dsh-packycode-api 1.3.5 → 1.3.7

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 1.3.7
+
+- **The CLI card also offers the update when a newer Claude Code is out.** Until now **Update Claude Code CLI** only appeared for a CLI older than 2.1.259. The plugin now reads the newest release on the host, from `https://registry.npmjs.org/@anthropic-ai/claude-code/latest` (npm's `latest` and the native installer's `latest` channel named the same 2.1.303 when checked), with a 10-second timeout and redirects refused, at most once every 30 minutes, again after 2 minutes when it got no answer, and at once when **Check again** is clicked. A CLI that works but is behind gets a note naming the new version, the same button and the command it runs; the installed version keeps working, so it is not marked too old. Without an answer from npm no update is offered. The update itself is unchanged: `claude update` for the native installer, npm with `--allow-scripts` for an npm install. Its outcome is now judged for a CLI that already worked: a run that changed nothing while a newer version exists fails with the installer's own output (for example Homebrew's `brew upgrade claude-code`) instead of reading as "updated", a failed command that changed nothing reports that failure, and a clean run with the newest release unknown says the version is unchanged.
+- Validation, 2026-10-19: 467 offline tests (new: the newest-release reader's URL, timeout, refused redirects, cache, forced re-read and silent failures; `updateAvailable` for a CLI behind, at, or without a newest release; an update from behind to latest; a clean run that left the CLI behind, a failed run that changed nothing, and a no-op run; the card's note, button, progress and outcomes), both rebuilt bundles and the versioned tarball. Live, the built manager read this device's native CLI as 2.1.295 and npm's latest as 2.1.303 and offered the update (887 ms for both reads). In a scratch HOME and npm prefix, an npm install of 2.1.295 was offered the update with the npm command, and the built `update()` took it to 2.1.303 in 36 s, after which no update was offered; the device's own CLI stayed untouched. The native `claude update` path was not run again; it is unchanged from 1.3.5. The card was checked through the client tests, not in DeepSeek Harness.
+- **GPT web search works again.** With the GPT backend, every search failed with "PackyCode search returned no web_search_call". The search did run: PackyCode's Codex channel answers a non-streaming `/v1/responses` request with `status: completed`, `tool_usage.web_search.num_requests: 1` and about 16K input tokens, but an empty `output`. Streamed, the same request carries the preamble, each `web_search_call` and the cited answer as `response.output_item.done` events, then ends on a `response.completed` whose `output` is empty as well. The GPT backend now streams (`stream: true`) and rebuilds the output from those events in `output_index` order; a final event that does carry output is used as it is, and a channel that answers with one JSON body is read as before. Sources and the summary come from the same items as before. A body with no output at all now says the gateway did not pass the result on, instead of claiming the model ran no search.
+- **A full upstream is resent inside the search.** The channel relays OpenAI's "Temporary capacity limit. Please try again in 2s." (`rate_limit_exceeded`) and its `server_error` inside the 200 stream, before any output, so the gateway cannot resend them itself. The search resends on the same key after the pause the message names (1 s when it names none; a pause over 5 s is reported instead), at most twice, as the official Codex client resends them. Quota and key wording are never resent, and no key is moved aside for this. When it persists, the error names the model and suggests the DeepSeek backend. Any other failure relayed in the stream is reported at once as "failed upstream", not as HTTP 200.
+- **Every GPT search sends a `prompt_cache_key`.** The Codex group answers a Responses request without one with a 403 ("请使用标准 Codex 客户端"; 3 of 3 live, while 3 of 3 with one were accepted). DSH's searches already carried the session id or the plugin's fallback id; a caller that names no session, such as `scripts/live-check.mjs --with-search`, now gets one id per provider, as the model route does.
+- Validation, 2026-10-21: 480 offline tests (new: the empty-output message; the stream reader rebuilding the output in index order, keeping a final event's own output, surviving CRLF, bare CR and chunks split mid-line and mid-character, turning `error` / `response.failed` into the body error and refusing a stream without a final event; which upstream errors are resent and after which pause; a GPT search that streams, always sends a cache key, resends a capacity refusal on the same key without blaming it, reports a persisting one after three attempts and any other one at once; cancellation during the pause and mid-stream), both rebuilt bundles and the versioned tarball. Against a local server, a stream that stalls ends at the request timeout as "no answer within", and a cancel ends it as `WEB_ABORTED`. Live with a key in `codex`: non-streaming `gpt-6.1-sol` searches returned `completed` with an empty `output` 3 of 3 times, and the streams checked for it ended on an empty final `output` with every item in `response.output_item.done`. 28 live GPT searches parsed through the rebuild; through the built provider they returned 13–20 sources and a 1.0–1.8K-character summary in 14.6–29.9 s (one more ran past the test script's own 30 s cancel; DSH's desktop presets give `web_search` 60 s). `node scripts/live-check.mjs --with-search` passed every HTTP model, the rotation and the classification; DeepSeek search returned 10 sources in 6.0 s, and GPT search met the upstream capacity limit on all three attempts and reported it with the new message. The capacity limit is upstream: `gpt-6.1-sol`, `gpt-5.6-sol` and `gpt-6-astra` searches each met it about once in five, plain requests never. One existing CLI test that aborts after 300 ms failed in two full runs while the machine was heavily loaded (it also fails on its own at the unchanged HEAD); the final full run passed all 480.
+
+## 1.3.6
+
+- **DeepSeek Flash runs over Responses.** `deepseek-flash` moves from `openai-completions` to `openai-responses`; the base URL stays `https://cf.api.fan/v1`, so requests now go to `/v1/responses` instead of `/v1/chat/completions`. PackyCode's `/api/pricing` lists `openai-response` among the model's endpoints, for the same groups (`deepseek-officially`, `deepseek-sale`). The effort levels are unchanged (`off`, `low`, `high`, `max`), and so is `thinkingLevelMap`: `off` now sends `reasoning.effort: "none"`, which the gateway answers with no reasoning item and zero reasoning tokens. The Chat Completions dialect (`thinkingFormat: 'deepseek'`, `max_tokens`, reasoning content on assistant messages) is gone with it; reasoning comes back as `reasoning_text` items, which pi-ai streams as thinking and sends back with the turn's tool calls. Like Grok, DeepSeek omits `prompt_cache_key`: the gateway accepts the field, but its prefix cache already hits without it. Image input is sent as `input_image`. The 384,000-token output ceiling stays under the gateway's Responses limit of 393,216. No catalog model uses Chat Completions any more, so the provider no longer registers that API; the group probe still uses `/v1/chat/completions`, which needs no model. A session that ran on Chat Completions continues over Responses: pi-ai sends its earlier thinking as text and keeps its tool calls.
+- Validation, 2026-10-19: 461 offline tests (new: DeepSeek's Responses efforts and `off` → `none` without a cache key, reasoning streamed as thinking and replayed with its tool call, the vision payload as `input_image`, and the key-choice gateway answering on Responses), both rebuilt bundles and the versioned tarball. Live against the gateway with a `deepseek-officially` key: direct `/v1/responses` requests for `deepseek-flash` returned 200 at `none`, `minimal`, `low`, `medium`, `high`, `xhigh` and `max`, with no reasoning item at `none`; `max_output_tokens` up to 393,216 was accepted and 500,000 refused. Through the plugin's provider, four-turn tool conversations passed at `high`, `max`, `off`, mixed efforts, and with replayed reasoning items (up to three in one request); the prefix cache hit without `prompt_cache_key`; a conversation started over Chat Completions continued over Responses. `scripts/live-check.mjs` passed for all ten models, key rotation (an invalid key on `deepseek-flash` was disabled and the real key answered) and the RPC projections, and `--model deepseek-flash --with-vision` named both color fixtures. Not checked in DeepSeek Harness itself; no DSH restart.
+
 ## 1.3.5
 
 - **An outdated Claude Code CLI is caught before the request, and the CLI card updates it.** 1.3.4 always passes `--permission-prompts none`, which Claude Code added in 2.1.259 (2026-09-02). A colleague's CLI from the official installer was 2.1.223 (2026-08-05): it rejected the option at start-up, every `cc` Claude turn failed with "the installed Claude Code CLI is too old", and the card still showed it as installed. The plugin now requires 2.1.259 or later. An older detected CLI is refused before it is started, with the detected and required versions; a cached detection that looks outdated is probed again first, so a CLI updated in a terminal is used at once. The card marks such a CLI **too old** and offers **Update Claude Code CLI**. A CLI from the official installer (or any install that is not npm's) is updated with `claude update`, run with the plugin's own CLI home and without the user's `ANTHROPIC_*` / `CLAUDE_*` / `DISABLE_*` variables. An npm global install is updated by npm itself — the npm beside the CLI, which owns its prefix — with `npm install -g @anthropic-ai/claude-code@latest --allow-scripts=@anthropic-ai/claude-code`. The update succeeds only when the CLI detected afterwards is new enough; otherwise the card says whether it stayed old (for example a Homebrew install), stopped running, or could not download, with the command's output. The CLI's flags and environment for requests are unchanged.

package/README.en.md

@@ -47,10 +47,10 @@ You need **DeepSeek Harness** and a **PackyCode (PackyAPI) API key**. For DSH se
 Open the desktop application's **Plugins** page, click **Add plugin**, and enter the package name **with a version** as the **package name or address**:
 
 ```text
-dsh-packycode-api@1.3.5
+dsh-packycode-api@1.3.7
 ```
 
-Choose the **official** install source, then click **Install**. `1.3.5` was the latest release when this was written; the [npm page](https://www.npmjs.com/package/dsh-packycode-api) shows the current one.
+Choose the **official** install source, then click **Install**. `1.3.7` was the latest release when this was written; the [npm page](https://www.npmjs.com/package/dsh-packycode-api) shows the current one.
 
 > **Always include the version.** With a bare `dsh-packycode-api`, the install prompt shows the newest version on npm, but DSH's bundled pnpm by default installs only versions published at least 24 hours ago, so you can end up several releases behind with no sign of it in the prompt. With an exact version, pnpm installs that version and adds it to the profile's `minimumReleaseAgeExclude` itself. Afterwards, check **Current version** under **Settings → PackyCode → Plugin version**.
 
@@ -71,7 +71,7 @@ Choose a model from the `PackyCode` group. All ten models use the plugin’s HTT
 
 The **Plugins** page shows the installed state and version, and is also where you enable, disable, or uninstall.
 
-**For non-desktop profiles only:** `dsh plugin --profile <name> add dsh-packycode-api@1.3.5`. Do not use it for `desktop` — the CLI refuses it (`profile "desktop" is managed exclusively by the Electron application`).
+**For non-desktop profiles only:** `dsh plugin --profile <name> add dsh-packycode-api@1.3.7`. Do not use it for `desktop` — the CLI refuses it (`profile "desktop" is managed exclusively by the Electron application`).
 
 For a local checkout, keep the `link:` prefix: `dsh plugin --profile <name> add link:/path/to/dsh-packycode-api`. **Do not pass a bare path or `file:`** — that install copies the whole checkout, `node_modules` included, into the profile, where it then shadows the packages the DSH installation itself provides and the plugin looks uninstalled; see the FAQ. If you already installed that way, uninstall first and reinstall as above.
 
@@ -89,7 +89,7 @@ A profile without a browser can still use the model route. It just has no settin
 
 **Read the balance.** Each key under **Accounts and keys** shows its own remaining, used, and limit (limit = remaining + used); an unlimited key shows **No quota limit**. Keys are not added up into a total. An API key can read only its own quota, not the PackyCode account's balance, so check the account balance in the PackyCode console. A key that could not be read says why on its own row; a key whose read failed this time but succeeded before keeps showing its last balance with the time it was read (the composer shows it as `≈US$…`) until DSH restarts. The composer shows the active key's remaining balance only while a PackyCode model is selected. **Refresh** bypasses the roughly 60-second cache. The default model host is `https://cf.api.fan` and the balance host is `https://www.packyapi.ai`; both can be changed under **Advanced: endpoints**. The old default, `https://www.packyapi.com`, is DNS-poisoned on mainland networks and answers `fetch failed` without a proxy; even when settings still name it, `.ai` is tried first.
 
-**Use Claude.** Select any Claude model. When the key is in the `cc` group, the plugin sends the request with this device's official Claude Code CLI, so install it first under **Settings → PackyCode → Claude Code CLI** (or run `npm install -g @anthropic-ai/claude-code --allow-scripts=@anthropic-ai/claude-code`), and click **Update Claude Code CLI** there when it is too old; keys in `cc-sale`, `cc-expensive`, `claude-officially` and other groups use the plugin's HTTP route and need no CLI. Under **Accounts and keys**, every key that reaches Claude is marked “Claude via official CLI” or “Claude via HTTP”; the groups alone decide the route, and it cannot be switched by hand. On both routes DSH executes every tool under its own permissions, and plan mode, questions, todos, subagents, attachments, reasoning effort and history behave as for any other model. See “Claude Code CLI route” below.
+**Use Claude.** Select any Claude model. When the key is in the `cc` group, the plugin sends the request with this device's official Claude Code CLI, so install it first under **Settings → PackyCode → Claude Code CLI** (or run `npm install -g @anthropic-ai/claude-code --allow-scripts=@anthropic-ai/claude-code`), and click **Update Claude Code CLI** there when it is too old or a newer version is out; keys in `cc-sale`, `cc-expensive`, `claude-officially` and other groups use the plugin's HTTP route and need no CLI. Under **Accounts and keys**, every key that reaches Claude is marked “Claude via official CLI” or “Claude via HTTP”; the groups alone decide the route, and it cannot be switched by hand. On both routes DSH executes every tool under its own permissions, and plan mode, questions, todos, subagents, attachments, reasoning effort and history behave as for any other model. See “Claude Code CLI route” below.
 
 **Web search.** DSH's `web_search` calls DeepSeek's official API by default (billed to `DEEPSEEK_API_KEY`). **Settings → PackyCode → Web search** can route it through PackyCode instead:
 
@@ -139,7 +139,7 @@ PackyCode's `cc` group (“claude code专用”) only serves the official Claude
 - **DSH's prompt and history, unchanged.** DSH's system prompt is appended to the CLI's own; the history (text, images, signed thinking, tool calls and results) is written as a CLI transcript and resumed; the reasoning effort is passed as `--effort`.
 - **One long-lived process per conversation.** A DSH session keeps one CLI process per model: tool results and the next user turn continue it, so requests keep one cacheable prefix. After compaction, a plan-mode switch or a key change, a new process is resumed from DSH's full history; session titles and compaction use one-shot processes. A process idle for 20 minutes stops; at most 8 stay alive.
 - **Isolated from your own Claude Code.** It runs with its own config home, `~/.dsh/packycode-claude-cli`, and never reads `~/.claude` settings, CLAUDE.md, MCP configuration or logins; only the key stored in the plugin is passed to the child. Auto-update, telemetry, auto-compaction, auto-memory and model fallback are off, and retries are left to DSH's retry policy, which rotates keys.
-- **An outdated CLI is one click away from current.** The plugin needs Claude Code 2.1.259 or later (the first release with the `--permission-prompts` option it passes). An older CLI is stopped before the request with an explanation, and the CLI card marks it too old and offers **Update Claude Code CLI**: an install from the official installer (`~/.local/bin/claude`) runs `claude update`; an npm global install runs `npm install -g @anthropic-ai/claude-code@latest --allow-scripts=@anthropic-ai/claude-code`, because npm 12 skips install scripts by default and `claude update` does not allow them on an npm install, which leaves a CLI that cannot run. Your Claude Code is only updated when you click that button.
+- **An outdated CLI is one click away from current.** The plugin needs Claude Code 2.1.259 or later (the first release with the `--permission-prompts` option it passes). An older CLI is stopped before the request with an explanation, and the CLI card marks it too old and offers **Update Claude Code CLI**: an install from the official installer (`~/.local/bin/claude`) runs `claude update`; an npm global install runs `npm install -g @anthropic-ai/claude-code@latest --allow-scripts=@anthropic-ai/claude-code`, because npm 12 skips install scripts by default and `claude update` does not allow them on an npm install, which leaves a CLI that cannot run. When the CLI works but is not the latest release, the card names the new version and offers the same button: the plugin reads `latest` of `@anthropic-ai/claude-code` from npm on this device (the same version as the native installer's `latest` channel), at most once every 30 minutes, and again when you click Check again; without an answer it offers nothing. Your Claude Code is only updated when you click that button.
 - **Failures say why.** A missing CLI, an outdated CLI, and a request from the official CLI that the gateway still refuses each get their own explanation; nothing switches to another route or provider, and no key is disabled.
 
 Known differences: starting a process takes about 0.3–1 s; when a process is resumed in the middle of a tool turn, the CLI adds “Continue from where you left off.” after the tool results, as the official client does. Requires Claude Code 2.1.259 or later (tested with 2.1.295 and 2.1.303). On Windows, Claude Code also needs Git for Windows.
@@ -170,7 +170,7 @@ Live checks on 2026-10-15 passed generation and editing at `low` on all three en
 
 | Model | How it runs | Effort | Token group |
 | --- | --- | --- | --- |
-| `deepseek-flash` | HTTP, chat/completions, images allowed | Can be off; `low` / `high` / `max` | `deepseek-officially`, `deepseek-sale` |
+| `deepseek-flash` | HTTP, Responses, images allowed | Can be off; `low` / `high` / `max` | `deepseek-officially`, `deepseek-sale` |
 | `gpt-6.1-sol` | HTTP, Responses, images allowed | Cannot be off; `low` / `medium` / `high` / `xhigh` / `max` | `codex`, `codex-sale` |
 | `gpt-6-astra` | Same | Same | Same |
 | `gpt-5.6-sol` | Same | Same | Same |
@@ -183,7 +183,7 @@ Live checks on 2026-10-15 passed generation and editing at `low` on all three en
 
 A model in the list does not mean the current token group allows it. When changing groups, do not drop the group that serves the model you still want.
 
-All ten models in the current catalog declare text and image input. DeepSeek Flash follows the [official vision guide](https://api-docs.deepseek.com/guides/vision/); images are read through DSH's attachment service and sent with the Chat Completions request.
+All ten models in the current catalog declare text and image input. DeepSeek Flash follows the [official vision guide](https://api-docs.deepseek.com/guides/vision/); images are read through DSH's attachment service and sent with the Responses request.
 
 Gemini capabilities and limits follow Google's model pages: [Gemini 4 Argon](https://ai.google.dev/gemini-api/docs/models/gemini-4-argon), [Gemini 3.8 Flash](https://ai.google.dev/gemini-api/docs/models/gemini-3.8-flash). Both models use the native Gemini protocol through `/v1beta/models/{model}:streamGenerateContent`, streaming text, thinking and tool calls; images are read through DSH's attachment service. Thinking levels are sent with `thinkingLevel`. Both routes use the single-stream output limit without automatic continuation beyond 65,536 tokens. Available endpoints and groups follow the [PackyAPI live model catalog](https://www.packyapi.com/api/pricing).
 
@@ -191,7 +191,9 @@ Gemini capabilities and limits follow Google's model pages: [Gemini 4 Argon](htt
 
 Grok 4.7's context and reasoning levels follow the [official guide](https://docs.x.ai/developers/grok-4-7). There is no separate text-output limit; the plugin uses the context size as its numeric output ceiling, bounded by the remaining context per request.
 
-Only GPT Responses requests keep `prompt_cache_key`; other Responses models omit it by default. This gateway's Grok route reports a misleading `Incorrect API key provided` error when the field is present.
+Only GPT Responses requests keep `prompt_cache_key`; other Responses models omit it by default. This gateway's Grok route reports a misleading `Incorrect API key provided` error when the field is present, and DeepSeek Flash hits its prefix cache without it.
+
+DeepSeek Flash uses the gateway's Responses endpoint (`/api/pricing` lists `openai-response`). With effort off it sends `reasoning.effort: "none"`, and the gateway answers without reasoning; otherwise reasoning comes back as `reasoning_text` and is sent back with the same turn's tool calls.
 
 <details>
 <summary>Protocol, group and client compatibility</summary>
@@ -214,9 +216,9 @@ Only GPT Responses requests keep `prompt_cache_key`; other Responses models omit
 
 ## Update and uninstall
 
-> **Upgrading from 1.3.2 or earlier:** install `dsh-packycode-api@1.3.5` on the Plugins page instead of clicking **Update plugin** in the old settings card. The old button bypasses pnpm's release-age policy: if the version it installs is less than 24 hours old, the profile refuses every other plugin install until that version is 24 hours old. After the install and a restart, the button is the fixed one, and later updates can use it.
+> **Upgrading from 1.3.2 or earlier:** install `dsh-packycode-api@1.3.7` on the Plugins page instead of clicking **Update plugin** in the old settings card. The old button bypasses pnpm's release-age policy: if the version it installs is less than 24 hours old, the profile refuses every other plugin install until that version is 24 hours old. After the install and a restart, the button is the fixed one, and later updates can use it.
 
-**Update:** open **Settings → PackyCode** and, when a newer version is listed, click **Update plugin**. It installs that exact version into the owning profile with DSH's bundled pnpm and reads `package.json` back before reporting success. The install keeps pnpm's release-age policy instead of overriding it: by default pnpm installs the version at once and records it in the profile's `minimumReleaseAgeExclude`; under a stricter pnpm policy the button says when the update can run. A local `link:` checkout does not get the button. Then quit and reopen the desktop application. A page refresh does not reload the Host. Reinstalling from the **Plugins** page works too, again with the version in the package name (for example `dsh-packycode-api@1.3.5`); without it you may get a version that is merely the newest one published at least 24 hours ago.
+**Update:** open **Settings → PackyCode** and, when a newer version is listed, click **Update plugin**. It installs that exact version into the owning profile with DSH's bundled pnpm and reads `package.json` back before reporting success. The install keeps pnpm's release-age policy instead of overriding it: by default pnpm installs the version at once and records it in the profile's `minimumReleaseAgeExclude`; under a stricter pnpm policy the button says when the update can run. A local `link:` checkout does not get the button. Then quit and reopen the desktop application. A page refresh does not reload the Host. Reinstalling from the **Plugins** page works too, again with the version in the package name (for example `dsh-packycode-api@1.3.7`); without it you may get a version that is merely the newest one published at least 24 hours ago.
 
 **Coming back from a local-path install, uninstall first.** An update is a `pnpm add`: it rewrites the files inside the package directory and leaves a `node_modules` that an earlier local-path install left there. That older tree keeps shadowing the packages the DSH installation provides, so the plugin row fails to load with no visible reason. **Uninstall** runs `pnpm remove`, which deletes the package directory outright — only a reinstall after that is clean. `node scripts/install-check.mjs` reports whether a profile is in that state.
 
@@ -232,7 +234,7 @@ ls ~/.dsh/profiles/desktop/node_modules/dsh-packycode-api/node_modules
 
 Output means a leftover tree: a registry install ships no `node_modules`, so this one usually comes from an earlier local-path install (`file:`, or a bare path instead of `link:`). It sits inside the profile directory, and DSH resolves a plugin's imports from inside the profile first, so the plugin gets those old copies — for example `@deepseek-ai/schemastery` 3.18.2, which has no `Schema.volatile()`, so the module throws while it is imported. When an import fails the Loader creates no fiber for that row and no client bundle is composed either, so the model route, the RPC channel, and the settings panel all stay absent.
 
-Recovery: **uninstall** the plugin on the **Plugins** page, **install** it again with the version in the package name (for example `dsh-packycode-api@1.3.5`), then quit and reopen the desktop application. Uninstall runs `pnpm remove` and deletes the whole package directory; reinstalling or clicking **Update** only rewrites files and keeps the leftover tree. Deleting that `node_modules` by hand and restarting works too.
+Recovery: **uninstall** the plugin on the **Plugins** page, **install** it again with the version in the package name (for example `dsh-packycode-api@1.3.7`), then quit and reopen the desktop application. Uninstall runs `pnpm remove` and deletes the whole package directory; reinstalling or clicking **Update** only rewrites files and keeps the leftover tree. Deleting that `node_modules` by hand and restarting works too.
 
 **Right after a first install, every card in Settings shows `transport failure for /packycode-api/…: HTTP 405`?** The installed version is 1.1.6 or earlier, usually because only the bare package name was entered: the install prompt shows the newest version, but pnpm installs the newest one published at least 24 hours ago (see **Install the plugin**). Those older versions can register their settings channel only after DSH restarts and rebuilds its `connection` service. So right after a first install `/packycode-api` does not exist yet, requests fall through to the static page, and it answers 405; the model route and the settings panel itself load normally. From 1.1.7 on, a first install needs no restart. Check which version was installed:
 

package/README.md

@@ -47,10 +47,10 @@
 打开桌面应用的**插件**页，点击**添加插件**，在**包名或地址**中填入**带版本号**的包名：
 
 ```text
-dsh-packycode-api@1.3.5
+dsh-packycode-api@1.3.7
 ```
 
-在**安装源**中选择**官方源**，然后点击**安装**。`1.3.5` 是写这份说明时的最新版，当前最新版本号以 [npm 页面](https://www.npmjs.com/package/dsh-packycode-api) 为准。
+在**安装源**中选择**官方源**，然后点击**安装**。`1.3.7` 是写这份说明时的最新版，当前最新版本号以 [npm 页面](https://www.npmjs.com/package/dsh-packycode-api) 为准。
 
 > **一定要带版本号。** 只填 `dsh-packycode-api` 时，安装前的提示显示的是 npm 上的最新版，但 DSH 自带的 pnpm 默认只安装发布满 24 小时的版本，实际装上的可能是好几个版本之前的旧版，而安装提示里看不出这一点。填写精确版本时，pnpm 会直接安装这个版本，并自动把它加入 profile 的 `minimumReleaseAgeExclude`。装好后可以在 **设置 → PackyCode → 插件版本** 核对「当前版本」。
 
@@ -71,7 +71,7 @@ dsh-packycode-api@1.3.5
 
 桌面应用的**插件**页可以看到已安装状态与版本，也可以在那里启用、停用或卸载。
 
-**仅用于非 desktop profile：** `dsh plugin --profile <name> add dsh-packycode-api@1.3.5`。不要对 `desktop` 使用它 —— CLI 会直接拒绝（`profile "desktop" is managed exclusively by the Electron application`）。
+**仅用于非 desktop profile：** `dsh plugin --profile <name> add dsh-packycode-api@1.3.7`。不要对 `desktop` 使用它 —— CLI 会直接拒绝（`profile "desktop" is managed exclusively by the Electron application`）。
 
 本地开发要加 `link:` 前缀：`dsh plugin --profile <name> add link:/path/to/dsh-packycode-api`。**不要直接写路径（或 `file:`）** —— 那样的安装会把整个仓库目录（连同 `node_modules`）复制进 profile，之后它会在 profile 内部挡住 DSH 自带的包，插件看起来像没装，见「常见问题」。已经那样装过的话，先卸载再按上面的方式重装。
 
@@ -89,7 +89,7 @@ dsh-packycode-api@1.3.5
 
 **看余额。** 「账户与 Key」里每个 Key 显示它自己的剩余、已用与额度（额度 = 剩余 + 已用），不限额的 Key 显示「不限额度」；多个 Key 不相加成合计。API Key 只能读到自己的额度，读不到 PackyCode 账号的总余额，账号余额请到 PackyCode 控制台查看。读失败的 Key 会在它那一行注明原因；某个 Key 这次读失败但之前读到过，会继续显示上次的余额并注明读取时间（输入框里显示为 `≈US$…`），重启 DSH 后才清空。输入框右侧只在选中 PackyCode 模型时显示当前 Key 的剩余额度。「刷新」会跳过约 60 秒的缓存。默认模型接口是 `https://cf.api.fan`，余额接口是 `https://www.packyapi.ai`，可在「高级：接口地址」里改。旧默认值 `https://www.packyapi.com` 在国内网络下 DNS 被污染、直连会 `fetch failed`，即使设置里保存的是它，插件也会先试 `.ai`。
 
-**用 Claude。** 直接选择三个 Claude 模型之一。Key 在 `cc` 分组时，插件用本机的官方 Claude Code CLI 发出请求，需要先在 **设置 → PackyCode → Claude Code CLI** 一键安装（或自行 `npm install -g @anthropic-ai/claude-code --allow-scripts=@anthropic-ai/claude-code`），版本过低时在同一处点「更新 Claude Code CLI」；`cc-sale`、`cc-expensive`、`claude-officially` 等分组直接走插件内 HTTP，不需要 CLI。「账户与 Key」里每个能用 Claude 的 Key 会标出「Claude 经官方 CLI」或「Claude 经 HTTP」，通道只由分组决定，不能手动切换。无论哪条通道，工具都由 DSH 执行并按 DSH 的权限审批，计划模式、提问、待办、子代理、附件、思考档位和历史都和其它模型一样。详见下方「Claude Code CLI 通道」。
+**用 Claude。** 直接选择三个 Claude 模型之一。Key 在 `cc` 分组时，插件用本机的官方 Claude Code CLI 发出请求，需要先在 **设置 → PackyCode → Claude Code CLI** 一键安装（或自行 `npm install -g @anthropic-ai/claude-code --allow-scripts=@anthropic-ai/claude-code`），版本过低或有新版本时在同一处点「更新 Claude Code CLI」；`cc-sale`、`cc-expensive`、`claude-officially` 等分组直接走插件内 HTTP，不需要 CLI。「账户与 Key」里每个能用 Claude 的 Key 会标出「Claude 经官方 CLI」或「Claude 经 HTTP」，通道只由分组决定，不能手动切换。无论哪条通道，工具都由 DSH 执行并按 DSH 的权限审批，计划模式、提问、待办、子代理、附件、思考档位和历史都和其它模型一样。详见下方「Claude Code CLI 通道」。
 
 **网页搜索。** DSH 的 `web_search` 默认调用 DeepSeek 官方接口（用 `DEEPSEEK_API_KEY` 计费）。在 **设置 → PackyCode → 网页搜索** 里可以改走 PackyCode：
 
@@ -139,7 +139,7 @@ PackyCode 的 `cc` 分组（「claude code专用」）只接受官方 Claude Cod
 - **提示与历史保持 DSH 原样。** DSH 的系统提示追加在 CLI 官方提示之后；历史（文字、图片、带签名的思考、工具调用与结果）由插件写成 CLI 的会话记录后续接，思考档位以 `--effort` 传入。
 - **一个会话一个常驻进程。** 同一个 DSH 会话、同一模型复用一个 CLI 进程：工具结果和下一轮消息直接续接，请求前缀不变，网关缓存照常命中。历史被压缩、切换计划模式或换 Key 时，用 DSH 的完整历史恢复一个新进程；会话标题和压缩用一次性进程。空闲 20 分钟的进程自动结束，最多同时保留 8 个。
 - **与你自己的 Claude Code 隔离。** 使用独立配置目录 `~/.dsh/packycode-claude-cli`，不读取 `~/.claude` 的设置、CLAUDE.md、MCP 配置和登录状态；只把插件保存的 Key 交给子进程。自动更新、遥测、自动压缩、自动记忆和模型回退都关闭，失败重试交还给 DSH 的重试策略（会按 Key 轮换）。
-- **版本过低一键更新。** 插件需要 Claude Code 2.1.259 或更新版本（插件传入的 `--permission-prompts` 从这一版开始提供）。更旧的 CLI 在请求发出前就被拦下并说明原因，CLI 卡片标出「版本过低」并提供「更新 Claude Code CLI」：官方安装器（`~/.local/bin/claude`）装的执行 `claude update`；npm 全局安装的执行 `npm install -g @anthropic-ai/claude-code@latest --allow-scripts=@anthropic-ai/claude-code`，因为 npm 12 默认不运行安装脚本，而 `claude update` 在 npm 安装上不会放行脚本，会留下一个无法运行的 CLI。只有点这个按钮时才会更新你的 Claude Code。
+- **版本过低一键更新。** 插件需要 Claude Code 2.1.259 或更新版本（插件传入的 `--permission-prompts` 从这一版开始提供）。更旧的 CLI 在请求发出前就被拦下并说明原因，CLI 卡片标出「版本过低」并提供「更新 Claude Code CLI」：官方安装器（`~/.local/bin/claude`）装的执行 `claude update`；npm 全局安装的执行 `npm install -g @anthropic-ai/claude-code@latest --allow-scripts=@anthropic-ai/claude-code`，因为 npm 12 默认不运行安装脚本，而 `claude update` 在 npm 安装上不会放行脚本，会留下一个无法运行的 CLI。CLI 能用但不是最新版时，卡片也会提示新版本并提供同一个按钮：插件在本机读取 npm 上 `@anthropic-ai/claude-code` 的 `latest`（与官方安装器的 `latest` 通道是同一版本），30 分钟内最多读一次，点「重新检测」立即重读；读不到时不提示。只有点这个按钮时才会更新你的 Claude Code。
 - **出错会说清原因。** 未安装 CLI、CLI 版本过旧、官方 CLI 发出的请求仍被网关拒绝，分别给出说明和下一步，不会改走其它通道或提供商，也不会停用 Key。
 
 已知差异：新进程启动约 0.3–1 秒；在一轮工具调用中途恢复进程时，CLI 会按官方行为在工具结果后附上一句 “Continue from where you left off.”。需要 Claude Code 2.1.259 或更新版本（实测 2.1.295 与 2.1.303）。Windows 上 Claude Code 还需要 Git for Windows。
@@ -170,7 +170,7 @@ Claude 与其它模型一样，通过 DSH 的 `packycode_image_generate` 工具
 
 | 模型 | 怎么调用 | 推理档位 | 适合的令牌分组 |
 | --- | --- | --- | --- |
-| `deepseek-flash` | HTTP，chat/completions，可带图 | 可关；`low` / `high` / `max` | `deepseek-officially`、`deepseek-sale` |
+| `deepseek-flash` | HTTP，Responses，可带图 | 可关；`low` / `high` / `max` | `deepseek-officially`、`deepseek-sale` |
 | `gpt-6.1-sol` | HTTP，Responses，可带图 | 不能关；`low` / `medium` / `high` / `xhigh` / `max` | `codex`、`codex-sale` |
 | `gpt-6-astra` | 同上 | 同上 | 同上 |
 | `gpt-5.6-sol` | 同上 | 同上 | 同上 |
@@ -183,7 +183,7 @@ Claude 与其它模型一样，通过 DSH 的 `packycode_image_generate` 工具
 
 列表里看得到模型，不代表当前令牌分组一定放行。换分组时不要把对应分组一起去掉。
 
-当前目录中的 10 个模型都声明了文字和图像输入。DeepSeek Flash 的识图能力按 [官方图像理解文档](https://api-docs.deepseek.com/zh-cn/guides/vision/) 配置；图片通过 DSH 附件服务读取，再随 chat/completions 请求发送。
+当前目录中的 10 个模型都声明了文字和图像输入。DeepSeek Flash 的识图能力按 [官方图像理解文档](https://api-docs.deepseek.com/zh-cn/guides/vision/) 配置；图片通过 DSH 附件服务读取，再随 Responses 请求发送。
 
 Gemini 的能力与限制来自 Google 官方模型页：[Gemini 4 Argon](https://ai.google.dev/gemini-api/docs/models/gemini-4-argon)、[Gemini 3.8 Flash](https://ai.google.dev/gemini-api/docs/models/gemini-3.8-flash)。两款模型统一使用 Gemini 原生协议，通过 `/v1beta/models/{model}:streamGenerateContent` 流式返回文字、思考和工具调用，图片仍由 DSH 附件服务读取。思考档位通过 `thinkingLevel` 传入。两者均使用单次流式输出上限，不执行超过 65,536 token 的自动续写。可用端点与分组以 [PackyAPI 实时模型目录](https://www.packyapi.com/api/pricing) 为准。
 
@@ -191,7 +191,9 @@ Gemini 的能力与限制来自 Google 官方模型页：[Gemini 4 Argon](https:
 
 Grok 4.7 的上下文与推理档位来自 [官方文档](https://docs.x.ai/developers/grok-4-7)。官方没有单独限制文字输出长度；插件将输出上限设为上下文大小，并按每次请求的剩余上下文收紧。
 
-Responses 请求只有 GPT 模型保留 `prompt_cache_key`，其他 Responses 模型默认省略。当前网关的 Grok 路由会将这个字段误报成 `Incorrect API key provided`。
+Responses 请求只有 GPT 模型保留 `prompt_cache_key`，其他 Responses 模型默认省略。当前网关的 Grok 路由会将这个字段误报成 `Incorrect API key provided`；DeepSeek Flash 不带它也能命中前缀缓存。
+
+DeepSeek Flash 走网关的 Responses 接口（`/api/pricing` 列出 `openai-response`）。关闭推理时发送 `reasoning.effort: "none"`，网关返回时不带思考；开启时思考内容以 `reasoning_text` 返回，并随同一轮的工具调用一起回传。
 
 <details>
 <summary>协议、分组与客户端兼容性</summary>
@@ -214,9 +216,9 @@ Responses 请求只有 GPT 模型保留 `prompt_cache_key`，其他 Responses
 
 ## 更新与卸载
 
-> **从 1.3.2 或更早版本升级：** 请在插件页填写 `dsh-packycode-api@1.3.5` 安装，不要点旧版设置页里的「更新插件」。旧按钮安装时会绕过 pnpm 的发布冷却期：装到的版本如果发布还不满 24 小时，这个 profile 在它满 24 小时之前就装不了其他插件。装好并重启后，按钮就换成了修好的版本，以后直接点即可。
+> **从 1.3.2 或更早版本升级：** 请在插件页填写 `dsh-packycode-api@1.3.7` 安装，不要点旧版设置页里的「更新插件」。旧按钮安装时会绕过 pnpm 的发布冷却期：装到的版本如果发布还不满 24 小时，这个 profile 在它满 24 小时之前就装不了其他插件。装好并重启后，按钮就换成了修好的版本，以后直接点即可。
 
-**更新：** 打开 **设置 → PackyCode**，有新版本时点「更新插件」。它会在当前 profile 目录里用 DSH 自带的 pnpm 安装精确版本，并读回 `package.json` 确认版本落地。安装遵守 pnpm 的发布冷却策略，不会绕过它：默认情况下 pnpm 会直接装上这个版本，并把它记进 profile 的 `minimumReleaseAgeExclude`；如果你给 pnpm 配了更严格的策略，按钮会提示什么时候可以更新。本地 `link:` 开发安装不会出现这个按钮。完成后完全退出并重新打开桌面应用。只刷新页面不会重载 Host。也可以在**插件**页重新安装，同样要填写带版本号的包名（例如 `dsh-packycode-api@1.3.5`），否则装上的可能是发布满 24 小时的旧版。
+**更新：** 打开 **设置 → PackyCode**，有新版本时点「更新插件」。它会在当前 profile 目录里用 DSH 自带的 pnpm 安装精确版本，并读回 `package.json` 确认版本落地。安装遵守 pnpm 的发布冷却策略，不会绕过它：默认情况下 pnpm 会直接装上这个版本，并把它记进 profile 的 `minimumReleaseAgeExclude`；如果你给 pnpm 配了更严格的策略，按钮会提示什么时候可以更新。本地 `link:` 开发安装不会出现这个按钮。完成后完全退出并重新打开桌面应用。只刷新页面不会重载 Host。也可以在**插件**页重新安装，同样要填写带版本号的包名（例如 `dsh-packycode-api@1.3.7`），否则装上的可能是发布满 24 小时的旧版。
 
 **从本地路径安装切回官方源时，必须先卸载。** 「更新」是 `pnpm add`，它只重写包目录里的文件，不会删除更早一次本地路径安装留在包目录内的 `node_modules`；那份旧依赖会继续挡住 DSH 自带的包，插件行加载失败且看不出原因。「卸载」执行的是 `pnpm remove`，会删掉整个包目录，重装才是干净的。用 `node scripts/install-check.mjs` 可以确认当前 profile 是否处于这个状态。
 
@@ -232,7 +234,7 @@ ls ~/.dsh/profiles/desktop/node_modules/dsh-packycode-api/node_modules
 
 有输出就是残留：从 npm 安装的包不会自带 `node_modules`，这一份通常来自更早一次「本地路径」安装（`file:` 或直接写路径，而不是 `link:`）。它位于 profile 目录内部，而 DSH 解析插件导入时优先使用 profile 内的副本，所以插件拿到的仍是那份旧依赖 —— 例如 `@deepseek-ai/schemastery` 3.18.2 没有 `Schema.volatile()`，模块在导入阶段就抛错。导入失败时 Loader 不会为这一行创建 fiber，客户端 bundle 也不会被组合，于是模型路由、RPC 通道和设置页全都不会出现。
 
-修复：到**插件**页**卸载**本插件，再用带版本号的包名重新**安装**（例如 `dsh-packycode-api@1.3.5`），然后完全退出并重新打开桌面应用。卸载执行的是 `pnpm remove`，会删掉整个包目录；直接重装或点「更新」只重写文件，不会清掉这份残留。也可以手动删掉上面那个 `node_modules` 再重启。
+修复：到**插件**页**卸载**本插件，再用带版本号的包名重新**安装**（例如 `dsh-packycode-api@1.3.7`），然后完全退出并重新打开桌面应用。卸载执行的是 `pnpm remove`，会删掉整个包目录；直接重装或点「更新」只重写文件，不会清掉这份残留。也可以手动删掉上面那个 `node_modules` 再重启。
 
 **首次安装后，设置页每张卡片都显示 `transport failure for /packycode-api/…: HTTP 405`？** 实际装上的是 1.1.6 或更早的版本，通常是因为安装时只填了包名：安装提示显示的是最新版，pnpm 实际装的却是发布满 24 小时的旧版（见「安装插件」）。这些旧版要等 DSH 重启、重建它的 `connection` 服务之后，才能注册设置通道。所以首次安装后 `/packycode-api` 通道还不存在，请求落到静态页面，返回 405；模型路由和设置页本身照常加载。1.1.7 起首次安装不需要重启。先确认装上的版本：
 

package/lib/client.js

@@ -157,6 +157,9 @@ window.__ModuleLoader__.load({
 			cliUpdating: "正在更新…（通常需要一两分钟，请勿关闭 DSH）",
 			cliUpdateCommand: "将在本机执行：{command}",
 			cliUpdateSucceeded: "已更新到 {version}。",
+			cliUpdateUnchanged: "更新命令已执行，版本仍是 {version}。",
+			cliUpdateAvailable: "有新版本 {latest}，可以更新。当前版本仍可正常使用。",
+			cliUpdateNotUpdated: "更新命令已执行，但版本仍是 {version}，最新版是 {latest}。请在终端执行 {command}，看它给出的提示（例如用 Homebrew 安装的要执行 brew upgrade claude-code），然后点「重新检测」。当前版本仍可正常使用。",
 			cliUpdateFailed: "更新失败",
 			cliUpdateNotInstalled: "没有找到要更新的 CLI，请点「重新检测」。",
 			cliUpdateStillOutdated: "更新命令已执行，但版本仍低于 {minVersion}。请在终端执行 {command}，看它给出的提示（例如用 Homebrew 安装的要执行 brew upgrade claude-code），然后点「重新检测」。",
@@ -369,6 +372,9 @@ window.__ModuleLoader__.load({
 			cliUpdating: "Updating… (usually a minute or two; keep DSH open)",
 			cliUpdateCommand: "Runs on this device: {command}",
 			cliUpdateSucceeded: "Updated to {version}.",
+			cliUpdateUnchanged: "The update ran; the version is still {version}.",
+			cliUpdateAvailable: "Version {latest} is available. The installed version keeps working until you update.",
+			cliUpdateNotUpdated: "The update ran, but the version is still {version} and the latest is {latest}. Run {command} in a terminal and follow what it says (for a Homebrew install, brew upgrade claude-code), then click Check again. The installed version keeps working.",
 			cliUpdateFailed: "Update failed",
 			cliUpdateNotInstalled: "No CLI was found to update. Click Check again.",
 			cliUpdateStillOutdated: "The update ran, but the version is still below {minVersion}. Run {command} in a terminal and follow what it says (for a Homebrew install, brew upgrade claude-code), then click Check again.",
@@ -2591,6 +2597,7 @@ window.__ModuleLoader__.load({
 			"not-found-after-install": () => "cliNotFoundAfterInstall",
 			"not-installed": () => "cliUpdateNotInstalled",
 			"still-outdated": () => "cliUpdateStillOutdated",
+			"not-updated": () => "cliUpdateNotUpdated",
 			"broken-after-update": () => "cliUpdateBroken"
 		};
 		/** The sentence explaining a failed install or update, by the code the host classified. */
@@ -2599,12 +2606,15 @@ window.__ModuleLoader__.load({
 			const command = cli.install?.action === "update" ? cli.updateCommand : cli.command;
 			return key === void 0 ? void 0 : fill(t(key), {
 				command: command ?? "",
-				minVersion: cli.minVersion ?? ""
+				minVersion: cli.minVersion ?? "",
+				version: cli.version ?? "",
+				latest: cli.install?.latest ?? cli.latest ?? ""
 			});
 		}
 		/**
 		* Whether this device has the Claude Code CLI that Claude requests on cc
-		* keys go through: an installer without one, an updater for one too old.
+		* keys go through: an installer without one, an updater for one too old or
+		* behind npm's latest.
 		*/
 		function ClaudeCliCard({ call, t }) {
 			const [cli, setCli] = react.useState();
@@ -2642,6 +2652,7 @@ window.__ModuleLoader__.load({
 			};
 			const usable = cli?.installed === true && cli.version !== void 0;
 			const outdated = usable && cli.outdated === true;
+			const updateAvailable = usable && !outdated && cli.updateAvailable === true;
 			const action = cli?.install?.action ?? "install";
 			const failed = cli?.install?.state === "failed";
 			const failure = cli === void 0 ? void 0 : installFailure(cli, t);
@@ -2691,8 +2702,27 @@ window.__ModuleLoader__.load({
 						}),
 						cli.install?.state === "succeeded" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 							className: "pkc-note",
-							children: action === "update" ? fill(t("cliUpdateSucceeded"), { version: cli.install.to ?? cli.version }) : t("cliInstallSucceeded")
-						})
+							children: action === "update" ? fill(t(cli.install.from !== void 0 && cli.install.from === cli.install.to ? "cliUpdateUnchanged" : "cliUpdateSucceeded"), { version: cli.install.to ?? cli.version }) : t("cliInstallSucceeded")
+						}),
+						updateAvailable && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "pkc-note",
+								children: fill(t("cliUpdateAvailable"), { latest: cli.latest ?? "" })
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+								className: "pkc-split",
+								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Button, {
+									size: "md",
+									disabled: running || checking,
+									onClick: update,
+									children: running && action === "update" ? t("cliUpdating") : t("cliUpdate")
+								})
+							}),
+							cli.updateCommand !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "pkc-note",
+								children: fill(t("cliUpdateCommand"), { command: cli.updateCommand })
+							})
+						] })
 					] }),
 					outdated && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "pkc-callout",

package/lib/index.js

@@ -14,7 +14,6 @@ import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { lazyStream } from "@earendil-works/pi-ai/api/lazy";
 import { clampThinkingLevel, createProvider } from "@earendil-works/pi-ai";
-import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
 import { openAIResponsesApi } from "@earendil-works/pi-ai/api/openai-responses.lazy";
 import { anthropicMessagesApi } from "@earendil-works/pi-ai/api/anthropic-messages.lazy";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -1053,8 +1052,9 @@ function resolveSpawnCommand(binary, { platform = process.platform, exists = exi
 * sent by this device's Claude Code CLI, so the settings panel shows whether
 * one is installed (and which version), and offers to install it with
 * `npm install -g @anthropic-ai/claude-code` — the same command on macOS and
-* Windows — or to update one older than the transport needs. Both run on the
-* host, never in a shell built from user text: their arguments are constants.
+* Windows — or to update one older than the transport needs or than npm's
+* `latest`. Both run on the host, never in a shell built from user text:
+* their arguments are constants.
 *
 * npm 12 skips install scripts unless they are allowed, and the CLI's
 * postinstall is what puts its native binary in place, so every npm install
@@ -1068,6 +1068,11 @@ const CLAUDE_INSTALL_COMMAND = `npm install -g ${CLAUDE_NPM_PACKAGE} ${ALLOW_SCR
 const CLAUDE_NPM_UPDATE_COMMAND = `npm install -g ${CLAUDE_NPM_PACKAGE}@latest ${ALLOW_SCRIPTS}`;
 /** How any other install (the native installer's, Homebrew's) is updated: by the CLI itself. */
 const CLAUDE_SELF_UPDATE_COMMAND = "claude update";
+/**
+* The newest CLI release. npm's `latest` tag and the native installer's
+* `latest` channel name the same version, and both updates above install it.
+*/
+const CLAUDE_NPM_LATEST_URL = `https://registry.npmjs.org/${CLAUDE_NPM_PACKAGE}/latest`;
 const INSTALL_ARGS = Object.freeze([
 	"install",
 	"-g",
@@ -1087,6 +1092,11 @@ const PREFIX_TIMEOUT_MS = 2e4;
 const INSTALL_TIMEOUT_MS = 900 * 1e3;
 /** A detection is reused this long; the panel's refresh and an install bypass it. */
 const DETECTION_TTL_MS = 300 * 1e3;
+const LATEST_TIMEOUT_MS = 1e4;
+/** The newest release is read again after this long; the panel's refresh bypasses it. */
+const LATEST_TTL_MS = 1800 * 1e3;
+/** An unanswered read is retried sooner, so one network blip does not hide an update for long. */
+const LATEST_RETRY_MS = 120 * 1e3;
 const DETAIL_CHARS = 800;
 /**
 * The version `claude --version` prints, e.g. `2.1.3 (Claude Code)`.
@@ -1195,6 +1205,48 @@ function explainNpmFailure(result) {
 	};
 }
 /**
+* The newest Claude Code CLI version on npm, read host-side with a timeout
+* and redirects refused. A read never throws: no answer is `undefined`, which
+* offers no update.
+* @param options - fetch, registry URL, timeout, cache lifetimes and clock.
+* @returns `{ read({ force }), peek() }`.
+*/
+function createClaudeLatestReader({ fetchImpl = ambientFetch, url = CLAUDE_NPM_LATEST_URL, timeoutMs = LATEST_TIMEOUT_MS, ttlMs = LATEST_TTL_MS, retryMs = LATEST_RETRY_MS, now = () => Date.now() } = {}) {
+	let cached;
+	let inFlight;
+	const load = async () => {
+		let version;
+		try {
+			const response = await boundedFetch(url, { headers: { Accept: "application/json" } }, {
+				fetchImpl,
+				timeoutMs
+			});
+			if (response.ok) version = (await response.json())?.version;
+		} catch {
+			version = void 0;
+		}
+		return {
+			version: parseSemver(version) === void 0 ? void 0 : version,
+			fetchedAt: now()
+		};
+	};
+	return Object.freeze({
+		async read({ force = false } = {}) {
+			const lifetime = cached?.version === void 0 ? retryMs : ttlMs;
+			if (!force && cached !== void 0 && now() - cached.fetchedAt < lifetime) return cached.version;
+			if (inFlight === void 0) inFlight = load().then((value) => {
+				cached = value;
+				return value;
+			}).finally(() => {
+				inFlight = void 0;
+			});
+			return (await inFlight).version;
+		},
+		/** The last version read, without a request. */
+		peek: () => cached?.version
+	});
+}
+/**
 * Run a command to completion and capture its output. Never rejects: a
 * missing program or a timeout comes back as `error`.
 */
@@ -1264,10 +1316,12 @@ function runCaptured(spawnImpl, command, args, options, timeoutMs) {
 /**
 * The CLI manager behind the settings panel and the runner.
 * @param options - the configured CLI path (a function, so a settings change
-*   applies without a restart), plus platform, environment, and process seams.
+*   applies without a restart), the newest-release reader (none: no update
+*   is offered for a CLI the transport can use), plus platform, environment,
+*   and process seams.
 * @returns `{ binary, detect, install, status }`.
 */
-function createClaudeCliManager({ explicitPath = () => "", platform = process.platform, home = homedir(), env = process.env, execPath = process.execPath, configDir = DEFAULT_CLAUDE_CONFIG_DIR, spawnImpl = spawn, exists = existsSync, readFile = (file) => readFileSync(file, "utf8"), realpath = realpathSync, readdir, now = () => Date.now() } = {}) {
+function createClaudeCliManager({ explicitPath = () => "", latestReader, platform = process.platform, home = homedir(), env = process.env, execPath = process.execPath, configDir = DEFAULT_CLAUDE_CONFIG_DIR, spawnImpl = spawn, exists = existsSync, readFile = (file) => readFileSync(file, "utf8"), realpath = realpathSync, readdir, now = () => Date.now() } = {}) {
 	const path = pathFor(platform);
 	const configured = () => {
 		const value = explicitPath();
@@ -1434,10 +1488,16 @@ function createClaudeCliManager({ explicitPath = () => "", platform = process.pl
 		const beside = path.join(path.dirname(binary), platform === "win32" ? "npm.cmd" : "npm");
 		return exists(beside) ? beside : npm();
 	};
+	/** The newest release, or undefined when unknown. */
+	const latestVersion = ({ force = false } = {}) => latestReader?.read({ force }) ?? Promise.resolve(void 0);
+	/** Whether a version is older than the newest release; false when either is unknown. */
+	const behind = (version, latest) => latest !== void 0 && compareSemver(version, latest) === -1;
 	/**
 	* Update the located CLI the way it was installed: npm's global package
 	* through npm, anything else through `claude update` with the plugin's
-	* own CLI home. Success means the CLI now detected is new enough.
+	* own CLI home. Success means the CLI now detected is new enough and either
+	* changed or was not behind the newest release; a command that exited
+	* cleanly but left it behind says so.
 	*/
 	const runUpdate = async () => {
 		const before = await detect({ force: true });
@@ -1485,8 +1545,10 @@ function createClaudeCliManager({ explicitPath = () => "", platform = process.pl
 			} }, INSTALL_TIMEOUT_MS);
 		}
 		const after = await detect({ force: true });
+		const latest = await latestVersion();
 		const from = before.version === void 0 ? {} : { from: before.version };
-		if (after.version !== void 0 && !isClaudeCliOutdated(after.version)) installation = {
+		const changed = after.version !== void 0 && after.version !== before.version;
+		if (after.version !== void 0 && !isClaudeCliOutdated(after.version) && (changed || result.code === 0 && !behind(after.version, latest))) installation = {
 			state: "succeeded",
 			action: "update",
 			...from,
@@ -1506,13 +1568,21 @@ function createClaudeCliManager({ explicitPath = () => "", platform = process.pl
 			detail: detailOf(after.error, result.stdout, result.stderr),
 			finishedAt: now()
 		};
-		else installation = {
+		else if (isClaudeCliOutdated(after.version)) installation = {
 			state: "failed",
 			action: "update",
 			code: "still-outdated",
 			detail: detailOf(result.stdout, result.stderr),
 			finishedAt: now()
 		};
+		else installation = {
+			state: "failed",
+			action: "update",
+			code: "not-updated",
+			latest,
+			detail: detailOf(result.stdout, result.stderr),
+			finishedAt: now()
+		};
 	};
 	const update = () => {
 		if (installing !== void 0) return installation;
@@ -1553,15 +1623,18 @@ function createClaudeCliManager({ explicitPath = () => "", platform = process.pl
 		settled: () => installing ?? Promise.resolve(),
 		/**
 		* What the settings panel shows. While an install or update runs, the
-		* last detection stands instead of probing a half-written package.
+		* last detection and the last newest-release reading stand instead of
+		* probing a half-written package. The two reads run side by side.
 		*/
 		async status({ force = false } = {}) {
-			const value = installing === void 0 ? await detect({ force }) : detection;
+			const [value, latest] = installing === void 0 ? await Promise.all([detect({ force }), latestVersion({ force })]) : [detection, latestReader?.peek()];
 			return {
 				installed: value?.installed === true,
 				...value?.version === void 0 ? {} : { version: value.version },
 				minVersion: CLAUDE_MIN_VERSION,
 				outdated: isClaudeCliOutdated(value?.version),
+				...latest === void 0 ? {} : { latest },
+				updateAvailable: value?.version !== void 0 && behind(value.version, latest),
 				...value?.path === void 0 ? {} : { updateCommand: isNpmClaudeInstall(value.path, {
 					platform,
 					realpath
@@ -3251,8 +3324,8 @@ function createDiagnostics({ sessionQuery, readEvents, ring, groups, secrets = a
 *
 * The gateway's own guidance for these routes, which the base URLs and pinned
 * protocols below exist to satisfy:
-* - OpenAI/Codex traffic takes `/v1` in the base URL and never an endpoint
-*   path — the SDK appends `/responses` or `/chat/completions` itself.
+* - OpenAI-protocol traffic takes `/v1` in the base URL and never an endpoint
+*   path — the SDK appends `/responses` itself.
 * - Anthropic traffic takes `https://cf.api.fan` with **no** `/v1`: the
 *   Anthropic client appends `/v1/messages` itself.
 * - A model asked over the wrong protocol does not fail cleanly; the stream
@@ -3262,7 +3335,7 @@ function createDiagnostics({ sessionQuery, readEvents, ring, groups, secrets = a
 * model does not support is refused before the request is sent: Claude Opus
 * 5.5 (platform.claude.com effort docs), GPT-6.1 Sol, GPT-6 Astra and GPT-5.6
 * Sol `reasoning.effort` (developers.openai.com model pages), DeepSeek
-* thinking mode (`thinking` toggle plus `low|high|max` effort), Grok 4.7
+* thinking mode (`low|high|max` effort, or off), Grok 4.7
 * (docs.x.ai/developers/grok-4-7), and Gemini 4 Argon
 * (ai.google.dev/gemini-api/docs/models/gemini-4-argon and docs/openai).
 *
@@ -3275,15 +3348,14 @@ const NO_COST = Object.freeze({
 	cacheRead: 0,
 	cacheWrite: 0
 });
-const COMPLETIONS_BASE = `${DEFAULT_API_HOST}/v1`;
 const RESPONSES_BASE = `${DEFAULT_API_HOST}/v1`;
 const MESSAGES_BASE = DEFAULT_API_HOST;
 const GEMINI_BASE = `${DEFAULT_API_HOST}/v1beta`;
 /**
 * pi-ai thinking-level maps. A level pinned to `null` is unsupported; an
 * absent key keeps pi-ai's own default for that level, which is how `off`
-* stays available for DeepSeek (`off` sends nothing and the deepseek dialect
-* then emits `thinking: disabled`).
+* stays available for DeepSeek: pi-ai's Responses API then sends
+* `reasoning.effort: "none"`, which the gateway answers without reasoning.
 */
 const DEEPSEEK_LEVELS = Object.freeze({
 	minimal: null,
@@ -3322,21 +3394,15 @@ const PACKYCODE_MODELS = Object.freeze([
 	Object.freeze({
 		id: "deepseek-flash",
 		name: "DeepSeek Flash",
-		api: "openai-completions",
+		api: "openai-responses",
 		provider: PROVIDER,
-		baseUrl: COMPLETIONS_BASE,
+		baseUrl: RESPONSES_BASE,
 		reasoning: true,
 		input: Object.freeze(["text", "image"]),
 		cost: NO_COST,
 		contextWindow: 1e6,
 		maxTokens: 384e3,
-		thinkingLevelMap: DEEPSEEK_LEVELS,
-		compat: Object.freeze({
-			thinkingFormat: "deepseek",
-			maxTokensField: "max_tokens",
-			requiresReasoningContentOnAssistantMessages: true,
-			supportsDeveloperRole: false
-		})
+		thinkingLevelMap: DEEPSEEK_LEVELS
 	}),
 	Object.freeze({
 		id: "gpt-6.1-sol",
@@ -5829,8 +5895,8 @@ function createGeminiApi() {
 * The PackyCode pi-ai provider, built in code so the user configures no route.
 *
 * `createProvider` dispatches on `model.api`, which is what lets one route
-* carry Chat Completions, Responses, Anthropic Messages and native Gemini
-* models — the gateway refuses some of them over other protocols.
+* carry Responses, Anthropic Messages and native Gemini models — the gateway
+* refuses some of them over other protocols.
 *
 * @module dsh-packycode-api/provider
 */
@@ -5874,7 +5940,6 @@ function createPackyCodeProvider({ claudeCli } = {}) {
 		auth: keyRingAuth(),
 		models: PACKYCODE_MODELS,
 		api: {
-			"openai-completions": openAICompletionsApi(),
 			"openai-responses": openAIResponsesApi(),
 			"anthropic-messages": createClaudeApi({ cli: claudeCli }),
 			"google-generative-ai": createGeminiApi()
@@ -6471,8 +6536,8 @@ function createPackyCodeRpc({ ring, balance, groups, hosts, preference, claude,
 *   the `web_search_20250305` server tool. Results come from its structured
 *   `web_search_tool_result` blocks, never from prose.
 * - `gpt`: OpenAI Responses at `/v1/responses`, `gpt-6.1-sol`, with the
-*   hosted `web_search` tool. Results come from `url_citation` annotations and
-*   the `web_search_call` actions.
+*   hosted `web_search` tool, streamed. Results come from `url_citation`
+*   annotations and the `web_search_call` actions.
 *
 * Only keys stored in this plugin's key ring authenticate a search; there is no
 * fallback to another credential. A key the gateway reports as exhausted or
@@ -6519,6 +6584,14 @@ const MAX_OUTPUT_TOKENS = 4096;
 const ANTHROPIC_VERSION = "2023-06-01";
 /** Distinct keys one search may try before reporting the last failure. */
 const MAX_KEY_ATTEMPTS = 4;
+/** Resends of one search after an upstream hiccup the gateway relayed with 200. */
+const MAX_TRANSIENT_RETRIES = 2;
+/** Pause before such a resend when the upstream names none. */
+const DEFAULT_RETRY_DELAY_MS = 1e3;
+/** A longer advised pause would not fit DSH's search budget; report it instead. */
+const MAX_RETRY_DELAY_MS = 5e3;
+/** Bound on one unterminated stream event. */
+const MAX_EVENT_CHARS = 4 * 1024 * 1024;
 const MAX_CONTENT_CHARS = 4e3;
 const MAX_SNIPPET_CHARS = 500;
 const MAX_TITLE_CHARS = 200;
@@ -6532,6 +6605,7 @@ const MAX_ERROR_DETAIL_CHARS = 400;
 var WebError = class extends HarnessError {};
 const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 const text = (value) => typeof value === "string" ? value : "";
+const named = (value) => text(value) === "" ? void 0 : value;
 function bounded(value, maximum) {
 	const clean = text(value).replace(/\s+/gu, " ").trim();
 	if (clean === "") return void 0;
@@ -6631,10 +6705,12 @@ function parseMessagesSearchResponse(response) {
 * search actions surfaced; the final message becomes `content`.
 * @param response - parsed Responses body.
 * @returns the normalized search result.
-* @throws {WebError} when the model ran no web search.
+* @throws {WebError} when the model ran no web search, or the body carries no
+*   output at all.
 */
 function parseResponsesSearchResponse(response) {
 	const output = Array.isArray(response?.output) ? response.output : [];
+	if (output.length === 0) throw new WebError(`PackyCode search returned no output items${text(response?.status) === "" ? "" : ` (status ${text(response.status)})`}; the gateway did not pass the search result on`, "WEB_PROVIDER_ERROR");
 	const calls = output.filter((item) => item?.type === "web_search_call");
 	if (calls.length === 0) throw new WebError("PackyCode search returned no web_search_call; the model did not run a web search", "WEB_PROVIDER_ERROR");
 	const sources = sourceList();
@@ -6663,6 +6739,129 @@ function parseResponsesSearchResponse(response) {
 	}
 	return result(sources.values(), boundedBlock(answer, MAX_CONTENT_CHARS));
 }
+/** Events after which a Responses stream carries nothing a search uses. */
+const RESPONSES_LAST_EVENTS = /* @__PURE__ */ new Set([
+	"response.completed",
+	"response.incomplete",
+	"response.failed",
+	"error"
+]);
+/**
+* Read a streamed Responses answer into the body it describes.
+*
+* PackyCode's Codex channel ends a stream with a `response.completed` whose
+* `output` is empty; the items only arrive as `response.output_item.done`
+* events. A non-streaming request gets that same empty `output`, which is why
+* the GPT backend streams. The items are rebuilt here in `output_index`
+* order; the final event's own `output` wins when it has any. An `error`
+* event or `response.failed` becomes the body's `error`.
+* @param response - a 200 answer whose body is `text/event-stream`.
+* @param signal - the caller's cancellation; it cancels the read.
+* @returns the body, with `output` rebuilt or `error` set.
+* @throws {WebError} when the stream ends before its final event.
+*/
+async function readResponsesStream(response, signal) {
+	if (response.body === null || response.body === void 0) throw new WebError("PackyCode search returned an empty stream", "WEB_PROVIDER_ERROR");
+	const items = [];
+	let final;
+	let failure;
+	/** Apply one event; true once nothing after it matters. */
+	const dispatch = (block) => {
+		let name = "";
+		let data;
+		for (const line of block.split("\n")) {
+			if (line.startsWith(":")) continue;
+			const colon = line.indexOf(":");
+			const field = colon < 0 ? line : line.slice(0, colon);
+			const value = colon < 0 ? "" : line.slice(colon + 1).replace(/^ /u, "");
+			if (field === "event") name = value;
+			else if (field === "data") data = data === void 0 ? value : `${data}\n${value}`;
+		}
+		if (data === void 0 || data === "[DONE]") return false;
+		let event;
+		try {
+			event = JSON.parse(data);
+		} catch {
+			return false;
+		}
+		const type = text(event?.type) || name;
+		if (type === "response.output_item.done" && record(event.item)) items.push({
+			index: Number.isInteger(event.output_index) ? event.output_index : Number.MAX_SAFE_INTEGER,
+			item: event.item
+		});
+		else if (type === "response.completed" || type === "response.incomplete") final = record(event.response) ? event.response : {};
+		else if (type === "error") failure = record(event.error) ? event.error : {
+			code: event.code,
+			message: event.message
+		};
+		else if (type === "response.failed") failure ??= record(event.response?.error) ? event.response.error : { message: "the response failed" };
+		return RESPONSES_LAST_EVENTS.has(type);
+	};
+	const reader = response.body.getReader();
+	const cancel = () => {
+		reader.cancel(signal.reason).catch(() => void 0);
+	};
+	signal?.addEventListener("abort", cancel, { once: true });
+	const decoder = new TextDecoder();
+	let pending = "";
+	let carry = "";
+	let ended = false;
+	try {
+		signal?.throwIfAborted();
+		while (!ended) {
+			const { done, value } = await reader.read();
+			signal?.throwIfAborted();
+			const decoded = carry + (done ? decoder.decode() : decoder.decode(value, { stream: true }));
+			carry = !done && decoded.endsWith("\r") ? "\r" : "";
+			pending += decoded.slice(0, decoded.length - carry.length).replace(/\r\n?/gu, "\n");
+			for (let boundary = pending.indexOf("\n\n"); !ended && boundary >= 0; boundary = pending.indexOf("\n\n")) {
+				ended = dispatch(pending.slice(0, boundary));
+				pending = pending.slice(boundary + 2);
+			}
+			if (done) {
+				if (!ended && pending.trim() !== "") ended = dispatch(pending);
+				break;
+			}
+			if (pending.length > MAX_EVENT_CHARS) throw new WebError("PackyCode search stream sent an oversized event", "WEB_PROVIDER_ERROR");
+		}
+	} finally {
+		signal?.removeEventListener("abort", cancel);
+		await reader.cancel().catch(() => void 0);
+		reader.releaseLock();
+	}
+	if (failure !== void 0) return { error: failure };
+	if (final === void 0) throw new WebError("PackyCode search stream ended before the response completed", "WEB_PROVIDER_ERROR");
+	const output = Array.isArray(final.output) && final.output.length > 0 ? final.output : items.sort((left, right) => left.index - right.index).map((entry) => entry.item);
+	return {
+		...final,
+		output
+	};
+}
+/** "Please try again in 2s.", "try again in 1.898s", "try again in 28ms". */
+const RETRY_HINT = /try again in\s*(\d+(?:\.\d+)?)\s*(ms|s|secs?|seconds?)\b/iu;
+/**
+* Whether an error the gateway relayed with a 200 answer is an upstream
+* hiccup a resent request clears, and how long to wait before resending.
+*
+* The Codex channel reports a model at capacity as `rate_limit_exceeded`
+* ("Temporary capacity limit. Please try again in 2s.") and a fault as
+* `server_error`, inside a stream it has already answered 200 for, so the
+* gateway cannot resend it on another channel. The official Codex client
+* resends both, after the pause the message names.
+* @param error - the body's or the stream's `error` object.
+* @param fallbackMs - the pause when the upstream names none.
+* @returns the pause in milliseconds, or undefined when a resend would not
+*   help or its pause would not fit DSH's search budget.
+*/
+function transientRetryDelay(error, fallbackMs = DEFAULT_RETRY_DELAY_MS) {
+	if (!record(error)) return void 0;
+	const message = text(error.message);
+	if (classifyGatewayFailure(message) !== void 0) return void 0;
+	if (!(["rate_limit_exceeded", "server_error"].includes(text(error.code)) || ["server_error", "service_unavailable_error"].includes(text(error.type)) || classifyUpstreamServerError(message))) return void 0;
+	const hint = RETRY_HINT.exec(message);
+	const delay = hint === null ? fallbackMs : Math.round(Number(hint[1]) * (hint[2].toLowerCase() === "ms" ? 1 : 1e3));
+	return delay <= MAX_RETRY_DELAY_MS ? delay : void 0;
+}
 /** Build one backend's request; the key is attached by the caller. */
 function buildSearchRequest(backend, { apiHost, query, sessionId }) {
 	const model = SEARCH_BACKEND_MODELS[backend];
@@ -6685,6 +6884,7 @@ function buildSearchRequest(backend, { apiHost, query, sessionId }) {
 			reasoning: { effort: "low" },
 			max_output_tokens: MAX_OUTPUT_TOKENS,
 			store: false,
+			stream: true,
 			...typeof sessionId === "string" && sessionId !== "" ? { prompt_cache_key: sessionId } : {}
 		},
 		parse: parseResponsesSearchResponse
@@ -6728,29 +6928,51 @@ async function failureText(response) {
 	} catch {}
 	return raw.replace(/\s+/gu, " ").trim().slice(0, MAX_ERROR_DETAIL_CHARS);
 }
+/** An error object as bounded text, its code first, the way failureText words one. */
+function errorText(error) {
+	const message = text(error.message);
+	if (message === "") return JSON.stringify(error).slice(0, MAX_ERROR_DETAIL_CHARS);
+	return `${text(error.code) === "" ? "" : `${error.code}: `}${message}`.slice(0, MAX_ERROR_DETAIL_CHARS);
+}
 const mask = (message, key) => typeof key === "string" && key.length >= 8 ? message.split(key).join(`…${key.slice(-4)}`) : message;
 function isAbort(error, signal) {
 	return signal?.aborted === true || error?.name === "AbortError";
 }
+const isEventStream = (response) => /^text\/event-stream\b/iu.test(response.headers?.get?.("content-type") ?? "");
+/** Wait before a resend; a cancelled search stops waiting. */
+async function pause(ms, signal) {
+	try {
+		await setTimeout$1(ms, void 0, { signal });
+	} catch (error) {
+		throw new WebError("PackyCode search aborted", "WEB_ABORTED", { cause: error });
+	}
+}
 /**
 * Create the provider that searches through PackyCode on every request.
 * @param options - the key ring, the host resolution, the backend preference,
 *   the key-failure sink shared with the model route, and test seams.
 * @returns a DSH web search provider.
 */
-function createPackyCodeSearchProvider({ ring, hosts, backend = () => DEFAULT_SEARCH_BACKEND, onKeyFailure, covers, resolveSessionId, fetchImpl = ambientFetch, timeoutMs = DEFAULT_SEARCH_TIMEOUT_MS } = {}) {
+function createPackyCodeSearchProvider({ ring, hosts, backend = () => DEFAULT_SEARCH_BACKEND, onKeyFailure, covers, resolveSessionId, fetchImpl = ambientFetch, timeoutMs = DEFAULT_SEARCH_TIMEOUT_MS, retryDelayMs = DEFAULT_RETRY_DELAY_MS } = {}) {
 	if (ring === void 0 || typeof ring.activeKey !== "function") throw new Error("PackyCode search requires the key ring");
 	if (typeof hosts !== "function") throw new Error("PackyCode search requires the host resolution");
+	/**
+	* The Codex group refuses a Responses request without `prompt_cache_key`
+	* with a 403 ("请使用标准 Codex 客户端"); a search no session is named for
+	* still sends one, as the model route does.
+	*/
+	const fallbackSessionId = `${PACKYCODE_SEARCH_PROVIDER_ID}-search-${randomUUID()}`;
 	/** One request with one key; classified failures come back as values. */
 	const attempt = async (request, key, signal) => {
 		if (signal?.aborted === true) throw new WebError("PackyCode search aborted", "WEB_ABORTED", { cause: signal.reason });
+		const streamed = request.body.stream === true;
 		let response;
 		try {
 			response = await boundedFetch(request.url, {
 				method: "POST",
 				headers: {
 					...request.headers(key),
-					accept: "application/json",
+					accept: streamed ? "text/event-stream" : "application/json",
 					"content-type": "application/json"
 				},
 				body: JSON.stringify(request.body)
@@ -6770,14 +6992,17 @@ function createPackyCodeSearchProvider({ ring, hosts, backend = () => DEFAULT_SE
 		};
 		let body;
 		try {
-			body = await response.json();
+			body = streamed && isEventStream(response) ? await readResponsesStream(response, signal) : await response.json();
 		} catch (error) {
 			if (isAbort(error, signal)) throw new WebError("PackyCode search aborted", "WEB_ABORTED", { cause: error });
+			if (error?.name === "TimeoutError") throw new WebError(`PackyCode search got no answer within ${Math.round(timeoutMs / 1e3)}s`, "WEB_PROVIDER_ERROR", { cause: error });
+			if (error instanceof WebError) throw error;
 			throw new WebError("PackyCode search returned an unreadable response", "WEB_PROVIDER_ERROR", { cause: error });
 		}
 		if (record(body?.error)) return {
-			failure: mask(text(body.error.message) || JSON.stringify(body.error).slice(0, MAX_ERROR_DETAIL_CHARS), key),
-			status: response.status
+			failure: mask(errorText(body.error), key),
+			status: response.status,
+			retryAfterMs: transientRetryDelay(body.error, retryDelayMs)
 		};
 		return { value: request.parse(body) };
 	};
@@ -6792,16 +7017,22 @@ function createPackyCodeSearchProvider({ ring, hosts, backend = () => DEFAULT_SE
 			const request = buildSearchRequest(chosen, {
 				apiHost: hosts().apiHost,
 				query,
-				sessionId: searchRequest?.sessionId ?? resolveSessionId?.()
+				sessionId: named(searchRequest?.sessionId) ?? named(resolveSessionId?.()) ?? fallbackSessionId
 			});
 			const candidates = await orderedKeys(ring, request.model, covers);
+			const other = chosen === "gpt" ? SEARCH_BACKEND_DEEPSEEK : "gpt";
 			let lastFailure;
 			let uncovered = false;
 			for (const key of candidates.slice(0, MAX_KEY_ATTEMPTS)) {
-				const outcome = await attempt(request, key.key, signal);
+				let outcome = await attempt(request, key.key, signal);
+				for (let retry = 0; outcome.retryAfterMs !== void 0 && retry < MAX_TRANSIENT_RETRIES; retry += 1) {
+					await pause(outcome.retryAfterMs, signal);
+					outcome = await attempt(request, key.key, signal);
+				}
 				if (outcome.value !== void 0) return outcome.value;
 				const failure = outcome.failure === "" ? `HTTP ${outcome.status}` : outcome.failure;
 				lastFailure = failure;
+				if (outcome.retryAfterMs !== void 0) throw new WebError(`PackyCode search: ${request.model} stayed unavailable upstream after 3 attempts (${failure}). Try again shortly, or switch the search backend to "${other}" under Settings → PackyCode → Web search.`, "WEB_PROVIDER_ERROR");
 				if (classifyClientPolicy(failure)) throw new WebError(explainClientPolicyFailure(), "WEB_PROVIDER_ERROR");
 				const kind = classifyGatewayFailure(failure) ?? (outcome.status === 401 ? "invalid-key" : void 0);
 				if (kind !== void 0) {
@@ -6812,13 +7043,10 @@ function createPackyCodeSearchProvider({ ring, hosts, backend = () => DEFAULT_SE
 					uncovered = true;
 					continue;
 				}
-				throw new WebError(`PackyCode search failed (HTTP ${outcome.status}): ${failure}`, "WEB_PROVIDER_ERROR");
+				throw new WebError(`PackyCode search failed ${outcome.status === 200 ? "upstream" : `(HTTP ${outcome.status})`}: ${failure}`, "WEB_PROVIDER_ERROR");
 			}
 			if (candidates.length === 0) throw new WebError("PackyCode search has no usable API key; add one under Settings → PackyCode", "WEB_PROVIDER_CREDENTIAL_MISSING");
-			if (uncovered) {
-				const other = chosen === "gpt" ? SEARCH_BACKEND_DEEPSEEK : "gpt";
-				throw new WebError(`PackyCode search: no stored API key's group covers ${request.model} (${chosen} backend). Switch the search backend to "${other}" under Settings → PackyCode → Web search, or add a key whose group includes it. Gateway said: ${lastFailure}`, "WEB_PROVIDER_ERROR");
-			}
+			if (uncovered) throw new WebError(`PackyCode search: no stored API key's group covers ${request.model} (${chosen} backend). Switch the search backend to "${other}" under Settings → PackyCode → Web search, or add a key whose group includes it. Gateway said: ${lastFailure}`, "WEB_PROVIDER_ERROR");
 			throw new WebError(`PackyCode search: every usable key was refused (${lastFailure ?? "no detail"})`, "WEB_PROVIDER_CREDENTIAL_MISSING");
 		}
 	});
@@ -7438,7 +7666,10 @@ function apply(ctx, config) {
 	* requests through this device's Claude Code CLI. DSH's agent loop, tools,
 	* permissions and plan mode are unchanged; only the transport differs.
 	*/
-	const claudeCli = createClaudeCliManager({ explicitPath: () => fieldValue(source()?.claudeCliPath) });
+	const claudeCli = createClaudeCliManager({
+		explicitPath: () => fieldValue(source()?.claudeCliPath),
+		latestReader: createClaudeLatestReader()
+	});
 	const cliTransport = createClaudeCliTransport({
 		binary: async () => {
 			let found = await claudeCli.detect();
@@ -7643,4 +7874,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { CHANNEL, CLAUDE_INSTALL_COMMAND, CLAUDE_MIN_VERSION, CLAUDE_MISSING_MESSAGE, CLAUDE_NPM_PACKAGE, CLAUDE_NPM_UPDATE_COMMAND, CLAUDE_SELF_UPDATE_COMMAND, CLI_ONLY_GROUPS, CLI_SESSION_IDLE_MS, CLI_TOOL_NOTE, Config, DEFAULT_API_HOST, DEFAULT_CLAUDE_CONFIG_DIR, DEFAULT_IMAGE_MODEL, DEFAULT_SEARCH_BACKEND, DEFAULT_STATUS_HOST, DIAGNOSTICS_FORMAT, DIAGNOSTICS_LIMITS, DISPLAY_NAME, HTTP_CLAUDE_GROUPS, IMAGE_MODELS, IMAGE_MODEL_IDS, IMAGE_QUALITIES, IMAGE_TIMEOUT_MS, IMAGE_TOOL_NAME, LEGACY_STATUS_HOSTS, MAX_IMAGE_BYTES, MAX_LIVE_CLI_SESSIONS, MCP_SERVER_NAME, MCP_TOOL_PREFIX, PACKYCODE_AUTO_SEARCH_PROVIDER_ID, PACKYCODE_MODELS, PACKYCODE_MODEL_IDS, PACKYCODE_SEARCH_PROVIDER_ID, PLUGIN_ID, PROVIDER, PackyCodeKeyRing, SEARCH_BACKENDS, SEARCH_BACKEND_MODELS, SEARCH_MODES, SETTINGS_NAMESPACE, TEST_MESSAGE_POLICY_CODE, apply, assertApiKey, baseUrlOf, buildCliArgs, buildCliEnvironment, buildSearchRequest, buildTranscript, canonicalMessage, catalogCoverage, classifyCliOutdated, classifyCliUnavailable, classifyClientPolicy, classifyGatewayFailure, classifyTestMessagePolicy, classifyUpstreamServerError, claudeBinaryCandidates, claudeTransportFor, cliErrorMessage, cliToolName, createBalanceReader, createClaudeCliManager, createClaudeCliTransport, createClaudeToolNames, createDiagnostics, createGroupReader, createImageController, createKeyChooser, createModelSelectionController, createPackyCodeAutoSearchProvider, createPackyCodeImageClient, createPackyCodeImageTool, createPackyCodeProfile, createPackyCodeProvider, createPackyCodeRpc, createPackyCodeSearchProvider, createProfileSearchComposition, createRouteAdapter, createSearchComposition, createSearchController, decodeImagePng, describeRequest, dshSystemText, explainCliClientPolicyFailure, explainCliOutdated, explainCliUnavailable, explainClientPolicyFailure, explainNpmFailure, explainTestMessagePolicyFailure, guardKeyRotation, inject, isClaudeCliOutdated, isNpmClaudeInstall, locateClaudeBinary, locateNpm, name, normalizeFailureMessage, normalizeHost, parseClaudeVersion, parseMessagesSearchResponse, parsePricing, parseResponsesSearchResponse, parseSelectedGroups, parseTokenUsage, pickKeyForModel, planContinuation, pngDimensions, readHiddenModels, readImagePreference, readSearchChoice, resolveSpawnCommand, splitConversation, startClaudeCliSession, startClaudeMcpBridge, statusHostOrder, summarizeSessionEvents, toolResultToMcp, validateImageOptions };
+export { CHANNEL, CLAUDE_INSTALL_COMMAND, CLAUDE_MIN_VERSION, CLAUDE_MISSING_MESSAGE, CLAUDE_NPM_LATEST_URL, CLAUDE_NPM_PACKAGE, CLAUDE_NPM_UPDATE_COMMAND, CLAUDE_SELF_UPDATE_COMMAND, CLI_ONLY_GROUPS, CLI_SESSION_IDLE_MS, CLI_TOOL_NOTE, Config, DEFAULT_API_HOST, DEFAULT_CLAUDE_CONFIG_DIR, DEFAULT_IMAGE_MODEL, DEFAULT_SEARCH_BACKEND, DEFAULT_STATUS_HOST, DIAGNOSTICS_FORMAT, DIAGNOSTICS_LIMITS, DISPLAY_NAME, HTTP_CLAUDE_GROUPS, IMAGE_MODELS, IMAGE_MODEL_IDS, IMAGE_QUALITIES, IMAGE_TIMEOUT_MS, IMAGE_TOOL_NAME, LEGACY_STATUS_HOSTS, MAX_IMAGE_BYTES, MAX_LIVE_CLI_SESSIONS, MCP_SERVER_NAME, MCP_TOOL_PREFIX, PACKYCODE_AUTO_SEARCH_PROVIDER_ID, PACKYCODE_MODELS, PACKYCODE_MODEL_IDS, PACKYCODE_SEARCH_PROVIDER_ID, PLUGIN_ID, PROVIDER, PackyCodeKeyRing, SEARCH_BACKENDS, SEARCH_BACKEND_MODELS, SEARCH_MODES, SETTINGS_NAMESPACE, TEST_MESSAGE_POLICY_CODE, apply, assertApiKey, baseUrlOf, buildCliArgs, buildCliEnvironment, buildSearchRequest, buildTranscript, canonicalMessage, catalogCoverage, classifyCliOutdated, classifyCliUnavailable, classifyClientPolicy, classifyGatewayFailure, classifyTestMessagePolicy, classifyUpstreamServerError, claudeBinaryCandidates, claudeTransportFor, cliErrorMessage, cliToolName, createBalanceReader, createClaudeCliManager, createClaudeCliTransport, createClaudeLatestReader, createClaudeToolNames, createDiagnostics, createGroupReader, createImageController, createKeyChooser, createModelSelectionController, createPackyCodeAutoSearchProvider, createPackyCodeImageClient, createPackyCodeImageTool, createPackyCodeProfile, createPackyCodeProvider, createPackyCodeRpc, createPackyCodeSearchProvider, createProfileSearchComposition, createRouteAdapter, createSearchComposition, createSearchController, decodeImagePng, describeRequest, dshSystemText, explainCliClientPolicyFailure, explainCliOutdated, explainCliUnavailable, explainClientPolicyFailure, explainNpmFailure, explainTestMessagePolicyFailure, guardKeyRotation, inject, isClaudeCliOutdated, isNpmClaudeInstall, locateClaudeBinary, locateNpm, name, normalizeFailureMessage, normalizeHost, parseClaudeVersion, parseMessagesSearchResponse, parsePricing, parseResponsesSearchResponse, parseSelectedGroups, parseTokenUsage, pickKeyForModel, planContinuation, pngDimensions, readHiddenModels, readImagePreference, readSearchChoice, resolveSpawnCommand, splitConversation, startClaudeCliSession, startClaudeMcpBridge, statusHostOrder, summarizeSessionEvents, toolResultToMcp, validateImageOptions };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-packycode-api",
-  "version": "1.3.5",
+  "version": "1.3.7",
   "description": "Use PackyCode API keys in DeepSeek Harness with multi-protocol models, image generation and editing, separate key rings, and balance display",
   "type": "module",
   "main": "./lib/index.js",