dsh-plugin-subscriptions 0.5.3 → 0.6.0

package/lib/index.js

@@ -1,5 +1,6 @@
 import z from "@deepseek-ai/schemastery";
-import { CONTEXT_WINDOW_EXCEEDED_CODE, CallId, EMPTY_RESPONSE_CODE, LlmAdapter, LlmError, QUOTA_EXCEEDED_CODE, ReasoningEffortId, attributionHeaders, errorChain, isContextWindowExceededError, isQuotaExceededError, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
+import * as llm from "@deepseek-ai/dsh-llm";
+import { CONTEXT_WINDOW_EXCEEDED_CODE, EMPTY_RESPONSE_CODE, LlmAdapter, LlmError, QUOTA_EXCEEDED_CODE, ReasoningEffortId, attributionHeaders, errorChain, isContextWindowExceededError, isQuotaExceededError, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { createServer } from "node:http";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { ProxyAgent, fetch as fetch$1 } from "undici";
@@ -271,13 +272,13 @@ const DISABLED = {
 	bypass: []
 };
 /** Current config; updated by every load/apply/save. */
-let current = DISABLED;
+let current$1 = DISABLED;
 /** The live dispatcher, or undefined when proxies are off/errored. */
 let agent;
 /** Last load/apply failure, surfaced by the config view. */
 let configError;
 /** One lazy load of the on-disk config (module-import cheap; file read once). */
-let ready;
+let ready$1;
 /** Absolute path of the proxy config file. */
 function proxyFilePath() {
 	return dshHomePath("plugins", "subscriptions", "proxy.json");
@@ -392,7 +393,7 @@ async function applyConfig(cfg) {
 			withError(error);
 			next = void 0;
 		}
-		current = cfg;
+		current$1 = cfg;
 	}
 	const previous = agent;
 	agent = next;
@@ -432,16 +433,16 @@ async function loadConfigFile(path) {
 	});
 }
 /** Resolve the module state once from disk; failures disable the proxy. */
-async function ensureReady() {
-	ready ??= loadConfigFile(proxyFilePath()).then(async (cfg) => {
+async function ensureReady$1() {
+	ready$1 ??= loadConfigFile(proxyFilePath()).then(async (cfg) => {
 		await applyConfig(cfg);
-		return current;
+		return current$1;
 	}, async (error) => {
 		withError(error);
 		await applyConfig(void 0);
-		return current;
+		return current$1;
 	});
-	return ready;
+	return ready$1;
 }
 /** Persist a config atomically with owner-only permissions, then apply it. */
 async function persistConfig(cfg, path) {
@@ -462,13 +463,13 @@ async function persistConfig(cfg, path) {
 *   load/apply failure when the stored config is unusable.
 */
 async function proxyGetConfig() {
-	await ensureReady();
+	await ensureReady$1();
 	return {
-		enabled: current.enabled,
-		url: current.url,
-		...current.username === void 0 ? {} : { username: current.username },
-		passwordSet: current.password !== void 0 && current.password !== "",
-		bypass: [...current.bypass],
+		enabled: current$1.enabled,
+		url: current$1.url,
+		...current$1.username === void 0 ? {} : { username: current$1.username },
+		passwordSet: current$1.password !== void 0 && current$1.password !== "",
+		bypass: [...current$1.bypass],
 		...configError === void 0 ? {} : { error: configError }
 	};
 }
@@ -479,14 +480,14 @@ async function proxyGetConfig() {
 * @returns the resulting view (secrets omitted).
 */
 async function proxySetConfig(input) {
-	await ensureReady();
-	const password = input.password === void 0 ? current.password : input.password === null || input.password === "" ? void 0 : input.password;
+	await ensureReady$1();
+	const password = input.password === void 0 ? current$1.password : input.password === null || input.password === "" ? void 0 : input.password;
 	const next = normalizeConfig({
 		enabled: input.enabled,
 		url: input.url,
 		...input.username === void 0 ? {} : { username: input.username },
 		...password === void 0 ? {} : { password },
-		bypass: input.bypass ?? current.bypass
+		bypass: input.bypass ?? current$1.bypass
 	});
 	await persistConfig(next, proxyFilePath());
 	await applyConfig(next);
@@ -502,16 +503,16 @@ async function proxySetConfig(input) {
 * host's global fetch.
 */
 async function proxiedFetch(input, init = {}) {
-	await ensureReady();
+	await ensureReady$1();
 	let dispatcher;
-	if (current.enabled && agent !== void 0) {
+	if (current$1.enabled && agent !== void 0) {
 		let hostname = "";
 		try {
 			hostname = (typeof input === "string" ? new URL(input) : input instanceof URL ? input : new URL(input.url)).hostname;
 		} catch {
 			hostname = "";
 		}
-		if (!matchesBypass(hostname, current.bypass)) dispatcher = agent;
+		if (!matchesBypass(hostname, current$1.bypass)) dispatcher = agent;
 	}
 	if (dispatcher === void 0) return fetch(input, init);
 	return dispatchFetch(input, {
@@ -544,7 +545,7 @@ async function proxyTestConnection(target = DEFAULT_PROXY_TEST_URL, draft) {
 			error: errorMessage(error)
 		};
 	}
-	await ensureReady();
+	await ensureReady$1();
 	let probeAgent;
 	let viaProxy;
 	let closeProbe = false;
@@ -566,7 +567,7 @@ async function proxyTestConnection(target = DEFAULT_PROXY_TEST_URL, draft) {
 		};
 	}
 	else {
-		viaProxy = current.enabled && agent !== void 0 && !matchesBypass(parsed.hostname, current.bypass);
+		viaProxy = current$1.enabled && agent !== void 0 && !matchesBypass(parsed.hostname, current$1.bypass);
 		probeAgent = viaProxy ? agent : void 0;
 	}
 	const started = Date.now();
@@ -1227,6 +1228,22 @@ function readString(payload, field) {
 	if (typeof value !== "string" || value.length === 0) throw new BadRequest(`payload.${field} must be a non-empty string`);
 	return value;
 }
+/** Validate the `setModelDefault` endpoint's payload. */
+function readModelDefaultInput(payload) {
+	const provider = readProvider(payload);
+	const model = readString(payload, "model");
+	const record = payload;
+	let effort;
+	if (record.effort !== void 0) {
+		if (typeof record.effort !== "string" || record.effort.length === 0) throw new BadRequest("payload.effort must be a non-empty string when present");
+		effort = record.effort;
+	}
+	return {
+		provider,
+		model,
+		...effort === void 0 ? {} : { effort }
+	};
+}
 /** Validate the optional Claude login method. */
 function readLoginMethod(payload, provider) {
 	const method = payload.method;
@@ -1279,6 +1296,14 @@ function readVideoName(payload) {
 	if (typeof name$1 !== "string" || !VIDEO_NAME_PATTERN.test(name$1)) throw new BadRequest("payload.name must be a bare .mp4 file name");
 	return name$1;
 }
+/** Validate the `usage` endpoint's optional force flag. */
+function readForce(payload) {
+	if (typeof payload !== "object" || payload === null) return false;
+	const force = payload.force;
+	if (force === void 0) return false;
+	if (typeof force !== "boolean") throw new BadRequest("payload.force must be a boolean when present");
+	return force;
+}
 /** Validate the session id both speed endpoints carry. */
 function readSessionId(payload) {
 	if (typeof payload !== "object" || payload === null) throw new BadRequest("payload must be an object");
@@ -1346,7 +1371,7 @@ function readProxyTestPayload(payload) {
 		...proxy === void 0 ? {} : { proxy }
 	};
 }
-async function dispatch(controller, speed, proxy, endpoint, payload, signal) {
+async function dispatch(controller, speed, proxy, modelDefaults, endpoint, payload, signal) {
 	switch (endpoint) {
 		case "status": {
 			const entries = await Promise.all(PROVIDER_IDS.map(async (provider) => [provider, await controller.status(provider)]));
@@ -1376,7 +1401,7 @@ async function dispatch(controller, speed, proxy, endpoint, payload, signal) {
 		}
 		case "usage": {
 			const provider = readProvider(payload);
-			return ok(await controller.usage(provider, readString(payload, "account"), signal));
+			return ok(await controller.usage(provider, readString(payload, "account"), signal, readForce(payload)));
 		}
 		case "image": return ok(await controller.readImage(readImageRef(payload), signal));
 		case "video": return ok(await controller.readVideo(readVideoName(payload), signal));
@@ -1393,6 +1418,16 @@ async function dispatch(controller, speed, proxy, endpoint, payload, signal) {
 		case "proxyTest":
 			if (proxy === void 0) throw new BadRequest("proxy configuration is unavailable");
 			return ok(await proxy.test(readProxyTestPayload(payload)));
+		case "modelDefaults":
+			if (modelDefaults === void 0) throw new BadRequest("model defaults are unavailable");
+			return ok(await modelDefaults.catalog());
+		case "setModelDefault":
+			if (modelDefaults === void 0) throw new BadRequest("model defaults are unavailable");
+			{
+				const input = readModelDefaultInput(payload);
+				await modelDefaults.set(input.provider, input.model, input.effort);
+			}
+			return ok({ ok: true });
 		default: throw new BadRequest(`unknown /subscriptions-auth endpoint "${endpoint}"`);
 	}
 }
@@ -1402,13 +1437,14 @@ async function dispatch(controller, speed, proxy, endpoint, payload, signal) {
 * @param controller - the auth operations backing the endpoints.
 * @param speed - the per-session speed-tier state backing the Speed toggle.
 * @param proxy - optional proxy-config controller backing `proxyGet`/`proxySet`/`proxyTest`.
+* @param modelDefaults - optional per-model default-effort state backing `modelDefaults`/`setModelDefault`.
 */
-function registerAuthRpc(ctx, controller, speed, proxy = void 0) {
+function registerAuthRpc(ctx, controller, speed, proxy = void 0, modelDefaults = void 0) {
 	ctx.inject(["connection"], (ctx$1) => {
 		const connection = ctx$1.get("connection");
 		ctx$1.effect(() => connection.rpc.handle(SUBSCRIPTIONS_AUTH_CHANNEL, async (endpoint, payload, signal) => {
 			try {
-				return await dispatch(controller, speed, proxy, endpoint, payload, signal);
+				return await dispatch(controller, speed, proxy, modelDefaults, endpoint, payload, signal);
 			} catch (error) {
 				return failure(error);
 			}
@@ -1416,6 +1452,442 @@ function registerAuthRpc(ctx, controller, speed, proxy = void 0) {
 	});
 }
 
+//#endregion
+//#region src/model-defaults.ts
+/** Absolute path of the defaults file. */
+function modelDefaultsFilePath() {
+	return dshHomePath("plugins", "subscriptions", "model-defaults.json");
+}
+const EMPTY = Object.freeze({});
+/** In-memory snapshot read by every consumer (adapters, RPC). */
+let current = EMPTY;
+/** One lazy load of the on-disk file (read once per process). */
+let ready;
+/** Last load failure, surfaced to callers that care; defaults stay empty. */
+let loadError;
+/**
+* Serialises every write: the read-modify-write sequence must not interleave,
+* or a fast second save would compute its snapshot from the stale `current`
+* and silently drop the first update (the UI disables only the row being
+* saved, so overlaps are reachable).
+*/
+let writeChain = Promise.resolve();
+/**
+* Validate one persisted provider section: a string→string map, or undefined.
+* Malformed *entries* are skipped, not the whole section: one bad value (a
+* hand edit losing its quotes) must not silently un-configure every model in
+* that provider. What was dropped is reported so the caller can surface it
+* instead of the loss disappearing.
+*/
+function sanitizeProvider(value, dropped) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const entries = {};
+	for (const [model, effort] of Object.entries(value)) {
+		if (typeof effort !== "string" || effort.length === 0) {
+			dropped.push(model);
+			continue;
+		}
+		entries[model] = effort;
+	}
+	if (Object.keys(entries).length === 0) return void 0;
+	return Object.freeze(entries);
+}
+/** Validate the raw document: only known providers, malformed sections dropped. */
+function sanitizeDefaults(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return {
+		defaults: EMPTY,
+		dropped: []
+	};
+	const record = value;
+	const result = {};
+	const dropped = [];
+	for (const provider of PROVIDER_IDS) {
+		const section = sanitizeProvider(record[provider], dropped);
+		if (section !== void 0) result[provider] = section;
+	}
+	return {
+		defaults: Object.freeze(result),
+		dropped
+	};
+}
+/** Read and validate the on-disk file; a missing file reads as empty. */
+async function loadFile(path) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return EMPTY;
+		throw error;
+	}
+	try {
+		const { defaults, dropped } = sanitizeDefaults(JSON.parse(text));
+		if (dropped.length > 0) loadError = /* @__PURE__ */ new Error(`subscriptions model defaults: ${dropped.length} malformed entr${dropped.length === 1 ? "y" : "ies"} skipped (${dropped.join(", ")}); fix or delete the file`);
+		return defaults;
+	} catch {
+		throw new Error(`subscriptions model defaults at ${path} are not valid JSON; fix or delete the file`);
+	}
+}
+/** Resolve the module state once from disk; failures leave the defaults empty. */
+async function ensureReady() {
+	ready ??= loadFile(modelDefaultsFilePath()).then((loaded) => {
+		current = loaded;
+	}, (error) => {
+		loadError = error;
+		current = EMPTY;
+	});
+	return ready;
+}
+/** Persist a snapshot atomically with owner-only permissions. */
+async function atomicPersist(defaults, path) {
+	await mkdir(dirname(path), { recursive: true });
+	const tmp = `${path}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
+	try {
+		await writeFile(tmp, JSON.stringify(defaults, null, 2), { mode: 384 });
+		await chmod(tmp, 384);
+		await rename(tmp, path);
+	} catch (error) {
+		await rm(tmp, { force: true });
+		throw error;
+	}
+}
+let persistDefaults = atomicPersist;
+/**
+* Clone one provider section, or undefined when nothing is configured for it.
+* The clone is prototype-less: model ids are provider-supplied catalog data
+* used as object keys, and consumers index the section directly (the RPC
+* catalog in index.ts does), so an id like `toString` would otherwise yield an
+* inherited *function* where a string is declared.
+*/
+function sectionOf(defaults, provider) {
+	const section = defaults[provider];
+	if (section === void 0) return void 0;
+	return Object.assign(Object.create(null), section);
+}
+/**
+* Ready the defaults store.
+* @internal Exported for tests; index.ts calls it at apply time so every
+* later synchronous read sees the persisted state.
+*/
+async function loadModelDefaults() {
+	await ensureReady();
+}
+/**
+* The configured default effort for one model, or undefined when none (the
+* picker then follows the provider's own default).
+* @internal Exported for the adapters' `defaultEffortOf` options.
+*/
+function defaultEffortOf(provider, model) {
+	const section = current[provider];
+	if (section === void 0) return void 0;
+	return Object.prototype.hasOwnProperty.call(section, model) ? section[model] : void 0;
+}
+/**
+* Set or clear one model's configured default effort, then persist. The
+* memory snapshot updates only after the atomic write succeeds, so a failed
+* write never leaves the live state ahead of the file.
+* @param provider - the subscription provider route.
+* @param model - the wire model id.
+* @param effort - the effort id, or undefined to clear the override.
+*/
+function setDefaultEffort(provider, model, effort) {
+	const run = writeChain.then(async () => {
+		await ensureReady();
+		const section = { ...sectionOf(current, provider) ?? {} };
+		if (effort === void 0) delete section[model];
+		else section[model] = effort;
+		const next = { ...current };
+		if (Object.keys(section).length === 0) delete next[provider];
+		else next[provider] = Object.freeze(section);
+		const frozen = Object.freeze(next);
+		await persistDefaults(frozen, modelDefaultsFilePath());
+		current = frozen;
+	});
+	writeChain = run.catch(() => void 0);
+	return run;
+}
+
+//#endregion
+//#region src/providers/rate-limit.ts
+/**
+* Extra time added to every provider-disclosed wait. Absorbs clock skew
+* between the harness and the provider, so a retry does not land a moment
+* before the window actually reopens and burn an attempt on a second 429.
+*/
+const RESET_GRACE_MS = 2e3;
+/** Shortest wait ever scheduled, including for a reset instant already in the past. */
+const MIN_WAIT_MS = 1e3;
+/** Below this a bare number is a delay in seconds rather than an epoch stamp. */
+const EPOCH_SECONDS_FLOOR = 1e9;
+/** At or above this a bare epoch stamp is already in milliseconds. */
+const EPOCH_MILLIS_FLOOR = 0xe8d4a51000;
+/** Node's maximum timer delay; a longer wait cannot be scheduled at all. */
+const MAX_TIMER_DELAY_MS = 2147483647;
+/** Default ceiling on a rate-limit wait: six hours covers a five-hour session window with slack. */
+const DEFAULT_RATE_LIMIT_MAX_WAIT_MS = 360 * 60 * 1e3;
+/**
+* Interpret a bare numeric rate-limit value, which providers write in three
+* shapes: epoch milliseconds, epoch seconds, or a delay in seconds. The
+* magnitude separates them unambiguously for any plausible value — an epoch in
+* seconds is ~1.8e9 today, while a delay of even a full week is ~6e5.
+* @param value - the raw numeric value.
+* @param now - the current epoch milliseconds.
+* @returns epoch milliseconds of the reset, or undefined when the value is unusable.
+*/
+function resetInstantFromNumber(value, now) {
+	if (!Number.isFinite(value) || value <= 0) return void 0;
+	if (value >= EPOCH_MILLIS_FLOOR) return value;
+	if (value >= EPOCH_SECONDS_FLOOR) return value * 1e3;
+	return now + value * 1e3;
+}
+/**
+* Parse a Go-style duration (`6m0s`, `1h2m3.5s`, `150ms`) into milliseconds —
+* the form OpenAI-compatible `x-ratelimit-reset-*` headers use.
+* @param text - the raw header value.
+* @returns the duration in milliseconds, or undefined when the text is not one.
+*/
+function durationMs(text) {
+	const trimmed = text.trim();
+	if (trimmed.length === 0) return void 0;
+	const pattern = /(\d+(?:\.\d+)?)(ms|h|m|s)/y;
+	const units = {
+		h: 36e5,
+		m: 6e4,
+		s: 1e3,
+		ms: 1
+	};
+	let total = 0;
+	let matched = false;
+	let index = 0;
+	let previousUnit = Number.POSITIVE_INFINITY;
+	for (;;) {
+		pattern.lastIndex = index;
+		const match = pattern.exec(trimmed);
+		if (match === null) break;
+		const unit = units[match[2]];
+		if (unit >= previousUnit) return void 0;
+		previousUnit = unit;
+		total += Number(match[1]) * unit;
+		index = pattern.lastIndex;
+		matched = true;
+	}
+	if (!matched || index !== trimmed.length) return void 0;
+	return total > 0 ? total : void 0;
+}
+/**
+* Interpret any single rate-limit value — a number, a numeric string, a
+* duration (`6m0s`), or a date — as the instant a window reopens. One reader
+* for every shape, so a provider that changes the encoding of a field it
+* already sends does not need a code change here.
+* @param value - the raw header value or JSON field.
+* @param now - the current epoch milliseconds.
+* @returns epoch milliseconds of the reset, or undefined when the value is unusable.
+*/
+function resetInstantFromValue(value, now) {
+	if (typeof value === "number") return resetInstantFromNumber(value, now);
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	if (trimmed.length === 0) return void 0;
+	const numeric = Number(trimmed);
+	if (Number.isFinite(numeric)) return resetInstantFromNumber(numeric, now);
+	const duration = durationMs(trimmed);
+	if (duration !== void 0) return now + duration;
+	const parsed = Date.parse(trimmed);
+	return Number.isFinite(parsed) ? parsed : void 0;
+}
+/**
+* Read a header carrying any of the {@link resetInstantFromValue} shapes.
+* @param response - the failed response.
+* @param name - the header to read.
+* @param now - the current epoch milliseconds.
+* @returns epoch milliseconds of the reset, or undefined when absent or unusable.
+*/
+function resetInstantFromHeader(response, name$1, now) {
+	return resetInstantFromValue(response.headers.get(name$1), now);
+}
+/**
+* Read the RFC 7231 `retry-after` header in both its forms: a delay in seconds
+* (never an epoch stamp, whatever its magnitude) or an HTTP-date.
+* @param response - the failed response.
+* @param now - the current epoch milliseconds.
+* @returns epoch milliseconds of the reset, or undefined when absent or unusable.
+*/
+function retryAfterInstant(response, now) {
+	const raw = response.headers.get("retry-after");
+	if (raw === null) return void 0;
+	const trimmed = raw.trim();
+	if (trimmed.length === 0) return void 0;
+	const seconds = Number(trimmed);
+	if (Number.isFinite(seconds)) return seconds > 0 ? now + seconds * 1e3 : void 0;
+	const parsed = Date.parse(trimmed);
+	return Number.isFinite(parsed) ? parsed : void 0;
+}
+/**
+* Parse a response body as JSON without throwing on the non-JSON bodies
+* providers occasionally return under load (an HTML gateway page, say).
+* @param body - the complete response body.
+* @returns the parsed value, or undefined when the body is not JSON.
+*/
+function jsonBody(body) {
+	if (body.length === 0) return void 0;
+	try {
+		return JSON.parse(body);
+	} catch {
+		return;
+	}
+}
+/** How deep {@link resetFromFields} walks; every observed payload nests one or two levels. */
+const MAX_BODY_DEPTH = 4;
+/**
+* Find a reset instant under any of the named keys, anywhere in a parsed body.
+*
+* The search is by key rather than by path on purpose: providers move the same
+* field between containers (`detail`, `error`, top level) across endpoints and
+* versions, and a path-shaped reader silently stops working when they do. Only
+* the key list is provider-specific.
+* @param value - the parsed body, or any nested value.
+* @param keys - field names this provider uses for a reset or delay.
+* @param now - the current epoch milliseconds.
+* @param depth - remaining recursion depth.
+* @returns the earliest instant found, or undefined when no key matched.
+*/
+function resetFromFields(value, keys, now, depth = MAX_BODY_DEPTH) {
+	if (depth <= 0 || value === null || typeof value !== "object") return void 0;
+	let earliest;
+	const consider = (candidate) => {
+		if (candidate !== void 0 && (earliest === void 0 || candidate < earliest)) earliest = candidate;
+	};
+	if (Array.isArray(value)) {
+		for (const item of value) consider(resetFromFields(item, keys, now, depth - 1));
+		return earliest;
+	}
+	for (const [key, nested] of Object.entries(value)) if (keys.includes(key)) consider(resetInstantFromValue(nested, now));
+	else consider(resetFromFields(nested, keys, now, depth - 1));
+	return earliest;
+}
+/**
+* The earliest of several candidate reset instants, ignoring absent ones. The
+* earliest is the one that matters: it is the first moment any of the reported
+* limits allows a request again.
+* @param candidates - reset instants in no particular order.
+* @returns the earliest instant, or undefined when every candidate is absent.
+*/
+function earliestReset(...candidates) {
+	let earliest;
+	for (const candidate of candidates) {
+		if (candidate === void 0) continue;
+		if (earliest === void 0 || candidate < earliest) earliest = candidate;
+	}
+	return earliest;
+}
+/**
+* Turn a reset instant into the wait to report as `providerRetryAfterMs`.
+*
+* Deliberately not capped: a reset beyond the policy's `maxDelayMs` makes the
+* retry plugin delegate immediately, failing the turn at once with the real
+* reset in the message, rather than clamping the wait down and burning the
+* retry budget against a window that is still closed.
+* @param instant - epoch milliseconds the window reopens.
+* @param now - the current epoch milliseconds.
+* @returns the wait in milliseconds, never below {@link MIN_WAIT_MS}.
+*/
+function waitFromReset(instant, now) {
+	return Math.max(MIN_WAIT_MS, instant - now + RESET_GRACE_MS);
+}
+/** Header names worth showing when a 429 disclosed no reset this code recognizes. */
+const DIAGNOSTIC_HEADER = /rate-?limit|retry|reset|^x-codex-/i;
+/**
+* Render the rate-limit-shaped headers and the head of the body of a 429 whose
+* reset instant nothing parsed. Emitted through the adapter's `onWarn`, this is
+* how an unrecognized provider field gets named from live traffic instead of
+* being guessed at.
+*
+* It is also where the per-bucket rollover snapshots land by design — no reader
+* parks a turn on one, because on a 429 they cannot say which bucket refused —
+* so the operator still sees what the provider disclosed.
+* @param response - the failed response.
+* @param body - the complete response body.
+* @returns a one-line diagnostic.
+*/
+function rateLimitDiagnostics(response, body) {
+	const headers = [];
+	response.headers.forEach((value, key) => {
+		if (DIAGNOSTIC_HEADER.test(key)) headers.push(`${key}: ${value}`);
+	});
+	headers.sort();
+	const rendered = headers.length > 0 ? headers.join("; ") : "(none)";
+	const head = body.slice(0, 200);
+	return `429 disclosed no reset time; headers [${rendered}]; body ${head.length > 0 ? head : "(empty)"}`;
+}
+/**
+* The retry shape every subscription route starts from: Claude Code's own SDK
+* numbers — ten retries after the first attempt, exponential backoff from 1s
+* doubling per attempt, capped at 60s, plus 20% jitter.
+*
+* Shared across all four routes rather than kept to claude, because what these
+* numbers are tuned for is the shape of a subscription endpoint — a consumer
+* plan behind a session window, which sheds load in bursts and rewards an
+* attempt that outlasts them — and that is the same on all four. The dsh-llm
+* defaults (5 retries from 500ms to 10s) give up after about fifteen seconds,
+* which is short for that.
+*
+* The 60s cap governs local backoff only: a disclosed rate-limit reset is
+* accepted up to the configured wait ceiling instead.
+*/
+const DEFAULT_RETRY = Object.freeze({
+	maxRetries: 10,
+	initialDelayMs: 1e3,
+	maxDelayMs: 6e4,
+	jitterRatio: .2
+});
+/** Waiting behavior a route falls back to when the plugin passed none (waiting on, six-hour ceiling). */
+const DEFAULT_RATE_LIMIT_WAIT = Object.freeze({
+	wait: true,
+	maxWaitMs: DEFAULT_RATE_LIMIT_MAX_WAIT_MS
+});
+/**
+* Validate and default the rate-limit waiting config.
+* @param config - the raw plugin config section, when present.
+* @param path - diagnostic path naming the config that owns the value.
+* @returns the resolved, immutable behavior.
+*/
+function resolveRateLimitWait(config, path) {
+	const wait = config?.wait ?? true;
+	const maxWaitMs = config?.maxWaitMs ?? DEFAULT_RATE_LIMIT_MAX_WAIT_MS;
+	if (!Number.isFinite(maxWaitMs) || maxWaitMs <= 0) throw new Error(`${path}.maxWaitMs must be a positive finite number of milliseconds`);
+	if (maxWaitMs > MAX_TIMER_DELAY_MS) throw new Error(`${path}.maxWaitMs must be no greater than ${String(MAX_TIMER_DELAY_MS)} (the maximum schedulable delay)`);
+	return Object.freeze({
+		wait,
+		maxWaitMs
+	});
+}
+/**
+* Resolve one route's retry policy, widening the delay ceiling to the
+* configured wait so a disclosed reset hours out is accepted rather than
+* refused.
+*
+* The ceiling is shared with local exponential backoff, so widening it also
+* raises how long an unrelated transient failure may back off for. That stays
+* bounded by the finite retry budget — the claude route's ten retries reach
+* 512 s per attempt at most — and it only governs when the provider disclosed
+* nothing, which is exactly the case where a longer wait is the safer guess.
+* @param defaults - the route's retry shape.
+* @param rateLimit - resolved waiting behavior.
+* @param path - diagnostic path naming the provider route.
+* @returns the policy to report from `providerRetryPolicy`.
+*/
+function subscriptionRetryPolicy(defaults, rateLimit, path) {
+	const maxDelayMs = rateLimit.wait ? Math.max(defaults.maxDelayMs, rateLimit.maxWaitMs) : defaults.maxDelayMs;
+	return resolveRetryPolicy({
+		mode: "normal",
+		maxRetries: defaults.maxRetries,
+		backoff: {
+			initialDelayMs: defaults.initialDelayMs,
+			maxDelayMs,
+			jitterRatio: defaults.jitterRatio
+		}
+	}, path);
+}
+
 //#endregion
 //#region src/providers/common.ts
 /**
@@ -1446,38 +1918,56 @@ function validateModels(models, label) {
 	});
 }
 /**
-* Build an LlmError from a non-2xx provider response, reading and truncating
-* the body for the message and mapping the status to a stable code.
+* Build an LlmError from a non-2xx provider response, mapping the status to a
+* stable code and, for a rate-limited request, the disclosed reset instant to
+* the `providerRetryAfterMs` the retry plugin waits out.
+*
+* A 429 classifies as `RATE_LIMIT` on the strength of the status alone, ahead
+* of the quota-wording check. On these routes there is no terminal quota to
+* distinguish: a subscription has no balance to top up, only a window that
+* reopens, and providers announce an exhausted window with wording
+* (`usage_limit_reached`) the shared classifier reads as permanent.
 * @param response - the failed response.
 * @param label - diagnostic prefix naming the provider API.
+* @param options - the calling provider's rate-limit reader and warning sink.
 * @returns the classified error.
 */
-async function httpLlmError(response, label) {
+async function httpLlmError(response, label, options = {}) {
 	let body = "";
 	try {
-		body = (await response.text()).slice(0, 500);
+		body = await response.text();
 	} catch {}
-	const message = body.length > 0 ? `${label} error (HTTP ${String(response.status)}): ${body}` : `${label} error (HTTP ${String(response.status)})`;
+	const shown = body.slice(0, 500);
+	const message = shown.length > 0 ? `${label} error (HTTP ${String(response.status)}): ${shown}` : `${label} error (HTTP ${String(response.status)})`;
 	let code;
 	if (response.status === 401 || response.status === 403) code = "AUTH";
-	else if (isQuotaExceededError(body)) code = QUOTA_EXCEEDED_CODE;
 	else if (response.status === 429) code = "RATE_LIMIT";
-	else if (response.status === 400 && isContextWindowExceededError(body)) code = CONTEXT_WINDOW_EXCEEDED_CODE;
+	else if (isQuotaExceededError(shown)) code = QUOTA_EXCEEDED_CODE;
+	else if (response.status === 400 && isContextWindowExceededError(shown)) code = CONTEXT_WINDOW_EXCEEDED_CODE;
 	else if (response.status === 408 || response.status === 504) code = "TIMEOUT";
 	else if (response.status >= 500) code = "SERVER";
 	else code = `HTTP_${String(response.status)}`;
-	const retryAfter = response.headers.get("retry-after");
-	let providerRetryAfterMs;
-	if (retryAfter !== null) {
-		const seconds = Number(retryAfter);
-		if (Number.isFinite(seconds) && seconds > 0) providerRetryAfterMs = seconds * 1e3;
-	}
+	const now = Date.now();
+	const rateLimited = response.status === 429;
+	const reset = rateLimited ? options.rateLimitReset?.(response, body, now) ?? retryAfterInstant(response, now) : retryAfterInstant(response, now);
+	if (reset === void 0 && rateLimited) options.onWarn?.(`${label}: ${rateLimitDiagnostics(response, body)}`);
 	return new LlmError(message, code, {
 		status: response.status,
-		...providerRetryAfterMs === void 0 ? {} : { providerRetryAfterMs }
+		...reset === void 0 ? {} : { providerRetryAfterMs: waitFromReset(reset, now) }
 	});
 }
 /**
+* Parse a response's `retry-after` header (seconds) into milliseconds.
+* @param response - the failed response.
+* @returns the delay in ms, or undefined when absent/unusable.
+*/
+function parseRetryAfterMs(response) {
+	const retryAfter = response.headers.get("retry-after");
+	if (retryAfter === null) return void 0;
+	const seconds = Number(retryAfter);
+	return Number.isFinite(seconds) && seconds > 0 ? seconds * 1e3 : void 0;
+}
+/**
 * Create an idle watchdog chained to the caller's signal.
 * @param caller - the request's own abort signal, when present.
 * @param timeoutMs - maximum idle interval while a stream read is outstanding.
@@ -1531,11 +2021,20 @@ var OAuthEndpointError = class extends Error {
 	status;
 	/** The provider's OAuth `error` code (e.g. `invalid_grant`), when present. */
 	oauthCode;
-	constructor(message, status, oauthCode) {
+	/**
+	* The endpoint's `retry-after`, in ms, when it sent one. Usage/models
+	* endpoints reuse this error type and can rate-limit progressively (each
+	* hit within the window extends the next one), so a caller retrying on a
+	* fixed schedule instead of honoring this can keep an account locked out
+	* indefinitely.
+	*/
+	retryAfterMs;
+	constructor(message, status, oauthCode, retryAfterMs$1) {
 		super(message);
 		this.name = "OAuthEndpointError";
 		this.status = status;
 		this.oauthCode = oauthCode;
+		this.retryAfterMs = retryAfterMs$1;
 	}
 };
 /**
@@ -1552,7 +2051,7 @@ async function oauthEndpointError(response, label) {
 		oauthCode = typeof parsed.error === "string" ? parsed.error : void 0;
 		detail = typeof parsed.error_description === "string" ? parsed.error_description : oauthCode ?? "";
 	} catch {}
-	return new OAuthEndpointError(detail.length > 0 ? `${label} token endpoint error (HTTP ${String(response.status)}): ${detail}` : `${label} token endpoint error (HTTP ${String(response.status)})`, response.status, oauthCode);
+	return new OAuthEndpointError(detail.length > 0 ? `${label} token endpoint error (HTTP ${String(response.status)}): ${detail}` : `${label} token endpoint error (HTTP ${String(response.status)})`, response.status, oauthCode, parseRetryAfterMs(response));
 }
 /**
 * Per-provider session freshness: loads the stored session, refreshes
@@ -1609,9 +2108,9 @@ var TokenManager = class {
 		}
 	}
 	async doRefresh(session) {
-		const current$1 = await this.options.load();
-		if (current$1 !== void 0 && current$1.accessToken !== session.accessToken && current$1.expiresAt - Date.now() > this.options.preemptMs) return current$1;
-		const next = await this.options.refresh(current$1 ?? session);
+		const current$2 = await this.options.load();
+		if (current$2 !== void 0 && current$2.accessToken !== session.accessToken && current$2.expiresAt - Date.now() > this.options.preemptMs) return current$2;
+		const next = await this.options.refresh(current$2 ?? session);
 		await this.options.save(next);
 		return next;
 	}
@@ -1633,6 +2132,59 @@ function withTimeout(work, timeoutMs) {
 		throw error;
 	}), aborted]);
 }
+/** Display name for a wire reasoning-effort identifier. */
+function effortDisplayName(effort) {
+	return effort === "xhigh" ? "Extra High" : effort.charAt(0).toUpperCase() + effort.slice(1);
+}
+/**
+* Fold a configured per-model default effort into a reasoning block, keeping
+* the DSH runtime invariant `defaultEffort ∈ efforts` (the runtime rejects an
+* unknown default with `INVALID_MODEL_REASONING`).
+*
+* A configured level the base set does not advertise is *dropped*, not
+* appended: for claude/grok/copilot the base is the provider's live catalog,
+* i.e. the truth about what the model accepts, so honouring a stale override
+* would put an unsupported effort on every single request instead of letting
+* the harness reject it before provider I/O. The override then simply falls
+* back to the provider's own default until the user picks a level the catalog
+* still lists.
+*
+* `extendable` opts into the opposite rule for a base that is a *built-in
+* fallback* rather than discovered truth (codex, whose static effort list is
+* known to trail the backend): there, appending the configured level is how a
+* newly shipped tier becomes selectable at all.
+* @param configuredDefault - the user-configured default effort id, or undefined.
+* @param base - the discovered/built-in reasoning block, or undefined.
+* @param options - `extendable` marks the base as a fallback that may be extended.
+* @returns the merged block, or undefined when neither side contributes one.
+*/
+function mergeReasoning(configuredDefault, base, options) {
+	const detached = base === void 0 ? void 0 : {
+		efforts: [...base.efforts],
+		...base.defaultEffort === void 0 ? {} : { defaultEffort: base.defaultEffort }
+	};
+	if (configuredDefault === void 0) return detached;
+	const effort = ReasoningEffortId(configuredDefault);
+	if (base === void 0) return options?.extendable === true ? {
+		efforts: [{
+			id: effort,
+			name: effortDisplayName(effort)
+		}],
+		defaultEffort: effort
+	} : void 0;
+	if (base.efforts.some((entry) => entry.id === effort)) return {
+		efforts: [...base.efforts],
+		defaultEffort: effort
+	};
+	if (options?.extendable !== true) return detached;
+	return {
+		efforts: [...base.efforts, {
+			id: effort,
+			name: effortDisplayName(effort)
+		}],
+		defaultEffort: effort
+	};
+}
 /**
 * First account catalog that lists `model` (callers pass default-first).
 * One failing lookup sits that account out so a sibling's metadata still
@@ -2557,7 +3109,8 @@ var PoolUsageTracker = class {
 	/**
 	* The quota view of one member. A cold cache awaits the first fetch; a
 	* stale one answers immediately while the refresh serves the NEXT call
-	* (member selection must never block on the network mid-conversation).
+	* (member selection must never block on the network mid-conversation). A
+	* failure still cooling down degrades immediately with no network call.
 	* @param member - the pool member to score (account resolved).
 	* @returns availability plus the urgency score.
 	*/
@@ -2570,10 +3123,13 @@ var PoolUsageTracker = class {
 			fetchedAt: 0
 		};
 		const entry = this.entries.get(key);
-		if (entry !== void 0 && Date.now() - entry.at < this.ttlMs) return this.score(member, entry);
 		if (entry !== void 0) {
-			this.refresh(key, fetcher).catch(() => void 0);
-			return this.score(member, entry);
+			const fresh = Date.now() - entry.at < (entry.cooldownMs ?? this.ttlMs);
+			if (entry.snapshot !== void 0) {
+				if (!fresh) this.refresh(key, fetcher).catch(() => void 0);
+				return this.score(member, entry);
+			}
+			if (fresh) return degradedQuota(entry.error);
 		}
 		try {
 			const snapshot = await this.refresh(key, fetcher);
@@ -2582,17 +3138,31 @@ var PoolUsageTracker = class {
 				at: Date.now()
 			});
 		} catch (error) {
-			return isMissingOrInvalidCredential(error) ? {
-				available: false,
-				urgency: 0,
-				fetchedAt: 0
-			} : {
-				available: true,
-				urgency: 0,
-				fetchedAt: 0
-			};
+			return degradedQuota(error);
 		}
 	}
+	/**
+	* Same cache as {@link quotaFor}, for direct display (the Settings page):
+	* the raw snapshot, or the original fetch error, instead of a routing
+	* score.
+	* @param provider - the account's provider.
+	* @param account - the account key.
+	* @param force - bypass a fresh cached SNAPSHOT for an honest re-check (the
+	*   manual Refresh button). A live failure cooldown is never bypassed —
+	*   retrying through it is exactly what turns a 429 into a permanent
+	*   lockout, so even a forced call still answers from the negative cache.
+	* @returns `{ supported: false }` when the provider has no usage fetcher.
+	*/
+	async snapshotFor(provider, account, force = false) {
+		const fetcher = this.fetcherFor(provider, account);
+		if (fetcher === void 0) return { supported: false };
+		const key = `${provider}/${account}`;
+		const entry = this.entries.get(key);
+		if (entry !== void 0 && Date.now() - entry.at < (entry.cooldownMs ?? this.ttlMs)) if (entry.snapshot !== void 0) {
+			if (!force) return entry.snapshot;
+		} else throw entry.error;
+		return this.refresh(key, fetcher);
+	}
 	/** Drop cached snapshots: one account, or a whole provider when `account` is omitted. */
 	invalidate(provider, account) {
 		if (account !== void 0) {
@@ -2601,7 +3171,14 @@ var PoolUsageTracker = class {
 		}
 		for (const key of [...this.entries.keys()]) if (key.startsWith(`${provider}/`)) this.entries.delete(key);
 	}
-	/** Run (or join) the single in-flight fetch for one account key. */
+	/**
+	* Run (or join) the single in-flight fetch for one account key, caching
+	* either outcome. A missing/invalid credential is deliberately NOT
+	* negative-cached: it costs no network round trip (the session lookup
+	* fails before the request goes out) and re-checking live means the
+	* member rejoins routing the instant its login is fixed, rather than
+	* waiting out a stale cooldown.
+	*/
 	refresh(key, fetcher) {
 		let pending = this.inflight.get(key);
 		if (pending === void 0) {
@@ -2611,6 +3188,13 @@ var PoolUsageTracker = class {
 					at: Date.now()
 				});
 				return snapshot;
+			}, (error) => {
+				if (!isMissingOrInvalidCredential(error)) this.entries.set(key, {
+					error,
+					at: Date.now(),
+					cooldownMs: cooldownFor(error, this.ttlMs)
+				});
+				throw error;
 			}).finally(() => {
 				this.inflight.delete(key);
 			});
@@ -2635,6 +3219,27 @@ var PoolUsageTracker = class {
 	}
 };
 /**
+* The routing view of a fetch failure. Logged out: the member cannot serve
+* at all. Any other failure (network, endpoint rate limit) must not block
+* routing — the member stays available with a zero score, degrading the
+* strategy to plain priority order for it.
+*/
+function degradedQuota(error) {
+	return isMissingOrInvalidCredential(error) ? {
+		available: false,
+		urgency: 0,
+		fetchedAt: 0
+	} : {
+		available: true,
+		urgency: 0,
+		fetchedAt: 0
+	};
+}
+/** How long to hold a failure in the negative cache: the endpoint's own `retry-after`, or the default TTL. */
+function cooldownFor(error, defaultTtlMs) {
+	return error instanceof OAuthEndpointError && error.retryAfterMs !== void 0 ? error.retryAfterMs : defaultTtlMs;
+}
+/**
 * Whether a window constrains this model: unscoped windows always do; a
 * model-scoped window (Claude's Opus/Sonnet lanes) applies when its scope
 * names the model family.
@@ -2701,6 +3306,14 @@ async function resolveImages(messages, attachments, signal) {
 	})));
 }
 
+//#endregion
+//#region src/compat.ts
+/** Brand a string as a tool-call id: alpha's `ToolCallId`, rc.2's `CallId`. */
+const ToolCallId = (() => {
+	const exports = llm;
+	return exports["ToolCallId"] ?? exports["CallId"];
+})();
+
 //#endregion
 //#region src/translate/sse.ts
 /**
@@ -2895,7 +3508,7 @@ function closeBlock$2(block) {
 		};
 		case "tool-call": return {
 			type: "tool-call",
-			id: CallId(block.callId),
+			id: ToolCallId(block.callId),
 			name: block.name ?? "",
 			arguments: block.text
 		};
@@ -2985,7 +3598,7 @@ var ResponsesStreamTranslator = class {
 					chunks.push({
 						type: "tool-call-delta",
 						index: block.index,
-						id: CallId(callId),
+						id: ToolCallId(callId),
 						...item.name === void 0 ? {} : { name: item.name },
 						argumentsDelta: ""
 					});
@@ -3027,7 +3640,7 @@ var ResponsesStreamTranslator = class {
 				chunks.push({
 					type: "tool-call-delta",
 					index: block.index,
-					id: CallId(block.callId),
+					id: ToolCallId(block.callId),
 					...block.name === void 0 ? {} : { name: block.name },
 					argumentsDelta: event.delta ?? ""
 				});
@@ -3120,6 +3733,28 @@ const CODEX_CONTEXT_WINDOW = 4e5;
 const CODEX_DEFAULT_MAX_TOKENS = 128e3;
 /** Refresh when the access token has less than this much life left. */
 const CODEX_PREEMPT_MS = 5 * 6e4;
+/**
+* Body fields the backend uses to name a reset. A window-exhaustion rejection
+* carries `usage_limit_reached` with the seconds left on the window — the case
+* that used to classify as a terminal quota and never be retried at all.
+*/
+const CODEX_RESET_FIELDS = [
+	"resets_in_seconds",
+	"reset_after_seconds",
+	"resets_at",
+	"reset_at"
+];
+/**
+* Reads the reset instant of the Codex window that rejected a request.
+*
+* Body only. The `x-codex-{primary,secondary}-reset-after-seconds` headers are
+* rollover snapshots the backend attaches to every response, one per window,
+* so they say nothing about which window refused: a burst 429 that would clear
+* in seconds still carries a primary rollover hours out, and reading it would
+* park the turn for those hours. They reach the operator through
+* `rateLimitDiagnostics` instead.
+*/
+const codexRateLimitReset = (_response, body, now) => resetFromFields(jsonBody(body), CODEX_RESET_FIELDS, now);
 /** Default instruction when the request carries no system prompt. */
 const DEFAULT_CODEX_INSTRUCTIONS = "You are Codex, a coding agent based on GPT-5. Help the user with their software engineering tasks.";
 /** Refresh-grant rejections that mean the login is gone for good. */
@@ -3368,10 +4003,6 @@ const CODEX_MODELS_URL = "https://chatgpt.com/backend-api/codex/models";
 * the range of current codex CLI releases.
 */
 const CODEX_CLIENT_VERSION = "0.147.0";
-/** Display name for a wire reasoning-effort value. */
-function effortName(effort) {
-	return effort === "xhigh" ? "Extra High" : effort.charAt(0).toUpperCase() + effort.slice(1);
-}
 /**
 * Whether a catalog entry advertises the fast tier. Mirrors codex-rs
 * `ModelPreset::supports_fast_mode`: a `service_tiers` id matching the fast
@@ -3407,7 +4038,7 @@ async function fetchCodexModels(session, fetchFn = proxiedFetch, signal) {
 		if (entry.visibility === "hide" || entry.visibility === "none") continue;
 		const efforts = (entry.supported_reasoning_levels ?? []).filter((level) => typeof level.effort === "string" && level.effort.length > 0).map((level) => ({
 			id: ReasoningEffortId(level.effort),
-			name: effortName(level.effort),
+			name: effortDisplayName(level.effort),
 			...level.description === void 0 ? {} : { description: level.description }
 		}));
 		const defaultEffort = typeof entry.default_reasoning_level === "string" && entry.default_reasoning_level.length > 0 && efforts.some((effort) => effort.id === ReasoningEffortId(entry.default_reasoning_level)) ? ReasoningEffortId(entry.default_reasoning_level) : void 0;
@@ -3545,6 +4176,9 @@ var CodexAdapter = class extends LlmAdapter {
 			name: "ChatGPT (Codex)"
 		};
 	}
+	providerRetryPolicy(provider) {
+		return subscriptionRetryPolicy(DEFAULT_RETRY, this.options.rateLimit ?? DEFAULT_RATE_LIMIT_WAIT, `codex: provider "${provider}" retryPolicy`);
+	}
 	staticModels(provider) {
 		return this.options.models.map((model) => ({
 			provider,
@@ -3633,6 +4267,10 @@ var CodexAdapter = class extends LlmAdapter {
 	async resolveOwnModel(provider, model) {
 		const discovered = await this.discovered(model);
 		const configured = this.options.models.find((entry) => entry.id === model);
+		const reasoning = mergeReasoning(this.options.defaultEffortOf?.(model), discovered?.reasoning ?? {
+			efforts: CODEX_EFFORTS,
+			defaultEffort: CODEX_DEFAULT_EFFORT
+		}, { extendable: discovered?.reasoning === void 0 });
 		return {
 			provider,
 			id: model,
@@ -3641,10 +4279,7 @@ var CodexAdapter = class extends LlmAdapter {
 			inputModalities: configured?.inputModalities ?? CODEX_MODALITIES,
 			context: { contextWindow: discovered?.contextWindow ?? configured?.contextWindow ?? CODEX_CONTEXT_WINDOW },
 			defaultMaxTokens: configured?.maxTokens ?? CODEX_DEFAULT_MAX_TOKENS,
-			reasoning: discovered?.reasoning ?? {
-				efforts: CODEX_EFFORTS,
-				defaultEffort: CODEX_DEFAULT_EFFORT
-			}
+			...reasoning === void 0 ? {} : { reasoning }
 		};
 	}
 	async *stream(options) {
@@ -3668,7 +4303,10 @@ var CodexAdapter = class extends LlmAdapter {
 				session = await this.options.tokens.session(account, true);
 				response = await this.request(options, session, watchdog.signal);
 			}
-			if (!response.ok) throw await httpLlmError(response, "codex API");
+			if (!response.ok) throw await httpLlmError(response, "codex API", {
+				rateLimitReset: codexRateLimitReset,
+				...this.options.onWarn === void 0 ? {} : { onWarn: this.options.onWarn }
+			});
 			if (response.body === null) throw new LlmError("codex API returned no response body", EMPTY_RESPONSE_CODE);
 			yield* streamResponses(response.body, () => {
 				watchdog.pulse();
@@ -3921,7 +4559,7 @@ function closeBlock$1(block) {
 		};
 		case "tool-call": return {
 			type: "tool-call",
-			id: CallId(block.callId),
+			id: ToolCallId(block.callId),
 			name: block.name ?? "",
 			arguments: block.text
 		};
@@ -4024,7 +4662,7 @@ var AnthropicStreamTranslator = class {
 						chunks.push({
 							type: "tool-call-delta",
 							index: opened.index,
-							id: CallId(opened.callId),
+							id: ToolCallId(opened.callId),
 							...block.name === void 0 ? {} : { name: block.name },
 							argumentsDelta: ""
 						});
@@ -4061,7 +4699,7 @@ var AnthropicStreamTranslator = class {
 						chunks.push({
 							type: "tool-call-delta",
 							index: block.index,
-							id: CallId(block.callId),
+							id: ToolCallId(block.callId),
 							...block.name === void 0 ? {} : { name: block.name },
 							argumentsDelta: delta.partial_json ?? ""
 						});
@@ -4165,6 +4803,34 @@ const CLAUDE_DEFAULT_MAX_TOKENS = 32e3;
 /** Refresh when the access token has less than this much life left. */
 const CLAUDE_PREEMPT_MS = 5 * 6e4;
 /**
+* Body fields Anthropic uses to name a reset instant, read when the unified
+* headers are absent.
+*/
+const CLAUDE_RESET_FIELDS = [
+	"resets_at",
+	"resetsAt",
+	"reset_at",
+	"retry_after"
+];
+/**
+* Reads the reset instant of the Anthropic window that rejected a request.
+*
+* `anthropic-ratelimit-unified-*` is the subscription-plan family — the one
+* Claude Code renders as "resets 3pm" — and is the only header that names the
+* window which actually rejected this request. The per-bucket
+* `anthropic-ratelimit-{requests,tokens,input-tokens,output-tokens}-reset`
+* headers are deliberately not read: they are rollover snapshots attached to
+* every response, so on a 429 they cannot say which bucket refused, and the
+* earliest of them is typically the bucket that still had room — a wait that
+* lands straight back in the closed window. They reach the operator through
+* `rateLimitDiagnostics` instead.
+*/
+const claudeRateLimitReset = (response, body, now) => {
+	const unified = earliestReset(resetInstantFromHeader(response, "anthropic-ratelimit-unified-reset", now), resetInstantFromHeader(response, "anthropic-ratelimit-unified-fallback-reset", now));
+	if (unified !== void 0) return unified;
+	return resetFromFields(jsonBody(body), CLAUDE_RESET_FIELDS, now);
+};
+/**
 * The subscription endpoint only serves requests presenting as Claude Code,
 * so these headers impersonate the CLI; the harness attribution user-agent
 * cannot be sent here (one user-agent slot, and the CLI's wins).
@@ -4432,14 +5098,6 @@ async function fetchClaudeModels(session, fetchFn = proxiedFetch, signal) {
 	if (models.length === 0) throw new Error("claude models API returned an empty catalog");
 	return models;
 }
-/**
-* Claude Code's own SDK retry shape: exponential backoff starting at 1s,
-* doubling per attempt, capped at 60s, plus jitter. `maxRetries` is the
-* count of retries after the first attempt (Claude Code defaults to 10).
-*/
-const CLAUDE_RETRY_INITIAL_DELAY_MS = 1e3;
-const CLAUDE_RETRY_MAX_DELAY_MS = 6e4;
-const CLAUDE_RETRY_JITTER_RATIO = .2;
 /** The Claude 4.5 family accepts image input. */
 const CLAUDE_MODALITIES = ["text", "image"];
 /**
@@ -4533,16 +5191,7 @@ var ClaudeAdapter = class extends LlmAdapter {
 		};
 	}
 	providerRetryPolicy(provider) {
-		if (this.options.maxRetries === void 0) return void 0;
-		return resolveRetryPolicy({
-			mode: "normal",
-			maxRetries: this.options.maxRetries,
-			backoff: {
-				initialDelayMs: CLAUDE_RETRY_INITIAL_DELAY_MS,
-				maxDelayMs: CLAUDE_RETRY_MAX_DELAY_MS,
-				jitterRatio: CLAUDE_RETRY_JITTER_RATIO
-			}
-		}, `claude: provider "${provider}" retryPolicy`);
+		return subscriptionRetryPolicy(DEFAULT_RETRY, this.options.rateLimit ?? DEFAULT_RATE_LIMIT_WAIT, `claude: provider "${provider}" retryPolicy`);
 	}
 	async listModels(provider) {
 		const own = await this.listOwnModels(provider);
@@ -4588,7 +5237,7 @@ var ClaudeAdapter = class extends LlmAdapter {
 	async resolveOwnModel(provider, model) {
 		const disc = await this.discovered(model);
 		const configured = this.options.models.find((entry) => entry.id === model);
-		const reasoning = disc?.reasoning;
+		const reasoning = mergeReasoning(this.options.defaultEffortOf?.(model), disc?.reasoning);
 		return {
 			provider,
 			id: model,
@@ -4620,7 +5269,10 @@ var ClaudeAdapter = class extends LlmAdapter {
 				session = await this.options.tokens.session(account, true);
 				response = await this.request(options, session, watchdog.signal);
 			}
-			if (!response.ok) throw await httpLlmError(response, "claude API");
+			if (!response.ok) throw await httpLlmError(response, "claude API", {
+				rateLimitReset: claudeRateLimitReset,
+				...this.options.onWarn === void 0 ? {} : { onWarn: this.options.onWarn }
+			});
 			if (response.body === null) throw new LlmError("claude API returned no response body", EMPTY_RESPONSE_CODE);
 			yield* streamAnthropic(response.body, () => {
 				watchdog.pulse();
@@ -4687,6 +5339,24 @@ const GROK_CONTEXT_WINDOW = 256e3;
 const GROK_DEFAULT_MAX_TOKENS = 32e3;
 /** Refresh when the access token has less than this much life left. */
 const GROK_PREEMPT_MS = 2 * 6e4;
+/** Body fields xAI uses to name a delay or reset. */
+const GROK_RESET_FIELDS = [
+	"retry_after",
+	"retry_after_seconds",
+	"resets_at",
+	"reset_at"
+];
+/**
+* Reads the reset instant of the xAI window that rejected a request.
+*
+* Body only. xAI serves the OpenAI-compatible `x-ratelimit-reset-*` family,
+* whose values are rollover durations (`6m0s`) present on every response, one
+* per bucket — on a 429 the earliest of them is usually a bucket with room
+* (`0s` for the request bucket while the token bucket is the one exhausted),
+* which would burn the whole retry budget in seconds. They reach the operator
+* through `rateLimitDiagnostics` instead.
+*/
+const grokRateLimitReset = (_response, body, now) => resetFromFields(jsonBody(body), GROK_RESET_FIELDS, now);
 /** A discovered URL must be https on x.ai or a subdomain; anything else is a hostile document. */
 function assertXaiEndpoint(url, field) {
 	let parsed;
@@ -5106,6 +5776,9 @@ var GrokAdapter = class extends LlmAdapter {
 			name: "Grok (Subscription)"
 		};
 	}
+	providerRetryPolicy(provider) {
+		return subscriptionRetryPolicy(DEFAULT_RETRY, this.options.rateLimit ?? DEFAULT_RATE_LIMIT_WAIT, `grok: provider "${provider}" retryPolicy`);
+	}
 	staticModels(provider) {
 		return this.options.models.map((model) => ({
 			provider,
@@ -5167,6 +5840,7 @@ var GrokAdapter = class extends LlmAdapter {
 	async resolveOwnModel(provider, model) {
 		const discovered = await this.discovered(model);
 		const configured = this.options.models.find((entry) => entry.id === model);
+		const reasoning = mergeReasoning(this.options.defaultEffortOf?.(model), discovered?.reasoning);
 		return {
 			provider,
 			id: model,
@@ -5175,7 +5849,7 @@ var GrokAdapter = class extends LlmAdapter {
 			inputModalities: configured?.inputModalities ?? grokModalities(model),
 			context: { contextWindow: discovered?.contextWindow ?? configured?.contextWindow ?? GROK_CONTEXT_WINDOW },
 			defaultMaxTokens: configured?.maxTokens ?? GROK_DEFAULT_MAX_TOKENS,
-			...discovered?.reasoning === void 0 ? {} : { reasoning: discovered.reasoning }
+			...reasoning === void 0 ? {} : { reasoning }
 		};
 	}
 	async *stream(options) {
@@ -5199,7 +5873,10 @@ var GrokAdapter = class extends LlmAdapter {
 				session = await this.options.tokens.session(account, true);
 				response = await this.request(options, session, watchdog.signal);
 			}
-			if (!response.ok) throw await httpLlmError(response, "grok API");
+			if (!response.ok) throw await httpLlmError(response, "grok API", {
+				rateLimitReset: grokRateLimitReset,
+				...this.options.onWarn === void 0 ? {} : { onWarn: this.options.onWarn }
+			});
 			if (response.body === null) throw new LlmError("grok API returned no response body", EMPTY_RESPONSE_CODE);
 			yield* streamResponses(response.body, () => {
 				watchdog.pulse();
@@ -5221,6 +5898,7 @@ var GrokAdapter = class extends LlmAdapter {
 			parallel_tool_calls: true,
 			...options.maxTokens !== void 0 ? { max_output_tokens: options.maxTokens } : {},
 			...options.reasoningEffort !== void 0 ? { reasoning: { effort: String(options.reasoningEffort) } } : {},
+			...options.sessionId !== void 0 ? { prompt_cache_key: String(options.sessionId) } : {},
 			store: false,
 			stream: true
 		};
@@ -5383,7 +6061,7 @@ function closeBlock(block) {
 		};
 		case "tool-call": return {
 			type: "tool-call",
-			id: CallId(block.callId),
+			id: ToolCallId(block.callId),
 			name: block.name ?? "",
 			arguments: block.text
 		};
@@ -5537,7 +6215,7 @@ var ChatCompletionsStreamTranslator = class {
 					chunks.push({
 						type: "tool-call-delta",
 						index: block.index,
-						id: CallId(block.callId),
+						id: ToolCallId(block.callId),
 						...block.name === void 0 ? {} : { name: block.name },
 						argumentsDelta: ""
 					});
@@ -5547,7 +6225,7 @@ var ChatCompletionsStreamTranslator = class {
 					chunks.push({
 						type: "tool-call-delta",
 						index: block.index,
-						id: CallId(block.callId),
+						id: ToolCallId(block.callId),
 						argumentsDelta: call.function.arguments
 					});
 				}
@@ -6096,6 +6774,9 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 			name: "GitHub Copilot"
 		};
 	}
+	providerRetryPolicy(provider) {
+		return subscriptionRetryPolicy(DEFAULT_RETRY, this.options.rateLimit ?? DEFAULT_RATE_LIMIT_WAIT, `copilot: provider "${provider}" retryPolicy`);
+	}
 	staticModels(provider) {
 		return this.options.models.map((model) => ({
 			provider,
@@ -6258,6 +6939,7 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 	async resolveOwnModel(provider, model) {
 		const discovered = await this.discovered(model);
 		const configured = this.options.models.find((entry) => entry.id === model);
+		const reasoning = mergeReasoning(this.options.defaultEffortOf?.(model), discovered?.reasoning);
 		return {
 			provider,
 			id: model,
@@ -6266,7 +6948,7 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 			inputModalities: discovered?.inputModalities ?? configured?.inputModalities ?? ["text"],
 			context: { contextWindow: discovered?.contextWindow ?? configured?.contextWindow ?? COPILOT_CONTEXT_WINDOW },
 			defaultMaxTokens: configured?.maxTokens ?? COPILOT_DEFAULT_MAX_TOKENS,
-			...discovered?.reasoning === void 0 ? {} : { reasoning: discovered.reasoning }
+			...reasoning === void 0 ? {} : { reasoning }
 		};
 	}
 	async *stream(options) {
@@ -6293,7 +6975,7 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 				session = await this.options.tokens.session(account, true);
 				response = await this.request(options, session, watchdog.signal, wire, scope);
 			}
-			if (!response.ok) throw await httpLlmError(response, "copilot API");
+			if (!response.ok) throw await httpLlmError(response, "copilot API", { ...this.options.onWarn === void 0 ? {} : { onWarn: this.options.onWarn } });
 			if (response.body === null) throw new LlmError("copilot API returned no response body", EMPTY_RESPONSE_CODE);
 			const pulse = () => {
 				watchdog.pulse();
@@ -6616,13 +7298,13 @@ function truncate$1(text, max = 60) {
 * image input; any resolution failure means "no".
 */
 async function routeDeclaresImageInput(resolveLlm, exec) {
-	const llm = resolveLlm?.();
+	const llm$1 = resolveLlm?.();
 	const routed = exec.agent?.session.requestHeader()?.config;
 	const provider = routed?.provider ?? exec.agent?.options.provider;
 	const model = routed?.model ?? exec.agent?.options.model;
-	if (llm === void 0 || provider === void 0 || model === void 0) return false;
+	if (llm$1 === void 0 || provider === void 0 || model === void 0) return false;
 	try {
-		return (await llm.resolveModelInfo(provider, model, exec.signal)).inputModalities?.includes("image") === true;
+		return (await llm$1.resolveModelInfo(provider, model, exec.signal)).inputModalities?.includes("image") === true;
 	} catch {
 		return false;
 	}
@@ -7111,6 +7793,10 @@ const Config = z.object({
 		"copilot"
 	]),
 	streamIdleTimeoutMs: z.number().min(1).default(DEFAULT_STREAM_IDLE_TIMEOUT_MS),
+	rateLimit: z.object({
+		wait: z.boolean().default(true),
+		maxWaitMs: z.number().min(1).default(DEFAULT_RATE_LIMIT_MAX_WAIT_MS)
+	}),
 	models: z.object({
 		codex: z.array(modelEntrySchema),
 		claude: z.array(modelEntrySchema),
@@ -7273,18 +7959,20 @@ var SubscriptionsAuthController = class {
 	* cannot be read off the flow manager.
 	*/
 	claims = /* @__PURE__ */ new Map();
-	constructor(flows, deviceFlows, onAuthChanged, resolveAttachments, usageFetchers = {}, readClaudeCreds = readClaudeCodeCredentials) {
+	constructor(flows, deviceFlows, onAuthChanged, resolveAttachments, usageFetchers = {}, readClaudeCreds = readClaudeCodeCredentials, poolUsage = void 0) {
 		this.flows = flows;
 		this.deviceFlows = deviceFlows;
 		this.onAuthChanged = onAuthChanged;
 		this.resolveAttachments = resolveAttachments;
 		this.usageFetchers = usageFetchers;
 		this.readClaudeCreds = readClaudeCreds;
+		this.poolUsage = poolUsage;
 	}
-	usage(provider, account, signal) {
+	usage(provider, account, signal, force = false) {
 		const fetcher = this.usageFetchers[provider];
 		if (fetcher === void 0) return Promise.resolve({ supported: false });
-		return fetcher(account, signal);
+		if (this.poolUsage === void 0) return fetcher(account, signal);
+		return this.poolUsage.snapshotFor(provider, account, force);
 	}
 	async readImage(ref, signal) {
 		const attachments = this.resolveAttachments();
@@ -7451,6 +8139,7 @@ function apply(ctx, config) {
 	const providers = [...new Set(config.providers ?? [...PROVIDER_IDS])];
 	const streamIdleTimeoutMs = config.streamIdleTimeoutMs ?? DEFAULT_STREAM_IDLE_TIMEOUT_MS;
 	if (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0) throw new Error(`${name}: streamIdleTimeoutMs must be a positive finite number`);
+	const rateLimit = resolveRateLimitWait(config.rateLimit, `${name}: rateLimit`);
 	const catalog = resolveCatalog(config.models);
 	const overridden = new Set(PROVIDER_IDS.filter((provider) => (config.models?.[provider]?.length ?? 0) > 0));
 	const flows = new OAuthFlowManager();
@@ -7473,6 +8162,7 @@ function apply(ctx, config) {
 		poolAdapter?.invalidate();
 		for (const [route, handle] of handles) handle.replace([route]);
 	};
+	loadModelDefaults();
 	let codexTokens;
 	let claudeTokens;
 	let grokTokens;
@@ -7501,11 +8191,13 @@ function apply(ctx, config) {
 			adapter = new CodexAdapter({
 				models: catalog.codex,
 				streamIdleTimeoutMs,
+				rateLimit,
 				tokens,
 				discovery: !overridden.has("codex"),
 				onWarn,
 				resolveAttachments,
 				catalogStore: catalogStore("codex"),
+				defaultEffortOf: (model) => defaultEffortOf("codex", model),
 				pool: () => poolAdapter,
 				speedFor: (sessionId, model) => sessionId !== void 0 && speedBySession.get(sessionId) === "fast" && adapter.supportsFastTier(model)
 			});
@@ -7533,12 +8225,13 @@ function apply(ctx, config) {
 			const adapter = new ClaudeAdapter({
 				models: catalog.claude,
 				streamIdleTimeoutMs,
+				rateLimit,
 				tokens,
 				discovery: !overridden.has("claude"),
 				onWarn,
-				maxRetries: 10,
 				resolveAttachments,
 				catalogStore: catalogStore("claude"),
+				defaultEffortOf: (model) => defaultEffortOf("claude", model),
 				pool: () => poolAdapter
 			});
 			adapters.set("claude", adapter);
@@ -7564,11 +8257,13 @@ function apply(ctx, config) {
 			const adapter = new GrokAdapter({
 				models: catalog.grok,
 				streamIdleTimeoutMs,
+				rateLimit,
 				tokens,
 				discovery: !overridden.has("grok"),
 				onWarn,
 				resolveAttachments,
 				catalogStore: catalogStore("grok"),
+				defaultEffortOf: (model) => defaultEffortOf("grok", model),
 				pool: () => poolAdapter
 			});
 			adapters.set("grok", adapter);
@@ -7592,11 +8287,13 @@ function apply(ctx, config) {
 			copilotAdapter = new CopilotAdapter({
 				models: catalog.copilot,
 				streamIdleTimeoutMs,
+				rateLimit,
 				tokens,
 				discovery: !overridden.has("copilot"),
 				onWarn,
 				resolveAttachments,
 				catalogStore: catalogStore("copilot"),
+				defaultEffortOf: (model) => defaultEffortOf("copilot", model),
 				pool: () => poolAdapter
 			});
 			adapters.set("copilot", copilotAdapter);
@@ -7667,7 +8364,7 @@ function apply(ctx, config) {
 			onWarn
 		});
 	}
-	registerAuthRpc(ctx, new SubscriptionsAuthController(flows, deviceFlows, authChanged, resolveAttachments, usageFetchers), {
+	registerAuthRpc(ctx, new SubscriptionsAuthController(flows, deviceFlows, authChanged, resolveAttachments, usageFetchers, void 0, poolUsage), {
 		async speed(sessionId) {
 			return {
 				tier: speedBySession.get(sessionId) ?? "standard",
@@ -7682,6 +8379,63 @@ function apply(ctx, config) {
 		get: () => proxyGetConfig(),
 		set: (input) => proxySetConfig(input),
 		test: (payload) => proxyTestConnection(payload.url, payload.proxy)
+	}, {
+		async catalog() {
+			const visible = new Set((await ctx.llm.listProviders()).map((provider) => provider.id));
+			const catalog$1 = [];
+			for (const provider of PROVIDER_IDS) {
+				if (!visible.has(provider)) continue;
+				let models = [];
+				try {
+					models = await ctx.llm.listModels(provider);
+				} catch {
+					continue;
+				}
+				let tierIds = /* @__PURE__ */ new Set();
+				try {
+					const tiers = await poolAdapter?.modelsForProvider(provider);
+					if (tiers !== void 0) tierIds = new Set(tiers.map((tier) => tier.id));
+				} catch {}
+				const views = [];
+				for (const model of models) {
+					if (tierIds.has(model.id)) continue;
+					let info;
+					try {
+						info = await ctx.llm.resolveModelInfo(provider, model.id);
+					} catch {
+						continue;
+					}
+					if (info === void 0) continue;
+					const override = defaultEffortOf(provider, model.id);
+					views.push({
+						id: model.id,
+						name: model.name,
+						efforts: info.reasoning?.efforts.map((effort) => ({
+							id: effort.id,
+							name: effort.name
+						})) ?? [],
+						...override === void 0 ? {} : { configured: override }
+					});
+				}
+				catalog$1.push({
+					provider,
+					models: views
+				});
+			}
+			return catalog$1;
+		},
+		async set(provider, model, effort) {
+			if (effort !== void 0) {
+				let info;
+				try {
+					info = await ctx.llm.resolveModelInfo(provider, model);
+				} catch {}
+				const offered = info?.reasoning?.efforts ?? [];
+				if (offered.length > 0 && !offered.some((entry) => entry.id === effort)) throw new BadRequest(`model ${model} does not advertise a "${effort}" reasoning effort`);
+			}
+			await setDefaultEffort(provider, model, effort);
+			handles.get(provider)?.replace([provider]);
+		}
 	});
 	if (claudeTokens !== void 0) {
 		const tokens = claudeTokens;