dsh-connect-agnes-token-plan 0.5.0

package/lib/agnescode-models-CUcL9UwK.js

@@ -0,0 +1,713 @@
+import { c as num, p as str, u as obj } from "./host-config-BNGgm_j7.js";
+import { createDecipheriv } from "node:crypto";
+
+//#region src/host/agnescode.ts
+/**
+* The AgnesCode（爱思编程）protocol layer — the pure, peer-free API half of the
+* third upstream provider (ROADMAP §6.3 "third upstream").
+*
+* This is the plugin's FIRST "local-login-state harvest" line (the workbuddy /
+* qoder / trae precedent family, §5.3): the credential is NOT obtained by a
+* login this plugin performs — the user signs into the AgnesCode desktop App
+* (WeChat scan, `app_id: agnes`), the App encrypts its session file with
+* Chromium os_crypt, and this module reads THAT file. Nothing here writes to
+* the App's directory; the harvested JWT lands in the DSH credentials service
+* (`agnescode-store.ts`), never in this plugin's directory, git, or logs
+* (red line 1).
+*
+* Wire facts this module encodes (all probed live 2026-10-01, ROADMAP §6.3):
+*   - the session file is `%APPDATA%/AgnesCode/code-auth-session.cn.v1`,
+*     Chromium os_crypt: `v10` prefix + AES-256-GCM, key = DPAPI-unwrapped
+*     `os_crypt.encrypted_key` from the sibling `Local State` JSON;
+*   - the decrypted JSON carries `accessToken` (JWT, ~28-day `exp`), the user
+*     object, and `bffPublicBaseUrl` — the per-account API base, which is why
+*     NO base URL is hardcoded here (the reference reverse-proxy pins the
+*     INTERNATIONAL `.com` host as a constant — the same trap video.ts hit);
+*   - chat is plain OpenAI-compatible `{bff}/chat/completions`; models list at
+*     `{bff}/models` (needs `X-App-Id: 1` + `X-Platform: 1`); the credit pool
+*     lives OUTSIDE the `/v1` prefix at `{origin}/api/v2/subscription/
+*     credits-balance` (a subscription-pool envelope, NOT Token Plan semantics).
+*
+* Safety stance for third-party data: `bffPublicBaseUrl` is PINNED to the
+* Agnes origin family (https + `*.agnes-ai.cn` / `*.agnes-ai.com`) before any
+* Authorization header is aimed at it — a corrupted or hostile session file
+* must not be able to redirect the stored token to a foreign host.
+*
+* Everything here takes injected io/fetchers and pure data, so the offline
+* suites exercise it without a network or a real DPAPI call; no Host peer is
+* imported.
+*
+* @module dsh-connect-agnes-token-plan/agnescode
+*/
+/** The model-catalogue request headers the BFF gates on (probed: required). */
+const AGNESCODE_CATALOG_HEADERS = Object.freeze({
+	"X-App-Id": "1",
+	"X-Platform": "1"
+});
+/** The request-language header the desktop client sends. */
+const AGNESCODE_LANGUAGE_HEADER = "X-User-Language";
+/**
+* The session-file name pattern, matched case-insensitively against the App's
+* roaming directory. The CN build ships `code-auth-session.cn.v1`; other
+* region variants (`code-auth-session.v1`, a future `.com` tag) share the
+* shape, so the harvest matches the FAMILY rather than one literal — but each
+* match is diagnosed individually and the first usable one wins.
+*/
+const AGNESCODE_SESSION_FILE_PATTERN = /^code-auth-session[^/\\]*\.v1$/i;
+/** Where the desktop App keeps its Chromium profile, per platform. */
+const AGNESCODE_APP_DATA_CANDIDATES = Object.freeze([
+	{
+		platform: "win32",
+		dirEnv: "APPDATA",
+		leaf: "AgnesCode"
+	},
+	{
+		platform: "darwin",
+		dirEnv: "HOME",
+		leaf: "Library/Application Support/AgnesCode"
+	},
+	{
+		platform: "linux",
+		dirEnv: "HOME",
+		leaf: ".config/AgnesCode"
+	}
+]);
+/**
+* The tiers of a failed harvest, one per row of the panel's diagnosis list
+* (the workbuddy five-tier discipline, restated for this file family). The
+* tiers deliberately split "the App is not here" from "the App is here but we
+* cannot read its crypto" — they want different user advice.
+*/
+const AGNESCODE_HARVEST_TIER = Object.freeze({
+	FILE_MISSING: "file_missing",
+	UNREADABLE: "unreadable",
+	MALFORMED: "malformed",
+	NO_KEY: "no_key",
+	DECRYPT_FAILED: "decrypt_failed",
+	NO_TOKEN: "no_token",
+	UNTRUSTED_BASE: "untrusted_base",
+	UNSUPPORTED_PLATFORM: "unsupported_platform",
+	OK: "ok"
+});
+/**
+* Whether a BFF base may carry the account's Authorization header. Pinned to
+* the Agnes origin family over https — see the module header. Anything else
+* reads as `UNTRUSTED_BASE` and the harvest keeps walking.
+* @param {unknown} value - the `bffPublicBaseUrl` from the session file.
+* @returns {string|null} the normalized base (no trailing slash), or `null`.
+*/
+function trustAgnescodeBffBase(value) {
+	if (typeof value !== "string" || value.trim() === "") return null;
+	let url;
+	try {
+		url = new URL(value.trim());
+	} catch {
+		return null;
+	}
+	if (url.protocol !== "https:") return null;
+	if (url.port !== "") return null;
+	const host = url.hostname.toLowerCase();
+	if (!(host === "agnes-ai.cn" || host === "agnes-ai.com" || host.endsWith(".agnes-ai.cn") || host.endsWith(".agnes-ai.com"))) return null;
+	return url.origin + url.pathname.replace(/\/+$/, "");
+}
+/**
+* Parse one DECRYPTED session document into the shape the store persists.
+* Malformed input reads as `null`, never throws — one re-harvest, never a
+* crash. Only secret-FREE facts plus the token itself survive; the raw user
+* object (avatar URL, provider ids) is dropped, not stored.
+* @param {unknown} raw - the decrypted JSON value.
+* @returns {{accessToken: string, userId: string, nickname: string, bffBase: string}|null}
+*/
+function parseAgnescodeSession(raw) {
+	const source = obj(raw);
+	const accessToken = str(source.accessToken, "");
+	if (accessToken === "") return null;
+	const bffBase = trustAgnescodeBffBase(source.bffPublicBaseUrl);
+	if (bffBase === null) return null;
+	const user = obj(source.userInfo);
+	return {
+		accessToken,
+		userId: str(user.id, ""),
+		nickname: str(user.username, ""),
+		bffBase
+	};
+}
+/**
+* Derive the API root the account-scoped (`/api/...`) endpoints address —
+* the BFF base WITHOUT its `/v1` suffix. The credits endpoint does NOT live
+* under `/v1` (probed: `{origin}/api/v2/...`), so a caller that concatenated
+* the full base would 404.
+* @param {string} bffBase - a {@link trustAgnescodeBffBase}-normalized base.
+* @returns {string} the origin (plus any non-`/v1` prefix, preserved).
+*/
+function agnescodeApiRoot(bffBase) {
+	const base = str(bffBase, "").replace(/\/+$/, "");
+	return base.endsWith("/v1") ? base.slice(0, -3) : base;
+}
+/** Decode a JWT's `exp` claim to MILLISECONDS; `undefined` on any failure. */
+function decodeAgnescodeJwtExpMs(token) {
+	if (typeof token !== "string" || token.length === 0) return void 0;
+	const parts = token.split(".");
+	if (parts.length < 2) return void 0;
+	try {
+		const payload = JSON.parse(Buffer.from(parts[1] ?? "", "base64url").toString("utf8"));
+		if (typeof payload !== "object" || payload === null || Array.isArray(payload)) return void 0;
+		const seconds = num(payload.exp);
+		return typeof seconds === "number" ? seconds * 1e3 : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* The header set one AgnesCode BFF request carries. The catalogue headers are
+* REQUIRED on `/v1/models` (probed) and harmless elsewhere; the language
+* header mirrors the desktop client.
+* @param {object} credential - `{ accessToken }`.
+* @returns {object} the header map.
+*/
+function agnescodeHeaders(credential) {
+	return {
+		Accept: "application/json",
+		"Content-Type": "application/json",
+		Authorization: `Bearer ${str(obj(credential).accessToken, "")}`,
+		...AGNESCODE_CATALOG_HEADERS,
+		[AGNESCODE_LANGUAGE_HEADER]: "zh-Hans"
+	};
+}
+/**
+* Chromium os_crypt blob → plaintext: strip the `v10` prefix, AES-256-GCM with
+* a 12-byte nonce and a trailing 16-byte auth tag.
+* @param {Buffer|Uint8Array} blob - the raw session-file bytes.
+* @param {Buffer|Uint8Array} key - the 32-byte os_crypt key (already unwrapped).
+* @returns {Buffer} the decrypted bytes.
+* @throws when the prefix, the key size, or the auth tag does not match.
+*/
+function decryptAgnescodeSessionBlob(blob, key) {
+	const bytes = Buffer.isBuffer(blob) ? blob : Buffer.from(blob ?? []);
+	const keyBytes = Buffer.isBuffer(key) ? key : Buffer.from(key ?? []);
+	if (keyBytes.length !== 32) throw new Error(`os_crypt key must be 32 bytes, got ${keyBytes.length}`);
+	const prefix = bytes.subarray(0, 3).toString("latin1");
+	if (prefix !== "v10") throw new Error(`unexpected session-blob prefix ${JSON.stringify(prefix)}`);
+	const body = bytes.subarray(3);
+	if (body.length < 28) throw new Error("session blob too short for nonce + tag");
+	const nonce = body.subarray(0, 12);
+	const tag = body.subarray(body.length - 16);
+	const ciphertext = body.subarray(12, body.length - 16);
+	const decipher = createDecipheriv("aes-256-gcm", keyBytes, nonce);
+	decipher.setAuthTag(tag);
+	return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+}
+/**
+* Unwrap the os_crypt key from a `Local State` document. The stored value is
+* base64 of `DPAPI` + the DPAPI-protected key bytes; the DPAPI call itself is
+* injected (the real one is a PowerShell child process — no native deps).
+* @param {unknown} localStateRaw - the parsed (or raw) `Local State` JSON.
+* @param {(wrapped: Buffer) => Promise<Buffer>} dpapiUnprotect - injected DPAPI.
+* @returns {Promise<Buffer>} the 32-byte os_crypt key.
+* @throws on any shape mismatch — the caller maps it to `NO_KEY`/`DECRYPT_FAILED`.
+*/
+async function unwrapAgnescodeLocalStateKey(localStateRaw, dpapiUnprotect) {
+	let source;
+	if (typeof localStateRaw === "string" || Buffer.isBuffer(localStateRaw) || localStateRaw instanceof Uint8Array) {
+		const text = typeof localStateRaw === "string" ? localStateRaw : Buffer.from(localStateRaw).toString("utf8");
+		try {
+			source = JSON.parse(text);
+		} catch {
+			throw new Error("Local State is not valid JSON");
+		}
+	} else source = obj(localStateRaw);
+	const encryptedKeyB64 = str(obj(obj(source).os_crypt).encrypted_key, "");
+	if (encryptedKeyB64 === "") throw new Error("Local State carries no os_crypt.encrypted_key");
+	const wrapped = Buffer.from(encryptedKeyB64, "base64");
+	if (wrapped.length < 6 || wrapped.subarray(0, 5).toString("latin1") !== "DPAPI") throw new Error("os_crypt.encrypted_key lacks the DPAPI prefix");
+	return dpapiUnprotect(wrapped.subarray(5));
+}
+/**
+* The production DPAPI unwrap: a PowerShell child process. No native addon and
+* no build step (the Host half is build-free, ROADMAP §6.2), and the unwrapped
+* key transits the stdout pipe IN MEMORY — it is never printed, logged, or
+* written anywhere. Runs only on win32; every other platform maps to
+* `UNSUPPORTED_PLATFORM` upstream of this call.
+* @param {Buffer} wrapped - the DPAPI-protected key bytes.
+* @returns {Promise<Buffer>} the unwrapped key bytes.
+*/
+async function defaultDpapiUnprotect(wrapped) {
+	const { spawn } = await import("node:child_process");
+	const script = [
+		"Add-Type -AssemblyName System.Security",
+		"$in = [Console]::OpenStandardInput()",
+		"$ms = New-Object IO.MemoryStream",
+		"$in.CopyTo($ms)",
+		"$pt = [Security.Cryptography.ProtectedData]::Unprotect($ms.ToArray(), $null, 'CurrentUser')",
+		"[Console]::OpenStandardOutput().Write($pt, 0, $pt.Length)"
+	].join("; ");
+	return new Promise((resolve, reject) => {
+		const child = spawn("powershell.exe", [
+			"-NoProfile",
+			"-NonInteractive",
+			"-Command",
+			script
+		], {
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			windowsHide: true
+		});
+		const chunks = [];
+		let failure = "";
+		const timer = setTimeout(() => {
+			child.kill();
+			reject(/* @__PURE__ */ new Error("DPAPI unprotect timed out (10s)"));
+		}, 1e4);
+		child.stdout.on("data", (chunk) => chunks.push(chunk));
+		child.stderr.on("data", (chunk) => {
+			failure += chunk.toString();
+		});
+		child.stdin.on("error", () => {});
+		child.on("error", (why) => {
+			clearTimeout(timer);
+			reject(why);
+		});
+		child.on("close", (code) => {
+			clearTimeout(timer);
+			if (code !== 0) {
+				reject(/* @__PURE__ */ new Error(`DPAPI unprotect failed (exit ${code})${failure ? `: ${failure.slice(0, 200)}` : ""}`));
+				return;
+			}
+			resolve(Buffer.concat(chunks));
+		});
+		child.stdin.write(wrapped);
+		child.stdin.end();
+	});
+}
+/**
+* Harvest the AgnesCode session from the local desktop App — the walk behind
+* the panel's「重新检测」. One diagnostic row per candidate file, in the order
+* the candidates were tried; the FIRST usable session wins and the walk stops.
+* A walk that finds nothing usable returns `ok: false` WITH the rows, so the
+* panel can show exactly what was probed and why it failed (the workbuddy
+* discipline: never a bare "not logged in" when the App state is the problem).
+*
+* The token appears ONLY in the return value's `session` — the `attempts` rows
+* carry tier codes and shape facts (lengths, file sizes), never values.
+* @param {object} [options]
+* @param {object} [options.env] - the process env (defaults to `process.env`).
+* @param {object} [options.platform] - `process.platform` (defaults to real).
+* @param {(path: string) => Promise<Buffer>} [options.readFile] - injected reader.
+* @param {(path: string) => Promise<string[]>} [options.readDir] - injected lister.
+* @param {(wrapped: Buffer) => Promise<Buffer>} [options.dpapiUnprotect] - injected DPAPI.
+* @returns {Promise<{ok: boolean, session?: object, attempts: object[]}>}
+*/
+async function harvestAgnescodeLocalSession(options = {}) {
+	const env = options.env ?? process.env;
+	const platform = options.platform ?? process.platform;
+	const readFile = options.readFile ?? (async (path) => (await import("node:fs/promises")).readFile(path));
+	const readDir = options.readDir ?? (async (path) => (await import("node:fs/promises")).readdir(path));
+	const dpapiUnprotect = options.dpapiUnprotect ?? defaultDpapiUnprotect;
+	/** One tier row: {file, tier, detail?} — detail carries shapes, never values. */
+	const attempts = [];
+	if (platform !== "win32") return {
+		ok: false,
+		attempts: [{
+			file: null,
+			tier: AGNESCODE_HARVEST_TIER.UNSUPPORTED_PLATFORM,
+			detail: `no verified harvest path for ${platform} yet (Windows only; macOS reads state.vscdb — unimplemented)`
+		}]
+	};
+	const appDirs = AGNESCODE_APP_DATA_CANDIDATES.filter((candidate) => candidate.platform === platform).map((candidate) => {
+		const base = str(env[candidate.dirEnv], "");
+		return base === "" ? null : `${base.replace(/[\\/]+$/, "")}/${candidate.leaf}`;
+	}).filter(Boolean);
+	if (appDirs.length === 0) return {
+		ok: false,
+		attempts: [{
+			file: null,
+			tier: AGNESCODE_HARVEST_TIER.UNSUPPORTED_PLATFORM,
+			detail: `no app-data candidate for platform ${platform}`
+		}]
+	};
+	for (const appDir of appDirs) {
+		let fileNames = [];
+		try {
+			fileNames = (await readDir(appDir)).filter((name) => AGNESCODE_SESSION_FILE_PATTERN.test(name));
+		} catch {
+			attempts.push({
+				file: appDir,
+				tier: AGNESCODE_HARVEST_TIER.FILE_MISSING,
+				detail: "the AgnesCode app directory is absent"
+			});
+			continue;
+		}
+		if (fileNames.length === 0) {
+			attempts.push({
+				file: appDir,
+				tier: AGNESCODE_HARVEST_TIER.FILE_MISSING,
+				detail: "no code-auth-session*.v1 in the app directory"
+			});
+			continue;
+		}
+		fileNames.sort((a, b) => a.endsWith(".cn.v1") === b.endsWith(".cn.v1") ? a.localeCompare(b) : a.endsWith(".cn.v1") ? -1 : 1);
+		for (const fileName of fileNames) {
+			const filePath = `${appDir}/${fileName}`;
+			let blob;
+			try {
+				blob = await readFile(filePath);
+			} catch (why) {
+				attempts.push({
+					file: filePath,
+					tier: AGNESCODE_HARVEST_TIER.UNREADABLE,
+					detail: why instanceof Error ? why.message : String(why)
+				});
+				continue;
+			}
+			let localStateRaw;
+			try {
+				localStateRaw = await readFile(`${appDir}/Local State`);
+			} catch {
+				attempts.push({
+					file: filePath,
+					tier: AGNESCODE_HARVEST_TIER.NO_KEY,
+					detail: "the sibling Local State is absent"
+				});
+				continue;
+			}
+			let key;
+			try {
+				key = await unwrapAgnescodeLocalStateKey(localStateRaw, dpapiUnprotect);
+			} catch (why) {
+				attempts.push({
+					file: filePath,
+					tier: AGNESCODE_HARVEST_TIER.NO_KEY,
+					detail: why instanceof Error ? why.message : String(why)
+				});
+				continue;
+			}
+			let plain;
+			try {
+				plain = decryptAgnescodeSessionBlob(blob, key);
+			} catch (why) {
+				attempts.push({
+					file: filePath,
+					tier: AGNESCODE_HARVEST_TIER.DECRYPT_FAILED,
+					detail: `${why instanceof Error ? why.message : String(why)} (blob ${blob.length} B)`
+				});
+				continue;
+			}
+			let parsed;
+			try {
+				parsed = JSON.parse(plain.toString("utf8"));
+			} catch {
+				attempts.push({
+					file: filePath,
+					tier: AGNESCODE_HARVEST_TIER.MALFORMED,
+					detail: "decrypted bytes are not JSON"
+				});
+				continue;
+			}
+			const session = parseAgnescodeSession(parsed);
+			if (session === null) {
+				attempts.push({
+					file: filePath,
+					tier: str(obj(parsed).accessToken, "") === "" ? AGNESCODE_HARVEST_TIER.NO_TOKEN : AGNESCODE_HARVEST_TIER.UNTRUSTED_BASE,
+					detail: "the decrypted session lacks a usable token or a pinned Agnes base"
+				});
+				continue;
+			}
+			attempts.push({
+				file: filePath,
+				tier: AGNESCODE_HARVEST_TIER.OK,
+				detail: `JWT ${session.accessToken.length} chars`
+			});
+			return {
+				ok: true,
+				session,
+				attempts
+			};
+		}
+	}
+	return {
+		ok: false,
+		attempts
+	};
+}
+/**
+* Fetch the live model catalogue, or `null` when it cannot be read. The
+* adapter falls back to the static roster on `null` (the `console-client`
+* silent-fallback discipline).
+*
+* The BFF rows carry `is_member_only` — a fact about gating, not visibility,
+* so it is KEPT (the panel badges it; offering a member-gated model is
+* preferable to silently hiding one, mirroring red line 7's spirit of stating
+* account-level limits instead of dropping models).
+* @param {object} credential - `{ accessToken, bffBase }`.
+* @param {typeof fetch} [fetcher] - injected fetch.
+* @returns {Promise<object[]|null>} `[{id, name, vision, memberOnly, contextWindow, maxOutputLength}]`, or `null`.
+*/
+async function fetchAgnescodeCatalog(credential, fetcher) {
+	const effective = fetcher ?? globalThis.fetch;
+	const source = obj(credential);
+	const bffBase = trustAgnescodeBffBase(source.bffBase);
+	if (bffBase === null) return null;
+	try {
+		const response = await effective(`${bffBase}/models`, {
+			headers: agnescodeHeaders(source),
+			signal: AbortSignal.timeout(3e4)
+		});
+		if (!response.ok) return null;
+		const body = obj(await response.json().catch(() => ({})));
+		const models = Array.isArray(body.data) ? body.data : [];
+		const seen = /* @__PURE__ */ new Set();
+		const out = [];
+		for (const raw of models) {
+			const model = obj(raw);
+			const id = str(model.id, "");
+			if (id === "" || seen.has(id)) continue;
+			if (str(model.model_type, "text") !== "text") continue;
+			seen.add(id);
+			out.push({
+				id,
+				name: str(model.name, id),
+				vision: false,
+				memberOnly: model.is_member_only === true,
+				contextWindow: num(model.max_input_tokens),
+				maxOutputLength: num(model.max_output_tokens)
+			});
+		}
+		return out.length > 0 ? out : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Read the account's credit pool. Read-only; the envelope is a SUBSCRIPTION
+* pool (level / time-sensitive vs permanent credits), NOT a Token Plan
+* usage-overview — the panel must not render it with quota semantics.
+* @param {object} credential - `{ accessToken, bffBase }`.
+* @param {typeof fetch} [fetcher] - injected fetch.
+* @returns {Promise<object|null>} `{totalBalance, timeSensitiveBalance, permanentBalance, subscriptionCredits, dailyFreeCredits, level}` or `null`.
+*/
+async function fetchAgnescodeBalance(credential, fetcher) {
+	const effective = fetcher ?? globalThis.fetch;
+	const source = obj(credential);
+	const bffBase = trustAgnescodeBffBase(source.bffBase);
+	if (bffBase === null) return null;
+	try {
+		const response = await effective(`${agnescodeApiRoot(bffBase)}/api/v2/subscription/credits-balance`, {
+			headers: agnescodeHeaders(source),
+			signal: AbortSignal.timeout(3e4)
+		});
+		if (!response.ok) return null;
+		const envelope = obj(await response.json().catch(() => ({})));
+		if (str(envelope.code, "") !== "000000" || envelope.data === null || typeof envelope.data !== "object") return null;
+		const data = obj(envelope.data);
+		const total = numOrNullSafe(data.total_balance);
+		if (total === null) return null;
+		return {
+			totalBalance: total,
+			timeSensitiveBalance: numOrNullSafe(data.time_sensitive_balance) ?? 0,
+			permanentBalance: numOrNullSafe(data.permanent_balance) ?? 0,
+			subscriptionCredits: numOrNullSafe(data.subscription_credits) ?? 0,
+			dailyFreeCredits: numOrNullSafe(data.daily_free_credits) ?? 0,
+			level: num(data.level)
+		};
+	} catch {
+		return null;
+	}
+}
+/** Read a finite non-negative number, else `null`. */
+function numOrNullSafe(value) {
+	const parsed = Number(value);
+	return Number.isFinite(parsed) && parsed >= 0 ? parsed : null;
+}
+/**
+* The static fallback roster: the seven models the CN BFF listed at probe time
+* (2026-10-01, ROADMAP §6.3). All `model_type: text`, no multiplier concept
+* (billing is the credit pool, not per-model rates). Used ONLY when
+* `fetchAgnescodeCatalog` comes back empty; a fresh catalogue always wins.
+*/
+const AGNESCODE_FALLBACK_MODELS = Object.freeze([
+	{
+		id: "agnes-3.0-flash",
+		name: "Agnes 3.0 Flash",
+		memberOnly: false,
+		vision: false,
+		contextWindow: 512e3,
+		maxOutputLength: 65536
+	},
+	{
+		id: "agnes-2.5-flash",
+		name: "Agnes 2.5 Flash",
+		memberOnly: false,
+		vision: false,
+		contextWindow: 512e3,
+		maxOutputLength: 65536
+	},
+	{
+		id: "agnes-2.5-pro",
+		name: "Agnes 2.5 Pro",
+		memberOnly: false,
+		vision: false,
+		contextWindow: 512e3,
+		maxOutputLength: 65536
+	},
+	{
+		id: "deepseek-v4-flash",
+		name: "DeepSeek V4 Flash",
+		memberOnly: true,
+		vision: false,
+		contextWindow: 1e6,
+		maxOutputLength: 393216
+	},
+	{
+		id: "glm-5.2",
+		name: "GLM-5.2",
+		memberOnly: true,
+		vision: false,
+		contextWindow: 1e6,
+		maxOutputLength: 131072
+	},
+	{
+		id: "kimi-k3",
+		name: "Kimi K3",
+		memberOnly: true,
+		vision: false,
+		contextWindow: 1048576,
+		maxOutputLength: 131072
+	},
+	{
+		id: "deepseek-v4-pro",
+		name: "DeepSeek V4 Pro",
+		memberOnly: true,
+		vision: false,
+		contextWindow: 1e6,
+		maxOutputLength: 393216
+	}
+]);
+
+//#endregion
+//#region src/host/agnescode-models.ts
+/**
+* AgnesCode catalogue entry → pi-ai model descriptor mapping — the peer-free
+* half of the third upstream provider. Mirrors `raccoon-models.ts`'s
+* discipline: plain objects only (no Host peer import); `agnescode-llm-adapter.ts`
+* is the peer-dependent half.
+*
+* Three decisions carried here:
+*   1. `reasoning: false` — the catalogue rows declare a `thinking_toggle`
+*      (default ON), but the WIRE field that would control it from OpenAI
+*      chat is UNVERIFIED (ROADMAP §6.3). Offering a thinking selector would
+*      promise something the descriptor cannot emit; the honest v1 shape is
+*      "no toggle; the BFF defaults to thinking ON". A stated limitation, not
+*      an oversight.
+*   2. The base URL is PER-ACCOUNT (`bffPublicBaseUrl` from the session
+*      file), so it rides through the builder's options instead of a module
+*      constant — the reference reverse-proxy's hardcoded `.com` constant is
+*      the trap this avoids.
+*   3. `memberOnly` models are OFFERED, not dropped: gating is account state,
+*      not model truth (red line 7's spirit — state limits, never silently
+*      retract models). The panel badges them; a request that hits the gate
+*      fails visibly at the upstream.
+*
+* @module dsh-connect-agnes-token-plan/agnescode-models
+*/
+/** The provider id this plugin registers under for AgnesCode. */
+const AGNESCODE_PROVIDER_ID = "sensenova-agnescode";
+/** What the DSH model picker shows as the AgnesCode provider's name. */
+const AGNESCODE_DISPLAY_NAME = "SenseNova AgnesCode";
+/** The zero-cost sentinel: per-token prices are unknowable (credit-gated). */
+const NO_COST = Object.freeze({
+	input: 0,
+	output: 0,
+	cacheRead: 0,
+	cacheWrite: 0
+});
+/** The catalogue/identity headers every request carries (probed: required). */
+function agnescodeRequestHeaders() {
+	return {
+		Accept: "application/json",
+		"Content-Type": "application/json",
+		"X-App-Id": "1",
+		"X-Platform": "1",
+		"X-User-Language": "zh-Hans"
+	};
+}
+/**
+* The AgnesCode model rows the panel shows and the adapter offers.
+*
+* A live catalogue row always beats the static fallback roster. The row keeps
+* what the picker and panel need — plus `memberOnly`, which this provider HAS
+* a platform-declared fact for and the panel badges.
+* @param {object[]|null} [catalog] - the `fetchAgnescodeCatalog` result.
+* @returns {object[]} the AgnesCode model rows.
+*/
+function agnescodeRoster(catalog) {
+	const rows = Array.isArray(catalog) && catalog.length > 0 ? catalog : AGNESCODE_FALLBACK_MODELS;
+	const out = [];
+	for (const row of rows) {
+		const id = str(row?.id, "");
+		if (id === "") continue;
+		out.push({
+			id,
+			name: str(row?.name, id),
+			vision: row?.vision === true,
+			memberOnly: row?.memberOnly === true,
+			multiplier: typeof row?.multiplier === "number" ? row.multiplier : void 0,
+			contextWindow: num(row?.contextWindow),
+			maxOutputLength: num(row?.maxOutputLength)
+		});
+	}
+	return out;
+}
+/**
+* Map one AgnesCode row onto the pi-ai model descriptor the adapter offers.
+* @param {object} row - an {@link agnescodeRoster} row (must carry `id`).
+* @param {object} [options] - `{ bffBase }` — the pinned per-account base.
+* @returns {object} the pi-ai descriptor.
+*/
+function agnescodeToDescriptor(row, options = {}) {
+	const id = str(row?.id, "");
+	if (id === "") throw new Error("agnescodeToDescriptor: row has no id");
+	const bffBase = str(options.bffBase, "");
+	if (bffBase === "") throw new Error("agnescodeToDescriptor: a pinned bffBase is required");
+	const vision = row?.vision === true;
+	return {
+		id,
+		name: str(row?.name, id),
+		api: "openai-completions",
+		provider: AGNESCODE_PROVIDER_ID,
+		baseUrl: bffBase,
+		input: vision ? ["text", "image"] : ["text"],
+		reasoning: false,
+		cost: { ...NO_COST },
+		contextWindow: num(row?.contextWindow) ?? 512e3,
+		maxTokens: num(row?.maxOutputLength) ?? 32e3,
+		headers: agnescodeRequestHeaders(),
+		compat: {
+			maxTokensField: "max_tokens",
+			supportsDeveloperRole: false
+		}
+	};
+}
+/**
+* Build the whole descriptor list for one AgnesCode roster.
+* @param {object[]} [roster] - the {@link agnescodeRoster} result.
+* @param {object} [options] - `{ bffBase }`.
+* @returns {object[]} the pi-ai descriptors.
+*/
+function buildAgnescodeDescriptors(roster, options = {}) {
+	const list = Array.isArray(roster) ? roster : agnescodeRoster(null);
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const row of list) {
+		const id = str(row?.id, "");
+		if (id === "" || seen.has(id)) continue;
+		seen.add(id);
+		out.push(agnescodeToDescriptor(row, options));
+	}
+	return out;
+}
+
+//#endregion
+export { AGNESCODE_FALLBACK_MODELS as a, fetchAgnescodeCatalog as c, buildAgnescodeDescriptors as i, harvestAgnescodeLocalSession as l, AGNESCODE_PROVIDER_ID as n, decodeAgnescodeJwtExpMs as o, agnescodeRoster as r, fetchAgnescodeBalance as s, AGNESCODE_DISPLAY_NAME as t, trustAgnescodeBffBase as u };