dsh-llm-adapters 1.2.0 → 1.2.2

package/src/account-store.ts

@@ -39,12 +39,12 @@ export interface RaccoonAccountRecord {
 }
 
 /**
- * One Trae web login.
+ * One Trae login.
  *
- * `accessToken` is the `Cloud-IDE-JWT` the website itself uses. `deviceId` and
- * `machineId` are the fingerprints captured from that web session — this
- * plugin never reads a desktop install — and are replayed on chat, quota and
- * check-in requests.
+ * `accessToken` is the `Cloud-IDE-JWT` Trae's own clients use. `deviceId` and
+ * `machineId` are replayed on chat, quota and check-in requests. A web login
+ * captures them from its browser session; a `client` login copies the desktop
+ * client's own values, which is the only source the check-in route accepts.
  */
 export interface TraeAccountRecord {
   accessToken: string
@@ -54,6 +54,8 @@ export interface TraeAccountRecord {
   userId?: string
   name?: string
   loginAt: number
+  /** Where the token came from; absent means the plugin's browser login. */
+  source?: 'web' | 'client'
   /** The `Cloud-IDE-JWT` expiry (about 8 hours); absent when the JWT carries none. */
   expiresAt?: number
   /**
@@ -91,12 +93,19 @@ export interface CodeArtsAccountRecord {
     d: string
   }
   userName?: string
+  /**
+   * The `x-ot-session-id` this account chats under: one stable value instead of
+   * one per request, because the gateway counts concurrent sessions by it.
+   *
+   * A record written before the field existed derives the same value from the
+   * refresh token's profile, so an existing sign-in needs no new login.
+   */
+  otSessionId?: string
   /**
    * Models the account answered `InferHub.4004.200` for.
    *
-   * The verdict is worth persisting: asking with `maas_type: benefit` spends
-   * one of the three chat slots the plan allows per minute, even though the
-   * call cannot succeed.
+   * Worth persisting: the account has no allowance pack for them, so without the
+   * verdict every call would pay for a request that cannot succeed.
    */
   noBenefit?: string[]
   loginAt: number
@@ -138,9 +147,11 @@ function traeRecord(value: unknown, region: TraeRegion): TraeAccountRecord | und
   const accessToken = text(raw?.accessToken)
   if (raw === undefined || accessToken === undefined) return undefined
   const deviceId = text(raw.deviceId)
+  const source = raw.source === 'web' || raw.source === 'client' ? raw.source : undefined
   return {
     accessToken,
     region,
+    ...source === undefined ? {} : { source },
     deviceId: deviceId ?? `web-${randomBytes(8).toString('hex')}`,
     machineId: text(raw.machineId) ?? `web-${randomBytes(16).toString('hex')}`,
     loginAt: number(raw.loginAt) ?? Date.now(),
@@ -177,6 +188,7 @@ function codeartsRecord(value: unknown): CodeArtsAccountRecord | undefined {
     ...text(raw.codeVerifier) === undefined ? {} : { codeVerifier: text(raw.codeVerifier)! },
     ...key === undefined ? {} : { dpopPrivateJwk: key },
     ...text(raw.userName) === undefined ? {} : { userName: text(raw.userName)! },
+    ...text(raw.otSessionId) === undefined ? {} : { otSessionId: text(raw.otSessionId)! },
     ...noBenefit.length === 0 ? {} : { noBenefit },
   }
 }

package/src/adapter.ts

@@ -22,7 +22,7 @@ import { LoomyProvider } from './loomy.ts'
 import { RaccoonProvider } from './raccoon.ts'
 import { TraeProvider } from './trae.ts'
 import type { AuthStatus } from './auth.ts'
-import type { CheckinStatus, ProviderStatus, QuotaSnapshot } from './types.ts'
+import type { CheckinStatus, ClientLoginStatus, ProviderStatus, QuotaSnapshot } from './types.ts'
 import type { ReadImage } from './wire.ts'
 
 export interface AdapterOptions {
@@ -41,7 +41,7 @@ export interface AdapterOptions {
  *
  * Declared as an interface rather than a union so a new provider only has to
  * implement the behaviour, not edit the adapter's type list. The optional
- * check-in methods exist only on Trae.
+ * client-login and check-in methods exist only on Trae.
  */
 export interface ProviderClient {
   status(): Promise<AuthStatus>
@@ -64,6 +64,10 @@ export interface ProviderClient {
   invalidateModels(): void
   invalidateQuota(): void
   close(): void
+  /** Trae only: the local desktop client's current sign-in state. */
+  localClientLogin?(): Promise<ClientLoginStatus>
+  /** Trae only: copy that state into the plugin's own account store. */
+  importClientLogin?(): Promise<void>
   checkinStatus?(): Promise<CheckinStatus>
   claimCheckin?(): Promise<CheckinStatus>
 }
@@ -154,6 +158,17 @@ export abstract class LocalAdapter extends LlmAdapter {
     return result
   }
 
+  /** Import a local client login and return the refreshed account reading. */
+  async importClientLogin(): Promise<ProviderStatus> {
+    if (this.client.importClientLogin === undefined) {
+      throw new Error('该供应商不支持复用本机客户端登录')
+    }
+    await this.client.importClientLogin()
+    this.invalidateCatalog()
+    this.invalidateUsage()
+    return this.usageInfo(true)
+  }
+
   invalidateCatalog(): void {
     this.client.invalidateModels()
   }
@@ -165,7 +180,20 @@ export abstract class LocalAdapter extends LlmAdapter {
   /** Login state plus quota, shaped for the settings page. */
   async usageInfo(fresh = false): Promise<ProviderStatus> {
     const auth = await this.client.status()
-    const base: ProviderStatus = { brand: this.brand, ...auth }
+    // Detection is part of the reading even while signed out: that is what
+    // offers the second sign-in method. Only Trae implements it.
+    const clientLogin = this.client.localClientLogin === undefined
+      ? undefined
+      : await this.client.localClientLogin().catch(error => ({
+          available: false,
+          signedIn: false,
+          error: error instanceof Error ? error.message : String(error),
+        }))
+    const base: ProviderStatus = {
+      brand: this.brand,
+      ...auth,
+      ...clientLogin === undefined ? {} : { clientLogin },
+    }
     // Trae's check-in state is part of the account reading; the other two
     // providers do not implement it, so this costs them nothing.
     const checkin = this.client.checkinStatus === undefined

package/src/api.ts

@@ -184,8 +184,20 @@ async function handleAccount(req: IncomingMessage, res: ServerResponse, adapters
     return
   }
 
-  // Trae and CodeArts have a daily reward; the other adapters reject the action,
-  // so the page can keep one button that simply reports the refusal.
+  // Trae's second sign-in method: the desktop client must already be logged in.
+  // The response is an ordinary account reading, so it never carries the token.
+  if (action === 'client-login') {
+    try {
+      send(res, 200, await adapter.importClientLogin())
+    } catch (error) {
+      send(res, 400, { error: error instanceof Error ? error.message : String(error) })
+    }
+    return
+  }
+
+  // Trae (client login only) and CodeArts have a daily reward; the other
+  // adapters reject the action, so the page can keep one button that simply
+  // reports the refusal.
   if (action === 'checkin') {
     try {
       send(res, 200, { brand, checkin: await adapter.claimCheckin() })
@@ -195,7 +207,7 @@ async function handleAccount(req: IncomingMessage, res: ServerResponse, adapters
     return
   }
 
-  send(res, 400, { error: 'action 只接受 browser、browser-cancel、checkin 或 logout' })
+  send(res, 400, { error: 'action 只接受 browser、browser-cancel、client-login、checkin 或 logout' })
 }
 
 export async function handleApi(

package/src/auth.ts

@@ -1,10 +1,11 @@
 /**
  * Credential state for every provider.
  *
- * Sign-in happens in the provider's own web page, so credentials exist in
- * exactly one place: the plugin's own account store. No desktop client file is
- * discovered, read, or written, and no token leaves this module in errors or
- * display fields.
+ * Sign-in happens in the provider's own web page. Trae additionally offers an
+ * explicit, read-only import of the local desktop client's login state; nothing
+ * is ever written back to that client. Either way credentials end up in exactly
+ * one place, the plugin's own account store, and no token leaves this module in
+ * errors or display fields.
  *
  * @module dsh-llm-adapters/auth
  */
@@ -13,7 +14,7 @@ import type {
   AccountStore, CodeArtsAccountRecord, LoomyAccountRecord, RaccoonAccountRecord, TraeAccountRecord,
 } from './account-store.ts'
 import type { TraeRegion } from './brand.ts'
-import { RefreshTokenExpiredError, exchangeRefreshToken, keyPairFromStoredJwk, readUserProfile } from './codearts-oauth.ts'
+import { RefreshTokenExpiredError, exchangeRefreshToken, keyPairFromStoredJwk, otSessionIdOf, readUserProfile } from './codearts-oauth.ts'
 import type { CodeArtsCredential } from './codearts-oauth.ts'
 import { responseError } from './http.ts'
 import { TRAE_REGION_PROFILES, TRAE_WEB_USER_AGENT } from './trae-endpoints.ts'
@@ -34,6 +35,8 @@ export interface AuthStatus {
   possiblyExpired?: boolean
   account?: LocalAccount
   error?: string
+  /** Trae only: where the token came from. */
+  loginSource?: 'web' | 'client'
 }
 
 /** Expiry margin for Raccoon's JWT, so a call does not start on a dead token. */
@@ -111,6 +114,13 @@ export interface JwtFacts {
   phone?: string
   ownerType?: string
   sessionId?: string
+  /**
+   * The `sub` claim, which is what an account is called on the Raccoon gateway.
+   *
+   * Unlike the token itself it survives a re-sign, so it is the seed a stable
+   * per-account session id is derived from.
+   */
+  subject?: string
 }
 
 /** Normalize seconds, milliseconds, and ISO strings to epoch milliseconds. */
@@ -142,6 +152,7 @@ export function decodeJwtFacts(token: string): JwtFacts {
       ...typeof record.phone === 'string' ? { phone: record.phone } : {},
       ...typeof record.owner_type === 'string' ? { ownerType: record.owner_type } : {},
       ...typeof record.sid === 'string' ? { sessionId: record.sid } : {},
+      ...typeof record.sub === 'string' ? { subject: record.sub } : {},
     }
   } catch {
     return {}
@@ -261,12 +272,13 @@ function mergeSetCookies(current: string, headers: readonly string[]): string {
 }
 
 /**
- * Trae's web login, one per region.
+ * Trae's login, one per region.
  *
- * The `Cloud-IDE-JWT` the website issues lives about eight hours, but the
- * website session behind it lives about fourteen days. The cookies captured at
- * sign-in are replayed against `GetUserToken` to renew the short token silently;
- * only when the session itself dies does the user have to sign in again.
+ * A web login stores the `Cloud-IDE-JWT` from the website plus the cookies
+ * behind it, so the short token can be renewed silently until the website
+ * session dies. A client login stores the token the desktop client already
+ * uses; that token has no website session, and the client itself refreshes it.
+ * Only the client source carries the device id the check-in route accepts.
  */
 export class TraeAuth {
   private readonly inflight = new Map<TraeRegion, Promise<string>>()
@@ -286,20 +298,41 @@ export class TraeAuth {
     const region = this.region()
     const stored = await this.store.trae(region)
     if (stored === undefined) {
-      return { signedIn: false, error: `${traeLabel(region)}尚未登录。请在设置页点「打开浏览器登录」。` }
+      return {
+        signedIn: false,
+        error: `${traeLabel(region)}尚未登录。可以点「打开浏览器登录」，或复用本机已登录的 Trae 客户端。`,
+      }
     }
+    const source = stored.source ?? 'web'
     const now = Date.now()
     const { token, session } = traeExpiries(stored)
     const tokenExpired = token !== undefined && token <= now + TRAE_EXPIRY_MARGIN_MS
+    const account = traeAccount(stored)
+    if (source === 'client') {
+      // The client owns the refresh loop; when its token dies the user signs in
+      // there again and imports the new state.
+      const signedIn = !tokenExpired
+      return {
+        signedIn,
+        loginSource: 'client',
+        loginAt: stored.loginAt,
+        ...token === undefined ? {} : { expiresAt: token },
+        ...!signedIn ? { possiblyExpired: true } : {},
+        ...Object.keys(account).length === 0 ? {} : { account },
+        ...!signedIn
+          ? { error: `${traeLabel(region)}客户端登录令牌已过期，请先在 Trae 客户端重新登录，再点「复用客户端登录态」。` }
+          : {},
+      }
+    }
     const sessionExpired = session !== undefined && session <= now + TRAE_EXPIRY_MARGIN_MS
     const refreshable = stored.cookies !== undefined && !sessionExpired
     const signedIn = !tokenExpired || refreshable
-    const account = traeAccount(stored)
     // With a renewable session the user cares about the website-session
     // deadline, not the eight-hour JWT the plugin replaces on its own.
     const expiresAt = refreshable ? session ?? token : token
     return {
       signedIn,
+      loginSource: 'web',
       loginAt: stored.loginAt,
       ...expiresAt === undefined ? {} : { expiresAt },
       ...!signedIn ? { possiblyExpired: true } : {},
@@ -315,17 +348,23 @@ export class TraeAuth {
   /**
    * The bearer token, or an actionable error when there is none.
    *
-   * A token near its expiry is renewed first; `force` means the gateway already
-   * rejected it, so the renewal is attempted even if the clock disagrees.
+   * A web token near its expiry is renewed first; `force` means the gateway
+   * already rejected it, so the renewal is attempted even if the clock
+   * disagrees. A client token is returned until its own expiry and then asks
+   * for a fresh import, because only the client can refresh it.
    */
   async accessToken(force = false): Promise<string> {
     const region = this.region()
     const stored = await this.store.trae(region)
     if (stored === undefined) {
-      throw new Error(`${traeLabel(region)}尚未登录。请在设置页点「打开浏览器登录」。`)
+      throw new Error(`${traeLabel(region)}尚未登录。可以点「打开浏览器登录」，或复用本机已登录的 Trae 客户端。`)
     }
     const { token, session } = traeExpiries(stored)
     const expired = token !== undefined && token <= Date.now() + TRAE_EXPIRY_MARGIN_MS
+    if (stored.source === 'client') {
+      if (!force && !expired) return stored.accessToken
+      throw new Error(`${traeLabel(region)}客户端登录令牌已${force ? '失效' : '过期'}，请先在 Trae 客户端重新登录，再点「复用客户端登录态」。`)
+    }
     if (!force && !expired) return stored.accessToken
     if (stored.cookies === undefined) {
       throw new Error(`${traeLabel(region)}登录已${force ? '失效' : '过期'}，请在设置页重新登录。`)
@@ -342,7 +381,7 @@ export class TraeAuth {
     if (existing !== undefined) return existing
     const task = (async () => {
       const stored = await this.store.trae(region)
-      if (stored === undefined || stored.cookies === undefined) {
+      if (stored === undefined || stored.source === 'client' || stored.cookies === undefined) {
         throw new Error(`${traeLabel(region)}登录已失效，请在设置页重新登录。`)
       }
       const profile = TRAE_REGION_PROFILES[region]
@@ -408,7 +447,7 @@ export class TraeAuth {
     const region = this.region()
     const stored = await this.store.trae(region)
     if (stored === undefined) {
-      throw new Error(`${traeLabel(region)}尚未登录。请在设置页点「打开浏览器登录」。`)
+      throw new Error(`${traeLabel(region)}尚未登录。可以点「打开浏览器登录」，或复用本机已登录的 Trae 客户端。`)
     }
     return {
       deviceId: stored.deviceId,
@@ -515,6 +554,7 @@ export class CodeArtsAuth {
           ...next.expiresAt === undefined ? {} : { expiresAt: next.expiresAt },
           ...next.refreshToken === undefined ? {} : { refreshToken: next.refreshToken },
           ...next.userName === undefined ? {} : { userName: next.userName },
+          ...next.otSessionId === undefined ? {} : { otSessionId: next.otSessionId },
         })
         this.lastError = undefined
         return next
@@ -539,6 +579,10 @@ export class CodeArtsAuth {
 }
 
 function credentialOf(record: CodeArtsAccountRecord): CodeArtsCredential {
+  // A record written before `otSessionId` existed derives the very value the
+  // login would have stored, so an account that is already signed in gets its
+  // single session without a new login.
+  const otSessionId = record.otSessionId ?? otSessionIdOf(readUserProfile(record.refreshToken))
   return {
     accessKeyId: record.accessKeyId,
     secretAccessKey: record.secretAccessKey,
@@ -547,5 +591,6 @@ function credentialOf(record: CodeArtsAccountRecord): CodeArtsCredential {
     ...record.refreshToken === undefined ? {} : { refreshToken: record.refreshToken },
     ...record.codeVerifier === undefined ? {} : { codeVerifier: record.codeVerifier },
     ...record.dpopPrivateJwk === undefined ? {} : { dpopPrivateJwk: record.dpopPrivateJwk },
+    ...otSessionId === undefined ? {} : { otSessionId },
   }
 }

package/src/codearts-oauth.ts

@@ -35,6 +35,17 @@ export interface CodeArtsCredential {
   dpopPrivateJwk?: DpopPrivateJwk
   /** Display only, from the refresh token's profile; never used for signing. */
   userName?: string
+  /**
+   * The id the gateway counts concurrent sessions against (`x-ot-session-id`).
+   *
+   * Measured on a real account: the three-session cap is keyed by this header,
+   * not by `Chat-Id` / `Session-Id`. A per-request value makes every call a new
+   * session, so the account spends its own budget on its own history and the
+   * fourth call of the minute comes back `TM.00001041`. Derived from the account
+   * identity instead of stored at random: the same value in every process, and
+   * one that survives a token renewal.
+   */
+  otSessionId?: string
 }
 
 /** Who the credential belongs to, as the portal encoded it in the token. */
@@ -180,6 +191,19 @@ export function readUserProfile(token: string | undefined): CodeArtsUserProfile
   }
 }
 
+/**
+ * The session id this account should chat under, derived from who the account is.
+ *
+ * 32 lowercase hex, the shape the IDE's own kernel sends. Nothing but stability
+ * matters here — the gateway uses the value as a key, not as an identity — so it
+ * is hashed from the principal id rather than kept in a file.
+ */
+export function otSessionIdOf(profile: CodeArtsUserProfile | undefined): string | undefined {
+  const seed = profile?.userId ?? profile?.userName
+  if (seed === undefined) return undefined
+  return createHash('sha256').update(`codearts-ot-session:${seed}`).digest('hex').slice(0, 32)
+}
+
 /** The portal URL the browser opens; the callback is on loopback. */
 export function buildAuthorizeUrl(port: number, pkce: PkcePair, ticketId: string): string {
   return `${CODEARTS_PORTAL_AUTHORIZE}?theme=2&locale=zh-cn`
@@ -263,13 +287,18 @@ export async function exchangeRefreshToken(
   }, keyPair, fetcher)
   const credential = credentialFrom(token, codeVerifier, keyPair)
   // A refresh response may omit the rotated refresh token; keep the old one so
-  // the next refresh is still possible. The name rides on that token, so it has
-  // to be read from whichever one this credential ends up carrying.
-  const userName = credential.userName ?? readUserProfile(refreshToken)?.userName
+  // the next refresh is still possible. The name and the account identity ride on
+  // that token, so both are read from whichever one this credential ends up
+  // carrying: a response without a profile must not hand the account a new
+  // session id, or every renewal would cost it a slot again.
+  const previous = readUserProfile(refreshToken)
+  const userName = credential.userName ?? previous?.userName
+  const otSessionId = credential.otSessionId ?? otSessionIdOf(previous)
   return {
     ...credential,
     refreshToken: credential.refreshToken ?? refreshToken,
     ...userName === undefined ? {} : { userName },
+    ...otSessionId === undefined ? {} : { otSessionId },
   }
 }
 
@@ -277,14 +306,16 @@ function credentialFrom(token: TokenResponse, codeVerifier: string, keyPair: Dpo
   const credentials = token.credentials ?? {}
   const expiration = credentials.expiration
   const expiresAt = expiration === undefined ? undefined : Date.parse(expiration)
-  const userName = readUserProfile(token.refresh_token)?.userName
+  const profile = readUserProfile(token.refresh_token)
+  const otSessionId = otSessionIdOf(profile)
   return {
     accessKeyId: credentials.access_key_id ?? '',
     secretAccessKey: credentials.secret_access_key ?? '',
     securityToken: credentials.security_token ?? '',
     ...expiresAt === undefined || Number.isNaN(expiresAt) ? {} : { expiresAt },
     ...token.refresh_token === undefined ? {} : { refreshToken: token.refresh_token },
-    ...userName === undefined ? {} : { userName },
+    ...profile?.userName === undefined ? {} : { userName: profile.userName },
+    ...otSessionId === undefined ? {} : { otSessionId },
     codeVerifier,
     dpopPrivateJwk: keyPair.privateKeyJwk,
   }

package/src/codearts.ts

@@ -46,7 +46,6 @@ import {
 } from './codearts-endpoints.ts'
 import { CodeArtsLogin } from './codearts-login.ts'
 import { headersForFetch, sha256Hex, signRequestHuawei } from './codearts-sign.ts'
-import { CodeArtsSessionWindow, sharedSessionWindow } from './codearts-window.ts'
 import type { CodeArtsCredential } from './codearts-oauth.ts'
 import type { LoginStatus } from './login-page.ts'
 import { parseModelName } from './model-name.ts'
@@ -115,8 +114,6 @@ export interface CodeArtsProviderOptions {
   loginTimeoutMs?: number
   /** Injectable OpenRouter lookup for tests; defaults to the live catalog. */
   openRouter?: OpenRouterLookup
-  /** Chat budget; defaults to the process-wide window (survives hot reloads). */
-  window?: CodeArtsSessionWindow
 }
 
 /** One roster entry before it becomes a model row. */
@@ -306,20 +303,22 @@ const sleep = (ms: number, signal?: AbortSignal): Promise<void> => new Promise((
   signal?.addEventListener('abort', onAbort, { once: true })
 })
 
-/** Retries for a gateway that is busy for reasons the window cannot predict. */
+/** Retries for a gateway that is busy for reasons the caller cannot predict. */
 const QUEUE_ATTEMPTS = 3
-/** Minimum pause before retrying a rejected call; the window adds its own. */
+/** Pause before retrying a rejected call. */
 const QUEUE_BACKOFF_MS = 20_000
 
 /**
  * The message a user sees once waiting is hopeless.
  *
- * The raw gateway text (`TM.00001041`) reads like a bug; the limit is the
- * trial plan's, and the only fix on this side is to say so.
+ * The raw gateway text (`TM.00001041`) reads like a bug. The three concurrent
+ * sessions are the trial plan's, and one plugin chatting under a single session
+ * id is not meant to reach them: the slots are being held by something else on
+ * the same account.
  */
 function queueExhausted(): ProviderHttpError {
   return new ProviderHttpError(
-    'CodeArts 体验版每分钟只允许 3 个会话，当前已被占满。请稍等片刻再发，或关闭其它 CodeArts 会话。',
+    'CodeArts 这个账号的 3 个并发会话已被占满（通常是码道 IDE 或另一台设备），请稍后再发，或关闭其它 CodeArts 会话。',
     429,
   )
 }
@@ -356,7 +355,6 @@ export class CodeArtsProvider {
   /** Models that answered `InferHub.4004.200`: no allowance pack to bill. */
   private readonly noBenefit = new Set<string>()
   private noBenefitLoaded = false
-  private readonly window: CodeArtsSessionWindow
   private readonly openRouter: OpenRouterLookup
   private readonly sessionId = randomUUID()
   /**
@@ -371,7 +369,6 @@ export class CodeArtsProvider {
   private imageCacheWrite: Promise<void> = Promise.resolve()
 
   constructor(private readonly options: CodeArtsProviderOptions) {
-    this.window = options.window ?? sharedSessionWindow()
     this.openRouter = options.openRouter ?? new OpenRouterCatalog(options.fetchImpl ?? fetch)
     this.catalog = new ModelCatalog(() => this.loadModels(), options.ttlMs)
     this.login = new CodeArtsLogin({
@@ -380,9 +377,7 @@ export class CodeArtsProvider {
       ...options.logger === undefined ? {} : { logger: options.logger },
       save: async (account) => {
         await options.store.saveCodearts(account as CodeArtsAccountRecord)
-        // A different account starts with a clean budget: the slots the gateway
-        // remembers belong to the old one.
-        this.window.reset()
+        // A different account has different verdicts about what it may bill.
         this.noBenefit.clear()
         this.invalidateModels()
         this.invalidateQuota()
@@ -784,7 +779,7 @@ export class CodeArtsProvider {
     }
   }
 
-  /** Ask the vision model to describe one image, within the same chat budget. */
+  /** Ask the vision model to describe one image; another turn on the same session. */
   private async describeImage(dataUrl: string, signal?: AbortSignal): Promise<string> {
     const payload = JSON.stringify({
       model: CODEARTS_VISION_MODEL,
@@ -802,8 +797,6 @@ export class CodeArtsProvider {
     let authRefreshed = false
     let queueAttempts = 0
     for (;;) {
-      // The vision model is another chat session, so it spends the same budget.
-      const slot = await this.window.open(signal)
       let response: Response
       try {
         response = await this.send(chatId, payload, CODEARTS_VISION_MODEL, false, signal)
@@ -814,10 +807,9 @@ export class CodeArtsProvider {
           continue
         }
         if (error instanceof CodeArtsRetry && error.kind === 'queue') {
-          slot.release()
           if (queueAttempts < QUEUE_ATTEMPTS) {
             queueAttempts++
-            await sleep(Math.max(this.window.waitMs(), QUEUE_BACKOFF_MS), signal)
+            await sleep(QUEUE_BACKOFF_MS, signal)
             continue
           }
           throw queueExhausted()
@@ -842,10 +834,9 @@ export class CodeArtsProvider {
         }
       } catch (error) {
         if (error instanceof CodeArtsRetry && error.kind === 'queue') {
-          slot.release()
           if (queueAttempts < QUEUE_ATTEMPTS) {
             queueAttempts++
-            await sleep(Math.max(this.window.waitMs(), QUEUE_BACKOFF_MS), signal)
+            await sleep(QUEUE_BACKOFF_MS, signal)
             continue
           }
           throw queueExhausted()
@@ -906,10 +897,6 @@ export class CodeArtsProvider {
     let benefitDropped = false
     let queueAttempts = 0
     for (;;) {
-      // The plan allows three sessions a minute for the whole account, and a
-      // rejected call spends one just like a served one. Wait for a slot here
-      // instead of firing into `TM.00001041` and hoping a retry lands later.
-      const slot = await this.window.open(options.signal)
       let response: Response
       try {
         response = await this.send(chatId, payload, model, benefitDropped, options.signal)
@@ -933,8 +920,7 @@ export class CodeArtsProvider {
           }
           if (error.kind === 'queue' && queueAttempts < QUEUE_ATTEMPTS) {
             queueAttempts++
-            slot.release()
-            await sleep(Math.max(this.window.waitMs(), QUEUE_BACKOFF_MS), options.signal)
+            await sleep(QUEUE_BACKOFF_MS, options.signal)
             continue
           }
           if (error.kind === 'queue') throw queueExhausted()
@@ -966,8 +952,7 @@ export class CodeArtsProvider {
         // safe while nothing has been emitted, or the answer would repeat.
         if (!produced && error instanceof CodeArtsRetry && error.kind === 'queue' && queueAttempts < QUEUE_ATTEMPTS) {
           queueAttempts++
-          slot.release()
-          await sleep(Math.max(this.window.waitMs(), QUEUE_BACKOFF_MS), options.signal)
+          await sleep(QUEUE_BACKOFF_MS, options.signal)
           continue
         }
         if (error instanceof CodeArtsRetry && error.kind === 'queue') throw queueExhausted()
@@ -997,6 +982,9 @@ export class CodeArtsProvider {
   ): Promise<Response> {
     const credential = await this.credential()
     const benefit = !benefitDropped && this.isBenefitModel(model)
+    // A credential whose token carries no identity falls back to this process's
+    // own id: still one session for the account, never one per request.
+    const otSessionId = credential.otSessionId ?? this.sessionId.replace(/-/g, '')
     const signed = await signRequestHuawei(
       credential.accessKeyId,
       credential.secretAccessKey,
@@ -1015,6 +1003,14 @@ export class CodeArtsProvider {
       'chat-id': chatId,
       'session-id': this.sessionId,
       lang: 'en',
+      // Measured on a real account: the gateway counts the account's concurrent
+      // sessions by `x-ot-session-id`, not by `chat-id` / `session-id`. One stable
+      // value is why the trial plan stops charging its own history for every
+      // turn; the trace id stays per request, as the IDE sends it. These join the
+      // unsigned set — `chat-id` and `session-id` already do.
+      'x-ot-session-id': otSessionId,
+      'user-session-id': otSessionId,
+      'x-ot-trace-id': randomUUID().replace(/-/g, ''),
     }
     const timeout = AbortSignal.timeout(Math.max(this.options.timeoutMs(), 60_000))
     const response = await this.fetcher(CODEARTS_CHAT_URL, {
@@ -1052,7 +1048,6 @@ export class CodeArtsProvider {
 
   async logoutAccount(): Promise<void> {
     await this.options.auth.logout()
-    this.window.reset()
     this.invalidateModels()
     this.invalidateQuota()
   }