dsh-provider-qoder 0.2.1 → 0.3.1

package/lib/index.js

@@ -4,6 +4,8 @@ import crypto, { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+import { WebError } from "@deepseek-ai/dsh-web";
+import { SettingsConflictError } from "@deepseek-ai/dsh-settings";
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
 //#region src/qoder/catalog.ts
 const discoveredMetadataKeys = [
@@ -234,6 +236,12 @@ function getQoderUserStatusUrl(region = "global") {
 	const { openApiUrl } = resolveQoderEndpoints(region);
 	return `${openApiUrl}/api/v3/user/status`;
 }
+/** Path of the center web search route. */
+const qoderWebSearchPath = "/api/v1/webSearch/oneSearch";
+function getQoderWebSearchUrl(region = "global") {
+	const { centerUrl } = resolveQoderEndpoints(region);
+	return `${centerUrl.replace(/\/+$/u, "")}/algo${qoderWebSearchPath}?Encode=1`;
+}
 //#endregion
 //#region src/qoder/errors.ts
 /**
@@ -254,7 +262,8 @@ function qoderHttpError(message, response) {
 	return new QoderLlmError(message, code, {
 		status,
 		...providerRetryAfterMs === void 0 ? {} : { providerRetryAfterMs },
-		...requestId === void 0 ? {} : { requestId }
+		...requestId === void 0 ? {} : { requestId },
+		...response.cause === void 0 ? {} : { cause: response.cause }
 	});
 }
 function qoderRequestId(headers) {
@@ -333,7 +342,9 @@ function redactLogValue(value, depth = 0) {
 	if (value instanceof Error) return {
 		name: value.name,
 		message: redactString(value.message),
-		..."code" in value ? { code: redactLogValue(value.code, depth + 1) } : {}
+		..."code" in value ? { code: redactLogValue(value.code, depth + 1) } : {},
+		..."cause" in value ? { cause: redactLogValue(value.cause, depth + 1) } : {},
+		...value instanceof AggregateError ? { errors: redactLogValue(value.errors, depth + 1) } : {}
 	};
 	if (Array.isArray(value)) return value.slice(0, maxEntries).map((item) => redactLogValue(item, depth + 1));
 	return Object.fromEntries(Object.entries(value).slice(0, maxEntries).map(([key, item]) => {
@@ -374,7 +385,7 @@ MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDA8iMH5c02LilrsERw9t6Pv5Nc
 6HRkPJ7S236FZz73In/KVuLnwI8JJ2CbuJap8kvheCCZpmAWpb/cPx/3Vr/J6I17
 XcW+ML9FoCI6AOvOzwIDAQAB
 -----END PUBLIC KEY-----`;
-const qoderIdeVersion = "1.1.47";
+const qoderIdeVersion = "1.1.60";
 const defaultUserAgent = `qoder/${qoderIdeVersion}`;
 const qoderDataPolicy = "disagree";
 const qoderLoginVersion = "v2";
@@ -448,6 +459,7 @@ function buildAuthHeaders(body, requestURL, creds) {
 		"X-Request-Id": crypto.randomUUID()
 	};
 }
+const defaultResponseHeaderTimeoutMs = 6e4;
 const defaultMaxJsonBytes = 2 * 1024 * 1024;
 const defaultMaxErrorBytes = 16 * 1024;
 const metadataRetryBaseDelayMs = 200;
@@ -799,35 +811,6 @@ function toolResultText(block) {
 	}
 	return text;
 }
-/**
-* Check message shapes without performing any provider I/O.
-*
-* Callers run this before resolving credentials so an invalid request never
-* consumes a Qoder subscription.
-*/
-function validateMessageShapes(messages) {
-	for (const message of messages) {
-		const toolResults = message.content.filter((block) => block.type === "tool-result");
-		if (toolResults.length > 0) {
-			if (message.role !== "user" || toolResults.length !== message.content.length) throw unsupported("Qoder tool-result messages cannot contain sibling content or use a non-user role.");
-			for (const result of toolResults) toolResultText(result);
-			continue;
-		}
-		for (const block of message.content) {
-			if (block.type === "text") continue;
-			if (block.type === "image") {
-				if (message.role !== "user") throw unsupported("Qoder image content is valid only in user messages.");
-				continue;
-			}
-			if (block.type === "tool-call") {
-				if (message.role !== "assistant") throw unsupported("Qoder tool calls are valid only in assistant messages.");
-				continue;
-			}
-			if (block.type === "reasoning") continue;
-			throw unsupported(`Qoder transport encountered unsupported block type: ${String(block.type)}`);
-		}
-	}
-}
 /** Reject a batch that exceeds the deployment image policy before any upload work starts. */
 function enforceImageLimits(images, attachments) {
 	const limits = attachments.imageLimits;
@@ -842,10 +825,15 @@ async function resolveImagePart(block, context) {
 	let image;
 	try {
 		const limits = attachments.imageLimits;
-		image = await attachments.readImageRequest(block.attachment, {
-			maxPixels: limits.maxImagePixels,
-			maxBytes: limits.maxImageBytes
-		}, signal);
+		const { width, height } = block.attachment;
+		const scale = Math.min(1, Math.sqrt(limits.maxImagePixels / (width * height)), limits.maxImageDimension / width, limits.maxImageDimension / height);
+		const target = {
+			width: Math.max(1, Math.floor(width * scale)),
+			height: Math.max(1, Math.floor(height * scale)),
+			maxBytes: limits.maxImageBytes,
+			maxPixels: limits.maxImagePixels
+		};
+		image = await attachments.readImageRequest(block.attachment, target, signal);
 	} catch (error) {
 		if (signal?.aborted) throw new QoderLlmError("Qoder image preparation was aborted.", "ABORTED", { cause: error });
 		if (error instanceof QoderLlmError) throw error;
@@ -870,8 +858,29 @@ function translateTools(tools) {
 		}
 	}));
 }
+/** Read a named property from an untyped object, returning it only if present. */
+function prop(obj, key) {
+	return obj !== null && obj !== void 0 && typeof obj === "object" ? obj[key] : void 0;
+}
+/** Coerce a candidate value to a non-empty string tool call id, or `undefined`. */
+function asCallId(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : void 0;
+}
+function extractToolCallId(message, result) {
+	return asCallId(prop(result, "toolCallId")) ?? asCallId(prop(message, "toolCallId")) ?? asCallId(prop(message, "tool_call_id")) ?? asCallId(prop(message.source, "kind") === "tool" ? prop(message.source, "callId") : void 0);
+}
+function consumeToolCallId(message, result, pendingIds, fallbackIndex) {
+	const explicit = extractToolCallId(message, result);
+	if (explicit !== void 0) {
+		const idx = pendingIds.indexOf(explicit);
+		if (idx !== -1) pendingIds.splice(idx, 1);
+		return explicit;
+	}
+	return pendingIds.shift() ?? `call_unknown_${fallbackIndex}`;
+}
 async function validateAndTranslateMessages(messages, systemPrompt, attachments, signal, pipeline) {
-	validateMessageShapes(messages);
 	const context = {
 		attachments,
 		signal,
@@ -880,18 +889,20 @@ async function validateAndTranslateMessages(messages, systemPrompt, attachments,
 	};
 	const preserveThinking = pipeline?.preserveThinking ?? true;
 	const output = [];
+	let lastAssistantToolCallIds = [];
 	if (typeof systemPrompt === "string" && systemPrompt.trim().length > 0) output.push({
 		role: "system",
 		content: systemPrompt
 	});
 	for (const message of messages) {
 		const toolResults = message.content.filter((block) => block.type === "tool-result");
+		const nonToolBlocks = message.content.filter((block) => block.type !== "tool-result");
 		if (toolResults.length > 0) {
-			if (message.role !== "user" || toolResults.length !== message.content.length) throw unsupported("Qoder tool-result messages cannot contain sibling content or use a non-user role.");
 			for (const result of toolResults) {
+				const callId = consumeToolCallId(message, result, lastAssistantToolCallIds, output.length);
 				output.push({
 					role: "tool",
-					tool_call_id: String(result.toolCallId),
+					tool_call_id: callId,
 					content: toolResultText(result)
 				});
 				const images = result.content.filter((block) => block.type === "image");
@@ -906,24 +917,27 @@ async function validateAndTranslateMessages(messages, systemPrompt, attachments,
 					});
 				}
 			}
-			continue;
+			if (nonToolBlocks.length === 0) continue;
 		}
+		const contentBlocks = toolResults.length > 0 ? nonToolBlocks : message.content;
 		let text = "";
 		let reasoningText = "";
 		const userContent = [];
 		const pendingImages = [];
 		let hasImage = false;
 		const toolCalls = [];
-		for (const block of message.content) {
+		for (const block of contentBlocks) {
+			if (message.role === "tool" && block.type !== "text" && block.type !== "image") throw unsupported(`Qoder tool results support text and images only; received ${block.type} content.`);
 			if (block.type === "text") {
 				text += block.text;
-				if (message.role === "user") userContent.push({
+				if (message.role === "user" || toolResults.length > 0) userContent.push({
 					type: "text",
 					text: block.text
 				});
 				continue;
 			}
 			if (block.type === "image") {
+				if (message.role !== "user" && message.role !== "tool" && toolResults.length === 0) throw unsupported("Qoder image content is valid only in user messages.");
 				hasImage = true;
 				pendingImages.push({
 					slot: userContent.length,
@@ -951,6 +965,7 @@ async function validateAndTranslateMessages(messages, systemPrompt, attachments,
 		if (message.role === "assistant") {
 			const hasReasoning = preserveThinking && reasoningText.length > 0;
 			if (!text && toolCalls.length === 0 && !hasReasoning) continue;
+			if (toolCalls.length > 0) lastAssistantToolCallIds = toolCalls.map((tc) => tc.id);
 			output.push({
 				role: "assistant",
 				content: text || " ",
@@ -959,20 +974,317 @@ async function validateAndTranslateMessages(messages, systemPrompt, attachments,
 			});
 			continue;
 		}
+		if (message.role === "tool") {
+			const callId = consumeToolCallId(message, void 0, lastAssistantToolCallIds, output.length);
+			output.push({
+				role: "tool",
+				tool_call_id: callId,
+				content: text
+			});
+			if (pendingImages.length > 0) {
+				if (attachments !== void 0) enforceImageLimits(pendingImages.map((pending) => pending.block), attachments);
+				output.push({
+					role: "user",
+					content: [{
+						type: "text",
+						text: `[${pendingImages.length} image${pendingImages.length === 1 ? "" : "s"} returned by the previous tool call]`
+					}, ...await Promise.all(pendingImages.map((pending) => resolveImagePart(pending.block, context)))]
+				});
+			}
+			continue;
+		}
 		if (pendingImages.length > 0) {
 			if (attachments !== void 0) enforceImageLimits(pendingImages.map((pending) => pending.block), attachments);
 			await Promise.all(pendingImages.map(async (pending) => {
 				userContent[pending.slot] = await resolveImagePart(pending.block, context);
 			}));
 		}
+		if (toolResults.length > 0 && !hasImage && text.trim().length === 0) continue;
+		const wireRole = toolResults.length > 0 ? "user" : message.role;
+		const wireToolCallId = wireRole === "tool" ? consumeToolCallId(message, void 0, lastAssistantToolCallIds, output.length) : void 0;
 		output.push({
-			role: message.role,
-			content: hasImage ? userContent.filter((part) => part !== void 0) : text
+			role: wireRole,
+			content: hasImage ? userContent.filter((part) => part !== void 0) : text,
+			...wireToolCallId ? { tool_call_id: wireToolCallId } : {}
 		});
 	}
 	return output;
 }
 //#endregion
+//#region src/qoder/transport/wire/turn-identity.ts
+/**
+* Per-turn Qoder request identity.
+*
+* A DSH turn issues one model request per reasoning step, so a single
+* subscriber prompt becomes dozens of consecutive Qoder requests. Qoder's
+* Credits panel aggregates consumption per agent run — the `business.id` a
+* request reports — so every step of one turn must carry the same run identity
+* while the next subscriber prompt opens a new one.
+*
+* The adapter never sees a turn number, and the host appends messages to a
+* turn's history while it runs — its own context, notifications, delegated
+* agents' messages — so the boundary is derived from the history here. A turn is
+* the multiset of user-role messages it has accounted for: a subscriber message
+* the run has not seen opens the next turn, while host-appended context,
+* transport-synthesized markers, and anything an auxiliary call carries continue
+* the open record.
+*
+* Known limit: text identifies a message because the host's message ids are not
+* part of the wire shape. A subscriber who sends the same words twice with the
+* first copy already gone from history — compaction replaced that span — shares
+* the open record instead of opening a new one. Carrying the host's message
+* identity through translation is the fix, and needs the host to expose it on
+* the request the adapter receives.
+*
+* @module dsh-provider-qoder/qoder/transport/wire/turn-identity
+*/
+const defaultMaxSessions = 64;
+/** A conversation untouched for this long cannot still be mid-turn. */
+const defaultIdleSessionTtlMs = 3600 * 1e3;
+/**
+* Openings of everything the host appends while a turn runs.
+*
+* One subscriber prompt is what the subscriber perceives as one turn, so every
+* message the harness adds around that prompt — its own context, notifications,
+* and delegated agents' messages — must stay inside the same record. Only a
+* message outside this list is treated as a new prompt. The list is
+* evidence-based: every entry was observed in live DSH transcripts, and an
+* offline audit replays real sessions to keep it aligned. An unknown future
+* wrapper therefore opens one extra record instead of merging two turns.
+*/
+const injectedContextOpenings = [
+	"<system-reminder>",
+	"<openviking-context",
+	"<goal_complete>",
+	"Current runtime context. This snapshot supersedes earlier runtime-context",
+	"This is an automatically generated checkpoint condensing",
+	"[model changed:",
+	"background job ",
+	"The approval policy changed"
+];
+/**
+* Host messages that name their sender.
+*
+* A delegated agent's message and a settled background subagent both start with
+* a word a subscriber may legitimately use, so they are matched on the host's
+* own template — the sender's identity then a fixed phrase — instead of on a
+* bare prefix that would swallow real prompts.
+*/
+const hostNotificationTemplate = /^(?:Agent|Background subagent) \S{3,} (?:sent a message:|finished\b)/;
+/**
+* Text this transport synthesizes while translating a turn's own tool results.
+*
+* A tool result carrying images becomes a user-role message, so it must be
+* recognized as part of the open record rather than as new subscriber input.
+*/
+const syntheticMarkerTemplate = /^\[\d+ images? returned by the previous tool call\]/;
+/** Wire text of one user message, used for injection classification and text extraction. */
+function wireMessageText(message) {
+	const content = message.content;
+	if (typeof content === "string") return content;
+	if (content === null) return "";
+	return content.map((part) => part.type === "text" ? part.text : "").join("");
+}
+/** Classify one user-role wire message. */
+function qoderMessageOrigin(message) {
+	const text = wireMessageText(message).trimStart();
+	if (syntheticMarkerTemplate.test(text)) return "synthetic";
+	if (hostNotificationTemplate.test(text)) return "injected";
+	return injectedContextOpenings.some((opening) => text.startsWith(opening)) ? "injected" : "prompt";
+}
+/** Stable record id of one session turn. */
+function turnIdFor(sessionId, turnCount, anchor) {
+	return crypto.createHash("sha256").update("qoder-turn").update("\0").update(sessionId).update("\0").update(String(turnCount)).update("\0").update(anchor).digest("hex").slice(0, 16);
+}
+/**
+* Fingerprint of one message, used to count how often a turn has seen it.
+*
+* Text identifies a message, never an image URL: a published URL is re-signed as
+* its cache entry expires, so a rotating URL would make the turn's own prompt
+* look like new input and split the record. Image count still separates a
+* message that carries images from one that does not.
+*/
+function messageFingerprint(message) {
+	const hash = crypto.createHash("sha256");
+	hash.update(message.role);
+	hash.update("\0");
+	const content = message.content;
+	if (typeof content === "string") hash.update(content);
+	else if (content !== null) {
+		let images = 0;
+		for (const part of content) if (part.type === "text") {
+			hash.update("\0text\0");
+			hash.update(part.text);
+		} else images += 1;
+		hash.update(`\0images=${images}`);
+	}
+	return hash.digest("hex").slice(0, 16);
+}
+/**
+* Resolves the record identity of the turn one request belongs to.
+*
+* One tracker instance owns its sessions, so tests and transports stay
+* independent. State is created lazily per session and bounded by
+* `maxSessions`.
+*/
+var QoderTurnTracker = class {
+	maxSessions;
+	idleSessionTtlMs;
+	now;
+	sessions = /* @__PURE__ */ new Map();
+	constructor(options = {}) {
+		this.maxSessions = options.maxSessions ?? defaultMaxSessions;
+		this.idleSessionTtlMs = options.idleSessionTtlMs ?? defaultIdleSessionTtlMs;
+		this.now = options.now ?? Date.now;
+	}
+	/**
+	* Resolves the full wire identity for one Qoder request.
+	*
+	* Coordinates `request_set_id`, `chat_record_id`, and `business` metadata so
+	* that requests within one subscriber turn share a single agent run and
+	* consumption record.
+	*/
+	resolveTurnIdentity(sessionId, messages, kind = "conversation", requestId = crypto.randomUUID(), modelKey) {
+		const now = this.now();
+		if (sessionId === void 0 || sessionId.length === 0) return {
+			requestSetId: `qoder-request-${crypto.randomUUID()}`,
+			chatRecordId: requestId,
+			businessId: crypto.randomUUID(),
+			beginAt: now
+		};
+		if (kind === "auxiliary") {
+			if (this.sessions.has(sessionId)) this.sessions.get(sessionId).lastTouchedAt = now;
+			return {
+				requestSetId: `qoder-request-${crypto.randomUUID()}`,
+				chatRecordId: requestId,
+				businessId: crypto.randomUUID(),
+				beginAt: now
+			};
+		}
+		let state = this.sessions.get(sessionId);
+		if (state === void 0) {
+			state = {
+				claimed: /* @__PURE__ */ new Map(),
+				currentTurnId: "",
+				currentBusinessId: "",
+				turnOpenedAt: 0,
+				lastTouchedAt: now,
+				turnCount: 0,
+				currentModel: modelKey
+			};
+			this.claimSession(sessionId, state);
+		} else {
+			state.lastTouchedAt = now;
+			this.sessions.delete(sessionId);
+			this.sessions.set(sessionId, state);
+		}
+		const modelChanged = state.currentModel !== void 0 && modelKey !== void 0 && state.currentModel !== modelKey;
+		if (modelKey !== void 0) state.currentModel = modelKey;
+		const present = /* @__PURE__ */ new Map();
+		for (const message of messages) {
+			if (message.role !== "user") continue;
+			const fingerprint = messageFingerprint(message);
+			const entry = present.get(fingerprint);
+			if (entry === void 0) present.set(fingerprint, {
+				count: 1,
+				host: qoderMessageOrigin(message)
+			});
+			else entry.count += 1;
+		}
+		let opening;
+		let unclaimed = 0;
+		for (const [fingerprint, entry] of present) {
+			const claimed = state.claimed.get(fingerprint) ?? 0;
+			if (entry.count <= claimed) continue;
+			state.claimed.set(fingerprint, entry.count);
+			if (entry.host === "injected" || entry.host === "synthetic") continue;
+			unclaimed += entry.count - claimed;
+			opening = fingerprint;
+		}
+		for (const [fingerprint, claimed] of state.claimed) {
+			const current = present.get(fingerprint);
+			if (current === void 0) state.claimed.delete(fingerprint);
+			else if (current.count < claimed) state.claimed.set(fingerprint, current.count);
+		}
+		if (opening !== void 0 && unclaimed > 0 || modelChanged) {
+			state.turnCount += 1;
+			state.currentTurnId = turnIdFor(sessionId, state.turnCount, opening ?? state.currentModel ?? "");
+			state.currentBusinessId = crypto.randomUUID();
+			state.turnOpenedAt = now;
+		} else if (state.currentTurnId === "") {
+			state.turnCount += 1;
+			state.currentTurnId = turnIdFor(sessionId, state.turnCount, state.currentModel ?? "");
+			state.currentBusinessId = crypto.randomUUID();
+			state.turnOpenedAt = now;
+		}
+		return {
+			requestSetId: state.currentTurnId,
+			chatRecordId: requestId,
+			businessId: state.currentBusinessId,
+			beginAt: state.turnOpenedAt
+		};
+	}
+	/**
+	* Record id shared by every step of `sessionId`'s current turn.
+	*
+	* `null` means the request carries no session identity, so no conversation
+	* identity can be derived and the caller must fall back to a per-request id.
+	*/
+	resolveTurnRecordId(sessionId, messages, kind = "conversation") {
+		if (sessionId === void 0 || sessionId.length === 0) return null;
+		return this.resolveTurnIdentity(sessionId, messages, kind).requestSetId;
+	}
+	/**
+	* Agent-run identity the Qoder service reports consumption against.
+	*
+	* The official client stamps one `business.id` per agent run and keeps it for
+	* every request that run makes, which is what makes one subscriber turn one
+	* consumption record. A request outside any conversation still gets its own.
+	*/
+	resolveBusinessId(sessionId, messages, kind = "conversation") {
+		const identity = this.resolveTurnIdentity(sessionId, messages, kind);
+		return {
+			businessId: identity.businessId,
+			beginAt: identity.beginAt
+		};
+	}
+	/** Forget one session, e.g. when its transport is disposed. */
+	forget(sessionId) {
+		this.sessions.delete(sessionId);
+	}
+	/** Forget every session. */
+	clear() {
+		this.sessions.clear();
+	}
+	claimSession(sessionId, state) {
+		this.sessions.set(sessionId, state);
+		this.evict();
+	}
+	/**
+	* Keep the recorded sessions bounded.
+	*
+	* A conversation untouched for longer than the idle TTL cannot still be
+	* running a turn, so it is dropped first and dropping it cannot split a
+	* record. Sessions are ordered by last touch, which makes that idle set the
+	* prefix of the map, so in practice this deletes from the coldest end; the TTL
+	* only changes the outcome if the clock moves backwards. Once every recorded
+	* conversation is more recent than the TTL, the ceiling drops the coldest one,
+	* which can split the turn that conversation was running.
+	*/
+	evict() {
+		const idleBefore = this.now() - this.idleSessionTtlMs;
+		for (const [id, state] of this.sessions) {
+			if (this.sessions.size <= this.maxSessions) return;
+			if (state.lastTouchedAt <= idleBefore) this.sessions.delete(id);
+		}
+		while (this.sessions.size > this.maxSessions) {
+			const oldest = this.sessions.keys().next();
+			if (oldest.done === true) return;
+			this.sessions.delete(oldest.value);
+		}
+	}
+};
+//#endregion
 //#region src/qoder/transport/wire/serialize.ts
 /** Build the minimum qodercli request envelope for a validated DSH request. */
 function stableHash(prefix, ...inputs) {
@@ -984,18 +1296,25 @@ function stableHash(prefix, ...inputs) {
 	}
 	return hash.digest("hex").slice(0, 16);
 }
-function stableChatRecordId(model, messages, tools, maxTokens) {
-	const hash = crypto.createHash("sha256");
-	hash.update("qoder-record");
-	hash.update("\0");
-	hash.update(model);
-	hash.update("\0");
-	hash.update(JSON.stringify(messages));
-	hash.update("\0");
-	hash.update(JSON.stringify(tools));
-	hash.update("\0");
-	hash.update(`mt=${maxTokens}`);
-	return hash.digest("hex").slice(0, 16);
+/**
+* Turn identity shared by every request the process serves.
+*
+* Qoder's Credits panel aggregates consumption per agent run — the
+* `business.id` a request reports — so every step of one turn must carry the
+* same run identity while the next subscriber prompt opens a new one. The
+* tracker owns that boundary.
+*/
+const qoderTurnTracker = new QoderTurnTracker();
+/**
+* Whether this request serves the subscriber's turn or the host's bookkeeping.
+*
+* The host marks an auxiliary call through `GenerateOptions.purpose`, and those
+* calls carry a message list of their own under the same session identity. They
+* must never move the open turn's boundary, or one subscriber prompt would
+* report two consumption records.
+*/
+function callKind(options) {
+	return options.purpose === void 0 ? "conversation" : "auxiliary";
 }
 /**
 * Reject an unusable request before any credential resolution or provider I/O.
@@ -1010,7 +1329,6 @@ function validateQoderRequestShape(options, model) {
 		if (!model?.reasoningEfforts?.some((candidate) => candidate.id === effort)) throw new QoderLlmError(`Qoder model "${options.model}" does not advertise reasoning effort "${effort}".`, "UNSUPPORTED_REASONING_EFFORT");
 	}
 	if (options.messages.some((message) => contentHasImage(message.content)) && model?.supportsImages !== true) throw new QoderLlmError(`Qoder model "${options.model}" does not advertise image input.`, "UNSUPPORTED_CONTENT");
-	validateMessageShapes(options.messages);
 }
 /** Translate a request whose shape has already been validated. */
 function translateQoderMessages(options, attachments, pipeline) {
@@ -1020,7 +1338,7 @@ async function validateQoderRequest(options, model, attachments) {
 	validateQoderRequestShape(options, model);
 	return validateAndTranslateMessages(options.messages, options.system, attachments, options.signal);
 }
-async function buildQoderRequestBody(options, userId, translatedMessages, model, attachments) {
+async function buildQoderRequestBody(options, userId, translatedMessages, model, attachments, tracker) {
 	if (!userId) throw new QoderLlmError("Qoder request identity is missing.", "AUTH");
 	const modelKey = options.model || "cmodel";
 	const messages = translatedMessages ?? await validateQoderRequest(options, model, attachments);
@@ -1035,17 +1353,18 @@ async function buildQoderRequestBody(options, userId, translatedMessages, model,
 	}]));
 	let lastUserText = "";
 	for (let index = messages.length - 1; index >= 0; index--) if (messages[index].role === "user") {
-		const content = messages[index].content;
-		lastUserText = typeof content === "string" ? content : Array.isArray(content) ? content.filter((part) => part.type === "text").map((part) => part.text).join("") : "";
+		lastUserText = wireMessageText(messages[index]);
 		break;
 	}
-	const stablePart = stableHash("qoder-session", userId, modelKey);
+	const stablePart = stableHash("qoder-session", userId);
 	const sessionId = options.sessionId === void 0 ? `${stablePart}-${crypto.randomUUID()}` : `${stablePart}-${String(options.sessionId)}`;
-	const recordId = stableChatRecordId(modelKey, messages, tools, maxTokens);
+	const requestId = crypto.randomUUID();
+	const sessionIdParam = options.sessionId === void 0 ? void 0 : String(options.sessionId);
+	const identity = (tracker ?? qoderTurnTracker).resolveTurnIdentity(sessionIdParam, messages, callKind(options), requestId, modelKey);
 	return {
-		request_id: crypto.randomUUID(),
-		request_set_id: recordId,
-		chat_record_id: recordId,
+		request_id: requestId,
+		request_set_id: identity.requestSetId,
+		chat_record_id: identity.chatRecordId,
 		session_id: sessionId,
 		stream: true,
 		chat_task: "FREE_INPUT",
@@ -1090,12 +1409,12 @@ async function buildQoderRequestBody(options, userId, translatedMessages, model,
 		},
 		business: {
 			product: "cli",
-			version: "1.0.0",
+			version: "1.0.60",
 			type: "agent",
 			stage: "start",
-			id: crypto.randomUUID(),
+			id: identity.businessId,
 			name: lastUserText.substring(0, 30),
-			begin_at: Date.now()
+			begin_at: identity.beginAt
 		}
 	};
 }
@@ -1426,13 +1745,20 @@ function normalizeQuota(raw) {
 		unit
 	};
 }
+/**
+* Normalize an epoch-millis (or parseable date string) expiry to ISO-8601.
+*
+* The provider uses the int64 maximum as a "never expires" sentinel, which is
+* outside the `Date` range: an unusable value resolves to `undefined` instead
+* of throwing, so one bad field cannot abort the whole account read.
+*/
 function normalizeExpiresAt(rawExpires) {
 	if (rawExpires === void 0 || rawExpires === null) return void 0;
-	if (typeof rawExpires === "number" && rawExpires > 0) return new Date(rawExpires).toISOString();
-	if (typeof rawExpires === "string" && rawExpires.length > 0) {
-		const parsed = Date.parse(rawExpires);
-		if (!Number.isNaN(parsed) && parsed > 0) return new Date(parsed).toISOString();
-	}
+	const parsed = typeof rawExpires === "number" ? rawExpires : typeof rawExpires === "string" && rawExpires.length > 0 ? Date.parse(rawExpires) : NaN;
+	if (!Number.isFinite(parsed) || parsed <= 0) return void 0;
+	const date = new Date(parsed);
+	if (!Number.isFinite(date.getTime())) return void 0;
+	return date.toISOString();
 }
 function asString(value) {
 	return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
@@ -1447,6 +1773,76 @@ function asNumber(value) {
 		if (Number.isFinite(num)) return num;
 	}
 }
+/**
+* The provider names a resource package with internal identifiers (campaign
+* ids) that must never reach the UI, so the subscriber-facing copy only ever
+* comes from `displayLabels`.
+*/
+function findDisplayLabel(raw, dimension) {
+	if (!Array.isArray(raw)) return void 0;
+	for (const entry of raw) {
+		if (!entry || typeof entry !== "object") continue;
+		const obj = entry;
+		if (asString(obj.dimension) === dimension) return obj;
+	}
+}
+/**
+* Normalize one `displayLabels` entry into language-tagged copy.
+*
+* The provider's value lives under `valueI18n`/`value_i18n`, keyed by language
+* tag, plus `value` as the untagged fallback. An entry with neither is dropped
+* rather than surfaced as an empty label.
+*/
+function normalizeLocalizedText(raw) {
+	if (!raw || typeof raw !== "object") return void 0;
+	const obj = raw;
+	const values = {};
+	const localized = obj.valueI18n ?? obj.value_i18n;
+	if (localized && typeof localized === "object") for (const [locale, text] of Object.entries(localized)) {
+		const resolved = asString(text);
+		if (resolved !== void 0) values[locale] = resolved;
+	}
+	const fallback = asString(obj.value);
+	if (fallback === void 0 && Object.keys(values).length === 0) return void 0;
+	return {
+		values,
+		fallback: fallback ?? ""
+	};
+}
+/**
+* Normalize the dedicated (entitlement-scoped) resource packages.
+*
+* Copy is read from `displayLabels` only, never from `name`/`description`,
+* which carry internal campaign identifiers. Entries without a usable size are
+* dropped and a non-array value yields `undefined`, so an unexpected payload
+* never fails the account read that also feeds the model catalog.
+*/
+function normalizeResourcePackages(raw) {
+	if (!Array.isArray(raw)) return void 0;
+	const packages = [];
+	for (const entry of raw) {
+		if (!entry || typeof entry !== "object") continue;
+		const obj = entry;
+		const quota = normalizeQuota(obj);
+		if (quota === void 0 || quota.total <= 0 && quota.used <= 0 && quota.remaining <= 0) continue;
+		const id = asString(obj.id);
+		const title = normalizeLocalizedText(findDisplayLabel(obj.displayLabels ?? obj.display_labels, "title"));
+		const description = normalizeLocalizedText(findDisplayLabel(obj.displayLabels ?? obj.display_labels, "description"));
+		const expiresAt = normalizeExpiresAt(obj.expiresAt);
+		const available = asBoolean(obj.available);
+		const status = asString(obj.status);
+		packages.push({
+			...id !== void 0 ? { id } : {},
+			...title !== void 0 ? { title } : {},
+			...description !== void 0 ? { description } : {},
+			...quota,
+			...expiresAt !== void 0 ? { expiresAt } : {},
+			...available !== void 0 ? { available } : {},
+			...status !== void 0 ? { status } : {}
+		});
+	}
+	return packages.length > 0 ? packages : void 0;
+}
 function normalizeOrganization(raw) {
 	if (!raw || typeof raw !== "object") return void 0;
 	const obj = raw;
@@ -1569,6 +1965,14 @@ var QoderUsageReader = class {
 		if (pat) this.cache.delete(`${this.region}:${opaqueCredentialKey(pat)}`);
 		else this.cache.clear();
 	}
+	/**
+	* Read `GET /api/v2/quota/usage` and normalize it for the host/client seam.
+	*
+	* The `raw` echo keeps the upstream fields for diagnostics, but never
+	* `dedicatedResourcePackages`: those entries carry the campaign identifiers
+	* that the normalized list deliberately discards, and this payload crosses
+	* the seam into the browser.
+	*/
 	async fetchUsage(jobToken, signal) {
 		const data = await openApiJsonRequest(this.fetchImpl, {
 			url: getQoderUsageUrl(this.region),
@@ -1579,13 +1983,17 @@ var QoderUsageReader = class {
 			operation: "Usage",
 			logCategory: "account.usage"
 		});
+		const dedicatedResourcePackages = normalizeResourcePackages(data.dedicatedResourcePackages);
+		const rawUsage = { ...data };
+		delete rawUsage.dedicatedResourcePackages;
 		return {
 			userQuota: normalizeQuota(data.userQuota),
 			orgResourcePackage: normalizeQuota(data.orgResourcePackage),
+			...dedicatedResourcePackages !== void 0 ? { dedicatedResourcePackages } : {},
 			totalUsagePercentage: typeof data.totalUsagePercentage === "number" ? data.totalUsagePercentage : void 0,
 			isQuotaExceeded: typeof data.isQuotaExceeded === "boolean" ? data.isQuotaExceeded : false,
 			expiresAt: normalizeExpiresAt(data.expiresAt),
-			raw: data
+			raw: rawUsage
 		};
 	}
 	async fetchPlan(jobToken, signal) {
@@ -1659,6 +2067,163 @@ function qoderEncodeBody(plaintext) {
 	}
 	return out;
 }
+function searchAborted(signal, fallback) {
+	return new WebError("Web search was cancelled.", "WEB_ABORTED", { cause: signal?.aborted === true ? signal.reason : fallback });
+}
+function isAbortError(error) {
+	return error instanceof DOMException && error.name === "AbortError";
+}
+var QoderSearchClient = class {
+	fetchImpl;
+	region;
+	logger;
+	timeoutMs;
+	resolveCredentials;
+	refreshCredentials;
+	now;
+	constructor(options) {
+		this.fetchImpl = options.fetch ?? globalThis.fetch;
+		this.region = options.region ?? "global";
+		this.logger = options.logger;
+		this.timeoutMs = options.timeoutMs ?? 3e4;
+		this.resolveCredentials = options.resolveCredentials;
+		this.refreshCredentials = options.refreshCredentials;
+		this.now = options.now ?? Date.now;
+	}
+	async search(request, signal) {
+		if (signal?.aborted) throw searchAborted(signal);
+		let credentials = await this.resolveCredentials(signal);
+		if (signal?.aborted) throw searchAborted(signal);
+		const first = await this.attempt(request, credentials, signal);
+		if (first.result !== void 0) return first.result;
+		if (first.retryable && this.refreshCredentials !== void 0) {
+			this.logger?.debug?.("[web-search] refreshing credentials before retry", {
+				region: this.region,
+				reason: first.reason
+			});
+			try {
+				credentials = await this.refreshCredentials(signal);
+			} catch (error) {
+				if (signal?.aborted) throw searchAborted(signal, error);
+				throw new WebError(`Qoder credential refresh failed: ${String(error)}`, "WEB_PROVIDER_ERROR", { cause: error });
+			}
+			const second = await this.attempt(request, credentials, signal);
+			if (second.result !== void 0) return second.result;
+			throw new WebError(`Qoder web search failed: ${second.reason}`, "WEB_PROVIDER_ERROR");
+		}
+		throw new WebError(`Qoder web search failed: ${first.reason}`, "WEB_PROVIDER_ERROR");
+	}
+	async attempt(request, credentials, signal) {
+		const url = getQoderWebSearchUrl(this.region);
+		const innerPayload = {
+			query: request.query,
+			timeRange: "NoLimit",
+			contents: {
+				mainText: false,
+				markdownText: false,
+				summary: false
+			}
+		};
+		const encodedBody = qoderEncodeBody(JSON.stringify({
+			payload: JSON.stringify(innerPayload),
+			encodeVersion: "1"
+		}));
+		const timeout = AbortSignal.timeout(this.timeoutMs);
+		const requestSignal = signal !== void 0 ? AbortSignal.any([signal, timeout]) : timeout;
+		const startedAt = this.now();
+		this.logger?.debug?.("[web-search] started", {
+			region: this.region,
+			url,
+			query: request.query
+		});
+		let response;
+		try {
+			const authHeaders = buildAuthHeaders(encodedBody, url, credentials);
+			response = await this.fetchImpl(url, {
+				method: "POST",
+				headers: {
+					...authHeaders,
+					"Content-Type": "application/json",
+					"Accept": "application/json",
+					"Accept-Encoding": "identity"
+				},
+				body: encodedBody,
+				signal: requestSignal
+			});
+		} catch (error) {
+			if (signal?.aborted) throw searchAborted(signal, error);
+			if (timeout.aborted || isAbortError(error)) return {
+				retryable: false,
+				reason: "request timed out"
+			};
+			this.logger?.warn?.("[web-search] network failure", { region: this.region }, redactLogValue(error));
+			return {
+				retryable: false,
+				reason: `network failure: ${String(error)}`
+			};
+		}
+		const elapsedMs = this.now() - startedAt;
+		this.logger?.debug?.("[web-search] response received", {
+			status: response.status,
+			elapsedMs
+		});
+		if (!response.ok) return {
+			retryable: response.status === 401 || response.status === 403,
+			reason: `HTTP ${response.status} ${response.statusText}`.trim()
+		};
+		let text;
+		try {
+			text = await readLimitedText(response, defaultMaxJsonBytes, "Qoder web search response");
+		} catch (error) {
+			if (signal?.aborted) throw searchAborted(signal, error);
+			return {
+				retryable: false,
+				reason: `failed to read response body: ${String(error)}`
+			};
+		}
+		let parsed;
+		try {
+			parsed = JSON.parse(text);
+		} catch (error) {
+			return {
+				retryable: false,
+				reason: `invalid JSON response: ${String(error)}`
+			};
+		}
+		if (parsed.errorCode != null && parsed.errorCode !== 0) return {
+			retryable: false,
+			reason: `backend error code ${parsed.errorCode}: ${parsed.errorMsg ?? "unknown"}`
+		};
+		const rawItems = parsed.pageItems ?? [];
+		const sources = [];
+		const seen = /* @__PURE__ */ new Set();
+		for (const item of rawItems) {
+			if (!item.link || item.link.trim().length === 0) continue;
+			const link = item.link.trim();
+			if (seen.has(link)) continue;
+			seen.add(link);
+			sources.push({
+				url: link,
+				...item.title !== void 0 && item.title.trim().length > 0 ? { title: item.title.trim() } : {},
+				...item.snippet !== void 0 && item.snippet.trim().length > 0 ? { snippet: item.snippet.trim() } : {},
+				...item.publishedAt !== void 0 && item.publishedAt.trim().length > 0 ? { publishedAt: item.publishedAt.trim() } : {}
+			});
+		}
+		this.logger?.debug?.("[web-search] succeeded", {
+			region: this.region,
+			resultsCount: sources.length,
+			elapsedMs
+		});
+		return {
+			result: {
+				sources,
+				truncated: false
+			},
+			retryable: false,
+			reason: ""
+		};
+	}
+};
 //#endregion
 //#region src/qoder/transport/wire/thinking.ts
 const thinkingTags = [{
@@ -1823,6 +2388,30 @@ const doneMarker = "[DONE]";
 function malformed(message) {
 	return new QoderLlmError(message, "MALFORMED_RESPONSE");
 }
+function extractErrorDetail(envelope) {
+	const raw = envelope.body ?? envelope.message;
+	if (!raw) return void 0;
+	if (typeof raw !== "string") return JSON.stringify(raw);
+	const trimmed = raw.trim();
+	try {
+		const parsed = JSON.parse(trimmed);
+		if (parsed && typeof parsed === "object") {
+			let detailMsg;
+			if (typeof parsed.details === "string") try {
+				const inner = JSON.parse(parsed.details);
+				if (typeof inner?.error?.message === "string") detailMsg = inner.error.message.trim();
+				else if (typeof inner?.message === "string") detailMsg = inner.message.trim();
+			} catch {}
+			const msg = typeof parsed.message === "string" ? parsed.message.trim() : void 0;
+			const code = typeof parsed.code === "string" ? parsed.code.trim() : void 0;
+			const err = typeof parsed.error === "string" ? parsed.error.trim() : void 0;
+			const text = detailMsg || msg || err;
+			if (code && text) return `${code}: ${text}`;
+			return text || code || trimmed;
+		}
+	} catch {}
+	return trimmed;
+}
 function parseEnvelope(rawData) {
 	let value;
 	try {
@@ -1834,7 +2423,13 @@ function parseEnvelope(rawData) {
 	const envelope = value;
 	if (envelope.statusCodeValue !== void 0 && typeof envelope.statusCodeValue !== "number") throw malformed("Qoder SSE envelope has an invalid status code.");
 	if (envelope.statusCodeValue !== void 0 && (!Number.isInteger(envelope.statusCodeValue) || envelope.statusCodeValue < 100 || envelope.statusCodeValue > 599)) throw malformed("Qoder SSE envelope has an invalid status code.");
-	if (envelope.statusCodeValue !== void 0 && envelope.statusCodeValue !== 200) throw qoderHttpError(`Qoder service returned upstream error status ${envelope.statusCodeValue}.`, { status: envelope.statusCodeValue });
+	if (envelope.statusCodeValue !== void 0 && envelope.statusCodeValue !== 200) {
+		const detail = extractErrorDetail(envelope);
+		throw qoderHttpError(detail ? `Qoder service returned upstream error status ${envelope.statusCodeValue}: ${detail}` : `Qoder service returned upstream error status ${envelope.statusCodeValue}.`, {
+			status: envelope.statusCodeValue,
+			cause: envelope.body
+		});
+	}
 	if (envelope.body !== void 0 && typeof envelope.body !== "string") throw malformed("Qoder SSE envelope has an invalid model body.");
 	return envelope;
 }
@@ -1866,10 +2461,18 @@ function finishKind(value) {
 	if (value === void 0 || value === null || value === "") return void 0;
 	if (value === "stop") return "stop";
 	if (value === "length") return "max-tokens";
-	if (value === "tool_calls" || value === "toolUse") return "tool-calls";
+	if (value === "tool_calls" || value === "toolUse" || value === "function_call") return "tool-calls";
 	if (value === "content_filter") throw new QoderLlmError("Qoder blocked the response through its content filter.", "PROVIDER_ERROR");
 	throw malformed(`Qoder returned unknown finish reason "${value}".`);
 }
+/** Whether a choice delta streams content, reasoning, or tool-call data. Control-only frames do not. */
+function carriesStreamDelta(delta) {
+	if (delta == null) return false;
+	if (Array.isArray(delta.tool_calls) && delta.tool_calls.length > 0) return true;
+	if (typeof delta.content === "string" && delta.content) return true;
+	if (typeof delta.reasoning_content === "string" && delta.reasoning_content) return true;
+	return false;
+}
 async function* parseQoderSse(stream, options = {}) {
 	const reader = stream.getReader();
 	const decoder = new TextDecoder();
@@ -1882,6 +2485,7 @@ async function* parseQoderSse(stream, options = {}) {
 	let activeTextual;
 	let pendingUsage;
 	let terminalKind = "stop";
+	let sawFinishReason = false;
 	let sawContent = false;
 	const maxBufferChars = options.maxBufferChars ?? 2097152;
 	const closeTextual = () => {
@@ -1976,7 +2580,8 @@ async function* parseQoderSse(stream, options = {}) {
 					sawDone = true;
 					break;
 				}
-				const body = parseEnvelope(rawData).body?.trim();
+				const envelope = parseEnvelope(rawData);
+				const body = typeof envelope.body === "string" ? envelope.body.trim() : "";
 				if (!body) continue;
 				if (body === doneMarker) {
 					sawDone = true;
@@ -1985,7 +2590,11 @@ async function* parseQoderSse(stream, options = {}) {
 				const innerChunk = parseInner(body);
 				pendingUsage = tokenUsage(innerChunk) ?? pendingUsage;
 				for (const choice of innerChunk.choices ?? []) {
-					terminalKind = finishKind(choice.finish_reason) ?? terminalKind;
+					const kind = finishKind(choice.finish_reason);
+					if (kind !== void 0) {
+						terminalKind = kind;
+						sawFinishReason = true;
+					} else if (carriesStreamDelta(choice.delta)) sawFinishReason = false;
 					const delta = choice.delta;
 					if (!delta) continue;
 					if (typeof delta.reasoning_content === "string" && delta.reasoning_content) for (const segment of thinkingParser.pushReasoning(delta.reasoning_content)) for (const chunk of appendSegment(segment)) yield chunk;
@@ -2055,7 +2664,7 @@ async function* parseQoderSse(stream, options = {}) {
 		await reader.cancel().catch(() => void 0);
 		reader.releaseLock();
 	}
-	if (!sawDone) throw new QoderLlmError("SSE stream ended prematurely without [DONE].", "TRANSPORT");
+	if (!sawDone && !sawFinishReason) throw new QoderLlmError("SSE stream ended prematurely without [DONE].", "TRANSPORT");
 	for (const segment of thinkingParser.finish()) for (const chunk of appendSegment(segment)) yield chunk;
 	for (const chunk of closeTextual()) yield chunk;
 	for (const [, state] of [...toolCalls.entries()].sort(([left], [right]) => left - right)) {
@@ -2123,7 +2732,10 @@ async function* streamQoderChat(options, model, credentials, messages, dependenc
 	let headerTimedOut = false;
 	let idleTimedOut = false;
 	let idleTimer;
+	let chunkCount = 0;
+	let reqId;
 	const startedAt = performance.now();
+	let lastActivityAt = startedAt;
 	const onCallerAbort = () => requestController.abort(options.signal?.reason);
 	options.signal?.addEventListener("abort", onCallerAbort, { once: true });
 	const headerTimer = setTimeout(() => {
@@ -2131,6 +2743,7 @@ async function* streamQoderChat(options, model, credentials, messages, dependenc
 		requestController.abort("response header timeout");
 	}, dependencies.responseHeaderTimeoutMs);
 	const resetIdleTimer = () => {
+		lastActivityAt = performance.now();
 		if (idleTimer !== void 0) clearTimeout(idleTimer);
 		idleTimer = setTimeout(() => {
 			idleTimedOut = true;
@@ -2154,34 +2767,100 @@ async function* streamQoderChat(options, model, credentials, messages, dependenc
 			signal: requestController.signal
 		});
 		clearTimeout(headerTimer);
+		reqId = qoderRequestId(response.headers);
 		dependencies.logger?.debug?.("[Qoder Stream] Response headers received", {
 			region: dependencies.region,
 			status: response.status,
 			durationMs: Math.round(performance.now() - startedAt),
-			...qoderRequestId(response.headers) === void 0 ? {} : { requestId: qoderRequestId(response.headers) }
+			...reqId === void 0 ? {} : { requestId: reqId }
 		});
 		resetIdleTimer();
-		if (!response.ok) throw qoderHttpError(`Qoder upstream service returned HTTP ${response.status}.`, response);
+		if (!response.ok) {
+			let bodyText = "";
+			try {
+				bodyText = (await response.text()).trim();
+			} catch {}
+			let detail = "";
+			if (bodyText) try {
+				const parsed = JSON.parse(bodyText);
+				const msg = typeof parsed.message === "string" && parsed.message.trim() ? parsed.message.trim() : void 0;
+				const code = typeof parsed.code === "string" && parsed.code.trim() ? parsed.code.trim() : void 0;
+				if (code && msg) detail = `: ${code}: ${msg}`;
+				else if (msg) detail = `: ${msg}`;
+				else detail = `: ${bodyText.slice(0, 300)}`;
+			} catch {
+				detail = `: ${bodyText.slice(0, 300)}`;
+			}
+			throw qoderHttpError(`Qoder upstream service returned HTTP ${response.status}${detail}.`, {
+				status: response.status,
+				headers: response.headers,
+				cause: bodyText || void 0
+			});
+		}
 		if (!response.body) throw new QoderLlmError("Qoder response contains no readable body stream.", "EMPTY_RESPONSE");
-		yield* parseQoderSse(response.body, { onActivity: resetIdleTimer });
+		let firstChunkDurationMs;
+		let tokenUsage;
+		let finishReason;
+		const streamStartedAt = performance.now();
+		for await (const chunk of parseQoderSse(response.body, { onActivity: resetIdleTimer })) {
+			chunkCount++;
+			if (firstChunkDurationMs === void 0) {
+				firstChunkDurationMs = Math.round(performance.now() - startedAt);
+				dependencies.logger?.debug?.("[Qoder Stream] First chunk received", {
+					durationMs: firstChunkDurationMs,
+					...reqId === void 0 ? {} : { requestId: reqId }
+				});
+			}
+			if (chunk.type === "usage") tokenUsage = chunk.usage;
+			if (chunk.type === "finish") finishReason = chunk.reason.kind;
+			yield chunk;
+		}
+		dependencies.logger?.debug?.("[Qoder Stream] Stream completed", {
+			durationMs: Math.round(performance.now() - startedAt),
+			streamDurationMs: Math.round(performance.now() - streamStartedAt),
+			chunkCount,
+			...finishReason === void 0 ? {} : { finishReason },
+			...tokenUsage === void 0 ? {} : { usage: tokenUsage },
+			...reqId === void 0 ? {} : { requestId: reqId }
+		});
 	} catch (error) {
 		if (options.signal?.aborted) throw aborted$1("Request was aborted.");
+		const elapsedMs = Math.round(performance.now() - startedAt);
 		if (headerTimedOut) {
 			const failure = new QoderLlmError("Qoder model request exceeded its response header timeout.", "TIMEOUT");
-			dependencies.logger?.error?.("[Qoder Stream] Request failed", redactLogValue(failure));
+			dependencies.logger?.error?.("[Qoder Stream] Request failed", redactLogValue(failure), {
+				phase: "header",
+				elapsedMs,
+				timeoutMs: dependencies.responseHeaderTimeoutMs
+			});
 			throw failure;
 		}
 		if (idleTimedOut) {
 			const failure = new QoderLlmError("Qoder model stream exceeded its idle timeout.", "TIMEOUT");
-			dependencies.logger?.error?.("[Qoder Stream] Request failed", redactLogValue(failure));
+			dependencies.logger?.error?.("[Qoder Stream] Request failed", redactLogValue(failure), {
+				phase: "stream-idle",
+				chunkCount,
+				idleDurationMs: Math.round(performance.now() - lastActivityAt),
+				elapsedMs,
+				...reqId === void 0 ? {} : { requestId: reqId }
+			});
 			throw failure;
 		}
 		if (error instanceof QoderLlmError) {
-			dependencies.logger?.error?.("[Qoder Stream] Request failed", redactLogValue(error));
+			dependencies.logger?.error?.("[Qoder Stream] Request failed", redactLogValue(error), {
+				chunkCount,
+				elapsedMs,
+				...reqId === void 0 ? {} : { requestId: reqId }
+			});
 			throw error;
 		}
 		const failure = new QoderLlmError("Qoder transport request failed.", "TRANSPORT", { cause: error });
-		dependencies.logger?.error?.("[Qoder Stream] Request failed", redactLogValue(failure), { cause: redactLogValue(error) });
+		dependencies.logger?.error?.("[Qoder Stream] Request failed", redactLogValue(failure), {
+			chunkCount,
+			elapsedMs,
+			...reqId === void 0 ? {} : { requestId: reqId },
+			cause: redactLogValue(error)
+		});
 		throw failure;
 	} finally {
 		clearTimeout(headerTimer);
@@ -2209,6 +2888,7 @@ var DefaultQoderTransport = class {
 	modelFlights = new SingleFlight();
 	attachments;
 	imageUploader;
+	searchClient;
 	preserveThinking;
 	constructor(options) {
 		this.region = options.region;
@@ -2216,7 +2896,7 @@ var DefaultQoderTransport = class {
 		this.fetchImpl = options.fetch ?? globalThis.fetch;
 		this.logger = options.logger;
 		this.streamIdleTimeoutMs = options.streamIdleTimeoutMs ?? 3e5;
-		this.responseHeaderTimeoutMs = options.responseHeaderTimeoutMs ?? 3e4;
+		this.responseHeaderTimeoutMs = options.responseHeaderTimeoutMs ?? 6e4;
 		this.metadataTimeoutMs = options.metadataTimeoutMs;
 		this.attachments = options.attachments;
 		this.preserveThinking = options.preserveThinking;
@@ -2245,6 +2925,20 @@ var DefaultQoderTransport = class {
 				return this.auth.getCredentials(pat, signal);
 			}
 		});
+		this.searchClient = new QoderSearchClient({
+			fetch: this.fetchImpl,
+			logger: this.logger,
+			region: this.region,
+			resolveCredentials: async (signal) => {
+				const pat = await this.requirePat(signal);
+				return this.auth.getCredentials(pat, signal);
+			},
+			refreshCredentials: async (signal) => {
+				const pat = await this.requirePat(signal);
+				this.auth.clear(pat);
+				return this.auth.getCredentials(pat, signal);
+			}
+		});
 	}
 	stream(options, model) {
 		return this.generate(options, model);
@@ -2270,6 +2964,9 @@ var DefaultQoderTransport = class {
 			signal: options?.signal
 		});
 	}
+	async searchWeb(request, signal) {
+		return this.searchClient.search(request, signal);
+	}
 	async requirePat(signal) {
 		if (signal?.aborted) throw aborted("Qoder request was aborted.");
 		const pat = (await this.resolvePat()).trim();
@@ -2333,8 +3030,18 @@ const Config = z.object({
 	modelsByRegion: modelsByRegionSchema.default({}),
 	models: z.array(catalogModel),
 	streamIdleTimeoutMs: z.number().step(1).min(1).default(defaultStreamIdleTimeoutMs),
-	preserveThinking: z.boolean().default(true)
+	responseHeaderTimeoutMs: z.number().step(1).min(1).default(defaultResponseHeaderTimeoutMs),
+	preserveThinking: z.boolean().default(true),
+	webSearchMode: z.union([
+		"auto",
+		"always",
+		"disabled"
+	]).default("auto")
 });
+const PluginConfig = Config.volatile();
+function readConfig(value) {
+	return "get" in value ? Config(structuredClone(value.get())) : value;
+}
 function resolveModels(models) {
 	const resolved = models ?? defaultModels;
 	if (resolved.length === 0) throw new Error("provider-qoder: at least one model is required");
@@ -2353,6 +3060,10 @@ function modelsFor(config, region, legacyModelsRegion = config.region ?? "global
 	return resolveModels(defaultModels);
 }
 //#endregion
+//#region src/dsh/provider.ts
+/** DSH model provider route, matching the plugin package name. */
+const QODER_PROVIDER_ID = "dsh-provider-qoder";
+//#endregion
 //#region src/dsh/adapter.ts
 /** Thin DSH adapter over the Qoder transport seam. */
 function modelInfo(provider, model) {
@@ -2369,12 +3080,15 @@ var QoderAdapter = class extends LlmAdapter {
 	catalogModels;
 	providerId;
 	providerName;
+	onModelsDiscovered;
+	discoveries = /* @__PURE__ */ new WeakMap();
 	constructor(options) {
 		super();
 		this.resolveTransport = options.resolveTransport;
 		this.catalogModels = options.models && options.models.length > 0 ? options.models : defaultModels;
-		this.providerId = options.providerId ?? "qoder-official";
+		this.providerId = options.providerId ?? "dsh-provider-qoder";
 		this.providerName = options.providerName ?? "Qoder";
+		this.onModelsDiscovered = options.onModelsDiscovered;
 	}
 	providerInfo(provider) {
 		return {
@@ -2382,15 +3096,55 @@ var QoderAdapter = class extends LlmAdapter {
 			name: this.providerName
 		};
 	}
-	listModels(provider) {
-		return Promise.resolve(this.catalogModels.map((model) => modelInfo(provider, model)));
+	/** Refresh advertised metadata on catalog reads, sharing a five-minute transport-local cache. */
+	async listModels(provider) {
+		const transport = this.resolveTransport();
+		let cached = this.discoveries.get(transport);
+		if (cached === void 0) {
+			cached = { expiresAt: 0 };
+			this.discoveries.set(transport, cached);
+		}
+		const entry = cached;
+		if (entry.inflight === void 0 && Date.now() >= entry.expiresAt) entry.inflight = Promise.resolve().then(() => transport.discoverModels()).then((models) => {
+			if (this.discoveries.get(transport) !== entry || this.resolveTransport() !== transport) return;
+			entry.models = models;
+			entry.expiresAt = Date.now() + 300 * 1e3;
+			this.publishDiscoveredModels(transport, models);
+		}).catch(() => {}).finally(() => {
+			entry.inflight = void 0;
+		});
+		await entry.inflight;
+		if (this.resolveTransport() !== transport) return this.listModels(provider);
+		return this.effectiveModels().map((model) => modelInfo(provider, model));
+	}
+	/**
+	* Announce one accepted discovery without joining the catalog read.
+	*
+	* Persisting metadata can queue behind unrelated settings writes, so awaiting
+	* it here would stall every `listModels` call on settings storage.
+	*/
+	publishDiscoveredModels(transport, models) {
+		try {
+			const pending = this.onModelsDiscovered?.(transport, models);
+			if (pending !== void 0 && pending !== null && typeof pending.catch === "function") pending.catch(() => {});
+		} catch {}
+	}
+	effectiveModels() {
+		return mergeQoderDiscoveryMetadata(this.catalogModels, this.discoveries.get(this.resolveTransport())?.models ?? []);
 	}
 	replaceModels(models) {
 		this.catalogModels = models;
 	}
+	/** Publish an explicit discovery without letting older in-flight reads overwrite it. */
+	updateDiscoveredModels(transport, models) {
+		this.discoveries.set(transport, {
+			models,
+			expiresAt: Date.now() + 300 * 1e3
+		});
+	}
 	resolveModel(provider, modelId, signal) {
 		if (signal?.aborted) return Promise.reject(new QoderLlmError("Qoder model resolution was aborted.", "ABORTED"));
-		const configured = this.catalogModels.find((model) => model.id === modelId);
+		const configured = this.effectiveModels().find((model) => model.id === modelId);
 		if (configured === void 0) return Promise.resolve({
 			provider,
 			id: modelId,
@@ -2413,11 +3167,64 @@ var QoderAdapter = class extends LlmAdapter {
 	}
 	stream(options) {
 		if (options.provider !== this.providerId) throw new QoderLlmError(`Qoder adapter does not own provider "${options.provider}".`, "INVALID_PROVIDER");
-		const model = this.catalogModels.find((candidate) => candidate.id === (options.model || "cmodel"));
+		const model = this.effectiveModels().find((candidate) => candidate.id === (options.model || "cmodel"));
 		return this.resolveTransport().stream(options, model);
 	}
 };
 //#endregion
+//#region src/dsh/search-provider.ts
+/**
+* DSH WebSearchProvider implementation with initiator-aware dynamic routing.
+*
+* Implements the `@deepseek-ai/dsh-web` capability seam, routing search queries
+* to Qoder Center when an agent runs with a Qoder model (`dsh-provider-qoder`),
+* or delegating to a fallback search provider when another model is active.
+*
+* @module dsh-provider-qoder/dsh/search-provider
+*/
+const QODER_SEARCH_PROVIDER_ID = "qoder";
+const QODER_MODEL_PROVIDER_ROUTE = QODER_PROVIDER_ID;
+var QoderSearchProvider = class {
+	id = QODER_SEARCH_PROVIDER_ID;
+	ctx;
+	resolveTransport;
+	searchClient;
+	getWebSearchMode;
+	fallbackProvider;
+	constructor(options) {
+		this.ctx = options.ctx;
+		this.resolveTransport = options.resolveTransport;
+		this.searchClient = options.searchClient;
+		this.getWebSearchMode = options.getWebSearchMode;
+		this.fallbackProvider = options.fallbackProvider;
+	}
+	available() {
+		return this.getWebSearchMode() !== "disabled";
+	}
+	async search(request, signal) {
+		const mode = this.getWebSearchMode();
+		if (mode === "disabled") throw new WebError("Qoder web search is disabled in settings.", "WEB_PROVIDER_UNAVAILABLE");
+		const agent = (this.ctx.get("agents") ?? this.ctx.agents)?.currentInitiator?.();
+		const defaultModelService = this.ctx.get("agentDefaultModel");
+		const providerRoute = agent?.options?.provider ?? defaultModelService?.get?.()?.provider;
+		if (mode === "always" || providerRoute === QODER_MODEL_PROVIDER_ROUTE) {
+			if (this.resolveTransport !== void 0) return this.resolveTransport().searchWeb(request, signal);
+			if (this.searchClient !== void 0) return this.searchClient.search(request, signal);
+			throw new WebError("No Qoder transport configured for web search.", "WEB_PROVIDER_ERROR");
+		}
+		const fallback = this.resolveFallback();
+		if (fallback && fallback.available()) return fallback.search(request, signal);
+		throw new WebError(`Current model provider is "${providerRoute ?? "unknown"}" rather than "${QODER_MODEL_PROVIDER_ROUTE}", and no fallback web search provider is available. Switch to a Qoder model or configure an ambient search provider.`, "WEB_PROVIDER_UNAVAILABLE");
+	}
+	resolveFallback() {
+		if (this.fallbackProvider && this.fallbackProvider.available()) return this.fallbackProvider;
+		const providers = this.ctx.get("web")?.searchProviders;
+		if (providers && typeof providers.entries === "function") {
+			for (const [id, provider] of providers.entries()) if (id !== "qoder" && provider.available()) return provider;
+		}
+	}
+};
+//#endregion
 //#region src/dsh/credential-contract.ts
 /** Shared DSH host/browser contract for the one managed Qoder credential. */
 const qoderCredentialRef = "QODER_MANAGED_CREDENTIAL";
@@ -2436,6 +3243,116 @@ async function resolveManagedQoderPat(credentials) {
 	return hit.value.trim();
 }
 //#endregion
+//#region src/dsh/settings.ts
+function bindQoderSettings(owner, ctx, input, options) {
+	const settings = ctx.settings;
+	if (typeof settings.register === "function") {
+		const namespace = "provider-qoder";
+		return {
+			namespace,
+			scope: settings.register(namespace, Config, options)
+		};
+	}
+	const namespace = owner.fiber.entry?.options.id ?? "provider-qoder";
+	const get = () => readConfig(input);
+	options.validate?.(get());
+	ctx.effect(() => owner.on("internal/config", function(_raw, next) {
+		const value = next();
+		if (this === owner.fiber) options.validate?.(Config(value));
+		return value;
+	}));
+	return {
+		namespace,
+		scope: {
+			get,
+			update: (patch) => settings.update(namespace, patch),
+			watch: (listener) => {
+				const on = owner.on.bind(owner);
+				return ctx.effect(() => on("loader/volatile-update", () => {
+					Promise.resolve().then(listener).catch((error) => ctx.emit("internal/error", error));
+				}));
+			}
+		}
+	};
+}
+/**
+* Absolute Fetch-route prefix. Connection mounts its shared, authenticated API
+* channel at `/api`, and every exact Fetch route lives directly below it.
+*/
+const qoderRpcApiPath = `/api/qoder-subscription`;
+/** Endpoints the account card and the model catalog call. */
+const qoderRpcEndpoints = ["account", "models"];
+/** Absolute Fetch-route path of one endpoint. */
+function qoderRpcPath(endpoint) {
+	return `${qoderRpcApiPath}/${endpoint}`;
+}
+/** Type guard for an untrusted endpoint name. */
+function isQoderRpcEndpoint(value) {
+	return typeof value === "string" && qoderRpcEndpoints.includes(value);
+}
+//#endregion
+//#region src/dsh/rpc.ts
+/**
+* Mount every Qoder settings endpoint on the shared API channel.
+*
+* Registering is caller-owned: the returned disposer removes the routes again,
+* so the caller can tie them to its fiber with `ctx.effect`.
+*
+* @param ctx - host context carrying the Connection service.
+* @param handler - decoded endpoint handler, shared by every endpoint.
+* @returns disposer removing every registered route.
+* @throws when Connection exposes no exact Fetch registry.
+*/
+function registerQoderRpc(ctx, handler) {
+	const registry = ctx.connection?.fetch;
+	if (typeof registry?.register !== "function") throw new Error("provider-qoder: connection exposes no exact Fetch route registry");
+	const disposers = qoderRpcEndpoints.map((endpoint) => registry.register({
+		path: qoderRpcPath(endpoint),
+		methods: ["POST"],
+		requestBody: "buffered",
+		fetch: (request) => handleQoderRpcRequest(endpoint, handler, request)
+	}));
+	return () => {
+		for (const dispose of disposers) if (typeof dispose === "function") dispose();
+	};
+}
+/**
+* Decode one request, run the endpoint handler, and encode its result.
+*
+* Failures stay inside the response envelope so the client keeps a single error
+* path; only a malformed body and a handler crash use a transport status.
+*/
+async function handleQoderRpcRequest(endpoint, handler, request) {
+	if (request.signal.aborted) return Response.json({
+		ok: false,
+		error: {
+			code: "ABORTED",
+			message: "Request aborted",
+			details: { issues: [] }
+		}
+	});
+	let payload = {};
+	const body = await request.text();
+	if (body.trim().length > 0) try {
+		payload = JSON.parse(body);
+	} catch {
+		return new Response("body is not JSON", { status: 400 });
+	}
+	try {
+		return Response.json(await handler(endpoint, payload, request.signal));
+	} catch (error) {
+		if (request.signal.aborted) return Response.json({
+			ok: false,
+			error: {
+				code: "ABORTED",
+				message: "Request aborted",
+				details: { issues: [] }
+			}
+		});
+		return new Response(`handler failure: ${String(error)}`, { status: 500 });
+	}
+}
+//#endregion
 //#region src/dsh/plugin.ts
 const name = "provider-qoder";
 const inject = [
@@ -2444,9 +3361,8 @@ const inject = [
 	"connection",
 	"attachments"
 ];
-const providerQoder = "qoder-official";
+const providerQoder = QODER_PROVIDER_ID;
 const settingsNamespace = "provider-qoder";
-const qoderChannel = "/qoder-subscription";
 const fiberDisposed = 4;
 const fiberUnloading = 5;
 function logError(error) {
@@ -2457,17 +3373,18 @@ function logError(error) {
 		..."code" in error ? { code: error.code } : {}
 	};
 }
-function publicError(message) {
+function publicError(code, message, details = { issues: [] }) {
 	return {
 		ok: false,
 		error: {
-			code: "internal",
+			code,
 			message,
-			details: { issues: [] }
+			details
 		}
 	};
 }
-function apply(ctx, config = {}) {
+function apply(ctx, input = {}) {
+	const config = readConfig(input);
 	const logger = ctx.logger;
 	const initialRegion = config.region ?? "global";
 	const hasConfiguredModels = config.models !== void 0 && config.models.length > 0;
@@ -2476,7 +3393,9 @@ function apply(ctx, config = {}) {
 		modelsByRegion: { ...config.modelsByRegion },
 		...hasConfiguredModels ? { models: resolveModels(config.models) } : {},
 		streamIdleTimeoutMs: config.streamIdleTimeoutMs ?? 3e5,
-		preserveThinking: config.preserveThinking ?? true
+		responseHeaderTimeoutMs: config.responseHeaderTimeoutMs ?? 6e4,
+		preserveThinking: config.preserveThinking ?? true,
+		webSearchMode: config.webSearchMode ?? "auto"
 	};
 	let current = () => baseConfig;
 	let legacyModelsRegion = initialRegion;
@@ -2485,11 +3404,12 @@ function apply(ctx, config = {}) {
 		global: [],
 		china: []
 	};
-	const createTransport = (region, streamIdleTimeoutMs, preserveThinking, resolvePat = () => resolveManagedQoderPat(ctx.credentials)) => createQoderTransport({
+	const createTransport = (region, streamIdleTimeoutMs, responseHeaderTimeoutMs, preserveThinking, resolvePat = () => resolveManagedQoderPat(ctx.credentials)) => createQoderTransport({
 		region,
 		resolvePat,
 		logger,
 		streamIdleTimeoutMs,
+		responseHeaderTimeoutMs,
 		attachments: ctx.attachments,
 		preserveThinking
 	});
@@ -2500,30 +3420,43 @@ function apply(ctx, config = {}) {
 			region,
 			models: mergeQoderDiscoveryMetadata(modelsFor(value, region, legacyModelsRegion), discoveredCatalogs[region]),
 			streamIdleTimeoutMs: value.streamIdleTimeoutMs ?? 3e5,
-			preserveThinking: value.preserveThinking ?? true
+			responseHeaderTimeoutMs: value.responseHeaderTimeoutMs ?? 6e4,
+			preserveThinking: value.preserveThinking ?? true,
+			webSearchMode: value.webSearchMode ?? "auto"
 		};
 	};
 	const initial = resolveConfig();
-	let activeTransport = createTransport(initial.region, initial.streamIdleTimeoutMs, initial.preserveThinking);
+	let activeTransport = createTransport(initial.region, initial.streamIdleTimeoutMs, initial.responseHeaderTimeoutMs, initial.preserveThinking);
 	let activeTransportConfig = {
 		region: initial.region,
 		streamIdleTimeoutMs: initial.streamIdleTimeoutMs,
+		responseHeaderTimeoutMs: initial.responseHeaderTimeoutMs,
 		preserveThinking: initial.preserveThinking
 	};
 	const adapter = new QoderAdapter({
 		resolveTransport: () => activeTransport,
 		models: initial.models,
 		providerId: providerQoder,
-		providerName: "Qoder"
+		providerName: "Qoder",
+		onModelsDiscovered: (transport, models) => {
+			if (transport !== activeTransport || ctx.fiber.state === fiberUnloading || ctx.fiber.state === fiberDisposed) return;
+			const region = activeTransportConfig.region;
+			discoveredCatalogs[region] = models;
+			refreshAdapter();
+			persistDiscoveredModels(region).catch((error) => {
+				logger?.error?.("[Qoder Settings] Failed to synchronize model catalog", logError(error));
+			});
+		}
 	});
 	const registration = ctx.llm.registerAdapter([providerQoder], adapter);
 	const refreshAdapter = () => {
 		const next = resolveConfig();
-		if (next.region !== activeTransportConfig.region || next.streamIdleTimeoutMs !== activeTransportConfig.streamIdleTimeoutMs || next.preserveThinking !== activeTransportConfig.preserveThinking) {
-			activeTransport = createTransport(next.region, next.streamIdleTimeoutMs, next.preserveThinking);
+		if (next.region !== activeTransportConfig.region || next.streamIdleTimeoutMs !== activeTransportConfig.streamIdleTimeoutMs || next.responseHeaderTimeoutMs !== activeTransportConfig.responseHeaderTimeoutMs || next.preserveThinking !== activeTransportConfig.preserveThinking) {
+			activeTransport = createTransport(next.region, next.streamIdleTimeoutMs, next.responseHeaderTimeoutMs, next.preserveThinking);
 			activeTransportConfig = {
 				region: next.region,
 				streamIdleTimeoutMs: next.streamIdleTimeoutMs,
+				responseHeaderTimeoutMs: next.responseHeaderTimeoutMs,
 				preserveThinking: next.preserveThinking
 			};
 		}
@@ -2531,7 +3464,7 @@ function apply(ctx, config = {}) {
 		registration.replace([providerQoder]);
 	};
 	ctx.inject(["settings"], (settingsCtx) => {
-		const scope = settingsCtx.settings.register(settingsNamespace, Config, {
+		const { scope, namespace } = bindQoderSettings(ctx, settingsCtx, input, {
 			base: baseConfig,
 			validate: (value) => {
 				for (const region of Object.keys(value.modelsByRegion ?? {})) if (region !== "global" && region !== "china") throw new Error(`provider-qoder: unsupported model catalog region "${region}"`);
@@ -2541,34 +3474,39 @@ function apply(ctx, config = {}) {
 		});
 		legacyModelsRegion = scope.get().region ?? initialRegion;
 		current = () => scope.get();
-		persistDiscoveredModels = async (region) => {
-			const value = scope.get();
-			const selected = modelsFor(value, region, legacyModelsRegion);
-			const enriched = mergeQoderDiscoveryMetadata(selected, discoveredCatalogs[region]);
-			if (!hasSameQoderDiscoveryMetadata(selected, enriched)) await scope.update({ modelsByRegion: {
-				...value.modelsByRegion,
-				[region]: enriched
-			} });
+		let bindingActive = true;
+		const persistCatalog = async (region) => {
+			while (bindingActive && ctx.fiber.state !== fiberUnloading && ctx.fiber.state !== fiberDisposed) {
+				if (!settingsCtx.settings.writable || discoveredCatalogs[region].length === 0) return;
+				const snapshot = settingsCtx.settings.describe().find((section) => section.ns === namespace);
+				if (snapshot === void 0) return;
+				const selected = modelsFor(snapshot.value, region, legacyModelsRegion);
+				const enriched = modelsFor(Config({ modelsByRegion: { [region]: mergeQoderDiscoveryMetadata(selected, discoveredCatalogs[region]) } }), region);
+				if (hasSameQoderDiscoveryMetadata(selected, enriched)) return;
+				try {
+					await settingsCtx.settings.update(namespace, { modelsByRegion: { [region]: enriched } }, snapshot.revision);
+					return;
+				} catch (error) {
+					if (!(error instanceof SettingsConflictError)) throw error;
+				}
+			}
 		};
+		persistDiscoveredModels = persistCatalog;
 		refreshAdapter();
 		const loaded = scope.get();
 		const loadedRegion = loaded.region ?? "global";
-		if (loaded.models !== void 0 && loaded.models.length > 0 && loaded.modelsByRegion?.[loadedRegion] === void 0) scope.update({ modelsByRegion: {
-			...loaded.modelsByRegion,
-			[loadedRegion]: resolveModels(loaded.models)
-		} }).catch((error) => logger?.error?.("[Qoder Settings] Failed to migrate model catalog", logError(error)));
-		scope.watch(async (next) => {
-			if (ctx.fiber.state === fiberUnloading || ctx.fiber.state === fiberDisposed) return;
+		if (loaded.models !== void 0 && loaded.models.length > 0 && loaded.modelsByRegion?.[loadedRegion] === void 0) scope.update({ modelsByRegion: { [loadedRegion]: resolveModels(loaded.models) } }).catch((error) => logger?.error?.("[Qoder Settings] Failed to migrate model catalog", logError(error)));
+		scope.watch(async () => {
+			if (!bindingActive || ctx.fiber.state === fiberUnloading || ctx.fiber.state === fiberDisposed) return;
 			refreshAdapter();
-			const region = next.region ?? "global";
-			const selected = modelsFor(next, region, legacyModelsRegion);
-			const enriched = mergeQoderDiscoveryMetadata(selected, discoveredCatalogs[region]);
-			if (!hasSameQoderDiscoveryMetadata(selected, enriched)) await scope.update({ modelsByRegion: {
-				...next.modelsByRegion,
-				[region]: enriched
-			} });
+			await persistCatalog(scope.get().region ?? "global");
 		});
+		for (const region of ["global", "china"]) {
+			if (discoveredCatalogs[region].length === 0) continue;
+			persistCatalog(region).catch((error) => logger?.error?.("[Qoder Settings] Failed to synchronize model catalog", logError(error)));
+		}
 		settingsCtx.effect(() => () => {
+			bindingActive = false;
 			if (ctx.fiber.state === fiberUnloading || ctx.fiber.state === fiberDisposed) return;
 			persistDiscoveredModels = async () => {};
 			current = () => baseConfig;
@@ -2577,8 +3515,10 @@ function apply(ctx, config = {}) {
 	});
 	const discoverModels = async (signal, suppliedPat) => {
 		const snapshot = resolveConfig();
+		const snapshotTransport = activeTransport;
 		const normalizedPat = suppliedPat?.trim();
-		const models = await (normalizedPat ? createTransport(snapshot.region, snapshot.streamIdleTimeoutMs, snapshot.preserveThinking, () => Promise.resolve(normalizedPat)) : activeTransport).discoverModels(signal);
+		const models = await (normalizedPat ? createTransport(snapshot.region, snapshot.streamIdleTimeoutMs, snapshot.responseHeaderTimeoutMs, snapshot.preserveThinking, () => Promise.resolve(normalizedPat)) : snapshotTransport).discoverModels(signal);
+		adapter.updateDiscoveredModels(snapshotTransport, models);
 		discoveredCatalogs[snapshot.region] = models;
 		refreshAdapter();
 		await persistDiscoveredModels(snapshot.region);
@@ -2593,40 +3533,69 @@ function apply(ctx, config = {}) {
 			maxTokens: model.maxTokens
 		}));
 	});
-	if (ctx.connection?.rpc) {
-		const handler = async (endpoint, payload, signal) => {
-			if (endpoint !== "account" && endpoint !== "models") return publicError(`Unknown endpoint: ${endpoint}`);
-			signal.throwIfAborted();
-			if (endpoint === "models") try {
-				return {
-					ok: true,
-					value: await discoverModels(signal)
-				};
-			} catch (error) {
-				if (signal.aborted || error instanceof QoderLlmError && error.code === "ABORTED") throw error;
-				logger?.error?.("[Qoder RPC] Failed to discover models", logError(error));
-				return publicError(error instanceof Error ? error.message : "Failed to discover Qoder models");
-			}
-			const force = typeof payload === "object" && payload !== null && "force" in payload ? payload.force === true : false;
-			logger?.debug?.("[Qoder RPC] Reading subscriber account", { force });
+	const handler = async (endpoint, payload, signal) => {
+		if (!isQoderRpcEndpoint(endpoint)) return publicError("UNKNOWN_ENDPOINT", `Unknown endpoint: ${endpoint}`);
+		if (signal.aborted) return publicError("ABORTED", "Request aborted");
+		const executeRpc = async (operation, task) => {
 			try {
-				const account = await activeTransport.readAccount({
-					force,
-					signal
-				});
-				logger?.debug?.("[Qoder RPC] Subscriber account resolved");
 				return {
 					ok: true,
-					value: account
+					value: await task()
 				};
 			} catch (error) {
-				if (signal.aborted || error instanceof QoderLlmError && error.code === "ABORTED") throw error;
-				logger?.error?.("[Qoder RPC] Failed to read subscriber account", logError(error));
-				return publicError(error instanceof Error ? error.message : "Failed to load Qoder account");
+				if (signal.aborted || error instanceof QoderLlmError && error.code === "ABORTED") {
+					logger?.debug?.(`[Qoder RPC] ${operation} was aborted`);
+					return publicError("ABORTED", "Request aborted");
+				}
+				let code = "INTERNAL";
+				if (error instanceof QoderLlmError) if (error.code === "MISSING_CREDENTIAL" || error.code === "NO_CREDENTIALS") code = "NO_CREDENTIALS";
+				else if (error.code === "AUTH") code = "UNAUTHENTICATED";
+				else if (error.code === "TIMEOUT") code = "TIMEOUT";
+				else code = "UPSTREAM_ERROR";
+				logger?.error?.(`[Qoder RPC] Failed to ${operation}`, logError(error));
+				return publicError(code, error instanceof Error ? error.message : `Failed to ${operation}`);
 			}
 		};
-		ctx.effect(() => ctx.connection.rpc.handle(qoderChannel, handler), "provider-qoder: loopback account RPC");
+		if (endpoint === "models") return await executeRpc("discover Qoder models", () => discoverModels(signal));
+		const force = typeof payload === "object" && payload !== null && "force" in payload ? payload.force === true : false;
+		logger?.debug?.("[Qoder RPC] Reading subscriber account", { force });
+		const outcome = await executeRpc("load Qoder account", () => activeTransport.readAccount({
+			force,
+			signal
+		}));
+		if (outcome.ok) logger?.debug?.("[Qoder RPC] Subscriber account resolved");
+		return outcome;
+	};
+	try {
+		ctx.effect(() => registerQoderRpc(ctx, handler), "provider-qoder: settings RPC routes");
+	} catch (error) {
+		logger?.error?.("[Qoder RPC] Failed to register the settings RPC routes", logError(error));
 	}
+	ctx.inject(["web"], (webCtx) => {
+		const searchProvider = new QoderSearchProvider({
+			ctx,
+			resolveTransport: () => activeTransport,
+			getWebSearchMode: () => resolveConfig().webSearchMode ?? "auto"
+		});
+		webCtx.web.registerSearchProvider(searchProvider);
+		if (typeof webCtx.web.search === "function") {
+			const originalSearch = webCtx.web.search.bind(webCtx.web);
+			webCtx.effect(() => {
+				webCtx.web.search = async (request, signal) => {
+					const mode = resolveConfig().webSearchMode ?? "auto";
+					if (mode === "disabled") return originalSearch(request, signal);
+					const agent = (ctx.get("agents") ?? ctx.agents)?.currentInitiator?.();
+					const defaultModelService = ctx.get("agentDefaultModel");
+					const isQoderActive = (agent?.options?.provider ?? defaultModelService?.get?.()?.provider) === providerQoder;
+					if (mode === "always" || isQoderActive) return searchProvider.search(request, signal);
+					return originalSearch(request, signal);
+				};
+				return () => {
+					webCtx.web.search = originalSearch;
+				};
+			}, "provider-qoder: transparent web search router");
+		}
+	});
 }
 //#endregion
-export { Config, apply, inject, name };
+export { PluginConfig as Config, QODER_SEARCH_PROVIDER_ID, QoderSearchClient, QoderSearchProvider, apply, getQoderWebSearchUrl, inject, name, qoderWebSearchPath };