dsh-codex-subscription 2.6.8 → 2.7.0

package/README.en.md

@@ -106,7 +106,7 @@ This plugin supports the latest DeepSeek Harness release recorded in its package
 2. Paste this package name, with its version, into the **Package name or address** field:
 
    ```text
-   dsh-codex-subscription@2.6.8
+   dsh-codex-subscription@2.7.0
    ```
 
 3. Click **Install** and wait for completion. Follow the page instructions; save your work before restarting if requested.
@@ -118,7 +118,7 @@ Why the version is included: DSH's plugin page only installs versions that are a
 <summary>Terminal installation (with an existing dsh command)</summary>
 
 ```sh
-dsh plugin --profile web add dsh-codex-subscription@2.6.8
+dsh plugin --profile web add dsh-codex-subscription@2.7.0
 ```
 
 Follow the restart instructions, then sign in under **Settings → Codex**. Both the Plugins page and the terminal use DSH's installation management.
@@ -131,7 +131,7 @@ Follow the restart instructions, then sign in under **Settings → Codex**. Both
 After signing in and selecting a Codex model in Web, install the same plugin in the Headless profile:
 
 ```sh
-dsh plugin --profile headless add dsh-codex-subscription@2.6.8
+dsh plugin --profile headless add dsh-codex-subscription@2.7.0
 dsh --profile headless "Reply with only the word: ok"
 ```
 
@@ -266,7 +266,7 @@ Find this plugin on the DSH **Plugins** page and use its update or uninstall act
 <summary>Terminal commands</summary>
 
 ```sh
-dsh plugin --profile web update dsh-codex-subscription@2.6.8
+dsh plugin --profile web update dsh-codex-subscription@2.7.0
 ```
 
 Run only when you want to uninstall:
@@ -282,7 +282,7 @@ dsh plugin --profile web remove dsh-codex-subscription
 <details>
 <summary>DSH 0.2.0-rc.2 reports the plugin as incompatible?</summary>
 
-DSH 0.2.0-rc.2 did not exist when any release before 2.2.10 was published, and a published package's compatibility declaration cannot be changed. Install 2.2.10 or later (a bare package name can resolve to an older release during the first 24 hours, so enter `dsh-codex-subscription@2.2.10`) from the **Plugins** page, or run `dsh plugin --profile web update dsh-codex-subscription@2.6.8`, then restart DSH.
+DSH 0.2.0-rc.2 did not exist when any release before 2.2.10 was published, and a published package's compatibility declaration cannot be changed. Install 2.2.10 or later (a bare package name can resolve to an older release during the first 24 hours, so enter `dsh-codex-subscription@2.2.10`) from the **Plugins** page, or run `dsh plugin --profile web update dsh-codex-subscription@2.7.0`, then restart DSH.
 
 </details>
 

package/README.md

@@ -106,7 +106,7 @@
 2. 在 **包名或地址** 输入框中粘贴下面的包名（已带版本号）：
 
    ```text
-   dsh-codex-subscription@2.6.8
+   dsh-codex-subscription@2.7.0
    ```
 
 3. 点击 **安装**，等待安装完成；按页面提示操作，需要重启时先保存工作。
@@ -118,7 +118,7 @@
 <summary>终端安装（已能运行 dsh 命令）</summary>
 
 ```sh
-dsh plugin --profile web add dsh-codex-subscription@2.6.8
+dsh plugin --profile web add dsh-codex-subscription@2.7.0
 ```
 
 安装完成后按提示重启 DSH，再到 **设置 → Codex 订阅** 登录。插件页面和终端均由 DSH 管理安装。
@@ -131,7 +131,7 @@ dsh plugin --profile web add dsh-codex-subscription@2.6.8
 先在 Web 中完成登录并选择一次 Codex 模型，再把同一个插件安装到 Headless profile：
 
 ```sh
-dsh plugin --profile headless add dsh-codex-subscription@2.6.8
+dsh plugin --profile headless add dsh-codex-subscription@2.7.0
 dsh --profile headless "只回复：ok"
 ```
 
@@ -295,7 +295,7 @@ DSH 实机设置截图。
 <summary>终端方式</summary>
 
 ```sh
-dsh plugin --profile web update dsh-codex-subscription@2.6.8
+dsh plugin --profile web update dsh-codex-subscription@2.7.0
 ```
 
 仅在需要卸载时运行：
@@ -311,7 +311,7 @@ dsh plugin --profile web remove dsh-codex-subscription
 <details>
 <summary>DSH 0.2.0-rc.2 提示插件不兼容？</summary>
 
-2.2.10 之前的所有版本发布时 DSH 0.2.0-rc.2 还不存在，其兼容声明无法事后修改。请安装 2.2.10 或更高版本（只填包名时，发布满 24 小时前可能装到旧版，请直接填 `dsh-codex-subscription@2.2.10`）：在 **插件** 页面更新，或运行 `dsh plugin --profile web update dsh-codex-subscription@2.6.8`，然后重启 DSH。
+2.2.10 之前的所有版本发布时 DSH 0.2.0-rc.2 还不存在，其兼容声明无法事后修改。请安装 2.2.10 或更高版本（只填包名时，发布满 24 小时前可能装到旧版，请直接填 `dsh-codex-subscription@2.2.10`）：在 **插件** 页面更新，或运行 `dsh plugin --profile web update dsh-codex-subscription@2.7.0`，然后重启 DSH。
 
 </details>
 

package/lib/client.js

@@ -1074,6 +1074,7 @@ window.__ModuleLoader__.load({
 			"account/select",
 			"account/remove",
 			"usage",
+			"usage/accounts",
 			"diagnostics",
 			"preferences/status",
 			"preferences/models",
@@ -6037,7 +6038,13 @@ window.__ModuleLoader__.load({
 			resetNoCredit: "没有可用的额度重置。",
 			resetAlready: "这次重置请求已处理。",
 			resetFailed: "无法使用额度重置。",
+			accountQuotaLeft: "{label}剩余 {value}%",
+			accountQuotaResets: "{value} 重置",
+			accountQuotaLoading: "正在读取额度…",
+			accountQuotaError: "暂时读不到这个账号的额度",
+			accountQuotaNone: "没有额度窗口信息",
 			resetRenewLogin: "登录状态已失效，请重新登录。",
+			resetBlocked: "ChatGPT 的网络防护拦截了这次请求（HTTP 403），登录状态没有问题。请稍后再试，或检查网络、代理或 VPN。",
 			resetExpired: "本次确认已失效，请重新开始。",
 			resetInProgress: "额度重置正在处理中。",
 			resetTooEarly: "请等待冷静期结束后再确认。",
@@ -6643,7 +6650,13 @@ window.__ModuleLoader__.load({
 			resetNoCredit: "No quota reset is available.",
 			resetAlready: "This reset request was already processed.",
 			resetFailed: "Could not use the quota reset.",
+			accountQuotaLeft: "{label} {value}% left",
+			accountQuotaResets: "resets {value}",
+			accountQuotaLoading: "Reading quota…",
+			accountQuotaError: "The quota of this account could not be read right now",
+			accountQuotaNone: "No quota window reported",
 			resetRenewLogin: "Your sign-in expired. Sign in again.",
+			resetBlocked: "ChatGPT network protection blocked this request (HTTP 403). Your sign-in is fine; try again later or check your network, proxy or VPN.",
 			resetExpired: "This confirmation expired. Start again.",
 			resetInProgress: "A quota reset is already in progress.",
 			resetTooEarly: "Wait for the cooldown before confirming.",
@@ -6849,6 +6862,9 @@ window.__ModuleLoader__.load({
 .codexSubscriptionAccounts{display:flex;flex-direction:column;border-top:1px solid var(--dsw-alias-border-l2)}
 .codexSubscriptionAccount{display:flex;align-items:center;justify-content:space-between;gap:10px;min-height:42px;border-bottom:1px solid var(--dsw-alias-border-l2);font-size:13px}
 .codexSubscriptionAccount:last-child{border-bottom:0}
+.codexSubscriptionAccountMain{display:flex;flex-direction:column;gap:2px;padding:6px 0;min-width:0}
+.codexSubscriptionAccountQuota{display:flex;flex-wrap:wrap;gap:2px 12px;font-size:12px;color:var(--dsw-alias-text-l2)}
+.codexSubscriptionAccountQuota[data-state=error]{color:var(--dsw-alias-text-danger,#c0392b)}
 .codexSubscriptionAccount[data-active=true] .codexSubscriptionEmail,.codexSubscriptionAccount[data-active=true]>span{font-weight:600}
 .codexSubscriptionEmail{max-width:100%;overflow:hidden;padding:2px 4px;border:0;border-radius:5px;background:transparent;color:var(--dsw-alias-label-primary);font:inherit;text-align:left;text-overflow:ellipsis;white-space:nowrap;cursor:pointer}
 .codexSubscriptionEmail:hover{background:var(--dsw-alias-interactive-bg-hover)}
@@ -9078,7 +9094,9 @@ window.__ModuleLoader__.load({
 			return `${local[0]}•••${local.at(-1)}@${domain}`;
 		};
 		const hours = (seconds) => Math.round(seconds / 3600 * 10) / 10;
-		const percent = (value) => Number(value).toLocaleString(void 0, { maximumFractionDigits: 1 });
+		/** The language DSH shows its interface in, so dates and numbers match the text around them rather than the OS. */
+		const uiLocale = () => typeof document === "undefined" ? void 0 : document.documentElement.lang || void 0;
+		const percent = (value) => Number(value).toLocaleString(uiLocale(), { maximumFractionDigits: 1 });
 		const isApproximateWindow = (seconds, expected) => seconds >= expected * .95 && seconds <= expected * 1.05;
 		const windowLabel = (seconds, t) => {
 			if (isApproximateWindow(seconds, 18e3)) return t("windowFiveHours");
@@ -9155,7 +9173,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region src/version.js
-		const PACKAGE_VERSION = "2.6.8";
+		const PACKAGE_VERSION = "2.7.0";
 		//#endregion
 		//#region src/client-recovery.js
 		async function recoveryCall(rpc, endpoint, payload = {}, timeoutMs = 1e4) {
@@ -9383,7 +9401,7 @@ window.__ModuleLoader__.load({
 		}
 		function shortReset(quota, t) {
 			if (!Number.isSafeInteger(quota.resetsAt)) return t("resetUnknown");
-			const value = (/* @__PURE__ */ new Date(quota.resetsAt * 1e3)).toLocaleString(void 0, {
+			const value = (/* @__PURE__ */ new Date(quota.resetsAt * 1e3)).toLocaleString(uiLocale(), {
 				month: "numeric",
 				day: "numeric",
 				hour: "2-digit",
@@ -11152,6 +11170,73 @@ window.__ModuleLoader__.load({
 			}
 		}
 		//#endregion
+		//#region src/client-account-quota.jsx
+		const when = (seconds) => (/* @__PURE__ */ new Date(seconds * 1e3)).toLocaleString(uiLocale(), {
+			month: "numeric",
+			day: "numeric",
+			hour: "2-digit",
+			minute: "2-digit"
+		});
+		/** Quota of every signed-in account (read-only; the active account does not change). */
+		function useAccountQuotas(rpc, ids) {
+			const [entries, setEntries] = (0, react.useState)({});
+			const [busy, setBusy] = (0, react.useState)(false);
+			const request = (0, react.useRef)(0);
+			const key = ids.join(",");
+			const load = (force) => {
+				if (ids.length < 2) {
+					setEntries({});
+					return;
+				}
+				const id = ++request.current;
+				setBusy(true);
+				recoveryCall(rpc, "usage/accounts", { force }).then((value) => {
+					if (request.current === id) setEntries(Object.fromEntries((value?.accounts ?? []).map((entry) => [entry.id, entry])));
+				}).catch(() => {
+					if (request.current === id) setEntries(Object.fromEntries(ids.map((account) => [account, {
+						id: account,
+						error: "Could not read ChatGPT usage"
+					}])));
+				}).finally(() => {
+					if (request.current === id) setBusy(false);
+				});
+			};
+			(0, react.useEffect)(() => {
+				load(false);
+				return () => {
+					request.current += 1;
+				};
+			}, [key]);
+			return {
+				entries,
+				busy,
+				refresh: () => load(true)
+			};
+		}
+		function AccountQuota({ entry, loading, t }) {
+			if (entry === void 0) return loading ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("small", {
+				className: "codexSubscriptionAccountQuota",
+				children: t("accountQuotaLoading")
+			}) : null;
+			if (entry.error !== void 0) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("small", {
+				className: "codexSubscriptionAccountQuota",
+				"data-state": "error",
+				children: entry.error === "ChatGPT sign-in needs to be renewed" ? t("resetRenewLogin") : t("accountQuotaError")
+			});
+			const windows = entry.usage?.rateLimits?.find((limit) => limit.id === "codex")?.windows ?? [];
+			if (windows.length === 0) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("small", {
+				className: "codexSubscriptionAccountQuota",
+				children: t("accountQuotaNone")
+			});
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("small", {
+				className: "codexSubscriptionAccountQuota",
+				children: windows.map((window) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", { children: [fill(t("accountQuotaLeft"), {
+					label: windowLabel(window.windowSeconds, t),
+					value: percent(window.remainingPercent)
+				}), window.resetsAt === void 0 ? "" : ` · ${fill(t("accountQuotaResets"), { value: when(window.resetsAt) })}`] }, window.windowSeconds))
+			});
+		}
+		//#endregion
 		//#region src/client-account.jsx
 		const LOGIN_FAILURES = [
 			"account-claim",
@@ -11173,6 +11258,7 @@ window.__ModuleLoader__.load({
 				children: emailVisible ? candidate.email : maskEmail(candidate.email)
 			});
 		}
+		const signedInIds = (account) => account?.authenticated === true ? (account.accounts ?? []).map((candidate) => candidate.id).filter((id) => typeof id === "string") : [];
 		function AccountCard({ rpc, t, account, setAccount, onSignedOut }) {
 			const [flow, setFlow] = (0, react.useState)();
 			const flowGeneration = (0, react.useRef)(0);
@@ -11185,6 +11271,7 @@ window.__ModuleLoader__.load({
 			const [emailVisibilityKey, setEmailVisibilityKey] = (0, react.useState)(accountVisibilityKey);
 			const [busy, setBusy] = (0, react.useState)(false);
 			const [error, setError] = (0, react.useState)();
+			const quotas = useAccountQuotas(rpc, signedInIds(account));
 			const call = (endpoint, payload = {}) => recoveryCall(rpc, endpoint, payload);
 			(0, react.useEffect)(() => {
 				if (emailVisibilityKey === accountVisibilityKey) return;
@@ -11380,12 +11467,19 @@ window.__ModuleLoader__.load({
 						children: accounts.map((candidate) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 							className: "codexSubscriptionAccount",
 							"data-active": candidate.active,
-							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(AccountEmail, {
-								candidate,
-								fallback: candidate.label,
-								t,
-								emailVisible: emailVisibleForAccount,
-								onClick: toggleEmail
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "codexSubscriptionAccountMain",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(AccountEmail, {
+									candidate,
+									fallback: candidate.label,
+									t,
+									emailVisible: emailVisibleForAccount,
+									onClick: toggleEmail
+								}), accounts.length > 1 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(AccountQuota, {
+									entry: quotas.entries[candidate.id],
+									loading: quotas.busy,
+									t
+								}) : null]
 							}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								className: "codexSubscriptionActions",
 								children: [
@@ -11789,7 +11883,7 @@ window.__ModuleLoader__.load({
 							children: [
 								t("diagnosticsSnapshotTime"),
 								" ",
-								new Date(report.generatedAt).toLocaleString()
+								new Date(report.generatedAt).toLocaleString(uiLocale())
 							]
 						}) : null,
 						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
@@ -11807,7 +11901,7 @@ window.__ModuleLoader__.load({
 									" · ",
 									t(`diagnosticSource_${event.source}`),
 									" · ",
-									new Date(event.observedAt).toLocaleTimeString()
+									new Date(event.observedAt).toLocaleTimeString(uiLocale())
 								] }, `${event.source}:${event.action}`)) }) : null
 							] }, item.code)) }) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("diagnosticsNoRecordedFailure") })
 						}),
@@ -11825,7 +11919,7 @@ window.__ModuleLoader__.load({
 							] }) }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("tbody", { children: (report.inspection?.capabilities ?? []).map((item) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("tr", { children: [
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: t(`diagnosticCapability_${item.id}`) }),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("td", { children: [t(`diagnosticReason_${item.reason}`), item.blockedBy ? ` · ${t(`diagnosticCapability_${item.blockedBy}`)}` : ""] }),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("td", { children: [item.latest ? `${item.latest.action} · ${t(`diagnosticSource_${item.latest.source}`)} · ${t(`diagnosticOutcome_${item.latest.status}`)} · ${new Date(item.latest.observedAt).toLocaleTimeString()}` : t("diagnosticsUnverified"), item.unresolved?.length ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("diagnosticsUnresolved") }) : null] })
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("td", { children: [item.latest ? `${item.latest.action} · ${t(`diagnosticSource_${item.latest.source}`)} · ${t(`diagnosticOutcome_${item.latest.status}`)} · ${new Date(item.latest.observedAt).toLocaleTimeString(uiLocale())}` : t("diagnosticsUnverified"), item.unresolved?.length ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("diagnosticsUnresolved") }) : null] })
 							] }, item.id)) })]
 						}),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
@@ -11972,8 +12066,8 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region src/client-usage.jsx
-		const count = (value) => Number(value).toLocaleString();
-		const creditAmount = (value) => Number.isFinite(Number(value)) && String(value).trim() !== "" ? Number(value).toLocaleString(void 0, { maximumFractionDigits: 2 }) : value;
+		const count = (value) => Number(value).toLocaleString(uiLocale());
+		const creditAmount = (value) => Number.isFinite(Number(value)) && String(value).trim() !== "" ? Number(value).toLocaleString(uiLocale(), { maximumFractionDigits: 2 }) : value;
 		function CreditExpiry({ credits, t }) {
 			const date = validDate(credits.expiresAt);
 			if (date === void 0 || credits.unlimited) return null;
@@ -11984,7 +12078,7 @@ window.__ModuleLoader__.load({
 				"data-soon": status.soon,
 				role: "status",
 				children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", { children: [fill(t(status.daysLeft === 0 ? "creditsExpiredToday" : "creditsExpires"), {
-					date: date.toLocaleDateString(),
+					date: date.toLocaleDateString(uiLocale()),
 					days: status.daysLeft
 				}), estimate ? ` ${t("creditsExpiryEstimate")}` : ""] })
 			});
@@ -11992,7 +12086,7 @@ window.__ModuleLoader__.load({
 		function ResetTime({ resetsAt, t }) {
 			const date = Number.isSafeInteger(resetsAt) ? validDate(resetsAt * 1e3) : void 0;
 			if (date === void 0) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("resetUnknown") });
-			const value = date.toLocaleString(void 0, {
+			const value = date.toLocaleString(uiLocale(), {
 				month: "numeric",
 				day: "numeric",
 				hour: "2-digit",
@@ -12000,7 +12094,7 @@ window.__ModuleLoader__.load({
 			});
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("time", {
 				dateTime: date.toISOString(),
-				title: date.toLocaleString(),
+				title: date.toLocaleString(uiLocale()),
 				children: fill(t("resets"), { value })
 			});
 		}
@@ -12010,8 +12104,8 @@ window.__ModuleLoader__.load({
 				className: "codexSubscriptionResetExpiry",
 				children: date === void 0 ? t("resetCreditExpiryUnknown") : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("time", {
 					dateTime: date.toISOString(),
-					title: date.toLocaleString(),
-					children: fill(t("resetCreditExpires"), { value: date.toLocaleDateString(void 0, {
+					title: date.toLocaleString(uiLocale()),
+					children: fill(t("resetCreditExpires"), { value: date.toLocaleDateString(uiLocale(), {
 						month: "long",
 						day: "numeric"
 					}) })
@@ -12203,6 +12297,7 @@ window.__ModuleLoader__.load({
 			return t((/* @__PURE__ */ new Map([
 				["ChatGPT subscription is not signed in", "resetRenewLogin"],
 				["ChatGPT sign-in needs to be renewed", "resetRenewLogin"],
+				["ChatGPT blocked this request before it reached your account (HTTP 403); your sign-in is fine, try again later or check your network, proxy or VPN", "resetBlocked"],
 				["No quota reset is available", "resetNoCredit"],
 				["No usable quota reset is available", "resetNoCredit"],
 				["The available quota reset expires too soon", "resetExpired"],
@@ -12265,7 +12360,7 @@ window.__ModuleLoader__.load({
 							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", { children: t("usage") }), fetchedAt === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("time", {
 								className: "codexSubscriptionFreshness",
 								dateTime: fetchedAt.toISOString(),
-								children: fill(t("usageUpdated"), { value: fetchedAt.toLocaleString() })
+								children: fill(t("usageUpdated"), { value: fetchedAt.toLocaleString(uiLocale()) })
 							})]
 						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Button, {
 							className: "codexSubscriptionRefresh",

package/lib/index.js

@@ -12,7 +12,7 @@ import { clientRequestSchema } from "@deepseek-ai/dsh-client-connection";
 import { lstat, mkdir, open, readFile, rename, rm, stat } from "node:fs/promises";
 import { constants, readFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import * as dshLlm from "@deepseek-ai/dsh-llm";
 import { createUserMessage } from "@deepseek-ai/dsh-llm";
@@ -1135,6 +1135,7 @@ const RPC_ENDPOINTS = Object.freeze([
 	"account/select",
 	"account/remove",
 	"usage",
+	"usage/accounts",
 	"diagnostics",
 	"preferences/status",
 	"preferences/models",
@@ -2087,9 +2088,36 @@ function inheritedOriginalImageRef(session, assetId) {
 }
 //#endregion
 //#region src/version.js
-const PACKAGE_VERSION = "2.6.8";
+const PACKAGE_VERSION = "2.7.0";
 const USER_AGENT = `dsh-codex-subscription/${PACKAGE_VERSION}`;
 //#endregion
+//#region src/http-failure.js
+const SIGN_IN_RENEW = "ChatGPT sign-in needs to be renewed";
+const REQUEST_BLOCKED = "ChatGPT blocked this request before it reached your account (HTTP 403); your sign-in is fine, try again later or check your network, proxy or VPN";
+const CHALLENGE_MARKERS = /just a moment|cf-chl|_cf_chl_opt|attention required|enable javascript and cookies|challenge-platform/iu;
+/** Whether error text is a Cloudflare / network-protection page (pi-ai keeps only the body of a failed request, not its status). */
+const isChallengePage = (text) => typeof text === "string" && /^\s*<(?:!doctype|html)/iu.test(text) && CHALLENGE_MARKERS.test(text);
+/** Whether a 403 response is a Cloudflare / network-protection page rather than an answer from the ChatGPT backend. */
+async function isBlockedByNetwork(response) {
+	if (response?.status !== 403) return false;
+	try {
+		const header = (name) => String(response.headers?.get?.(name) ?? "");
+		if (/challenge/iu.test(header("cf-mitigated"))) return true;
+		if (!/html/iu.test(header("content-type"))) return false;
+		if (/cloudflare/iu.test(header("server"))) return true;
+		const text = typeof response.clone === "function" ? (await response.clone().text()).slice(0, 8192) : "";
+		return CHALLENGE_MARKERS.test(text);
+	} catch {
+		return false;
+	}
+}
+/** The error message for a 401 or 403 answer, or undefined for any other status. */
+async function authFailureMessage(response) {
+	if (response?.status === 401) return SIGN_IN_RENEW;
+	if (response?.status !== 403) return void 0;
+	return await isBlockedByNetwork(response) ? REQUEST_BLOCKED : SIGN_IN_RENEW;
+}
+//#endregion
 //#region src/codex-images.js
 const CODEX_IMAGE_TOOL_NAME = "codex_image_generate";
 const CODEX_IMAGE_GENERATION_URL = "https://chatgpt.com/backend-api/codex/images/generations";
@@ -2592,7 +2620,8 @@ function createCodexImageTool(options) {
 				throw new Error(`Codex image ${editing ? "edit" : "generation"} request failed${requestFailureReason(error)}`, { cause: error });
 			}
 			if (!response.ok) {
-				if (response.status === 401 || response.status === 403) throw new Error("ChatGPT sign-in needs to be renewed");
+				const authFailure = await authFailureMessage(response);
+				if (authFailure !== void 0) throw new Error(authFailure);
 				const requestId = supportId(response);
 				if (response.status === 429) throw new Error(`${await limitMessage(response)}${requestId}`);
 				throw new Error(`Codex image ${editing ? "edit" : "generation"} failed (HTTP ${response.status})${requestId}`);
@@ -2770,6 +2799,37 @@ function retryPolicyFor(choice, resolve) {
 	}
 }
 //#endregion
+//#region src/request-observer.js
+const failureOf = (chunk) => chunk?.reason?.kind === "error" ? chunk.reason.failure : void 0;
+function observed(stream, options, provider) {
+	return (async function* () {
+		try {
+			for await (const chunk of stream(options)) {
+				const failure = failureOf(chunk);
+				if (failure !== void 0 && !options?.signal?.aborted) provider.noteAdapterFailure?.("failure", options, failure);
+				yield chunk;
+			}
+		} catch (error) {
+			if (!options?.signal?.aborted) provider.noteAdapterFailure?.("thrown", options, error);
+			throw error;
+		}
+	})();
+}
+function observeAdapter(adapter, provider) {
+	return new Proxy(adapter, { get(target, property) {
+		if (property === "stream") return (options) => observed((o) => target.stream(o), options, provider);
+		if (property === "prepareCall") return async (...args) => {
+			const call = await target.prepareCall(...args);
+			return {
+				...call,
+				stream: (options) => observed((o) => call.stream(o), options, provider)
+			};
+		};
+		const value = Reflect.get(target, property, target);
+		return typeof value === "function" ? value.bind(target) : value;
+	} });
+}
+//#endregion
 //#region src/account-vault.js
 const VERSION = 1;
 const DEFAULT_LABEL = "Account 1";
@@ -2969,6 +3029,42 @@ var DshOAuthAccountVault = class {
 			return clone$1(payload?.accounts.find((account) => account.id === payload.activeId)?.credential);
 		});
 	}
+	/** One account's credential, whether or not it is the active one. */
+	readAccount(id) {
+		return this.#enqueue(async () => {
+			const payload = await this.#ensurePayload();
+			return clone$1(payload?.accounts.find((account) => account.id === id)?.credential);
+		});
+	}
+	/** Update one account's credential (a token refresh) without changing which account is active. */
+	modifyAccount(id, update) {
+		return this.#enqueue(async () => {
+			let result;
+			await this.#modifyPayload(async (current) => {
+				const index = current.accounts.findIndex((account) => account.id === id);
+				if (index < 0) throw new Error("Unknown Codex account");
+				const previous = clone$1(current.accounts[index].credential);
+				const next = await update(previous);
+				if (next === void 0) {
+					result = previous;
+					return current;
+				}
+				const credential = sanitizeOAuthCredential(next);
+				if (credential.email === void 0 && previous.email !== void 0) credential.email = previous.email;
+				const accounts = [...current.accounts];
+				accounts[index] = {
+					...accounts[index],
+					credential
+				};
+				result = clone$1(credential);
+				return {
+					...current,
+					accounts
+				};
+			});
+			return result;
+		});
+	}
 	activeId() {
 		return this.#enqueue(async () => (await this.#ensurePayload())?.activeId);
 	}
@@ -3068,11 +3164,11 @@ var DshOAuthAccountVault = class {
 };
 //#endregion
 //#region src/credential-store.js
-const PROVIDER$1 = "openai-codex";
+const PROVIDER$2 = "openai-codex";
 const abortIfNeeded = (options) => options?.signal?.throwIfAborted();
 const clone = (value) => value === void 0 ? void 0 : structuredClone(value);
-function assertProvider(providerId) {
-	if (providerId !== PROVIDER$1) throw new Error(`Codex credential store does not own provider ${JSON.stringify(providerId)}`);
+function assertProvider$1(providerId) {
+	if (providerId !== PROVIDER$2) throw new Error(`Codex credential store does not own provider ${JSON.stringify(providerId)}`);
 }
 function assertOAuthCredential(value) {
 	if (value === void 0) return void 0;
@@ -3105,7 +3201,7 @@ var DshOAuthCredentialStore = class {
 		this.vault = options.vault;
 	}
 	#enqueue(providerId, operation, options) {
-		assertProvider(providerId);
+		assertProvider$1(providerId);
 		const current = (this.#chains.get(providerId) ?? Promise.resolve()).catch(() => void 0).then(async () => {
 			abortIfNeeded(options);
 			return operation();
@@ -3118,7 +3214,7 @@ var DshOAuthCredentialStore = class {
 		return current;
 	}
 	async #read(providerId, options) {
-		assertProvider(providerId);
+		assertProvider$1(providerId);
 		abortIfNeeded(options);
 		if (this.vault !== void 0) {
 			const current = await this.vault.readActive();
@@ -3151,8 +3247,8 @@ var DshOAuthCredentialStore = class {
 	}
 	async list(options) {
 		abortIfNeeded(options);
-		return await this.read(PROVIDER$1, options) === void 0 ? [] : [{
-			providerId: PROVIDER$1,
+		return await this.read(PROVIDER$2, options) === void 0 ? [] : [{
+			providerId: PROVIDER$2,
 			type: "oauth"
 		}];
 	}
@@ -3202,16 +3298,16 @@ function createCodexAuthService(models, store, options = {}) {
 	const createPendingStore = options.createPendingStore ?? (() => new PendingOAuthCredentialStore());
 	return Object.freeze({
 		async status(options) {
-			const current = await store.read(PROVIDER$1, options);
+			const current = await store.read(PROVIDER$2, options);
 			const accounts = await accountVault?.list();
 			if (current === void 0) return {
 				authenticated: false,
-				provider: PROVIDER$1,
+				provider: PROVIDER$2,
 				...accounts === void 0 ? {} : { accounts }
 			};
 			return {
 				authenticated: true,
-				provider: PROVIDER$1,
+				provider: PROVIDER$2,
 				type: "oauth",
 				expiresAt: current.expires,
 				...accounts === void 0 ? {} : { accounts }
@@ -3222,13 +3318,13 @@ function createCodexAuthService(models, store, options = {}) {
 				if (accountVault === void 0 || createLoginModels === void 0) throw new Error("Codex multi-account is unavailable");
 				return runLogin(async () => {
 					const pending = createPendingStore();
-					await createLoginModels(pending).login(PROVIDER$1, "oauth", interaction);
+					await createLoginModels(pending).login(PROVIDER$2, "oauth", interaction);
 					const credential = pending.credential();
 					if (credential === void 0) throw new Error("Codex login did not return credentials");
 					await accountVault.add(input.label, credential);
 				});
 			}
-			return runLogin(() => models.login(PROVIDER$1, "oauth", interaction));
+			return runLogin(() => models.login(PROVIDER$2, "oauth", interaction));
 		},
 		async select(id) {
 			if (accountVault === void 0) throw new Error("Codex multi-account is unavailable");
@@ -3241,7 +3337,7 @@ function createCodexAuthService(models, store, options = {}) {
 			return this.status();
 		},
 		logout(options) {
-			return models.logout(PROVIDER$1, options);
+			return models.logout(PROVIDER$2, options);
 		}
 	});
 }
@@ -3644,13 +3740,146 @@ function createCodexRpcHandler(coordinator, options = {}) {
 	};
 }
 //#endregion
+//#region src/failure-capture.js
+const KEEP = /* @__PURE__ */ new Set([
+	"method",
+	"type",
+	"role",
+	"name",
+	"api",
+	"provider",
+	"model",
+	"stopReason",
+	"reasoning",
+	"reasoningEffort",
+	"transport",
+	"mimeType",
+	"kind",
+	"effort",
+	"toolChoice",
+	"cacheRetention",
+	"textVerbosity",
+	"serviceTier"
+]);
+const DROP = /* @__PURE__ */ new Set([
+	"apiKey",
+	"headers",
+	"env",
+	"authorization",
+	"token",
+	"signal",
+	"fetch",
+	"cookie"
+]);
+const MAX_DEPTH = 10;
+const MAX_ARRAY = 40;
+const MAX_KEYS = 80;
+const MAX_NODES = 4e3;
+const MAX_TEXT = 64;
+const UNDEFINED_MARKER = "$undefined";
+function redactRequest(value) {
+	let nodes = 0;
+	const walk = (item, key, depth) => {
+		nodes += 1;
+		if (nodes > MAX_NODES) return { $truncated: "nodes" };
+		if (item === void 0) return { [UNDEFINED_MARKER]: true };
+		if (item === null || typeof item === "boolean") return item;
+		if (typeof item === "number") return Number.isFinite(item) ? item : { $number: String(item) };
+		if (typeof item === "bigint" || typeof item === "symbol") return { $type: typeof item };
+		if (typeof item === "function") return { $type: "function" };
+		if (typeof item === "string") {
+			if (KEEP.has(key) && item.length <= MAX_TEXT) return item;
+			return item.length <= MAX_TEXT ? "x".repeat(item.length) : { $text: item.length };
+		}
+		if (depth >= MAX_DEPTH) return { $truncated: "depth" };
+		if (Array.isArray(item)) {
+			const list = [];
+			for (let index = 0; index < Math.min(item.length, MAX_ARRAY); index += 1) list.push(index in item ? walk(item[index], key, depth + 1) : { $hole: true });
+			return item.length > MAX_ARRAY ? [...list, { $more: item.length - MAX_ARRAY }] : list;
+		}
+		if (item instanceof Uint8Array) return { $bytes: item.byteLength };
+		if (typeof item === "object") {
+			const entries = Object.keys(item).filter((name) => !DROP.has(name));
+			const out = {};
+			for (const name of entries.slice(0, MAX_KEYS)) out[name] = walk(item[name], name, depth + 1);
+			if (entries.length > MAX_KEYS) out.$moreKeys = entries.length - MAX_KEYS;
+			return out;
+		}
+		return { $type: typeof item };
+	};
+	return walk(value, "", 0);
+}
+//#endregion
+//#region src/pi-ai-compat.js
+const versionOf = (specifier) => {
+	try {
+		let path = fileURLToPath(import.meta.resolve(specifier));
+		for (let depth = 0; depth < 6; depth += 1) {
+			path = path.replace(/[\\/][^\\/]+$/u, "");
+			try {
+				const manifest = JSON.parse(readFileSync(`${path}/package.json`, "utf8"));
+				if (typeof manifest.version === "string") return manifest.version;
+			} catch {}
+		}
+	} catch {}
+};
+let cached;
+/** Versions of the pi-ai library and of DSH's adapter this plugin runs against. */
+function runtimeVersions() {
+	cached ??= {
+		piAi: versionOf("@earendil-works/pi-ai"),
+		adapter: versionOf("@deepseek-ai/dsh-llm-pi-ai")
+	};
+	return cached;
+}
+const atLeast087 = (version) => {
+	const match = /^(\d+)\.(\d+)/u.exec(version ?? "");
+	return match !== null && (Number(match[1]) > 0 || Number(match[2]) >= 87);
+};
+/** Whether the installed pi-ai understands system messages inside the transcript. */
+const understandsSystemMessages = (version) => atLeast087(version);
+const textOf = (content) => typeof content === "string" ? content : Array.isArray(content) ? content.filter((block) => block?.type === "text" && typeof block.text === "string").map((block) => block.text).join("\n") : "";
+/**
+* Fold the transcript's leading system messages back into `systemPrompt` and `tools`,
+* the form every pi-ai release accepts. Messages after the first non-system one stay.
+*/
+function hoistLeadingSystem(context) {
+	const messages = context?.messages;
+	if (!Array.isArray(messages) || messages[0]?.role !== "system") return context;
+	let end = 0;
+	const texts = context.systemPrompt ? [context.systemPrompt] : [];
+	const tools = [...Array.isArray(context.tools) ? context.tools : []];
+	while (messages[end]?.role === "system") {
+		const message = messages[end];
+		const text = [textOf(message.content), ...Object.values(message.sections ?? {}).filter((value) => typeof value === "string")].filter(Boolean).join("\n\n");
+		if (text !== "") texts.push(text);
+		if (Array.isArray(message.toolsAdded)) tools.push(...message.toolsAdded);
+		end += 1;
+	}
+	const { systemPrompt: _systemPrompt, tools: _tools, ...rest } = context;
+	const systemPrompt = texts.join("\n\n");
+	return {
+		...rest,
+		...systemPrompt === "" ? {} : { systemPrompt },
+		...tools.length === 0 ? {} : { tools },
+		messages: messages.slice(end)
+	};
+}
+//#endregion
 //#region src/transport-failure.js
-const TRANSIENT_WEBSOCKET_CLOSE = /^WebSocket closed (?:1006|1011|1012|1013)(?:\s|$)/;
+const TRANSIENT_WEBSOCKET_CLOSE = /^WebSocket closed (?:1000|1006|1011|1012|1013)(?:\s|$)/;
 const GATEWAY_REPLAY_BUFFER_EXCEEDED = /^\s*exceeded request buffer limit while retrying upstream\s*$/;
 function normalizeTransportEvent(event, signal) {
 	if (signal?.aborted || event?.type !== "error" || event.reason !== "error") return event;
 	const message = event.error?.errorMessage;
 	if (typeof message !== "string") return event;
+	if (isChallengePage(message)) return {
+		...event,
+		error: {
+			...event.error,
+			errorMessage: REQUEST_BLOCKED
+		}
+	};
 	if (!TRANSIENT_WEBSOCKET_CLOSE.test(message) && !GATEWAY_REPLAY_BUFFER_EXCEEDED.test(message)) return event;
 	return {
 		...event,
@@ -3806,6 +4035,36 @@ function openaiCodexSubscriptionProvider({ resolveSpeedMode = () => void 0, reso
 		sessionModel: 0,
 		retries: 0
 	};
+	const streamFailure = {
+		count: 0,
+		stage: void 0,
+		frame: void 0,
+		request: void 0,
+		adapter: void 0
+	};
+	const noteAdapterFailure = (kind, adapterOptions, failure) => {
+		try {
+			streamFailure.adapter = {
+				kind,
+				...typeof failure?.code === "string" ? { code: failure.code.slice(0, 40) } : {},
+				message: String(failure?.message ?? "").slice(0, 160),
+				request: redactRequest(adapterOptions)
+			};
+		} catch {
+			streamFailure.adapter = void 0;
+		}
+	};
+	const noteStreamFailure = (stage, error, source) => {
+		streamFailure.count += 1;
+		streamFailure.stage = stage;
+		try {
+			streamFailure.request = source === void 0 ? void 0 : redactRequest(source);
+		} catch {
+			streamFailure.request = void 0;
+		}
+		const frame = typeof error?.stack === "string" ? /([\w.@-]+[\\/][\w.-]+\.[cm]?[jt]sx?):(\d+):(\d+)/u.exec(error.stack.split("\n").slice(1).join("\n")) : null;
+		streamFailure.frame = frame ? `${frame[1].replaceAll("\\", "/")}:${frame[2]}:${frame[3]}` : void 0;
+	};
 	const reviewRoute = (model, context) => {
 		if (resolveReviewModel() !== "official" || !isDshAutoReview(context)) return void 0;
 		review.requests += 1;
@@ -3860,22 +4119,40 @@ function openaiCodexSubscriptionProvider({ resolveSpeedMode = () => void 0, reso
 		};
 		return { [Symbol.asyncIterator]: () => replay ??= run() };
 	};
-	const networkIterable = (factory, options, direct = false) => {
+	const networkIterable = (factory, options, direct = false, source) => {
 		let iterator;
 		let prepared;
+		let stage = "prepare";
 		const step = async (method, value) => {
-			const request = await (prepared ??= (direct ? void 0 : connection?.prepare(options)) ?? Promise.resolve({ options }));
-			const result = await runNetwork("model", () => {
-				iterator ??= factory(direct ? request.options : compaction?.requestOptions(request.options) ?? request.options)[Symbol.asyncIterator]();
-				return iterator[method]?.(value) ?? (method === "throw" ? Promise.reject(value) : Promise.resolve({
-					done: true,
-					value
-				}));
-			}, direct ? request.network : compaction?.networkOptions(request.network) ?? request.network);
-			return result.done ? result : {
-				...result,
-				value: normalizeTransportEvent(result.value, request.options?.signal)
-			};
+			try {
+				const request = await (prepared ??= (direct ? void 0 : connection?.prepare(options)) ?? Promise.resolve({ options }));
+				if (stage === "prepare") stage = "request";
+				const result = await runNetwork("model", () => {
+					const next = direct ? request.options : compaction?.requestOptions(request.options) ?? request.options;
+					iterator ??= factory({
+						...next,
+						async onPayload(payload, requestModel) {
+							stage = "payload";
+							return next.onPayload?.(payload, requestModel);
+						}
+					})[Symbol.asyncIterator]();
+					return iterator[method]?.(value) ?? (method === "throw" ? Promise.reject(value) : Promise.resolve({
+						done: true,
+						value
+					}));
+				}, direct ? request.network : compaction?.networkOptions(request.network) ?? request.network);
+				if (!result.done) {
+					if (result.value?.type === "error" && !request.options?.signal?.aborted) noteStreamFailure(stage, void 0, source);
+					else if (stage === "payload") stage = "stream";
+				}
+				return result.done ? result : {
+					...result,
+					value: normalizeTransportEvent(result.value, request.options?.signal)
+				};
+			} catch (error) {
+				noteStreamFailure(stage, error, source);
+				throw error;
+			}
 		};
 		return {
 			[Symbol.asyncIterator]() {
@@ -3889,9 +4166,16 @@ function openaiCodexSubscriptionProvider({ resolveSpeedMode = () => void 0, reso
 			throw: (error) => iterator ? step("throw", error) : Promise.reject(error)
 		};
 	};
-	const routed = (method, model, context, options) => {
+	const routed = (method, model, transcript, options) => {
+		const context = understandsSystemMessages(runtimeVersions().piAi) ? transcript : hoistLeadingSystem(transcript);
 		const route = reviewRoute(model, context);
-		const create = () => route === void 0 ? networkIterable((prepared) => provider[method](model, context, prepared), withPreferences(model, options)) : networkIterable((prepared) => provider[method](model, context, prepared), withReview(route, options), true);
+		const source = {
+			method,
+			model,
+			context,
+			options
+		};
+		const create = () => route === void 0 ? networkIterable((prepared) => provider[method](model, context, prepared), withPreferences(model, options), false, source) : networkIterable((prepared) => provider[method](model, context, prepared), withReview(route, options), true, source);
 		return isDshAutoReview(context) ? reviewIterable(create) : create();
 	};
 	return Object.freeze({
@@ -3903,7 +4187,9 @@ function openaiCodexSubscriptionProvider({ resolveSpeedMode = () => void 0, reso
 		getModels,
 		stream: (model, context, options) => routed("stream", model, context, options),
 		streamSimple: (model, context, options) => routed("streamSimple", model, context, options),
-		reviewCounters: () => ({ ...review })
+		reviewCounters: () => ({ ...review }),
+		streamFailure: () => ({ ...streamFailure }),
+		noteAdapterFailure
 	});
 }
 Object.freeze([
@@ -4318,7 +4604,10 @@ function createCodexSearchProvider(options) {
 				if (signal?.aborted || error?.name === "AbortError") throw new WebError("Codex search aborted", "WEB_ABORTED", { cause: error });
 				throw new WebError("Codex search request failed", "WEB_PROVIDER_ERROR", { cause: error });
 			}
-			if (!response.ok) throw response.status === 401 || response.status === 403 ? new WebError("ChatGPT sign-in needs to be renewed", "WEB_PROVIDER_CREDENTIAL_MISSING") : new WebError(`Codex search request failed (HTTP ${response.status})`, "WEB_PROVIDER_ERROR");
+			if (!response.ok) {
+				const authFailure = await authFailureMessage(response);
+				throw authFailure === "ChatGPT sign-in needs to be renewed" ? new WebError(authFailure, "WEB_PROVIDER_CREDENTIAL_MISSING") : authFailure !== void 0 ? new WebError(authFailure, "WEB_PROVIDER_ERROR") : new WebError(`Codex search request failed (HTTP ${response.status})`, "WEB_PROVIDER_ERROR");
+			}
 			let value;
 			try {
 				value = await response.json();
@@ -4849,6 +5138,15 @@ function safeRequests(network) {
 	}
 	return result;
 }
+/** pi-ai and DSH's adapter come from the host; a profile can pair an adapter with an older library, so the report names both. */
+function libraryVersions() {
+	const { piAi, adapter } = runtimeVersions();
+	const valid = (value) => typeof value === "string" && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]{1,32})?$/u.test(value);
+	return {
+		...valid(piAi) ? { piAi } : {},
+		...valid(adapter) ? { adapter } : {}
+	};
+}
 /** Build a support report that deliberately excludes OAuth and account metadata. */
 async function createSubscriptionDiagnostics({ auth, preferences, login = { phase: "idle" }, network, modelCatalog, connection, compaction, review, inspectionOptions, operations, runtimeManagement, storage, tools }) {
 	const collected = {};
@@ -4914,6 +5212,26 @@ async function createSubscriptionDiagnostics({ auth, preferences, login = { phas
 				"retries"
 			]) : void 0
 		],
+		[
+			"streamFailure",
+			"transport",
+			() => {
+				const value = review?.streamFailure?.();
+				if (!Number.isSafeInteger(value?.count)) return void 0;
+				return {
+					count: value.count,
+					...[
+						"prepare",
+						"request",
+						"payload",
+						"stream"
+					].includes(value.stage) ? { stage: value.stage } : {},
+					...typeof value.frame === "string" && /^[\w.@/-]{1,120}:\d+:\d+$/u.test(value.frame) ? { frame: value.frame } : {},
+					...value.request && typeof value.request === "object" && JSON.stringify(value.request).length <= 12e4 ? { request: value.request } : {},
+					...value.adapter && typeof value.adapter === "object" && JSON.stringify(value.adapter).length <= 12e4 ? { adapter: value.adapter } : {}
+				};
+			}
+		],
 		[
 			"operations",
 			"transport",
@@ -5007,7 +5325,8 @@ async function createSubscriptionDiagnostics({ auth, preferences, login = { phas
 			node: process.version,
 			platform: process.platform,
 			arch: process.arch,
-			...hostDshVersion() ? { dsh: hostDshVersion() } : {}
+			...hostDshVersion() ? { dsh: hostDshVersion() } : {},
+			...libraryVersions()
 		},
 		account,
 		login,
@@ -5017,6 +5336,7 @@ async function createSubscriptionDiagnostics({ auth, preferences, login = { phas
 		...collected.websocket ? { websocket: collected.websocket } : {},
 		...collected.compaction ? { compaction: collected.compaction } : {},
 		...collected.review ? { review: collected.review } : {},
+		...collected.streamFailure ? { streamFailure: collected.streamFailure } : {},
 		...catalog && ["unavailable", "online"].includes(catalog.source) && [
 			"idle",
 			"refreshing",
@@ -5286,7 +5606,7 @@ function createCodexUsageReader(options) {
 			signal: requestSignal$1(signal, timeoutMs)
 		});
 		if (!response.ok) {
-			const error = /* @__PURE__ */ new Error(response.status === 401 || response.status === 403 ? "ChatGPT sign-in needs to be renewed" : `ChatGPT usage request failed (HTTP ${response.status})`);
+			const error = new Error(await authFailureMessage(response) ?? `ChatGPT usage request failed (HTTP ${response.status})`);
 			Object.defineProperty(error, "retryAfterMs", { value: retryAfterMs(response, now, maxRetryAfterMs) });
 			throw error;
 		}
@@ -5337,6 +5657,102 @@ function createCodexUsageReader(options) {
 	});
 }
 //#endregion
+//#region src/account-usage.js
+const PROVIDER$1 = "openai-codex";
+const MAX_PARALLEL = 4;
+const assertProvider = (providerId) => {
+	if (providerId !== PROVIDER$1) throw new Error("Codex account usage received an unknown provider");
+};
+/** pi-ai's OAuth credential store, bound to one account of the vault. */
+function accountCredentialStore(vault, id, expirySkewMs = 0) {
+	const shift = (credential) => credential === void 0 || expirySkewMs === 0 ? credential : {
+		...credential,
+		expires: credential.expires - expirySkewMs
+	};
+	return {
+		async read(providerId) {
+			assertProvider(providerId);
+			return shift(await vault.readAccount(id));
+		},
+		async list() {
+			return await vault.readAccount(id) === void 0 ? [] : [{
+				providerId: PROVIDER$1,
+				type: "oauth"
+			}];
+		},
+		async modify(providerId, update) {
+			assertProvider(providerId);
+			return vault.modifyAccount(id, async (current) => update(shift(current)));
+		},
+		async delete() {
+			throw new Error("An account usage read cannot remove a sign-in");
+		}
+	};
+}
+/**
+* @param {object} options
+* @param {{ list(): Promise<object[]>, readAccount(id: string): Promise<object|undefined>, modifyAccount: Function }} options.vault
+* @param {(credentials: object) => object} options.createModels builds a pi-ai Models over a credential store, with the Codex provider set
+* @param {typeof fetch} options.fetch
+*/
+function createAccountUsageReader({ vault, createModels, fetch, expirySkewMs = 0, now = Date.now, activeReader }) {
+	const readers = /* @__PURE__ */ new Map();
+	const readerFor = (id) => {
+		let reader = readers.get(id);
+		if (reader === void 0) {
+			const models = createModels(accountCredentialStore(vault, id, expirySkewMs));
+			reader = createCodexUsageReader({
+				getAuth: () => models.getAuth(PROVIDER$1),
+				readCredential: () => vault.readAccount(id).then((credential) => credential),
+				fetch,
+				now
+			});
+			readers.set(id, reader);
+		}
+		return reader;
+	};
+	const summarize = (error, signal) => {
+		if (signal?.aborted) throw error;
+		const message = error instanceof Error ? error.message : "";
+		return ["ChatGPT subscription is not signed in", "ChatGPT sign-in needs to be renewed"].includes(message) || message.includes("blocked this request") ? message : "Could not read ChatGPT usage";
+	};
+	return Object.freeze({
+		/** One entry per account: its usage reading, or the reason it could not be read. */
+		async readAll({ force = false, signal } = {}) {
+			const accounts = await vault.list();
+			for (const id of [...readers.keys()]) if (!accounts.some((account) => account.id === id)) readers.delete(id);
+			const entries = new Array(accounts.length);
+			let next = 0;
+			const worker = async () => {
+				while (next < accounts.length) {
+					const index = next++;
+					const account = accounts[index];
+					try {
+						const reader = account.active && activeReader !== void 0 ? activeReader : readerFor(account.id);
+						entries[index] = {
+							id: account.id,
+							usage: await reader.read({
+								force,
+								signal
+							})
+						};
+					} catch (error) {
+						entries[index] = {
+							id: account.id,
+							error: summarize(error, signal)
+						};
+					}
+				}
+			};
+			await Promise.all(Array.from({ length: Math.min(MAX_PARALLEL, accounts.length) }, worker));
+			return entries;
+		},
+		clear() {
+			readers.clear();
+		}
+	});
+}
+//#endregion
 //#region src/quota-retry.js
 const DEFAULT_MAX_WAIT_MS = 360 * 60 * 1e3;
 const DEFAULT_RESET_MARGIN_MS = 1e4;
@@ -6057,7 +6473,7 @@ function createCodexResetCreditService(options) {
 			},
 			signal: requestSignal(signal, timeoutMs)
 		});
-		if (!response.ok) throw new Error(response.status === 401 || response.status === 403 ? "ChatGPT sign-in needs to be renewed" : `ChatGPT quota reset request failed (HTTP ${response.status})`);
+		if (!response.ok) throw new Error(await authFailureMessage(response) ?? `ChatGPT quota reset request failed (HTTP ${response.status})`);
 		let raw;
 		try {
 			raw = await response.json();
@@ -6191,7 +6607,7 @@ function createCodexResetCreditService(options) {
 						throw new Error(UNCERTAIN_RESET_RESULT);
 					}
 					if (response.status !== 401 && response.status !== 403) retryable = false;
-					throw new Error(response.status === 401 || response.status === 403 ? "ChatGPT sign-in needs to be renewed" : `ChatGPT quota reset request failed (HTTP ${response.status})`);
+					throw new Error(await authFailureMessage(response) ?? `ChatGPT quota reset request failed (HTTP ${response.status})`);
 				}
 				let raw;
 				try {
@@ -6233,7 +6649,7 @@ const publicError = (code, message) => ({
 		details: { issues: [] }
 	}
 });
-function createSubscriptionRpcHandler({ authHandler, usageReader, resetCreditService, preferences, defaultModel, runtimeManagement, diagnosticsReader, modelCatalog, originalImages, resolveInheritedOriginal, closeConnections, onAccountChanged, onCleanupFailure }) {
+function createSubscriptionRpcHandler({ authHandler, usageReader, accountUsageReader, resetCreditService, preferences, defaultModel, runtimeManagement, diagnosticsReader, modelCatalog, originalImages, resolveInheritedOriginal, closeConnections, onAccountChanged, onCleanupFailure }) {
 	return async (endpoint, payload, signal) => {
 		if (endpoint === "default-model/status" || endpoint === "default-model/select") try {
 			signal.throwIfAborted();
@@ -6380,10 +6796,27 @@ function createSubscriptionRpcHandler({ authHandler, usageReader, resetCreditSer
 			};
 		} catch (error) {
 			if (signal.aborted) throw error;
-			const known = /* @__PURE__ */ new Set(["ChatGPT subscription is not signed in", "ChatGPT sign-in needs to be renewed"]);
+			const known = /* @__PURE__ */ new Set([
+				"ChatGPT subscription is not signed in",
+				"ChatGPT sign-in needs to be renewed",
+				REQUEST_BLOCKED
+			]);
 			const message = error instanceof Error && known.has(error.message) ? error.message : "Could not read ChatGPT usage";
 			return publicError("internal", message);
 		}
+		if (endpoint === "usage/accounts") try {
+			signal.throwIfAborted();
+			return {
+				ok: true,
+				value: { accounts: await accountUsageReader.readAll({
+					force: payload?.force === true,
+					signal
+				}) }
+			};
+		} catch (error) {
+			if (signal.aborted) throw error;
+			return publicError("internal", "Could not read the usage of the signed-in accounts");
+		}
 		if (endpoint === "reset-credit/inspect" || endpoint === "reset-credit/prepare" || endpoint === "reset-credit/consume") try {
 			signal.throwIfAborted();
 			return {
@@ -6402,6 +6835,7 @@ function createSubscriptionRpcHandler({ authHandler, usageReader, resetCreditSer
 			const known = /* @__PURE__ */ new Set([
 				"ChatGPT subscription is not signed in",
 				"ChatGPT sign-in needs to be renewed",
+				REQUEST_BLOCKED,
 				"No quota reset is available",
 				"No usable quota reset is available",
 				"The available quota reset expires too soon",
@@ -6424,7 +6858,7 @@ function createSubscriptionRpcHandler({ authHandler, usageReader, resetCreditSer
 				() => modelCatalog?.clear(),
 				() => onAccountChanged?.()
 			];
-			if (endpoint === "logout") tasks.push(() => usageReader.clear());
+			if (endpoint === "logout") tasks.push(() => usageReader.clear(), () => accountUsageReader?.clear());
 			if (endpoint === "account/remove" && typeof payload?.id === "string") tasks.push(() => usageReader.clearScope(payload.id));
 			if ((await Promise.allSettled(tasks.map((task) => Promise.resolve().then(task)))).some((value) => value.status === "rejected")) try {
 				onCleanupFailure?.();
@@ -6745,7 +7179,7 @@ function apply(ctx, config = {}) {
 		auth: adapterAuth,
 		resolveAttachments: () => ctx.get?.("attachments")
 	});
-	ctx.llm.registerAdapter([PROVIDER], compaction.wrapAdapter(adapter));
+	ctx.llm.registerAdapter([PROVIDER], observeAdapter(compaction.wrapAdapter(adapter), provider));
 	const currentAgent = () => ctx.get?.("agents")?.currentInitiator?.();
 	const codexSearch = createCodexSearchProvider({
 		resolvePreferences: () => readCapabilitySettings(settings.get()),
@@ -6785,12 +7219,13 @@ function apply(ctx, config = {}) {
 		}
 	});
 	const coordinator = new CodexLoginCoordinator(auth);
+	const baseUsageReader = createCodexUsageReader({
+		getAuth: resolveAuth,
+		readCredential: (options) => store.read(PROVIDER, options),
+		fetch: (input, init) => network.fetch("quota", input, init)
+	});
 	const usageReader = createQuotaForecastReader({
-		reader: createCodexUsageReader({
-			getAuth: resolveAuth,
-			readCredential: (options) => store.read(PROVIDER, options),
-			fetch: (input, init) => network.fetch("quota", input, init)
-		}),
+		reader: baseUsageReader,
 		enabled: () => normalizeQuickQuotaMode(settings.get()[QUICK_QUOTA_MODE_FIELD], settings.get()[LEGACY_QUICK_QUOTA_FIELD]) === QUICK_QUOTA_MODE_FORECAST,
 		scope: async () => await accountVault?.activeId() ?? "legacy",
 		stateStore: new QuotaForecastStateStore({ filename: dshHomePath("state", "codex-subscription", "quota-forecast.json") })
@@ -6864,9 +7299,21 @@ function apply(ctx, config = {}) {
 			sketchBridge.dispose();
 		};
 	}, "codex-subscription: native sketch tool");
+	const accountUsageReader = createAccountUsageReader({
+		vault: accountVault,
+		createModels: (credentials) => {
+			const accountModels = createModels({ credentials });
+			accountModels.setProvider(provider);
+			return accountModels;
+		},
+		fetch: (input, init) => network.fetch("quota", input, init),
+		expirySkewMs: OAUTH_EXPIRY_SKEW_MS,
+		activeReader: baseUsageReader
+	});
 	const subscriptionHandler = createSubscriptionRpcHandler({
 		authHandler: createCodexRpcHandler(coordinator, { openExternal: openCodexAuthUrl }),
 		usageReader,
+		accountUsageReader,
 		resetCreditService,
 		preferences,
 		defaultModel,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-codex-subscription",
-  "version": "2.6.8",
+  "version": "2.7.0",
   "description": "Use ChatGPT and Codex subscriptions in DeepSeek Harness with OAuth, quota, safe resets, web search, images, and Fast mode",
   "type": "module",
   "main": "./lib/index.js",