dsh-llm-adapters 1.2.1 → 1.2.2

package/lib/types/auth.d.ts

@@ -44,6 +44,13 @@ export interface JwtFacts {
     phone?: string;
     ownerType?: string;
     sessionId?: string;
+    /**
+     * The `sub` claim, which is what an account is called on the Raccoon gateway.
+     *
+     * Unlike the token itself it survives a re-sign, so it is the seed a stable
+     * per-account session id is derived from.
+     */
+    subject?: string;
 }
 /** Read non-secret JWT claims; malformed tokens simply yield no facts. */
 export declare function decodeJwtFacts(token: string): JwtFacts;

package/lib/types/codearts-oauth.d.ts

@@ -28,6 +28,17 @@ export interface CodeArtsCredential {
     dpopPrivateJwk?: DpopPrivateJwk;
     /** Display only, from the refresh token's profile; never used for signing. */
     userName?: string;
+    /**
+     * The id the gateway counts concurrent sessions against (`x-ot-session-id`).
+     *
+     * Measured on a real account: the three-session cap is keyed by this header,
+     * not by `Chat-Id` / `Session-Id`. A per-request value makes every call a new
+     * session, so the account spends its own budget on its own history and the
+     * fourth call of the minute comes back `TM.00001041`. Derived from the account
+     * identity instead of stored at random: the same value in every process, and
+     * one that survives a token renewal.
+     */
+    otSessionId?: string;
 }
 /** Who the credential belongs to, as the portal encoded it in the token. */
 export interface CodeArtsUserProfile {
@@ -75,6 +86,14 @@ export declare function readJwtExpiry(token: string): number | undefined;
  * request; without it the field stays empty and the page says so.
  */
 export declare function readUserProfile(token: string | undefined): CodeArtsUserProfile | undefined;
+/**
+ * The session id this account should chat under, derived from who the account is.
+ *
+ * 32 lowercase hex, the shape the IDE's own kernel sends. Nothing but stability
+ * matters here — the gateway uses the value as a key, not as an identity — so it
+ * is hashed from the principal id rather than kept in a file.
+ */
+export declare function otSessionIdOf(profile: CodeArtsUserProfile | undefined): string | undefined;
 /** The portal URL the browser opens; the callback is on loopback. */
 export declare function buildAuthorizeUrl(port: number, pkce: PkcePair, ticketId: string): string;
 /** Where the browser lands after a successful or failed exchange. */

package/lib/types/codearts.d.ts

@@ -19,7 +19,6 @@ import type { AccountStore } from './account-store.ts';
 import { CodeArtsAuth } from './auth.ts';
 import type { AuthStatus } from './auth.ts';
 import type { ProviderModel } from './catalog.ts';
-import { CodeArtsSessionWindow } from './codearts-window.ts';
 import type { LoginStatus } from './login-page.ts';
 import type { OpenRouterLookup } from './openrouter.ts';
 import type { CheckinStatus, QuotaPack, QuotaSnapshot } from './types.ts';
@@ -72,8 +71,6 @@ export interface CodeArtsProviderOptions {
     loginTimeoutMs?: number;
     /** Injectable OpenRouter lookup for tests; defaults to the live catalog. */
     openRouter?: OpenRouterLookup;
-    /** Chat budget; defaults to the process-wide window (survives hot reloads). */
-    window?: CodeArtsSessionWindow;
 }
 /** One roster entry before it becomes a model row. */
 export interface CodeArtsModelRow {
@@ -110,7 +107,6 @@ export declare class CodeArtsProvider {
     /** Models that answered `InferHub.4004.200`: no allowance pack to bill. */
     private readonly noBenefit;
     private noBenefitLoaded;
-    private readonly window;
     private readonly openRouter;
     private readonly sessionId;
     /**
@@ -159,7 +155,7 @@ export declare class CodeArtsProvider {
      * so a conversation pays for the description once.
      */
     private relayImages;
-    /** Ask the vision model to describe one image, within the same chat budget. */
+    /** Ask the vision model to describe one image; another turn on the same session. */
     private describeImage;
     stream(options: GenerateOptions, model: string, readImage: ReadImage | undefined, onInvalidate: () => void): AsyncGenerator<StreamChunk>;
     private send;

package/lib/types/config.d.ts

@@ -45,8 +45,6 @@ export interface Config {
     catalogFetchTimeoutSeconds?: number;
     /** Minutes between automatic OpenRouter syncs; 0 disables the schedule. */
     openRouterSyncMinutes?: number;
-    /** Minutes between Raccoon daily-point checks; 0 disables the monitor. */
-    raccoonCheckinMinutes?: number;
 }
 export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     loomyEnabled: z<boolean, boolean, "volatile-defined">;
@@ -82,7 +80,6 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     modelCacheTtlSeconds: z<number, number, "volatile-defined">;
     catalogFetchTimeoutSeconds: z<number, number, "volatile-defined">;
     openRouterSyncMinutes: z<number, number, "volatile-defined">;
-    raccoonCheckinMinutes: z<number, number, "volatile-defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
     loomyEnabled: z<boolean, boolean, "volatile-defined">;
     raccoonEnabled: z<boolean, boolean, "volatile-defined">;
@@ -117,7 +114,6 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     modelCacheTtlSeconds: z<number, number, "volatile-defined">;
     catalogFetchTimeoutSeconds: z<number, number, "volatile-defined">;
     openRouterSyncMinutes: z<number, number, "volatile-defined">;
-    raccoonCheckinMinutes: z<number, number, "volatile-defined">;
 }>>, "plain">;
 export interface ResolvedConfig {
     loomyEnabled: boolean;
@@ -153,7 +149,6 @@ export interface ResolvedConfig {
     modelCacheTtlMs: number;
     catalogFetchTimeoutMs: number;
     openRouterSyncMinutes: number;
-    raccoonCheckinMinutes: number;
 }
 export type ParsedConfig = {
     readonly [K in keyof Config]?: unknown;

package/lib/types/index.d.ts

@@ -71,11 +71,10 @@ export { CodeArtsProvider, CODEARTS_DEFAULT_EFFORT, CODEARTS_EFFORTS, clampMaxTo
 export type { CodeArtsActivity, CodeArtsModelRow, CodeArtsPackageInfo, CodeArtsProviderOptions, } from './codearts.ts';
 export { CODEARTS_BENEFIT_FALLBACK, CODEARTS_CHAT_URL, CODEARTS_CONTEXT_WINDOWS, CODEARTS_EFFORT_LEVELS, CODEARTS_FALLBACK_CONTEXT_WINDOW, CODEARTS_MAX_OUTPUT_TOKENS, CODEARTS_SNAP_BASE, CODEARTS_VISION_MODELS, codeartsContextWindow, } from './codearts-endpoints.ts';
 export { headersForFetch, signRequestHuawei } from './codearts-sign.ts';
-export { RefreshTokenExpiredError, buildAuthorizeUrl, exchangeAuthorizationCode, exchangeRefreshToken, generateDpopKeyPair, generatePkcePair, readJwtExpiry, signDpopJws, } from './codearts-oauth.ts';
+export { RefreshTokenExpiredError, buildAuthorizeUrl, exchangeAuthorizationCode, exchangeRefreshToken, generateDpopKeyPair, generatePkcePair, otSessionIdOf, readJwtExpiry, signDpopJws, } from './codearts-oauth.ts';
 export type { CodeArtsCredential, DpopKeyPair, DpopPrivateJwk, PkcePair } from './codearts-oauth.ts';
 export { CodeArtsLogin } from './codearts-login.ts';
 export type { CodeArtsLoginAccount, CodeArtsLoginOptions } from './codearts-login.ts';
-export { CODEARTS_SESSION_LIMIT, CODEARTS_SESSION_WINDOW_MS, CodeArtsSessionWindow, sharedSessionWindow, } from './codearts-window.ts';
 export { ProviderHttpError, buildMessages, buildTools, consumeOpenAiStream, openAiStream, sseEvents } from './wire.ts';
 export type { WireMessage } from './wire.ts';
 export { API_PREFIX, buildRows } from './api.ts';
@@ -118,7 +117,6 @@ export declare const Config: import("@deepseek-ai/schemastery").default<Schemast
     modelCacheTtlSeconds: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
     catalogFetchTimeoutSeconds: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
     openRouterSyncMinutes: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    raccoonCheckinMinutes: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
     loomyEnabled: import("@deepseek-ai/schemastery").default<boolean, boolean, "volatile-defined">;
     raccoonEnabled: import("@deepseek-ai/schemastery").default<boolean, boolean, "volatile-defined">;
@@ -153,6 +151,5 @@ export declare const Config: import("@deepseek-ai/schemastery").default<Schemast
     modelCacheTtlSeconds: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
     catalogFetchTimeoutSeconds: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
     openRouterSyncMinutes: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    raccoonCheckinMinutes: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
 }>>, "plain">;
 export declare function apply(ctx: Context, config: ParsedConfig): void;

package/lib/types/raccoon.d.ts

@@ -15,6 +15,7 @@ import { ModelCatalog } from './catalog.ts';
 import type { ProviderModel } from './catalog.ts';
 import type { OpenRouterLookup } from './openrouter.ts';
 import type { CheckinStatus, QuotaSnapshot } from './types.ts';
+import { ProviderHttpError } from './wire.ts';
 import type { ReadImage } from './wire.ts';
 export declare const RACCOON_BASE = "https://xiaohuanxiong.com/api/web";
 export declare const RACCOON_CLIENT_VERSION = "v1.0.35";
@@ -30,7 +31,68 @@ export interface RaccoonProviderOptions {
     fetchImpl?: typeof fetch;
     /** Injectable OpenRouter lookup for tests; defaults to the live catalog. */
     openRouter?: OpenRouterLookup;
+    /** Injectable session-id bookkeeping for tests; defaults to the real one. */
+    sessionIds?: RaccoonSessionIds;
 }
+/**
+ * The upstream code for the account's token-throughput wall.
+ *
+ * It reads like a request-rate complaint (`您的模型请求频率超限`) and is not
+ * one: measured on a live account, ten large requests in ten seconds hit it
+ * while fifty small ones did not, and the window refills by throughput rather
+ * than by request count. The gateway sends no `Retry-After` and no
+ * `x-ratelimit-*` header, so nothing here can compute a wait either.
+ */
+export declare const RACCOON_RATE_LIMIT_CODE = "user_model_rate_limited";
+/**
+ * Whether a rejection is the token wall rather than a generic failure.
+ *
+ * Matched on the status, the code and the wording, because the same condition
+ * arrives as an HTTP 429 and as an error frame inside a 200 stream.
+ */
+export declare function isRaccoonRateLimited(status: number | undefined, text: string): boolean;
+/**
+ * The wall, as an error the caller can tell apart from a generic 429.
+ *
+ * A subclass rather than a flag: the in-band path and the HTTP path would
+ * otherwise both be caught by the same handler, and the second pass would wrap
+ * the message the first pass had already rewritten.
+ */
+export declare class RaccoonRateLimitedError extends ProviderHttpError {
+    constructor(message: string);
+}
+/**
+ * One conversation's session id, stable across the turns of that conversation.
+ *
+ * The official client never opens a session per request — measured on its own
+ * logs, 125 calls over 26 minutes all carried one `sess-0-53927d74` — while an
+ * implementation that mints a fresh id per request tells the gateway that one
+ * account opened hundreds of sessions within minutes.
+ *
+ * The id is a pure function of (account, model) rather than a random value, so a
+ * restarted or hot-reloaded process continues the same conversation instead of
+ * presenting a new session, and two models stay two conversations. The principal
+ * itself never leaves the process — only a truncated digest of it does.
+ */
+export declare class RaccoonSessionIds {
+    private readonly principal;
+    /**
+     * @param principal - a value that is stable for one account and identifies it
+     *   without being the token itself (the JWT's `sub`).
+     */
+    constructor(principal: () => Promise<string | undefined>);
+    for(model: string): Promise<string | undefined>;
+}
+/**
+ * `sess-<sequence>-<8 hex>`, the shape the official client sends.
+ *
+ * The sequence is the official client's process-local counter and is pinned to 0
+ * here on purpose: an incrementing value would make one conversation look like a
+ * different session after a restart, which is the one thing this id exists to
+ * prevent. Identity lives in the digest, which is truncated on purpose — the id
+ * must separate accounts without naming them on the wire.
+ */
+export declare function raccoonSessionId(principal: string, model: string): string;
 /** Whether the gateway accepts a token harvested from the browser. */
 export declare function raccoonAccessTokenValid(token: string, fetchImpl?: typeof fetch): Promise<boolean>;
 /**
@@ -43,9 +105,9 @@ export declare class RaccoonProvider {
     readonly catalog: ModelCatalog;
     private quotaCache;
     private quotaInflight;
-    private checkinInflight;
     private loginFlow;
     private readonly openRouter;
+    private readonly sessionIds;
     constructor(options: RaccoonProviderOptions);
     status(): Promise<import("./auth.ts").AuthStatus>;
     signedIn(): Promise<boolean>;
@@ -58,6 +120,14 @@ export declare class RaccoonProvider {
     private login;
     logoutAccount(): Promise<void>;
     private headers;
+    /**
+     * The chat headers, including the session id the gateway counts sessions by.
+     *
+     * Only chat carries it: the catalogue, quota and check-in routes are plain
+     * business calls the official client sends outside any session, so leaving
+     * them alone keeps this change to the one route it was measured on.
+     */
+    private chatHeaders;
     /** Run one JSON call; a rejected token means this login needs a new scan. */
     private authorizedJson;
     private fetchModels;
@@ -76,12 +146,15 @@ export declare class RaccoonProvider {
      * `point_grant_popups` on `setting_info`; the bills list is the durable proof.
      */
     private dailyGrant;
-    checkinStatus(): Promise<CheckinStatus>;
-    claimCheckin(): Promise<CheckinStatus>;
     /**
-     * One automatic check-in pass: report today's grant, or ask the website path
-     * to issue it. Shared so overlapping timers cannot spend two call slots.
+     * Read today's grant. **Read-only on purpose.**
+     *
+     * The gateway has no claim endpoint: points are issued on the day's first
+     * website visit. Replaying that visit (`setting_info`) can trigger the grant
+     * from here, but doing so takes a state-changing action on the account without
+     * the user asking for it in that moment, so the plugin only reports. Claiming
+     * is the website's job, and the card links there.
      */
-    ensureDailyCheckin(): Promise<CheckinStatus>;
+    checkinStatus(): Promise<CheckinStatus>;
     stream(options: GenerateOptions, model: string, readImage: ReadImage | undefined, onUnauthorized?: () => void): AsyncGenerator<StreamChunk>;
 }

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-llm-adapters",
   "displayName": "Local LLM Adapters",
   "description": "DeepSeek Harness adapters for Loomy, SenseTime Raccoon and Trae. Sign in through the provider’s own web page (WeChat QR for Loomy and Raccoon, a dedicated browser window for Trae), or reuse a signed-in local Trae client for the mainland check-in, then use the account’s models with quota, thinking levels and per-model settings pages.",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "type": "module",
   "license": "MIT",
   "author": "k1-h2",

package/src/account-store.ts

@@ -93,12 +93,19 @@ export interface CodeArtsAccountRecord {
     d: string
   }
   userName?: string
+  /**
+   * The `x-ot-session-id` this account chats under: one stable value instead of
+   * one per request, because the gateway counts concurrent sessions by it.
+   *
+   * A record written before the field existed derives the same value from the
+   * refresh token's profile, so an existing sign-in needs no new login.
+   */
+  otSessionId?: string
   /**
    * Models the account answered `InferHub.4004.200` for.
    *
-   * The verdict is worth persisting: asking with `maas_type: benefit` spends
-   * one of the three chat slots the plan allows per minute, even though the
-   * call cannot succeed.
+   * Worth persisting: the account has no allowance pack for them, so without the
+   * verdict every call would pay for a request that cannot succeed.
    */
   noBenefit?: string[]
   loginAt: number
@@ -181,6 +188,7 @@ function codeartsRecord(value: unknown): CodeArtsAccountRecord | undefined {
     ...text(raw.codeVerifier) === undefined ? {} : { codeVerifier: text(raw.codeVerifier)! },
     ...key === undefined ? {} : { dpopPrivateJwk: key },
     ...text(raw.userName) === undefined ? {} : { userName: text(raw.userName)! },
+    ...text(raw.otSessionId) === undefined ? {} : { otSessionId: text(raw.otSessionId)! },
     ...noBenefit.length === 0 ? {} : { noBenefit },
   }
 }

package/src/auth.ts

@@ -14,7 +14,7 @@ import type {
   AccountStore, CodeArtsAccountRecord, LoomyAccountRecord, RaccoonAccountRecord, TraeAccountRecord,
 } from './account-store.ts'
 import type { TraeRegion } from './brand.ts'
-import { RefreshTokenExpiredError, exchangeRefreshToken, keyPairFromStoredJwk, readUserProfile } from './codearts-oauth.ts'
+import { RefreshTokenExpiredError, exchangeRefreshToken, keyPairFromStoredJwk, otSessionIdOf, readUserProfile } from './codearts-oauth.ts'
 import type { CodeArtsCredential } from './codearts-oauth.ts'
 import { responseError } from './http.ts'
 import { TRAE_REGION_PROFILES, TRAE_WEB_USER_AGENT } from './trae-endpoints.ts'
@@ -114,6 +114,13 @@ export interface JwtFacts {
   phone?: string
   ownerType?: string
   sessionId?: string
+  /**
+   * The `sub` claim, which is what an account is called on the Raccoon gateway.
+   *
+   * Unlike the token itself it survives a re-sign, so it is the seed a stable
+   * per-account session id is derived from.
+   */
+  subject?: string
 }
 
 /** Normalize seconds, milliseconds, and ISO strings to epoch milliseconds. */
@@ -145,6 +152,7 @@ export function decodeJwtFacts(token: string): JwtFacts {
       ...typeof record.phone === 'string' ? { phone: record.phone } : {},
       ...typeof record.owner_type === 'string' ? { ownerType: record.owner_type } : {},
       ...typeof record.sid === 'string' ? { sessionId: record.sid } : {},
+      ...typeof record.sub === 'string' ? { subject: record.sub } : {},
     }
   } catch {
     return {}
@@ -546,6 +554,7 @@ export class CodeArtsAuth {
           ...next.expiresAt === undefined ? {} : { expiresAt: next.expiresAt },
           ...next.refreshToken === undefined ? {} : { refreshToken: next.refreshToken },
           ...next.userName === undefined ? {} : { userName: next.userName },
+          ...next.otSessionId === undefined ? {} : { otSessionId: next.otSessionId },
         })
         this.lastError = undefined
         return next
@@ -570,6 +579,10 @@ export class CodeArtsAuth {
 }
 
 function credentialOf(record: CodeArtsAccountRecord): CodeArtsCredential {
+  // A record written before `otSessionId` existed derives the very value the
+  // login would have stored, so an account that is already signed in gets its
+  // single session without a new login.
+  const otSessionId = record.otSessionId ?? otSessionIdOf(readUserProfile(record.refreshToken))
   return {
     accessKeyId: record.accessKeyId,
     secretAccessKey: record.secretAccessKey,
@@ -578,5 +591,6 @@ function credentialOf(record: CodeArtsAccountRecord): CodeArtsCredential {
     ...record.refreshToken === undefined ? {} : { refreshToken: record.refreshToken },
     ...record.codeVerifier === undefined ? {} : { codeVerifier: record.codeVerifier },
     ...record.dpopPrivateJwk === undefined ? {} : { dpopPrivateJwk: record.dpopPrivateJwk },
+    ...otSessionId === undefined ? {} : { otSessionId },
   }
 }

package/src/codearts-oauth.ts

@@ -35,6 +35,17 @@ export interface CodeArtsCredential {
   dpopPrivateJwk?: DpopPrivateJwk
   /** Display only, from the refresh token's profile; never used for signing. */
   userName?: string
+  /**
+   * The id the gateway counts concurrent sessions against (`x-ot-session-id`).
+   *
+   * Measured on a real account: the three-session cap is keyed by this header,
+   * not by `Chat-Id` / `Session-Id`. A per-request value makes every call a new
+   * session, so the account spends its own budget on its own history and the
+   * fourth call of the minute comes back `TM.00001041`. Derived from the account
+   * identity instead of stored at random: the same value in every process, and
+   * one that survives a token renewal.
+   */
+  otSessionId?: string
 }
 
 /** Who the credential belongs to, as the portal encoded it in the token. */
@@ -180,6 +191,19 @@ export function readUserProfile(token: string | undefined): CodeArtsUserProfile
   }
 }
 
+/**
+ * The session id this account should chat under, derived from who the account is.
+ *
+ * 32 lowercase hex, the shape the IDE's own kernel sends. Nothing but stability
+ * matters here — the gateway uses the value as a key, not as an identity — so it
+ * is hashed from the principal id rather than kept in a file.
+ */
+export function otSessionIdOf(profile: CodeArtsUserProfile | undefined): string | undefined {
+  const seed = profile?.userId ?? profile?.userName
+  if (seed === undefined) return undefined
+  return createHash('sha256').update(`codearts-ot-session:${seed}`).digest('hex').slice(0, 32)
+}
+
 /** The portal URL the browser opens; the callback is on loopback. */
 export function buildAuthorizeUrl(port: number, pkce: PkcePair, ticketId: string): string {
   return `${CODEARTS_PORTAL_AUTHORIZE}?theme=2&locale=zh-cn`
@@ -263,13 +287,18 @@ export async function exchangeRefreshToken(
   }, keyPair, fetcher)
   const credential = credentialFrom(token, codeVerifier, keyPair)
   // A refresh response may omit the rotated refresh token; keep the old one so
-  // the next refresh is still possible. The name rides on that token, so it has
-  // to be read from whichever one this credential ends up carrying.
-  const userName = credential.userName ?? readUserProfile(refreshToken)?.userName
+  // the next refresh is still possible. The name and the account identity ride on
+  // that token, so both are read from whichever one this credential ends up
+  // carrying: a response without a profile must not hand the account a new
+  // session id, or every renewal would cost it a slot again.
+  const previous = readUserProfile(refreshToken)
+  const userName = credential.userName ?? previous?.userName
+  const otSessionId = credential.otSessionId ?? otSessionIdOf(previous)
   return {
     ...credential,
     refreshToken: credential.refreshToken ?? refreshToken,
     ...userName === undefined ? {} : { userName },
+    ...otSessionId === undefined ? {} : { otSessionId },
   }
 }
 
@@ -277,14 +306,16 @@ function credentialFrom(token: TokenResponse, codeVerifier: string, keyPair: Dpo
   const credentials = token.credentials ?? {}
   const expiration = credentials.expiration
   const expiresAt = expiration === undefined ? undefined : Date.parse(expiration)
-  const userName = readUserProfile(token.refresh_token)?.userName
+  const profile = readUserProfile(token.refresh_token)
+  const otSessionId = otSessionIdOf(profile)
   return {
     accessKeyId: credentials.access_key_id ?? '',
     secretAccessKey: credentials.secret_access_key ?? '',
     securityToken: credentials.security_token ?? '',
     ...expiresAt === undefined || Number.isNaN(expiresAt) ? {} : { expiresAt },
     ...token.refresh_token === undefined ? {} : { refreshToken: token.refresh_token },
-    ...userName === undefined ? {} : { userName },
+    ...profile?.userName === undefined ? {} : { userName: profile.userName },
+    ...otSessionId === undefined ? {} : { otSessionId },
     codeVerifier,
     dpopPrivateJwk: keyPair.privateKeyJwk,
   }

package/src/codearts.ts

@@ -46,7 +46,6 @@ import {
 } from './codearts-endpoints.ts'
 import { CodeArtsLogin } from './codearts-login.ts'
 import { headersForFetch, sha256Hex, signRequestHuawei } from './codearts-sign.ts'
-import { CodeArtsSessionWindow, sharedSessionWindow } from './codearts-window.ts'
 import type { CodeArtsCredential } from './codearts-oauth.ts'
 import type { LoginStatus } from './login-page.ts'
 import { parseModelName } from './model-name.ts'
@@ -115,8 +114,6 @@ export interface CodeArtsProviderOptions {
   loginTimeoutMs?: number
   /** Injectable OpenRouter lookup for tests; defaults to the live catalog. */
   openRouter?: OpenRouterLookup
-  /** Chat budget; defaults to the process-wide window (survives hot reloads). */
-  window?: CodeArtsSessionWindow
 }
 
 /** One roster entry before it becomes a model row. */
@@ -306,20 +303,22 @@ const sleep = (ms: number, signal?: AbortSignal): Promise<void> => new Promise((
   signal?.addEventListener('abort', onAbort, { once: true })
 })
 
-/** Retries for a gateway that is busy for reasons the window cannot predict. */
+/** Retries for a gateway that is busy for reasons the caller cannot predict. */
 const QUEUE_ATTEMPTS = 3
-/** Minimum pause before retrying a rejected call; the window adds its own. */
+/** Pause before retrying a rejected call. */
 const QUEUE_BACKOFF_MS = 20_000
 
 /**
  * The message a user sees once waiting is hopeless.
  *
- * The raw gateway text (`TM.00001041`) reads like a bug; the limit is the
- * trial plan's, and the only fix on this side is to say so.
+ * The raw gateway text (`TM.00001041`) reads like a bug. The three concurrent
+ * sessions are the trial plan's, and one plugin chatting under a single session
+ * id is not meant to reach them: the slots are being held by something else on
+ * the same account.
  */
 function queueExhausted(): ProviderHttpError {
   return new ProviderHttpError(
-    'CodeArts 体验版每分钟只允许 3 个会话，当前已被占满。请稍等片刻再发，或关闭其它 CodeArts 会话。',
+    'CodeArts 这个账号的 3 个并发会话已被占满（通常是码道 IDE 或另一台设备），请稍后再发，或关闭其它 CodeArts 会话。',
     429,
   )
 }
@@ -356,7 +355,6 @@ export class CodeArtsProvider {
   /** Models that answered `InferHub.4004.200`: no allowance pack to bill. */
   private readonly noBenefit = new Set<string>()
   private noBenefitLoaded = false
-  private readonly window: CodeArtsSessionWindow
   private readonly openRouter: OpenRouterLookup
   private readonly sessionId = randomUUID()
   /**
@@ -371,7 +369,6 @@ export class CodeArtsProvider {
   private imageCacheWrite: Promise<void> = Promise.resolve()
 
   constructor(private readonly options: CodeArtsProviderOptions) {
-    this.window = options.window ?? sharedSessionWindow()
     this.openRouter = options.openRouter ?? new OpenRouterCatalog(options.fetchImpl ?? fetch)
     this.catalog = new ModelCatalog(() => this.loadModels(), options.ttlMs)
     this.login = new CodeArtsLogin({
@@ -380,9 +377,7 @@ export class CodeArtsProvider {
       ...options.logger === undefined ? {} : { logger: options.logger },
       save: async (account) => {
         await options.store.saveCodearts(account as CodeArtsAccountRecord)
-        // A different account starts with a clean budget: the slots the gateway
-        // remembers belong to the old one.
-        this.window.reset()
+        // A different account has different verdicts about what it may bill.
         this.noBenefit.clear()
         this.invalidateModels()
         this.invalidateQuota()
@@ -784,7 +779,7 @@ export class CodeArtsProvider {
     }
   }
 
-  /** Ask the vision model to describe one image, within the same chat budget. */
+  /** Ask the vision model to describe one image; another turn on the same session. */
   private async describeImage(dataUrl: string, signal?: AbortSignal): Promise<string> {
     const payload = JSON.stringify({
       model: CODEARTS_VISION_MODEL,
@@ -802,8 +797,6 @@ export class CodeArtsProvider {
     let authRefreshed = false
     let queueAttempts = 0
     for (;;) {
-      // The vision model is another chat session, so it spends the same budget.
-      const slot = await this.window.open(signal)
       let response: Response
       try {
         response = await this.send(chatId, payload, CODEARTS_VISION_MODEL, false, signal)
@@ -814,10 +807,9 @@ export class CodeArtsProvider {
           continue
         }
         if (error instanceof CodeArtsRetry && error.kind === 'queue') {
-          slot.release()
           if (queueAttempts < QUEUE_ATTEMPTS) {
             queueAttempts++
-            await sleep(Math.max(this.window.waitMs(), QUEUE_BACKOFF_MS), signal)
+            await sleep(QUEUE_BACKOFF_MS, signal)
             continue
           }
           throw queueExhausted()
@@ -842,10 +834,9 @@ export class CodeArtsProvider {
         }
       } catch (error) {
         if (error instanceof CodeArtsRetry && error.kind === 'queue') {
-          slot.release()
           if (queueAttempts < QUEUE_ATTEMPTS) {
             queueAttempts++
-            await sleep(Math.max(this.window.waitMs(), QUEUE_BACKOFF_MS), signal)
+            await sleep(QUEUE_BACKOFF_MS, signal)
             continue
           }
           throw queueExhausted()
@@ -906,10 +897,6 @@ export class CodeArtsProvider {
     let benefitDropped = false
     let queueAttempts = 0
     for (;;) {
-      // The plan allows three sessions a minute for the whole account, and a
-      // rejected call spends one just like a served one. Wait for a slot here
-      // instead of firing into `TM.00001041` and hoping a retry lands later.
-      const slot = await this.window.open(options.signal)
       let response: Response
       try {
         response = await this.send(chatId, payload, model, benefitDropped, options.signal)
@@ -933,8 +920,7 @@ export class CodeArtsProvider {
           }
           if (error.kind === 'queue' && queueAttempts < QUEUE_ATTEMPTS) {
             queueAttempts++
-            slot.release()
-            await sleep(Math.max(this.window.waitMs(), QUEUE_BACKOFF_MS), options.signal)
+            await sleep(QUEUE_BACKOFF_MS, options.signal)
             continue
           }
           if (error.kind === 'queue') throw queueExhausted()
@@ -966,8 +952,7 @@ export class CodeArtsProvider {
         // safe while nothing has been emitted, or the answer would repeat.
         if (!produced && error instanceof CodeArtsRetry && error.kind === 'queue' && queueAttempts < QUEUE_ATTEMPTS) {
           queueAttempts++
-          slot.release()
-          await sleep(Math.max(this.window.waitMs(), QUEUE_BACKOFF_MS), options.signal)
+          await sleep(QUEUE_BACKOFF_MS, options.signal)
           continue
         }
         if (error instanceof CodeArtsRetry && error.kind === 'queue') throw queueExhausted()
@@ -997,6 +982,9 @@ export class CodeArtsProvider {
   ): Promise<Response> {
     const credential = await this.credential()
     const benefit = !benefitDropped && this.isBenefitModel(model)
+    // A credential whose token carries no identity falls back to this process's
+    // own id: still one session for the account, never one per request.
+    const otSessionId = credential.otSessionId ?? this.sessionId.replace(/-/g, '')
     const signed = await signRequestHuawei(
       credential.accessKeyId,
       credential.secretAccessKey,
@@ -1015,6 +1003,14 @@ export class CodeArtsProvider {
       'chat-id': chatId,
       'session-id': this.sessionId,
       lang: 'en',
+      // Measured on a real account: the gateway counts the account's concurrent
+      // sessions by `x-ot-session-id`, not by `chat-id` / `session-id`. One stable
+      // value is why the trial plan stops charging its own history for every
+      // turn; the trace id stays per request, as the IDE sends it. These join the
+      // unsigned set — `chat-id` and `session-id` already do.
+      'x-ot-session-id': otSessionId,
+      'user-session-id': otSessionId,
+      'x-ot-trace-id': randomUUID().replace(/-/g, ''),
     }
     const timeout = AbortSignal.timeout(Math.max(this.options.timeoutMs(), 60_000))
     const response = await this.fetcher(CODEARTS_CHAT_URL, {
@@ -1052,7 +1048,6 @@ export class CodeArtsProvider {
 
   async logoutAccount(): Promise<void> {
     await this.options.auth.logout()
-    this.window.reset()
     this.invalidateModels()
     this.invalidateQuota()
   }