级凭证没有 DPoP 密钥）。
+*
+* 已知代价：上游不给稳定身份，所以**对同一个账号重新登录**会被当成新账号，
+* 旧条目会自己失效（凭据被拒 → 停用）并可在卡片上删掉。
+*/
+function accountIdOf(cred) {
+	if (typeof cred.userId === "string" && cred.userId !== "") return cred.userId;
+	if (typeof cred.userName === "string" && cred.userName !== "") return cred.userName;
+	const jwk = cred.dpopPrivateKey;
+	if (jwk !== void 0 && typeof jwk.x === "string" && typeof jwk.y === "string") return `k${createHash("sha256").update(`${jwk.x}.${jwk.y}`).digest("hex").slice(0, 15)}`;
+	return `t${createHash("sha256").update(cred.token).digest("hex").slice(0, 15)}`;
+}
+function summarizeAccount(id, cred) {
+	return {
+		id,
+		...cred.label === void 0 ? {} : { label: cred.label },
+		...cred.userName === void 0 ? {} : { userName: cred.userName },
+		...cred.expiration === void 0 ? {} : { expiration: cred.expiration },
+		...cred.storedAt === void 0 ? {} : { storedAt: cred.storedAt },
+		stale: cred.stale === true,
+		signable: typeof cred.accessKeyId === "string" && cred.accessKeyId !== "" && typeof cred.secretAccessKey === "string" && cred.secretAccessKey !== ""
+	};
+}
+/**
+* 单个账号的内存状态与续期。
+*
+* 每个账号一份、互不干扰。`refresh_token` 是一次性的，上游在刷新时会轮换它：
+* 同一账号内并发刷新会烧掉它、并让失败的那次把 `stale` 盖在成功那次刚拿到的
+* 凭证上，登录态就此写死（本机真实踩过一次）。所以这里保留单凭证时代验证过的
+* 「单飞 + 代际」两条保护，只是作用域缩到单个账号。
+*/
+var AccountSlot = class {
+	_cred;
+	_inflight;
+	_gen = 0;
+	persist;
+	constructor(cred, persist) {
+		this._cred = cred;
+		this.persist = persist;
+	}
+	get credential() {
+		return this._cred;
+	}
+	/** 账号被替换或删除：作废在飞的刷新，别让它回头写回旧值。 */
+	invalidate() {
+		this._gen += 1;
+		this._inflight = void 0;
+	}
+	async ensureFresh() {
+		const cred = this._cred;
+		if (cred.stale === true) return cred;
+		if (!cred.refreshToken || !cred.dpopPrivateKey || !cred.clientId) return cred;
+		const exp = cred.expiration ? Date.parse(cred.expiration) : NaN;
+		if (!(Number.isNaN(exp) ? false : exp - Date.now() < REFRESH_SKEW_MS)) return cred;
+		return this._inflight ??= this.refresh(cred, {
+			refreshToken: cred.refreshToken,
+			dpopPrivateKey: cred.dpopPrivateKey,
+			clientId: cred.clientId
+		}).finally(() => {
+			this._inflight = void 0;
+		});
+	}
+	async refresh(cred, mat) {
+		const gen = this._gen;
+		const stillCurrent = () => this._gen === gen && this._cred === cred;
+		try {
+			const next = credentialFromOAuth(await refreshToken(defaultLoginConfig(), {
+				userId: cred.userId ?? "",
+				userName: cred.userName ?? "",
+				domainId: "",
+				securityToken: cred.token,
+				accessKeyId: cred.accessKeyId ?? "",
+				secretAccessKey: cred.secretAccessKey ?? "",
+				expiration: cred.expiration ?? "",
+				refreshToken: mat.refreshToken,
+				clientId: mat.clientId,
+				dpopPrivateKey: mat.dpopPrivateKey
+			}), cred.label);
+			if (!stillCurrent()) return next;
+			await this.persist(next);
+			this._cred = next;
+			await claimIfPossible(next);
+			return next;
+		} catch {
+			cred.stale = true;
+			if (!stillCurrent()) return cred;
+			this._cred = cred;
+			try {
+				await this.persist(cred);
+			} catch {}
+			return cred;
+		}
+	}
+};
+async function readAccountDocument(path) {
+	try {
+		const parsed = JSON.parse(await readFile(path, "utf8"));
+		if (typeof parsed !== "object" || parsed === null) return void 0;
+		const accounts = parsed.accounts ?? {};
+		const order = Array.isArray(parsed.order) ? parsed.order.filter((id) => typeof id === "string") : [];
+		for (const id of Object.keys(accounts)) if (!order.includes(id)) order.push(id);
+		return {
+			version: 1,
+			order,
+			accounts
+		};
+	} catch {
+		return;
+	}
+}
+/** 多账号凭证存储：一个账号一份槽位，共用一个文档文件。 */
+var CodeArtsAccountStore = class {
+	_doc;
+	_slots = /* @__PURE__ */ new Map();
+	_loading;
+	/** 落库串行化：多个账号的续期可能同时想写同一个文档。 */
+	_writeChain = Promise.resolve();
+	path;
+	/** 旧版单凭证文件；新文档不存在时把它收编成第一个账号。 */
+	legacyPath;
+	constructor(path, legacyPath) {
+		this.path = path;
+		this.legacyPath = legacyPath ?? join(dirname(path), ".codearts-auth.json");
+	}
+	async loaded() {
+		this._loading ??= this.load();
+		return this._loading;
+	}
+	async load() {
+		const doc = await readAccountDocument(this.path);
+		if (doc !== void 0) {
+			this.adopt(doc);
+			return;
+		}
+		const legacy = await loadCredential(this.legacyPath);
+		const fresh = {
+			version: 1,
+			order: [],
+			accounts: {}
+		};
+		if (legacy !== void 0) {
+			const id = accountIdOf(legacy);
+			fresh.order.push(id);
+			fresh.accounts[id] = legacy;
+		}
+		this.adopt(fresh);
+		if (legacy !== void 0) await this.persistDoc();
+	}
+	adopt(doc) {
+		this._doc = doc;
+		this._slots.clear();
+		for (const [id, cred] of Object.entries(doc.accounts)) this._slots.set(id, new AccountSlot(cred, this.persisterFor(id)));
+	}
+	persisterFor(id) {
+		return async (cred) => {
+			if (this._doc === void 0) return;
+			this._doc.accounts[id] = cred;
+			await this.persistDoc();
+		};
+	}
+	persistDoc() {
+		const snapshot = this._doc;
+		const write = async () => {
+			if (snapshot !== void 0) await writeJsonAtomic(this.path, snapshot);
+		};
+		this._writeChain = this._writeChain.then(write, write);
+		return this._writeChain;
+	}
+	/** 按展示顺序返回账号摘要。 */
+	async list() {
+		await this.loaded();
+		const doc = this._doc;
+		return doc.order.filter((id) => doc.accounts[id] !== void 0).map((id) => summarizeAccount(id, doc.accounts[id]));
+	}
+	async ids() {
+		await this.loaded();
+		const doc = this._doc;
+		return doc.order.filter((id) => doc.accounts[id] !== void 0);
+	}
+	async credential(id) {
+		await this.loaded();
+		return this._doc.accounts[id];
+	}
+	/** 首个账号——卡片顶部与 CLI 的「当前」。 */
+	async current() {
+		const ids = await this.ids();
+		return ids.length === 0 ? void 0 : this._doc.accounts[ids[0]];
+	}
+	async hasCredential() {
+		return (await this.ids()).length > 0;
+	}
+	/** 新增或更新一个账号，返回它的 id。 */
+	async upsert(cred, id = accountIdOf(cred)) {
+		await this.loaded();
+		const doc = this._doc;
+		this._slots.get(id)?.invalidate();
+		doc.accounts[id] = cred;
+		if (!doc.order.includes(id)) doc.order.push(id);
+		this._slots.set(id, new AccountSlot(cred, this.persisterFor(id)));
+		await this.persistDoc();
+		await claimIfPossible(cred);
+		return id;
+	}
+	/**
+	* 从一次 OAuth 登录结果新增/更新账号。
+	*
+	* 「再登录一次」天然就是「添加账号」：同一账号是更新，别的账号就是新增。
+	*
+	* 传了 `identity`（来自 `fetchCallerIdentity` 的稳定 user_id）就用它当账号键 ——
+	* 这正是「对同一个账号重新登录会被当成新账号」的解药；拿不到身份时退回旧行为
+	* （DPoP 公钥当键），也就是每次登录各自成一条。
+	*/
+	async upsertFromOAuth(t, label, identity) {
+		const cred = credentialFromOAuth(t, label);
+		if (identity !== void 0) {
+			cred.userId = identity.userId;
+			if (identity.userName !== "") cred.userName = identity.userName;
+			if (identity.domainId !== "") cred.domainId = identity.domainId;
+		}
+		return this.upsert(cred);
+	}
+	/**
+	* 把一条已有账号迁移到它的稳定身份键上（同键则合并）。
+	*
+	* 用在两处：登录后回填身份（老条目已经存在时合并掉），以及 `dsh-codearts identity --fix`
+	* 清理历史遗留的重复条目。合并时保留 `storedAt` 较新的一份凭证，位置沿用目标键原有的顺序。
+	*
+	* @returns 迁移结果：`merged` 表示并入了已存在的那条，`moved` 表示只换了键，`noop` 表示键没变
+	*/
+	async adoptIdentity(id, identity) {
+		await this.loaded();
+		const doc = this._doc;
+		const existing = doc.accounts[id];
+		if (existing === void 0) return "noop";
+		const targetKey = identity.userId;
+		if (targetKey === "" || targetKey === id) {
+			doc.accounts[id] = {
+				...existing,
+				userId: identity.userId === "" ? existing.userId : identity.userId,
+				...identity.userName === "" ? {} : { userName: identity.userName },
+				...identity.domainId === "" ? {} : { domainId: identity.domainId }
+			};
+			this._slots.get(id)?.invalidate();
+			this._slots.set(id, new AccountSlot(doc.accounts[id], this.persisterFor(id)));
+			await this.persistDoc();
+			return "noop";
+		}
+		const target = doc.accounts[targetKey];
+		const keep = target === void 0 ? existing : newerCredential(target, existing);
+		doc.accounts[targetKey] = {
+			...keep,
+			userId: identity.userId,
+			...identity.userName === "" ? {} : { userName: identity.userName },
+			...identity.domainId === "" ? {} : { domainId: identity.domainId }
+		};
+		delete doc.accounts[id];
+		doc.order = doc.order.filter((existingId) => existingId !== id);
+		if (!doc.order.includes(targetKey)) doc.order.push(targetKey);
+		this._slots.get(id)?.invalidate();
+		this._slots.delete(id);
+		this._slots.get(targetKey)?.invalidate();
+		this._slots.set(targetKey, new AccountSlot(doc.accounts[targetKey], this.persisterFor(targetKey)));
+		await this.persistDoc();
+		return target === void 0 ? "moved" : "merged";
+	}
+	/** 手工粘贴 security_token（降级态，无 AK/SK）——固定覆盖同一个「手工」账号。 */
+	async set(token, label) {
+		await this.upsert({
+			token: token.trim(),
+			label,
+			storedAt: Date.now()
+		}, MANUAL_ACCOUNT_ID);
+	}
+	async remove(id) {
+		await this.loaded();
+		const doc = this._doc;
+		this._slots.get(id)?.invalidate();
+		this._slots.delete(id);
+		delete doc.accounts[id];
+		doc.order = doc.order.filter((existing) => existing !== id);
+		await this.persistDoc();
+	}
+	/** 清空全部账号（整体登出）。 */
+	async clear() {
+		await this.loaded();
+		for (const slot of this._slots.values()) slot.invalidate();
+		this._slots.clear();
+		this._doc = {
+			version: 1,
+			order: [],
+			accounts: {}
+		};
+		await this.persistDoc();
+		await clearCredential(this.legacyPath);
+	}
+	/** 给 shim 用：解析某账号的签名材料（内部含续期）。 */
+	async resolve(id) {
+		await this.loaded();
+		const slot = this._slots.get(id);
+		if (slot === void 0) return void 0;
+		const cred = await slot.ensureFresh();
+		return {
+			token: cred.token,
+			accessKeyId: cred.accessKeyId,
+			secretAccessKey: cred.secretAccessKey,
+			securityToken: cred.token
+		};
+	}
+};
+//#endregion
+//#region src/catalog.ts
+/**
+* Static seed roster. Ids are the *upstream registered* spellings (case
+* matters — `canonicalModel` in upstream.ts passes these through verbatim).
+* Updated 2026-09 from codearts2api's known model set.
+*
+* maxTokens 注记（2026-09-30 实测，scripts/param-probe.mjs 直连上游二分验证）：
+* 免费福利 DeepSeek 模型的 max_tokens 服务端硬上限是 **65536**，更大的值
+* （73728 / 98304 / 131072 / 384000 / 393216）一律流内报
+* InferHub.001001005.400 "The request param is invalid, Please check it"。
+* 此前的 384000/393216 是占位值：DSH 会把 catalog 的 maxTokens 作为
+* max_tokens 原样发给上游，导致所有请求直接失败。
+*/
+const FALLBACK_CODEARTS_MODELS = [
+	{
+		id: "GLM-5.2",
+		name: "GLM-5.2",
+		contextWindow: 128e3,
+		maxTokens: 8e3,
+		supportsImages: true
+	},
+	{
+		id: "GLM-5.1",
+		name: "GLM-5.1",
+		contextWindow: 128e3,
+		maxTokens: 8e3,
+		supportsImages: false
+	},
+	{
+		id: "GLM-4.7",
+		name: "GLM-4.7",
+		contextWindow: 128e3,
+		maxTokens: 8e3,
+		supportsImages: true
+	},
+	{
+		id: "OpenPangu-2.0-Pro",
+		name: "OpenPangu 2.0 Pro",
+		contextWindow: 32e3,
+		maxTokens: 4e3,
+		supportsImages: true
+	},
+	{
+		id: "OpenPangu-2.0-Flash",
+		name: "OpenPangu 2.0 Flash",
+		contextWindow: 32e3,
+		maxTokens: 4e3,
+		supportsImages: true
+	},
+	{
+		id: "Qwen3-VL-235B",
+		name: "Qwen3-VL-235B",
+		contextWindow: 128e3,
+		maxTokens: 8e3,
+		supportsImages: true
+	},
+	{
+		id: "Qwen3.5-397B-A17B-VL",
+		name: "Qwen3.5-397B-A17B-VL",
+		contextWindow: 128e3,
+		maxTokens: 8e3,
+		supportsImages: true
+	},
+	{
+		id: "Qwen3.6-27B-VL",
+		name: "Qwen3.6-27B-VL",
+		contextWindow: 128e3,
+		maxTokens: 8e3,
+		supportsImages: true
+	},
+	{
+		id: "deepseek-v4-flash-0731",
+		name: "DeepSeek-V4-Flash (免费)",
+		contextWindow: 131072,
+		maxTokens: 65536,
+		supportsImages: true
+	},
+	{
+		id: "deepseek-v4-pro-0813",
+		name: "DeepSeek-V4-Pro (免费)",
+		contextWindow: 131072,
+		maxTokens: 65536,
+		supportsImages: true
+	},
+	{
+		id: "deepseek-v4.1-flash",
+		name: "DeepSeek-V4.1-Flash (免费)",
+		contextWindow: 131072,
+		maxTokens: 65536,
+		supportsImages: true
+	},
+	{
+		id: "glm-5.3-flash",
+		name: "GLM-5.3-Flash (免费)",
+		contextWindow: 128e3,
+		maxTokens: 8e3,
+		supportsImages: true
+	}
+];
+/** Mutable catalog shared by the shim's `/v1/models` and the adapter. */
+var CodeArtsCatalog = class {
+	models = FALLBACK_CODEARTS_MODELS;
+	current() {
+		return this.models;
+	}
+	set(models) {
+		this.models = [...models];
+	}
+};
+/**
+* Narrow a catalog to the user's enabled selection (allowlist of model ids).
+* Same semantics as the codebuddy plugin: absent or empty => serve all.
+*/
+function filterEnabledModels(models, enabled) {
+	if (enabled === void 0 || enabled.length === 0) return models;
+	const allow = new Set(enabled);
+	const kept = models.filter((model) => allow.has(model.id));
+	return kept.length === 0 ? models : kept;
+}
+const benefitLower = new Set([
+	"deepseek-v4-flash-0731",
+	"deepseek-v4-pro-0813",
+	"deepseek-v4.1-flash",
+	"glm-5.3-flash"
+].map((m) => m.toLowerCase()));
+/**
+* 动态发现确认的福利模型（小写 id）。
+*
+* 与 codearts2api 的差别：那边按账号隔离目录，本插件的聊天链路（shim → upstream）
+* 拿不到账号上下文，所以这里取**并集**并保留种子兜底 —— 宁可多带一次
+* `maas_type: benefit` 头，也不要漏带导致 404。套餐轮换后模型「转正」时，
+* 下次发现会把它从这份集合里去掉。
+*/
+const discoveredBenefit = /* @__PURE__ */ new Set();
+/** 用一次发现的结果替换动态福利集合（传空数组表示「本轮确认没有福利模型」）。 */
+function setDiscoveredBenefitModels(ids) {
+	discoveredBenefit.clear();
+	for (const id of ids) {
+		const key = id.trim().toLowerCase();
+		if (key !== "") discoveredBenefit.add(key);
+	}
+}
+/**
+* 该模型是否走限时福利路由（按小写 ID 判定）。
+*
+* 发现结果优先于种子：目录里明确「不是福利」的模型（已转正）不会被种子重新标成福利，
+* 因为发现成功时会把它从 `discoveredBenefit` 里剔除，而种子只在该集合为空时兜底。
+*/
+function isBenefitModel(id) {
+	const key = id.trim().toLowerCase();
+	if (key === "") return false;
+	if (discoveredBenefit.has(key)) return true;
+	if (discoveredBenefit.size > 0) return false;
+	return benefitLower.has(key);
+}
+/**
+* 合并多路来源的模型清单（内置 / 限时福利 / agent-center）。
+*
+* 规则对齐 codearts2api 的 `MergeModels`：
+*  - 按小写 id 去重（上游注册名大小写敏感，但同一模型的书写可能不一致）；
+*  - `benefit` 取或：漏标一次就是一次 404；
+*  - 参数更全的一条优先（有 contextWindow > 没有，supportsImages 为真优先）；
+*  - 输出按小写 id 排序，保证 `/v1/models` 在刷新前后顺序稳定。
+*/
+function mergeModelLists(sets) {
+	const merged = /* @__PURE__ */ new Map();
+	for (const set of sets) for (const model of set) {
+		const id = model.id.trim();
+		if (id === "") continue;
+		const key = id.toLowerCase();
+		const normalized = {
+			...model,
+			id
+		};
+		const current = merged.get(key);
+		merged.set(key, current === void 0 ? normalized : richerModel(current, normalized));
+	}
+	return [...merged.values()].sort((a, b) => {
+		const la = a.id.toLowerCase();
+		const lb = b.id.toLowerCase();
+		return la === lb ? a.id < b.id ? -1 : 1 : la < lb ? -1 : 1;
+	});
+}
+/** 同一模型两条记录取更全的一条；`benefit` 永远取或。 */
+function richerModel(current, next) {
+	const benefit = current.benefit === true || next.benefit === true;
+	const keep = richerThan(next, current) ? next : current;
+	const drop = keep === next ? current : next;
+	return {
+		id: keep.id,
+		name: keep.name || drop.name || keep.id,
+		contextWindow: keep.contextWindow > 0 ? keep.contextWindow : drop.contextWindow,
+		maxTokens: keep.maxTokens > 0 ? keep.maxTokens : drop.maxTokens,
+		supportsImages: keep.supportsImages || drop.supportsImages,
+		...benefit ? { benefit: true } : {}
+	};
+}
+/** a 是否比 b 更值得保留：优先带参数，其次保留大小写更「像注册名」的一条。 */
+function richerThan(a, b) {
+	if (a.contextWindow > 0 !== b.contextWindow > 0) return a.contextWindow > 0;
+	if (a.maxTokens > 0 !== b.maxTokens > 0) return a.maxTokens > 0;
+	return a.id !== a.id.toLowerCase() && b.id === b.id.toLowerCase();
+}
+/**
+* 用种子清单给**发现结果**补缺：种子只补，不覆盖。
+*
+* 为什么不能把种子一起丢进 `mergeModelLists`：那个函数按「参数更全/大小写更像注册名」
+* 选记录，种子里的占位值（例如 OpenPangu 的 ctx 32000 / max 4000）会凭大小写规则
+* 压过上游返回的真实值（ctx 524288 / max 131072）。所以顺序必须是
+* 「先合并发现结果 → 再用种子补 0 值字段与缺失条目」。
+*/
+function fillFromSeed(discovered, seed = FALLBACK_CODEARTS_MODELS) {
+	const byId = /* @__PURE__ */ new Map();
+	for (const model of discovered) byId.set(model.id.toLowerCase(), { ...model });
+	for (const fallback of seed) {
+		const key = fallback.id.toLowerCase();
+		const current = byId.get(key);
+		if (current === void 0) {
+			byId.set(key, { ...fallback });
+			continue;
+		}
+		byId.set(key, {
+			id: current.id,
+			name: current.name || fallback.name,
+			contextWindow: current.contextWindow > 0 ? current.contextWindow : fallback.contextWindow,
+			maxTokens: current.maxTokens > 0 ? current.maxTokens : fallback.maxTokens,
+			supportsImages: current.supportsImages || fallback.supportsImages,
+			...current.benefit === true ? { benefit: true } : {}
+		});
+	}
+	return [...byId.values()].sort((a, b) => {
+		const la = a.id.toLowerCase();
+		const lb = b.id.toLowerCase();
+		return la === lb ? a.id < b.id ? -1 : 1 : la < lb ? -1 : 1;
+	});
+}
+//#endregion
+//#region src/signer.ts
+/**
+* 华为云 SDK-HMAC-SHA256 请求签名（AK/SK + 可选 STS security token）。
+* 翻译自 codearts2api 的 internal/upstream/signer.go，对齐华为云 AKSKSigner。
+*
+* 在 CodeArts 桌面端实测：聊天请求必须用 AK/SK 签名，光传 x-auth-token 会被
+* APIG 拒（APIG.0301 decrypt token fail）。
+*
+* @module dsh-codearts/signer
+*/
+const ALGO = "SDK-HMAC-SHA256";
+function sha256Hex(buf) {
+	return createHash("sha256").update(buf).digest("hex");
+}
+function hmacHex(key, msg) {
+	return createHmac("sha256", key).update(msg).digest("hex");
+}
+/** 华为云 X-Sdk-Date 格式：20060102T150405Z（UTC，无分隔符、无毫秒）。 */
+function sdkDate(d) {
+	const p = (n, w = 2) => String(n).padStart(w, "0");
+	return `${d.getUTCFullYear()}${p(d.getUTCMonth() + 1)}${p(d.getUTCDate())}T${p(d.getUTCHours())}${p(d.getUTCMinutes())}${p(d.getUTCSeconds())}Z`;
+}
+function canonicalURI(path) {
+	let out = path.split("/").map((s) => encodeURIComponent(s)).join("/");
+	if (!out.endsWith("/")) out += "/";
+	return out;
+}
+function canonicalQuery(raw) {
+	if (!raw) return "";
+	const params = new URLSearchParams(raw);
+	const keys = [...new Set(params.keys())].sort();
+	const parts = [];
+	for (const k of keys) {
+		const vals = params.getAll(k).sort();
+		for (const v of vals) parts.push(`${encodeURIComponent(k)}=${encodeURIComponent(v)}`);
+	}
+	return parts.join("&");
+}
+/**
+* 给一个 fetch Request 加上 X-Sdk-Date / X-Security-Token / X-Sdk-Content-Sha256
+* / Authorization 头。body 为请求体（用于 payload hash）。
+*
+* 注意：Host 头 fetch 不允许手动 set，但签名必须包含 host，所以我们在签名计算
+* 里从 URL 取 host 补一个虚拟 host 行，Authorization 写回即可（fetch 实际发出的
+* Host 与 URL.host 一致）。
+*/
+function signRequest(req, body, cred) {
+	const xDate = sdkDate(/* @__PURE__ */ new Date());
+	req.headers.set("X-Sdk-Date", xDate);
+	if (cred.securityToken) req.headers.set("X-Security-Token", cred.securityToken);
+	const payloadHash = sha256Hex(body);
+	req.headers.set("X-Sdk-Content-Sha256", payloadHash);
+	const url = new URL(req.url);
+	const host = url.host;
+	const all = [];
+	req.headers.forEach((v, k) => all.push([k.toLowerCase(), v.trim()]));
+	all.push(["host", host]);
+	all.sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0);
+	let canonicalHeaders = "";
+	const signed = [];
+	for (const [k, v] of all) {
+		canonicalHeaders += `${k}:${v}\n`;
+		signed.push(k);
+	}
+	const signedHeaders = signed.join(";");
+	const canonicalRequest = [
+		req.method,
+		canonicalURI(url.pathname),
+		canonicalQuery(url.search.slice(1)),
+		canonicalHeaders,
+		signedHeaders,
+		payloadHash
+	].join("\n");
+	const stringToSign = [
+		ALGO,
+		xDate,
+		sha256Hex(canonicalRequest)
+	].join("\n");
+	const signature = hmacHex(cred.secretAccessKey, stringToSign);
+	req.headers.set("Authorization", `${ALGO} Access=${cred.accessKeyId}, SignedHeaders=${signedHeaders}, Signature=${signature}`);
+}
+//#endregion
+//#region src/upstream.ts
+/**
+* CodeArts 真实聊天协议（翻译自 codearts2api 逆向，consumer 版 cn-north-4）。
+*
+* 聊天走 OpenAI 兼容端点：
+*   POST /api/v2/chat/completions  （snap-access.cn-north-4.myhuaweicloud.com）
+* 鉴权为 x-auth-token = STS security_token，并叠加华为云 AK/SK SDK-HMAC-SHA256
+* 签名（与官方 AgentKernel 一致）。请求体是标准 OpenAI 形状（role/content），
+* 响应 SSE 也是 OpenAI 增量（choices[].delta.content），但含有华为特有事件
+* （累计全文快照 + 结束态 error_code），本模块做兼容转换。
+*
+* @module dsh-codearts/upstream
+*/
+var upstream_exports = /* @__PURE__ */ __exportAll({
+	CONCURRENCY_CAP_CODE: () => CONCURRENCY_CAP_CODE,
+	MAX_TOKENS_CEILING: () => MAX_TOKENS_CEILING,
+	PARAM_INVALID_CODE: () => PARAM_INVALID_CODE,
+	SNAP_HOST: () => SNAP_HOST,
+	canonicalModel: () => canonicalModel,
+	chatStream: () => chatStream,
+	claimBenefit: () => claimBenefit,
+	degradeTokenCeiling: () => degradeTokenCeiling,
+	estimateTokens: () => estimateTokens,
+	fetchCallerIdentity: () => fetchCallerIdentity,
+	fetchModels: () => fetchModels,
+	isConcurrencyCap: () => isConcurrencyCap,
+	isParamInvalidFrame: () => isParamInvalidFrame,
+	maxTokensCeilingFor: () => maxTokensCeilingFor,
+	prepareChatBody: () => prepareChatBody,
+	signedGet: () => signedGet
+});
+const SNAP_HOST = "https://snap-access.cn-north-4.myhuaweicloud.com";
+const EP_CHAT = "/api/v2/chat/completions";
+const BENEFIT_HOST = "https://opengw.developer.huaweicloud.com";
+const EP_BENEFIT_CLAIM = "/api/v1/benefit/claim";
+const EP_MODEL_BUILTIN = "/v1/model/builtin";
+const EP_BENEFIT_CONFIG = "/api/v1/gateway/config";
+const EP_AGENT_LIST = "/v1/agent-center/agents/useragents";
+const EP_AGENT_DETAIL = "/v1/agent-center/agents/detail";
+/**
+* 当前登录身份。**必须带 `/snap-manager` 前缀**：2026-09-30 实测
+* `/v1/current/user` 是 APIG.0101（未发布），`/snap-manager/v1/current/user`
+* 才返回 `{user_id, user_name, domain_id}`。codearts2api 的 const.go 里少了这段前缀
+* （它另有 STS 的 `/v5/caller-identity`，但那条对 STS 临时凭证返回 401）。
+*/
+const EP_CURRENT_USER = "/snap-manager/v1/current/user";
+const STATIC_MODEL_MAP = {
+	"snap-chat": "GLM-5.2",
+	"glm-5.2": "GLM-5.2",
+	"glm-5.1": "GLM-5.1",
+	"glm-4.7": "GLM-4.7",
+	"openpangu-2.0-pro": "OpenPangu-2.0-Pro",
+	"openpangu-2.0-flash": "OpenPangu-2.0-Flash",
+	"qwen3-vl-235b": "Qwen3-VL-235B",
+	"qwen3.5-397b-a17b-vl": "Qwen3.5-397B-A17B-VL",
+	"qwen3.6-27b-vl": "Qwen3.6-27B-VL",
+	"deepseek-v4-flash": "deepseek-v4-flash-0731",
+	"deepseek-v4-pro": "deepseek-v4-pro-0813",
+	"glm-5.3-flash": "glm-5.3-flash"
+};
+function canonicalModel(id) {
+	return STATIC_MODEL_MAP[id.toLowerCase()] ?? id;
+}
+function hex32() {
+	return randomBytes(16).toString("hex");
+}
+function randomTraceId() {
+	return hex32();
+}
+/** 上游对 max_tokens 的服务端硬上限（2026-09-30 直连二分实测）。 */
+const MAX_TOKENS_CEILING = 65536;
+/** token 估算的余量：混排误差 + 上游自己注入的会话头，宁可少给也别整轮失败。 */
+const PROMPT_ESTIMATE_MARGIN = 2048;
+/** 短于此的生成长度就没有实际意义了，此时直接报具体错误而不是硬挤。 */
+const MIN_USEFUL_OUTPUT_TOKENS = 1024;
+/**
+* 实测过的、**按模型**的 max_tokens 上限（小写 id → 上限）。
+*
+* 这个上限是模型相关的，不能用一个全局值：
+*  - 免费（限时福利）DeepSeek 系列：> 65536 会被流内 InferHub.001001005.400
+*    "The request param is invalid" 拒掉，而福利网关标称的是 393216 / 384000；
+*  - GLM-5.2：2026-09-30 逐值直连验证过 8000/65536/131072 均正常，但
+*    **2026-10-10 复测 131072 已经被拒**（同一个 InferHub.001001005.400），
+*    65536 仍然正常。也就是说这条上限由服务端控制、会漂，目录里留着的旧实测值
+*    不会报错，只会让该模型的每一轮在流的第一帧就失败 —— 所以复测要按日期记。
+*
+* 没测过的模型一律退回 `MAX_TOKENS_CEILING`（保守但可用），而不是照抄标称值 ——
+* DSH 会把 catalog 的 maxTokens 原样当 max_tokens 发出去，照抄标称值等于让请求失败。
+* 新增实测结果时往这里加一行即可（scripts/param-probe.mjs 与
+* scripts/probe-models.ts 是得到这些数字的工具）。
+*/
+const MEASURED_MAX_TOKENS = {
+	"deepseek-v4-flash-0731": 65536,
+	"deepseek-v4-pro-0813": 65536,
+	"deepseek-v4.1-flash": 65536,
+	"glm-5.3-flash": 65536,
+	"glm-5.2": 65536
+};
+/** 该模型可用的 max_tokens 上限（实测值与会话内学到的更低值取小）。 */
+function maxTokensCeilingFor(id) {
+	const measured = measuredCeilingFor(id);
+	const learned = learnedMaxTokens.get(ceilingKey(id));
+	return learned === void 0 ? measured : Math.min(measured, learned);
+}
+/**
+* 上游的「参数非法」错误码。它是**流内**帧（HTTP 仍是 200），所以既不走
+* classify()，也不会告诉我们是哪个参数错、更不区分「max_tokens 太大」和
+* 「prompt 装不下」—— 一切得我们自己判。
+*/
+const PARAM_INVALID_CODE = "InferHub.001001005.400";
+/** 一帧（chatStream 已把上游 error_code 转成 OpenAI error 帧）是不是那条「参数非法」。 */
+function isParamInvalidFrame(text) {
+	return text.includes("InferHub.001001005.400") || text.includes("The request param is invalid");
+}
+/**
+* 本次进程内学到的上限（小写 id → 上限）。
+*
+* 上游会把「实测过」的值悄悄调低（GLM-5.2 的 131072 于 2026-10-10 被收），
+* 手工表必然滞后。所以撞到「参数非法」时就地折半降档重试，并把结果记在这里，
+* 免得该模型后面每一轮都先白撞一次。
+*/
+const learnedMaxTokens = /* @__PURE__ */ new Map();
+/** 降档下限：再低就没有可用的生成长度了，此时宁可把具体错误报给用户。 */
+const MAX_TOKENS_FLOOR = 8192;
+function ceilingKey(id) {
+	return id.trim().toLowerCase();
+}
+function measuredCeilingFor(id) {
+	return MEASURED_MAX_TOKENS[ceilingKey(id)] ?? 65536;
+}
+/**
+* 把该模型的上限折半降一档（收到「参数非法」后重发之前调用）。
+* @returns 新的上限；已经降到底则返回 0，表示别再试了。
+*/
+function degradeTokenCeiling(id) {
+	const next = Math.floor(maxTokensCeilingFor(id) / 2);
+	if (next < MAX_TOKENS_FLOOR) return 0;
+	learnedMaxTokens.set(ceilingKey(id), next);
+	return next;
+}
+/**
+* 粗估一段文本占多少 token：CJK 每字约 1，其余每 4 字符约 1。
+*
+* 只要保守就够用 —— 它的用途是「在我们这边就把装不下的情况判掉」，
+* 而不是精确计费（上游不会告诉我们超没超，只会回一句参数非法）。
+*/
+function estimateTokens(text) {
+	let cjk = 0;
+	for (let i = 0; i < text.length; i += 1) {
+		const code = text.charCodeAt(i);
+		if (code >= 12352 && code <= 40959 || code >= 44032 && code <= 64511 || code >= 65280 && code <= 65376) cjk += 1;
+	}
+	return Math.ceil(cjk + (text.length - cjk) / 4);
+}
+/** 上游要求 chat_id 为 32 位小写十六进制。 */
+const CHAT_ID_RE = /^[0-9a-f]{32}$/;
+/** 稳定地把消息内容序列化成锚点文本（字符串原样，多模态数组走 JSON）。 */
+function canonicalContent(content) {
+	if (typeof content === "string") return content;
+	if (content === void 0 || content === null) return "";
+	try {
+		return JSON.stringify(content);
+	} catch {
+		return String(content);
+	}
+}
+/**
+* 为一次对话派生稳定的 chat_id。
+*
+* 上游按 chat_id 计会话，而并发会话数有上限且回收很慢。若每个请求都新开一个
+* chat_id，多轮对话几轮之后就会撞上「并发会话数已达上限」——历史在增长，但
+* **首条 user 消息始终不变**，所以拿它当会话锚点：同一次对话的每一轮共用同一个
+* chat_id，只占一个会话。
+*
+* 客户端若显式给了 conversation_id（32 位 hex）则优先用它。
+*/
+function conversationChatId(parsed) {
+	const explicit = typeof parsed.conversation_id === "string" ? parsed.conversation_id.trim().toLowerCase() : "";
+	if (CHAT_ID_RE.test(explicit)) return explicit;
+	const messages = Array.isArray(parsed.messages) ? parsed.messages : [];
+	for (const raw of messages) {
+		const message = raw;
+		if (message?.role !== "user") continue;
+		let anchor = `${message.role}\u0000${canonicalContent(message.content)}`;
+		if (Array.isArray(parsed.tools) && parsed.tools.length > 0) anchor += "\0tools";
+		return createHash("sha256").update(anchor).digest("hex").slice(0, 32);
+	}
+	return hex32();
+}
+/**
+* 由 chat_id 派生稳定的会话标识，作为 `Session-Id` 头发给上游。
+* 与参考实现 codearts2api 的 sessionIDFor 一致（sha256 前 16 字节）。
+*/
+function sessionIdFor(chatId) {
+	return createHash("sha256").update(`codearts-session:${chatId}`).digest("hex").slice(0, 32);
+}
+/**
+* 把 OpenAI 风格 chat body 适配给 CodeArts /api/v2/chat/completions。
+* 该端点虽是 OpenAI 兼容，但网关按自己的 schema 严格校验参数。所以这里
+* 不做原样透传，而是：
+*  1. model 走 canonicalModel（大小写敏感）
+*  2. max_completion_tokens → max_tokens（华为只认后者），并钳到该模型的上限；
+*     再按 contextWindow 扣掉 prompt 估算，保证 prompt + max_tokens 装得下
+*     （两者任一超限，上游都只会流内回 InferHub.001001005.400
+*     "The request param is invalid, Please check it"，不告诉我们是哪一个）
+*  3. 丢弃非白名单字段（stream_options / store / logprobs 等虽实测可容忍，
+*     但按 codearts2api 观察到的真实流量收窄，避免网关后续收紧）
+*  4. tools[].function 去掉 strict（OpenAI 专有）
+*  5. 注入 CodeArts 特有字段：chat_id（按对话派生，见 conversationChatId）、
+*     prompt_cache_key、tool_stream
+*
+* @param contextWindow 该模型的上下文窗口（来自 catalog）。传 0 表示不知道，
+*   此时只做上限钳制、不做「装不下」判断。
+*/
+function prepareChatBody(rawJson, contextWindow = 0) {
+	let parsed = {};
+	try {
+		parsed = JSON.parse(rawJson);
+	} catch {
+		return {
+			url: `${SNAP_HOST}${EP_CHAT}`,
+			body: rawJson,
+			model: "",
+			chatId: ""
+		};
+	}
+	const model = typeof parsed.model === "string" ? canonicalModel(parsed.model) : "";
+	const chatId = conversationChatId(parsed);
+	const body = {};
+	for (const key of [
+		"messages",
+		"temperature",
+		"top_p",
+		"max_tokens",
+		"stop",
+		"presence_penalty",
+		"frequency_penalty",
+		"tools",
+		"tool_choice",
+		"user",
+		"stream_options"
+	]) if (parsed[key] !== void 0) body[key] = parsed[key];
+	if (body.stream_options === void 0 || typeof body.stream_options !== "object") body.stream_options = { include_usage: true };
+	else body.stream_options.include_usage = true;
+	if (body.max_tokens === void 0 && typeof parsed.max_completion_tokens === "number") body.max_tokens = parsed.max_completion_tokens;
+	const ceiling = maxTokensCeilingFor(model);
+	if (typeof body.max_tokens === "number") {
+		let maxTokens = Math.min(body.max_tokens, ceiling);
+		if (contextWindow > 0) {
+			const promptTokens = estimateTokens(`${JSON.stringify(body.messages ?? "")}${JSON.stringify(body.tools ?? "")}`);
+			const room = contextWindow - promptTokens - PROMPT_ESTIMATE_MARGIN;
+			if (room < MIN_USEFUL_OUTPUT_TOKENS) {
+				body.max_tokens = maxTokens;
+				return {
+					url: `${SNAP_HOST}${EP_CHAT}`,
+					body: JSON.stringify(body),
+					model,
+					chatId,
+					error: `上下文放不下：${model} 的窗口是 ${contextWindow} tokens，本次请求（含 ${Array.isArray(body.messages) ? body.messages.length : 0} 条消息与工具定义）估算约 ${promptTokens} tokens，剩余不足 ${MIN_USEFUL_OUTPUT_TOKENS} tokens 的生成余量。请新建会话或改用上下文更大的模型。`
+				};
+			}
+			maxTokens = Math.min(maxTokens, room);
+		}
+		body.max_tokens = maxTokens;
+	}
+	if (Array.isArray(body.tools)) body.tools = body.tools.map((tool) => {
+		if (tool && typeof tool === "object" && tool.function && typeof tool.function === "object") {
+			const fn = { ...tool.function };
+			delete fn.strict;
+			return {
+				...tool,
+				function: fn
+			};
+		}
+		return tool;
+	});
+	body.model = model;
+	body.stream = true;
+	body.chat_id = chatId;
+	body.prompt_cache_key = chatId;
+	body.tool_stream = true;
+	return {
+		url: `${SNAP_HOST}${EP_CHAT}`,
+		body: JSON.stringify(body),
+		model,
+		chatId
+	};
+}
+/**
+* 免费档的「并发会话数已达上限」。实测 HTTP 400 + 这个错误码，上限是 3 个会话，
+* 而且被掐断/挂起的流要约 2 分钟才被网关回收。它不是请求错误，重发就有机会，
+* 所以 shim 要在本地排队重等，而不是把它变成 pi-ai 的重试风暴。
+*/
+const CONCURRENCY_CAP_CODE = "TM.00001041";
+function isConcurrencyCap(result) {
+	return !result.ok && result.message.includes("TM.00001041");
+}
+function classify(status, message) {
+	const m = message.toLowerCase();
+	if (status === 401 || status === 403) return "session_dead";
+	if (status === 402) return "hard_credit";
+	if (status === 429) return "soft_rate";
+	if (status === 404) return "not_found";
+	if (status >= 500) return "server";
+	if (m.includes("not registered") || m.includes("benefit not found")) return "not_found";
+	if (m.includes("tpm") || m.includes("并发")) return "soft_rate";
+	return "client";
+}
+const enc = new TextEncoder();
+function openAIData(obj) {
+	return enc.encode(`data: ${JSON.stringify(obj)}\n\n`);
+}
+/** OpenAI 流的终止帧是裸 `data: [DONE]`，不能走 JSON.stringify（否则会带引号）。 */
+function openAIDone() {
+	return enc.encode("data: [DONE]\n\n");
+}
+/**
+* 把上游累计快照 SSE 转换成 OpenAI 增量流。
+*
+* 上游行为（reverse-engineering.md §5）：
+*  - {"type":"answer", ...} 起始
+*  - {"text": "<累计全文>"} 全文快照（用替换语义）
+*  - {"delta":{"content":"..."}} 真增量
+*  - {"text":"[DONE]","error_code":"0"} 结束；error_code != 0 为错误
+*/
+async function chatStream(credential, prepared, signal) {
+	const traceId = randomTraceId();
+	const bodyBuf = Buffer.from(prepared.body);
+	const benefit = isBenefitModel(prepared.model);
+	const req = new Request(prepared.url, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			Accept: "text/event-stream",
+			"x-auth-token": credential.token,
+			"X-Security-Token": credential.securityToken,
+			"x-snap-traceid": traceId,
+			"X-Language": "zh-cn",
+			"app-id": "CodeAgent3.0",
+			"is_confidential": "false",
+			...benefit ? { "maas_type": "benefit" } : {}
+		},
+		body: bodyBuf
+	});
+	if (credential.accessKeyId && credential.secretAccessKey) signRequest(req, bodyBuf, {
+		accessKeyId: credential.accessKeyId,
+		secretAccessKey: credential.secretAccessKey,
+		securityToken: credential.securityToken
+	});
+	if (prepared.chatId) {
+		req.headers.set("Chat-Id", prepared.chatId);
+		req.headers.set("Session-Id", sessionIdFor(prepared.chatId));
+	}
+	let resp;
+	try {
+		resp = await fetch(req, { signal });
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		if (signal?.aborted === true) return {
+			ok: false,
+			kind: "client",
+			status: 0,
+			message: "aborted by client"
+		};
+		return {
+			ok: false,
+			kind: "server",
+			status: 0,
+			message
+		};
+	}
+	if (!resp.ok) {
+		const text = await resp.text().catch(() => "");
+		return {
+			ok: false,
+			kind: classify(resp.status, text),
+			status: resp.status,
+			message: text.slice(0, 400)
+		};
+	}
+	const model = prepared.model;
+	const upstream = resp.body;
+	if (!upstream) return {
+		ok: false,
+		kind: "server",
+		status: 0,
+		message: "dsh-codearts: 上游无响应体"
+	};
+	const reader = upstream.getReader();
+	const decoder = new TextDecoder();
+	let lastText = "";
+	let sentAny = false;
+	let doneSent = false;
+	let sseBuf = "";
+	return {
+		ok: true,
+		stream: new ReadableStream({
+			async pull(controller) {
+				try {
+					for (;;) {
+						const { done, value } = await reader.read();
+						if (done) {
+							if (sentAny && !doneSent) controller.enqueue(openAIDone());
+							controller.close();
+							return;
+						}
+						sseBuf += decoder.decode(value, { stream: true });
+						const lines = sseBuf.split("\n");
+						sseBuf = lines.pop() ?? "";
+						let emitted = false;
+						for (const raw of lines) {
+							const trimmed = raw.trim();
+							if (!trimmed.startsWith("data:")) continue;
+							const payload = trimmed.slice(5).trim();
+							if (payload === "[DONE]") {
+								sentAny = true;
+								if (!doneSent) {
+									doneSent = true;
+									controller.enqueue(openAIDone());
+									emitted = true;
+								}
+								continue;
+							}
+							if (!payload) continue;
+							let ev;
+							try {
+								ev = JSON.parse(payload);
+							} catch {
+								continue;
+							}
+							if (ev.error_code && ev.error_code !== "0" && ev.error_code !== 0) {
+								controller.enqueue(openAIData({
+									choices: [{
+										delta: { content: "" },
+										finish_reason: "stop"
+									}],
+									error: {
+										code: ev.error_code,
+										message: ev.error_msg ?? "upstream error"
+									}
+								}));
+								controller.enqueue(openAIDone());
+								controller.close();
+								return;
+							}
+							if (Array.isArray(ev.choices)) {
+								sentAny = true;
+								controller.enqueue(enc.encode(`data: ${JSON.stringify(ev)}\n\n`));
+								emitted = true;
+								continue;
+							}
+							if (ev.delta?.content) {
+								sentAny = true;
+								controller.enqueue(openAIData({
+									model,
+									choices: [{
+										delta: { content: ev.delta.content },
+										finish_reason: null
+									}]
+								}));
+								emitted = true;
+							}
+							if (typeof ev.text === "string" && ev.text !== "[DONE]") {
+								const cur = ev.text;
+								if (cur.length > lastText.length && cur.startsWith(lastText)) {
+									const delta = cur.slice(lastText.length);
+									sentAny = true;
+									controller.enqueue(openAIData({
+										model,
+										choices: [{
+											delta: { content: delta },
+											finish_reason: null
+										}]
+									}));
+									emitted = true;
+								}
+								lastText = cur;
+							}
+						}
+						if (emitted) return;
+					}
+				} catch (err) {
+					const message = err instanceof Error ? err.message : String(err);
+					controller.enqueue(openAIData({ error: { message } }));
+					controller.close();
+				}
+			},
+			cancel() {
+				reader.cancel().catch(() => {});
+			}
+		})
+	};
+}
+/**
+* 查当前凭证对应的账号身份。
+*
+* 为什么需要它：登录响应里 `user_id` / `user_name` 都是空串（实测），所以插件原先
+* 只能拿 DPoP 公钥当账号标识 —— 代价是**对同一个账号重新登录会被当成新账号**。
+* 这个端点给出上游的稳定 `user_id`，重新登录就能命中同一条账号记录。
+*
+* 失败不应阻断登录：调用方按「拿不到身份就退回旧行为」处理。
+*/
+async function fetchCallerIdentity(credential, signal) {
+	const resp = await signedGet(`${SNAP_HOST}${EP_CURRENT_USER}`, credential, void 0, signal);
+	if (!resp.ok) throw new Error(`identity HTTP ${resp.status} ${resp.message}`);
+	const body = asRecord(parseJson(resp.text));
+	const userId = firstString(body.user_id);
+	if (userId === "") throw new Error("identity response carries no user_id");
+	return {
+		userId,
+		userName: firstString(body.user_name),
+		domainId: firstString(body.domain_id)
+	};
+}
+/** 发现不到 contextWindow 时的保守默认值：只影响 DSH 的上下文计量条与截断余量。 */
+const UNKNOWN_CONTEXT_WINDOW = 32768;
+/** 发现不到 maxTokens 时的默认值（低于服务端上限，保证请求能过）。 */
+const UNKNOWN_MAX_TOKENS = 8e3;
+/** 带 AK/SK 签名的 GET；body 为空（签名按空载荷算）。 */
+async function signedGet(url, credential, agentType, signal) {
+	const req = new Request(url, {
+		method: "GET",
+		headers: {
+			"Content-Type": "application/json",
+			"X-Language": "zh-cn",
+			...agentType === void 0 ? {} : { "Agent-Type": agentType },
+			"X-Security-Token": credential.securityToken
+		}
+	});
+	if (credential.accessKeyId && credential.secretAccessKey) signRequest(req, Buffer.from(""), {
+		accessKeyId: credential.accessKeyId,
+		secretAccessKey: credential.secretAccessKey,
+		securityToken: credential.securityToken
+	});
+	let resp;
+	try {
+		resp = await fetch(req, { signal });
+	} catch (error) {
+		return {
+			ok: false,
+			status: 0,
+			message: error instanceof Error ? error.message : String(error)
+		};
+	}
+	const text = await resp.text().catch(() => "");
+	if (!resp.ok) return {
+		ok: false,
+		status: resp.status,
+		message: text.slice(0, 300)
+	};
+	return {
+		ok: true,
+		text
+	};
+}
+function parseJson(text) {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return;
+	}
+}
+function positive(value) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : 0;
+}
+function firstString(...values) {
+	for (const value of values) if (typeof value === "string" && value.trim() !== "") return value.trim();
+	return "";
+}
+function asRecord(value) {
+	return typeof value === "object" && value !== null ? value : {};
+}
+function asArray(value) {
+	return Array.isArray(value) ? value : [];
+}
+/**
+* 内置模型：`GET /v1/model/builtin`（`Agent-Type: PromptCenter`）。
+* 实测响应 `{ count, builtinModels: [{ model_id, model_name, model_desc,
+* enable, display_enabled, supports_images, ... }] }` —— 注意它**不带**
+* context_window / max_tokens，那两项要靠合并种子或福利来源补。
+*/
+async function fetchBuiltinModels(credential, signal) {
+	const resp = await signedGet(`${SNAP_HOST}${EP_MODEL_BUILTIN}`, credential, "PromptCenter", signal);
+	if (!resp.ok) throw new Error(`HTTP ${resp.status} ${resp.message}`);
+	const body = asRecord(parseJson(resp.text));
+	const out = [];
+	for (const raw of asArray(body.builtinModels)) {
+		const model = asRecord(raw);
+		if (model.enable === false) continue;
+		const id = firstString(model.model_id, model.model_name);
+		if (id === "") continue;
+		out.push({
+			id,
+			name: firstString(model.model_name, id),
+			contextWindow: positive(model.context_window),
+			maxTokens: positive(model.max_tokens),
+			supportsImages: model.supports_images === true
+		});
+	}
+	return out;
+}
+/**
+* 限时福利模型：`GET {opengw}/api/v1/gateway/config`。
+* 实测响应 `{ error_code: '0000', result: { base_url, models: [{ model_id,
+* model_name, context_window, max_tokens, sort }] } }`，整份标记福利。
+*/
+async function fetchBenefitModels(credential, signal) {
+	const resp = await signedGet(`${BENEFIT_HOST}${EP_BENEFIT_CONFIG}`, credential, void 0, signal);
+	if (!resp.ok) throw new Error(`HTTP ${resp.status} ${resp.message}`);
+	const body = asRecord(parseJson(resp.text));
+	const code = firstString(body.error_code);
+	if (code !== "" && code !== "0000") throw new Error(`gateway/config error_code=${code} ${firstString(body.error_msg)}`);
+	const out = [];
+	for (const raw of asArray(asRecord(body.result).models)) {
+		const model = asRecord(raw);
+		const id = firstString(model.model_id, model.model_name);
+		if (id === "") continue;
+		out.push({
+			id,
+			name: firstString(model.model_name, id),
+			contextWindow: positive(model.context_window),
+			maxTokens: positive(model.max_tokens),
+			supportsImages: model.supports_images === true,
+			benefit: true
+		});
+	}
+	return out;
+}
+/**
+* agent-center 的模型清单：先 `useragents` 找一个 CodeAgent，再取 detail 的
+* `gpts.models`。过滤条件与官方客户端一致（`agent_name === 'CodeAgent'` 且
+* IDE 可见），退化为 primary，再退化为第一个。
+*/
+async function fetchAgentModels(credential, signal) {
+	const listResp = await signedGet(`${SNAP_HOST}${EP_AGENT_LIST}?offset=0&limit=100&is_primary_agent=true`, credential, "AgentCenter", signal);
+	if (!listResp.ok) throw new Error(`agent list HTTP ${listResp.status} ${listResp.message}`);
+	const agents = asArray(asRecord(parseJson(listResp.text)).agents).map(asRecord);
+	let agentId = "";
+	for (const agent of agents) {
+		const alias = asRecord(agent.alias);
+		if (firstString(agent.agent_name) === "CodeAgent" && firstString(alias.alias_zh_cn) === "智能体" && agent.show_in_ide === true) {
+			agentId = firstString(agent.agent_id);
+			if (agentId !== "") break;
+		}
+	}
+	if (agentId === "") {
+		for (const agent of agents) if (agent.is_primary_agent === true) {
+			agentId = firstString(agent.agent_id);
+			if (agentId !== "") break;
+		}
+	}
+	if (agentId === "" && agents.length > 0) agentId = firstString(agents[0]?.agent_id);
+	if (agentId === "") throw new Error("no agent found to read gpts.models from");
+	const detailResp = await signedGet(`${SNAP_HOST}${EP_AGENT_DETAIL}?agent_id=${encodeURIComponent(agentId)}`, credential, "AgentCenter", signal);
+	if (!detailResp.ok) throw new Error(`agent detail HTTP ${detailResp.status} ${detailResp.message}`);
+	const gpts = asRecord(asRecord(parseJson(detailResp.text)).gpts);
+	const out = [];
+	for (const raw of asArray(gpts.models)) {
+		const model = asRecord(raw);
+		const params = asRecord(model.model_parameters);
+		const id = firstString(params.model_id, model.model_id, model.model_alias, model.model_name);
+		if (id === "") continue;
+		out.push({
+			id,
+			name: firstString(model.model_name, model.model_alias, id),
+			contextWindow: positive(params.context_window),
+			maxTokens: positive(params.max_tokens),
+			supportsImages: model.supports_images === true
+		});
+	}
+	return out;
+}
+/**
+* 动态发现当前账号可用的模型清单（三路合并）。
+*
+* 与 codearts2api 的 `Client.FetchModels` 等价：内置、限时福利、agent-center 三路
+* 各自独立，任一路失败只记进 `errors` 不阻断 —— 福利网关抖动时仍能拿到内置模型。
+*
+* 上标的两个「实测 vs 标称」处理（很重要，别照搬标称值）：
+*  - **maxTokens 钳到该模型的实测上限**（`MEASURED_MAX_TOKENS`）。上游
+*    `gateway/config` 给福利模型标的是 393216 / 384000，而聊天端点实测超过 65536
+*    就流内报 InferHub.001001005.400；DSH 会把 catalog 的 maxTokens 原样当
+*    max_tokens 发出去，照抄标称值等于让每个请求都失败。
+*  - contextWindow 用发现值（只影响 DSH 的上下文计量与截断余量，不影响路由）。
+*
+* @throws 三路全失败，或合并结果为空。
+*/
+async function fetchModels(credential, signal) {
+	const settled = await Promise.all([
+		fetchBuiltinModels(credential, signal).then((models) => ({
+			source: "builtin",
+			models
+		}), (error) => ({
+			source: "builtin",
+			error
+		})),
+		fetchBenefitModels(credential, signal).then((models) => ({
+			source: "benefit",
+			models
+		}), (error) => ({
+			source: "benefit",
+			error
+		})),
+		fetchAgentModels(credential, signal).then((models) => ({
+			source: "agent",
+			models
+		}), (error) => ({
+			source: "agent",
+			error
+		}))
+	]);
+	const sources = [];
+	const errors = [];
+	const discovered = [];
+	for (const item of settled) if ("error" in item) errors.push({
+		source: item.source,
+		message: item.error.message
+	});
+	else {
+		sources.push(item.source);
+		discovered.push(item.models);
+	}
+	if (sources.length === 0) throw new Error(`model discovery failed on every source: ${errors.map((e) => `${e.source}: ${e.message}`).join("; ")}`);
+	const merged = fillFromSeed(mergeModelLists(discovered));
+	if (merged.length === 0) throw new Error("model discovery returned an empty catalog");
+	return {
+		models: merged.map((model) => ({
+			...model,
+			contextWindow: model.contextWindow > 0 ? model.contextWindow : UNKNOWN_CONTEXT_WINDOW,
+			maxTokens: Math.min(model.maxTokens > 0 ? model.maxTokens : UNKNOWN_MAX_TOKENS, maxTokensCeilingFor(model.id))
+		})),
+		sources,
+		errors
+	};
+}
+/**
+* 领取限时福利（幂等：已领取返回成功）。官方客户端打开模型菜单即调用。
+* 不领取时福利模型调用必报 InferHub.4004.200 benefit not found。
+* 需要 AK/SK 签名（凭证要带 accessKeyId/secretAccessKey）。
+*/
+async function claimBenefit(credential, abort) {
+	if (!credential.accessKeyId || !credential.secretAccessKey) return;
+	const url = `${BENEFIT_HOST}${EP_BENEFIT_CLAIM}`;
+	const bodyBuf = Buffer.from("{}");
+	const req = new Request(url, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			"X-Language": "zh-cn",
+			"X-Security-Token": credential.securityToken
+		},
+		body: bodyBuf
+	});
+	signRequest(req, bodyBuf, {
+		accessKeyId: credential.accessKeyId,
+		secretAccessKey: credential.secretAccessKey,
+		securityToken: credential.securityToken
+	});
+	const resp = await fetch(req, { signal: abort });
+	const raw = await resp.text().catch(() => "");
+	if (!resp.ok) throw new Error(`claim benefit failed: ${resp.status} ${raw.slice(0, 200)}`);
+	try {
+		const json = JSON.parse(raw);
+		if (json.error_code && json.error_code !== "0000") throw new Error(`claim benefit rejected: ${json.error_code} ${json.error_msg ?? ""}`);
+	} catch (e) {
+		if (e instanceof SyntaxError) return;
+		throw e;
+	}
+}
+//#endregion
+//#region src/discovery.ts
+/**
+* 动态模型发现：把「已登录账号」变成「当前可用模型清单」。
+*
+* 为什么要单独一层：模型目录是**按账号**授予的（限时福利尤其如此：A 账号有、
+* B 账号没有），而插件对外只暴露一份目录。所以这里逐账号发现、取并集，再把
+* 结果提交给全局目录与福利集合。
+*
+* 失败一律不抛出：拉不到就继续用现有目录（冷启动时是种子清单），把失败原因
+* 带回去给 CLI / 日志展示。真正「不可用」的信号是 0 个账号。
+*
+* @module dsh-codearts/discovery
+*/
+/**
+* 逐账号发现并合并（不改全局状态）。
+*
+* @param store 账号文档；逐个 `resolve()` 以拿到已续期的签名材料
+* @param signal 取消信号（宿主关停时用）
+*/
+async function discoverModels(store, signal) {
+	const ids = await store.ids();
+	const accounts = [];
+	for (const id of ids) {
+		if (signal?.aborted === true) break;
+		const summary = (await store.list()).find((account) => account.id === id);
+		const label = summary?.label ?? summary?.userName;
+		const resolved = await store.resolve(id);
+		if (resolved === void 0) {
+			accounts.push({
+				accountId: id,
+				...label === void 0 ? {} : { label },
+				ok: false,
+				models: [],
+				sources: [],
+				errors: [{
+					source: "agent",
+					message: "credential unavailable (sign in again)"
+				}]
+			});
+			continue;
+		}
+		try {
+			const result = await fetchModels(resolved, signal);
+			accounts.push({
+				accountId: id,
+				...label === void 0 ? {} : { label },
+				ok: true,
+				models: result.models,
+				sources: result.sources,
+				errors: result.errors
+			});
+		} catch (error) {
+			accounts.push({
+				accountId: id,
+				...label === void 0 ? {} : { label },
+				ok: false,
+				models: [],
+				sources: [],
+				errors: [{
+					source: "agent",
+					message: error instanceof Error ? error.message : String(error)
+				}]
+			});
+		}
+	}
+	const ok = accounts.filter((account) => account.ok);
+	return {
+		models: mergeModelLists(ok.map((account) => account.models)),
+		accounts,
+		anySucceeded: ok.length > 0
+	};
+}
+/**
+* 发现并**提交**到全局目录：目录内容 + 福利集合。
+*
+* @returns 提交后的目录；没有任何账号成功时返回 `undefined`（调用方保留原目录）
+*/
+async function refreshCatalog(store, catalog, signal) {
+	const outcome = await discoverModels(store, signal);
+	if (!outcome.anySucceeded || outcome.models.length === 0) return outcome;
+	catalog.set(outcome.models);
+	setDiscoveredBenefitModels(outcome.models.filter((model) => model.benefit === true).map((model) => model.id));
+	return outcome;
+}
+//#endregion
+//#region src/usage.ts
+/**
+* 用量账本：把聊天流里的 usage 帧累计成「今天用了多少」。
+*
+* 为什么还要自己记：账号总额度有积分接口了（见 credits.ts，2026-10 从官方 Agent
+* 客户端挖出并实测通过），但**本机经插件发出的请求**仍需自己累计 —— 上游不按
+* 「这台机器」维度给统计。能拿到的真实数据有三样：
+*   1. 每个请求的 token `usage`（上游在流末尾回一帧 `{choices:[],usage:{...}}`）；
+*   2. 插件自己知道的账号会话槽位占用（见 account-pool：每账号 3 个并发会话）；
+*   3. 账号积分/额度（见 credits.ts）。
+*
+* 所以这里累计的是**本机经插件发出的请求**，与卡片上的积分区块互补 —— 一个是本机
+* 级、一个是账号级。官方额度明细在 `codearts.huaweicloud.com/portal/settings/personal-usage`。
+*
+* 落盘在 `$DSH_HOME/.codearts-usage.json`，按天存，保留最近 `RETENTION_DAYS` 天。
+*
+* @module dsh-codearts/usage
+*/
+/** 用量账本路径：与账号文档同一层（`$DSH_HOME` 或 `~/.dsh`）。 */
+function codeartsUsagePath(home) {
+	const base = home ?? process.env.DSH_HOME ?? join(homedir(), ".dsh");
+	return join(base, ".codearts-usage.json");
+}
+function emptyTotals() {
+	return {
+		requests: 0,
+		promptTokens: 0,
+		completionTokens: 0,
+		totalTokens: 0
+	};
+}
+function addTotals(into, add) {
+	into.requests += add.requests ?? 0;
+	into.promptTokens += add.promptTokens ?? 0;
+	into.completionTokens += add.completionTokens ?? 0;
+	into.totalTokens += add.totalTokens ?? 0;
+}
+function mergeTotals(into, from) {
+	addTotals(into, from);
+}
+/** 本地日期键 YYYY-MM-DD（不用 toISOString：那是 UTC，会把跨零点的用量算到前一天）。 */
+function localDateKey(at = Date.now()) {
+	const d = new Date(at);
+	const p = (n) => String(n).padStart(2, "0");
+	return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}`;
+}
+function positiveInt(value) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : 0;
+}
+/** 从上游 usage 帧里取三个计数字段（缺哪个算 0，total 缺失时用 prompt+completion 兜底）。 */
+function normalizeUsage(raw) {
+	if (raw === void 0) return {
+		promptTokens: 0,
+		completionTokens: 0,
+		totalTokens: 0
+	};
+	const promptTokens = positiveInt(raw.prompt_tokens);
+	const completionTokens = positiveInt(raw.completion_tokens);
+	const total = positiveInt(raw.total_tokens);
+	return {
+		promptTokens,
+		completionTokens,
+		totalTokens: total > 0 ? total : promptTokens + completionTokens
+	};
+}
+/**
+* 用量账本。
+*
+* 记账分两步，因为一次请求可能只有其一：
+*  - `noteRequest()` 在请求发出时调用（拿不到 usage 的流也要计入请求数）；
+*  - `noteUsage()` 在收到 usage 帧时调用（补 token 数）。
+*/
+var CodeArtsUsageTracker = class {
+	days = /* @__PURE__ */ new Map();
+	lastAt;
+	loaded = false;
+	loading;
+	saveTimer;
+	saving = Promise.resolve();
+	path;
+	now;
+	saveDebounceMs;
+	constructor(options = {}) {
+		this.path = options.path;
+		this.now = options.now ?? (() => Date.now());
+		this.saveDebounceMs = options.saveDebounceMs ?? 2e3;
+	}
+	/** 读账本（懒加载，只读一次）。 */
+	async load() {
+		this.loading ??= this.readFile();
+		return this.loading;
+	}
+	async readFile() {
+		if (this.loaded || this.path === void 0 || !existsSync(this.path)) {
+			this.loaded = true;
+			return;
+		}
+		try {
+			const raw = await readFile(this.path, "utf8");
+			const parsed = JSON.parse(raw);
+			if (parsed.version !== 1 || typeof parsed.days !== "object" || parsed.days === null) return;
+			for (const [date, day] of Object.entries(parsed.days)) {
+				if (typeof day !== "object" || day === null) continue;
+				const models = day.models ?? {};
+				const accounts = day.accounts ?? {};
+				this.days.set(date, {
+					models,
+					accounts
+				});
+			}
+			this.prune(this.now());
+		} catch {
+			this.days.clear();
+		} finally {
+			this.loaded = true;
+		}
+	}
+	day(dateKey) {
+		let day = this.days.get(dateKey);
+		if (day === void 0) {
+			day = {
+				models: {},
+				accounts: {}
+			};
+			this.days.set(dateKey, day);
+		}
+		return day;
+	}
+	bucket(store, key) {
+		let totals = store[key];
+		if (totals === void 0) {
+			totals = emptyTotals();
+			store[key] = totals;
+		}
+		return totals;
+	}
+	/** 记一次请求（不等到 usage 帧）。 */
+	noteRequest(accountId, model, at = this.now()) {
+		const day = this.day(localDateKey(at));
+		addTotals(this.bucket(day.models, model), { requests: 1 });
+		addTotals(this.bucket(day.accounts, accountId), { requests: 1 });
+		this.lastAt = at;
+		this.prune(at);
+		this.scheduleSave();
+	}
+	/** 记一次 usage 帧。 */
+	noteUsage(accountId, model, raw, at = this.now()) {
+		const usage = normalizeUsage(raw);
+		if (usage.totalTokens === 0 && usage.promptTokens === 0 && usage.completionTokens === 0) return;
+		const day = this.day(localDateKey(at));
+		addTotals(this.bucket(day.models, model), usage);
+		addTotals(this.bucket(day.accounts, accountId), usage);
+		this.lastAt = at;
+		this.prune(at);
+		this.scheduleSave();
+	}
+	/** 丢弃保留期之外的天（按日期键比较即可，YYYY-MM-DD 是字典序）。 */
+	prune(at) {
+		if (this.days.size === 0) return;
+		const cutoff = localDateKey(at - 5184e6);
+		for (const date of [...this.days.keys()]) if (date < cutoff) this.days.delete(date);
+	}
+	/** 当前快照（卡片与 CLI 都读它）。 */
+	snapshot(at = this.now()) {
+		const todayKey = localDateKey(at);
+		const today = this.days.get(todayKey);
+		const allTime = emptyTotals();
+		for (const day of this.days.values()) for (const totals of Object.values(day.models)) mergeTotals(allTime, totals);
+		const models = today?.models ?? {};
+		return {
+			today: {
+				...emptyTotals(),
+				...today === void 0 ? {} : sumOf(models)
+			},
+			allTime,
+			byModelToday: Object.entries(models).map(([id, totals]) => ({
+				id,
+				totals: { ...totals }
+			})).sort((a, b) => b.totals.totalTokens - a.totals.totalTokens || (a.id < b.id ? -1 : 1)),
+			byAccountToday: Object.fromEntries(Object.entries(today?.accounts ?? {}).map(([id, totals]) => [id, { ...totals }])),
+			days: this.days.size,
+			...this.lastAt === void 0 ? {} : { lastAt: this.lastAt }
+		};
+	}
+	scheduleSave() {
+		if (this.path === void 0) return;
+		if (this.saveTimer !== void 0) return;
+		this.saveTimer = setTimeout(() => {
+			this.saveTimer = void 0;
+			this.save();
+		}, this.saveDebounceMs);
+		this.saveTimer.unref?.();
+	}
+	/** 立即落盘（关停时调用，别丢最后几秒的账）。 */
+	async flush() {
+		if (this.saveTimer !== void 0) {
+			clearTimeout(this.saveTimer);
+			this.saveTimer = void 0;
+		}
+		await this.save();
+	}
+	save() {
+		if (this.path === void 0) return Promise.resolve();
+		const doc = {
+			version: 1,
+			days: Object.fromEntries(this.days)
+		};
+		this.saving = this.saving.then(() => writeJsonAtomic(this.path, doc), () => writeJsonAtomic(this.path, doc));
+		return this.saving;
+	}
+};
+/** 一批桶的合计。 */
+function sumOf(store) {
+	const out = emptyTotals();
+	for (const totals of Object.values(store)) mergeTotals(out, totals);
+	return out;
+}
+//#endregion
+export { codeartsAuthPath as C, codeartsAccountsPath as S, FALLBACK_CODEARTS_MODELS as _, SNAP_HOST as a, CodeArtsAccountStore as b, degradeTokenCeiling as c, isConcurrencyCap as d, isParamInvalidFrame as f, CodeArtsCatalog as g, signedGet as h, refreshCatalog as i, fetchCallerIdentity as l, prepareChatBody as m, codeartsUsagePath as n, canonicalModel as o, maxTokensCeilingFor as p, discoverModels as r, chatStream as s, CodeArtsUsageTracker as t, fetchModels as u, filterEnabledModels as v, startLogin as w, CodeArtsCredentialStore as x, isBenefitModel as y };