dsh-connect-agnes-token-plan 0.10.1 → 0.10.2

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 本文件只记**公开行为变化**（新增能力、破坏性改动、重要修复）。实现细节、重构与测试加固请直接看 `git log`。
 
+## [0.10.2] — 2026-10-10
+
+### 修复：视频状态轮询断点续查、额度渲染与模型花名册的几处真实缺陷 + 凭据隔离加固
+
+- **修（视频工具）：异步视频轮询被拒时原本不带 `video_id` 且只走「超时 / 超轮次」两路径**，agent 首次查询拿不到 task id 就无法续查，任务卡在「查不到」。`video-client` 现改为携带 `video_id` 并有限重试（`queryRetries=2` → 初查 + 2 次重试 = 3 次调用），与超时 / 超轮次两条路径对齐。新增 `video.test.mjs` 覆盖耗尽路径与 `queryRetries=0` 边界。
+- **修（额度渲染）：`usagePct` 有值而 `used` 缺失时，`count(null)` 被渲染成 `0`，面板会打印「已用 0 / N」**（F1）。`UsageTotals` 四个主计数另加 `typeof` 门：缺席字段不再画成「0」——真实数据流下此门不触发（`countOf` 已把缺席平台字段压成数字 0、`overview` 失败时 `quota.totals:null` 见红线⑥ / ADR-007），属渲染层自防御，防未来 partial 对象被构造出来。
+- **修（AgnesCode 花名册）：两处目录正确性缺陷**。（F5）排除别名 `id === EXCLUDED_IDS[0]` 改为 `.includes(id)`，第二个别名不再静默失效、继续混进花名册；（F10）`provider-controls` 的 `idList` 用 `String(id)` 强转，`null` 会变成字符串 `"null"` 这个假模型 id 出现在候选列表里，改用 `models.ts` 的 `rosterIds`（只收非空字符串）。
+- **修（凭据隔离）：AgnesCode 的 DPAPI PowerShell 子进程不再继承含凭据的父进程 env**，新增 `dpapiChildEnv` 剥除四枚凭据名（`AGNES_PASSWORD` / `AGNES_USERNAME` / `AGNES_TOKEN_PLAN_API_KEY` / `AGNESCODE_CREDENTIAL`），与全仓凭据 REF 集合逐字一致——降低解密第三方桌面端会话文件那一步的凭据泄漏半径（红线①）。`harvest attempts[].detail` 与 `state().error` 出口统一过 `redactSecrets`。
+- **内部加固 / 清理（不属公开行为变化，详见 `git log`）**：收敛三轮四域代码审查的约 22 项缺陷与计数器 / 方法归一化 / 单飞泄漏 / JSDoc 归位等低危项；删除 25 个零读者 style token（`details*` / `grant*` / `models*` / `trend*` / `poolsGrid` / `primaryHover`）与全仓零引用的孤儿 `jsqr` devDependency；统一 `countOf` 与 `Number(x)||0` 两处数值惯用法、`requestMethod` 六路由共用、BFF 门控头收敛为单一 `AGNESCODE_BASE_HEADERS`；CI `build-gate` 确保暂存目录存在再 `mkdtemp`。上述均以新增断言钉住，无破坏性改动。
+- 影响面：`src/{host,client}/`（多文件）、`lib/`、`client.js`（随 src 同 commit 重建，构建零漂移）、`test/`（多套件 + 断言）、`package.json`（版本 + 去孤儿依赖）。`npm test` 全绿：28 套件 + tsc / build / dup / e2e 四门禁通过，e2e 66/66 PASSED。
+
 ## [0.10.1] — 2026-10-06
 
 ### 修复：AgnesCode 截图里的真实账号昵称已脱敏（该图曾随 0.10.0 发布）

package/client.js

@@ -550,11 +550,16 @@ var dsh_connect_agnes_token_plan_client = (function() {
 	* Why two bases: the catalogue mixes them — windows and ceilings arrive as
 	* powers of two (1048576), while the plugin's own 128k fallback is the round
 	* decimal 128 000. A flat /1000 rounding once printed "1049k" for the 1M
-	* window and it read like a placeholder bug; so figures divisible by 1000 keep
-	* the decimal reading they were written with, binary-only figures (262144 →
-	* 256K, 65536 → 64K) get the binary one, anything ≥ 1M goes to M and anything
-	* ≥ 1G goes to G — the account-lifetime token total (billions) must not print
-	* as a four-digit "5214M".
+	* window and it read like a placeholder bug. The guards below therefore run
+	* in the order the code checks them, largest first:
+	*
+	*   - anything ≥ 1G goes to G — the account-lifetime token total (billions)
+	*     must not print as a four-digit "5214M";
+	*   - anything ≥ 1M goes to M — a 1M window (1048576) reads "1M", never
+	*     "1049k" or "1024k";
+	*   - below 1M, figures divisible by 1000 keep the decimal reading they were
+	*     written with (128000 → "128K");
+	*   - binary-only figures get the binary one (262144 → "256K", 65536 → "64K").
 	*/
 	function tokenSize(value) {
 		const number = typeof value === "number" && Number.isFinite(value) ? Math.floor(value) : 0;
@@ -977,12 +982,6 @@ var dsh_connect_agnes_token_plan_client = (function() {
 				borderRadius: 12,
 				padding: 16
 			},
-			poolsGrid: {
-				display: "grid",
-				gridTemplateColumns: "repeat(auto-fit, minmax(min(100%, 320px), 1fr))",
-				gap: 12,
-				alignItems: "start"
-			},
 			cardHead: {
 				display: "flex",
 				alignItems: "center",
@@ -1098,40 +1097,6 @@ var dsh_connect_agnes_token_plan_client = (function() {
 			},
 			barFillWarn: { background: "var(--dsw-alias-state-warn-primary)" },
 			barFillError: { background: "var(--dsw-alias-state-error-primary)" },
-			details: {
-				marginTop: 12,
-				paddingTop: 10,
-				borderTop: "1px solid var(--dsw-alias-border-l1)"
-			},
-			detailsSummary: {
-				fontSize: 12,
-				color: "var(--dsw-alias-label-secondary)",
-				cursor: "pointer",
-				userSelect: "none"
-			},
-			detailsBody: {
-				display: "flex",
-				flexDirection: "column",
-				gap: 10,
-				marginTop: 10
-			},
-			grant: {
-				fontSize: 12,
-				color: "var(--dsw-alias-label-secondary)"
-			},
-			models: {
-				display: "flex",
-				flexWrap: "wrap",
-				gap: 6
-			},
-			modelTag: {
-				fontFamily: "ui-monospace, SFMono-Regular, Menlo, Consolas, monospace",
-				fontSize: 11,
-				padding: "2px 6px",
-				borderRadius: 6,
-				background: "var(--dsw-alias-bg-layer-2)",
-				border: "1px solid var(--dsw-alias-border-l1)"
-			},
 			trendHead: {
 				display: "flex",
 				alignItems: "baseline",
@@ -1145,39 +1110,6 @@ var dsh_connect_agnes_token_plan_client = (function() {
 				color: "var(--dsw-alias-label-secondary)",
 				fontWeight: 500
 			},
-			trendRow: {
-				display: "flex",
-				flexDirection: "column",
-				gap: 8,
-				padding: "10px 0",
-				borderBottom: "1px solid var(--dsw-alias-border-l1)"
-			},
-			trendRowHead: {
-				display: "flex",
-				alignItems: "baseline",
-				justifyContent: "space-between",
-				gap: 12,
-				minWidth: 0
-			},
-			trendModel: {
-				fontFamily: "ui-monospace, SFMono-Regular, Menlo, Consolas, monospace",
-				fontSize: 12,
-				minWidth: 0,
-				overflow: "hidden",
-				textOverflow: "ellipsis",
-				whiteSpace: "nowrap"
-			},
-			trendCredits: {
-				fontSize: 13,
-				fontWeight: 600,
-				fontVariantNumeric: "tabular-nums"
-			},
-			trendBar: {
-				height: 6,
-				borderRadius: 3,
-				background: "var(--dsw-alias-bg-layer-2)",
-				overflow: "hidden"
-			},
 			trendLegend: {
 				marginTop: 10,
 				fontSize: 11,
@@ -1299,7 +1231,6 @@ var dsh_connect_agnes_token_plan_client = (function() {
 				color: "var(--dsw-alias-label-primary-foreground)",
 				cursor: "pointer"
 			},
-			primaryHover: { background: "var(--dsw-alias-button-primary-hover)" },
 			primaryBusy: {
 				opacity: .6,
 				cursor: "default"
@@ -1761,6 +1692,10 @@ var dsh_connect_agnes_token_plan_client = (function() {
 	* @returns {unknown} the tools row element.
 	*/
 	function RosterTools({ query, setQuery, name, busy, tickedCount, visible, bulk, tt }) {
+		const countLabel = format(tt("llm.rosterCount"), {
+			selected: tickedCount,
+			total: visible.length
+		});
 		return h("div", { style: S.rosterTools }, h("input", {
 			type: "search",
 			style: {
@@ -1777,14 +1712,8 @@ var dsh_connect_agnes_token_plan_client = (function() {
 			onChange: (event) => setQuery(event.target.value)
 		}), h("span", {
 			style: S.rosterCount,
-			title: format(tt("llm.rosterCount"), {
-				selected: tickedCount,
-				total: visible.length
-			})
-		}, format(tt("llm.rosterCount"), {
-			selected: tickedCount,
-			total: visible.length
-		})), h("button", {
+			title: countLabel
+		}, countLabel), h("button", {
 			type: "button",
 			style: S.rosterBulk,
 			disabled: busy === true || visible.length === 0,
@@ -2445,10 +2374,6 @@ var dsh_connect_agnes_token_plan_client = (function() {
 			role: "alert"
 		}, switchError) : null);
 	}
-	/** Ids off a snapshot array field, coerced to strings and guarded against `null`. */
-	function idList(value) {
-		return Array.isArray(value) ? value.map((id) => String(id)) : [];
-	}
 	/**
 	* The live draw-tool switch (docs/PROVIDER-HOT-RELOAD.md, same discipline
 	* as `ProviderSwitch`). Posts `{ enabled }` / `{ modelId }` to the plugin's
@@ -2466,7 +2391,7 @@ var dsh_connect_agnes_token_plan_client = (function() {
 			modelKey: "drawModelId",
 			enabled: llm?.drawEnabled === true,
 			hasKey: llm?.hasApiKey === true,
-			candidates: idList(llm?.drawCandidateIds),
+			candidates: rosterIds(llm?.drawCandidateIds),
 			preferred: llm?.drawPreferredModel != null ? String(llm.drawPreferredModel) : null,
 			effective: String(llm?.drawModel ?? ""),
 			onDone,
@@ -2487,7 +2412,7 @@ var dsh_connect_agnes_token_plan_client = (function() {
 	* reader wondering why a seconds-based model sits next to a frame-based one.
 	*/
 	function VideoSwitch({ llm, onDone, tt }) {
-		const excluded = idList(llm?.video25ModelIds);
+		const excluded = rosterIds(llm?.video25ModelIds);
 		const extraNote = excluded.length > 0 ? h("div", { style: {
 			...S.muted,
 			fontSize: 12,
@@ -2502,7 +2427,7 @@ var dsh_connect_agnes_token_plan_client = (function() {
 			modelKey: "videoModelId",
 			enabled: llm?.videoEnabled === true,
 			hasKey: llm?.hasApiKey === true,
-			candidates: idList(llm?.videoCandidateIds),
+			candidates: rosterIds(llm?.videoCandidateIds),
 			preferred: llm?.videoPreferredModel != null ? String(llm.videoPreferredModel) : null,
 			effective: String(llm?.videoModel ?? ""),
 			extraNote,
@@ -2537,6 +2462,7 @@ var dsh_connect_agnes_token_plan_client = (function() {
 		init_format();
 		init_http();
 		init_model_picker();
+		init_models();
 		init_runtime();
 		init_switch();
 		init_styles();
@@ -2777,7 +2703,7 @@ var dsh_connect_agnes_token_plan_client = (function() {
 		}, h("div", { style: {
 			...tone.fill,
 			width: `${pct}%`
-		} })), pct === null && resetLine === null ? null : h("div", { style: S.quotaFoot }, pct === null ? null : h("span", { style: S.quotaUsed }, `${tt("quota.used")} ${count(used)} / ${count(limit)}`), resetLine === null ? null : h("span", { style: {
+		} })), (pct === null || used === null) && resetLine === null ? null : h("div", { style: S.quotaFoot }, pct === null || used === null ? null : h("span", { style: S.quotaUsed }, `${tt("quota.used")} ${count(used)} / ${count(limit)}`), resetLine === null ? null : h("span", { style: {
 			...S.muted,
 			fontSize: 11
 		} }, resetLine)));
@@ -2881,29 +2807,34 @@ var dsh_connect_agnes_token_plan_client = (function() {
 			{
 				key: "requests",
 				label: tt("quota.total.requests"),
-				value: count(source.totalRequests)
+				value: count(source.totalRequests),
+				on: typeof source.totalRequests === "number"
 			},
 			{
 				key: "tokens",
 				label: tt("quota.total.tokens"),
-				value: tokenSize(source.totalTokens) || count(source.totalTokens)
+				value: tokenSize(source.totalTokens) || count(source.totalTokens),
+				on: typeof source.totalTokens === "number"
 			},
 			{
 				key: "images",
 				label: tt("quota.total.images"),
-				value: count(source.totalImages)
+				value: count(source.totalImages),
+				on: typeof source.totalImages === "number"
 			},
 			{
 				key: "video",
 				label: tt("quota.total.video"),
-				value: `${count(source.totalVideoSeconds)} ${tt("quota.unit.seconds")}`
+				value: `${count(source.totalVideoSeconds)} ${tt("quota.unit.seconds")}`,
+				on: typeof source.totalVideoSeconds === "number"
 			},
-			...typeof source.activeDays === "number" ? [{
+			{
 				key: "days",
 				label: tt("quota.total.activeDays"),
-				value: count(source.activeDays)
-			}] : []
-		];
+				value: count(source.activeDays),
+				on: typeof source.activeDays === "number"
+			}
+		].filter((cell) => cell.on);
 		return h("div", null, h("div", { style: {
 			...S.muted,
 			fontSize: 12,

package/lib/agnescode-llm-adapter.js

@@ -1,4 +1,4 @@
-import { t as DEFAULT_REASONING_EFFORT, w as name } from "./llm-models.js";
+import { T as name, t as DEFAULT_REASONING_EFFORT } from "./llm-models.js";
 import { i as buildAgnescodeDescriptors, n as AGNESCODE_PROVIDER_ID, r as agnescodeRoster, t as AGNESCODE_DISPLAY_NAME } from "./agnescode-models.js";
 import { i as buildRetryPolicyConfig, n as STREAM_IDLE_TIMEOUT_MS, r as createWrappedPiAiAdapter, t as REQUEST_IMAGE_BUDGETS } from "./pi-ai-adapter-core.js";
 import { createProvider } from "@earendil-works/pi-ai";

package/lib/agnescode-models.js

@@ -1,4 +1,4 @@
-import { A as numZeroOk, I as str, O as num, i as PROBED_VISION, j as obj, w as name } from "./llm-models.js";
+import { L as str, M as obj, T as name, i as PROBED_VISION, j as numZeroOk, k as num } from "./llm-models.js";
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { homedir } from "node:os";
@@ -79,12 +79,12 @@ function isProfileSegment(value) {
 * **怎么读它**：`ctx.get(name)` —— Cordis 自己的 "read a service without the
 * inject requirement" 入口，未提供时安静返回 `undefined`。注意**别用属性访问**
 * 去探：`ctx.profileContext` 会在服务缺失时**抛错**（`cannot get property
-* "profileContext" without inject`，cordis `lib/index.js:676`）——这是本插件
+* "profileContext" without inject`——cordis 的原文案）——这是本插件
 * 实测踩到的，不是推测。`readOptionalService` 把两个入口都包了，属性访问只作为
 * 测试桩的兜底留在最后。
 *
-* **为什么不用 `inject` 声明它**：`inject` 里的是**硬依赖**（`lib/index.js:688`
-* 的报错文案就叫 "cannot get required service"），缺了 Cordis 根本不加载本插件。
+* **为什么不用 `inject` 声明它**：`inject` 里的是**硬依赖**（报错文案就叫
+* "cannot get required service"），缺了 Cordis 根本不加载本插件。
 * 而 `profileContext` 在官方 runtime 里是**可选**的（`@linxin666/
 * dsh-client-ui-plugin-manager` 明确处理了"host 隐藏了它"的情形，
 * `dsh-better-sidebar` 同理）。把它变成硬依赖，会让那些主机上整个插件消失
@@ -607,13 +607,19 @@ function createFileCatalogStore(options = {}) {
 *
 * @module dsh-connect-agnes-token-plan/agnescode
 */
-/** The model-catalogue request headers the BFF gates on (probed: required). */
-const AGNESCODE_CATALOG_HEADERS = Object.freeze({
+/** The request headers every BFF call carries, with or without a token. The
+* `X-App-Id` / `X-Platform` pair is the catalogue gate (probed: required) and
+* the language header mirrors the desktop client. Declared ONCE here and spread
+* by both builders — `agnescodeHeaders` (authenticated) and
+* `agnescodeRequestHeaders` in `agnescode-models.ts` (anonymous) — so the two
+* cannot drift into disagreeing gate values. */
+const AGNESCODE_BASE_HEADERS = Object.freeze({
+	Accept: "application/json",
+	"Content-Type": "application/json",
 	"X-App-Id": "1",
-	"X-Platform": "1"
+	"X-Platform": "1",
+	"X-User-Language": "zh-Hans"
 });
-/** The request-language header the desktop client sends. */
-const AGNESCODE_LANGUAGE_HEADER = "X-User-Language";
 /**
 * The session-file name pattern, matched case-insensitively against the App's
 * roaming directory. The CN build ships `code-auth-session.cn.v1`; other
@@ -712,6 +718,10 @@ const AGNESCODE_HARVEST_TIER = Object.freeze({
 * a non-model in the picker. Keyed by id on purpose: a rule tied to "has no
 * multiplier" would silently start leaking `auto` back in the day the platform
 * prices it.
+*
+* Matched as a SET (`includes`), never by index: comparing against `[0]` would
+* make a second entry dead the moment it was added, and that failure would be
+* silent.
 */
 const AGNESCODE_CATALOGUE_EXCLUDED_IDS = Object.freeze(["auto"]);
 /**
@@ -795,11 +805,8 @@ function decodeAgnescodeJwtExpMs(token) {
 */
 function agnescodeHeaders(credential) {
 	return {
-		Accept: "application/json",
-		"Content-Type": "application/json",
-		Authorization: `Bearer ${str(obj(credential).accessToken, "")}`,
-		...AGNESCODE_CATALOG_HEADERS,
-		[AGNESCODE_LANGUAGE_HEADER]: "zh-Hans"
+		...AGNESCODE_BASE_HEADERS,
+		Authorization: `Bearer ${str(obj(credential).accessToken, "")}`
 	};
 }
 /**
@@ -851,6 +858,29 @@ async function unwrapAgnescodeLocalStateKey(localStateRaw, dpapiUnprotect) {
 	return dpapiUnprotect(wrapped.subarray(5));
 }
 /**
+* The env names that carry credentials. A spawned helper does not need them,
+* and must not be able to read them off its own process environment.
+*/
+const DPAPI_CHILD_SECRET_ENV = [
+	"AGNES_PASSWORD",
+	"AGNES_USERNAME",
+	"AGNES_TOKEN_PLAN_API_KEY",
+	"AGNESCODE_CREDENTIAL"
+];
+/**
+* The environment handed to the DPAPI PowerShell child: everything the shell
+* actually needs (SystemRoot, PATH, TEMP, …) survives, only the credential
+* names go. `spawn` inherits `process.env` by default; this is the explicit
+* exception to that default.
+* @param {object} [env] - the parent env (defaults to `process.env`).
+* @returns {object} a copy with the credential names removed.
+*/
+function dpapiChildEnv(env = process.env) {
+	const out = { ...env };
+	for (const name of DPAPI_CHILD_SECRET_ENV) delete out[name];
+	return out;
+}
+/**
 * The production DPAPI unwrap: a PowerShell child process. No native addon and
 * no build step (the Host half is build-free, ROADMAP §6.2), and the unwrapped
 * key transits the stdout pipe IN MEMORY — it is never printed, logged, or
@@ -881,7 +911,8 @@ async function defaultDpapiUnprotect(wrapped) {
 				"pipe",
 				"pipe"
 			],
-			windowsHide: true
+			windowsHide: true,
+			env: dpapiChildEnv()
 		});
 		const chunks = [];
 		let failure = "";
@@ -1113,7 +1144,7 @@ async function fetchAgnescodeCatalog(credential, fetcher) {
 			const model = obj(raw);
 			const id = str(model.id, "");
 			if (id === "" || seen.has(id)) continue;
-			if (id === AGNESCODE_CATALOGUE_EXCLUDED_IDS[0]) continue;
+			if (AGNESCODE_CATALOGUE_EXCLUDED_IDS.includes(id)) continue;
 			if (str(model.model_type, "text") !== "text") continue;
 			seen.add(id);
 			const allowed = Array.isArray(model.allowed_subscription) ? model.allowed_subscription : [];
@@ -1172,12 +1203,26 @@ async function fetchAgnescodeBalance(credential, fetcher) {
 	}
 }
 /**
-* The static fallback roster: the eight models the CN BFF listed at probe time
-* (2026-10-01 night re-probe, ROADMAP §6.3.1). All `model_type: text`, no
-* multiplier concept — confirmed by that re-probe: no model row carries a
-* credit/rate/price/cost key and all five rate-candidate endpoints 404
-* (billing is the account-level credit pool, not per-model rates). Used ONLY
-* when `fetchAgnescodeCatalog` comes back empty; a fresh catalogue always wins.
+* The static fallback roster: the eight models the CN BFF's `/v2/models`
+* listed at probe time (2026-10-01 night re-probe; rows and rates re-probed
+* 2026-10-04 against v2, ROADMAP §6.3.1). Used ONLY when
+* `fetchAgnescodeCatalog` comes back empty; a fresh catalogue always wins.
+*
+* `multiplier` is the BFF's `points_cost_multiplier` — a rate the PLATFORM
+* publishes per model, read once through `numZeroOk()`. A `0` is a published
+* price ("free"), NOT an absence: `num()` would turn it into "unpriced" and
+* the panel would lose the chip. The one v2 row with no rate at all is the
+* `auto` routing alias, which this list does not contain.
+*
+* `displayLabel` is the BFF's `display_label` promotional tag, present on one
+* row only, and passed through verbatim.
+*
+* SUPERSEDED READING, kept so the reversal is auditable: the 2026-10-01 v1
+* snapshot genuinely had "no multiplier concept — no row carries a rate key,
+* and all five rate-candidate endpoints 404". That was `/v1/models`, which
+* omits the field; the plugin reads v2 since 2026-10-04, where 8 of 9 rows
+* carry it. The lesson is the one in ROADMAP §6.3.1: deciding a field is
+* absent from a whole table requires scanning every row, not reading `rows[0]`.
 */
 const AGNESCODE_FALLBACK_MODELS = Object.freeze([
 	{
@@ -1312,15 +1357,13 @@ const NO_COST = Object.freeze({
 	cacheRead: 0,
 	cacheWrite: 0
 });
-/** The catalogue/identity headers every request carries (probed: required). */
+/** The catalogue/identity headers every request carries (probed: required).
+* The anonymous half of one pair: `agnescodeHeaders`' map with its
+* `Authorization` line removed. The gate values come from
+* `AGNESCODE_BASE_HEADERS`, never a second copy here, so the two builders
+* cannot disagree. */
 function agnescodeRequestHeaders() {
-	return {
-		Accept: "application/json",
-		"Content-Type": "application/json",
-		"X-App-Id": "1",
-		"X-Platform": "1",
-		"X-User-Language": "zh-Hans"
-	};
+	return { ...AGNESCODE_BASE_HEADERS };
 }
 /**
 * Whether an AgnesCode roster row accepts image input.

package/lib/index.js

@@ -1,4 +1,4 @@
-import { A as numZeroOk, C as isAdmitted, D as forget, E as resolveSettings, F as retryBounded, I as str, L as verbatim, M as pluginError, N as redactError, O as num, P as redactSecrets, S as inject, T as resolveAuthOverrides, _ as parseUsageSeries, b as CONFIG_DEFAULTS, c as summarizeCatalog, d as isVideoGenModel, f as checkShape, g as parseUsageOverview, h as parseSubscriptionUsage, j as obj, k as numOrNull, l as visionOf, m as parsePlans, n as LLM_DISPLAY_NAME, o as filterByEnabled, p as matchCurrentPlan, r as LLM_PROVIDER_ID, s as rosterWithAvailability, t as DEFAULT_REASONING_EFFORT, u as isImageGenModel, v as quotaWindows, w as name, x as hostName, y as readSubscriptionExpiry } from "./llm-models.js";
+import { A as numOrNull, C as inject, D as resolveSettings, E as resolveAuthOverrides, F as redactSecrets, I as retryBounded, L as str, M as obj, N as pluginError, O as forget, P as redactError, R as verbatim, S as hostName, T as name, _ as parseUsageOverview, b as readSubscriptionExpiry, c as summarizeCatalog, d as isVideoGenModel, f as checkShape, g as parseSubscriptionUsage, h as parsePlans, j as numZeroOk, k as num, l as visionOf, m as matchCurrentPlan, n as LLM_DISPLAY_NAME, o as filterByEnabled, p as countOf, r as LLM_PROVIDER_ID, s as rosterWithAvailability, t as DEFAULT_REASONING_EFFORT, u as isImageGenModel, v as parseUsageSeries, w as isAdmitted, x as CONFIG_DEFAULTS, y as quotaWindows } from "./llm-models.js";
 import { S as writeStateFile, _ as profileSegment, a as filterAgnescodeRows, b as stateDir, c as fetchAgnescodeBalance, d as trustAgnescodeBffBase, f as createFileCatalogStore, g as ensureStateDir, h as createStateReadCache, l as fetchAgnescodeCatalog, m as STATE_READ_TTL_MS, n as AGNESCODE_PROVIDER_ID, o as AGNESCODE_FALLBACK_MODELS, p as normalizeEnabledIds, s as decodeAgnescodeJwtExpMs, t as AGNESCODE_DISPLAY_NAME, u as harvestAgnescodeLocalSession, v as profileStateDir, x as temporaryOf, y as readStateJson } from "./agnescode-models.js";
 import { rm } from "node:fs/promises";
 import { join } from "node:path";
@@ -1673,7 +1673,7 @@ function createTokenStore(options) {
 				ephemeral: ephemeral(),
 				retryAfterMs: inForceWaitMs$1(held),
 				needsUserAction: held !== null && held.parked,
-				error: isFresh$1(stored) ? null : state.lastError === null ? null : state.lastError instanceof Error ? state.lastError.message : String(state.lastError)
+				error: isFresh$1(stored) ? null : state.lastError === null ? null : redactSecrets(state.lastError instanceof Error ? state.lastError.message : String(state.lastError))
 			};
 		}
 	};
@@ -2127,7 +2127,7 @@ function createApiKeyStore({ credentials = null, env = process.env } = {}) {
 		*/
 		async save(apiKey) {
 			const value = verbatim(apiKey, "");
-			if (typeof value !== "string" || value.trim() === "") throw new Error("an API key is required");
+			if (value.trim() === "") throw new Error("an API key is required");
 			const service = resolveService();
 			if (service !== null && typeof service.set === "function") {
 				await service.set(API_KEY_REF, value);
@@ -2749,6 +2749,15 @@ function registerProviderPair(llm, built, target, { providerId, displayName }) {
 *
 * The module is loaded once and the factory is read off it once, so a Host
 * whose peers resolve slowly pays that cost one time, not per publish.
+*
+* Only the SUCCESS is memoized. The memoized value used to be the promise
+* itself, which pinned a rejection in the slot for the life of the process:
+* after one failed `import()` every later publish rethrew the same error and
+* the provider could never register again — even after the operator fixed the
+* missing peer, which is exactly the remedy this file's own
+* `describeBuildFailure` prints for `ERR_MODULE_NOT_FOUND`. A recoverable
+* install problem cost a Host restart. Clearing the slot on failure keeps
+* "loaded once" for the happy path and gives the next publish a real retry.
 * @param {() => Promise<unknown>} loadModule - resolves the adapter module.
 * @param {string} exportName - the factory export to read off the module.
 * @returns {() => Promise<any>} the memoized factory resolver.
@@ -2756,7 +2765,10 @@ function registerProviderPair(llm, built, target, { providerId, displayName }) {
 function createAdapterFactoryResolver(loadModule, exportName) {
 	let adapterFactoryPromise;
 	return async () => {
-		if (adapterFactoryPromise === void 0) adapterFactoryPromise = Promise.resolve(loadModule()).then((mod) => mod?.[exportName]);
+		if (adapterFactoryPromise === void 0) adapterFactoryPromise = Promise.resolve(loadModule()).then((mod) => mod?.[exportName]).catch((error) => {
+			adapterFactoryPromise = void 0;
+			throw error;
+		});
 		return adapterFactoryPromise;
 	};
 }
@@ -3190,7 +3202,6 @@ function wireAgnescodePublisher({ store, panelSwitch, enabledIds, getLlm, loadAd
 		if (credential === null) return "";
 		if (await store.isExpired().catch(() => false)) {
 			if (harvest.inFlight === null && Date.now() >= harvest.blockedUntil) harvest.inFlight = harvestAgnescodeLocalSession().then(async (walk) => {
-				harvest.inFlight = null;
 				if (walk?.ok !== true) {
 					harvest.blockedUntil = Date.now() + AGNESCODE_REHARVEST_BACKOFF_MS;
 					logger?.warn?.(`agnescode: re-harvest found no usable session (${walk?.attempts?.length ?? 0} probed files); riding the stored token until ${new Date(harvest.blockedUntil).toISOString()}`);
@@ -3209,9 +3220,10 @@ function wireAgnescodePublisher({ store, panelSwitch, enabledIds, getLlm, loadAd
 				});
 				return walk;
 			}).catch(() => {
-				harvest.inFlight = null;
 				harvest.blockedUntil = Date.now() + AGNESCODE_REHARVEST_BACKOFF_MS;
 				return null;
+			}).finally(() => {
+				harvest.inFlight = null;
 			});
 			await Promise.resolve(harvest.inFlight).catch(() => null);
 		}
@@ -3861,26 +3873,25 @@ function buildDrawEndpoint(apiBase) {
 /**
 * The draw-capable model ids of one catalog, de-duplicated in first-seen order.
 *
-* Deduping keeps the LAST occurrence at its first-seen position, exactly like
-* `rosterOf` / `buildDescriptors` / `catalog-store.normalizeEntries`, so the
-* draw list and the chat roster can never disagree about which ids exist.
+* The ids are unique in first-seen order — a `Set` is all this needs. At the
+* id level there is no "which row survived" question the way `rosterOf` /
+* `buildDescriptors` / `catalog-store.normalizeEntries` have (they keep the
+* LAST row for an id, at its first-seen position), so the draw list and the
+* chat roster agree about which ids exist without sharing that row-level rule.
+* It WAS copied here, and the duplicate branch re-assigned the same id back to
+* its own slot — dead code that implied an ordering rule this function cannot
+* express.
 * @param {object[]} entries - the normalized catalog entries.
 * @returns {string[]}
 */
 function imageGenModelIds(entries) {
-	const position = /* @__PURE__ */ new Map();
-	const out = [];
+	const ids = /* @__PURE__ */ new Set();
 	for (const entry of Array.isArray(entries) ? entries : []) {
 		if (!isImageGenModel(entry)) continue;
 		const id = str(entry?.id, "");
-		if (id === "") continue;
-		if (position.has(id)) out[position.get(id)] = id;
-		else {
-			position.set(id, out.length);
-			out.push(id);
-		}
+		if (id !== "") ids.add(id);
 	}
-	return out;
+	return [...ids];
 }
 /**
 * Choose the model one draw call addresses.
@@ -4223,27 +4234,24 @@ function isVideo25Flash(model) {
 	return isVideo25Family(model) && /flash/i.test(str(model, ""));
 }
 /**
-* The video-generation model ids of one catalog, de-duplicated in first-seen order.
+* The video-generation model ids of one catalog, unique in first-seen order.
 *
 * Recognition is delegated to `modality.ts`, so this list and the chat roster
-* can never disagree about which entries exist.
+* can never disagree about which entries exist. A `Set` is all this needs: at
+* the id level there is no "which row survived" question, so the row-level
+* dedupe (`normalizeEntries`) is not copied here — see `imageGenModelIds` for
+* the same call.
 * @param {object[]} entries - the normalized catalog entries.
 * @returns {string[]}
 */
 function videoGenModelIds(entries) {
-	const position = /* @__PURE__ */ new Map();
-	const out = [];
+	const ids = /* @__PURE__ */ new Set();
 	for (const entry of Array.isArray(entries) ? entries : []) {
 		if (!isVideoGenModel(entry)) continue;
 		const id = str(entry?.id, "");
-		if (id === "") continue;
-		if (position.has(id)) out[position.get(id)] = id;
-		else {
-			position.set(id, out.length);
-			out.push(id);
-		}
+		if (id !== "") ids.add(id);
 	}
-	return out;
+	return [...ids];
 }
 /**
 * The subset of video ids this module can actually address — the V2.0 family.
@@ -4397,25 +4405,32 @@ async function soft(run) {
 /**
 * The panel's projection of one catalogue entry: no `featureTexts`, no
 * envelope leftovers — only the fields the quota screen reads or compares.
+*
+* The numeric pass is defensive rather than a conversion: `parsePlans` already
+* ran `countOf` over every figure, so by the time a row reaches here each
+* number is a number. `countOf` is kept because a plan may arrive by another
+* route (the doctor and the tests build rows directly), and `Number(x) || 0`
+* would let `Infinity` through while `countOf` reads it as 0 — the panel must
+* show a missing figure, never an unbounded one.
 * @param {object} plan - one {@link parsePlans} entry.
 * @returns {object} the projection.
 */
 function planSummary(plan) {
 	return {
 		uuid: str(plan?.uuid, ""),
-		planId: Number(plan?.planId) || 0,
+		planId: countOf(plan?.planId),
 		name: str(plan?.name, ""),
 		displayName: str(plan?.displayName, ""),
 		billingCycle: str(plan?.billingCycle, ""),
 		displayCycle: str(plan?.displayCycle, ""),
-		priceMinor: Number(plan?.priceMinor) || 0,
+		priceMinor: countOf(plan?.priceMinor),
 		currency: str(plan?.currency, ""),
 		limits: {
-			requests5h: Number(plan?.concurrencyLimit) || 0,
-			requestsWindowH: Number(plan?.concurrencyWindowH) || 0,
-			requestsWeekly: Number(plan?.textWeeklyLimit) || 0,
-			imagesDaily: Number(plan?.imageDailyLimit) || 0,
-			videoDaily: Number(plan?.videoDailyLimit) || 0
+			requests5h: countOf(plan?.concurrencyLimit),
+			requestsWindowH: countOf(plan?.concurrencyWindowH),
+			requestsWeekly: countOf(plan?.textWeeklyLimit),
+			imagesDaily: countOf(plan?.imageDailyLimit),
+			videoDaily: countOf(plan?.videoDailyLimit)
 		}
 	};
 }
@@ -4546,38 +4561,6 @@ function buildShapeWarnings(overview, series, plans) {
 	];
 }
 /**
-* Fetch the four console sources plus the model catalog and aggregate them
-* into the snapshot body the route writes.
-*
-* All five are fetched in parallel through the shared `cache` + `inflight`
-* maps (a single-flight per URL so concurrent polls share one call) and the
-* `tokenStore` (so a 401 triggers one renewal before the call). Only the
-* catalog is authenticated by the API key instead; a missing key degrades the
-* model lists, not the quota — resolved per poll so a key that arrives after
-* the plugin mounted still lights the lists on the next poll.
-*
-* @param {object} context
-* @param {object} context.settings - the resolved settings row.
-* @param {Map} context.cache - the console-response cache (shared across polls).
-* @param {Map} context.inflight - the single-flight map (shared across polls).
-* @param {object} context.tokenStore - the `createTokenStore` instance.
-* @param {object} context.apiKeyStore - the `createApiKeyStore` instance.
-* @param {object} context.publisher - the `createProviderPublisher` instance.
-* @param {object} context.catalogStore - the `createFileCatalogStore` instance.
-* @param {() => Promise<boolean|null>} context.panelSwitch - the panel-saved
-*   provider switch (`provider-store.enabled()`); null when untouched.
-* @param {() => Promise<boolean|null>} context.drawSwitch - the panel-saved
-*   draw-tool switch (`draw-store.enabled()`), same shape and precedence.
-* @param {() => Promise<string|null>} context.drawModelId - the panel-saved
-*   draw-model preference (`draw-store.modelId()`); null when untouched.
-* @param {() => Promise<boolean|null>} context.videoSwitch - the panel-saved
-*   video-tool switch (`video-store.enabled()`). A SEPARATE opt-in from the
-*   draw switch: the two modalities are independent.
-* @param {() => Promise<string|null>} context.videoModelId - the panel-saved
-*   video-model preference (`video-store.modelId()`); null when untouched.
-* @returns {Promise<object>} the snapshot body.
-*/
-/**
 * The ONLY side effects `buildSnapshotBody` performs, isolated here so the
 * aggregator above stays a pure projection of the console results.
 *
@@ -4604,7 +4587,7 @@ async function applyCatalogEffects({ catalogStore, publisher, providerState, cat
 		const freshSignature = catalogSignature(catalog, enabledIds);
 		if (freshSignature !== providerState.signature) {
 			catalogChanged = true;
-			if (await catalogStore.replace(catalog, enabledIds).catch(() => false)) providerState.signature = freshSignature;
+			if (await catalogStore.replace(catalog, enabledIds)) providerState.signature = freshSignature;
 			await publisher.publish(catalog, enabledIds, unavailableModelIds);
 		}
 		offered = catalog;
@@ -4619,6 +4602,38 @@ async function applyCatalogEffects({ catalogStore, publisher, providerState, cat
 		catalogChanged
 	};
 }
+/**
+* Fetch the four console sources plus the model catalog and aggregate them
+* into the snapshot body the route writes.
+*
+* All five are fetched in parallel through the shared `cache` + `inflight`
+* maps (a single-flight per URL so concurrent polls share one call) and the
+* `tokenStore` (so a 401 triggers one renewal before the call). Only the
+* catalog is authenticated by the API key instead; a missing key degrades the
+* model lists, not the quota — resolved per poll so a key that arrives after
+* the plugin mounted still lights the lists on the next poll.
+*
+* @param {object} context
+* @param {object} context.settings - the resolved settings row.
+* @param {Map} context.cache - the console-response cache (shared across polls).
+* @param {Map} context.inflight - the single-flight map (shared across polls).
+* @param {object} context.tokenStore - the `createTokenStore` instance.
+* @param {object} context.apiKeyStore - the `createApiKeyStore` instance.
+* @param {object} context.publisher - the `createProviderPublisher` instance.
+* @param {object} context.catalogStore - the `createFileCatalogStore` instance.
+* @param {() => Promise<boolean|null>} context.panelSwitch - the panel-saved
+*   provider switch (`provider-store.enabled()`); null when untouched.
+* @param {() => Promise<boolean|null>} context.drawSwitch - the panel-saved
+*   draw-tool switch (`draw-store.enabled()`), same shape and precedence.
+* @param {() => Promise<string|null>} context.drawModelId - the panel-saved
+*   draw-model preference (`draw-store.modelId()`); null when untouched.
+* @param {() => Promise<boolean|null>} context.videoSwitch - the panel-saved
+*   video-tool switch (`video-store.enabled()`). A SEPARATE opt-in from the
+*   draw switch: the two modalities are independent.
+* @param {() => Promise<string|null>} context.videoModelId - the panel-saved
+*   video-model preference (`video-store.modelId()`); null when untouched.
+* @returns {Promise<object>} the snapshot body.
+*/
 async function buildSnapshotBody({ settings, cache, inflight, tokenStore, apiKeyStore, publisher, catalogStore, panelSwitch, drawSwitch, drawModelId, videoSwitch, videoModelId }) {
 	const providerState = publisher.state;
 	const resolveApiKey = async () => (await apiKeyStore.resolve()).value;
@@ -4829,6 +4844,22 @@ function refuseOrigin(response) {
 	});
 }
 /**
+* The request's method, with the route's own fallback for a caller that omits
+* it.
+*
+* The web server always supplies a method, so the fallback is for the route
+* tests and any in-process caller. It is the ROUTE's choice, not a family
+* constant: a write route falls back to POST, a read route to GET, and the
+* wrong one turns a methodless request into a write. Shared here rather than
+* repeated, so the family's fallback wording has one home.
+* @param request - the incoming HTTP request.
+* @param fallback - the method to assume when the caller sent none.
+* @returns {string} the method.
+*/
+function requestMethod(request, fallback) {
+	return request.method === void 0 ? fallback : request.method;
+}
+/**
 * Refuse a disallowed method with the family's 405 shape.
 *
 * The 405 carries no `cache-control`: unlike a snapshot, a method refusal is
@@ -5099,7 +5130,7 @@ async function recordOriginlessWrite(method, options = {}) {
 			lastMethod
 		};
 		const temporary = temporaryOf(dir, FILE);
-		await writeStateFile(file, JSON.stringify(payload), { temporary });
+		await writeStateFile(file, payload, { temporary });
 	} catch {}
 }
 
@@ -5196,7 +5227,7 @@ function registerAccountRoute(ctx, wiring) {
 				refuseOrigin(response);
 				return;
 			}
-			const method = request.method === void 0 ? "POST" : request.method;
+			const method = requestMethod(request, "POST");
 			if (method === "GET") {
 				writeJson(response, 200, {
 					ok: true,
@@ -5288,7 +5319,7 @@ function registerApiKeyRoute(ctx, wiring) {
 				refuseOrigin(response);
 				return;
 			}
-			const method = request.method === void 0 ? "GET" : request.method;
+			const method = requestMethod(request, "GET");
 			const answer = async (extra = {}) => writeJson(response, 200, {
 				ok: true,
 				...await apiKeyStore.state().catch(() => ({
@@ -5372,7 +5403,7 @@ function registerProviderRoute(ctx, wiring) {
 				refuseOrigin(response);
 				return;
 			}
-			const method = request.method === void 0 ? "GET" : request.method;
+			const method = requestMethod(request, "GET");
 			const answer = async (extra = {}) => {
 				const providerSwitch = resolveSwitchEnabled(await readPanelValue(() => providerStore.enabled()), settings.registerProvider);
 				writeJson(response, 200, {
@@ -5450,7 +5481,7 @@ function registerModelsRoute(ctx, wiring) {
 				refuseOrigin(response);
 				return;
 			}
-			if ((request.method === void 0 ? "POST" : request.method) !== "POST") {
+			if (requestMethod(request, "POST") !== "POST") {
 				refuseMethod(response);
 				return;
 			}
@@ -5552,7 +5583,7 @@ function registerToolSwitchRoute(ctx, { path, label, store, enabledKey, enabledS
 				refuseOrigin(response);
 				return;
 			}
-			const method = request.method === void 0 ? "GET" : request.method;
+			const method = requestMethod(request, "GET");
 			const answer = async (extra = {}) => {
 				const panelEnabled = await readPanelValue(async () => await store?.enabled() ?? null);
 				const panelModel = await readPanelValue(async () => await store?.modelId() ?? null);
@@ -5720,6 +5751,13 @@ function registerVideoRoute(ctx, wiring) {
 *
 * @module dsh-connect-agnes-token-plan/routes/agnescode
 */
+/** Map the harvest rows through `redactSecrets`, at the single choke point. */
+function redactHarvestAttempts(attempts) {
+	return attempts.map((attempt) => ({
+		...attempt,
+		detail: redactSecrets(attempt.detail)
+	}));
+}
 /** The AgnesCode provider route (ROADMAP §6.3 "third upstream provider"). */
 const AGNESCODE_PATH = `/api/${name}/agnescode`;
 /** Ceiling on an AgnesCode action body: every action posts a bare `{action}`. */
@@ -5754,6 +5792,7 @@ function registerAgnescodeRoute(ctx, wiring) {
 				let expiresAtMs = null;
 				let balance = null;
 				let error = null;
+				let credential = null;
 				try {
 					if (agnescodeStore !== null && agnescodeStore !== void 0) {
 						const state = await agnescodeStore.state().catch(() => null);
@@ -5761,20 +5800,15 @@ function registerAgnescodeRoute(ctx, wiring) {
 						nickname = state?.nickname ?? "";
 						bffBase = state?.bffBase ?? "";
 						expiresAtMs = state?.expiresAtMs ?? null;
-						if (loggedIn) {
-							const { credential } = await agnescodeStore.resolve().catch(() => ({ credential: null }));
-							if (credential?.accessToken) balance = await fetchAgnescodeBalance(credential).catch(() => null);
-						}
+						credential = (await agnescodeStore.resolve().catch(() => ({ credential: null }))).credential ?? null;
+						if (loggedIn && credential?.accessToken) balance = await fetchAgnescodeBalance(credential).catch(() => null);
 					}
 				} catch (why) {
 					error = redactSecrets(why instanceof Error ? why.message : String(why));
 				}
 				let models = null;
 				try {
-					if (agnescodeStore !== null && agnescodeStore !== void 0) {
-						const { credential } = await agnescodeStore.resolve().catch(() => ({ credential: null }));
-						if (credential?.accessToken) models = await fetchAgnescodeCatalog(credential).catch(() => null);
-					}
+					if (credential?.accessToken) models = await fetchAgnescodeCatalog(credential).catch(() => null);
 				} catch {
 					models = null;
 				}
@@ -5816,7 +5850,7 @@ function registerAgnescodeRoute(ctx, wiring) {
 				const enabledIds = agnescodeModels !== null && agnescodeModels !== void 0 ? await agnescodeModels.listEnabledIds().catch(() => []) : [];
 				await agnescodePublisher.publish(filterAgnescodeRows(rows, enabledIds), bffBase);
 			};
-			const method = request.method === void 0 ? "GET" : request.method;
+			const method = requestMethod(request, "GET");
 			if (method === "GET") {
 				let state = await agnescodeState();
 				const staleRegistration = state.providerRegistered !== true && state.providerError !== null && state.providerError !== void 0 && state.providerError !== "";
@@ -5915,13 +5949,14 @@ function registerAgnescodeRoute(ctx, wiring) {
 				try {
 					if (agnescodeHarvestInFlight === null) agnescodeHarvestInFlight = (async () => {
 						const walk = await harvestAgnescodeLocalSession();
+						const attempts = redactHarvestAttempts(walk.attempts);
 						lastHarvest = {
 							ok: walk.ok,
-							attempts: walk.attempts
+							attempts
 						};
 						if (walk.ok !== true) return {
 							ok: false,
-							attempts: walk.attempts
+							attempts
 						};
 						const expMs = decodeAgnescodeJwtExpMs(walk.session.accessToken);
 						await agnescodeStore.save({
@@ -5933,7 +5968,7 @@ function registerAgnescodeRoute(ctx, wiring) {
 						});
 						return {
 							ok: true,
-							attempts: walk.attempts
+							attempts
 						};
 					})().finally(() => {
 						agnescodeHarvestInFlight = null;
@@ -6712,27 +6747,40 @@ function defaultSleep(ms) {
 * @param {string} [options.model] - sent as `model_name`.
 * @param {number} [options.timeoutMs] - the poll budget.
 * @param {number} [options.pollIntervalMs] - the gap between queries.
+* @param {number} [options.queryRetries] - how many times a REFUSED query is
+*   retried before the task id is handed back to the agent (default 2).
 * @param {Function} [options.sleep] - injected sleeper.
 * @param {Function} [options.now] - injected clock.
 * @param {Function} [options.isDisposed] - `() => boolean`, true after unmount.
 * @returns {Promise<object>} the terminal {@link parseVideoQuery} result.
 * @throws {Error} on timeout, disposal, or a refused query.
 */
-async function pollVideoResult({ fetchImpl, queryEndpoint, apiKey, videoId, model, timeoutMs = VIDEO_DEFAULT_TIMEOUT_MS, pollIntervalMs = VIDEO_POLL_INTERVAL_MS, sleep = defaultSleep, now = Date.now, isDisposed = () => false }) {
+async function pollVideoResult({ fetchImpl, queryEndpoint, apiKey, videoId, model, timeoutMs = VIDEO_DEFAULT_TIMEOUT_MS, pollIntervalMs = VIDEO_POLL_INTERVAL_MS, queryRetries = 2, sleep = defaultSleep, now = Date.now, isDisposed = () => false }) {
 	const budget = Math.max(1e3, Math.floor(num(timeoutMs, VIDEO_DEFAULT_TIMEOUT_MS)));
 	const interval = Math.max(100, Math.floor(num(pollIntervalMs, VIDEO_POLL_INTERVAL_MS)));
+	const retries = Math.max(0, Math.floor(num(queryRetries, 2)));
 	const deadline = now() + budget;
 	let attempts = 0;
 	for (;;) {
 		if (isDisposed()) throw new Error("Agnes video tool is no longer mounted");
 		if (++attempts > 1e3) throw new Error(`视频生成轮询超过 ${VIDEO_MAX_POLLS} 次仍未结束（video_id=${videoId}）——任务仍在平台侧运行，请稍后用 video_id 重新查询，不要重复提交`);
-		const value = await queryVideoTask({
-			fetchImpl,
-			queryEndpoint,
-			apiKey,
-			videoId,
-			model
-		});
+		let value;
+		let retried = 0;
+		for (;;) try {
+			value = await queryVideoTask({
+				fetchImpl,
+				queryEndpoint,
+				apiKey,
+				videoId,
+				model
+			});
+			break;
+		} catch (queryError) {
+			const cause = queryError instanceof Error ? queryError.message : String(queryError);
+			if (retried >= retries || isDisposed() || deadline - now() <= 0) throw new Error(`视频生成查询被拒（video_id=${videoId}）：${cause}——任务仍在平台侧运行，可用 video_id=${videoId} 稍后重新查询，不要重复提交`);
+			retried += 1;
+			await sleep(Math.min(interval, deadline - now()));
+		}
 		if (isVideoTerminal(value.status)) return value;
 		const remaining = deadline - now();
 		if (remaining <= 0) throw new Error(`视频生成超时（超过 ${budget}ms，任务仍处于 ${value.status === "" ? "unknown" : value.status}）——任务仍在平台侧运行，可用 video_id=${videoId} 稍后重新查询，不要重复提交`);

package/lib/llm-adapter.js

@@ -1,4 +1,4 @@
-import { a as buildDescriptors, n as LLM_DISPLAY_NAME, r as LLM_PROVIDER_ID, t as DEFAULT_REASONING_EFFORT, w as name } from "./llm-models.js";
+import { T as name, a as buildDescriptors, n as LLM_DISPLAY_NAME, r as LLM_PROVIDER_ID, t as DEFAULT_REASONING_EFFORT } from "./llm-models.js";
 import { i as buildRetryPolicyConfig, n as STREAM_IDLE_TIMEOUT_MS, r as createWrappedPiAiAdapter, t as REQUEST_IMAGE_BUDGETS } from "./pi-ai-adapter-core.js";
 import { createProvider } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";

package/lib/llm-models.js

@@ -24,7 +24,6 @@
 function num(value, fallback) {
 	return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : fallback;
 }
-/** Read a non-empty string, else the fallback. */
 function str(value, fallback) {
 	return typeof value === "string" && value.trim() !== "" ? value.trim() : fallback;
 }
@@ -72,14 +71,6 @@ function redactError(error) {
 function obj(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-/**
-* Read a string exactly as it was given, else the fallback.
-*
-* The companion to `str()` for secrets: a password is stored, read back and
-* sent as typed, because trimming it is a change the user cannot see. A
-* password of only whitespace is still "not filled in", which the caller
-* judges with `.trim()`.
-*/
 function verbatim(value, fallback) {
 	return typeof value === "string" ? value : fallback;
 }
@@ -1036,6 +1027,22 @@ function finiteOrNull(value) {
 	const parsed = Number(value);
 	return Number.isFinite(parsed) ? parsed : null;
 }
+/**
+* Read `subscription.usage` into the panel's per-window facts.
+*
+* This is the missing half of the quota story. `quotaWindows` states the
+* LIMIT from the plan; this states what has actually been consumed inside the
+* current window, plus the window's own bounds and the moment it resets — all
+* figures the PLATFORM reported, not derived here. Nothing is subtracted:
+* `used` and `limit` are quoted side by side exactly as the console shows
+* them, so the panel's bar is a transcription, not an arithmetic claim.
+*
+* Returns `null` when the payload carries no `usage` at all — an account that
+* has never consumed anything simply may not report one, and that absence
+* must read as "no bar", never as "used 0".
+* @param {unknown} subscription - the unwrapped `/api/cn/user/subscription` data.
+* @returns {Record<string, SubscriptionUsageCell>|null}
+*/
 function parseSubscriptionUsage(subscription) {
 	const usage = obj(obj(subscription).usage);
 	if (Object.keys(usage).length === 0) return null;
@@ -1536,32 +1543,6 @@ function maxOutputLengthOf(entry) {
 	return 0;
 }
 /**
-* The picker's 思考强度 levels, pinned to platform-valid wire spellings.
-*
-* DSH's picker offers levels from `getSupportedThinkingLevels(model)`
-* (`off`/`minimal`/`low`/`medium`/`high`/`xhigh`/`max`), and pi-ai's
-* openai-completions dispatch sends `reasoning_effort = map[level] ?? level`.
-* Agnes's OpenAI-compat gateway rejects `off` (the OpenAI spelling) and
-* `minimal`; the extended levels are PER-MODEL, per the 2026-10-01 live
-* ladder (see PROBED_EFFORT): `xhigh` only on agnes-3.0-flash, `max` on
-* every Agnes chat model. So:
-*
-* - `off: "none"` — the picker's "关闭" must send `none`, not `off`;
-*   - `low`/`medium` — 200 on every known chat model; a model ABSENT from
-*     the table (an unknown id) still gets them via the Agnes safe-set so
-*     the picker is never empty. A model PRESENT in the table with a level
-*     set `false` keeps it closed. The live-contract replay
-*     (`test/live-contract.mjs`) probes the per-model levels and flips the
-*     table cells once a model's 200 is recorded.
-* - `xhigh`/`max` — per the table; the safe-set keeps both closed for
-*   unknown ids.
-*
-* A value of `null` means "the picker must not offer this level"; a string is
-* the wire spelling the level dispatches to.
-* @param {object} entry - one normalized catalog entry.
-* @returns {object} the thinkingLevelMap.
-*/
-/**
 * Per-model 思考档位 probe table (frozen 2026-10-01 from the live ladder
 * replay, mirrored from `test/baselines/agnes-contract.json`
 * §reasoningEffort — every cell is a platform answer, not a guess).
@@ -1614,6 +1595,32 @@ const PROBED_EFFORT = Object.freeze({
 		max: true
 	}
 });
+/**
+* The picker's 思考强度 levels, pinned to platform-valid wire spellings.
+*
+* DSH's picker offers levels from `getSupportedThinkingLevels(model)`
+* (`off`/`minimal`/`low`/`medium`/`high`/`xhigh`/`max`), and pi-ai's
+* openai-completions dispatch sends `reasoning_effort = map[level] ?? level`.
+* Agnes's OpenAI-compat gateway rejects `off` (the OpenAI spelling) and
+* `minimal`; the extended levels are PER-MODEL, per the 2026-10-01 live
+* ladder (see PROBED_EFFORT): `xhigh` only on agnes-3.0-flash, `max` on
+* every Agnes chat model. So:
+*
+* - `off: "none"` — the picker's "关闭" must send `none`, not `off`;
+*   - `low`/`medium` — 200 on every known chat model; a model ABSENT from
+*     the table (an unknown id) still gets them via the Agnes safe-set so
+*     the picker is never empty. A model PRESENT in the table with a level
+*     set `false` keeps it closed. The live-contract replay
+*     (`test/live-contract.mjs`) probes the per-model levels and flips the
+*     table cells once a model's 200 is recorded.
+* - `xhigh`/`max` — per the table; the safe-set keeps both closed for
+*   unknown ids.
+*
+* A value of `null` means "the picker must not offer this level"; a string is
+* the wire spelling the level dispatches to.
+* @param {object} entry - one normalized catalog entry.
+* @returns {object} the thinkingLevelMap.
+*/
 function thinkingLevelMapFor(entry) {
 	const id = str(entry?.id, "");
 	const probed = PROBED_EFFORT[id];
@@ -1866,4 +1873,4 @@ function summarizeCatalog(entries) {
 }
 
 //#endregion
-export { numZeroOk as A, isAdmitted as C, forget as D, resolveSettings as E, retryBounded as F, str as I, verbatim as L, pluginError as M, redactError as N, num as O, redactSecrets as P, inject as S, resolveAuthOverrides as T, parseUsageSeries as _, buildDescriptors as a, CONFIG_DEFAULTS as b, summarizeCatalog as c, isVideoGenModel as d, checkShape as f, parseUsageOverview as g, parseSubscriptionUsage as h, PROBED_VISION as i, obj as j, numOrNull as k, visionOf as l, parsePlans as m, LLM_DISPLAY_NAME as n, filterByEnabled as o, matchCurrentPlan as p, LLM_PROVIDER_ID as r, rosterWithAvailability as s, DEFAULT_REASONING_EFFORT as t, isImageGenModel as u, quotaWindows as v, name as w, hostName as x, readSubscriptionExpiry as y };
+export { numOrNull as A, inject as C, resolveSettings as D, resolveAuthOverrides as E, redactSecrets as F, retryBounded as I, str as L, obj as M, pluginError as N, forget as O, redactError as P, verbatim as R, hostName as S, name as T, parseUsageOverview as _, buildDescriptors as a, readSubscriptionExpiry as b, summarizeCatalog as c, isVideoGenModel as d, checkShape as f, parseSubscriptionUsage as g, parsePlans as h, PROBED_VISION as i, numZeroOk as j, num as k, visionOf as l, matchCurrentPlan as m, LLM_DISPLAY_NAME as n, filterByEnabled as o, countOf as p, LLM_PROVIDER_ID as r, rosterWithAvailability as s, DEFAULT_REASONING_EFFORT as t, isImageGenModel as u, parseUsageSeries as v, isAdmitted as w, CONFIG_DEFAULTS as x, quotaWindows as y };

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-agnes-token-plan",
   "displayName": "DSH Connect Agnes Token Plan",
   "icon": "./icon.svg",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "Agnes connect bundle for the Harness Web UI: Token Plan quota panel (account-wide quota windows, cumulative usage, console sign-in) plus optional provider registration that brings Agnes models into DSH conversation, with host-side rate-limit self-healing.",
   "keywords": [
     "dsh-plugin",
@@ -95,7 +95,6 @@
     "@commitlint/config-conventional": "^21.2.3",
     "@types/node": "^26.6.3",
     "jscpd": "^5.4.0",
-    "jsqr": "^1.4.0",
     "tsdown": "^0.23.0",
     "typescript": "^5.9.3"
   }