dsh-packycode-api 1.3.2 → 1.3.4

package/lib/index.js

@@ -1,14 +1,15 @@
-import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { homedir } from "node:os";
 import { basename, dirname, join, posix, resolve, win32 } from "node:path";
 import z from "@deepseek-ai/schemastery";
-import { lstat, mkdir, open, readFile, readdir, realpath, rename, rm, writeFile } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import { constants, existsSync, readFileSync, readdirSync } from "node:fs";
+import { lstat, mkdir, open, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
+import { createServer } from "node:http";
 import { fileURLToPath } from "node:url";
-import { constants, existsSync } from "node:fs";
 import { HarnessError, LlmError, QUOTA_EXCEEDED_CODE, createUserMessage, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { credentialKey } from "@deepseek-ai/dsh-credentials";
-import { spawn } from "node:child_process";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { lazyStream } from "@earendil-works/pi-ai/api/lazy";
@@ -16,8 +17,8 @@ import { clampThinkingLevel, createProvider } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
 import { openAIResponsesApi } from "@earendil-works/pi-ai/api/openai-responses.lazy";
 import { anthropicMessagesApi } from "@earendil-works/pi-ai/api/anthropic-messages.lazy";
-import { googleGenerativeAIApi } from "@earendil-works/pi-ai/api/google-generative-ai.lazy";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { googleGenerativeAIApi } from "@earendil-works/pi-ai/api/google-generative-ai.lazy";
 //#region src/request.js
 /**
 * The host-side HTTP plumbing every reader shares: fetch resolved at call
@@ -294,7 +295,7 @@ function redactSecrets(text, values) {
 *
 * @module dsh-packycode-api/balance
 */
-const record$2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const record$4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 function number(value) {
 	if (typeof value === "number" && Number.isFinite(value)) return value;
 	if (typeof value === "string" && value.trim() !== "") {
@@ -322,8 +323,8 @@ function quotaFields(prefix, quota) {
 * @returns a small projection, or undefined when the shape is unrecognized.
 */
 function parseTokenUsage(payload) {
-	const data = record$2(payload?.data) ? payload.data : payload;
-	if (!record$2(data)) return void 0;
+	const data = record$4(payload?.data) ? payload.data : payload;
+	if (!record$4(data)) return void 0;
 	if (![
 		"name",
 		"quota_limit",
@@ -470,6 +471,2047 @@ function createBalanceReader({ listKeys, getHosts, fetchImpl = ambientFetch, now
 	});
 }
 //#endregion
+//#region src/locate.js
+/**
+* Finding programs on macOS, Linux, and Windows.
+*
+* A desktop app launched from Finder or the Start menu inherits a much shorter
+* PATH than a terminal, so a lookup that trusts PATH alone misses an npm or
+* Claude Code install the user can run from their shell. These helpers walk
+* PATH the way the platform's own shell would, and know the usual install
+* directories it may lack.
+*
+* @module dsh-packycode-api/locate
+*/
+/** The path flavour of `platform`, so a Windows layout is testable on macOS. */
+const pathFor = (platform) => platform === "win32" ? win32 : posix;
+const listDirectory = (directory) => {
+	try {
+		return readdirSync(directory);
+	} catch {
+		return [];
+	}
+};
+/** The environment's PATH key: Windows spells it `Path` and compares case-insensitively. */
+function pathKey(env, platform = process.platform) {
+	if (platform !== "win32") return "PATH";
+	return Object.keys(env ?? {}).find((name) => name.toUpperCase() === "PATH") ?? "Path";
+}
+/** Numeric `vX.Y.Z` ordering, newest first, for nvm's per-version directories. */
+function newestFirst(a, b) {
+	const parts = (value) => value.replace(/^v/u, "").split(".").map((part) => Number.parseInt(part, 10) || 0);
+	const left = parts(a);
+	const right = parts(b);
+	for (let index = 0; index < Math.max(left.length, right.length); index += 1) {
+		const delta = (right[index] ?? 0) - (left[index] ?? 0);
+		if (delta !== 0) return delta;
+	}
+	return 0;
+}
+/**
+* The `bin` directories of every Node version nvm installed, newest first.
+* @param options - home directory, environment, and a directory reader.
+* @returns absolute directories; empty when nvm is absent.
+*/
+function nvmBinDirs({ home, env = process.env, platform = process.platform, readdir = listDirectory } = {}) {
+	if (platform === "win32") return [];
+	const path = pathFor(platform);
+	const root = path.join(env.NVM_DIR ?? path.join(home, ".nvm"), "versions", "node");
+	return readdir(root).filter((name) => /^v\d/u.test(name)).sort(newestFirst).map((name) => path.join(root, name, "bin"));
+}
+/**
+* Look a program up on PATH.
+* @param names - file names to try in each directory, in order (on Windows
+*   pass the real file names, e.g. `claude.exe` and `claude.cmd`).
+* @param options - platform, environment, and an existence check.
+* @returns the first existing absolute path, or undefined.
+*/
+function searchPath(names, { platform = process.platform, env = process.env, exists = existsSync } = {}) {
+	const path = pathFor(platform);
+	const value = env?.[pathKey(env, platform)];
+	if (typeof value !== "string" || value === "") return void 0;
+	for (const raw of value.split(platform === "win32" ? ";" : ":")) {
+		const directory = raw.trim().replace(/^"(.*)"$/u, "$1");
+		if (directory === "") continue;
+		for (const name of names) {
+			const candidate = path.join(directory, name);
+			if (exists(candidate)) return candidate;
+		}
+	}
+}
+/**
+* An environment whose PATH starts with the directory a program lives in.
+*
+* npm's and the npm-installed CLI's launchers start with `#!/usr/bin/env node`,
+* and nvm, Homebrew, and the official installers put `node` beside them; a
+* GUI-launched host whose PATH lacks that directory would otherwise fail with
+* `env: node: No such file or directory`.
+* @param env - the environment to extend; not modified.
+* @param program - the program's path; a bare name leaves PATH alone.
+* @param platform - which path rules apply.
+* @returns a new environment.
+*/
+function withProgramDirOnPath(env, program, platform = process.platform) {
+	const path = pathFor(platform);
+	if (typeof program !== "string" || !path.isAbsolute(program)) return { ...env };
+	const key = pathKey(env, platform);
+	const separator = platform === "win32" ? ";" : ":";
+	const directory = path.dirname(program);
+	const entries = (typeof env?.[key] === "string" ? env[key] : "").split(separator).filter((entry) => entry !== "");
+	if (entries.includes(directory)) return { ...env };
+	return {
+		...env,
+		[key]: [directory, ...entries].join(separator)
+	};
+}
+//#endregion
+//#region src/claude-binary.js
+/**
+* Finding and starting the official Claude Code CLI.
+*
+* Keys in PackyCode's `cc` group are served only to the official client, so
+* their Claude requests are sent by the real CLI binary on this device. These
+* helpers locate it the way the user's shell would and turn an npm launcher
+* into something `spawn` can start without a shell.
+*
+* @module dsh-packycode-api/claude-binary
+*/
+/** The npm package the official CLI ships as. */
+const CLAUDE_NPM_PACKAGE = "@anthropic-ai/claude-code";
+/** Isolated CLI home; the plugin owns the endpoint and key it runs with. */
+const DEFAULT_CLAUDE_CONFIG_DIR = join(homedir(), ".dsh", "packycode-claude-cli");
+/** What a request reports when no CLI could be started at all. */
+const CLAUDE_MISSING_MESSAGE = "本机没有可用的 Claude Code CLI，而当前 Key 的 Claude 分组只接受官方 CLI 发出的请求。请在 设置 → PackyCode → Claude Code CLI 安装，或在终端运行 npm install -g @anthropic-ai/claude-code，然后重发。 / Claude Code CLI is not installed on this device, and this key's Claude group only serves the official CLI. Install it under Settings → PackyCode, or run: npm install -g @anthropic-ai/claude-code";
+/** The CLI's file names on PATH: the native installer ships an `.exe`, npm a `.cmd` launcher. */
+const claudeFileNames = (platform) => platform === "win32" ? ["claude.exe", "claude.cmd"] : ["claude"];
+/**
+* Where the official installer, npm, and the common Node managers put the CLI,
+* in the order they are tried. PATH is searched after these.
+* @param options - platform, home directory, environment, and a directory reader.
+* @returns absolute candidate paths.
+*/
+function claudeBinaryCandidates({ platform = process.platform, home = homedir(), env = process.env, readdir } = {}) {
+	const path = pathFor(platform);
+	if (platform === "win32") {
+		const appData = env.APPDATA ?? path.join(home, "AppData", "Roaming");
+		return [
+			path.join(home, ".local", "bin", "claude.exe"),
+			path.join(appData, "npm", "claude.cmd"),
+			...env.NVM_SYMLINK ? [path.join(env.NVM_SYMLINK, "claude.cmd")] : [],
+			path.join(env.ProgramFiles ?? "C:\\Program Files", "nodejs", "claude.cmd")
+		];
+	}
+	return [
+		path.join(home, ".local", "bin", "claude"),
+		path.join(home, ".claude", "local", "claude"),
+		"/opt/homebrew/bin/claude",
+		"/usr/local/bin/claude",
+		path.join(home, ".npm-global", "bin", "claude"),
+		path.join(home, ".volta", "bin", "claude"),
+		...nvmBinDirs({
+			home,
+			env,
+			platform,
+			readdir
+		}).map((directory) => path.join(directory, "claude"))
+	];
+}
+/**
+* Locate an installed Claude Code CLI.
+* @param options - a configured path (wins when it exists), plus platform,
+*   home, environment, and file-system seams.
+* @returns an absolute path, or undefined when none is installed.
+*/
+function locateClaudeBinary({ explicit, platform = process.platform, home = homedir(), env = process.env, exists = existsSync, readdir } = {}) {
+	const configured = typeof explicit === "string" ? explicit.trim() : "";
+	if (configured !== "") {
+		if (pathFor(platform).isAbsolute(configured)) return exists(configured) ? configured : void 0;
+		return searchPath(platform === "win32" && !/\.[a-z]+$/iu.test(configured) ? [`${configured}.exe`, `${configured}.cmd`] : [configured], {
+			platform,
+			env,
+			exists
+		});
+	}
+	for (const candidate of claudeBinaryCandidates({
+		platform,
+		home,
+		env,
+		readdir
+	})) if (exists(candidate)) return candidate;
+	return searchPath(claudeFileNames(platform), {
+		platform,
+		env,
+		exists
+	});
+}
+/** The program an npm `.cmd` launcher runs, relative to the launcher's own directory. */
+const SHIM_TARGET = /"%(?:~dp0|dp0%)\\([^"%]+?\.(?:c?js|mjs|exe))"/giu;
+/**
+* Turn a located CLI into something `spawn` can start without a shell.
+*
+* On Windows npm installs `claude.cmd`, and Node refuses to start a `.cmd`
+* without `shell: true` — which would hand arguments to `cmd.exe` to parse.
+* The launcher only forwards to a program beside it, so that program is
+* started directly instead: `node <cli.js>` or the packaged `.exe`.
+* @param binary - the located CLI.
+* @param options - platform and file-system seams.
+* @returns the command and the arguments that precede the CLI's own.
+*/
+function resolveSpawnCommand(binary, { platform = process.platform, exists = existsSync, readFile = (file) => readFileSync(file, "utf8") } = {}) {
+	if (platform !== "win32" || !/\.(?:cmd|bat)$/iu.test(binary)) return {
+		command: binary,
+		args: []
+	};
+	const path = pathFor(platform);
+	const directory = path.dirname(binary);
+	let relative;
+	try {
+		relative = [...readFile(binary).matchAll(SHIM_TARGET)].map((match) => match[1]).find((target) => !/^node\.exe$/iu.test(target));
+	} catch {}
+	const target = relative === void 0 ? path.join(directory, "node_modules", ...CLAUDE_NPM_PACKAGE.split("/"), "cli.js") : path.join(directory, relative);
+	if (!exists(target)) throw new Error(`Claude Code CLI launcher ${binary} points at a missing program; reinstall it with npm install -g ${CLAUDE_NPM_PACKAGE}`);
+	if (/\.exe$/iu.test(target)) return {
+		command: target,
+		args: []
+	};
+	const bundledNode = path.join(directory, "node.exe");
+	return {
+		command: exists(bundledNode) ? bundledNode : "node",
+		args: [target]
+	};
+}
+//#endregion
+//#region src/claude-install.js
+/**
+* Detecting, and installing, the local Claude Code CLI.
+*
+* Claude requests on a key whose group serves only the official client are
+* sent by this device's Claude Code CLI, so the settings panel shows whether
+* one is installed (and which version), and offers to install it with
+* `npm install -g @anthropic-ai/claude-code` — the same command on macOS and
+* Windows. Installation runs on the host, never in a shell built from user
+* text: npm's arguments are constants.
+*
+* @module dsh-packycode-api/claude-install
+*/
+const CLAUDE_INSTALL_COMMAND = `npm install -g ${CLAUDE_NPM_PACKAGE}`;
+const INSTALL_ARGS = Object.freeze([
+	"install",
+	"-g",
+	CLAUDE_NPM_PACKAGE
+]);
+const PREFIX_ARGS = Object.freeze(["prefix", "-g"]);
+const VERSION_TIMEOUT_MS = 2e4;
+const PREFIX_TIMEOUT_MS = 2e4;
+const INSTALL_TIMEOUT_MS = 900 * 1e3;
+/** A detection is reused this long; the panel's refresh and an install bypass it. */
+const DETECTION_TTL_MS = 300 * 1e3;
+const DETAIL_CHARS = 800;
+/**
+* The version `claude --version` prints, e.g. `2.1.3 (Claude Code)`.
+* @param output - the command's stdout.
+* @returns the semantic version, or undefined.
+*/
+function parseClaudeVersion(output) {
+	return /\b(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)\b/u.exec(typeof output === "string" ? output : "")?.[1];
+}
+/** The last lines of a command's output, bounded for display. */
+function detailOf(...texts) {
+	const tail = texts.filter((text) => typeof text === "string").join("\n").split(/\r?\n/u).map((line) => line.trimEnd()).filter((line) => line.trim() !== "").slice(-8).join("\n");
+	return tail.length > DETAIL_CHARS ? tail.slice(-800) : tail;
+}
+/**
+* Where npm usually lives, in the order tried after PATH.
+* @param options - platform, home, environment, the host's own Node, and a directory reader.
+* @returns absolute candidate paths.
+*/
+function npmCandidates({ platform = process.platform, home = homedir(), env = process.env, execPath = process.execPath, readdir } = {}) {
+	const path = pathFor(platform);
+	const name = platform === "win32" ? "npm.cmd" : "npm";
+	const beside = typeof execPath === "string" && execPath !== "" ? [path.join(path.dirname(execPath), name)] : [];
+	if (platform === "win32") return [
+		...beside,
+		...env.NVM_SYMLINK ? [path.join(env.NVM_SYMLINK, name)] : [],
+		path.join(env.ProgramFiles ?? "C:\\Program Files", "nodejs", name)
+	];
+	return [
+		...beside,
+		"/opt/homebrew/bin/npm",
+		"/usr/local/bin/npm",
+		path.join(home, ".volta", "bin", "npm"),
+		...nvmBinDirs({
+			home,
+			env,
+			platform,
+			readdir
+		}).map((directory) => path.join(directory, "npm"))
+	];
+}
+/**
+* Locate npm: PATH first (the one the user's terminal runs), then the usual places.
+* @param options - as {@link npmCandidates}, plus an existence check.
+* @returns an absolute path, or undefined.
+*/
+function locateNpm({ platform = process.platform, home = homedir(), env = process.env, execPath = process.execPath, exists = existsSync, readdir } = {}) {
+	const onPath = searchPath(platform === "win32" ? ["npm.cmd"] : ["npm"], {
+		platform,
+		env,
+		exists
+	});
+	if (onPath !== void 0) return onPath;
+	return npmCandidates({
+		platform,
+		home,
+		env,
+		execPath,
+		readdir
+	}).find((candidate) => exists(candidate));
+}
+/**
+* Classify an npm failure so the panel can say what to do about it.
+* @param result - the captured npm run.
+* @returns `{ code, detail }`.
+*/
+function explainNpmFailure(result) {
+	const detail = detailOf(result?.error?.message, result?.stderr, result?.stdout);
+	if (/\bEACCES\b|\bEPERM\b|permission denied|operation not permitted/iu.test(detail)) return {
+		code: "permission",
+		detail
+	};
+	if (/\bENOTFOUND\b|\bETIMEDOUT\b|\bECONNRESET\b|\bECONNREFUSED\b|network/iu.test(detail)) return {
+		code: "network",
+		detail
+	};
+	if (/timed out after/iu.test(detail)) return {
+		code: "timeout",
+		detail
+	};
+	return {
+		code: "failed",
+		detail: detail === "" ? `npm exited with code ${result?.code ?? "unknown"}` : detail
+	};
+}
+/**
+* Run a command to completion and capture its output. Never rejects: a
+* missing program or a timeout comes back as `error`.
+*/
+function runCaptured(spawnImpl, command, args, options, timeoutMs) {
+	return new Promise((resolve) => {
+		let child;
+		try {
+			child = spawnImpl(command, args, {
+				...options,
+				stdio: [
+					"ignore",
+					"pipe",
+					"pipe"
+				],
+				windowsHide: true
+			});
+		} catch (error) {
+			resolve({
+				code: null,
+				stdout: "",
+				stderr: "",
+				error
+			});
+			return;
+		}
+		let stdout = "";
+		let stderr = "";
+		let done = false;
+		const finish = (outcome) => {
+			if (done) return;
+			done = true;
+			clearTimeout(timer);
+			resolve({
+				stdout,
+				stderr,
+				...outcome
+			});
+		};
+		const timer = setTimeout(() => {
+			try {
+				child.kill();
+			} catch {}
+			finish({
+				code: null,
+				error: /* @__PURE__ */ new Error(`timed out after ${Math.round(timeoutMs / 1e3)}s`)
+			});
+		}, timeoutMs);
+		timer.unref?.();
+		child.stdout?.setEncoding?.("utf8");
+		child.stderr?.setEncoding?.("utf8");
+		child.stdout?.on("data", (chunk) => {
+			stdout = (stdout + String(chunk)).slice(-65536);
+		});
+		child.stderr?.on("data", (chunk) => {
+			stderr = (stderr + String(chunk)).slice(-65536);
+		});
+		child.on("error", (error) => finish({
+			code: null,
+			error
+		}));
+		child.on("close", (code) => finish({
+			code,
+			error: void 0
+		}));
+	});
+}
+/**
+* The CLI manager behind the settings panel and the runner.
+* @param options - the configured CLI path (a function, so a settings change
+*   applies without a restart), plus platform, environment, and process seams.
+* @returns `{ binary, detect, install, status }`.
+*/
+function createClaudeCliManager({ explicitPath = () => "", platform = process.platform, home = homedir(), env = process.env, execPath = process.execPath, configDir = DEFAULT_CLAUDE_CONFIG_DIR, spawnImpl = spawn, exists = existsSync, readFile = (file) => readFileSync(file, "utf8"), readdir, now = () => Date.now() } = {}) {
+	const path = pathFor(platform);
+	const configured = () => {
+		const value = explicitPath();
+		return typeof value === "string" ? value.trim() : "";
+	};
+	const locateOptions = () => ({
+		platform,
+		home,
+		env,
+		exists,
+		readdir
+	});
+	const npm = () => locateNpm({
+		...locateOptions(),
+		execPath
+	});
+	/**
+	* Run npm. On Windows npm is a `.cmd` launcher, which Node starts only
+	* through `cmd.exe`; that is safe here because every argument is a constant.
+	*/
+	const runNpm = (program, args, timeoutMs) => runCaptured(spawnImpl, platform === "win32" ? `"${program}"` : program, args, {
+		env: withProgramDirOnPath(env, program, platform),
+		shell: platform === "win32"
+	}, timeoutMs);
+	/** npm's global bin directory, read once; a GUI PATH often lacks it. */
+	let globalBin;
+	const npmGlobalBin = async () => {
+		if (globalBin !== void 0) return globalBin === "" ? void 0 : globalBin;
+		const program = npm();
+		if (program === void 0) return void 0;
+		const result = await runNpm(program, PREFIX_ARGS, PREFIX_TIMEOUT_MS);
+		const prefix = result.code === 0 ? result.stdout.trim().split(/\r?\n/u).at(-1)?.trim() ?? "" : "";
+		globalBin = prefix === "" ? "" : platform === "win32" ? prefix : path.join(prefix, "bin");
+		return globalBin === "" ? void 0 : globalBin;
+	};
+	const locate = async () => {
+		const found = locateClaudeBinary({
+			explicit: configured(),
+			...locateOptions()
+		});
+		if (found !== void 0 || configured() !== "") return found;
+		const bin = await npmGlobalBin();
+		if (bin === void 0) return void 0;
+		return claudeFileNames(platform).map((name) => path.join(bin, name)).find((candidate) => exists(candidate));
+	};
+	const probe = async () => {
+		const found = await locate();
+		if (found === void 0) return configured() === "" ? { installed: false } : {
+			installed: false,
+			configuredPath: configured()
+		};
+		let command;
+		try {
+			command = resolveSpawnCommand(found, {
+				platform,
+				exists,
+				readFile
+			});
+		} catch (error) {
+			return {
+				installed: true,
+				path: found,
+				error: error.message
+			};
+		}
+		const result = await runCaptured(spawnImpl, command.command, [...command.args, "--version"], { env: {
+			...withProgramDirOnPath(env, found, platform),
+			CLAUDE_CONFIG_DIR: configDir,
+			DISABLE_AUTOUPDATER: "1",
+			DISABLE_TELEMETRY: "1",
+			CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
+		} }, VERSION_TIMEOUT_MS);
+		const version = result.code === 0 ? parseClaudeVersion(result.stdout) : void 0;
+		if (version !== void 0) return {
+			installed: true,
+			path: found,
+			version
+		};
+		return {
+			installed: true,
+			path: found,
+			error: detailOf(result.error?.message, result.stderr, result.stdout) || `exited with code ${result.code ?? "unknown"}`
+		};
+	};
+	let detection;
+	let detecting;
+	const detect = async ({ force = false } = {}) => {
+		if (!force && detection !== void 0 && now() - detection.checkedAt < DETECTION_TTL_MS) return detection;
+		if (detecting !== void 0) return detecting;
+		detecting = probe().catch((error) => ({
+			installed: false,
+			error: error instanceof Error ? error.message : String(error)
+		})).then((value) => {
+			detection = {
+				...value,
+				checkedAt: now()
+			};
+			return detection;
+		}).finally(() => {
+			detecting = void 0;
+		});
+		return detecting;
+	};
+	let installation = { state: "idle" };
+	let installing;
+	const install = () => {
+		if (installing !== void 0) return installation;
+		const program = npm();
+		if (program === void 0) {
+			installation = {
+				state: "failed",
+				code: "npm-missing",
+				finishedAt: now()
+			};
+			return installation;
+		}
+		installation = {
+			state: "running",
+			startedAt: now(),
+			npm: program
+		};
+		installing = runNpm(program, INSTALL_ARGS, INSTALL_TIMEOUT_MS).then(async (result) => {
+			globalBin = void 0;
+			if (result.code !== 0) {
+				installation = {
+					state: "failed",
+					...explainNpmFailure(result),
+					finishedAt: now()
+				};
+				await detect({ force: true });
+				return;
+			}
+			const found = await detect({ force: true });
+			installation = found.installed && found.version !== void 0 ? {
+				state: "succeeded",
+				finishedAt: now()
+			} : {
+				state: "failed",
+				code: "not-found-after-install",
+				detail: detailOf(result.stdout, result.stderr),
+				finishedAt: now()
+			};
+		}).catch((error) => {
+			installation = {
+				state: "failed",
+				code: "failed",
+				detail: error instanceof Error ? error.message : String(error),
+				finishedAt: now()
+			};
+		}).finally(() => {
+			installing = void 0;
+		});
+		return installation;
+	};
+	return Object.freeze({
+		/**
+		* The CLI the runner should start: the last detected one while it still
+		* exists, otherwise a fresh lookup — so a CLI installed after startup,
+		* from the panel or a terminal, is used without restarting.
+		*/
+		async binary() {
+			if (detection?.path !== void 0 && exists(detection.path)) return detection.path;
+			return await locate() ?? (configured() === "" ? "claude" : configured());
+		},
+		detect,
+		/** The last detection, without probing again; undefined before the first. */
+		lastDetection: () => detection === void 0 ? void 0 : { ...detection },
+		install,
+		/** Wait for an install in flight; for tests and scripts. */
+		settled: () => installing ?? Promise.resolve(),
+		/**
+		* What the settings panel shows. While an install runs, the last detection
+		* stands instead of probing a half-written package.
+		*/
+		async status({ force = false } = {}) {
+			const value = installing === void 0 ? await detect({ force }) : detection;
+			return {
+				installed: value?.installed === true,
+				...value?.version === void 0 ? {} : { version: value.version },
+				...value?.path === void 0 ? {} : { path: value.path },
+				...value?.configuredPath === void 0 ? {} : { configuredPath: value.configuredPath },
+				...value?.error === void 0 ? {} : { error: value.error },
+				...value?.checkedAt === void 0 ? {} : { checkedAt: value.checkedAt },
+				platform,
+				command: CLAUDE_INSTALL_COMMAND,
+				install: { ...installation }
+			};
+		}
+	});
+}
+//#endregion
+//#region src/claude-mcp-bridge.js
+/**
+* The MCP server through which the Claude Code CLI sees DSH's tools.
+*
+* The CLI runs with its own tools disabled. Each tool the DSH request offers
+* is listed here instead, so the CLI's request carries DSH's exact names,
+* descriptions and schemas (under the `mcp__dsh__` prefix). A call the model
+* makes is never executed here: DSH executes it — with its own permissions,
+* sandbox, plan-mode gate and UI — and the result it sends on the next step
+* answers the call the CLI is holding open.
+*
+* One server per CLI process: a stateless, JSON-response Streamable HTTP
+* endpoint bound to 127.0.0.1, guarded by a random capability that only the
+* owner-only config file carries. No API key or user data crosses it.
+*
+* @module dsh-packycode-api/claude-mcp-bridge
+*/
+/** The MCP server name; the CLI exposes its tools as `mcp__dsh__<name>`. */
+const MCP_SERVER_NAME = "dsh";
+const MCP_TOOL_PREFIX = `mcp__dsh__`;
+/** Tool arguments can carry whole files; bound them, but generously. */
+const MAX_BODY_BYTES = 64 * 1024 * 1024;
+const PROTOCOL_VERSIONS = Object.freeze([
+	"2025-11-25",
+	"2025-06-18",
+	"2025-03-26",
+	"2024-11-05"
+]);
+const record$3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const validId = (value) => typeof value === "string" && value.length <= 256 || typeof value === "number" && Number.isSafeInteger(value);
+var RpcError = class extends Error {
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+	}
+};
+/** An Anthropic tool_result block as an MCP CallToolResult. */
+function toolResultToMcp(block) {
+	const parts = typeof block?.content === "string" ? [{
+		type: "text",
+		text: block.content
+	}] : Array.isArray(block?.content) ? block.content : [];
+	const content = [];
+	for (const part of parts) if (part?.type === "text" && typeof part.text === "string") content.push({
+		type: "text",
+		text: part.text
+	});
+	else if (part?.type === "image" && part.source?.type === "base64") content.push({
+		type: "image",
+		data: part.source.data,
+		mimeType: part.source.media_type
+	});
+	else if (part !== void 0) content.push({
+		type: "text",
+		text: JSON.stringify(part)
+	});
+	return {
+		content,
+		...block?.is_error === true ? { isError: true } : {}
+	};
+}
+/**
+* Start a bridge.
+* @param options - the tools to list (Anthropic tool definitions whose names
+*   carry the `mcp__dsh__` prefix), and the call sink: `onCall({ toolUseId,
+*   name, arguments })` returns a promise of the MCP result; `toolUseId` is
+*   undefined when the CLI does not send it.
+* @returns `{ url, authorization, setTools, close }`.
+*/
+async function startClaudeMcpBridge({ tools = [], onCall, version = "1.0.0", serverFactory = createServer } = {}) {
+	if (typeof onCall !== "function") throw new Error("the Claude MCP bridge needs a call sink");
+	const capability = Buffer.from(`Bearer ${randomBytes(32).toString("hex")}`);
+	let listed = [];
+	const setTools = (next) => {
+		listed = (Array.isArray(next) ? next : []).filter((tool) => typeof tool?.name === "string" && tool.name.startsWith(MCP_TOOL_PREFIX) && record$3(tool.input_schema)).map((tool) => ({
+			name: tool.name.slice(MCP_TOOL_PREFIX.length),
+			description: typeof tool.description === "string" ? tool.description : "",
+			inputSchema: tool.input_schema
+		}));
+	};
+	setTools(tools);
+	let closed = false;
+	let origin;
+	const reply = (res, status, value) => {
+		if (res.destroyed || res.writableEnded) return;
+		res.writeHead(status, {
+			"Content-Type": "application/json",
+			"Cache-Control": "no-store",
+			"X-Content-Type-Options": "nosniff"
+		});
+		res.end(value === void 0 ? "" : JSON.stringify(value));
+	};
+	const authorized = (req) => {
+		const actual = Buffer.from(typeof req.headers.authorization === "string" ? req.headers.authorization : "");
+		return actual.length === capability.length && timingSafeEqual(actual, capability);
+	};
+	const dispatch = async (message) => {
+		const params = message.params;
+		switch (message.method) {
+			case "initialize": return {
+				protocolVersion: PROTOCOL_VERSIONS.includes(params?.protocolVersion) ? params.protocolVersion : PROTOCOL_VERSIONS[0],
+				capabilities: { tools: { listChanged: false } },
+				serverInfo: {
+					name: "dsh",
+					title: "DeepSeek Harness",
+					version
+				}
+			};
+			case "ping": return {};
+			case "tools/list": return { tools: listed };
+			case "tools/call": {
+				if (!record$3(params) || typeof params.name !== "string") throw new RpcError(-32602, "Invalid tool call");
+				const id = params._meta?.["claudecode/toolUseId"];
+				return onCall({
+					toolUseId: typeof id === "string" && id !== "" ? id : void 0,
+					name: params.name,
+					arguments: params.arguments
+				});
+			}
+			default: throw new RpcError(-32601, "Method not found");
+		}
+	};
+	const handle = async (req, res) => {
+		if (closed || req.headers.host !== new URL(origin).host || req.headers.origin !== void 0 && req.headers.origin !== origin) return reply(res, 403);
+		if (!authorized(req)) return reply(res, 401);
+		if (req.url !== "/mcp") return reply(res, 404);
+		if (req.method !== "POST") {
+			res.setHeader("Allow", "POST");
+			return reply(res, 405);
+		}
+		const declared = req.headers["content-length"];
+		if (declared !== void 0 && (!/^\d+$/u.test(declared) || Number(declared) > MAX_BODY_BYTES)) return reply(res, 413);
+		const chunks = [];
+		let size = 0;
+		try {
+			for await (const chunk of req.iterator({ destroyOnReturn: false })) {
+				size += chunk.length;
+				if (size > MAX_BODY_BYTES) {
+					req.resume();
+					return reply(res, 413);
+				}
+				chunks.push(chunk);
+			}
+		} catch {
+			return reply(res, 400);
+		}
+		let message;
+		try {
+			message = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+		} catch {
+			return reply(res, 400, {
+				jsonrpc: "2.0",
+				id: null,
+				error: {
+					code: -32700,
+					message: "Parse error"
+				}
+			});
+		}
+		if (!record$3(message) || message.jsonrpc !== "2.0" || typeof message.method !== "string" || Object.hasOwn(message, "id") && !validId(message.id)) {
+			if (record$3(message) && message.jsonrpc === "2.0" && message.method === void 0) return reply(res, 202);
+			return reply(res, 400, {
+				jsonrpc: "2.0",
+				id: null,
+				error: {
+					code: -32600,
+					message: "Invalid request"
+				}
+			});
+		}
+		if (!Object.hasOwn(message, "id")) return reply(res, 202);
+		try {
+			const result = await dispatch(message);
+			reply(res, 200, {
+				jsonrpc: "2.0",
+				id: message.id,
+				result
+			});
+		} catch (error) {
+			reply(res, 200, {
+				jsonrpc: "2.0",
+				id: message.id,
+				error: {
+					code: error instanceof RpcError ? error.code : -32603,
+					message: error instanceof RpcError ? error.message : "Internal error"
+				}
+			});
+		}
+	};
+	const server = serverFactory((req, res) => {
+		handle(req, res).catch(() => reply(res, 500));
+	});
+	server.requestTimeout = 0;
+	server.headersTimeout = 6e4;
+	server.maxConnections = 32;
+	server.on("clientError", (_error, socket) => socket.destroy());
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(0, "127.0.0.1", () => {
+			server.off("error", reject);
+			resolve();
+		});
+	});
+	server.unref();
+	origin = `http://127.0.0.1:${server.address().port}`;
+	let closing;
+	return {
+		url: `${origin}/mcp`,
+		authorization: capability.toString(),
+		setTools,
+		close() {
+			if (closing !== void 0) return closing;
+			closed = true;
+			closing = new Promise((resolve) => server.close(() => resolve()));
+			server.closeAllConnections();
+			return closing;
+		}
+	};
+}
+//#endregion
+//#region src/failures.js
+/**
+* Failure classification for the two conditions that move the key ring along.
+*
+* The gateway reports an exhausted key and a rejected key in Chinese, and the
+* harness classifies failures by fixed English/status wording it recognizes
+* (`isQuotaExceededError`, `\b401\b`). Normalizing here is what makes the
+* harness's retry policy re-run the step — and therefore what lets the retry
+* pick up the next key. Rewriting is honest about what happened: this plugin
+* knows the key's condition from the gateway's own words plus its balance
+* reader, so the sentence it substitutes says no more than that.
+*
+* @module dsh-packycode-api/failures
+*/
+/** Terminal quota, balance, or credit wording, in the gateway's own languages. */
+const QUOTA_WORDING = /额度|余额|配额|欠费|insufficient[\s_-]+(?:quota|balance|credits?)|quota[\s_-]+(?:exceeded|exhausted|reached)|out[\s_-]+of[\s_-]+(?:credits?|budget)/iu;
+/** A rejected key names itself; a bare 403 does not, and must not disable one. */
+const INVALID_KEY_WORDING = /无效的令牌|令牌无效|无效密钥|密钥无效|invalid[\s_-]+api[\s_-]*key|invalid_authentication|api key is invalid/iu;
+const INVALID_KEY_STATUS = /\b401\b/;
+/**
+* A gateway group that only serves its vendor's official client. These arrive
+* as 403, which the harness reads as an authentication failure and renders as
+* an invalid-API-key problem — the opposite of what happened. This wording
+* also covers intermittent client-anomaly refusals; it does not establish
+* whether a future request will be accepted.
+*/
+const CLIENT_POLICY_WORDING = /only accessible via the official|only accepts requests from the official|official\s+claude(?:\s+code)?\s+cli|官方\s*claude(?:\s*code)?\s*cli|请使用标准\s*codex\s*客户端|客户端存在异常|二次分发|API\s*转接/iu;
+/** A content-policy refusal observed on an already-authorized request. */
+const TEST_MESSAGE_POLICY_CODE = "GATEWAY_TEST_MESSAGE";
+const TEST_MESSAGE_PREFIX = `[${TEST_MESSAGE_POLICY_CODE}]`;
+/** Match the captured refusal narrowly; a bare 403 is still not evidence. */
+function classifyTestMessagePolicy(message) {
+	if (typeof message !== "string") return false;
+	return message.startsWith(TEST_MESSAGE_PREFIX) || /already connected and authorized/iu.test(message) && /no need to send test messages/iu.test(message) && /verify the connection/iu.test(message);
+}
+/** Keep the host's status-word classifier from turning this into AUTH. */
+function explainTestMessagePolicyFailure() {
+	return `${TEST_MESSAGE_PREFIX} PackyCode 将这次请求识别为连通性测试并拒绝。请使用实际业务内容；本次拒绝不表示 Key 失效，也不会禁用或切换 Key。`;
+}
+/**
+* The gateway's answer when a key's groups do not include the model's
+* supplier: `model_not_found` / 当前令牌未覆盖供应商. The key is fine for other
+* models, so it is never moved aside for this.
+*/
+const COVERAGE_WORDING = /model_not_found|未覆盖供应商|无可用渠道|no available channel/iu;
+/**
+* Whether the gateway refused the model for this key's groups.
+* @param message - the failure text.
+* @returns true for a group-coverage refusal.
+*/
+function classifyCoverage(message) {
+	return COVERAGE_WORDING.test(typeof message === "string" ? message : "");
+}
+/** The key's quota is exhausted; move to the next key. */
+const QUOTA_FAILURE = "quota";
+/** The gateway rejected the key itself; move to the next key. */
+const INVALID_KEY_FAILURE = "invalid-key";
+/**
+* Whether the gateway is refusing this client rather than this credential.
+* @param message - provider failure text, as pi-ai carries it.
+* @returns true when the route is gated to a vendor's official client.
+*/
+function classifyClientPolicy(message) {
+	return CLIENT_POLICY_WORDING.test(typeof message === "string" ? message : "");
+}
+/**
+* OpenAI's generic transient failure: the sentence its `server_error` carries,
+* or the `server_error:` prefix pi-ai writes when the event names the code.
+* The gateway can relay it inside a stream it has already answered 200 for —
+* an SSE `error` event with a 503 `server_error`, then `response.failed` — so
+* no HTTP status comes with it.
+*/
+const UPSTREAM_SERVER_ERROR = /an error occurred while processing your request\b[\s\S]*\bhelp\.openai\.com\b|^(?:error code\s+)?server_error:/iu;
+/**
+* Whether a failure is the upstream's transient server error, which a resent
+* request clears. The key is not at fault.
+* @param message - provider failure text, as pi-ai carries it.
+* @returns true for OpenAI's generic `server_error`.
+*/
+function classifyUpstreamServerError(message) {
+	return UPSTREAM_SERVER_ERROR.test(typeof message === "string" ? message : "");
+}
+/**
+* Classify a gateway failure message.
+*
+* Quota wording wins over a status token: an exhausted balance is often
+* reported as 402/403, and only the key's own rejection may read as 401. A
+* client-policy refusal is not a key fault and is classified separately.
+* @param message - provider failure text, as pi-ai carries it.
+* @returns the failure kind, or undefined when the key is not at fault.
+*/
+function classifyGatewayFailure(message) {
+	const text = typeof message === "string" ? message : "";
+	if (text === "") return void 0;
+	if (classifyClientPolicy(text) || classifyTestMessagePolicy(text)) return void 0;
+	if (QUOTA_WORDING.test(text)) return QUOTA_FAILURE;
+	if (INVALID_KEY_WORDING.test(text)) return INVALID_KEY_FAILURE;
+	if (INVALID_KEY_STATUS.test(text)) return INVALID_KEY_FAILURE;
+}
+/**
+* Rewrite a failure message so the harness classifies it as quota or auth.
+*
+* A bare status token is neutralized first: an exhausted balance arrives as
+* 402 or 403 on some gateway routes, and the harness's auth rule matches
+* 401/403 before it reads any wording, which would send the failure into a
+* category the retry policy does not re-run.
+* @param message - the original provider failure text.
+* @param kind - the classification of {@link classifyGatewayFailure}.
+* @returns text the harness routes to QUOTA or AUTH.
+*/
+/**
+* Explain a client-policy refusal so the user reads the real cause.
+*
+* The sentence must not read as any other failure the harness knows: it
+* deliberately carries no HTTP status and none of the words the classifier
+* matches for auth, quota, rate limits, timeouts, or transport faults. That
+* keeps the failure out of the host's generic retry policy and lets the
+* sentence reach the user verbatim, in
+* place of the "API key is invalid" the bare 403 would have produced.
+* @param keyName - the account name the balance reader saw, when known.
+* @returns the replacement sentence.
+*/
+function explainClientPolicyFailure() {
+	return "PackyCode 拒绝了这个客户端：所选分组只允许厂商官方客户端调用（Claude 分组要求官方 Claude CLI，Codex 分组要求标准 Codex 客户端）。这不是 API Key 失效。请检查当前分组的客户端要求；若调整分组，应先在模型广场确认该模型可用。 / This group only serves the vendor’s official client; the API key is fine.";
+}
+/** Prefix of every failure the Claude Code CLI transport relays from the gateway. */
+const CLI_MARK = "[Claude Code CLI]";
+/** The CLI could not be found or started; the transport's error type says so. */
+const CLI_UNAVAILABLE = "dsh_cli_unavailable";
+/** The installed CLI refused an option the transport needs. */
+const CLI_OUTDATED = "dsh_cli_outdated";
+/**
+* The message a relayed failure carried. pi-ai reports an HTTP error as its
+* status followed by the JSON body; the gateway's or CLI's own sentence is
+* that body's `error.message`.
+*/
+function relayedMessage(message) {
+	const text = typeof message === "string" ? message : "";
+	const start = text.indexOf("{");
+	if (start >= 0) try {
+		const body = JSON.parse(text.slice(start));
+		const inner = body?.error?.message ?? body?.message;
+		if (typeof inner === "string") return inner;
+	} catch {}
+	return text;
+}
+/** Whether a failure says the Claude Code CLI is missing. */
+const classifyCliUnavailable = (message) => typeof message === "string" && message.includes("dsh_cli_unavailable");
+/** Whether a failure says the Claude Code CLI is too old for this plugin. */
+const classifyCliOutdated = (message) => typeof message === "string" && message.includes("dsh_cli_outdated");
+/**
+* Explain a missing CLI. Like every explanation here it carries no status
+* token and no transport wording, so DSH shows it once instead of retrying a
+* request that cannot start.
+* @returns the replacement sentence.
+*/
+function explainCliUnavailable(message) {
+	const detail = relayedMessage(message).replace(/^[\s\S]*?dsh_cli_unavailable:?\s*/u, "").replace(/\b\d{3}\b/gu, "").replace(/\b(?:network|connection|socket|fetch|timed?\s*out|timeout|terminated)\b/giu, "…").trim().slice(0, 300);
+	return "本机没有可用的 Claude Code CLI，而当前 Key 所在的 Claude 分组（cc）只接受官方 Claude Code 客户端。请在 设置 → PackyCode → Claude Code CLI 一键安装，或在终端执行 npm install -g @anthropic-ai/claude-code，然后重发这条消息。也可以改用 cc-sale / cc-expensive 分组的 Key，它们走插件内置的 HTTP 通道。" + (detail === "" || detail === "dsh_cli_unavailable" ? "" : `（启动失败：${detail}）`) + " / Claude Code CLI is not available, and this key's Claude group only serves the official client. Install it under Settings → PackyCode (npm install -g @anthropic-ai/claude-code), then resend.";
+}
+/**
+* Explain a CLI that is too old for the options this plugin passes.
+* @param message - the CLI's own complaint.
+* @returns the replacement sentence.
+*/
+function explainCliOutdated(message) {
+	return `本机的 Claude Code CLI 版本过旧，不支持插件所需的参数。请在终端执行 claude update，或 npm install -g @anthropic-ai/claude-code@latest 更新后重发。 / The installed Claude Code CLI is too old for this plugin; update it (claude update). CLI said: ${relayedMessage(message).replace(/^[\s\S]*?dsh_cli_outdated:?\s*/u, "").replace(/\b\d{3}\b/gu, "").slice(0, 300)}`;
+}
+/**
+* Explain a client-policy refusal of a request the official CLI itself sent.
+* The HTTP route's advice (use the official client) does not apply; the
+* gateway's words are kept, without their status, for a support request.
+* @param message - the relayed failure text.
+* @returns the replacement sentence.
+*/
+function explainCliClientPolicyFailure(message) {
+	return `PackyCode 拒绝了这次由官方 Claude Code CLI 发出的请求，认为客户端异常。这不是 API Key 失效。请先把 Claude Code CLI 更新到最新版本（claude update）再试；仍然失败时，请把下面的原始错误（含 request id）发给 PackyCode 客服。 / The gateway refused a request the official Claude Code CLI sent; the API key is fine. Gateway said: ${relayedMessage(message).replace(/^[\s\S]*?\[Claude Code CLI\]\s*/u, "").replace(/\b(?:401|403)\b/gu, "HTTP").slice(0, 600)}`;
+}
+/**
+* Rewrite a failure message so the harness classifies it as quota or auth.
+*
+* A bare status token is neutralized first: an exhausted balance arrives as
+* 402 or 403 on some gateway routes, and the harness's auth rule matches
+* 401/403 before it reads any wording, which would send the failure into a
+* category the retry policy does not re-run.
+* @param message - the original provider failure text.
+* @param kind - the classification of {@link classifyGatewayFailure}.
+* @param options - optional account name for the policy explanation.
+* @returns text the harness routes to QUOTA or AUTH, or a policy explanation.
+*/
+function normalizeFailureMessage(message, kind, options = {}) {
+	const text = typeof message === "string" && message.length > 0 ? message : "PackyCode request failed";
+	if (kind === "client-policy") return explainClientPolicyFailure(options.keyName);
+	if (kind === "quota") return `${neutralizeAuthStatus(text)} — PackyCode: insufficient quota for this API key; trying the next key`;
+	if (kind === "invalid-key") return `${neutralizeAuthStatus(text)} — PackyCode: 401 invalid_authentication for this API key; trying the next key`;
+	return text;
+}
+function neutralizeAuthStatus(text) {
+	return text.replace(/\b(?:401|403)\b/gu, "HTTP");
+}
+//#endregion
+//#region src/claude-transcript.js
+/**
+* Hand DSH's conversation to the Claude Code CLI.
+*
+* The CLI resumes a conversation from a JSONL transcript (`--resume <file>`)
+* and sends exactly those messages — text, images, signed thinking, tool calls
+* and results — before the new input. DSH's history, already converted to the
+* Anthropic Messages shape by the native route, is written in the CLI's
+* classic transcript format, so the CLI's request carries the same history the
+* HTTP route would have sent. Request-level cache markers are dropped: the CLI
+* places its own.
+*
+* @module dsh-packycode-api/claude-transcript
+*/
+const record$2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+/** A copy without `cache_control` anywhere in the block tree. */
+function withoutCacheControl(value) {
+	if (Array.isArray(value)) return value.map(withoutCacheControl);
+	if (!record$2(value)) return value;
+	const copy = {};
+	for (const [key, item] of Object.entries(value)) if (key !== "cache_control") copy[key] = withoutCacheControl(item);
+	return copy;
+}
+/** Content as a block array. */
+const contentBlocks = (content) => typeof content === "string" ? content === "" ? [] : [{
+	type: "text",
+	text: content
+}] : Array.isArray(content) ? content : [];
+/**
+* One message in a canonical shape, for comparing requests: pi-ai sends the
+* newest message as blocks with a cache marker and the same message as a
+* plain string once it is older, and tool results either way.
+*/
+function canonicalMessage(message) {
+	const canonical = (block) => block?.type === "tool_result" ? {
+		...block,
+		content: contentBlocks(block.content)
+	} : block;
+	return {
+		role: message?.role,
+		content: contentBlocks(withoutCacheControl(message?.content)).map(canonical)
+	};
+}
+/** Whether a message carries tool results, i.e. continues an open turn. */
+const hasToolResult = (message) => message?.role === "user" && contentBlocks(message.content).some((block) => block?.type === "tool_result");
+/** The tool_use ids an assistant message asked for, in order. */
+const toolUseIds = (message) => message?.role === "assistant" ? contentBlocks(message.content).filter((block) => block?.type === "tool_use").map((block) => block.id) : [];
+/** Merge consecutive messages of the same role; the CLI expects alternation. */
+function alternate(messages) {
+	const merged = [];
+	for (const message of messages) {
+		const previous = merged.at(-1);
+		if (previous !== void 0 && previous.role === message.role) merged[merged.length - 1] = {
+			role: message.role,
+			content: [...contentBlocks(previous.content), ...contentBlocks(message.content)]
+		};
+		else merged.push({
+			role: message.role,
+			content: contentBlocks(message.content)
+		});
+	}
+	return merged;
+}
+/**
+* Split a request into what the CLI resumes and what it receives as input.
+*
+* - At a turn boundary, trailing user messages are the new input: they go to
+*   the CLI's stdin as one message, after the resumed history.
+* - Inside a turn (the newest message carries tool results, possibly with a
+*   steering note), everything is resumed and the CLI continues the open turn.
+*   Feeding the note over stdin instead would make the CLI close the turn with
+*   a synthetic reply first.
+* @param messages - the request's Anthropic messages.
+* @returns `{ history, input, continues }`; `input` is a content array or
+*   undefined, `continues` is true for an open turn.
+*/
+function splitConversation(messages) {
+	const clean = alternate(withoutCacheControl(Array.isArray(messages) ? messages : []));
+	const last = clean.at(-1);
+	if (last === void 0) return {
+		history: [],
+		input: void 0,
+		continues: false
+	};
+	if (last.role !== "user") throw new Error("Claude Code CLI cannot continue a conversation that ends with an assistant message");
+	if (hasToolResult(last)) return {
+		history: clean,
+		input: void 0,
+		continues: true
+	};
+	return {
+		history: clean.slice(0, -1),
+		input: last.content,
+		continues: false
+	};
+}
+/**
+* Serialize history as a CLI transcript.
+* @param history - alternating Anthropic messages, oldest first.
+* @param options - the CLI session id, working directory, model, and the CLI
+*   version string recorded in each entry.
+* @returns JSONL text, one entry per message.
+*/
+function buildTranscript(history, { sessionId, cwd, model, version = "0.0.0", now = Date.now } = {}) {
+	const start = now() - history.length * 1e3;
+	let parentUuid = null;
+	const lines = history.map((message, index) => {
+		const uuid = randomUUID();
+		const content = contentBlocks(message.content);
+		const entry = {
+			parentUuid,
+			isSidechain: false,
+			userType: "external",
+			cwd,
+			sessionId,
+			version,
+			type: message.role,
+			message: message.role === "assistant" ? {
+				id: `msg_dsh_${uuid.replaceAll("-", "")}`,
+				type: "message",
+				role: "assistant",
+				model,
+				content,
+				stop_reason: content.some((block) => block?.type === "tool_use") ? "tool_use" : "end_turn",
+				stop_sequence: null,
+				usage: {
+					input_tokens: 0,
+					output_tokens: 0
+				}
+			} : {
+				role: "user",
+				content
+			},
+			uuid,
+			timestamp: new Date(start + index * 1e3).toISOString()
+		};
+		parentUuid = uuid;
+		return JSON.stringify(entry);
+	});
+	return lines.length === 0 ? "" : `${lines.join("\n")}\n`;
+}
+//#endregion
+//#region src/claude-cli-session.js
+/**
+* One Claude Code CLI process serving one DSH conversation.
+*
+* The CLI is the transport, not the agent. It runs with its own tools
+* disabled, DSH's system prompt appended to its own, and DSH's tools listed
+* through the MCP bridge. Each DSH model step is one API request the CLI
+* makes; its raw stream events are replayed to the native Messages client as
+* the HTTP response of that step, frame for frame what the gateway streamed.
+* When the model calls tools, the CLI waits on the bridge while DSH executes
+* them; the next step's tool results answer those calls and the same process
+* continues, so its requests keep one growing, cacheable prefix. Between
+* turns the process waits for the next user message on stdin.
+*
+* A process that cannot continue a request (another history, prompt, tool set
+* or key) is replaced by one resumed from DSH's history; see the transport.
+*
+* @module dsh-packycode-api/claude-cli-session
+*/
+/** The CLI wrote nothing for this long after starting: it is stuck before its first request. */
+const CLI_STARTUP_TIMEOUT_MS = 9e4;
+const KILL_GRACE_MS = 3e3;
+const MAX_LINE_CHARS = 64 * 1024 * 1024;
+/** The project-directory name the CLI's own files go under in its isolated home. */
+const CLI_PROJECT_DIR_NAME = "dsh-packycode";
+/** A held tool call's answer when the process is torn down first. */
+const DISPOSED_RESULT = Object.freeze({
+	isError: true,
+	content: [{
+		type: "text",
+		text: "DSH replaced this Claude Code CLI process before the tool result arrived."
+	}]
+});
+const ERROR_TYPES = Object.freeze({
+	400: "invalid_request_error",
+	401: "authentication_error",
+	403: "permission_error",
+	404: "not_found_error",
+	413: "request_too_large",
+	429: "rate_limit_error",
+	500: "api_error",
+	529: "overloaded_error"
+});
+/**
+* CLI arguments for one process. DSH's tools reach the model through the
+* bridge; the CLI's own tools, settings files, slash commands and session
+* persistence are off, and its system prompt gets DSH's appended.
+* @param options - model, effort, private file paths, and either the
+*   transcript to resume or the fresh session id.
+* @returns argv after the binary.
+*/
+function buildCliArgs({ model, effort, systemFile, mcpConfigFile, transcriptFile, sessionId }) {
+	return [
+		"-p",
+		"--input-format",
+		"stream-json",
+		"--output-format",
+		"stream-json",
+		"--verbose",
+		"--include-partial-messages",
+		"--model",
+		model,
+		...typeof effort === "string" && effort !== "" ? ["--effort", effort] : [],
+		"--tools",
+		"",
+		"--strict-mcp-config",
+		"--mcp-config",
+		mcpConfigFile,
+		"--allowedTools",
+		`mcp__dsh`,
+		"--permission-prompts",
+		"none",
+		"--setting-sources",
+		"",
+		"--disable-slash-commands",
+		"--no-session-persistence",
+		"--append-system-prompt-file",
+		systemFile,
+		...typeof transcriptFile === "string" ? ["--resume", transcriptFile] : ["--session-id", sessionId]
+	];
+}
+/**
+* The child's environment: the request's endpoint and key, an isolated CLI
+* home, retries and fallbacks handed back to DSH, and nothing inherited that
+* would authenticate another account or redirect the request.
+* @param options - endpoint, key, CLI home, output cap, whether the open turn
+*   is continued, and the parent environment.
+* @returns the environment for the child process.
+*/
+function buildCliEnvironment({ baseUrl, apiKey, configDir, maxTokens, continues = false, parent = process.env }) {
+	if (typeof apiKey !== "string" || apiKey === "") throw new Error("Claude Code CLI has no PackyCode API key to run with");
+	const env = {};
+	for (const [name, value] of Object.entries(parent ?? {})) {
+		if (/^(?:ANTHROPIC_|CLAUDE_|CLAUDECODE|AWS_BEARER_TOKEN_BEDROCK|MCP_|MAX_MCP_|DISABLE_|ENABLE_)/iu.test(name)) continue;
+		if (value !== void 0) env[name] = value;
+	}
+	return {
+		...env,
+		ANTHROPIC_BASE_URL: baseUrl,
+		ANTHROPIC_AUTH_TOKEN: apiKey,
+		CLAUDE_CONFIG_DIR: configDir,
+		CLAUDE_CODE_PROJECT_DIR_NAME: CLI_PROJECT_DIR_NAME,
+		DISABLE_AUTOUPDATER: "1",
+		DISABLE_TELEMETRY: "1",
+		DISABLE_ERROR_REPORTING: "1",
+		DISABLE_BUG_COMMAND: "1",
+		CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
+		CLAUDE_CODE_MAX_RETRIES: "0",
+		CLAUDE_CODE_DISABLE_NONSTREAMING_FALLBACK: "1",
+		CLAUDE_CODE_DISABLE_REFUSAL_FALLBACK: "1",
+		CLAUDE_CODE_DISABLE_MODEL_ACCESS_FALLBACK: "1",
+		CLAUDE_CODE_NO_MODEL_FALLBACK: "1",
+		CLAUDE_CODE_DISABLE_AUTO_MEMORY: "1",
+		CLAUDE_CODE_DISABLE_CLAUDE_MDS: "1",
+		DISABLE_AUTO_COMPACT: "1",
+		DISABLE_COMPACT: "1",
+		CLAUDE_CODE_DISABLE_FILE_CHECKPOINTING: "1",
+		CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1",
+		CLAUDE_CODE_DISABLE_TERMINAL_TITLE: "1",
+		CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT: "0",
+		CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS: "0",
+		MCP_TOOL_TIMEOUT: "86400000",
+		MAX_MCP_OUTPUT_TOKENS: "1000000",
+		...Number.isSafeInteger(maxTokens) && maxTokens > 0 ? { CLAUDE_CODE_MAX_OUTPUT_TOKENS: String(maxTokens) } : {},
+		...continues ? { CLAUDE_CODE_RESUME_INTERRUPTED_TURN: "1" } : {}
+	};
+}
+/** The gateway message inside the CLI's "API Error: …" result text. */
+function cliErrorMessage(text) {
+	const value = typeof text === "string" ? text.trim() : "";
+	return (/API Error:\s*(?:Request rejected\s*\(\d{3}\)\s*·?\s*|\d{3}\s+)?([\s\S]*)$/u.exec(value)?.[1] ?? value).trim() || value;
+}
+/** An HTTP error response carrying the gateway's own words. */
+function errorResponse(status, message, type) {
+	const code = Number.isInteger(status) && status >= 400 && status <= 599 ? status : 502;
+	return new Response(JSON.stringify({
+		type: "error",
+		error: {
+			type: type ?? ERROR_TYPES[code] ?? "api_error",
+			message
+		}
+	}), {
+		status: code,
+		headers: { "content-type": "application/json" }
+	});
+}
+const sseFrame = (event) => `event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`;
+const encoder = new TextEncoder();
+/**
+* Start a process.
+* @param options - the binary resolver, CLI home, private run directory,
+*   endpoint and key, the request (model, effort, system text, tools, max
+*   tokens), the conversation split (history to resume, input, open-turn
+*   flag), cwd, the CLI session id, the version recorded in the transcript,
+*   and process seams.
+* @returns the session; call `respond()` for each step it serves.
+*/
+async function startClaudeCliSession({ binary, configDir, runDirectory, baseUrl, apiKey, request, conversation, cwd, sessionId, cliVersion, oneShot = false, platform = process.platform, parentEnv = process.env, spawnImpl = spawn, startupTimeoutMs = CLI_STARTUP_TIMEOUT_MS, logger }) {
+	await mkdir(runDirectory, {
+		recursive: true,
+		mode: 448
+	});
+	/** Calls the CLI is holding open, by tool_use id. */
+	const held = /* @__PURE__ */ new Map();
+	/** DSH's results for the calls of the last response. */
+	const answers = /* @__PURE__ */ new Map();
+	/** The tool_use ids and names of the last response, in order. */
+	let pending = [];
+	let bridge;
+	let child;
+	let state = "starting";
+	let step;
+	let disposing;
+	let stderr = "";
+	let startupTimer;
+	let apiError;
+	let sawOutput = false;
+	let version;
+	const disposed = () => disposing !== void 0;
+	const onCall = ({ toolUseId, name }) => {
+		if (disposed()) return Promise.resolve(DISPOSED_RESULT);
+		const id = toolUseId ?? pending.find((entry) => entry.name === name && !held.has(entry.id) && !entry.served)?.id;
+		const entry = pending.find((candidate) => candidate.id === id);
+		if (entry !== void 0) entry.served = true;
+		if (answers.has(id)) return Promise.resolve(answers.get(id));
+		return new Promise((resolve) => {
+			held.set(id, resolve);
+		});
+	};
+	const release = (entry) => {
+		entry.done = true;
+		entry.signal?.removeEventListener("abort", entry.onAbort);
+		if (step === entry) step = void 0;
+	};
+	/** Fail the step that is waiting or streaming. */
+	const failStep = (error, { status, message } = {}) => {
+		const entry = step;
+		if (entry === void 0 || entry.done) return;
+		release(entry);
+		if (!entry.started) {
+			if (status !== void 0) entry.resolve(errorResponse(status, message ?? error.message));
+			else entry.reject(error);
+			return;
+		}
+		try {
+			entry.controller.enqueue(encoder.encode(sseFrame({
+				type: "error",
+				error: {
+					type: ERROR_TYPES[status] ?? "api_error",
+					message: message ?? error.message
+				}
+			})));
+			entry.controller.close();
+		} catch {}
+	};
+	const dispose = (reason = "closed") => {
+		if (disposing !== void 0) return disposing;
+		state = "closed";
+		clearTimeout(startupTimer);
+		for (const resolve of held.values()) resolve(DISPOSED_RESULT);
+		held.clear();
+		failStep(/* @__PURE__ */ new Error(`Claude Code CLI process ended (${reason})`));
+		if (child !== void 0 && child.exitCode === null && child.signalCode === null) {
+			try {
+				child.stdin?.end?.();
+			} catch {}
+			try {
+				child.kill("SIGTERM");
+			} catch {}
+			const timer = setTimeout(() => {
+				try {
+					child.kill("SIGKILL");
+				} catch {}
+			}, KILL_GRACE_MS);
+			timer.unref?.();
+			child.once?.("close", () => clearTimeout(timer));
+		}
+		disposing = Promise.allSettled([bridge?.close(), rm(runDirectory, {
+			recursive: true,
+			force: true
+		})]).then(() => void 0);
+		return disposing;
+	};
+	const finishStep = () => {
+		const entry = step;
+		if (entry === void 0 || entry.done) return;
+		release(entry);
+		try {
+			entry.controller.close();
+		} catch {}
+		if (oneShot) {
+			dispose("one-shot request answered");
+			return;
+		}
+		if (entry.stopReason === "tool_use" && entry.tools.length > 0) {
+			state = "awaiting-tools";
+			pending = entry.tools;
+			answers.clear();
+		} else if (entry.stopReason === "end_turn") {
+			state = "idle";
+			pending = [];
+		} else dispose(`response ended with ${entry.stopReason ?? "no stop reason"}`);
+	};
+	const onEvent = (event) => {
+		const entry = step;
+		if (entry === void 0 || entry.done) return;
+		if (event.type === "message_start") {
+			if (entry.started) {
+				failStep(/* @__PURE__ */ new Error("second response"), {
+					status: 502,
+					message: `${CLI_MARK} began a second response within one step`
+				});
+				dispose("second response in one step");
+				return;
+			}
+			entry.started = true;
+			clearTimeout(startupTimer);
+			const body = new ReadableStream({
+				start(controller) {
+					entry.controller = controller;
+				},
+				cancel() {
+					if (!entry.done) {
+						release(entry);
+						dispose("response cancelled");
+					}
+				}
+			});
+			entry.resolve(new Response(body, {
+				status: 200,
+				headers: {
+					"content-type": "text/event-stream; charset=utf-8",
+					"cache-control": "no-cache"
+				}
+			}));
+		}
+		if (!entry.started) return;
+		if (event.type === "content_block_start" && event.content_block?.type === "tool_use") entry.tools.push({
+			id: event.content_block.id,
+			name: String(event.content_block.name ?? "").slice(MCP_TOOL_PREFIX.length)
+		});
+		if (event.type === "message_delta" && typeof event.delta?.stop_reason === "string") entry.stopReason = event.delta.stop_reason;
+		try {
+			entry.controller.enqueue(encoder.encode(sseFrame(event)));
+		} catch {}
+		if (event.type === "message_stop") finishStep();
+	};
+	const write = (frame) => {
+		try {
+			child?.stdin?.write?.(`${JSON.stringify(frame)}\n`);
+		} catch {}
+	};
+	const onLine = (line) => {
+		let message;
+		try {
+			message = JSON.parse(line);
+		} catch {
+			return;
+		}
+		if (message === null || typeof message !== "object") return;
+		if (message.type === "stream_event" && message.event !== null && typeof message.event === "object") {
+			onEvent(message.event);
+			return;
+		}
+		if (message.type === "system" && message.subtype === "init" && typeof message.claude_code_version === "string") {
+			version = message.claude_code_version;
+			return;
+		}
+		if (message.type === "control_request" && typeof message.request_id === "string") {
+			write({
+				type: "control_response",
+				response: {
+					subtype: "error",
+					request_id: message.request_id,
+					error: "DeepSeek Harness answers no Claude Code CLI prompts"
+				}
+			});
+			return;
+		}
+		if (message.type === "assistant" && typeof message.error === "string") {
+			apiError = (message.message?.content ?? []).filter((block) => block?.type === "text").map((block) => block.text).join("\n");
+			return;
+		}
+		if (message.type === "result") {
+			if (message.is_error === true || typeof message.subtype === "string" && message.subtype !== "success") {
+				const text = typeof message.result === "string" && message.result !== "" ? message.result : apiError ?? "Claude Code CLI request failed";
+				failStep(new Error(text), {
+					status: Number.isInteger(message.api_error_status) ? message.api_error_status : 502,
+					message: `${CLI_MARK} ${cliErrorMessage(text)}`
+				});
+				dispose("request failed");
+			}
+			apiError = void 0;
+		}
+	};
+	/**
+	* Serve one step: give the CLI its input, then answer with the response it
+	* streams for its next API request.
+	* @param input - `{ kind: 'start' }`, `{ kind: 'tools', results }` (tool_use
+	*   id → Anthropic tool_result block), or `{ kind: 'turn', content }`.
+	* @param signal - the step's abort signal.
+	* @returns the HTTP response of this step.
+	*/
+	const respond = (input, signal) => new Promise((resolve, reject) => {
+		if (disposed()) {
+			reject(/* @__PURE__ */ new Error("Claude Code CLI process is closed"));
+			return;
+		}
+		if (step !== void 0) {
+			reject(/* @__PURE__ */ new Error("Claude Code CLI process is already serving a step"));
+			return;
+		}
+		const entry = {
+			started: false,
+			done: false,
+			tools: [],
+			stopReason: void 0,
+			controller: void 0,
+			resolve,
+			reject,
+			signal
+		};
+		entry.onAbort = () => {
+			const error = signal.reason ?? new DOMException("This operation was aborted", "AbortError");
+			if (entry.started && !entry.done) {
+				release(entry);
+				try {
+					entry.controller.error(error);
+				} catch {}
+			} else failStep(error);
+			dispose("aborted");
+		};
+		step = entry;
+		if (signal?.aborted) {
+			entry.onAbort();
+			return;
+		}
+		signal?.addEventListener("abort", entry.onAbort, { once: true });
+		state = "streaming";
+		if (input.kind === "tools") {
+			for (const [id, block] of input.results) answers.set(id, toolResultToMcp(block));
+			for (const [id, resolveCall] of held) if (answers.has(id)) {
+				held.delete(id);
+				resolveCall(answers.get(id));
+			}
+		} else if (input.kind === "turn") write({
+			type: "user",
+			message: {
+				role: "user",
+				content: input.content
+			},
+			parent_tool_use_id: null
+		});
+		else if (conversation.input !== void 0) write({
+			type: "user",
+			message: {
+				role: "user",
+				content: conversation.input
+			},
+			parent_tool_use_id: null
+		});
+	});
+	try {
+		bridge = await startClaudeMcpBridge({
+			tools: request.tools,
+			onCall
+		});
+		const systemFile = join(runDirectory, "system-prompt.md");
+		const mcpConfigFile = join(runDirectory, "mcp.json");
+		await writeFile(systemFile, request.system, { mode: 384 });
+		await writeFile(mcpConfigFile, JSON.stringify({ mcpServers: { ["dsh"]: {
+			type: "http",
+			url: bridge.url,
+			headers: { Authorization: bridge.authorization },
+			timeout: 864e5
+		} } }), { mode: 384 });
+		let transcriptFile;
+		if (conversation.history.length > 0) {
+			transcriptFile = join(runDirectory, `${sessionId}.jsonl`);
+			await writeFile(transcriptFile, buildTranscript(conversation.history, {
+				sessionId,
+				cwd,
+				model: request.model,
+				version: cliVersion
+			}), { mode: 384 });
+		}
+		const program = await binary();
+		const command = resolveSpawnCommand(program, { platform });
+		const args = buildCliArgs({
+			model: request.model,
+			effort: request.effort,
+			systemFile,
+			mcpConfigFile,
+			transcriptFile,
+			sessionId
+		});
+		const env = withProgramDirOnPath(buildCliEnvironment({
+			baseUrl,
+			apiKey,
+			configDir,
+			maxTokens: request.maxTokens,
+			continues: conversation.continues,
+			parent: parentEnv
+		}), program, platform);
+		child = spawnImpl(command.command, [...command.args, ...args], {
+			cwd,
+			env,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			windowsHide: true
+		});
+	} catch (error) {
+		await dispose("could not start");
+		throw error;
+	}
+	let buffer = "";
+	child.stdout?.setEncoding?.("utf8");
+	child.stderr?.setEncoding?.("utf8");
+	child.stdout?.on("data", (chunk) => {
+		sawOutput = true;
+		buffer += chunk;
+		if (buffer.length > MAX_LINE_CHARS) buffer = "";
+		let index = buffer.indexOf("\n");
+		while (index !== -1) {
+			const line = buffer.slice(0, index).trim();
+			buffer = buffer.slice(index + 1);
+			if (line.startsWith("{")) onLine(line);
+			index = buffer.indexOf("\n");
+		}
+	});
+	child.stderr?.on("data", (chunk) => {
+		stderr = (stderr + String(chunk)).slice(-16384);
+	});
+	child.stdin?.on?.("error", () => void 0);
+	child.on("error", (error) => {
+		if (error?.code === "ENOENT") failStep(error, {
+			status: 400,
+			message: CLI_UNAVAILABLE
+		});
+		else failStep(error, {
+			status: 502,
+			message: `${CLI_MARK} could not run: ${error.message}`
+		});
+		dispose("could not run");
+	});
+	child.on("close", (code, killSignal) => {
+		if (!disposed()) {
+			const detail = stderr.trim().split("\n").slice(-6).join(" ").slice(0, 800);
+			const outdated = /unknown option|unrecognized option|error: option|invalid choice/iu.test(detail);
+			failStep(new Error(detail), {
+				status: outdated ? 400 : 502,
+				message: outdated ? `${CLI_OUTDATED}: ${detail}` : `${CLI_MARK} exited with ${code ?? killSignal}${detail === "" ? "" : `: ${detail}`}`
+			});
+			logger?.warn?.("packycode-api: Claude Code CLI exited (%s)", code ?? killSignal);
+		}
+		dispose("exited");
+	});
+	startupTimer = setTimeout(() => {
+		if (sawOutput || disposed()) return;
+		failStep(/* @__PURE__ */ new Error("silent"), {
+			status: 504,
+			message: `${CLI_MARK} printed nothing within ${Math.round(startupTimeoutMs / 1e3)}s of starting`
+		});
+		dispose("startup timeout");
+	}, startupTimeoutMs);
+	startupTimer.unref?.();
+	return {
+		/** `starting`, `streaming`, `awaiting-tools`, `idle` or `closed`. */
+		get state() {
+			return state;
+		},
+		/** The tool_use ids the CLI is waiting on, in order. */
+		get pendingToolIds() {
+			return pending.map((entry) => entry.id);
+		},
+		get closed() {
+			return disposed();
+		},
+		/** The CLI version the process announced, once it has. */
+		get version() {
+			return version;
+		},
+		respond,
+		dispose
+	};
+}
+/** A fresh private directory name for one process. */
+const runDirectoryName = () => `run-${Date.now().toString(36)}-${randomBytes(6).toString("hex")}`;
+//#endregion
+//#region src/claude-cli-transport.js
+/**
+* Send Claude Messages requests through the official Claude Code CLI.
+*
+* The native route builds every Claude request exactly as it does for HTTP —
+* DSH's history, system prompt, tools, images and signed thinking, converted
+* by pi-ai — and hands the finished request to this transport instead of the
+* network when the key's group only serves the official client. The answer
+* comes back as the same SSE stream, so DSH's agent loop, tool execution,
+* permissions, plan mode, replay and error handling are unchanged.
+*
+* Each DSH conversation (session and model) keeps one live CLI process. A
+* request that continues it — the tool results it is waiting for, or the
+* user's next turn — reuses it, so its requests share one cacheable prefix.
+* Any other request (a different history, system prompt, tool set, key or
+* effort) replaces it with a process resumed from the request's own history.
+* Session titles and compaction run in a separate one-shot process.
+*
+* @module dsh-packycode-api/claude-cli-transport
+*/
+/** Live processes kept at once; the least recently used one goes first. */
+const MAX_LIVE_CLI_SESSIONS = 8;
+/** A process nothing has used for this long is stopped; DSH resumes it from history. */
+const CLI_SESSION_IDLE_MS = 1200 * 1e3;
+const SWEEP_MS = 60 * 1e3;
+/** Run directories a crashed host left behind are removed after this long. */
+const STALE_RUN_MS = 1440 * 60 * 1e3;
+/** Text blocks the native route prepends for its own HTTP envelope; the CLI writes its own. */
+const ENVELOPE = /^(?:x-anthropic-billing-header:|You are Claude Code, Anthropic's official CLI for Claude)/u;
+/**
+* Appended after DSH's own instructions: the tools are DSH's, under the MCP
+* prefix the CLI gives them, and the CLI's own tools are absent.
+*/
+const CLI_TOOL_NOTE = [
+	"Tool access in this session: every tool you can call is provided by DeepSeek Harness (DSH) and appears with the mcp__dsh__ prefix.",
+	"When the instructions above name a tool by its plain name (for example bash, read, edit or exit_plan_mode), call the mcp__dsh__ tool of that name.",
+	"Claude Code's built-in tools (Bash, Read, Edit, Write, Glob, Grep, Task, TodoWrite, WebSearch, WebFetch, NotebookEdit) are not available here; never call them.",
+	"DSH runs each call under its own permissions and sandbox and returns the result."
+].join("\n");
+/** The DSH system prompt inside a Messages payload, without the HTTP envelope. */
+function dshSystemText(system) {
+	return (typeof system === "string" ? [{
+		type: "text",
+		text: system
+	}] : Array.isArray(system) ? system : []).filter((block) => block?.type === "text" && typeof block.text === "string" && !ENVELOPE.test(block.text)).map((block) => block.text).join("\n\n").trim();
+}
+/**
+* What a payload asks of the CLI.
+* @param body - the Messages request body the native route built.
+* @param meta - the request's key, endpoint and working directory.
+* @returns model, effort, cap, system text, tools, messages, and the
+*   signature a live process must match to continue.
+*/
+function describeRequest(body, { apiKey, baseUrl, cwd } = {}) {
+	const tools = (Array.isArray(body?.tools) ? body.tools : []).filter((tool) => typeof tool?.name === "string" && tool.name.startsWith(MCP_TOOL_PREFIX) && tool.input_schema !== void 0).map((tool) => ({
+		name: tool.name,
+		description: tool.description ?? "",
+		input_schema: tool.input_schema
+	}));
+	const own = dshSystemText(body?.system);
+	const system = own === "" ? CLI_TOOL_NOTE : `${own}\n\n${CLI_TOOL_NOTE}`;
+	const messages = Array.isArray(body?.messages) ? body.messages : [];
+	const request = {
+		model: String(body?.model ?? ""),
+		effort: typeof body?.output_config?.effort === "string" ? body.output_config.effort : void 0,
+		maxTokens: Number.isSafeInteger(body?.max_tokens) ? body.max_tokens : void 0,
+		system,
+		tools,
+		messages,
+		normalized: messages.map((message) => JSON.stringify(canonicalMessage(message)))
+	};
+	request.signature = createHash("sha256").update(JSON.stringify([
+		request.model,
+		request.effort,
+		request.maxTokens,
+		system,
+		tools,
+		createHash("sha256").update(String(apiKey ?? "")).digest("hex"),
+		baseUrl,
+		cwd
+	])).digest("hex");
+	return request;
+}
+/**
+* How a live process continues this request, or undefined when it cannot.
+* @param entry - the live process and the request it last served.
+* @param request - the new request.
+* @returns `{ kind: 'tools', results }` or `{ kind: 'turn', content }`.
+*/
+function planContinuation(entry, request) {
+	const session = entry?.session;
+	if (session === void 0 || session.closed || entry.signature !== request.signature) return void 0;
+	const base = entry.baseline;
+	const next = request.normalized;
+	if (next.length < base.length + 2) return void 0;
+	for (let index = 0; index < base.length; index++) if (next[index] !== base[index]) return void 0;
+	const assistant = request.messages[base.length];
+	const rest = request.messages.slice(base.length + 1);
+	if (assistant?.role !== "assistant" || rest.some((message) => message?.role !== "user")) return void 0;
+	const ids = toolUseIds(assistant);
+	const blocks = rest.flatMap((message) => contentBlocks(withoutCacheControl(message.content)));
+	if (session.state === "awaiting-tools") {
+		const pending = session.pendingToolIds;
+		if (ids.join("\n") !== pending.join("\n")) return void 0;
+		if (blocks.some((block) => block?.type !== "tool_result")) return void 0;
+		const results = new Map(blocks.map((block) => [block.tool_use_id, block]));
+		if (results.size !== pending.length || pending.some((id) => !results.has(id))) return void 0;
+		return {
+			kind: "tools",
+			results
+		};
+	}
+	if (session.state === "idle") {
+		if (ids.length > 0 || blocks.length === 0 || blocks.some((block) => block?.type === "tool_result")) return void 0;
+		return {
+			kind: "turn",
+			content: blocks
+		};
+	}
+}
+/** The endpoint a Messages URL belongs to: everything before `/v1/messages`. */
+function baseUrlOf(input) {
+	const url = new URL(input instanceof Request ? input.url : String(input));
+	const path = url.pathname.replace(/\/v1\/messages\/?$/u, "").replace(/\/+$/u, "");
+	return `${url.origin}${path}`;
+}
+/**
+* Create the transport.
+* @param options - how to find the CLI binary (`binary()` resolves a path or
+*   throws), the isolated CLI home, the version recorded in transcripts,
+*   limits, a logger, and process seams for tests.
+* @returns `{ fetch(input, init, meta), close(), stats() }`.
+*/
+function createClaudeCliTransport({ binary, configDir = DEFAULT_CLAUDE_CONFIG_DIR, version = () => void 0, maxLive = 8, idleMs = CLI_SESSION_IDLE_MS, logger, spawnImpl, platform, parentEnv, startupTimeoutMs, now = Date.now } = {}) {
+	if (typeof binary !== "function") throw new Error("the Claude Code CLI transport needs a binary resolver");
+	const live = /* @__PURE__ */ new Map();
+	/** One-shot processes in flight; they end themselves, unless the plugin unloads first. */
+	const oneShots = /* @__PURE__ */ new Set();
+	let closed = false;
+	let opened = 0;
+	let continued = 0;
+	(async () => {
+		const runs = join(configDir, "runs");
+		for (const name of await readdir(runs).catch(() => [])) {
+			if (!name.startsWith("run-")) continue;
+			const path = join(runs, name);
+			try {
+				if (now() - (await stat(path)).mtimeMs > STALE_RUN_MS) await rm(path, {
+					recursive: true,
+					force: true
+				});
+			} catch {}
+		}
+	})();
+	const evict = (key, reason) => {
+		const entry = live.get(key);
+		if (entry === void 0) return;
+		live.delete(key);
+		entry.session.dispose(reason);
+	};
+	const sweep = setInterval(() => {
+		for (const session of oneShots) if (session.closed) oneShots.delete(session);
+		for (const [key, entry] of live) if (entry.session.closed) live.delete(key);
+		else if (now() - entry.touched > idleMs && entry.session.state !== "streaming") evict(key, "idle");
+	}, SWEEP_MS);
+	sweep.unref?.();
+	/** The session's own directory when it exists; otherwise a neutral one. */
+	const workingDirectory = async (cwd) => {
+		if (typeof cwd === "string" && cwd !== "") try {
+			if ((await stat(cwd)).isDirectory()) return cwd;
+		} catch {}
+		const fallback = join(configDir, "workspace");
+		await mkdir(fallback, { recursive: true });
+		return fallback;
+	};
+	const open = async (request, meta, { oneShot }) => startClaudeCliSession({
+		binary,
+		configDir,
+		runDirectory: join(configDir, "runs", runDirectoryName()),
+		baseUrl: meta.baseUrl,
+		apiKey: meta.apiKey,
+		request,
+		conversation: splitConversation(request.messages),
+		cwd: await workingDirectory(meta.cwd),
+		sessionId: oneShot ? randomUUID() : meta.sessionId,
+		cliVersion: version(),
+		oneShot,
+		logger,
+		...spawnImpl === void 0 ? {} : { spawnImpl },
+		...platform === void 0 ? {} : { platform },
+		...parentEnv === void 0 ? {} : { parentEnv },
+		...startupTimeoutMs === void 0 ? {} : { startupTimeoutMs }
+	});
+	/**
+	* Send one Messages request through the CLI.
+	* @param input - the request URL the native client targeted.
+	* @param init - its init; `body` is the JSON payload, `signal` the abort.
+	* @param meta - `{ apiKey, sessionId, purpose, cwd }`.
+	* @returns the HTTP response of the request.
+	*/
+	const send = async (input, init, meta) => {
+		if (closed) throw new Error("the Claude Code CLI transport is closed");
+		const body = JSON.parse(typeof init?.body === "string" ? init.body : "{}");
+		const baseUrl = baseUrlOf(input);
+		const request = describeRequest(body, {
+			apiKey: meta.apiKey,
+			baseUrl,
+			cwd: meta.cwd
+		});
+		const context = {
+			...meta,
+			baseUrl
+		};
+		const oneShot = async () => {
+			const session = await open(request, context, { oneShot: true });
+			opened += 1;
+			oneShots.add(session);
+			return session.respond({ kind: "start" }, init?.signal);
+		};
+		try {
+			if (meta.purpose !== void 0) return await oneShot();
+			const key = `${meta.sessionId}\u0000${request.model}`;
+			const entry = live.get(key);
+			if (entry !== void 0 && !entry.session.closed && ["starting", "streaming"].includes(entry.session.state)) return await oneShot();
+			const plan = planContinuation(entry, request);
+			if (plan !== void 0) {
+				entry.baseline = request.normalized;
+				entry.touched = now();
+				continued += 1;
+				return await entry.session.respond(plan, init?.signal);
+			}
+			if (entry !== void 0) evict(key, "superseded");
+			const session = await open(request, context, { oneShot: false });
+			opened += 1;
+			live.set(key, {
+				session,
+				baseline: request.normalized,
+				signature: request.signature,
+				touched: now()
+			});
+			while (live.size > maxLive) {
+				const [oldest] = [...live.entries()].filter(([candidate]) => candidate !== key).sort((left, right) => left[1].touched - right[1].touched);
+				if (oldest === void 0) break;
+				evict(oldest[0], "too many live sessions");
+			}
+			return await session.respond({ kind: "start" }, init?.signal);
+		} catch (error) {
+			if (init?.signal?.aborted) throw error;
+			const reason = error?.code === "CLAUDE_CLI_MISSING" ? "" : `: ${String(error?.message ?? error).slice(0, 300)}`;
+			logger?.warn?.("packycode-api: Claude Code CLI could not start%s", reason);
+			return errorResponse(400, `${CLI_UNAVAILABLE}${reason}`, CLI_UNAVAILABLE);
+		}
+	};
+	return Object.freeze({
+		fetch: send,
+		/** Counters for diagnostics; never message content. */
+		stats: () => ({
+			live: [...live.values()].filter((entry) => !entry.session.closed).length,
+			opened,
+			continued
+		}),
+		/** Stop every process; the plugin is unloading. */
+		async close() {
+			closed = true;
+			clearInterval(sweep);
+			const sessions = [...[...live.values()].map((entry) => entry.session), ...oneShots];
+			live.clear();
+			oneShots.clear();
+			await Promise.allSettled(sessions.map((session) => session.dispose("plugin unloaded")));
+		}
+	});
+}
+//#endregion
+//#region src/claude-transport.js
+/**
+* Which transport a Claude request uses: the plugin's own Messages HTTP client,
+* or the official Claude Code CLI on this device.
+*
+* PackyCode's `cc` group ("claude code专用") serves only the official client,
+* so a key in it sends its Claude requests through the real CLI.
+* `cc-expensive`, `cc-sale` and `claude-officially` keep the native HTTP
+* route. The user can pin either transport in the settings panel.
+* (`claude-sale` is delisted for now; it joins the CLI list if it returns.)
+*
+* Only the transport changes: DSH's agent loop, tools, permissions, plan mode,
+* attachments and history are identical on both, and no other provider or
+* credential is ever substituted.
+*
+* @module dsh-packycode-api/claude-transport
+*/
+/** Groups whose Claude requests are sent by the official Claude Code client. */
+const CLI_ONLY_GROUPS = Object.freeze(["cc"]);
+/** Claude groups whose requests use the plugin's HTTP route. */
+const HTTP_CLAUDE_GROUPS = Object.freeze([
+	"cc-expensive",
+	"cc-sale",
+	"claude-officially"
+]);
+/** `auto` follows the key's groups; `cli` and `http` pin one transport. */
+const CLAUDE_TRANSPORTS = Object.freeze([
+	"auto",
+	"cli",
+	"http"
+]);
+const DEFAULT_CLAUDE_TRANSPORT = "auto";
+/** Whether a catalog model is served over the Anthropic Messages protocol. */
+const isClaudeModel = (modelId) => typeof modelId === "string" && modelId.startsWith("claude-");
+/** Read the stored preference; anything unknown is the default. */
+function readClaudeTransport(value) {
+	return CLAUDE_TRANSPORTS.includes(value) ? value : DEFAULT_CLAUDE_TRANSPORT;
+}
+/**
+* Decide the transport for a Claude request.
+* @param options - the stored preference and the request key's groups, as the
+*   last group reading saw them (undefined when there is no reading yet).
+* @returns `{ transport: 'cli' | 'http', reason, groups? }`. `reason` is
+*   `preference`, `group` (the key's groups decided), or `unknown` (no reading
+*   yet; the native HTTP route stands, as it did before this choice existed).
+*/
+function claudeTransportFor({ preference, groups } = {}) {
+	const pinned = readClaudeTransport(preference);
+	if (pinned !== "auto") return {
+		transport: pinned,
+		reason: "preference"
+	};
+	if (!Array.isArray(groups)) return {
+		transport: "http",
+		reason: "unknown"
+	};
+	const gated = groups.filter((name) => CLI_ONLY_GROUPS.includes(name));
+	return gated.length > 0 ? {
+		transport: "cli",
+		reason: "group",
+		groups: gated
+	} : {
+		transport: "http",
+		reason: "group",
+		groups: groups.filter((name) => HTTP_CLAUDE_GROUPS.includes(name))
+	};
+}
+//#endregion
 //#region src/diagnostics.js
 /**
 * A support summary of one DSH session, for reports such as "已达到输出 token
@@ -1323,7 +3365,8 @@ function validateImageOptions({ model = DEFAULT_IMAGE_MODEL, quality = "auto", s
 *   plugin's own row, read through a live reference, written through
 *   `settings.update(rowId, patch)`, and announced by `loader/volatile-update`.
 *   Only volatile fields are writable there, so the host overrides stay
-*   read-only while web search and model visibility are editable.
+*   read-only while web search, model visibility, images and the Claude
+*   transport are editable.
 *
 * @module dsh-packycode-api/preferences
 */
@@ -1360,7 +3403,7 @@ function unwritable(message) {
 *   current source and how to replace it, what to do when the section changes,
 *   and the preference targets this fills in (host overrides, search, models).
 */
-function connectSettings(settingsCtx, { ctx, Config, namespace, source, setSource, onChange, hostPreference, searchPreference, modelPreference, imagePreference }) {
+function connectSettings(settingsCtx, { ctx, Config, namespace, source, setSource, onChange, hostPreference, searchPreference, modelPreference, imagePreference, claudePreference }) {
 	const settings = settingsCtx.settings;
 	if (typeof settings?.installSection === "function") {
 		try {
@@ -1378,6 +3421,7 @@ function connectSettings(settingsCtx, { ctx, Config, namespace, source, setSourc
 				Object.assign(searchPreference, target);
 				Object.assign(modelPreference, target);
 				if (imagePreference !== void 0) Object.assign(imagePreference, target);
+				if (claudePreference !== void 0) Object.assign(claudePreference, target);
 			}
 		} catch (error) {
 			ctx.logger?.warn?.("packycode-api: host overrides unavailable, defaults stand: %s", error.message);
@@ -1393,6 +3437,7 @@ function connectSettings(settingsCtx, { ctx, Config, namespace, source, setSourc
 	Object.assign(searchPreference, target);
 	Object.assign(modelPreference, target);
 	if (imagePreference !== void 0) Object.assign(imagePreference, target);
+	if (claudePreference !== void 0) Object.assign(claudePreference, target);
 	if (typeof settings.configure === "function") {
 		const scope = typeof settingsCtx.effect === "function" ? settingsCtx : ctx;
 		try {
@@ -2189,10 +4234,25 @@ function createKeyChooser({ ring, groups, onRotated, logger, waitMs = DEFAULT_GR
 		if (key !== void 0) await warm();
 		return key;
 	};
+	/**
+	* Wait at most `waitMs` for a group reading to exist, whatever the number
+	* of keys: a Claude request's transport depends on its key's groups.
+	*/
+	const awaitGroups = async () => {
+		if (groups.hasReading() || snapshot.length === 0) return;
+		let timer;
+		await Promise.race([groups.read().catch(() => void 0), new Promise((resolve) => {
+			timer = setTimeout(resolve, waitMs);
+		})]);
+		clearTimeout(timer);
+	};
 	return Object.freeze({
 		remember,
 		covers,
 		active,
+		awaitGroups,
+		/** The ring id of the key material a request carries, as of the last resolution. */
+		idOf: (key) => typeof key === "string" ? idByKey.get(key) : void 0,
 		/**
 		* The key one HTTP request for `modelId` runs with, given the active key
 		* pi-ai resolved. Synchronous because pi-ai opens its stream synchronously;
@@ -2542,7 +4602,11 @@ function createModelSelectionController({ readPreference, writePreference, isWri
 * The running version comes from this package. The latest version comes from
 * the npm registry. An in-place update is only offered for a registry install,
 * and it installs that exact version with the host's own pnpm — never through
-* `dsh plugin --profile desktop`, which the desktop app refuses. Registry
+* `dsh plugin --profile desktop`, which the desktop app refuses. The install
+* runs under the profile's own `minimumReleaseAge`: a version installed past
+* it would sit in the profile's lockfile, and pnpm then refuses every later
+* plugin install in that profile until the version is old enough. A version
+* pnpm still holds back is reported as pending, with when it clears. Registry
 * bodies and package-manager output stay host-side.
 *
 * @module dsh-packycode-api/plugin-version
@@ -2552,6 +4616,28 @@ const NPM_REGISTRY_LATEST_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/late
 const DEFAULT_VERSION_TTL_MS = 5 * 6e4;
 const DEFAULT_VERSION_TIMEOUT_MS = 1e4;
 const DEFAULT_UPDATE_TIMEOUT_MS = 18e4;
+const RELEASE_AGE_ERROR = /ERR_PNPM_(?:NO_MATURE_MATCHING_VERSION|MINIMUM_RELEASE_AGE_VIOLATION)/u;
+const RELEASE_AGE_ENTRY = /(\S+@\S+) was published at (\S+?), within the minimumReleaseAge cutoff \((\S+?)\)/gu;
+/**
+* Recognize pnpm refusing a version that is younger than its
+* `minimumReleaseAge`, whether the version was requested or already sits in
+* the lockfile. Each refused entry reads `<name>@<version> was published at
+* <time>, within the minimumReleaseAge cutoff (<time>)`.
+* @param output - the install's stdout and stderr.
+* @param finishedAt - when the install ended; pnpm drew its cutoff then.
+* @returns undefined when this is not a release-age refusal; otherwise
+*   `{ availableAt }`, when the youngest refused entry clears, if pnpm said.
+*/
+function releaseAgeRefusal(output, finishedAt) {
+	const text = String(output ?? "").replace(/\u001b\[[0-9;]*m/gu, "");
+	if (!RELEASE_AGE_ERROR.test(text)) return void 0;
+	let availableAt;
+	for (const [, , published, cutoff] of text.matchAll(RELEASE_AGE_ENTRY)) {
+		const clears = Date.parse(published) + (finishedAt - Date.parse(cutoff));
+		if (Number.isFinite(clears) && (availableAt === void 0 || clears > availableAt)) availableAt = clears;
+	}
+	return availableAt === void 0 ? {} : { availableAt };
+}
 /** Parse a strict `x.y.z[-pre][+build]` version; anything else is undefined. */
 function parseSemver(value) {
 	if (typeof value !== "string") return void 0;
@@ -2826,7 +4912,6 @@ function createPackyCodePluginManager({ fetchImpl = ambientFetch, runCommand = s
 							...launcher.prefix,
 							"add",
 							"--save-exact",
-							`--config.minimumReleaseAge=0`,
 							`${PACKAGE_NAME}@${latest}`
 						],
 						cwd: profileDir
@@ -2838,7 +4923,16 @@ function createPackyCodePluginManager({ fetchImpl = ambientFetch, runCommand = s
 					if (signal?.aborted) throw error;
 					throw new Error("PackyCode plugin update failed");
 				}
-				if (result.code !== 0) throw new Error("PackyCode plugin update failed");
+				if (result.code !== 0) {
+					const refusal = releaseAgeRefusal(`${result.stdout ?? ""}\n${result.stderr ?? ""}`, now());
+					if (refusal !== void 0) return {
+						version: latest,
+						profile: install.profile,
+						pending: true,
+						...refusal
+					};
+					throw new Error("PackyCode plugin update failed");
+				}
 				await confirmInstalled({
 					profileDir,
 					expected: latest,
@@ -2857,154 +4951,6 @@ function createPackyCodePluginManager({ fetchImpl = ambientFetch, runCommand = s
 	});
 }
 //#endregion
-//#region src/failures.js
-/**
-* Failure classification for the two conditions that move the key ring along.
-*
-* The gateway reports an exhausted key and a rejected key in Chinese, and the
-* harness classifies failures by fixed English/status wording it recognizes
-* (`isQuotaExceededError`, `\b401\b`). Normalizing here is what makes the
-* harness's retry policy re-run the step — and therefore what lets the retry
-* pick up the next key. Rewriting is honest about what happened: this plugin
-* knows the key's condition from the gateway's own words plus its balance
-* reader, so the sentence it substitutes says no more than that.
-*
-* @module dsh-packycode-api/failures
-*/
-/** Terminal quota, balance, or credit wording, in the gateway's own languages. */
-const QUOTA_WORDING = /额度|余额|配额|欠费|insufficient[\s_-]+(?:quota|balance|credits?)|quota[\s_-]+(?:exceeded|exhausted|reached)|out[\s_-]+of[\s_-]+(?:credits?|budget)/iu;
-/** A rejected key names itself; a bare 403 does not, and must not disable one. */
-const INVALID_KEY_WORDING = /无效的令牌|令牌无效|无效密钥|密钥无效|invalid[\s_-]+api[\s_-]*key|invalid_authentication|api key is invalid/iu;
-const INVALID_KEY_STATUS = /\b401\b/;
-/**
-* A gateway group that only serves its vendor's official client. These arrive
-* as 403, which the harness reads as an authentication failure and renders as
-* an invalid-API-key problem — the opposite of what happened. This wording
-* also covers intermittent client-anomaly refusals; it does not establish
-* whether a future request will be accepted.
-*/
-const CLIENT_POLICY_WORDING = /only accessible via the official|only accepts requests from the official|official\s+claude(?:\s+code)?\s+cli|官方\s*claude(?:\s*code)?\s*cli|请使用标准\s*codex\s*客户端|客户端存在异常|二次分发|API\s*转接/iu;
-/** A content-policy refusal observed on an already-authorized request. */
-const TEST_MESSAGE_POLICY_CODE = "GATEWAY_TEST_MESSAGE";
-const TEST_MESSAGE_PREFIX = `[${TEST_MESSAGE_POLICY_CODE}]`;
-/** Match the captured refusal narrowly; a bare 403 is still not evidence. */
-function classifyTestMessagePolicy(message) {
-	if (typeof message !== "string") return false;
-	return message.startsWith(TEST_MESSAGE_PREFIX) || /already connected and authorized/iu.test(message) && /no need to send test messages/iu.test(message) && /verify the connection/iu.test(message);
-}
-/** Keep the host's status-word classifier from turning this into AUTH. */
-function explainTestMessagePolicyFailure() {
-	return `${TEST_MESSAGE_PREFIX} PackyCode 将这次请求识别为连通性测试并拒绝。请使用实际业务内容；本次拒绝不表示 Key 失效，也不会禁用或切换 Key。`;
-}
-/**
-* The gateway's answer when a key's groups do not include the model's
-* supplier: `model_not_found` / 当前令牌未覆盖供应商. The key is fine for other
-* models, so it is never moved aside for this.
-*/
-const COVERAGE_WORDING = /model_not_found|未覆盖供应商|无可用渠道|no available channel/iu;
-/**
-* Whether the gateway refused the model for this key's groups.
-* @param message - the failure text.
-* @returns true for a group-coverage refusal.
-*/
-function classifyCoverage(message) {
-	return COVERAGE_WORDING.test(typeof message === "string" ? message : "");
-}
-/** The key's quota is exhausted; move to the next key. */
-const QUOTA_FAILURE = "quota";
-/** The gateway rejected the key itself; move to the next key. */
-const INVALID_KEY_FAILURE = "invalid-key";
-/**
-* Whether the gateway is refusing this client rather than this credential.
-* @param message - provider failure text, as pi-ai carries it.
-* @returns true when the route is gated to a vendor's official client.
-*/
-function classifyClientPolicy(message) {
-	return CLIENT_POLICY_WORDING.test(typeof message === "string" ? message : "");
-}
-/**
-* OpenAI's generic transient failure: the sentence its `server_error` carries,
-* or the `server_error:` prefix pi-ai writes when the event names the code.
-* The gateway can relay it inside a stream it has already answered 200 for —
-* an SSE `error` event with a 503 `server_error`, then `response.failed` — so
-* no HTTP status comes with it.
-*/
-const UPSTREAM_SERVER_ERROR = /an error occurred while processing your request\b[\s\S]*\bhelp\.openai\.com\b|^(?:error code\s+)?server_error:/iu;
-/**
-* Whether a failure is the upstream's transient server error, which a resent
-* request clears. The key is not at fault.
-* @param message - provider failure text, as pi-ai carries it.
-* @returns true for OpenAI's generic `server_error`.
-*/
-function classifyUpstreamServerError(message) {
-	return UPSTREAM_SERVER_ERROR.test(typeof message === "string" ? message : "");
-}
-/**
-* Classify a gateway failure message.
-*
-* Quota wording wins over a status token: an exhausted balance is often
-* reported as 402/403, and only the key's own rejection may read as 401. A
-* client-policy refusal is not a key fault and is classified separately.
-* @param message - provider failure text, as pi-ai carries it.
-* @returns the failure kind, or undefined when the key is not at fault.
-*/
-function classifyGatewayFailure(message) {
-	const text = typeof message === "string" ? message : "";
-	if (text === "") return void 0;
-	if (classifyClientPolicy(text) || classifyTestMessagePolicy(text)) return void 0;
-	if (QUOTA_WORDING.test(text)) return QUOTA_FAILURE;
-	if (INVALID_KEY_WORDING.test(text)) return INVALID_KEY_FAILURE;
-	if (INVALID_KEY_STATUS.test(text)) return INVALID_KEY_FAILURE;
-}
-/**
-* Rewrite a failure message so the harness classifies it as quota or auth.
-*
-* A bare status token is neutralized first: an exhausted balance arrives as
-* 402 or 403 on some gateway routes, and the harness's auth rule matches
-* 401/403 before it reads any wording, which would send the failure into a
-* category the retry policy does not re-run.
-* @param message - the original provider failure text.
-* @param kind - the classification of {@link classifyGatewayFailure}.
-* @returns text the harness routes to QUOTA or AUTH.
-*/
-/**
-* Explain a client-policy refusal so the user reads the real cause.
-*
-* The sentence must not read as any other failure the harness knows: it
-* deliberately carries no HTTP status and none of the words the classifier
-* matches for auth, quota, rate limits, timeouts, or transport faults. That
-* keeps the failure out of the host's generic retry policy and lets the
-* sentence reach the user verbatim, in
-* place of the "API key is invalid" the bare 403 would have produced.
-* @param keyName - the account name the balance reader saw, when known.
-* @returns the replacement sentence.
-*/
-function explainClientPolicyFailure() {
-	return "PackyCode 拒绝了这个客户端：所选分组只允许厂商官方客户端调用（Claude 分组要求官方 Claude CLI，Codex 分组要求标准 Codex 客户端）。这不是 API Key 失效。请检查当前分组的客户端要求；若调整分组，应先在模型广场确认该模型可用。 / This group only serves the vendor’s official client; the API key is fine.";
-}
-/**
-* Rewrite a failure message so the harness classifies it as quota or auth.
-*
-* A bare status token is neutralized first: an exhausted balance arrives as
-* 402 or 403 on some gateway routes, and the harness's auth rule matches
-* 401/403 before it reads any wording, which would send the failure into a
-* category the retry policy does not re-run.
-* @param message - the original provider failure text.
-* @param kind - the classification of {@link classifyGatewayFailure}.
-* @param options - optional account name for the policy explanation.
-* @returns text the harness routes to QUOTA or AUTH, or a policy explanation.
-*/
-function normalizeFailureMessage(message, kind, options = {}) {
-	const text = typeof message === "string" && message.length > 0 ? message : "PackyCode request failed";
-	if (kind === "client-policy") return explainClientPolicyFailure(options.keyName);
-	if (kind === "quota") return `${neutralizeAuthStatus(text)} — PackyCode: insufficient quota for this API key; trying the next key`;
-	if (kind === "invalid-key") return `${neutralizeAuthStatus(text)} — PackyCode: 401 invalid_authentication for this API key; trying the next key`;
-	return text;
-}
-function neutralizeAuthStatus(text) {
-	return text.replace(/\b(?:401|403)\b/gu, "HTTP");
-}
-//#endregion
 //#region src/gemini-replay.js
 /** A bounded resend for the gateway's intermittent Flash signature refusal. */
 const waitForRetry = (ms, signal) => setTimeout$1(ms, void 0, { signal });
@@ -3107,8 +5053,13 @@ async function isReplayableRefusal(response, { allowTestMessage }) {
 		reader?.releaseLock();
 	}
 }
+/**
+* pi-ai 0.x carries the offered tools in `context.tools`; pi-ai 1.x (DSH
+* 0.2.1) hands the provider a transcript whose system messages declare them
+* as `toolsAdded`.
+*/
 function hasToolContext(context) {
-	return (context.tools?.length ?? 0) > 0 || context.messages?.some((message) => message.role === "toolResult" || Array.isArray(message.content) && message.content.some((block) => block.type === "toolCall"));
+	return (context.tools?.length ?? 0) > 0 || context.messages?.some((message) => message.role === "toolResult" || message.role === "system" && (message.toolsAdded?.length ?? 0) > 0 || Array.isArray(message.content) && message.content.some((block) => block.type === "toolCall"));
 }
 /**
 * Fixed Haiku and Sonnet tool payloads were observed returning both 200 and
@@ -3298,16 +5249,37 @@ const BUILTIN_NAMES = Object.freeze({
 	glob: "Glob",
 	grep: "Grep"
 });
-/** CLI-compatible wire names, restored to their originals before host dispatch. */
-function createClaudeToolNames() {
+/** Through the CLI every DSH tool is an MCP tool of the `dsh` server. */
+const CLI_PREFIX = "mcp__dsh__";
+/** A name the CLI keeps verbatim: no double underscore, and the whole name within 64 characters. */
+const CLI_SAFE_NAME = /^[a-zA-Z0-9-]+(?:_[a-zA-Z0-9-]+)*$/u;
+const CLI_MAX_NAME = 54;
+const digestOf = (name) => createHash("sha256").update(name).digest("hex").slice(0, 12);
+/** The wire name of a DSH tool when the official CLI carries the request. */
+function cliToolName(name) {
+	if (CLI_SAFE_NAME.test(name) && name.length <= CLI_MAX_NAME) return `${CLI_PREFIX}${name}`;
+	const slug = name.replace(/[^a-zA-Z0-9-]+/gu, "_").replace(/^_+/u, "").slice(0, CLI_MAX_NAME - 13).replace(/_+$/u, "") || "tool";
+	return `${CLI_PREFIX}${slug}_${digestOf(name)}`;
+}
+/**
+* Request-scoped wire names, restored to their originals before host
+* dispatch. Over HTTP the CLI-compatible built-in spellings are used; through
+* the CLI every tool is listed by the MCP bridge and the model sees
+* `mcp__dsh__<name>`.
+* @param options - `cli` selects the CLI transport's names.
+*/
+function createClaudeToolNames({ cli = false } = {}) {
 	const owners = /* @__PURE__ */ new Map(), offered = /* @__PURE__ */ new Map(), clientNames = /* @__PURE__ */ new Set();
 	let declaredNames = /* @__PURE__ */ new Set();
 	const encode = (name, available = false) => {
 		if (typeof name !== "string") return name;
-		const slug = name.replace(/[^a-zA-Z0-9_-]/gu, "_").slice(0, 40) || "tool";
-		const digest = createHash("sha256").update(name).digest("hex").slice(0, 12);
-		const builtin = Object.hasOwn(BUILTIN_NAMES, name) ? BUILTIN_NAMES[name] : void 0;
-		const alias = builtin && !declaredNames.has(builtin) ? builtin : `mcp__dsh__${slug}_${digest}`;
+		let alias;
+		if (cli) alias = cliToolName(name);
+		else {
+			const slug = name.replace(/[^a-zA-Z0-9_-]/gu, "_").slice(0, 40) || "tool";
+			const builtin = Object.hasOwn(BUILTIN_NAMES, name) ? BUILTIN_NAMES[name] : void 0;
+			alias = builtin && !declaredNames.has(builtin) ? builtin : `mcp__dsh__${slug}_${digestOf(name)}`;
+		}
 		if (owners.has(alias) && owners.get(alias) !== name) throw new Error("Ambiguous Claude tool name");
 		owners.set(alias, name);
 		if (available) {
@@ -3392,8 +5364,54 @@ function createClaudeToolNames() {
 	};
 }
 //#endregion
+//#region src/request-context.js
+/**
+* Per-request facts the route knows but pi-ai does not carry to the wire.
+*
+* DSH hands the route a request's purpose (an agent step, a session title, a
+* compaction) and the initiating session's working directory; pi-ai forwards
+* only the model, messages and transport options to the provider. The route
+* runs each stream's iteration inside an async context holding those facts,
+* so the Claude transport can read them where the request is actually sent.
+* Nothing here is model-visible or leaves the host.
+*
+* @module dsh-packycode-api/request-context
+*/
+const storage = new AsyncLocalStorage();
+/** The facts of the request being sent, or undefined outside the route. */
+const currentRequest = () => storage.getStore();
+/**
+* Iterate `iterable` with `context` as the current request. Every `next()` —
+* and so every promise the producer creates while it runs — sees the context,
+* however the consumer interleaves several streams.
+* @param context - plain facts; frozen before use.
+* @param iterable - the stream to iterate.
+* @returns an async iterable over the same items.
+*/
+function withRequestContext(context, iterable) {
+	const store = Object.freeze({ ...context });
+	return { [Symbol.asyncIterator]() {
+		let iterator;
+		const run = (action) => storage.run(store, () => {
+			iterator ??= iterable[Symbol.asyncIterator]();
+			return action(iterator);
+		});
+		return {
+			next: (...args) => run((it) => it.next(...args)),
+			return: (...args) => run((it) => typeof it.return === "function" ? it.return(...args) : Promise.resolve({
+				done: true,
+				value: args[0]
+			})),
+			throw: (...args) => run((it) => typeof it.throw === "function" ? it.throw(...args) : Promise.reject(args[0])),
+			[Symbol.asyncIterator]() {
+				return this;
+			}
+		};
+	} };
+}
+//#endregion
 //#region src/claude-api.js
-/** Claude Messages over HTTP, with the gateway's tested client envelope. */
+/** Claude Messages over HTTP, or through the official CLI for keys whose group requires it. */
 const CLIENT_VERSION = "2.1.295";
 const USER_AGENT = `claude-cli/${CLIENT_VERSION} (external, sdk-cli)`;
 const CLIENT_BETA = "claude-code-20250219";
@@ -3440,8 +5458,14 @@ function sessionUuid(value) {
 * Only the host-side client envelope is changed. The bearer is always the
 * explicit request key selected by this plugin; there is no credential or
 * subprocess fallback. A client-policy refusal still reaches the route guard.
+*
+* With `cli`, a request whose key must use the official client is handed to
+* the Claude Code CLI transport instead of the network: the same payload,
+* the same SSE answer, DSH's tools listed through the CLI's MCP bridge.
+* @param options - `cli.choose({ apiKey, model })` decides per request;
+*   `cli.fetch(input, init, meta)` sends it.
 */
-function createClaudeApi() {
+function createClaudeApi({ cli } = {}) {
 	const api = anthropicMessagesApi();
 	const deviceId = randomBytes(32).toString("hex");
 	const adapt = (model, context, options, toolNames) => {
@@ -3511,9 +5535,38 @@ function createClaudeApi() {
 			}
 		};
 	};
+	/**
+	* The official CLI writes its own envelope, identity, effort and thinking
+	* display; only DSH's payload (with CLI tool names) is handed over. The
+	* route's request context says which DSH session, purpose and working
+	* directory the request belongs to.
+	*/
+	const adaptCli = (model, context, options, toolNames) => {
+		const route = currentRequest();
+		const meta = Object.freeze({
+			apiKey: options?.apiKey,
+			sessionId: sessionUuid(options?.sessionId),
+			...route?.purpose === void 0 ? {} : { purpose: route.purpose },
+			...typeof route?.cwd === "string" ? { cwd: route.cwd } : {}
+		});
+		return {
+			...options,
+			fetch: async (input, init) => {
+				return finishClaudeStream(await createClaudeReplayFetch((target, request) => cli.fetch(target, request, meta), {
+					model,
+					context
+				})(input, init), init?.signal ?? (input instanceof Request ? input.signal : void 0));
+			},
+			onPayload: async (payload, model) => toolNames.encodePayload(await options?.onPayload?.(payload, model) ?? payload)
+		};
+	};
 	const invoke = (method, model, context, options) => {
-		const names = createClaudeToolNames();
-		return names.decodeStream(api[method](model, context, adapt(model, context, options, names)));
+		const viaCli = cli !== void 0 && cli.choose({
+			apiKey: options?.apiKey,
+			model: model.id
+		}) === true;
+		const names = createClaudeToolNames({ cli: viaCli });
+		return names.decodeStream(api[method](model, context, (viaCli ? adaptCli : adapt)(model, context, options, names)));
 	};
 	return {
 		...api,
@@ -3624,6 +5677,16 @@ function createGeminiApi() {
 */
 const TERMINAL_EVENTS = /* @__PURE__ */ new Set(["error", "done"]);
 /**
+* A plugin-authored sentence for failures no retry can clear, or undefined.
+* Each carries no status token, so DSH shows it once instead of retrying.
+*/
+function explainFinalFailure(text) {
+	if (classifyCliUnavailable(text)) return explainCliUnavailable(text);
+	if (classifyCliOutdated(text)) return explainCliOutdated(text);
+	if (classifyTestMessagePolicy(text)) return explainTestMessagePolicyFailure();
+	if (classifyClientPolicy(text)) return text.includes("[Claude Code CLI]") ? explainCliClientPolicyFailure(text) : explainClientPolicyFailure();
+}
+/**
 * The api-key method pi-ai consults before it honours a request's `apiKey`
 * override. Resolution itself stays empty: this plugin authenticates from its
 * own key ring through the adapter, and ambient `PACKY_CODE_API_KEY` discovery
@@ -3639,8 +5702,12 @@ function keyRingAuth() {
 		})
 	} };
 }
-/** Build the route's pi-ai provider (unguarded; the plugin wraps its streams). */
-function createPackyCodeProvider() {
+/**
+* Build the route's pi-ai provider (unguarded; the plugin wraps its streams).
+* @param options - `claudeCli`, the Claude Code CLI transport selector for
+*   keys whose Claude group only serves the official client.
+*/
+function createPackyCodeProvider({ claudeCli } = {}) {
 	const provider = createProvider({
 		id: PROVIDER,
 		name: DISPLAY_NAME,
@@ -3650,7 +5717,7 @@ function createPackyCodeProvider() {
 		api: {
 			"openai-completions": openAICompletionsApi(),
 			"openai-responses": openAIResponsesApi(),
-			"anthropic-messages": createClaudeApi(),
+			"anthropic-messages": createClaudeApi({ cli: claudeCli }),
 			"google-generative-ai": createGeminiApi()
 		}
 	});
@@ -3698,18 +5765,12 @@ function guardKeyRotation(stream, { onKeyFailure, key } = {}) {
 		for (const carrierKey of ["error", "message"]) {
 			const carrier = value[carrierKey];
 			if (carrier === null || typeof carrier !== "object") continue;
-			if (classifyTestMessagePolicy(carrier.errorMessage)) return {
-				...value,
-				[carrierKey]: {
-					...carrier,
-					errorMessage: explainTestMessagePolicyFailure()
-				}
-			};
-			if (classifyClientPolicy(carrier.errorMessage)) return {
+			const explained = explainFinalFailure(carrier.errorMessage);
+			if (explained !== void 0) return {
 				...value,
 				[carrierKey]: {
 					...carrier,
-					errorMessage: explainClientPolicyFailure()
+					errorMessage: explained
 				}
 			};
 			const kind = classifyGatewayFailure(carrier.errorMessage);
@@ -3743,8 +5804,8 @@ function guardKeyRotation(stream, { onKeyFailure, key } = {}) {
 						const original = error instanceof Error ? error.message : String(error);
 						const text = redactSecrets(original, key === void 0 ? [] : [key]);
 						const cause = text === original ? error : new Error(text);
-						if (classifyTestMessagePolicy(text)) throw new Error(explainTestMessagePolicyFailure(), { cause });
-						if (classifyClientPolicy(text)) throw new Error(explainClientPolicyFailure(), { cause });
+						const explained = explainFinalFailure(text);
+						if (explained !== void 0) throw new Error(explained, { cause });
 						const kind = observed ? void 0 : classifyGatewayFailure(text);
 						if (kind !== void 0) {
 							report(kind, text);
@@ -3955,18 +6016,31 @@ function createPackyCodeProfile(provider) {
 		}, `${PLUGIN_ID}.retryPolicy`)
 	});
 }
+/** The initiating session's working directory, when the resolver knows it. */
+function workingDirectoryOf(resolveWorkingDirectory, sessionId) {
+	if (typeof resolveWorkingDirectory !== "function") return void 0;
+	try {
+		const cwd = resolveWorkingDirectory(sessionId);
+		return typeof cwd === "string" && cwd !== "" && !cwd.includes("\0") ? cwd : void 0;
+	} catch {
+		return;
+	}
+}
 /**
-* The HTTP route's adapter.
+* The route's adapter.
 *
 * Each request resolves the active key, then runs on the key the chooser picks
-* for its model; a key-level failure in the stream moves that key aside.
+* for its model; a key-level failure in the stream moves that key aside. A
+* Claude request on a key whose group only serves the official client is sent
+* by the Claude Code CLI (`claudeCli`); everything else is plain HTTP.
 * @param options - the key ring and chooser, the session id used when a caller
-*   supplies none, the attachment store image input is read from, and an
-*   optional synchronous resolver for the initiating session's exact cwd.
+*   supplies none, the attachment store image input is read from, an optional
+*   synchronous resolver for the initiating session's exact cwd, and the
+*   optional Claude Code CLI transport selector.
 * @returns a `PiAiAdapter` serving the `packycode` route.
 */
-function createRouteAdapter({ ring, keys, fallbackSessionId, resolveAttachments, resolveWorkingDirectory, isModelVisible = () => true }) {
-	const raw = createPackyCodeProvider();
+function createRouteAdapter({ ring, keys, fallbackSessionId, resolveAttachments, resolveWorkingDirectory, isModelVisible = () => true, claudeCli }) {
+	const raw = createPackyCodeProvider({ claudeCli });
 	/**
 	* The gateway's Codex-group check refuses a Responses request that carries
 	* no `prompt_cache_key` with a 403, which pi-ai derives from the session id.
@@ -4002,17 +6076,31 @@ function createRouteAdapter({ ring, keys, fallbackSessionId, resolveAttachments,
 		streamSimple: guarded("streamSimple")
 	});
 	const profiles = /* @__PURE__ */ new Map([[PROVIDER, createPackyCodeProfile(provider)]]);
+	/**
+	* Iterate one request inside its context: the transport reads the purpose
+	* and the initiating session's cwd from it where the request is sent.
+	*/
+	const inContext = (options, send) => {
+		const clarified = clarifyWorkingDirectory(options, resolveWorkingDirectory);
+		const cwd = workingDirectoryOf(resolveWorkingDirectory, options.sessionId);
+		return classifyRouteFailures(withRequestContext({
+			model: options.model,
+			...options.purpose === void 0 ? {} : { purpose: options.purpose },
+			...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },
+			...cwd === void 0 ? {} : { cwd }
+		}, send(clarified)));
+	};
 	return new class extends PiAiAdapter {
 		async prepareCall(provider, model, signal) {
 			const prepared = await super.prepareCall(provider, model, signal);
 			const title = TITLE_MODELS[model];
 			return {
 				...prepared,
-				stream: (options) => options.purpose === "session-title" && (title !== void 0 || model === "claude-haiku-5-5") ? this.stream(options) : classifyRouteFailures(prepared.stream(clarifyWorkingDirectory(options, resolveWorkingDirectory)))
+				stream: (options) => options.purpose === "session-title" && (title !== void 0 || model === "claude-haiku-5-5") ? this.stream(options) : inContext(options, (routedOptions) => prepared.stream(routedOptions))
 			};
 		}
 		stream(options) {
-			return classifyRouteFailures(super.stream(clarifyWorkingDirectory(titleRequest(options), resolveWorkingDirectory)));
+			return inContext(titleRequest(options), (routedOptions) => super.stream(routedOptions));
 		}
 		async listModels(provider) {
 			return (await super.listModels(provider)).filter((model) => isModelVisible(model.id));
@@ -4020,8 +6108,10 @@ function createRouteAdapter({ ring, keys, fallbackSessionId, resolveAttachments,
 	}({
 		profiles: () => profiles,
 		resolveApiKey: async () => {
-			const active = await keys.active();
+			const request = currentRequest();
+			const active = request === void 0 ? await ring.activeKey() : await keys.active();
 			if (active === void 0) throw new LlmError("No usable PackyCode API key: add one under Settings → PackyCode, or re-enable the keys this plugin moved past.", "MISSING_CREDENTIAL");
+			if (claudeCli?.followsGroups?.() === true && isClaudeModel(request?.model)) await keys.awaitGroups?.();
 			return active.key;
 		},
 		auth: Object.freeze({
@@ -4040,10 +6130,11 @@ function createRouteAdapter({ ring, keys, fallbackSessionId, resolveAttachments,
 * The loopback RPC surface behind the settings panel and the composer chip.
 *
 * Every reply carries only what this plugin owns: key labels and state, the
-* balance and group projections the host built, host overrides, the plugin
-* version, web search preferences and model visibility, bounded session-authorized
-* original PNG chunks, or a numbers-only session diagnosis. Key material never
-* crosses this boundary.
+* balance and group projections the host built, host overrides, whether this
+* device has the Claude Code CLI and which transport Claude requests take, the
+* plugin version, web search preferences and model visibility, bounded
+* session-authorized original PNG chunks, or a numbers-only session
+* diagnosis. Key material never crosses this boundary.
 *
 * @module dsh-packycode-api/rpc
 */
@@ -4065,15 +6156,16 @@ const keyId = (payload) => String(payload?.id ?? "");
 /**
 * Build the RPC handler.
 * @param options - the key ring, the balance and group readers, the host
-*   preference, and the optional plugin manager and web search controller
-*   (without one, its endpoints refuse).
+*   preference, and the optional Claude Code CLI support, plugin manager and
+*   web search controller (without one, its endpoints refuse).
 * @returns a handler for `connection.rpc.handle(CHANNEL, handler)`.
 */
-function createPackyCodeRpc({ ring, balance, groups, hosts, preference, pluginManager, search, modelSelection, images, imageOriginals, diagnostics }) {
+function createPackyCodeRpc({ ring, balance, groups, hosts, preference, claude, pluginManager, search, modelSelection, images, imageOriginals, diagnostics }) {
 	const need = (service, message) => {
 		if (service === void 0) throw new Error(message);
 		return service;
 	};
+	const cli = () => need(claude, "PackyCode Claude Code CLI support is unavailable in this runtime");
 	const manager = () => need(pluginManager, "PackyCode plugin version is unavailable");
 	const webSearch = () => need(search, "PackyCode web search is unavailable in this runtime");
 	const groupReader = () => need(groups, "PackyCode key groups are unavailable in this runtime");
@@ -4120,7 +6212,17 @@ function createPackyCodeRpc({ ring, balance, groups, hosts, preference, pluginMa
 				activeId: state.activeId
 			};
 		},
-		groups: (payload) => groupReader().read({ force: payload?.force === true }),
+		groups: async (payload) => {
+			const reading = await groupReader().read({ force: payload?.force === true });
+			if (claude === void 0) return reading;
+			return {
+				...reading,
+				keys: reading.keys.map((entry) => ({
+					...entry,
+					claudeTransport: claude.transportFor(entry.groups)
+				}))
+			};
+		},
 		"hosts/update": async (payload) => {
 			if (preference.writable !== true) throw new Error("PackyCode host overrides are not writable in this profile");
 			await preference.set({
@@ -4132,6 +6234,15 @@ function createPackyCodeRpc({ ring, balance, groups, hosts, preference, pluginMa
 			images?.invalidateBalance?.();
 			return status();
 		},
+		"claude-cli/status": (payload) => cli().status({ force: payload?.force === true }),
+		"claude-cli/install": () => {
+			cli().install();
+			return cli().status();
+		},
+		"claude-cli/update": async (payload) => {
+			await cli().update({ transport: payload?.transport });
+			return cli().status();
+		},
 		"plugin/version": (payload, signal) => manager().read({
 			force: payload?.force === true,
 			signal
@@ -5086,7 +7197,15 @@ const Config = z.object({
 	hiddenModels: live(z.array(z.string()).default([])),
 	imageEnabled: live(z.boolean().default(true)),
 	imageModel: live(z.union([...IMAGE_MODEL_IDS]).default(DEFAULT_IMAGE_MODEL)),
-	imageQuality: live(z.union([...IMAGE_QUALITIES]).default("auto"))
+	imageQuality: live(z.union([...IMAGE_QUALITIES]).default("auto")),
+	/**
+	* How Claude requests travel: `auto` sends a key in the `cc` group through
+	* the official Claude Code CLI and every other key over HTTP; `cli` and
+	* `http` pin one transport.
+	*/
+	claudeTransport: live(z.union([...CLAUDE_TRANSPORTS]).default(DEFAULT_CLAUDE_TRANSPORT)),
+	/** Path to the Claude Code CLI; empty means "the usual install places, then PATH". */
+	claudeCliPath: live(z.string().default(""))
 });
 function apply(ctx, config) {
 	const ring = new PackyCodeKeyRing(ctx.credentials);
@@ -5099,7 +7218,9 @@ function apply(ctx, config) {
 		hiddenModels: fieldValue(config?.hiddenModels),
 		imageEnabled: fieldValue(config?.imageEnabled),
 		imageModel: fieldValue(config?.imageModel),
-		imageQuality: fieldValue(config?.imageQuality)
+		imageQuality: fieldValue(config?.imageQuality),
+		claudeTransport: fieldValue(config?.claudeTransport),
+		claudeCliPath: fieldValue(config?.claudeCliPath)
 	});
 	const hosts = () => {
 		const current = source() ?? {};
@@ -5160,12 +7281,45 @@ function apply(ctx, config) {
 		isWritable: () => modelPreference.writable === true && typeof modelPreference.set === "function",
 		onChange: () => refreshModels()
 	});
+	/**
+	* Keys in a group that only serves the official client send their Claude
+	* requests through this device's Claude Code CLI. DSH's agent loop, tools,
+	* permissions and plan mode are unchanged; only the transport differs.
+	*/
+	const claudeCli = createClaudeCliManager({ explicitPath: () => fieldValue(source()?.claudeCliPath) });
+	const cliTransport = createClaudeCliTransport({
+		binary: async () => {
+			const found = await claudeCli.detect();
+			if (typeof found.path !== "string" || found.path === "") throw Object.assign(/* @__PURE__ */ new Error("Claude Code CLI is not installed"), { code: "CLAUDE_CLI_MISSING" });
+			return found.path;
+		},
+		version: () => claudeCli.lastDetection()?.version,
+		logger: ctx.logger
+	});
+	ctx.effect(() => () => {
+		cliTransport.close();
+	}, "packycode-api: Claude Code CLI processes");
+	const claudePreference = {
+		writable: false,
+		set: void 0
+	};
+	const claudeTransportPreference = () => readClaudeTransport(source()?.claudeTransport);
+	/** The transport a Claude request on this key takes, by its last group reading. */
+	const claudeTransportOf = (keyId) => claudeTransportFor({
+		preference: claudeTransportPreference(),
+		groups: keyId === void 0 ? void 0 : groups.groupsOf(keyId)
+	});
 	const registration = ctx.llm.registerAdapter([PROVIDER], createRouteAdapter({
 		ring,
 		keys,
 		fallbackSessionId,
 		resolveAttachments: attachments,
 		isModelVisible: modelSelection.isVisible,
+		claudeCli: Object.freeze({
+			followsGroups: () => claudeTransportPreference() === "auto",
+			choose: ({ apiKey, model }) => isClaudeModel(model) && claudeTransportOf(keys.idOf(apiKey)).transport === "cli",
+			fetch: (input, init, meta) => cliTransport.fetch(input, init, meta)
+		}),
 		resolveWorkingDirectory: (sessionId) => {
 			const session = currentSession();
 			return session && (sessionId === void 0 || session.id === sessionId) ? session.header?.cwd : void 0;
@@ -5249,7 +7403,8 @@ function apply(ctx, config) {
 		hostPreference,
 		searchPreference,
 		modelPreference,
-		imagePreference
+		imagePreference,
+		claudePreference
 	}));
 	ctx.on?.("loader/volatile-update", () => {
 		modelSelection.reconcile();
@@ -5291,6 +7446,30 @@ function apply(ctx, config) {
 		hosts,
 		preference: hostPreference,
 		pluginManager: createPackyCodePluginManager(),
+		claude: Object.freeze({
+			async status({ force = false } = {}) {
+				return {
+					...await claudeCli.status({ force }),
+					transport: claudeTransportPreference(),
+					writable: claudePreference.writable === true && typeof claudePreference.set === "function",
+					processes: cliTransport.stats()
+				};
+			},
+			install: () => claudeCli.install(),
+			async update({ transport } = {}) {
+				if (!CLAUDE_TRANSPORTS.includes(transport)) throw new Error("That PackyCode Claude transport is not supported");
+				if (claudePreference.writable !== true || typeof claudePreference.set !== "function") throw new Error("PackyCode settings are not writable in this profile");
+				try {
+					await claudePreference.set({ claudeTransport: transport });
+				} catch {
+					throw new Error("PackyCode could not save the Claude transport");
+				}
+			},
+			transportFor: (names) => claudeTransportFor({
+				preference: claudeTransportPreference(),
+				groups: names
+			})
+		}),
 		search,
 		modelSelection,
 		images,
@@ -5333,4 +7512,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { CHANNEL, Config, DEFAULT_API_HOST, DEFAULT_IMAGE_MODEL, DEFAULT_SEARCH_BACKEND, DEFAULT_STATUS_HOST, DIAGNOSTICS_FORMAT, DIAGNOSTICS_LIMITS, DISPLAY_NAME, IMAGE_MODELS, IMAGE_MODEL_IDS, IMAGE_QUALITIES, IMAGE_TIMEOUT_MS, IMAGE_TOOL_NAME, LEGACY_STATUS_HOSTS, MAX_IMAGE_BYTES, PACKYCODE_AUTO_SEARCH_PROVIDER_ID, PACKYCODE_MODELS, PACKYCODE_MODEL_IDS, PACKYCODE_SEARCH_PROVIDER_ID, PLUGIN_ID, PROVIDER, PackyCodeKeyRing, SEARCH_BACKENDS, SEARCH_BACKEND_MODELS, SEARCH_MODES, SETTINGS_NAMESPACE, TEST_MESSAGE_POLICY_CODE, apply, assertApiKey, buildSearchRequest, catalogCoverage, classifyClientPolicy, classifyGatewayFailure, classifyTestMessagePolicy, classifyUpstreamServerError, createBalanceReader, createDiagnostics, createGroupReader, createImageController, createKeyChooser, createModelSelectionController, createPackyCodeAutoSearchProvider, createPackyCodeImageClient, createPackyCodeImageTool, createPackyCodeProfile, createPackyCodeProvider, createPackyCodeRpc, createPackyCodeSearchProvider, createProfileSearchComposition, createRouteAdapter, createSearchComposition, createSearchController, decodeImagePng, explainClientPolicyFailure, explainTestMessagePolicyFailure, guardKeyRotation, inject, name, normalizeFailureMessage, normalizeHost, parseMessagesSearchResponse, parsePricing, parseResponsesSearchResponse, parseSelectedGroups, parseTokenUsage, pickKeyForModel, pngDimensions, readHiddenModels, readImagePreference, readSearchChoice, statusHostOrder, summarizeSessionEvents, validateImageOptions };
+export { CHANNEL, CLAUDE_INSTALL_COMMAND, CLAUDE_MISSING_MESSAGE, CLAUDE_NPM_PACKAGE, CLAUDE_TRANSPORTS, CLI_ONLY_GROUPS, CLI_SESSION_IDLE_MS, CLI_TOOL_NOTE, Config, DEFAULT_API_HOST, DEFAULT_CLAUDE_CONFIG_DIR, DEFAULT_CLAUDE_TRANSPORT, DEFAULT_IMAGE_MODEL, DEFAULT_SEARCH_BACKEND, DEFAULT_STATUS_HOST, DIAGNOSTICS_FORMAT, DIAGNOSTICS_LIMITS, DISPLAY_NAME, HTTP_CLAUDE_GROUPS, IMAGE_MODELS, IMAGE_MODEL_IDS, IMAGE_QUALITIES, IMAGE_TIMEOUT_MS, IMAGE_TOOL_NAME, LEGACY_STATUS_HOSTS, MAX_IMAGE_BYTES, MAX_LIVE_CLI_SESSIONS, MCP_SERVER_NAME, MCP_TOOL_PREFIX, PACKYCODE_AUTO_SEARCH_PROVIDER_ID, PACKYCODE_MODELS, PACKYCODE_MODEL_IDS, PACKYCODE_SEARCH_PROVIDER_ID, PLUGIN_ID, PROVIDER, PackyCodeKeyRing, SEARCH_BACKENDS, SEARCH_BACKEND_MODELS, SEARCH_MODES, SETTINGS_NAMESPACE, TEST_MESSAGE_POLICY_CODE, apply, assertApiKey, baseUrlOf, buildCliArgs, buildCliEnvironment, buildSearchRequest, buildTranscript, canonicalMessage, catalogCoverage, classifyCliOutdated, classifyCliUnavailable, classifyClientPolicy, classifyGatewayFailure, classifyTestMessagePolicy, classifyUpstreamServerError, claudeBinaryCandidates, claudeTransportFor, cliErrorMessage, cliToolName, createBalanceReader, createClaudeCliManager, createClaudeCliTransport, createClaudeToolNames, createDiagnostics, createGroupReader, createImageController, createKeyChooser, createModelSelectionController, createPackyCodeAutoSearchProvider, createPackyCodeImageClient, createPackyCodeImageTool, createPackyCodeProfile, createPackyCodeProvider, createPackyCodeRpc, createPackyCodeSearchProvider, createProfileSearchComposition, createRouteAdapter, createSearchComposition, createSearchController, decodeImagePng, describeRequest, dshSystemText, explainCliClientPolicyFailure, explainCliOutdated, explainCliUnavailable, explainClientPolicyFailure, explainNpmFailure, explainTestMessagePolicyFailure, guardKeyRotation, inject, locateClaudeBinary, locateNpm, name, normalizeFailureMessage, normalizeHost, parseClaudeVersion, parseMessagesSearchResponse, parsePricing, parseResponsesSearchResponse, parseSelectedGroups, parseTokenUsage, pickKeyForModel, planContinuation, pngDimensions, readClaudeTransport, readHiddenModels, readImagePreference, readSearchChoice, resolveSpawnCommand, splitConversation, startClaudeCliSession, startClaudeMcpBridge, statusHostOrder, summarizeSessionEvents, toolResultToMcp, validateImageOptions };