dsh-packycode-api 1.0.4 → 1.0.5

package/lib/index.js

@@ -41,8 +41,17 @@ const DEFAULT_API_HOST = "https://cf.api.fan";
 /**
 * Host carrying `/api/usage/token/`. `cf.api.fan` answers 404 for the whole
 * `/api/*` family, so per-key quota is read from the PackyAPI host instead.
+* PackyAPI now runs on `.ai` (its site and docs moved there); the `.com` name
+* is DNS-poisoned on mainland networks, so a host whose fetch does not go
+* through a proxy reads `fetch failed` from it.
 */
-const DEFAULT_STATUS_HOST = "https://www.packyapi.com";
+const DEFAULT_STATUS_HOST = "https://www.packyapi.ai";
+/**
+* Earlier default status hosts. A profile that saved one keeps working, but
+* the current default is tried before it, so an unreachable legacy name
+* cannot hold a read up for its whole timeout first.
+*/
+const LEGACY_STATUS_HOSTS = Object.freeze(["https://www.packyapi.com"]);
 /** PackyAPI quotes balances in quota units of 1/500000 USD (new-api convention). */
 const QUOTA_PER_USD = 5e5;
 /** Balance cache lifetime; a forced read bypasses it. */
@@ -61,7 +70,8 @@ const DEFAULT_REASONING_LEVEL = "high";
 * the account. Only the second family exists on the model host (`cf.api.fan`
 * answers 404 for `/api/*`), so a read tries the configured host first and
 * falls back to the PackyAPI host — the same fallback the PackyCode status
-* tooling uses.
+* tooling uses. A saved legacy status host (`www.packyapi.com`, DNS-poisoned
+* on mainland networks) is tried after the current default, not before it.
 *
 * Credentials and response bodies stay host-side; the browser receives only
 * the projection built here.
@@ -139,22 +149,71 @@ function parseBillingUsage(payload) {
 function statusMessage(status) {
 	if (status === 401) return "this API key was rejected (401)";
 	if (status === 402 || status === 403) return "the account cannot be read with this key (402/403)";
+	if (status === 429) return "the gateway is rate limiting balance reads (429)";
 	return `the gateway answered HTTP ${status}`;
 }
+/**
+* Say why a request never got an answer. Node's fetch reports every transport
+* fault as a bare `fetch failed`; the cause carries the part a reader can act
+* on (a DNS failure, a refused or reset connection, a certificate problem).
+*/
+function transportMessage(error, timeoutSignal, timeoutMs) {
+	if (timeoutSignal.aborted) return `no answer within ${Math.round(timeoutMs / 1e3)}s`;
+	const cause = error?.cause;
+	const code = typeof cause?.code === "string" ? cause.code : typeof error?.code === "string" ? error.code : void 0;
+	const message = error instanceof Error ? error.message : String(error);
+	return code === void 0 ? message : `${message} (${code})`;
+}
 async function getJson(url, key, { fetchImpl, timeoutMs, signal }) {
 	const timeoutSignal = AbortSignal.timeout(timeoutMs);
 	const requestSignal = signal === void 0 ? timeoutSignal : AbortSignal.any([signal, timeoutSignal]);
-	const response = await fetchImpl(url, {
-		headers: {
-			Authorization: `Bearer ${key}`,
-			Accept: "application/json"
-		},
-		redirect: "error",
-		signal: requestSignal
-	});
+	let response;
+	try {
+		response = await fetchImpl(url, {
+			headers: {
+				Authorization: `Bearer ${key}`,
+				Accept: "application/json"
+			},
+			redirect: "error",
+			signal: requestSignal
+		});
+	} catch (error) {
+		if (signal?.aborted === true) throw error;
+		throw new Error(transportMessage(error, timeoutSignal, timeoutMs), { cause: error });
+	}
 	if (!response.ok) throw new Error(statusMessage(response.status));
 	return response.json();
 }
+/**
+* The status hosts one per-key read tries, in order: an explicit override,
+* the current default, the legacy defaults, then the model hosts.
+* @param hosts - the resolved host settings.
+* @returns unique origins.
+*/
+function statusHostOrder(hosts) {
+	const configured = hosts?.statusHost;
+	const override = configured === void 0 || LEGACY_STATUS_HOSTS.includes(configured) ? [] : [configured];
+	return [...new Set([
+		...override,
+		DEFAULT_STATUS_HOST,
+		...LEGACY_STATUS_HOSTS,
+		hosts?.apiHost,
+		DEFAULT_API_HOST
+	].filter((host) => typeof host === "string" && host !== ""))];
+}
+/**
+* The hosts the account read tries: the model hosts first (they serve the
+* billing endpoints), then the status hosts.
+* @param hosts - the resolved host settings.
+* @returns unique origins.
+*/
+function accountHostOrder(hosts) {
+	return [...new Set([
+		hosts?.apiHost,
+		DEFAULT_API_HOST,
+		...statusHostOrder(hosts)
+	].filter((host) => typeof host === "string" && host !== ""))];
+}
 async function withFallback(hosts, path, key, options) {
 	const tried = [];
 	for (const host of hosts) try {
@@ -169,6 +228,12 @@ async function withFallback(hosts, path, key, options) {
 }
 /**
 * Cached, single-flight balance reader.
+*
+* A read that fails for one key — the gateway throttled it, a host was
+* unreachable — keeps showing the last balance that key did report, marked
+* `stale` with when it was read and why this read failed, instead of blanking
+* the row. The same holds for the account figures. These last-good values
+* live in the host process: a page refresh keeps them, a restart does not.
 * @param options - key listing, host resolution, and transport knobs.
 * @returns `{ read({force, signal}), invalidate() }`.
 */
@@ -178,13 +243,11 @@ function createBalanceReader({ listKeys, getHosts, fetchImpl = fetch, now = Date
 	let cached;
 	let inFlight;
 	let generation = 0;
+	/** Last successful per-key usage, by key id, and the last account figures. */
+	const lastGood = /* @__PURE__ */ new Map();
+	let lastAccount;
 	const loadKey = async (entry, hosts, signal) => {
-		const { payload } = await withFallback([.../* @__PURE__ */ new Set([
-			hosts.statusHost,
-			DEFAULT_STATUS_HOST,
-			hosts.apiHost,
-			DEFAULT_API_HOST
-		])], "/api/usage/token/", entry.key, {
+		const { payload } = await withFallback(statusHostOrder(hosts), "/api/usage/token/", entry.key, {
 			fetchImpl,
 			timeoutMs,
 			signal
@@ -207,12 +270,7 @@ function createBalanceReader({ listKeys, getHosts, fetchImpl = fetch, now = Date
 			...keys.filter((entry) => entry.disabled !== true).map((entry) => entry.id)
 		])].map((id) => keys.find((entry) => entry.id === id)).filter((entry) => entry !== void 0);
 		if (candidates.length === 0) throw new Error("add a PackyCode API key to read the account balance");
-		const hostsToTry = [.../* @__PURE__ */ new Set([
-			hosts.apiHost,
-			DEFAULT_API_HOST,
-			hosts.statusHost,
-			DEFAULT_STATUS_HOST
-		])];
+		const hostsToTry = accountHostOrder(hosts);
 		const options = {
 			fetchImpl,
 			timeoutMs,
@@ -239,6 +297,7 @@ function createBalanceReader({ listKeys, getHosts, fetchImpl = fetch, now = Date
 		signal?.throwIfAborted();
 		const hosts = getHosts();
 		const keys = await listKeys();
+		for (const id of lastGood.keys()) if (!keys.some((entry) => entry.id === id)) lastGood.delete(id);
 		const entries = [];
 		const usableIds = [];
 		for (const entry of keys) {
@@ -248,23 +307,50 @@ function createBalanceReader({ listKeys, getHosts, fetchImpl = fetch, now = Date
 				disabled: entry.disabled === true
 			};
 			try {
+				const usage = await loadKey(entry, hosts, signal);
+				lastGood.set(entry.id, {
+					usage,
+					fetchedAt: now()
+				});
 				entries.push({
 					...base,
-					usage: await loadKey(entry, hosts, signal)
+					usage
 				});
 				usableIds.push(entry.id);
 			} catch (error) {
-				entries.push({
+				signal?.throwIfAborted();
+				const message = error instanceof Error ? error.message : String(error);
+				const previous = lastGood.get(entry.id);
+				entries.push(previous === void 0 ? {
+					...base,
+					error: message
+				} : {
 					...base,
-					error: error instanceof Error ? error.message : String(error)
+					usage: previous.usage,
+					stale: {
+						fetchedAt: previous.fetchedAt,
+						error: message
+					}
 				});
 			}
 		}
 		let account;
 		try {
 			account = await loadAccount(keys, hosts, signal, usableIds);
+			lastAccount = {
+				account,
+				fetchedAt: now()
+			};
 		} catch (error) {
-			account = { error: error instanceof Error ? error.message : String(error) };
+			signal?.throwIfAborted();
+			const message = error instanceof Error ? error.message : String(error);
+			account = lastAccount === void 0 || !keys.some((entry) => entry.id === lastAccount.account.keyId) ? { error: message } : {
+				...lastAccount.account,
+				stale: {
+					fetchedAt: lastAccount.fetchedAt,
+					error: message
+				}
+			};
 		}
 		return {
 			keys: entries,
@@ -302,6 +388,147 @@ function createBalanceReader({ listKeys, getHosts, fetchImpl = fetch, now = Date
 	});
 }
 //#endregion
+//#region src/failures.js
+/**
+* Failure classification for the two conditions that move the key ring along.
+*
+* The gateway reports an exhausted key and a rejected key in Chinese, and the
+* harness classifies failures by fixed English/status wording it recognizes
+* (`isQuotaExceededError`, `\b401\b`). Normalizing here is what makes the
+* harness's retry policy re-run the step — and therefore what lets the retry
+* pick up the next key. Rewriting is honest about what happened: this plugin
+* knows the key's condition from the gateway's own words plus its balance
+* reader, so the sentence it substitutes says no more than that.
+*
+* @module dsh-packycode-api/failures
+*/
+/** Terminal quota, balance, or credit wording, in the gateway's own languages. */
+const QUOTA_WORDING = /额度|余额|配额|欠费|insufficient[\s_-]+(?:quota|balance|credits?)|quota[\s_-]+(?:exceeded|exhausted|reached)|out[\s_-]+of[\s_-]+(?:credits?|budget)/iu;
+/** A rejected key names itself; a bare 403 does not, and must not disable one. */
+const INVALID_KEY_WORDING = /无效的令牌|令牌无效|无效密钥|密钥无效|invalid[\s_-]+api[\s_-]*key|invalid_authentication|api key is invalid/iu;
+const INVALID_KEY_STATUS = /\b401\b/;
+/**
+* A gateway group that only serves its vendor's official client. These arrive
+* as 403, which the harness reads as an authentication failure and renders as
+* an invalid-API-key problem — the opposite of what happened, and a condition
+* no retry can clear.
+*/
+const CLIENT_POLICY_WORDING = /only accessible via the official|only accepts requests from the official|official\s+claude(?:\s+code)?\s+cli|官方\s*claude(?:\s*code)?\s*cli|请使用标准\s*codex\s*客户端|客户端存在异常|二次分发|API\s*转接/iu;
+/** The key's quota is exhausted; move to the next key. */
+const QUOTA_FAILURE = "quota";
+/** The gateway rejected the key itself; move to the next key. */
+const INVALID_KEY_FAILURE = "invalid-key";
+/**
+* Whether the gateway is refusing this client rather than this credential.
+* @param message - provider failure text, as pi-ai carries it.
+* @returns true when the route is gated to a vendor's official client.
+*/
+function classifyClientPolicy(message) {
+	return CLIENT_POLICY_WORDING.test(typeof message === "string" ? message : "");
+}
+/**
+* Classify a gateway failure message.
+*
+* Quota wording wins over a status token: an exhausted balance is often
+* reported as 402/403, and only the key's own rejection may read as 401. A
+* client-policy refusal is not a key fault and is classified separately.
+* @param message - provider failure text, as pi-ai carries it.
+* @returns the failure kind, or undefined when the key is not at fault.
+*/
+function classifyGatewayFailure(message) {
+	const text = typeof message === "string" ? message : "";
+	if (text === "") return void 0;
+	if (classifyClientPolicy(text)) return void 0;
+	if (QUOTA_WORDING.test(text)) return QUOTA_FAILURE;
+	if (INVALID_KEY_WORDING.test(text)) return INVALID_KEY_FAILURE;
+	if (INVALID_KEY_STATUS.test(text)) return INVALID_KEY_FAILURE;
+}
+/**
+* Rewrite a failure message so the harness classifies it as quota or auth.
+*
+* A bare status token is neutralized first: an exhausted balance arrives as
+* 402 or 403 on some gateway routes, and the harness's auth rule matches
+* 401/403 before it reads any wording, which would send the failure into a
+* category the retry policy does not re-run.
+* @param message - the original provider failure text.
+* @param kind - the classification of {@link classifyGatewayFailure}.
+* @returns text the harness routes to QUOTA or AUTH.
+*/
+/**
+* Explain a client-policy refusal so the user reads the real cause.
+*
+* The sentence must not read as any other failure the harness knows: it
+* deliberately carries no HTTP status and none of the words the classifier
+* matches for auth, quota, rate limits, timeouts, or transport faults. That
+* keeps the failure out of the retry policy — no retry can talk a group into
+* serving an API client — and lets the sentence reach the user verbatim, in
+* place of the "API key is invalid" the bare 403 would have produced.
+* @param keyName - the account name the balance reader saw, when known.
+* @returns the replacement sentence.
+*/
+function explainClientPolicyFailure() {
+	return "PackyCode 拒绝了这个客户端：所选分组只允许厂商官方客户端调用（Claude 分组要求官方 Claude CLI，Codex 分组要求标准 Codex 客户端）。这不是 API Key 失效，重试也不会成功。请改用允许 API 调用的分组（例如 cc-sale 或 claude-officially），或改用 PackyCode 的 gpt-6.1-sol / deepseek-flash。 / This group only serves the vendor’s official client; the API key is fine and retrying cannot help.";
+}
+/**
+* The gateway is out of capacity for the moment: its Claude pool's
+* per-account wait queue is full, or it throttled or shed the request. The
+* CLI retries these on its own; this matches what is left when it gave up.
+*/
+const CAPACITY_WORDING = /concurrency_queue_full|并发排队已满|wait queues? (?:are|is) full|负载已饱和|overloaded|rate[_\s-]?limit|API Error:\s*(?:429|502|503|504|529)\b/iu;
+/**
+* Whether a CLI failure is the gateway being busy rather than a fault of the
+* key, the client, or the request.
+* @param message - the CLI failure text.
+* @returns true for throttling and capacity refusals.
+*/
+function classifyCapacity(message) {
+	return CAPACITY_WORDING.test(typeof message === "string" ? message : "");
+}
+/**
+* Explain a CLI turn that failed because the gateway stayed busy.
+* @param message - the CLI failure text.
+* @param retries - how many retries the CLI reported before giving up.
+* @returns the replacement sentence, with the gateway's own words kept.
+*/
+function explainCliCapacityFailure(message, retries) {
+	const detail = (typeof message === "string" ? message : "").replace(/^Claude Code CLI failed:\s*/u, "").slice(0, 600);
+	return `PackyCode 的 Claude 上游暂时繁忙（并发排队已满或被限流）。${typeof retries === "number" && retries > 0 ? `Claude Code CLI 已自动重试 ${retries} 次仍未成功。` : ""}这不是 API Key 或插件的问题，稍后再发一次即可；着急的话可以先切到 gpt-6.1-sol 或 deepseek-flash。 / PackyCode's Claude upstream is busy right now; retry shortly. Gateway said: ${detail}`;
+}
+/**
+* Explain a client-policy refusal of a request the local Claude Code CLI made.
+*
+* The request did come from the official CLI, so the HTTP-route advice above
+* (switch to a CLI) does not apply. The gateway's own words are kept, without
+* their HTTP status, so a support request can quote the request ids.
+* @param message - the CLI failure text.
+* @returns the replacement sentence.
+*/
+function explainCliClientPolicyFailure(message) {
+	return `PackyCode 的上游拒绝了这次 Claude Code CLI 请求，认为它不是官方 Claude Code CLI 发出的。这不是 API Key 失效。请先把插件和 Claude Code CLI 都更新到最新版本再试；仍然失败时，请把下面的原始错误（含 request id）发给 PackyCode 客服，确认所用分组是否支持 Claude Code 的 -p（非交互）模式。 / The gateway refused this Claude Code CLI request as not coming from the official CLI; the API key is fine. Gateway said: ${(typeof message === "string" ? message : "").replace(/^Claude Code CLI failed:\s*/u, "").replace(/\b(?:401|403)\b/gu, "HTTP").slice(0, 600)}`;
+}
+/**
+* Rewrite a failure message so the harness classifies it as quota or auth.
+*
+* A bare status token is neutralized first: an exhausted balance arrives as
+* 402 or 403 on some gateway routes, and the harness's auth rule matches
+* 401/403 before it reads any wording, which would send the failure into a
+* category the retry policy does not re-run.
+* @param message - the original provider failure text.
+* @param kind - the classification of {@link classifyGatewayFailure}.
+* @param options - optional account name for the policy explanation.
+* @returns text the harness routes to QUOTA or AUTH, or a policy explanation.
+*/
+function normalizeFailureMessage(message, kind, options = {}) {
+	const text = typeof message === "string" && message.length > 0 ? message : "PackyCode request failed";
+	if (kind === "client-policy") return explainClientPolicyFailure(options.keyName);
+	if (kind === "quota") return `${neutralizeAuthStatus(text)} — PackyCode: insufficient quota for this API key; trying the next key`;
+	if (kind === "invalid-key") return `${neutralizeAuthStatus(text)} — PackyCode: 401 invalid_authentication for this API key; trying the next key`;
+	return text;
+}
+function neutralizeAuthStatus(text) {
+	return text.replace(/\b(?:401|403)\b/gu, "HTTP");
+}
+//#endregion
 //#region src/claude-adapter.js
 /**
 * Route Claude models through the local Claude Code CLI.
@@ -314,9 +541,12 @@ function createBalanceReader({ listKeys, getHosts, fetchImpl = fetch, now = Date
 * A CLI-backed turn is a *delegation*: the CLI runs its own agent loop with
 * its own tools and returns one answer. The CLI cannot call the harness's
 * tools, so `options.tools` is deliberately not forwarded, and the harness's
-* system prompt is dropped in favour of the CLI's own. While it works, its
-* thinking and tool activity stream into a reasoning block and its answer
-* streams as text.
+* system prompt is dropped in favour of the CLI's own. The delegation
+* instructions travel as `--append-system-prompt`; the recent conversation
+* travels as one user message whose images are real image blocks, read from
+* the attachment store, so the CLI's model sees them as images. While it
+* works, its thinking and tool activity stream into a reasoning block and its
+* answer streams as text.
 *
 * A session-title request is not a delegation: it runs on the small model,
 * read-only and outside the workspace, with the title instructions appended,
@@ -335,15 +565,344 @@ const TITLE_MODEL_ID = "claude-haiku-5-5";
 /** How much of the conversation a delegated prompt carries. */
 const MAX_PROMPT_CHARS$1 = 48e3;
 const MAX_BLOCK_CHARS = 8e3;
-/** Render one content block as text a CLI prompt can carry. */
-function renderBlock(block) {
-	if (block === null || typeof block !== "object") return "";
-	if (block.type === "text" && typeof block.text === "string") return block.text;
-	if (block.type === "image") return "[图片]";
-	if (block.type === "tool-call" || block.type === "tool-call-delta") return `[调用工具 ${block.name ?? block.id ?? ""}]`;
-	if (block.type === "tool-result") return `[工具结果] ${(typeof block.content === "string" ? block.content : "").slice(0, MAX_BLOCK_CHARS)}`;
-	if (block.type === "reasoning") return "";
-	return "";
+const TRUNCATED_MARK = "…（较早对话已截断）";
+/**
+* Image bounds for one delegated turn. Each image is re-encoded by the
+* attachment store to the same request version the HTTP route sends (at most
+* 2048×2048 pixels, about 1 MiB); the oldest images are left out once the turn
+* would carry more than 20 of them or 20 MiB of base64.
+*/
+const CLI_IMAGE_LIMITS = Object.freeze({
+	maxPixels: 2048 * 2048,
+	maxBytesPerImage: 1024 * 1024,
+	maxTotalBase64Bytes: 20 * 1024 * 1024,
+	maxImages: 20
+});
+/** The vendor's per-image cap on base64 data; a fallback read above it is not sent. */
+const MAX_IMAGE_BASE64_BYTES = 5 * 1024 * 1024;
+const base64Length = (bytes) => Math.ceil(bytes / 3) * 4;
+/** A short name for an image or file a reader can match to the chat. */
+function attachmentName(ref) {
+	if (typeof ref?.name === "string" && ref.name !== "") return ref.name;
+	const id = String(ref?.attachmentId ?? "");
+	return id.startsWith("sha256:") ? id.slice(7, 15) : id.slice(0, 8);
+}
+/** The host path of a stored attachment, when the store is file-backed. */
+function hostPath(lookup) {
+	try {
+		const value = lookup();
+		return typeof value === "string" && value !== "" ? value : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Flatten one message's content into ordered parts: text, image, and file.
+* Tool calls and results become short text so a turn that started on another
+* model still reads coherently; reasoning is not carried.
+*/
+function collectParts(blocks, parts) {
+	for (const block of Array.isArray(blocks) ? blocks : []) {
+		if (block === null || typeof block !== "object") continue;
+		switch (block.type) {
+			case "text":
+				if (typeof block.text === "string" && block.text !== "") parts.push({
+					kind: "text",
+					text: block.text
+				});
+				break;
+			case "image":
+				if (block.attachment !== void 0) parts.push({
+					kind: "image",
+					ref: block.attachment
+				});
+				else parts.push({
+					kind: "text",
+					text: "[图片]"
+				});
+				break;
+			case "file":
+				if (block.attachment !== void 0) parts.push({
+					kind: "file",
+					ref: block.attachment
+				});
+				break;
+			case "tool-call":
+			case "tool-call-delta":
+				parts.push({
+					kind: "text",
+					text: `[调用工具 ${block.name ?? block.id ?? ""}]`
+				});
+				break;
+			case "tool-result": {
+				if (typeof block.content === "string") {
+					parts.push({
+						kind: "text",
+						text: `[工具结果] ${block.content.slice(0, MAX_BLOCK_CHARS)}`
+					});
+					break;
+				}
+				const nested = [];
+				collectParts(block.content, nested);
+				let budget = MAX_BLOCK_CHARS;
+				parts.push({
+					kind: "text",
+					text: "[工具结果]"
+				});
+				for (const part of nested) {
+					if (part.kind !== "text") {
+						parts.push(part);
+						continue;
+					}
+					if (budget <= 0) continue;
+					parts.push({
+						kind: "text",
+						text: part.text.slice(0, budget)
+					});
+					budget -= part.text.length;
+				}
+				break;
+			}
+			default: break;
+		}
+	}
+	return parts;
+}
+const textLength = (parts) => parts.reduce((sum, part) => sum + (part.kind === "text" ? part.text.length : 0), 0);
+/**
+* The conversation as labelled turns, newest last, trimmed to the prompt
+* budget by dropping whole older turns; a single newest turn that is larger
+* than the budget keeps its tail.
+*/
+function delegatedTurns(options) {
+	const messages = Array.isArray(options?.messages) ? options.messages : [];
+	const turns = [];
+	for (const message of messages) {
+		if (message === null || typeof message !== "object" || message.role === "system") continue;
+		const parts = collectParts(message.content, []);
+		if (parts.length === 0 || textLength(parts) === 0 && !parts.some((part) => part.kind !== "text")) continue;
+		const label = message.role === "user" ? "用户" : message.role === "assistant" ? "助手" : String(message.role);
+		turns.push({
+			label,
+			parts
+		});
+	}
+	const kept = [];
+	let used = 0;
+	for (let index = turns.length - 1; index >= 0; index -= 1) {
+		const turn = turns[index];
+		const size = textLength(turn.parts) + turn.label.length + 3;
+		if (used + size <= MAX_PROMPT_CHARS$1) {
+			kept.unshift(turn);
+			used += size;
+			continue;
+		}
+		if (kept.length === 0) kept.unshift({
+			label: turn.label,
+			parts: tailOf(turn.parts, MAX_PROMPT_CHARS$1 - turn.label.length - 3),
+			clipped: true
+		});
+		break;
+	}
+	return {
+		turns: kept,
+		truncated: kept.length < turns.length || kept[0]?.clipped === true
+	};
+}
+/** Keep the last `budget` characters of a turn's text, and every part after them. */
+function tailOf(parts, budget) {
+	const result = [];
+	let remaining = budget;
+	for (let index = parts.length - 1; index >= 0; index -= 1) {
+		const part = parts[index];
+		if (part.kind !== "text") {
+			result.unshift(part);
+			continue;
+		}
+		if (remaining <= 0) continue;
+		result.unshift({
+			kind: "text",
+			text: part.text.length > remaining ? part.text.slice(-remaining) : part.text
+		});
+		remaining -= part.text.length;
+	}
+	return result;
+}
+/** How a part reads when it is carried as text only. */
+function partText(part, describe) {
+	if (part.kind === "text") return part.text;
+	return describe(part);
+}
+/** Render turns as one transcript, with non-text parts described by `describe`. */
+function renderTurns({ turns, truncated }, describe) {
+	const transcript = turns.map((turn) => `${turn.label}：${turn.parts.map((part) => partText(part, describe)).join("\n").trim()}`).join("\n\n");
+	return truncated ? `${TRUNCATED_MARK}\n\n${transcript}` : transcript;
+}
+const plainDescription = (part) => part.kind === "image" ? `[图片 ${attachmentName(part.ref)}]` : `[文件 ${attachmentName(part.ref)}]`;
+/**
+* The delegation instructions, appended to the CLI's own system prompt.
+*
+* The harness system prompt describes tools this model cannot call, so only
+* its opening is passed on, marked as context.
+* @param options - the assembled request.
+* @param cwd - the working directory the CLI will run in, when known.
+* @returns the instructions text.
+*/
+function delegationInstructions(options, cwd) {
+	const system = typeof options?.system === "string" && options.system.trim() !== "" ? options.system.trim() : "";
+	return [
+		"本回合由 DeepSeek Harness 委派给 Claude Code 执行。用户消息是 DeepSeek Harness 会话的近期对话记录，最后一条是当前请求；其中的图片已作为图片随消息附上，「只读副本」路径也可以用 Read 工具读取。请用你自己的工具完成任务，直接输出最终结果；不要反问、不要复述流程。",
+		cwd === void 0 ? void 0 : `工作目录：${cwd}`,
+		system === "" ? void 0 : `补充说明（来自 DeepSeek Harness，其中提到的工具你未必拥有）：${system.slice(0, 2e3)}`
+	].filter((part) => part !== void 0).join("\n");
+}
+/**
+* The recent conversation as one text transcript. Images and files are named
+* in place; {@link buildDelegatedContent} is what carries the images.
+* @param options - the assembled request.
+* @returns the transcript text.
+*/
+function renderDelegatedPrompt(options) {
+	return renderTurns(delegatedTurns(options), plainDescription).trim();
+}
+/**
+* The recent conversation as content blocks for the CLI's stream-json input:
+* the transcript, with every image that fits the turn's bounds as an image
+* block at the place it was sent, labelled with its read-only host copy.
+* An image that is left out, or that cannot be read, is described in text
+* instead; it never fails the turn.
+* @param options - the assembled request.
+* @param context - the attachment store (`ctx.attachments`), image bounds,
+*   and cancellation.
+* @returns text and image blocks, in conversation order.
+*/
+async function buildDelegatedContent(options, { attachments, limits = CLI_IMAGE_LIMITS, signal } = {}) {
+	const shape = delegatedTurns(options);
+	const images = shape.turns.flatMap((turn) => turn.parts.filter((part) => part.kind === "image"));
+	const pathOf = (ref) => hostPath(() => attachments?.imageHostPath?.(ref));
+	const filePathOf = (ref) => hostPath(() => attachments?.fileHostPath?.(ref));
+	const carried = /* @__PURE__ */ new Map();
+	const reasons = /* @__PURE__ */ new Map();
+	const reads = /* @__PURE__ */ new Map();
+	let total = 0;
+	let count = 0;
+	let full = false;
+	for (const part of [...images].reverse()) {
+		if (attachments === void 0 || attachments === null) {
+			reasons.set(part, "unavailable");
+			continue;
+		}
+		if (full) {
+			reasons.set(part, "limit");
+			continue;
+		}
+		const id = String(part.ref.attachmentId);
+		try {
+			if (!reads.has(id)) reads.set(id, readRequestImage(attachments, part.ref, limits, signal));
+			const image = await reads.get(id);
+			const size = base64Length(image.data.byteLength);
+			if (size > MAX_IMAGE_BASE64_BYTES) {
+				reasons.set(part, "too-large");
+				continue;
+			}
+			if (count + 1 > limits.maxImages || total + size > limits.maxTotalBase64Bytes) {
+				full = true;
+				reasons.set(part, "limit");
+				continue;
+			}
+			count += 1;
+			total += size;
+			carried.set(part, image);
+		} catch (error) {
+			if (signal?.aborted === true) throw error;
+			reasons.set(part, "unreadable");
+		}
+	}
+	const blocks = [];
+	let text = shape.truncated ? `${TRUNCATED_MARK}\n\n` : "";
+	const flush = () => {
+		if (text !== "") blocks.push({
+			type: "text",
+			text
+		});
+		text = "";
+	};
+	for (const [turnIndex, turn] of shape.turns.entries()) {
+		text += `${turnIndex === 0 ? "" : "\n\n"}${turn.label}：`;
+		for (const [partIndex, part] of turn.parts.entries()) {
+			const separator = partIndex === 0 ? "" : "\n";
+			if (part.kind === "text") {
+				text += separator + part.text;
+				continue;
+			}
+			if (part.kind === "file") {
+				const path = filePathOf(part.ref);
+				text += `${separator}[文件 ${attachmentName(part.ref)}${path === void 0 ? "" : `；只读副本：${path}`}]`;
+				continue;
+			}
+			const path = pathOf(part.ref);
+			const copy = path === void 0 ? "" : `；只读副本：${path}`;
+			const image = carried.get(part);
+			if (image === void 0) {
+				text += `${separator}[图片 ${attachmentName(part.ref)}：${imageOmission(reasons.get(part))}${copy}]`;
+				continue;
+			}
+			text += `${separator}[图片 ${attachmentName(part.ref)}（${image.width}x${image.height}px）${copy}]`;
+			flush();
+			blocks.push({
+				type: "image",
+				source: {
+					type: "base64",
+					media_type: image.mediaType,
+					data: Buffer.from(image.data).toString("base64")
+				}
+			});
+		}
+	}
+	flush();
+	return blocks;
+}
+function imageOmission(reason) {
+	switch (reason) {
+		case "limit": return "超出本回合的图片上限，未随消息附上，需要时请用 Read 工具读取";
+		case "too-large": return "图片过大，未随消息附上，需要时请用 Read 工具读取";
+		case "unavailable": return "当前运行环境无法读取附件";
+		default: return "读取失败，未随消息附上";
+	}
+}
+/**
+* One request-sized version of a stored image: the store's own request
+* encoder when it has one, otherwise the stored normalized bytes.
+*/
+async function readRequestImage(attachments, ref, limits, signal) {
+	if (typeof attachments.readImageRequest === "function") {
+		const version = await attachments.readImageRequest(ref, {
+			maxPixels: limits.maxPixels,
+			maxBytes: limits.maxBytesPerImage
+		}, signal);
+		return {
+			data: version.data,
+			mediaType: version.mediaType ?? ref.mediaType,
+			width: version.width ?? ref.width,
+			height: version.height ?? ref.height
+		};
+	}
+	const stored = await attachments.readImage(ref, signal);
+	return {
+		data: stored.data,
+		mediaType: stored.mediaType ?? ref.mediaType,
+		width: ref.width,
+		height: ref.height
+	};
+}
+/**
+* The prompt of a one-shot auxiliary request: its messages' text, verbatim.
+* The caller frames its own input, so nothing is added around it.
+* @param options - the assembled request.
+* @returns the prompt text.
+*/
+function renderAuxiliaryPrompt(options) {
+	return (Array.isArray(options?.messages) ? options.messages : []).filter((message) => message !== null && typeof message === "object" && message.role !== "system").flatMap((message) => Array.isArray(message.content) ? message.content : []).filter((block) => block?.type === "text" && typeof block.text === "string").map((block) => block.text).join("\n\n").trim();
 }
 /**
 * Emit text and reasoning as well-formed harness blocks.
@@ -430,43 +989,9 @@ function turnUsage(lastRequest, finished) {
 		cacheWriteTokens: finished?.cacheWriteTokens ?? 0
 	};
 }
-/**
-* Turn an assembled request into one CLI prompt.
-*
-* The leading system message carries the harness's system prompt, which
-* describes tools this model cannot call; the CLI brings its own instead.
-* @param options - the assembled request.
-* @param cwd - the working directory the CLI will run in, when known.
-* @returns the prompt text.
-*/
-function renderDelegatedPrompt(options, cwd) {
-	const messages = Array.isArray(options?.messages) ? options.messages : [];
-	const turns = [];
-	for (const message of messages) {
-		if (message === null || typeof message !== "object") continue;
-		if (message.role === "system") continue;
-		const text = (Array.isArray(message.content) ? message.content : []).map(renderBlock).filter((part) => part !== "").join("\n").trim();
-		if (text === "") continue;
-		const label = message.role === "user" ? "用户" : message.role === "assistant" ? "助手" : String(message.role);
-		turns.push(`${label}：${text}`);
-	}
-	let transcript = turns.join("\n\n");
-	if (transcript.length > MAX_PROMPT_CHARS$1) transcript = `…（较早对话已截断）\n\n${transcript.slice(-48e3)}`;
-	const system = typeof options?.system === "string" && options.system.trim() !== "" ? options.system.trim() : "";
-	return `${[
-		"[本回合由 DeepSeek Harness 委派给 Claude Code CLI 执行。请用你自己的工具完成任务，直接输出最终结果；不要反问、不要复述流程。]",
-		cwd === void 0 ? void 0 : `[工作目录：${cwd}]`,
-		system === "" ? void 0 : `[补充说明：${system.slice(0, 2e3)}]`
-	].filter((part) => part !== void 0).join("\n")}\n\n${transcript}`.trim();
-}
-/**
-* The prompt of a one-shot auxiliary request: its messages' text, verbatim.
-* The caller frames its own input, so nothing is added around it.
-* @param options - the assembled request.
-* @returns the prompt text.
-*/
-function renderAuxiliaryPrompt(options) {
-	return (Array.isArray(options?.messages) ? options.messages : []).filter((message) => message !== null && typeof message === "object" && message.role !== "system").flatMap((message) => Array.isArray(message.content) ? message.content : []).filter((block) => block?.type === "text" && typeof block.text === "string").map((block) => block.text).join("\n\n").trim();
+/** One line describing a retry the CLI is making on its own. */
+function retryNote(event) {
+	return `网关返回 ${event.status === void 0 ? "出错" : `HTTP ${event.status}`}${typeof event.error === "string" && event.error !== "" ? `（${event.error}）` : ""}，CLI 自动重试${event.attempt === void 0 ? "" : event.maxRetries === void 0 ? ` ${event.attempt}` : ` ${event.attempt}/${event.maxRetries}`}${event.delayMs === void 0 ? "" : `，${(event.delayMs / 1e3).toFixed(1)} 秒后`}`;
 }
 /**
 * How one request runs on the CLI: a title request on the small model with
@@ -475,7 +1000,7 @@ function renderAuxiliaryPrompt(options) {
 * The CLI's own system prompt and tool set stay in place even for a title:
 * they are part of what the gateway sees from the official client.
 */
-function cliCall(options, { titleModel, cwdOf, modeOf }) {
+async function cliCall(options, { titleModel, cwdOf, modeOf, attachmentsOf, imageLimits }) {
 	if (options?.purpose === "session-title") return {
 		prompt: renderAuxiliaryPrompt(options),
 		model: titleModel,
@@ -485,7 +1010,12 @@ function cliCall(options, { titleModel, cwdOf, modeOf }) {
 	};
 	const cwd = cwdOf();
 	return {
-		prompt: renderDelegatedPrompt(options, cwd),
+		content: await buildDelegatedContent(options, {
+			attachments: attachmentsOf(),
+			limits: imageLimits,
+			signal: options?.signal
+		}),
+		appendSystemPrompt: delegationInstructions(options, cwd),
 		model: options.model,
 		mode: modeOf(),
 		cwd
@@ -495,26 +1025,39 @@ function cliCall(options, { titleModel, cwdOf, modeOf }) {
 * Wrap an adapter so the CLI-backed models run through the local CLI.
 *
 * @param options - the inner adapter, the CLI runner, the CLI-backed model ids,
-*   the model session titles run on, and the mode and working directory each
-*   turn runs with.
+*   the model session titles run on, the mode and working directory each
+*   turn runs with, and the attachment store images are read from.
 * @returns an adapter with the same provider surface.
 */
-function createClaudeCliAdapter({ inner, runner, modelIds = CLI_BACKED_MODEL_IDS, titleModel = TITLE_MODEL_ID, resolveMode, resolveCwd }) {
+function createClaudeCliAdapter({ inner, runner, modelIds = CLI_BACKED_MODEL_IDS, titleModel = TITLE_MODEL_ID, resolveMode, resolveCwd, resolveAttachments, imageLimits = CLI_IMAGE_LIMITS }) {
 	if (inner === void 0 || inner === null) throw new Error("the CLI adapter needs an inner adapter");
 	if (runner === void 0 || runner === null) throw new Error("the CLI adapter needs a runner");
 	const cliModels = new Set(modelIds);
 	/** The mode is read per turn so a settings change applies without a reload. */
 	const modeOf = () => typeof resolveMode === "function" ? resolveMode() : void 0;
 	const cwdOf = () => typeof resolveCwd === "function" ? resolveCwd() : void 0;
+	const attachmentsOf = () => {
+		try {
+			return typeof resolveAttachments === "function" ? resolveAttachments() ?? void 0 : void 0;
+		} catch {
+			return;
+		}
+	};
 	async function* cliStream(options) {
+		const quiet = options?.purpose === "session-title";
+		const blocks = createBlockWriter();
+		if (!quiet) yield* blocks.note("▸ 启动 Claude Code CLI…\n");
 		let call;
 		try {
-			call = cliCall(options, {
+			call = await cliCall(options, {
 				titleModel,
 				cwdOf,
-				modeOf
+				modeOf,
+				attachmentsOf,
+				imageLimits
 			});
 		} catch (error) {
+			yield* blocks.close();
 			yield {
 				type: "finish",
 				reason: {
@@ -527,7 +1070,6 @@ function createClaudeCliAdapter({ inner, runner, modelIds = CLI_BACKED_MODEL_IDS
 			};
 			return;
 		}
-		const blocks = createBlockWriter();
 		const seen = /* @__PURE__ */ new Set();
 		const firstSighting = (key) => {
 			if (key.endsWith(":")) return true;
@@ -535,6 +1077,7 @@ function createClaudeCliAdapter({ inner, runner, modelIds = CLI_BACKED_MODEL_IDS
 			seen.add(key);
 			return true;
 		};
+		let retries = 0;
 		try {
 			let finished;
 			let lastRequest;
@@ -542,6 +1085,16 @@ function createClaudeCliAdapter({ inner, runner, modelIds = CLI_BACKED_MODEL_IDS
 				...call,
 				signal: options.signal
 			})) switch (event.type) {
+				case "started":
+					if (!quiet) {
+						const detail = [event.version, event.model].filter((part) => typeof part === "string" && part !== "").join(" · ");
+						yield* blocks.note(`▸ Claude Code CLI 已启动${detail === "" ? "" : `（${detail}）`}\n`);
+					}
+					break;
+				case "retry":
+					retries = Math.max(retries, event.attempt ?? retries + 1);
+					if (!quiet) yield* blocks.note(`  ↻ ${retryNote(event)}\n`);
+					break;
 				case "block":
 					blocks.boundary(event.kind);
 					break;
@@ -575,13 +1128,15 @@ function createClaudeCliAdapter({ inner, runner, modelIds = CLI_BACKED_MODEL_IDS
 				reason: { kind: "stop" }
 			};
 		} catch (error) {
+			yield* blocks.close();
+			const raw = String(error?.message ?? error);
 			yield {
 				type: "finish",
 				reason: {
 					kind: "error",
 					failure: {
 						code: "PI_AI_ERROR",
-						message: String(error?.message ?? error)
+						message: classifyClientPolicy(raw) ? explainCliClientPolicyFailure(raw) : classifyCapacity(raw) ? explainCliCapacityFailure(raw, retries) : raw
 					}
 				}
 			};
@@ -745,8 +1300,32 @@ const DEFAULT_CLAUDE_MODE = "edit";
 /** Isolated CLI home; the plugin owns the endpoint and key it runs with. */
 const DEFAULT_CLAUDE_CONFIG_DIR = join(homedir(), ".dsh", "packycode-claude-cli");
 const DEFAULT_CLAUDE_TIMEOUT_MS = 1800 * 1e3;
-/** Argument lists travel through argv, which the kernel bounds. */
+/**
+* How long a streaming run may stay silent after starting. The CLI prints its
+* `system/init` line within a second or two once it runs; one that prints
+* nothing for this long is stuck before its first request and is stopped, so
+* the turn reports it instead of spinning until the overall timeout.
+*/
+const DEFAULT_CLAUDE_STARTUP_TIMEOUT_MS = 120 * 1e3;
+/**
+* Upper bound on one run's prompt text. The prompt travels over stdin, so this
+* is a sanity cap rather than an OS limit.
+*/
 const MAX_PROMPT_CHARS = 1e5;
+/** Upper bound on the images one run carries. */
+const MAX_INPUT_IMAGES = 20;
+/**
+* Instructions a run carries when its caller supplies none.
+*
+* In print mode the official CLI chooses its own identity line from whether
+* it was given appended instructions: with them it introduces itself to the
+* model as "Claude Code, Anthropic's official CLI for Claude, running within
+* the Claude Agent SDK"; without them as "a Claude agent, built on Anthropic's
+* Claude Agent SDK". PackyCode routes Claude only to Claude Code, and a run
+* without instructions was refused upstream as not coming from it, so every
+* run states what it was delegated to do.
+*/
+const DEFAULT_APPEND_SYSTEM_PROMPT = "This task was delegated to Claude Code by DeepSeek Harness. Complete it with your own tools and reply with the final result.";
 const KILL_GRACE_MS = 3e3;
 /** The npm package the official CLI ships as. */
 const CLAUDE_NPM_PACKAGE = "@anthropic-ai/claude-code";
@@ -862,34 +1441,74 @@ function resolveSpawnCommand(binary, { platform = process.platform, exists = exi
 }
 /**
 * Build the CLI arguments for one delegated task.
-* @param options - the prompt, the permission mode, an optional model, whether
-*   the caller consumes the streaming protocol, and optional instructions
-*   appended to the CLI's own system prompt. The CLI's system prompt and tool
-*   set are never replaced: they are part of what the official client sends.
+*
+* The prompt is not among them: it travels over stdin (see
+* {@link buildClaudeInput}). An argv is bounded — about 32K UTF-16 units on
+* Windows — and cannot carry an image; stdin carries both.
+* @param options - the permission mode, an optional model, whether the caller
+*   consumes the streaming protocol, and instructions appended to the CLI's
+*   own system prompt ({@link DEFAULT_APPEND_SYSTEM_PROMPT} when blank). The
+*   CLI's system prompt and tool set are never replaced: they are part of
+*   what the official client sends.
 * @returns argv after the binary name.
 */
-function buildClaudeArgs({ prompt, mode = DEFAULT_CLAUDE_MODE, model, stream = false, appendSystemPrompt } = {}) {
-	const text = typeof prompt === "string" ? prompt : "";
-	if (text.trim() === "") throw new Error("claude_code needs a non-empty prompt");
-	if (text.length > MAX_PROMPT_CHARS) throw new Error(`claude_code prompt is too long (${text.length} > ${MAX_PROMPT_CHARS} characters)`);
+function buildClaudeArgs({ mode = DEFAULT_CLAUDE_MODE, model, stream = false, appendSystemPrompt } = {}) {
 	const spec = CLAUDE_CLI_MODES[mode];
 	if (spec === void 0) throw new Error(`claude_code mode must be one of ${Object.keys(CLAUDE_CLI_MODES).join(", ")}`);
-	const args = [
+	const args = stream ? [
+		"-p",
+		"--input-format",
+		"stream-json",
+		"--output-format",
+		"stream-json",
+		"--include-partial-messages",
+		"--verbose"
+	] : [
 		"-p",
-		text,
 		"--output-format",
-		stream ? "stream-json" : "json"
+		"json"
 	];
-	if (stream) args.push("--include-partial-messages", "--verbose");
 	const named = typeof model === "string" ? model.trim() : "";
 	if (named !== "") args.push("--model", named);
 	const appended = typeof appendSystemPrompt === "string" ? appendSystemPrompt.trim() : "";
-	if (appended !== "") args.push("--append-system-prompt", appended);
+	args.push("--append-system-prompt", appended === "" ? DEFAULT_APPEND_SYSTEM_PROMPT : appended);
 	if (spec.skipPermissions === true) args.push("--dangerously-skip-permissions");
 	else args.push("--allowedTools", ...spec.allowedTools);
 	return args;
 }
 /**
+* Build what the CLI reads from stdin for one run.
+*
+* A streaming run reads one `stream-json` user message, whose content may mix
+* text and Anthropic image blocks; the CLI forwards those images to the model
+* as images. A non-streaming run reads plain prompt text.
+* @param options - the prompt text, or `content` blocks (`text` and
+*   `image` with a base64 `source`), and whether the run streams.
+* @returns the stdin payload.
+*/
+function buildClaudeInput({ prompt, content, stream = false } = {}) {
+	const blocks = Array.isArray(content) ? content.filter((block) => block?.type === "text" && typeof block.text === "string" && block.text !== "" || block?.type === "image") : [{
+		type: "text",
+		text: typeof prompt === "string" ? prompt : ""
+	}];
+	const text = blocks.filter((block) => block.type === "text").map((block) => block.text).join("");
+	const images = blocks.filter((block) => block.type === "image");
+	if (text.trim() === "" && images.length === 0) throw new Error("claude_code needs a non-empty prompt");
+	if (text.length > MAX_PROMPT_CHARS) throw new Error(`claude_code prompt is too long (${text.length} > ${MAX_PROMPT_CHARS} characters)`);
+	if (images.length > MAX_INPUT_IMAGES) throw new Error(`claude_code carries at most ${MAX_INPUT_IMAGES} images per run (got ${images.length})`);
+	if (!stream) {
+		if (images.length > 0) throw new Error("claude_code images need the streaming CLI input");
+		return text;
+	}
+	return `${JSON.stringify({
+		type: "user",
+		message: {
+			role: "user",
+			content: blocks
+		}
+	})}\n`;
+}
+/**
 * The child's environment: this plugin's endpoint and key, an isolated config
 * home, and the CLI's own network-noise switches off.
 * @param options - credential, config home, and the parent environment.
@@ -1048,6 +1667,25 @@ function readClaudeStreamEvents(event) {
 		id: String(block.tool_use_id ?? ""),
 		text: oneLine(toolResultText(block.content))
 	}));
+	if (event.type === "system") {
+		if (event.subtype === "init") return [{
+			type: "started",
+			version: typeof event.claude_code_version === "string" ? event.claude_code_version : "",
+			model: typeof event.model === "string" ? event.model : ""
+		}];
+		if (event.subtype === "api_retry") {
+			const count = (value) => typeof value === "number" && Number.isFinite(value) ? value : void 0;
+			return [{
+				type: "retry",
+				attempt: count(event.attempt),
+				maxRetries: count(event.max_retries),
+				delayMs: count(event.retry_delay_ms),
+				status: count(event.error_status),
+				error: typeof event.error === "string" ? event.error : ""
+			}];
+		}
+		return [];
+	}
 	if (event.type === "result") return [{
 		type: "result",
 		result: event
@@ -1058,24 +1696,29 @@ function readClaudeStreamEvents(event) {
 * A Claude Code CLI runner.
 * @param options - binary (a path, or a function resolving one per run so a
 *   CLI installed after startup is picked up), config home, credential
-*   resolution, and process seams.
-* @returns `{ run({ prompt, mode, model, cwd, signal }) }`.
+*   resolution, the overall and (streaming) startup time limits, and process
+*   seams.
+* @returns `{ run(options), stream(options) }`.
 */
-function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_CLAUDE_CONFIG_DIR, resolveCredential, spawnImpl = spawn, timeoutMs = DEFAULT_CLAUDE_TIMEOUT_MS, platform = process.platform } = {}) {
+function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_CLAUDE_CONFIG_DIR, resolveCredential, spawnImpl = spawn, timeoutMs = DEFAULT_CLAUDE_TIMEOUT_MS, startupTimeoutMs = DEFAULT_CLAUDE_STARTUP_TIMEOUT_MS, platform = process.platform } = {}) {
 	if (typeof resolveCredential !== "function") throw new Error("the Claude Code CLI runner needs resolveCredential");
 	/**
 	* Spawn one CLI process and own its lifetime: capture both pipes, enforce the
 	* timeout, and kill the process — with a grace period — when the caller
 	* aborts. Both public entry points share it.
 	*/
-	const start = async ({ prompt, mode, model, appendSystemPrompt, cwd, signal, stream, onStdout }) => {
+	const start = async ({ prompt, content, mode, model, appendSystemPrompt, cwd, signal, stream, onStdout }) => {
 		const args = buildClaudeArgs({
-			prompt,
 			mode,
 			model,
 			stream,
 			appendSystemPrompt
 		});
+		const input = buildClaudeInput({
+			prompt,
+			content,
+			stream
+		});
 		const { baseUrl, token } = await resolveCredential();
 		const program = typeof binary === "function" ? await binary() : binary;
 		const command = resolveSpawnCommand(program, { platform });
@@ -1088,16 +1731,20 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 			cwd,
 			env,
 			stdio: [
-				"ignore",
+				"pipe",
 				"pipe",
 				"pipe"
 			],
 			windowsHide: true
 		});
+		child.stdin?.on?.("error", () => void 0);
+		child.stdin?.end?.(input);
 		const state = {
 			stdout: "",
 			stderr: "",
 			timedOut: false,
+			silent: false,
+			sawOutput: false,
 			settled: false
 		};
 		const kill = () => {
@@ -1114,17 +1761,30 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 			kill();
 		}, timeoutMs) : void 0;
 		timer?.unref?.();
+		let startupTimer = stream && startupTimeoutMs > 0 ? setTimeout(() => {
+			if (state.sawOutput) return;
+			state.silent = true;
+			kill();
+		}, startupTimeoutMs) : void 0;
+		startupTimer?.unref?.();
+		const clearStartup = () => {
+			if (startupTimer !== void 0) clearTimeout(startupTimer);
+			startupTimer = void 0;
+		};
 		const onAbort = () => kill();
 		signal?.addEventListener("abort", onAbort, { once: true });
 		const release = () => {
 			if (state.settled) return;
 			state.settled = true;
 			if (timer !== void 0) clearTimeout(timer);
+			clearStartup();
 			signal?.removeEventListener("abort", onAbort);
 		};
 		child.stdout?.setEncoding?.("utf8");
 		child.stderr?.setEncoding?.("utf8");
 		child.stdout?.on("data", (chunk) => {
+			state.sawOutput = true;
+			clearStartup();
 			const text = String(chunk);
 			state.stdout = (state.stdout + text).slice(-4194304);
 			onStdout?.(text);
@@ -1143,6 +1803,11 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 					reject(/* @__PURE__ */ new Error(`claude_code timed out after ${Math.round(timeoutMs / 1e3)}s`));
 					return;
 				}
+				if (state.silent) {
+					const detail = state.stderr.trim().split("\n").slice(-4).join(" ").slice(0, 400);
+					reject(/* @__PURE__ */ new Error(`Claude Code CLI printed nothing within ${Math.round(startupTimeoutMs / 1e3)}s of starting and was stopped${detail === "" ? "" : `: ${detail}`}`));
+					return;
+				}
 				if (signal?.aborted === true) {
 					reject(/* @__PURE__ */ new Error("claude_code was aborted"));
 					return;
@@ -1167,12 +1832,13 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 		* @param options - prompt, mode, model, working directory, and cancellation.
 		* @returns the CLI's answer plus its own accounting.
 		*/
-		async run({ prompt, mode = DEFAULT_CLAUDE_MODE, model, cwd, signal } = {}) {
+		async run({ prompt, mode = DEFAULT_CLAUDE_MODE, model, appendSystemPrompt, cwd, signal } = {}) {
 			const startedAt = Date.now();
 			const { state, closed } = await start({
 				prompt,
 				mode,
 				model,
+				appendSystemPrompt,
 				cwd,
 				signal,
 				stream: false
@@ -1196,18 +1862,19 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 		* Run one delegated task, yielding its answer as the CLI produces it.
 		* The final `result` event carries the CLI's own accounting, summed over
 		* every request the CLI made.
-		* @param options - as {@link run}, plus optional `appendSystemPrompt`
-		*   instructions.
+		* @param options - as {@link run}, plus optional `content` blocks (text
+		*   and base64 images) that replace `prompt`.
 		* @returns an async generator of {@link readClaudeStreamEvents} events and
 		*   one closing `result` event.
 		*/
-		async *stream({ prompt, mode = DEFAULT_CLAUDE_MODE, model, appendSystemPrompt, cwd, signal } = {}) {
+		async *stream({ prompt, content, mode = DEFAULT_CLAUDE_MODE, model, appendSystemPrompt, cwd, signal } = {}) {
 			const startedAt = Date.now();
 			let buffer = "";
 			let sawResult;
 			const lines = [];
 			const { state, closed, kill } = await start({
 				prompt,
+				content,
 				mode,
 				model,
 				appendSystemPrompt,
@@ -2486,110 +3153,6 @@ const PACKYCODE_MODELS = Object.freeze([
 /** Every model id this catalog advertises, in picker order. */
 const PACKYCODE_MODEL_IDS = Object.freeze(PACKYCODE_MODELS.map((model) => model.id));
 //#endregion
-//#region src/failures.js
-/**
-* Failure classification for the two conditions that move the key ring along.
-*
-* The gateway reports an exhausted key and a rejected key in Chinese, and the
-* harness classifies failures by fixed English/status wording it recognizes
-* (`isQuotaExceededError`, `\b401\b`). Normalizing here is what makes the
-* harness's retry policy re-run the step — and therefore what lets the retry
-* pick up the next key. Rewriting is honest about what happened: this plugin
-* knows the key's condition from the gateway's own words plus its balance
-* reader, so the sentence it substitutes says no more than that.
-*
-* @module dsh-packycode-api/failures
-*/
-/** Terminal quota, balance, or credit wording, in the gateway's own languages. */
-const QUOTA_WORDING = /额度|余额|配额|欠费|insufficient[\s_-]+(?:quota|balance|credits?)|quota[\s_-]+(?:exceeded|exhausted|reached)|out[\s_-]+of[\s_-]+(?:credits?|budget)/iu;
-/** A rejected key names itself; a bare 403 does not, and must not disable one. */
-const INVALID_KEY_WORDING = /无效的令牌|令牌无效|无效密钥|密钥无效|invalid[\s_-]+api[\s_-]*key|invalid_authentication|api key is invalid/iu;
-const INVALID_KEY_STATUS = /\b401\b/;
-/**
-* A gateway group that only serves its vendor's official client. These arrive
-* as 403, which the harness reads as an authentication failure and renders as
-* an invalid-API-key problem — the opposite of what happened, and a condition
-* no retry can clear.
-*/
-const CLIENT_POLICY_WORDING = /only accessible via the official|official claude cli|官方\s*claude\s*cli|请使用标准\s*codex\s*客户端|客户端存在异常|二次分发|API\s*转接/iu;
-/** The key's quota is exhausted; move to the next key. */
-const QUOTA_FAILURE = "quota";
-/** The gateway rejected the key itself; move to the next key. */
-const INVALID_KEY_FAILURE = "invalid-key";
-/**
-* Whether the gateway is refusing this client rather than this credential.
-* @param message - provider failure text, as pi-ai carries it.
-* @returns true when the route is gated to a vendor's official client.
-*/
-function classifyClientPolicy(message) {
-	return CLIENT_POLICY_WORDING.test(typeof message === "string" ? message : "");
-}
-/**
-* Classify a gateway failure message.
-*
-* Quota wording wins over a status token: an exhausted balance is often
-* reported as 402/403, and only the key's own rejection may read as 401. A
-* client-policy refusal is not a key fault and is classified separately.
-* @param message - provider failure text, as pi-ai carries it.
-* @returns the failure kind, or undefined when the key is not at fault.
-*/
-function classifyGatewayFailure(message) {
-	const text = typeof message === "string" ? message : "";
-	if (text === "") return void 0;
-	if (classifyClientPolicy(text)) return void 0;
-	if (QUOTA_WORDING.test(text)) return QUOTA_FAILURE;
-	if (INVALID_KEY_WORDING.test(text)) return INVALID_KEY_FAILURE;
-	if (INVALID_KEY_STATUS.test(text)) return INVALID_KEY_FAILURE;
-}
-/**
-* Rewrite a failure message so the harness classifies it as quota or auth.
-*
-* A bare status token is neutralized first: an exhausted balance arrives as
-* 402 or 403 on some gateway routes, and the harness's auth rule matches
-* 401/403 before it reads any wording, which would send the failure into a
-* category the retry policy does not re-run.
-* @param message - the original provider failure text.
-* @param kind - the classification of {@link classifyGatewayFailure}.
-* @returns text the harness routes to QUOTA or AUTH.
-*/
-/**
-* Explain a client-policy refusal so the user reads the real cause.
-*
-* The sentence must not read as any other failure the harness knows: it
-* deliberately carries no HTTP status and none of the words the classifier
-* matches for auth, quota, rate limits, timeouts, or transport faults. That
-* keeps the failure out of the retry policy — no retry can talk a group into
-* serving an API client — and lets the sentence reach the user verbatim, in
-* place of the "API key is invalid" the bare 403 would have produced.
-* @param keyName - the account name the balance reader saw, when known.
-* @returns the replacement sentence.
-*/
-function explainClientPolicyFailure() {
-	return "PackyCode 拒绝了这个客户端：所选分组只允许厂商官方客户端调用（Claude 分组要求官方 Claude CLI，Codex 分组要求标准 Codex 客户端）。这不是 API Key 失效，重试也不会成功。请改用允许 API 调用的分组（例如 cc-sale 或 claude-officially），或改用 PackyCode 的 gpt-6.1-sol / deepseek-flash。 / This group only serves the vendor’s official client; the API key is fine and retrying cannot help.";
-}
-/**
-* Rewrite a failure message so the harness classifies it as quota or auth.
-*
-* A bare status token is neutralized first: an exhausted balance arrives as
-* 402 or 403 on some gateway routes, and the harness's auth rule matches
-* 401/403 before it reads any wording, which would send the failure into a
-* category the retry policy does not re-run.
-* @param message - the original provider failure text.
-* @param kind - the classification of {@link classifyGatewayFailure}.
-* @param options - optional account name for the policy explanation.
-* @returns text the harness routes to QUOTA or AUTH, or a policy explanation.
-*/
-function normalizeFailureMessage(message, kind, options = {}) {
-	const text = typeof message === "string" && message.length > 0 ? message : "PackyCode request failed";
-	if (kind === "client-policy") return explainClientPolicyFailure(options.keyName);
-	if (kind === "quota") return `${neutralizeAuthStatus(text)} — PackyCode: insufficient quota for this API key; trying the next key`;
-	if (kind === "invalid-key") return `${neutralizeAuthStatus(text)} — PackyCode: 401 invalid_authentication for this API key; trying the next key`;
-	return text;
-}
-function neutralizeAuthStatus(text) {
-	return text.replace(/\b(?:401|403)\b/gu, "HTTP");
-}
-//#endregion
 //#region src/provider.js
 /**
 * The PackyCode pi-ai provider, built in code so the user configures no route.
@@ -2848,6 +3411,8 @@ const name = PLUGIN_ID;
 * blocking on a service it will never see.
 */
 const inject = ["llm", "credentials"];
+/** What a `claude_code` tool run is told about where its task came from. */
+const CLAUDE_TOOL_INSTRUCTIONS = "This task was delegated to Claude Code by another agent in DeepSeek Harness through its claude_code tool. The task text is self-contained; complete it with your own tools and reply with the final result only.";
 /** Host overrides; a profile that never installs this section keeps the defaults. */
 const Config = z.object({
 	apiHost: z.string().default(DEFAULT_API_HOST),
@@ -3072,7 +3637,8 @@ function apply(ctx, config) {
 		}),
 		runner: claudeRunner,
 		resolveMode: resolveCliMode,
-		resolveCwd: resolveCliCwd
+		resolveCwd: resolveCliCwd,
+		resolveAttachments: () => ctx.get?.("attachments") ?? ctx.attachments
 	});
 	ctx.llm.registerAdapter([PROVIDER], adapter);
 	ctx.llm.registerConfigurableProviders([{
@@ -3192,6 +3758,7 @@ function apply(ctx, config) {
 					prompt: args.prompt,
 					mode: capClaudeMode(args.mode, cliModeCeiling(exec?.agent?.session)) ?? "edit",
 					model: args.model,
+					appendSystemPrompt: CLAUDE_TOOL_INSTRUCTIONS,
 					cwd,
 					signal: exec?.signal
 				});
@@ -3200,4 +3767,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { AUTO_CLAUDE_MODE, CHANNEL, CLAUDE_CLI_MODES, CLAUDE_INSTALL_COMMAND, CLAUDE_MISSING_MESSAGE, CLAUDE_NPM_PACKAGE, CLI_BACKED_MODEL_IDS, Config, DEFAULT_API_HOST, DEFAULT_STATUS_HOST, DISPLAY_NAME, PACKYCODE_MODELS, PACKYCODE_MODEL_IDS, PLUGIN_ID, PROVIDER, PackyCodeKeyRing, SETTINGS_NAMESPACE, TITLE_MODEL_ID, apply, assertApiKey, buildClaudeArgs, buildClaudeEnvironment, capClaudeMode, classifyClientPolicy, classifyGatewayFailure, claudeBinaryCandidates, claudeModeFor, claudeModeForSession, createBalanceReader, createClaudeCliAdapter, createClaudeCliManager, createClaudeRunner, createPackyCodeProfile, createPackyCodeProvider, createPackyCodeRpc, explainClientPolicyFailure, explainNpmFailure, findClaudeBinary, guardKeyRotation, inject, locateClaudeBinary, locateNpm, name, normalizeFailureMessage, normalizeHost, npmCandidates, parseBillingSubscription, parseBillingUsage, parseClaudeResult, parseClaudeVersion, parseTokenUsage, readClaudeStreamEvents, renderAuxiliaryPrompt, renderDelegatedPrompt, resolveSpawnCommand, summarizeToolUse };
+export { AUTO_CLAUDE_MODE, CHANNEL, CLAUDE_CLI_MODES, CLAUDE_INSTALL_COMMAND, CLAUDE_MISSING_MESSAGE, CLAUDE_NPM_PACKAGE, CLI_BACKED_MODEL_IDS, CLI_IMAGE_LIMITS, Config, DEFAULT_API_HOST, DEFAULT_APPEND_SYSTEM_PROMPT, DEFAULT_STATUS_HOST, DISPLAY_NAME, LEGACY_STATUS_HOSTS, PACKYCODE_MODELS, PACKYCODE_MODEL_IDS, PLUGIN_ID, PROVIDER, PackyCodeKeyRing, SETTINGS_NAMESPACE, TITLE_MODEL_ID, accountHostOrder, apply, assertApiKey, buildClaudeArgs, buildClaudeEnvironment, buildClaudeInput, buildDelegatedContent, capClaudeMode, classifyClientPolicy, classifyGatewayFailure, claudeBinaryCandidates, claudeModeFor, claudeModeForSession, createBalanceReader, createClaudeCliAdapter, createClaudeCliManager, createClaudeRunner, createPackyCodeProfile, createPackyCodeProvider, createPackyCodeRpc, delegationInstructions, explainCliClientPolicyFailure, explainClientPolicyFailure, explainNpmFailure, findClaudeBinary, guardKeyRotation, inject, locateClaudeBinary, locateNpm, name, normalizeFailureMessage, normalizeHost, npmCandidates, parseBillingSubscription, parseBillingUsage, parseClaudeResult, parseClaudeVersion, parseTokenUsage, readClaudeStreamEvents, renderAuxiliaryPrompt, renderDelegatedPrompt, resolveSpawnCommand, statusHostOrder, summarizeToolUse };