dsh-subscriptions 0.1.3 → 0.1.4

package/lib/index.js

@@ -5,7 +5,7 @@ import http, { createServer } from "node:http";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { getDefaultAutoSelectFamilyAttemptTimeout, setDefaultAutoSelectFamilyAttemptTimeout } from "node:net";
 import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { execFileSync } from "node:child_process";
 import { appendFileSync, chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -97,12 +97,12 @@ async function listen(handler, spec) {
 		for (const host of hosts) {
 			const server = createServer(handler);
 			try {
-				await new Promise((resolve$1, reject) => {
+				await new Promise((resolve$2, reject) => {
 					const onError = (error) => reject(error);
 					server.once("error", onError);
 					server.listen(port, host, () => {
 						server.removeListener("error", onError);
-						resolve$1();
+						resolve$2();
 					});
 				});
 				const address = server.address();
@@ -169,8 +169,8 @@ var OAuthFlowManager = class {
 		const timeoutMs = spec.timeoutMs ?? DEFAULT_FLOW_TIMEOUT_MS;
 		let resolveCode;
 		let rejectCode;
-		const codePromise = new Promise((resolve$1, reject) => {
-			resolveCode = resolve$1;
+		const codePromise = new Promise((resolve$2, reject) => {
+			resolveCode = resolve$2;
 			rejectCode = reject;
 		});
 		let settled = false;
@@ -280,14 +280,14 @@ const DEFAULT_INTERVAL_SEC = 5;
 const DEFAULT_EXPIRES_IN_SEC = 900;
 /** Sleep for `ms`, rejecting early when the signal aborts. */
 function sleep$1(ms, signal) {
-	return new Promise((resolve$1, reject) => {
+	return new Promise((resolve$2, reject) => {
 		if (signal.aborted) {
 			reject(signal.reason instanceof Error ? signal.reason : /* @__PURE__ */ new Error("aborted"));
 			return;
 		}
 		const timer = setTimeout(() => {
 			signal.removeEventListener("abort", onAbort);
-			resolve$1();
+			resolve$2();
 		}, ms);
 		timer.unref();
 		const onAbort = () => {
@@ -349,8 +349,8 @@ var DeviceFlowManager = class {
 		const controller = new AbortController();
 		let resolveToken;
 		let rejectToken;
-		const tokenPromise = new Promise((resolve$1, reject) => {
-			resolveToken = resolve$1;
+		const tokenPromise = new Promise((resolve$2, reject) => {
+			resolveToken = resolve$2;
 			rejectToken = reject;
 		});
 		tokenPromise.catch(() => void 0);
@@ -602,6 +602,81 @@ async function refreshClaudeSynced(session, doRefresh) {
 	return next;
 }
 
+//#endregion
+//#region src/providers/reset-redemption.ts
+/**
+* Manual-only redemption with single-use tickets. An ambiguous submission parks
+* the account to prevent an immediate blind retry. This block is process-local,
+* not a durable rate limit: restarting the host clears it. Re-check credits and
+* limits in Codex before retrying; a lost success response may have spent a
+* credit already, and another submission can spend another credit.
+* Rationale: [manual reset note](../../.agents/notes/implemented/provider/2026-10-04-codex-manual-reset.md).
+*/
+var ResetRedemption = class {
+	tickets = /* @__PURE__ */ new Map();
+	busy = /* @__PURE__ */ new Set();
+	uncertain = /* @__PURE__ */ new Set();
+	constructor(read, consume, invalidate, canonical) {
+		this.read = read;
+		this.consume = consume;
+		this.invalidate = invalidate;
+		this.canonical = canonical;
+	}
+	eligible(usage) {
+		const weekly = usage.windows?.find((w) => w.kind === "weekly" && w.scope === void 0);
+		if (!weekly || !Number.isFinite(weekly.usedPercent) || weekly.usedPercent < 80 || weekly.resetsAt === void 0 || weekly.resetsAt <= Date.now()) throw new Error("Reset blocked: fresh weekly usage must be at least 80%.");
+		if (usage.resetCreditsError) throw new Error("Reset credits could not be verified.");
+		return weekly.usedPercent;
+	}
+	async prepare(account, signal) {
+		const who = await this.canonical(account, signal);
+		if (this.busy.has(who) || this.uncertain.has(who)) throw new Error("Reset blocked: an operation is pending or its outcome is uncertain. Check Codex before retrying.");
+		const usage = await this.read(account, signal);
+		if (this.busy.has(who) || this.uncertain.has(who)) throw new Error("Reset blocked: an operation is pending or its outcome is uncertain. Check Codex before retrying.");
+		const weeklyUsedPercent = this.eligible(usage);
+		const credit = usage.resetCredits?.filter((c) => c.id && (c.expiresAt === void 0 || c.expiresAt > Date.now())).sort((a, b) => (a.expiresAt ?? Infinity) - (b.expiresAt ?? Infinity))[0];
+		if (!credit?.id) throw new Error("No available reset credit.");
+		for (const [key, value] of this.tickets) if (value.account === who || value.expiresAt <= Date.now()) this.tickets.delete(key);
+		const ticket = randomUUID();
+		const expiresAt = Date.now() + 6e4;
+		this.tickets.set(ticket, {
+			account: who,
+			creditId: credit.id,
+			expiresAt
+		});
+		return {
+			ticket,
+			expiresAt,
+			weeklyUsedPercent,
+			...credit.expiresAt === void 0 ? {} : { creditExpiresAt: credit.expiresAt }
+		};
+	}
+	async redeem(account, ticket, signal) {
+		const who = await this.canonical(account, signal);
+		const pending = this.tickets.get(ticket);
+		this.tickets.delete(ticket);
+		if (!pending || pending.account !== who || pending.expiresAt <= Date.now()) throw new Error("Confirmation expired. Start again.");
+		if (this.busy.has(who) || this.uncertain.has(who)) throw new Error("Reset blocked: operation pending or uncertain.");
+		this.busy.add(who);
+		try {
+			const usage = await this.read(account, signal);
+			if (pending.expiresAt <= Date.now()) throw new Error("Confirmation expired. Start again.");
+			this.eligible(usage);
+			if (!usage.resetCredits?.some((c) => c.id === pending.creditId && (c.expiresAt === void 0 || c.expiresAt > Date.now()))) throw new Error("The selected reset is no longer available.");
+			this.uncertain.add(who);
+			try {
+				await this.consume(account, pending.creditId, randomUUID(), signal);
+			} catch {
+				throw new Error("Reset outcome could not be confirmed. Do not retry or restart to bypass this block; verify credits and limits in Codex first.");
+			}
+			this.uncertain.delete(who);
+		} finally {
+			this.invalidate(who);
+			this.busy.delete(who);
+		}
+	}
+};
+
 //#endregion
 //#region src/auth/jwt.ts
 /** Minimal JWT payload decoding for claims extraction (no signature verification). */
@@ -905,7 +980,7 @@ async function writeStore(store, path) {
 * A chain is dropped once nothing is queued behind it, so the map holds an
 * entry only while writes are in flight.
 */
-const writeChains = /* @__PURE__ */ new Map();
+const writeChains$1 = /* @__PURE__ */ new Map();
 /**
 * Run one read-modify-write of a store path after every write already queued
 * for it. Callers join the chain synchronously, so call order is write order.
@@ -913,14 +988,14 @@ const writeChains = /* @__PURE__ */ new Map();
 * @param action - the read-modify-write to run.
 * @returns whatever `action` returns.
 */
-async function serialize(path, action) {
-	const next = (writeChains.get(path) ?? Promise.resolve()).then(action, action);
+async function serialize$1(path, action) {
+	const next = (writeChains$1.get(path) ?? Promise.resolve()).then(action, action);
 	const tail = next.then(() => void 0, () => void 0);
-	writeChains.set(path, tail);
+	writeChains$1.set(path, tail);
 	try {
 		return await next;
 	} finally {
-		if (writeChains.get(path) === tail) writeChains.delete(path);
+		if (writeChains$1.get(path) === tail) writeChains$1.delete(path);
 	}
 }
 /**
@@ -968,7 +1043,7 @@ async function getAccountSession(provider, account, path = authFilePath()) {
 */
 async function saveAccountSession(provider, account, session, path = authFilePath()) {
 	assertSessionShape(provider, account, session);
-	return serialize(path, async () => {
+	return serialize$1(path, async () => {
 		const store = await loadStore(path);
 		const entry = store[provider];
 		if (entry !== void 0) {
@@ -994,7 +1069,7 @@ async function saveAccountSession(provider, account, session, path = authFilePat
 * @param path - store file path; defaults to {@link authFilePath}.
 */
 async function deleteAccountSession(provider, account, path = authFilePath()) {
-	return serialize(path, async () => {
+	return serialize$1(path, async () => {
 		const store = await loadStore(path);
 		const entry = store[provider];
 		if (entry === void 0) return;
@@ -1018,7 +1093,7 @@ async function deleteAccountSession(provider, account, path = authFilePath()) {
 * @param path - store file path; defaults to {@link authFilePath}.
 */
 async function setDefaultAccount(provider, account, path = authFilePath()) {
-	return serialize(path, async () => {
+	return serialize$1(path, async () => {
 		const store = await loadStore(path);
 		const entry = store[provider];
 		if (entry !== void 0) account = resolveAccount(entry, account);
@@ -1367,6 +1442,8 @@ const SUBSCRIPTIONS_AUTH_ENDPOINTS = [
 	"cursorSetSettings",
 	"image",
 	"video",
+	"prepareReset",
+	"consumeReset",
 	"speed",
 	"setSpeed",
 	"modelDefaults",
@@ -1646,6 +1723,13 @@ async function dispatch(controller, speed, modelDefaults, endpoint, payload, sig
 			if (payload === null || typeof payload !== "object") throw new BadRequest("payload must be an object");
 			await cursor.setSettings(payload.settings);
 			return ok({ ok: true });
+		case "prepareReset":
+			if (!controller.prepareReset) throw new BadRequest("Reset redemption unavailable");
+			return ok(await controller.prepareReset(readString(payload, "account"), signal));
+		case "consumeReset":
+			if (!controller.consumeReset) throw new BadRequest("Reset redemption unavailable");
+			await controller.consumeReset(readString(payload, "account"), readString(payload, "ticket"), signal);
+			return ok({ ok: true });
 		case "image": return ok(await controller.readImage(readImageRef(payload), signal));
 		case "video": return ok(await controller.readVideo(readVideoName(payload), signal));
 		case "speed": return ok(await speed.speed(readSessionId(payload)));
@@ -1716,10 +1800,10 @@ function tokenExpiry(token, now) {
 }
 function abortableDelay$2(ms, signal) {
 	if (signal.aborted) return Promise.reject(signal.reason);
-	return new Promise((resolve$1, reject) => {
+	return new Promise((resolve$2, reject) => {
 		const timer = setTimeout(() => {
 			signal.removeEventListener("abort", aborted);
-			resolve$1();
+			resolve$2();
 		}, ms);
 		function aborted() {
 			clearTimeout(timer);
@@ -2207,7 +2291,7 @@ async function nativeFetch(url, init = {}) {
 	const client = target.protocol === "https:" ? https : http;
 	const method = (init.method ?? "GET").toUpperCase();
 	const body = init.body === void 0 ? void 0 : isBytes(init.body) ? Buffer.from(init.body) : String(init.body);
-	const request = (u$1, redirect) => new Promise((resolve$1, reject) => {
+	const request = (u$1, redirect) => new Promise((resolve$2, reject) => {
 		const req = client.request(u$1, {
 			method,
 			headers: sanitizeHeaders(init.headers),
@@ -2224,10 +2308,10 @@ async function nativeFetch(url, init = {}) {
 				}
 				const location = res.headers.location;
 				if ((redirect ?? "follow") === "follow" && location && status >= 300 && status < 400) {
-					resolve$1({ redirect: new URL(location, u$1) });
+					resolve$2({ redirect: new URL(location, u$1) });
 					return;
 				}
-				resolve$1({ response: makeResponse(status, res, data) });
+				resolve$2({ response: makeResponse(status, res, data) });
 			});
 		});
 		req.on("error", reject);
@@ -2385,12 +2469,12 @@ function isSuccessfulAgentResponse(status, contentType) {
 function abortableDelay$1(ms, signal) {
 	if (signal.aborted) return Promise.reject(signal.reason ?? /* @__PURE__ */ new Error("Cursor retry aborted"));
 	if (ms === 0) return Promise.resolve();
-	return new Promise((resolve$1, reject) => {
+	return new Promise((resolve$2, reject) => {
 		const timer = setTimeout(done, ms);
 		timer.unref?.();
 		function done() {
 			signal.removeEventListener("abort", aborted);
-			resolve$1();
+			resolve$2();
 		}
 		function aborted() {
 			clearTimeout(timer);
@@ -3170,8 +3254,8 @@ var ConnectFrameReader = class {
 			if (this.error !== void 0) throw this.error;
 			return;
 		}
-		return new Promise((resolve$1, reject) => this.waiters.push({
-			resolve: resolve$1,
+		return new Promise((resolve$2, reject) => this.waiters.push({
+			resolve: resolve$2,
 			reject
 		}));
 	}
@@ -3209,8 +3293,8 @@ var AgentRun = class {
 			authorization: `Bearer ${this.accessToken}`,
 			...AGENT_HEADERS
 		};
-		this.responsePromise = new Promise((resolve$1, reject) => {
-			this.resolveResponse = resolve$1;
+		this.responsePromise = new Promise((resolve$2, reject) => {
+			this.resolveResponse = resolve$2;
 			this.rejectResponse = reject;
 		});
 		this.responsePromise.catch(() => {});
@@ -3239,10 +3323,10 @@ var AgentRun = class {
 		});
 	}
 	#resolveResponse(status) {
-		const resolve$1 = this.resolveResponse;
+		const resolve$2 = this.resolveResponse;
 		this.resolveResponse = void 0;
 		this.rejectResponse = void 0;
-		resolve$1?.(status);
+		resolve$2?.(status);
 	}
 	#rejectResponse(error) {
 		const reject = this.rejectResponse;
@@ -3253,10 +3337,10 @@ var AgentRun = class {
 	waitForResponse(timeoutMs) {
 		if (this.responsePromise === void 0) throw new Error("Cursor AgentRun has not started");
 		if (timeoutMs === void 0) return this.responsePromise;
-		return new Promise((resolve$1, reject) => {
+		return new Promise((resolve$2, reject) => {
 			const timer = setTimeout(() => reject(/* @__PURE__ */ new Error("Cursor HTTP response timeout")), timeoutMs);
 			timer.unref?.();
-			this.responsePromise.then(resolve$1, reject).finally(() => clearTimeout(timer));
+			this.responsePromise.then(resolve$2, reject).finally(() => clearTimeout(timer));
 		});
 	}
 	write(payload) {
@@ -4798,31 +4882,6 @@ function earliestReset(...candidates) {
 function waitFromReset(instant, now) {
 	return Math.max(MIN_WAIT_MS, instant - now + RESET_GRACE_MS);
 }
-/** Header names worth showing when a 429 disclosed no reset this code recognizes. */
-const DIAGNOSTIC_HEADER = /rate-?limit|retry|reset|^x-codex-/i;
-/**
-* Render the rate-limit-shaped headers and the head of the body of a 429 whose
-* reset instant nothing parsed. Emitted through the adapter's `onWarn`, this is
-* how an unrecognized provider field gets named from live traffic instead of
-* being guessed at.
-*
-* It is also where the per-bucket rollover snapshots land by design — no reader
-* parks a turn on one, because on a 429 they cannot say which bucket refused —
-* so the operator still sees what the provider disclosed.
-* @param response - the failed response.
-* @param body - the complete response body.
-* @returns a one-line diagnostic.
-*/
-function rateLimitDiagnostics(response, body) {
-	const headers = [];
-	response.headers.forEach((value, key) => {
-		if (DIAGNOSTIC_HEADER.test(key)) headers.push(`${key}: ${value}`);
-	});
-	headers.sort();
-	const rendered = headers.length > 0 ? headers.join("; ") : "(none)";
-	const head = body.slice(0, 200);
-	return `429 disclosed no reset time; headers [${rendered}]; body ${head.length > 0 ? head : "(empty)"}`;
-}
 /**
 * The retry shape every subscription route starts from: Claude Code's own SDK
 * numbers — ten retries after the first attempt, exponential backoff from 1s
@@ -4923,6 +4982,17 @@ function validateModels(models, label) {
 	});
 }
 /**
+* Provider failures can echo credentials or customer input in any format.
+* Shape-based filtering cannot make arbitrary response text safe to display.
+* Here, safe means this diagnostic carries no provider-controlled free text,
+* not that secrets cannot exist elsewhere in the system. Keep raw responses
+* internal for classification and reset parsing; display only local summaries.
+* This deliberately loses model, parameter and plan details useful to support.
+*/
+function providerDiagnostic(summary, hasBody) {
+	return hasBody ? `${summary}: [provider response body omitted]` : summary;
+}
+/**
 * Build an LlmError from a non-2xx provider response, mapping the status to a
 * stable code and, for a rate-limited request, the disclosed reset instant to
 * the `providerRetryAfterMs` the retry plugin waits out.
@@ -4943,7 +5013,6 @@ async function httpLlmError(response, label, options = {}) {
 		body = await response.text();
 	} catch {}
 	const shown = body.slice(0, 500);
-	const message = shown.length > 0 ? `${label} error (HTTP ${String(response.status)}): ${shown}` : `${label} error (HTTP ${String(response.status)})`;
 	let code;
 	if (response.status === 401 || response.status === 403) code = "AUTH";
 	else if (response.status === 429) code = "RATE_LIMIT";
@@ -4952,10 +5021,11 @@ async function httpLlmError(response, label, options = {}) {
 	else if (response.status === 408 || response.status === 504) code = "TIMEOUT";
 	else if (response.status >= 500) code = "SERVER";
 	else code = `HTTP_${String(response.status)}`;
+	const message = providerDiagnostic(`${label} error (HTTP ${String(response.status)}, ${code})`, body.length > 0);
 	const now = Date.now();
 	const rateLimited = response.status === 429;
 	const reset = rateLimited ? options.rateLimitReset?.(response, body, now) ?? googleQuotaReset(body, now) ?? retryAfterInstant(response, now) : retryAfterInstant(response, now);
-	if (reset === void 0 && rateLimited) options.onWarn?.(`${label}: ${rateLimitDiagnostics(response, body)}`);
+	if (reset === void 0 && rateLimited) options.onWarn?.(providerDiagnostic(`${label}: 429 disclosed no reset time; [provider response headers omitted]`, body.length > 0));
 	return new LlmError(message, code, {
 		status: response.status,
 		...reset === void 0 ? {} : { providerRetryAfterMs: waitFromReset(reset, now) }
@@ -5079,19 +5149,17 @@ var OAuthEndpointError = class extends Error {
 */
 async function oauthEndpointError(response, label) {
 	let oauthCode;
-	let detail = "";
+	let body = "";
 	try {
-		const parsed = await response.json();
+		body = await response.text();
+		const parsed = JSON.parse(body);
 		if (typeof parsed.error === "string") oauthCode = parsed.error;
 		else if (typeof parsed.error === "object" && parsed.error !== null) {
 			const nested = parsed.error;
 			if (typeof nested.code === "string" && nested.code.length > 0) oauthCode = nested.code;
-			if (typeof nested.message === "string") detail = nested.message;
 		}
-		if (typeof parsed.error_description === "string") detail = parsed.error_description;
-		if (detail.length === 0) detail = oauthCode ?? "";
 	} catch {}
-	return new OAuthEndpointError(detail.length > 0 ? `${label} token endpoint error (HTTP ${String(response.status)}): ${detail}` : `${label} token endpoint error (HTTP ${String(response.status)})`, response.status, oauthCode, parseRetryAfterMs(response));
+	return new OAuthEndpointError(providerDiagnostic(`${label} token endpoint error (HTTP ${String(response.status)})`, body.length > 0), response.status, oauthCode, parseRetryAfterMs(response));
 }
 /**
 * Per-provider session freshness: loads the stored session, refreshes
@@ -5170,9 +5238,9 @@ const DISCOVERY_TIMEOUT_MS = 1e4;
 */
 function withTimeout(work, timeoutMs) {
 	const signal = AbortSignal.timeout(timeoutMs);
-	const aborted = new Promise((resolve$1) => {
-		if (signal.aborted) resolve$1(void 0);
-		else signal.addEventListener("abort", () => resolve$1(void 0), { once: true });
+	const aborted = new Promise((resolve$2) => {
+		if (signal.aborted) resolve$2(void 0);
+		else signal.addEventListener("abort", () => resolve$2(void 0), { once: true });
 	});
 	return Promise.race([work(signal).then((value) => signal.aborted ? void 0 : value, (error) => {
 		if (signal.aborted) return void 0;
@@ -5531,446 +5599,144 @@ var AccountTokenManager = class {
 };
 
 //#endregion
-//#region src/providers/catalog-store.ts
+//#region src/compat.ts
+/** Brand a string as a tool-call id: alpha's `ToolCallId`, rc.2's `CallId`. */
+const ToolCallId$1 = (() => {
+	const exports = llm;
+	return exports["ToolCallId"] ?? exports["CallId"];
+})();
+
+//#endregion
+//#region src/translate/sse.ts
 /**
-* Absolute path of the catalog store file.
-* @returns `dshHomePath('plugins', 'subscriptions', 'models.json')`.
+* Decode an SSE byte stream into events.
+* @param stream - raw response bytes; reads may split anywhere, including mid-UTF-8 sequence.
+* @param onActivity - called on every received chunk and comment line; drives the idle watchdog.
+* @returns events in arrival order.
 */
-function modelsFilePath() {
-	return dshHomePath("plugins", "subscriptions", "models.json");
-}
-/** The per-account section of the file, or undefined when absent or malformed. */
-function accountSection(store, provider) {
-	const accounts = store.accounts;
-	if (typeof accounts !== "object" || accounts === null || Array.isArray(accounts)) return void 0;
-	const section = accounts[provider];
-	if (typeof section !== "object" || section === null || Array.isArray(section)) return void 0;
-	return section;
-}
-/** Validate one persisted reasoning block, or undefined when malformed. */
-function sanitizeReasoning(value) {
-	if (typeof value !== "object" || value === null) return void 0;
-	const raw = value;
-	if (!Array.isArray(raw.efforts) || raw.efforts.length === 0) return void 0;
-	const seen = /* @__PURE__ */ new Set();
-	const efforts = [];
-	for (const entry of raw.efforts) {
-		if (typeof entry !== "object" || entry === null) return void 0;
-		const effort = entry;
-		if (typeof effort.id !== "string" || effort.id.length === 0 || typeof effort.name !== "string" || effort.name.length === 0 || effort.description !== void 0 && typeof effort.description !== "string" || seen.has(effort.id)) return void 0;
-		seen.add(effort.id);
-		efforts.push({
-			id: ReasoningEffortId(effort.id),
-			name: effort.name,
-			...effort.description === void 0 ? {} : { description: effort.description }
-		});
+async function* parseSse(stream, onActivity) {
+	const reader = stream.getReader();
+	const decoder = new TextDecoder();
+	let pending = "";
+	let dataLines = [];
+	let eventName;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) return;
+			onActivity?.();
+			pending += decoder.decode(value, { stream: true });
+			let newline = pending.indexOf("\n");
+			while (newline >= 0) {
+				let line = pending.slice(0, newline);
+				pending = pending.slice(newline + 1);
+				newline = pending.indexOf("\n");
+				if (line.endsWith("\r")) line = line.slice(0, -1);
+				if (line.length === 0) {
+					if (dataLines.length > 0) yield {
+						data: dataLines.join("\n"),
+						...eventName === void 0 ? {} : { event: eventName }
+					};
+					dataLines = [];
+					eventName = void 0;
+				} else if (line.startsWith(":")) onActivity?.();
+				else if (line.startsWith("data:")) dataLines.push(line.slice(5).replace(/^ /, ""));
+				else if (line.startsWith("event:")) eventName = line.slice(6).replace(/^ /, "");
+			}
+		}
+	} finally {
+		try {
+			await reader.cancel();
+		} catch {}
+		reader.releaseLock();
 	}
-	if (raw.defaultEffort !== void 0 && (typeof raw.defaultEffort !== "string" || !seen.has(raw.defaultEffort))) return void 0;
-	return {
-		efforts,
-		...raw.defaultEffort === void 0 ? {} : { defaultEffort: ReasoningEffortId(raw.defaultEffort) }
-	};
-}
-/** Validate one persisted model, or undefined when malformed. */
-function sanitizeModel(value) {
-	if (typeof value !== "object" || value === null) return void 0;
-	const raw = value;
-	if (typeof raw.id !== "string" || raw.id.length === 0 || typeof raw.name !== "string" || raw.name.length === 0 || raw.description !== void 0 && typeof raw.description !== "string" || raw.contextWindow !== void 0 && (typeof raw.contextWindow !== "number" || !Number.isInteger(raw.contextWindow) || raw.contextWindow <= 0) || raw.maxContextWindow !== void 0 && (typeof raw.maxContextWindow !== "number" || !Number.isSafeInteger(raw.maxContextWindow) || raw.maxContextWindow <= 0) || raw.maxOutputTokens !== void 0 && (typeof raw.maxOutputTokens !== "number" || !Number.isSafeInteger(raw.maxOutputTokens) || raw.maxOutputTokens <= 0) || raw.priority !== void 0 && (typeof raw.priority !== "number" || !Number.isFinite(raw.priority))) return void 0;
-	const reasoning = raw.reasoning === void 0 ? void 0 : sanitizeReasoning(raw.reasoning);
-	if (raw.reasoning !== void 0 && reasoning === void 0) return void 0;
-	const thinkingType = raw.thinkingType;
-	if (thinkingType !== void 0 && thinkingType !== "enabled" && thinkingType !== "adaptive") return void 0;
-	const fastTier = raw.fastTier;
-	if (fastTier !== void 0 && typeof fastTier !== "boolean") return void 0;
-	const copilotWire = raw.copilotWire;
-	if (copilotWire !== void 0 && copilotWire !== "chat-completions" && copilotWire !== "responses") return;
-	const copilotResponses = raw.copilotResponses;
-	if (copilotResponses !== void 0 && typeof copilotResponses !== "boolean") return void 0;
-	const inputModalities = raw.inputModalities;
-	if (inputModalities !== void 0 && (!Array.isArray(inputModalities) || inputModalities.length === 0 || inputModalities.some((modality) => modality !== "text" && modality !== "image"))) return void 0;
-	return {
-		id: raw.id,
-		name: raw.name,
-		...raw.description === void 0 ? {} : { description: raw.description },
-		...raw.contextWindow === void 0 ? {} : { contextWindow: raw.contextWindow },
-		...raw.maxContextWindow === void 0 ? {} : { maxContextWindow: raw.maxContextWindow },
-		...raw.maxOutputTokens === void 0 ? {} : { maxOutputTokens: raw.maxOutputTokens },
-		...raw.priority === void 0 ? {} : { priority: raw.priority },
-		...reasoning === void 0 ? {} : { reasoning },
-		...thinkingType === void 0 ? {} : { thinkingType },
-		...fastTier === void 0 ? {} : { fastTier },
-		...copilotWire === void 0 ? {} : { copilotWire },
-		...copilotResponses === void 0 ? {} : { copilotResponses },
-		...inputModalities === void 0 ? {} : { inputModalities: [...inputModalities] }
-	};
 }
+
+//#endregion
+//#region src/translate/anthropic.ts
 /**
-* Validate one persisted snapshot. Strict: any malformed field drops the
-* whole snapshot rather than repairing it — the next successful discovery
-* rewrites the entry anyway.
-* @param value - the raw per-provider file entry.
-* @returns the validated snapshot, or undefined when unusable.
+* The Claude Code identity block. The subscription endpoint rejects requests
+* that do not present as Claude Code, so this block is REQUIRED as the first
+* system entry on every request.
 */
-function sanitizeSnapshot(value) {
-	if (typeof value !== "object" || value === null) return void 0;
-	const raw = value;
-	if (typeof raw.at !== "number" || !Number.isFinite(raw.at)) return void 0;
-	if (!Array.isArray(raw.models) || raw.models.length === 0) return void 0;
-	const seen = /* @__PURE__ */ new Set();
-	const models = [];
-	for (const entry of raw.models) {
-		const model = sanitizeModel(entry);
-		if (model === void 0 || seen.has(model.id)) return void 0;
-		seen.add(model.id);
-		models.push(model);
+const CLAUDE_CODE_IDENTITY = "You are Claude Code, Anthropic's official CLI for Claude.";
+/** Tags wrapping a mid-conversation system message where it sits in the history. */
+const SYSTEM_REMINDER_OPEN = "<system-reminder>";
+const SYSTEM_REMINDER_CLOSE = "</system-reminder>";
+/**
+* How far apart consecutive message breakpoints sit, in content blocks.
+*
+* A breakpoint looks back at most 20 blocks for an entry an earlier request
+* wrote, so marks must stay closer than that: one agentic turn can append a
+* dozen tool_use/tool_result blocks at once, and a single trailing mark would
+* silently fall out of range and rebuild the whole prefix.
+*/
+const CACHE_BLOCK_STRIDE = 15;
+/**
+* Message breakpoints per request. Anthropic allows four in total and the
+* last `system` block takes the fourth, so three are left for the history —
+* enough to tolerate a turn appending roughly {@link CACHE_BLOCK_STRIDE} × 3
+* blocks before a read is lost.
+*/
+const MESSAGE_CACHE_BREAKPOINTS = 3;
+/** The API default; a marker at this TTL carries no `ttl` field at all. */
+const DEFAULT_PROMPT_CACHE_TTL = "5m";
+/**
+* Build one `cache_control` marker.
+*
+* Five minutes is spelled by omitting `ttl`, so a request that does not opt in
+* stays byte-identical to what earlier releases sent.
+* @param ttl - cache lifetime; defaults to five minutes.
+* @returns a fresh marker object (callers attach it to one block each).
+*/
+function cacheControl(ttl = DEFAULT_PROMPT_CACHE_TTL) {
+	return ttl === "1h" ? {
+		type: "ephemeral",
+		ttl: "1h"
+	} : { type: "ephemeral" };
+}
+/** Preserve native image blocks, retaining the existing text-only wire shape. */
+function toolResultContent(block) {
+	if (!block.content.some((part) => part.type === "image" && "dataBase64" in part)) return block.content.map((part) => part.type === "text" ? part.text : "").join("");
+	const content = [];
+	for (const part of block.content) {
+		if (part.type === "text" && part.text.length > 0) content.push({
+			type: "text",
+			text: part.text
+		});
+		if (part.type === "image" && "dataBase64" in part) content.push({
+			type: "image",
+			source: {
+				type: "base64",
+				media_type: part.mediaType,
+				data: part.dataBase64
+			}
+		});
 	}
-	return {
-		at: raw.at,
-		models
-	};
+	return content;
 }
-/** Read the whole file; missing or unparsable reads as an empty cache. */
-async function readCatalogFile(path) {
-	let text;
+/** Parse a tool call's raw JSON arguments into Anthropic's object-shaped `input`. */
+function parseToolInput(raw) {
 	try {
-		text = await readFile(path, "utf8");
-	} catch {
+		const parsed = JSON.parse(raw);
+		if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) return parsed;
 		return {};
-	}
-	try {
-		const parsed = JSON.parse(text);
-		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return {};
-		return parsed;
 	} catch {
 		return {};
 	}
 }
-/** Persist the whole file atomically (tmp file + rename). */
-async function writeCatalogFile(store, path) {
-	await mkdir(dirname(path), { recursive: true });
-	const tmp = `${path}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
-	try {
-		await writeFile(tmp, JSON.stringify(store, null, 2));
-		await rename(tmp, path);
-	} catch (error) {
-		await rm(tmp, { force: true });
-		throw error;
-	}
-}
 /**
-* Build the durable half of one provider's catalog cache over the shared
-* models.json file (concurrent writers are last-writer-wins, acceptable for
-* a cache).
-* @param provider - the provider route keying the file entry.
-* @param path - store file path; defaults to {@link modelsFilePath}.
-* @returns the persistence hooks for {@link ModelCatalogCache}.
-*/
-function catalogStore(provider, path = modelsFilePath()) {
-	return {
-		async load() {
-			return sanitizeSnapshot((await readCatalogFile(path))[provider]);
-		},
-		async save(snapshot) {
-			const store = await readCatalogFile(path);
-			store[provider] = snapshot;
-			await writeCatalogFile(store, path);
-		},
-		async clear() {
-			const store = await readCatalogFile(path);
-			if (store[provider] === void 0) return;
-			delete store[provider];
-			await writeCatalogFile(store, path);
-		}
-	};
-}
-/**
-* The durable half of one NON-default account's catalog cache. The provider
-* entry belongs to the default account; every other account keeps its own
-* snapshot under `accounts[provider][account]`, so a working secondary login
-* survives restarts and network failures even when the default login is dead.
-* @param provider - the provider route.
-* @param account - the canonical account key.
-* @param path - store file path; defaults to {@link modelsFilePath}.
-* @returns the persistence hooks for {@link ModelCatalogCache}.
-*/
-function accountCatalogStore(provider, account, path = modelsFilePath()) {
-	return {
-		async load() {
-			const section = accountSection(await readCatalogFile(path), provider);
-			return section !== void 0 && Object.hasOwn(section, account) ? sanitizeSnapshot(section[account]) : void 0;
-		},
-		async save(snapshot) {
-			const store = await readCatalogFile(path);
-			const accounts = typeof store.accounts === "object" && store.accounts !== null && !Array.isArray(store.accounts) ? store.accounts : {};
-			const section = {
-				...accountSection(store, provider) ?? {},
-				[account]: snapshot
-			};
-			store.accounts = {
-				...accounts,
-				[provider]: section
-			};
-			await writeCatalogFile(store, path);
-		},
-		async clear() {
-			const store = await readCatalogFile(path);
-			const section = accountSection(store, provider);
-			if (section === void 0 || !Object.hasOwn(section, account)) return;
-			const rest = { ...section };
-			delete rest[account];
-			store.accounts = {
-				...store.accounts,
-				[provider]: rest
-			};
-			await writeCatalogFile(store, path);
-		}
-	};
-}
-
-//#endregion
-//#region src/translate/resolved.ts
-/**
-* Wires with text-only tool outputs receive images in a following user turn.
-* Defer that turn until all consecutive user messages have been processed:
-* parallel tool results can arrive in separate harness messages, and a user
-* image message must not interrupt their tool-call/output pairing.
-*/
-function withToolResultImages(messages) {
-	const out = [];
-	let images = [];
-	const flush = () => {
-		if (images.length > 0) out.push({
-			role: "user",
-			content: images
-		});
-		images = [];
-	};
-	for (const message of messages) {
-		if (message.role === "assistant") flush();
-		out.push(message);
-		if (message.role === "tool") {
-			const parts = message.content.filter((part) => part.type === "image" && "dataBase64" in part);
-			if (parts.length > 0) images.push({
-				type: "text",
-				text: `Images from tool result ${String(message.toolCallId)}:`
-			}, ...parts);
-		}
-		for (const block of message.content) {
-			if (block.type !== "tool-result") continue;
-			const parts = block.content.filter((part) => part.type === "image" && "dataBase64" in part);
-			if (parts.length > 0) images.push({
-				type: "text",
-				text: `Images from tool result ${String(block.toolCallId)}:`
-			}, ...parts);
-		}
-	}
-	flush();
-	return out;
-}
-/**
-* The request projection for one oversized image, or undefined when it fits.
-* Hosts before DSH 0.1.7 read a pixel budget (`maxPixels`), later ones the
-* target edges (`width`/`height`); each validates only its own fields, so
-* one projection carries both.
-*/
-function imageRequestTarget(ref, limit) {
-	const longEdge = Math.max(ref.width, ref.height);
-	if (!(longEdge > limit.maxEdge)) return void 0;
-	const short = (edge) => Math.max(1, Math.floor(edge * limit.maxEdge / longEdge));
-	const width = ref.width >= ref.height ? limit.maxEdge : short(ref.width);
-	const height = ref.width >= ref.height ? short(ref.height) : limit.maxEdge;
-	return {
-		width,
-		height,
-		maxPixels: width * height,
-		maxBytes: limit.maxBytes
-	};
-}
-/**
-* Resolve every ImageBlock's attachment reference to inline base64 bytes.
-* Messages without images pass through unchanged. A request carrying an image
-* with no attachment service available fails loudly rather than silently
-* dropping the image.
-* @param messages - the request's conversation messages.
-* @param attachments - the deployment's attachment service, when mounted.
-* @param signal - cancellation for the storage reads.
-* @param limit - the route's outgoing image cap; oversized images are sent
-*   downscaled while the stored attachment and history stay untouched.
-* @returns the same messages with image blocks resolved for the translators.
-*/
-async function resolveImages(messages, attachments, signal, limit) {
-	if (messages.some((message) => message.content.some((block) => block.type === "image")) && attachments === void 0) throw new LlmError("dsh-subscriptions: the request carries an image but no attachments service is mounted; image input requires the harness attachment store", "UNSUPPORTED");
-	const readForRequest = async (ref) => {
-		if (attachments === void 0) throw new Error("attachments service is unavailable");
-		const target = limit === void 0 ? void 0 : imageRequestTarget(ref, limit);
-		if (target !== void 0) try {
-			const version = await attachments.readImageRequest(ref, target, signal);
-			return {
-				data: version.data,
-				mediaType: version.mediaType,
-				ref: version.attachment
-			};
-		} catch (error) {
-			if (signal?.aborted) throw error;
-		}
-		const stored = await attachments.readImage(ref, signal);
-		return {
-			data: stored.data,
-			mediaType: stored.ref.mediaType,
-			ref: stored.ref
-		};
-	};
-	const resolveBlock = async (block) => {
-		if (block.type !== "image") return [block];
-		const { data, mediaType: sentType, ref } = await readForRequest(block.attachment);
-		const { attachmentId, mediaType, bytes, width, height, name: name$1 } = ref;
-		return [{
-			type: "image",
-			mediaType: sentType,
-			dataBase64: Buffer.from(data).toString("base64")
-		}, {
-			type: "text",
-			text: `Image reference (for image_generate.referenceImages): ${JSON.stringify({
-				attachmentId,
-				mediaType,
-				bytes,
-				width,
-				height,
-				...name$1 === void 0 ? {} : { name: name$1 }
-			})}`
-		}];
-	};
-	return Promise.all(messages.map(async (message) => ({
-		role: message.role,
-		...message.source === void 0 ? {} : { source: message.source },
-		...message.role === "tool" ? {
-			toolCallId: message.toolCallId,
-			isError: message.isError
-		} : {},
-		content: (await Promise.all(message.content.map(resolveBlock))).flat()
-	})));
-}
-
-//#endregion
-//#region src/compat.ts
-/** Brand a string as a tool-call id: alpha's `ToolCallId`, rc.2's `CallId`. */
-const ToolCallId$1 = (() => {
-	const exports = llm;
-	return exports["ToolCallId"] ?? exports["CallId"];
-})();
-
-//#endregion
-//#region src/translate/sse.ts
-/**
-* Decode an SSE byte stream into events.
-* @param stream - raw response bytes; reads may split anywhere, including mid-UTF-8 sequence.
-* @param onActivity - called on every received chunk and comment line; drives the idle watchdog.
-* @returns events in arrival order.
-*/
-async function* parseSse(stream, onActivity) {
-	const reader = stream.getReader();
-	const decoder = new TextDecoder();
-	let pending = "";
-	let dataLines = [];
-	let eventName;
-	try {
-		while (true) {
-			const { done, value } = await reader.read();
-			if (done) return;
-			onActivity?.();
-			pending += decoder.decode(value, { stream: true });
-			let newline = pending.indexOf("\n");
-			while (newline >= 0) {
-				let line = pending.slice(0, newline);
-				pending = pending.slice(newline + 1);
-				newline = pending.indexOf("\n");
-				if (line.endsWith("\r")) line = line.slice(0, -1);
-				if (line.length === 0) {
-					if (dataLines.length > 0) yield {
-						data: dataLines.join("\n"),
-						...eventName === void 0 ? {} : { event: eventName }
-					};
-					dataLines = [];
-					eventName = void 0;
-				} else if (line.startsWith(":")) onActivity?.();
-				else if (line.startsWith("data:")) dataLines.push(line.slice(5).replace(/^ /, ""));
-				else if (line.startsWith("event:")) eventName = line.slice(6).replace(/^ /, "");
-			}
-		}
-	} finally {
-		reader.releaseLock();
-	}
-}
-
-//#endregion
-//#region src/translate/anthropic.ts
-/**
-* The Claude Code identity block. The subscription endpoint rejects requests
-* that do not present as Claude Code, so this block is REQUIRED as the first
-* system entry on every request.
-*/
-const CLAUDE_CODE_IDENTITY = "You are Claude Code, Anthropic's official CLI for Claude.";
-/** Tags wrapping a mid-conversation system message where it sits in the history. */
-const SYSTEM_REMINDER_OPEN = "<system-reminder>";
-const SYSTEM_REMINDER_CLOSE = "</system-reminder>";
-/**
-* How far apart consecutive message breakpoints sit, in content blocks.
-*
-* A breakpoint looks back at most 20 blocks for an entry an earlier request
-* wrote, so marks must stay closer than that: one agentic turn can append a
-* dozen tool_use/tool_result blocks at once, and a single trailing mark would
-* silently fall out of range and rebuild the whole prefix.
-*/
-const CACHE_BLOCK_STRIDE = 15;
-/**
-* Message breakpoints per request. Anthropic allows four in total and the
-* last `system` block takes the fourth, so three are left for the history —
-* enough to tolerate a turn appending roughly {@link CACHE_BLOCK_STRIDE} × 3
-* blocks before a read is lost.
-*/
-const MESSAGE_CACHE_BREAKPOINTS = 3;
-/** Preserve native image blocks, retaining the existing text-only wire shape. */
-function toolResultContent(block) {
-	if (!block.content.some((part) => part.type === "image" && "dataBase64" in part)) return block.content.map((part) => part.type === "text" ? part.text : "").join("");
-	const content = [];
-	for (const part of block.content) {
-		if (part.type === "text" && part.text.length > 0) content.push({
-			type: "text",
-			text: part.text
-		});
-		if (part.type === "image" && "dataBase64" in part) content.push({
-			type: "image",
-			source: {
-				type: "base64",
-				media_type: part.mediaType,
-				data: part.dataBase64
-			}
-		});
-	}
-	return content;
-}
-/** Parse a tool call's raw JSON arguments into Anthropic's object-shaped `input`. */
-function parseToolInput(raw) {
-	try {
-		const parsed = JSON.parse(raw);
-		if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) return parsed;
-		return {};
-	} catch {
-		return {};
-	}
-}
-/**
-* Move a user message's `tool_result` blocks into one contiguous run at the
-* front, preserving the relative order of both groups.
-*
-* Anthropic answers every `tool_use` against the blocks that *lead* the next
-* message, so a block of any other kind before or between the results reads
-* as a call left unanswered and the request is rejected. The harness merges
-* everything queued for one user turn into a single message, and a parallel
-* tool batch arrives as one result message per call, so any context spliced
-* mid-batch lands between two results. Restoring the run here keeps that
-* independent of delivery order. Order *among* the results does not matter.
-* @param message - one assembled user message, reordered in place.
+* Move a user message's `tool_result` blocks into one contiguous run at the
+* front, preserving the relative order of both groups.
+*
+* Anthropic answers every `tool_use` against the blocks that *lead* the next
+* message, so a block of any other kind before or between the results reads
+* as a call left unanswered and the request is rejected. The harness merges
+* everything queued for one user turn into a single message, and a parallel
+* tool batch arrives as one result message per call, so any context spliced
+* mid-batch lands between two results. Restoring the run here keeps that
+* independent of delivery order. Order *among* the results does not matter.
+* @param message - one assembled user message, reordered in place.
 */
 function leadWithToolResults(message) {
 	const firstOther = message.content.findIndex((block) => block.type !== "tool_result");
@@ -6095,13 +5861,14 @@ function toAnthropicMessages(messages) {
 * Marks are counted across the flattened block sequence, not per message,
 * because the lookback window Anthropic walks counts blocks the same way.
 * @param messages - assembled Anthropic messages, marked in place.
+* @param ttl - cache lifetime for every mark; defaults to five minutes.
 */
-function markMessageCache(messages) {
+function markMessageCache(messages, ttl) {
 	const blocks = messages.flatMap((message) => message.content);
 	for (let mark = 0; mark < MESSAGE_CACHE_BREAKPOINTS; mark++) {
 		const at = blocks.length - 1 - mark * CACHE_BLOCK_STRIDE;
 		if (at < 0) return;
-		blocks[at].cache_control = { type: "ephemeral" };
+		blocks[at].cache_control = cacheControl(ttl);
 	}
 }
 /**
@@ -6110,9 +5877,10 @@ function markMessageCache(messages) {
 * @param system - explicit system prompt, when set.
 * @param messages - conversation messages; the system-role text preceding the
 * conversation is appended, and a later one is left to {@link toAnthropicMessages}.
+* @param ttl - cache lifetime for the tools+system mark; defaults to five minutes.
 * @returns the system content blocks.
 */
-function toAnthropicSystem(system, messages) {
+function toAnthropicSystem(system, messages, ttl) {
 	const blocks = [{
 		type: "text",
 		text: CLAUDE_CODE_IDENTITY
@@ -6126,7 +5894,7 @@ function toAnthropicSystem(system, messages) {
 		type: "text",
 		text: block.text
 	});
-	blocks[blocks.length - 1].cache_control = { type: "ephemeral" };
+	blocks[blocks.length - 1].cache_control = cacheControl(ttl);
 	return blocks;
 }
 /**
@@ -6174,10 +5942,11 @@ function closeBlock$2(block) {
 function anthropicFailure(error) {
 	const type = error?.type ?? "unknown_error";
 	const message = error?.message ?? `Anthropic reported ${type}`;
-	if (type === "invalid_request_error" && /prompt is too long/i.test(message)) return new LlmError(message, CONTEXT_WINDOW_EXCEEDED_CODE);
-	if (type === "rate_limit_error") return new LlmError(message, "RATE_LIMIT");
-	if (type === "authentication_error") return new LlmError(message, "AUTH");
-	return new LlmError(message, "SERVER");
+	let classification = "SERVER";
+	if (type === "invalid_request_error" && /prompt is too long/i.test(message)) classification = CONTEXT_WINDOW_EXCEEDED_CODE;
+	else if (type === "rate_limit_error") classification = "RATE_LIMIT";
+	else if (type === "authentication_error") classification = "AUTH";
+	return new LlmError(`Anthropic failure (${classification}): [provider response body omitted]`, classification);
 }
 /**
 * Push-model Anthropic SSE translator: feed each parsed event object to
@@ -6366,27 +6135,426 @@ var AnthropicStreamTranslator = class {
 			case "error": throw anthropicFailure(event.error);
 			default: return chunks;
 		}
-	}
-};
+	}
+};
+/**
+* Consume an Anthropic SSE byte stream and yield harness StreamChunks.
+* @param stream - raw response body.
+* @param onActivity - transport-activity callback for the idle watchdog.
+* @returns the chunk stream; throws when the stream ends before `message_stop`.
+*/
+async function* streamAnthropic(stream, onActivity) {
+	const translator = new AnthropicStreamTranslator();
+	for await (const sseEvent of parseSse(stream, onActivity)) {
+		let event;
+		try {
+			event = JSON.parse(sseEvent.data);
+		} catch {
+			throw new LlmError("malformed SSE payload (MALFORMED_RESPONSE): [provider response body omitted]", "MALFORMED_RESPONSE");
+		}
+		yield* translator.push(event);
+		if (translator.terminated) return;
+	}
+	throw new LlmError("Anthropic SSE stream ended before message_stop", "STREAM_CLOSED");
+}
+
+//#endregion
+//#region src/providers/catalog-store.ts
+/**
+* Absolute path of the catalog store file.
+* @returns `dshHomePath('plugins', 'subscriptions', 'models.json')`.
+*/
+function modelsFilePath() {
+	return dshHomePath("plugins", "subscriptions", "models.json");
+}
+/** The per-account section of the file, or undefined when absent or malformed. */
+function accountSection(store, provider) {
+	const accounts = store.accounts;
+	if (typeof accounts !== "object" || accounts === null || Array.isArray(accounts)) return void 0;
+	const section = accounts[provider];
+	if (typeof section !== "object" || section === null || Array.isArray(section)) return void 0;
+	return section;
+}
+/** Validate one persisted reasoning block, or undefined when malformed. */
+function sanitizeReasoning(value) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const raw = value;
+	if (!Array.isArray(raw.efforts) || raw.efforts.length === 0) return void 0;
+	const seen = /* @__PURE__ */ new Set();
+	const efforts = [];
+	for (const entry of raw.efforts) {
+		if (typeof entry !== "object" || entry === null) return void 0;
+		const effort = entry;
+		if (typeof effort.id !== "string" || effort.id.length === 0 || typeof effort.name !== "string" || effort.name.length === 0 || effort.description !== void 0 && typeof effort.description !== "string" || seen.has(effort.id)) return void 0;
+		seen.add(effort.id);
+		efforts.push({
+			id: ReasoningEffortId(effort.id),
+			name: effort.name,
+			...effort.description === void 0 ? {} : { description: effort.description }
+		});
+	}
+	if (raw.defaultEffort !== void 0 && (typeof raw.defaultEffort !== "string" || !seen.has(raw.defaultEffort))) return void 0;
+	return {
+		efforts,
+		...raw.defaultEffort === void 0 ? {} : { defaultEffort: ReasoningEffortId(raw.defaultEffort) }
+	};
+}
+/** Validate one persisted model, or undefined when malformed. */
+function sanitizeModel(value) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const raw = value;
+	if (typeof raw.id !== "string" || raw.id.length === 0 || typeof raw.name !== "string" || raw.name.length === 0 || raw.description !== void 0 && typeof raw.description !== "string" || raw.contextWindow !== void 0 && (typeof raw.contextWindow !== "number" || !Number.isInteger(raw.contextWindow) || raw.contextWindow <= 0) || raw.maxContextWindow !== void 0 && (typeof raw.maxContextWindow !== "number" || !Number.isSafeInteger(raw.maxContextWindow) || raw.maxContextWindow <= 0) || raw.maxOutputTokens !== void 0 && (typeof raw.maxOutputTokens !== "number" || !Number.isSafeInteger(raw.maxOutputTokens) || raw.maxOutputTokens <= 0) || raw.priority !== void 0 && (typeof raw.priority !== "number" || !Number.isFinite(raw.priority))) return void 0;
+	const reasoning = raw.reasoning === void 0 ? void 0 : sanitizeReasoning(raw.reasoning);
+	if (raw.reasoning !== void 0 && reasoning === void 0) return void 0;
+	const thinkingType = raw.thinkingType;
+	if (thinkingType !== void 0 && thinkingType !== "enabled" && thinkingType !== "adaptive") return void 0;
+	const fastTier = raw.fastTier;
+	if (fastTier !== void 0 && typeof fastTier !== "boolean") return void 0;
+	const copilotWire = raw.copilotWire;
+	if (copilotWire !== void 0 && copilotWire !== "chat-completions" && copilotWire !== "responses") return;
+	const copilotResponses = raw.copilotResponses;
+	if (copilotResponses !== void 0 && typeof copilotResponses !== "boolean") return void 0;
+	const inputModalities = raw.inputModalities;
+	if (inputModalities !== void 0 && (!Array.isArray(inputModalities) || inputModalities.length === 0 || inputModalities.some((modality) => modality !== "text" && modality !== "image"))) return void 0;
+	return {
+		id: raw.id,
+		name: raw.name,
+		...raw.description === void 0 ? {} : { description: raw.description },
+		...raw.contextWindow === void 0 ? {} : { contextWindow: raw.contextWindow },
+		...raw.maxContextWindow === void 0 ? {} : { maxContextWindow: raw.maxContextWindow },
+		...raw.maxOutputTokens === void 0 ? {} : { maxOutputTokens: raw.maxOutputTokens },
+		...raw.priority === void 0 ? {} : { priority: raw.priority },
+		...reasoning === void 0 ? {} : { reasoning },
+		...thinkingType === void 0 ? {} : { thinkingType },
+		...fastTier === void 0 ? {} : { fastTier },
+		...copilotWire === void 0 ? {} : { copilotWire },
+		...copilotResponses === void 0 ? {} : { copilotResponses },
+		...inputModalities === void 0 ? {} : { inputModalities: [...inputModalities] }
+	};
+}
+/**
+* Validate one persisted snapshot. Strict: any malformed field drops the
+* whole snapshot rather than repairing it — the next successful discovery
+* rewrites the entry anyway.
+* @param value - the raw per-provider file entry.
+* @returns the validated snapshot, or undefined when unusable.
+*/
+function sanitizeSnapshot(value) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const raw = value;
+	if (typeof raw.at !== "number" || !Number.isFinite(raw.at)) return void 0;
+	if (!Array.isArray(raw.models) || raw.models.length === 0) return void 0;
+	const seen = /* @__PURE__ */ new Set();
+	const models = [];
+	for (const entry of raw.models) {
+		const model = sanitizeModel(entry);
+		if (model === void 0 || seen.has(model.id)) return void 0;
+		seen.add(model.id);
+		models.push(model);
+	}
+	return {
+		at: raw.at,
+		models
+	};
+}
+/** Read the whole file; missing or unparsable reads as an empty cache. */
+async function readCatalogFile(path) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch {
+		return {};
+	}
+	try {
+		const parsed = JSON.parse(text);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return {};
+		return parsed;
+	} catch {
+		return {};
+	}
+}
+/** Persist the whole file atomically (tmp file + rename). */
+async function writeCatalogFile(store, path) {
+	await mkdir(dirname(path), { recursive: true });
+	const tmp = `${path}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
+	try {
+		await writeFile(tmp, JSON.stringify(store, null, 2));
+		await rename(tmp, path);
+	} catch (error) {
+		await rm(tmp, { force: true });
+		throw error;
+	}
+}
+/**
+* Like the auth store, mutations of one resolved path share an in-process
+* write chain in call order. Each reads after the preceding mutation settles;
+* a failure rejects its caller without blocking later mutations. Idle chains
+* are removed. Separate processes (or filesystem aliases of a path) are not
+* locked and remain last-writer-wins.
+*/
+const writeChains = /* @__PURE__ */ new Map();
+async function serialize(path, action) {
+	const key = resolve(path);
+	const next = (writeChains.get(key) ?? Promise.resolve()).then(action, action);
+	const tail = next.then(() => void 0, () => void 0);
+	writeChains.set(key, tail);
+	try {
+		return await next;
+	} finally {
+		if (writeChains.get(key) === tail) writeChains.delete(key);
+	}
+}
+/**
+* Build the durable half of one provider's catalog cache over the shared
+* models.json file. Saves and clears serialize with all accounts at this path
+* in this process; readers see a complete file before or after an atomic rename.
+* @param provider - the provider route keying the file entry.
+* @param path - store file path; defaults to {@link modelsFilePath}.
+* @returns the persistence hooks for {@link ModelCatalogCache}.
+*/
+function catalogStore(provider, path = modelsFilePath()) {
+	return {
+		async load() {
+			return sanitizeSnapshot((await readCatalogFile(path))[provider]);
+		},
+		async save(snapshot) {
+			return serialize(path, async () => {
+				const store = await readCatalogFile(path);
+				store[provider] = snapshot;
+				await writeCatalogFile(store, path);
+			});
+		},
+		async clear() {
+			return serialize(path, async () => {
+				const store = await readCatalogFile(path);
+				if (store[provider] === void 0) return;
+				delete store[provider];
+				await writeCatalogFile(store, path);
+			});
+		}
+	};
+}
+/**
+* The durable half of one NON-default account's catalog cache. The provider
+* entry belongs to the default account; every other account keeps its own
+* snapshot under `accounts[provider][account]`, so a working secondary login
+* survives restarts and network failures even when the default login is dead.
+* Saves and clears share {@link catalogStore}'s in-process write chain.
+* @param provider - the provider route.
+* @param account - the canonical account key.
+* @param path - store file path; defaults to {@link modelsFilePath}.
+* @returns the persistence hooks for {@link ModelCatalogCache}.
+*/
+function accountCatalogStore(provider, account, path = modelsFilePath()) {
+	return {
+		async load() {
+			const section = accountSection(await readCatalogFile(path), provider);
+			return section !== void 0 && Object.hasOwn(section, account) ? sanitizeSnapshot(section[account]) : void 0;
+		},
+		async save(snapshot) {
+			return serialize(path, async () => {
+				const store = await readCatalogFile(path);
+				const accounts = typeof store.accounts === "object" && store.accounts !== null && !Array.isArray(store.accounts) ? store.accounts : {};
+				const section = {
+					...accountSection(store, provider) ?? {},
+					[account]: snapshot
+				};
+				store.accounts = {
+					...accounts,
+					[provider]: section
+				};
+				await writeCatalogFile(store, path);
+			});
+		},
+		async clear() {
+			return serialize(path, async () => {
+				const store = await readCatalogFile(path);
+				const section = accountSection(store, provider);
+				if (section === void 0 || !Object.hasOwn(section, account)) return;
+				const rest = { ...section };
+				delete rest[account];
+				store.accounts = {
+					...store.accounts,
+					[provider]: rest
+				};
+				await writeCatalogFile(store, path);
+			});
+		}
+	};
+}
+
+//#endregion
+//#region src/translate/resolved.ts
 /**
-* Consume an Anthropic SSE byte stream and yield harness StreamChunks.
-* @param stream - raw response body.
-* @param onActivity - transport-activity callback for the idle watchdog.
-* @returns the chunk stream; throws when the stream ends before `message_stop`.
+* Wires with text-only tool outputs receive images in a following user turn.
+* Defer that turn until all consecutive user messages have been processed:
+* parallel tool results can arrive in separate harness messages, and a user
+* image message must not interrupt their tool-call/output pairing.
 */
-async function* streamAnthropic(stream, onActivity) {
-	const translator = new AnthropicStreamTranslator();
-	for await (const sseEvent of parseSse(stream, onActivity)) {
-		let event;
-		try {
-			event = JSON.parse(sseEvent.data);
-		} catch {
-			throw new LlmError(`malformed SSE payload: ${sseEvent.data.slice(0, 120)}`, "MALFORMED_RESPONSE");
+function withToolResultImages(messages) {
+	const out = [];
+	let images = [];
+	const flush = () => {
+		if (images.length > 0) out.push({
+			role: "user",
+			content: images
+		});
+		images = [];
+	};
+	for (const message of messages) {
+		if (message.role === "assistant") flush();
+		out.push(message);
+		if (message.role === "tool") {
+			const parts = message.content.filter((part) => part.type === "image" && "dataBase64" in part);
+			if (parts.length > 0) images.push({
+				type: "text",
+				text: `Images from tool result ${String(message.toolCallId)}:`
+			}, ...parts);
+		}
+		for (const block of message.content) {
+			if (block.type !== "tool-result") continue;
+			const parts = block.content.filter((part) => part.type === "image" && "dataBase64" in part);
+			if (parts.length > 0) images.push({
+				type: "text",
+				text: `Images from tool result ${String(block.toolCallId)}:`
+			}, ...parts);
 		}
-		yield* translator.push(event);
-		if (translator.terminated) return;
 	}
-	throw new LlmError("Anthropic SSE stream ended before message_stop", "STREAM_CLOSED");
+	flush();
+	return out;
+}
+/**
+* Failure code a host's image-offload executor answers by replacing the oldest
+* retained images with text and retrying (`IMAGE_OFFLOAD_REQUIRED_CODE` in
+* dsh-llm 0.2+). Spelled out so the build links against older hosts too.
+*/
+const IMAGE_OFFLOAD_REQUIRED = "IMAGE_OFFLOAD_REQUIRED";
+/**
+* Whether the installed host records image offloads. Hosts that predate the
+* executor never mark images `offloaded`, so asking them to would fail every
+* later request instead of shrinking it.
+*/
+function hostSupportsImageOffload() {
+	const exports = llm;
+	return exports["IMAGE_OFFLOAD_REQUIRED_CODE"] === IMAGE_OFFLOAD_REQUIRED && typeof exports["offloadedImageText"] === "function";
+}
+/**
+* How many of the oldest images still sent inline must be offloaded before
+* the resolved request fits `maxBase64Bytes` of image data; zero when it fits.
+* Images are counted depth-first in request order, skipping assistant
+* messages, the same order the host's executor selects occurrences in.
+* @param messages - the resolved request, after {@link resolveImages}.
+* @param maxBase64Bytes - the route's budget for all inline image data.
+*/
+function requiredImageOffloadCount(messages, maxBase64Bytes) {
+	const lengths = [];
+	const visit = (blocks) => {
+		for (const block of blocks) if (block.type === "image" && "dataBase64" in block) lengths.push(block.dataBase64.length);
+		else if (block.type === "tool-result") visit(block.content);
+	};
+	for (const message of messages) if (message.role !== "assistant") visit(message.content);
+	let excess = lengths.reduce((sum, bytes) => sum + bytes, 0) - maxBase64Bytes;
+	let count = 0;
+	while (excess > 0 && count < lengths.length) {
+		excess -= lengths[count];
+		count += 1;
+	}
+	return count;
+}
+/**
+* The request projection for one oversized image, or undefined when it fits.
+* Hosts before DSH 0.1.7 read a pixel budget (`maxPixels`), later ones the
+* target edges (`width`/`height`); each validates only its own fields, so
+* one projection carries both.
+*/
+function imageRequestTarget(ref, limit) {
+	const longEdge = Math.max(ref.width, ref.height);
+	if (!(longEdge > limit.maxEdge)) return void 0;
+	const short = (edge) => Math.max(1, Math.floor(edge * limit.maxEdge / longEdge));
+	const width = ref.width >= ref.height ? limit.maxEdge : short(ref.width);
+	const height = ref.width >= ref.height ? short(ref.height) : limit.maxEdge;
+	return {
+		width,
+		height,
+		maxPixels: width * height,
+		maxBytes: limit.maxBytes
+	};
+}
+/**
+* Resolve every ImageBlock's attachment reference to inline base64 bytes.
+* Messages without images pass through unchanged. A request carrying an image
+* with no attachment service available fails loudly rather than silently
+* dropping the image.
+* @param messages - the request's conversation messages.
+* @param attachments - the deployment's attachment service, when mounted.
+* @param signal - cancellation for the storage reads.
+* @param limit - the route's outgoing image cap; oversized images are sent
+*   downscaled while the stored attachment and history stay untouched.
+* @returns the same messages with image blocks resolved for the translators.
+*/
+async function resolveImages(messages, attachments, signal, limit) {
+	const hasRetainedImage = (block) => block.type === "image" ? !("offloaded" in block && block.offloaded === true) : block.type === "tool-result" && block.content.some(hasRetainedImage);
+	if (attachments === void 0 && messages.some((message) => message.content.some(hasRetainedImage))) throw new LlmError("dsh-subscriptions: the request carries an image but no attachments service is mounted; image input requires the harness attachment store", "UNSUPPORTED");
+	const readForRequest = async (ref) => {
+		if (attachments === void 0) throw new Error("attachments service is unavailable");
+		const target = limit === void 0 ? void 0 : imageRequestTarget(ref, limit);
+		if (target !== void 0) try {
+			const version = await attachments.readImageRequest(ref, target, signal);
+			return {
+				data: version.data,
+				mediaType: version.mediaType,
+				ref: version.attachment
+			};
+		} catch (error) {
+			if (signal?.aborted) throw error;
+		}
+		const stored = await attachments.readImage(ref, signal);
+		return {
+			data: stored.data,
+			mediaType: stored.ref.mediaType,
+			ref: stored.ref
+		};
+	};
+	const resolveBlock = async (block) => {
+		if (block.type === "tool-result") return [{
+			...block,
+			content: (await Promise.all(block.content.map(resolveBlock))).flat()
+		}];
+		if (block.type !== "image" || "dataBase64" in block) return [block];
+		if ("offloaded" in block && block.offloaded === true) {
+			const format = llm.offloadedImageText;
+			return [{
+				type: "text",
+				text: format?.(block.attachment) ?? `[image omitted to fit request image limits; ${block.attachment.attachmentId}]`
+			}];
+		}
+		const { data, mediaType: sentType, ref } = await readForRequest(block.attachment);
+		const { attachmentId, mediaType, bytes, width, height, name: name$1 } = ref;
+		return [{
+			type: "image",
+			mediaType: sentType,
+			dataBase64: Buffer.from(data).toString("base64")
+		}, {
+			type: "text",
+			text: `Image reference (for image_generate.referenceImages): ${JSON.stringify({
+				attachmentId,
+				mediaType,
+				bytes,
+				width,
+				height,
+				...name$1 === void 0 ? {} : { name: name$1 }
+			})}`
+		}];
+	};
+	return Promise.all(messages.map(async (message) => ({
+		role: message.role,
+		...message.source === void 0 ? {} : { source: message.source },
+		...message.role === "tool" ? {
+			toolCallId: message.toolCallId,
+			isError: message.isError
+		} : {},
+		content: (await Promise.all(message.content.map(resolveBlock))).flat()
+	})));
 }
 
 //#endregion
@@ -6517,8 +6685,8 @@ const CLAUDE_RESET_FIELDS = [
 * headers are deliberately not read: they are rollover snapshots attached to
 * every response, so on a 429 they cannot say which bucket refused, and the
 * earliest of them is typically the bucket that still had room — a wait that
-* lands straight back in the closed window. They reach the operator through
-* `rateLimitDiagnostics` instead.
+* lands straight back in the closed window. The parsed reset supplies the retry
+* hint; diagnostics omit raw provider headers and body text.
 */
 const claudeRateLimitReset = (response, body, now) => {
 	const unified = earliestReset(resetInstantFromHeader(response, "anthropic-ratelimit-unified-reset", now), resetInstantFromHeader(response, "anthropic-ratelimit-unified-fallback-reset", now));
@@ -6713,11 +6881,49 @@ function isClaudePermanentRefreshError(error) {
 	return error instanceof OAuthEndpointError && (error.oauthCode === "invalid_grant" || error.oauthCode === "invalid_token");
 }
 const CLAUDE_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
-/** RFC3339 `resets_at` value → epoch ms, or undefined when absent/unparsable. */
+/** ISO-8601 or numeric epoch (seconds below 1e10 in magnitude, otherwise ms). */
 function claudeResetsAt(value) {
-	if (typeof value !== "string" || value.length === 0) return void 0;
-	const parsed = Date.parse(value);
-	return Number.isFinite(parsed) ? parsed : void 0;
+	let parsed;
+	if (typeof value === "number") parsed = Math.trunc(Math.abs(value) < 1e10 ? value * 1e3 : value);
+	else if (typeof value === "string" && /^\d{4}-\d{2}-\d{2}T/.test(value)) parsed = Date.parse(value);
+	else return;
+	return Number.isFinite(parsed) && Number.isFinite(new Date(parsed).getTime()) ? parsed : void 0;
+}
+/**
+* Read the observed cedar_ember shape from ItsJazii/pane, not an official
+* contract. Each entry retains its grant id and counts; claimable is only
+* read-only server-selection metadata, never an implemented redemption path.
+*/
+function claudeResetCredits(value, now) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const ember = value;
+	if (ember.eligible !== true || !Array.isArray(ember.grants)) return void 0;
+	const cooldownUntil = claudeResetsAt(ember.cooldown_until);
+	const cooling = cooldownUntil === void 0 ? ember.cooldown_until !== void 0 && ember.cooldown_until !== null : cooldownUntil > now;
+	const credits = [];
+	let selected = false;
+	for (const raw of ember.grants) {
+		if (typeof raw !== "object" || raw === null || Array.isArray(raw)) continue;
+		const grant = raw;
+		const { id, resets_total: total, resets_left: left, usable_now: usable, paused } = grant;
+		const expiresAt = claudeResetsAt(grant.ends_at);
+		if (typeof id !== "string" || id.trim().length === 0 || typeof total !== "number" || !Number.isSafeInteger(total) || total < 1 || typeof left !== "number" || !Number.isSafeInteger(left) || expiresAt === void 0 || usable !== void 0 && typeof usable !== "boolean" || paused !== void 0 && typeof paused !== "boolean") continue;
+		const resetsLeft = Math.max(0, Math.min(left, total));
+		if (resetsLeft === 0) continue;
+		const claimable = !selected && id === ember.next_grant_id && usable === true && paused !== true && !cooling && expiresAt > now;
+		if (claimable) selected = true;
+		credits.push({
+			id,
+			expiresAt,
+			resetsTotal: total,
+			resetsLeft,
+			...usable === void 0 ? {} : { usableNow: usable },
+			...paused === void 0 ? {} : { paused },
+			claimable,
+			...cooldownUntil === void 0 ? {} : { cooldownUntil }
+		});
+	}
+	return credits.length > 0 ? credits : void 0;
 }
 /** Claude session and weekly buckets reset as whole five-hour/seven-day windows. */
 function claudeWindowTiming(kind) {
@@ -6769,6 +6975,10 @@ function claudeLimitsWindows(value) {
 * source of Claude Code's `/usage` screen). Newer responses carry a
 * structured `limits` array; older ones the flat `five_hour`/`seven_day*`
 * buckets — both shapes are read, the array winning when it has entries.
+* Requests the optional cedar_ember banked-reset block with the existing CLI
+* identity. A 400/403 retries once without that parameter; ordinary windows
+* remain available and resetCreditsError records the optional lookup failure.
+* Missing/ineligible blocks and empty or unusable grants expose no credits.
 * @param session - the stored session (used as-is; never refreshed here).
 * @param fetchFn - fetch implementation (injectable for tests).
 * @param signal - caller cancellation from the RPC transport.
@@ -6777,7 +6987,7 @@ function claudeLimitsWindows(value) {
 */
 async function fetchClaudeUsage(session, fetchFn = hostFetch, signal, cliVersion = localClaudeCliVersion) {
 	const userAgent = claudeCliUserAgent(await cliVersion());
-	const response = await fetchFn(CLAUDE_USAGE_URL, {
+	const init = {
 		headers: {
 			"authorization": `Bearer ${session.accessToken}`,
 			"anthropic-beta": "oauth-2025-04-20",
@@ -6785,13 +6995,25 @@ async function fetchClaudeUsage(session, fetchFn = hostFetch, signal, cliVersion
 			"accept": "application/json"
 		},
 		...signal === void 0 ? {} : { signal }
-	});
+	};
+	let response = await fetchFn(`${CLAUDE_USAGE_URL}?cedar_ember=1`, init);
+	let resetCreditsError;
+	if (response.status === 400 || response.status === 403) {
+		resetCreditsError = `Claude banked resets lookup failed (HTTP ${response.status}); using plain usage.`;
+		response = await fetchFn(CLAUDE_USAGE_URL, init);
+	}
 	if (!response.ok) throw await oauthEndpointError(response, "claude usage");
 	const payload = await response.json();
+	const resetCredits = resetCreditsError === void 0 ? claudeResetCredits(payload.cedar_ember, Date.now()) : void 0;
+	const resets = {
+		...resetCredits === void 0 ? {} : { resetCredits },
+		...resetCreditsError === void 0 ? {} : { resetCreditsError }
+	};
 	const modern = claudeLimitsWindows(payload.limits);
 	if (modern.length > 0) return {
 		supported: true,
-		windows: modern
+		windows: modern,
+		...resets
 	};
 	const windows = [];
 	const legacy = [
@@ -6803,7 +7025,8 @@ async function fetchClaudeUsage(session, fetchFn = hostFetch, signal, cliVersion
 	for (const window of legacy) if (window !== void 0) windows.push(window);
 	return {
 		supported: true,
-		windows
+		windows,
+		...resets
 	};
 }
 function claudeThinkingType(capabilities) {
@@ -6888,6 +7111,14 @@ const CLAUDE_IMAGE_LIMIT = {
 	maxEdge: 2e3,
 	maxBytes: 375e4
 };
+/**
+* Inline image data a Claude request may carry, in base64 bytes. Every turn
+* resends the history, so screenshots accumulate until the request passes the
+* API's 32MB body limit and every later turn and compaction fails with HTTP
+* 413 `request_too_large`. Past this budget the host offloads the oldest
+* images to text and retries; the remaining 12MB holds prompts, tools, and text.
+*/
+const CLAUDE_REQUEST_IMAGE_BUDGET = 20 * 1024 * 1024;
 /** The Claude 4.5 family accepts image input. */
 const CLAUDE_MODALITIES = ["text", "image"];
 /**
@@ -6903,15 +7134,20 @@ const CLAUDE_MODALITIES = ["text", "image"];
 * @param maxTokens - the resolved output cap.
 * @param thinking - the thinking parameter, when the model takes one.
 * @param effort - the reasoning effort, when the model advertises efforts.
+* @param cacheTtl - lifetime of every cache breakpoint; defaults to five minutes.
+* Requests that carry a `purpose` (compaction, session titles) always use five
+* minutes to preserve their existing auxiliary-request behavior. A five-minute
+* mark can still read an entry a one-hour mark wrote.
 * @returns the JSON body to POST.
 */
-function claudeRequestBody(options, messages, maxTokens, thinking, effort) {
+function claudeRequestBody(options, messages, maxTokens, thinking, effort, cacheTtl) {
+	const ttl = options.purpose === void 0 ? cacheTtl : void 0;
 	const anthropicMessages = toAnthropicMessages(messages);
-	markMessageCache(anthropicMessages);
+	markMessageCache(anthropicMessages, ttl);
 	return {
 		model: options.model,
 		max_tokens: maxTokens,
-		system: toAnthropicSystem(options.system, messages),
+		system: toAnthropicSystem(options.system, messages, ttl),
 		messages: anthropicMessages,
 		...options.tools !== void 0 && options.tools.length > 0 ? { tools: toAnthropicTools(options.tools) } : {},
 		...thinking === void 0 ? {} : { thinking },
@@ -7097,9 +7333,13 @@ var ClaudeAdapter = class extends LlmAdapter {
 	}
 	async request(options, session, signal) {
 		const messages = await resolveImages(options.messages, this.options.resolveAttachments?.(), signal, CLAUDE_IMAGE_LIMIT);
+		if (hostSupportsImageOffload()) {
+			const offloadImages = requiredImageOffloadCount(messages, CLAUDE_REQUEST_IMAGE_BUDGET);
+			if (offloadImages > 0) throw new LlmError(`claude request images exceed the ${CLAUDE_REQUEST_IMAGE_BUDGET}-byte base64 budget; ${offloadImages} more oldest image(s) must be offloaded`, IMAGE_OFFLOAD_REQUIRED, { offloadImages });
+		}
 		const disc = await this.discovered(options.model);
 		const maxTokens = options.maxTokens ?? claudeMaxTokens(this.options.models.find((entry) => entry.id === options.model), disc);
-		const body = claudeRequestBody(options, messages, maxTokens, this.thinkingParam(disc?.thinkingType, maxTokens), options.reasoningEffort !== void 0 && disc?.reasoning !== void 0 ? String(options.reasoningEffort) : void 0);
+		const body = claudeRequestBody(options, messages, maxTokens, this.thinkingParam(disc?.thinkingType, maxTokens), options.reasoningEffort !== void 0 && disc?.reasoning !== void 0 ? String(options.reasoningEffort) : void 0, this.options.promptCacheTtl);
 		const cliVersion = await (this.options.resolveCliVersion ?? localClaudeCliVersion)();
 		return hostFetch(CLAUDE_API_URL, {
 			method: "POST",
@@ -7293,11 +7533,11 @@ function mapResponsesUsage(usage) {
 * @returns the mapped error (context overflow, quota, otherwise SERVER).
 */
 function responsesFailure(code, message) {
-	const text = message ?? code ?? "the provider reported a failed response";
 	const detail = `${code ?? ""} ${message ?? ""}`;
-	if (code === "context_window_exceeded" || isContextWindowExceededError(detail)) return new LlmError(text, CONTEXT_WINDOW_EXCEEDED_CODE);
-	if (code !== void 0 && /insufficient|quota/i.test(code) || isQuotaExceededError(detail)) return new LlmError(text, QUOTA_EXCEEDED_CODE);
-	return new LlmError(text, "SERVER");
+	let classification = "SERVER";
+	if (code === "context_window_exceeded" || isContextWindowExceededError(detail)) classification = CONTEXT_WINDOW_EXCEEDED_CODE;
+	else if (code !== void 0 && /insufficient|quota/i.test(code) || isQuotaExceededError(detail)) classification = QUOTA_EXCEEDED_CODE;
+	return new LlmError(`Responses failure (${classification}): [provider response body omitted]`, classification);
 }
 /** Assemble the final ContentBlock for one open block. */
 function closeBlock$1(block) {
@@ -7516,7 +7756,7 @@ async function* streamResponses(stream, onActivity, transform) {
 		try {
 			event = JSON.parse(sseEvent.data);
 		} catch {
-			throw new LlmError(`malformed SSE payload: ${sseEvent.data.slice(0, 120)}`, "MALFORMED_RESPONSE");
+			throw new LlmError("malformed SSE payload (MALFORMED_RESPONSE): [provider response body omitted]", "MALFORMED_RESPONSE");
 		}
 		if (transform !== void 0) event = transform(event);
 		yield* translator.push(event);
@@ -7555,8 +7795,8 @@ const CODEX_RESET_FIELDS = [
 * rollover snapshots the backend attaches to every response, one per window,
 * so they say nothing about which window refused: a burst 429 that would clear
 * in seconds still carries a primary rollover hours out, and reading it would
-* park the turn for those hours. They reach the operator through
-* `rateLimitDiagnostics` instead.
+* park the turn for those hours. The parsed body reset supplies the retry hint;
+* diagnostics omit raw provider headers and body text.
 */
 const codexRateLimitReset = (_response, body, now) => resetFromFields(jsonBody(body), CODEX_RESET_FIELDS, now);
 /** Default instruction when the request carries no system prompt. */
@@ -7728,6 +7968,63 @@ function isCodexPermanentRefreshError(error) {
 	return error instanceof OAuthEndpointError && error.oauthCode !== void 0 && PERMANENT_REFRESH_CODES.has(error.oauthCode);
 }
 const CODEX_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
+const CODEX_RESET_CREDITS_URL = "https://chatgpt.com/backend-api/wham/rate-limit-reset-credits";
+function parseResetDate(value) {
+	if (typeof value !== "string") return void 0;
+	const timestamp = Date.parse(value);
+	return Number.isFinite(timestamp) ? timestamp : void 0;
+}
+/** Read banked resets without spending them; consumption uses a separate explicit POST. */
+async function fetchCodexResetCredits(session, fetchFn = hostFetch, signal) {
+	const response = await fetchFn(CODEX_RESET_CREDITS_URL, {
+		headers: {
+			authorization: `Bearer ${session.accessToken}`,
+			"chatgpt-account-id": session.accountId,
+			originator: "Codex Desktop",
+			"openai-beta": "codex-1",
+			accept: "application/json",
+			...attributionHeaders()
+		},
+		...signal === void 0 ? {} : { signal }
+	});
+	if (!response.ok) throw await oauthEndpointError(response, "codex reset credits");
+	const payload = await response.json();
+	if (!Array.isArray(payload?.credits)) throw new Error("codex reset credits: unexpected response (missing credits array)");
+	return payload.credits.flatMap((value) => {
+		if (typeof value !== "object" || value === null) return [];
+		const credit = value;
+		if (credit.status !== "available" || credit.reset_type !== "codex_rate_limits") return [];
+		const grantedAt = parseResetDate(credit.granted_at);
+		const expiresAt = parseResetDate(credit.expires_at);
+		return [{
+			...typeof credit.id === "string" ? { id: credit.id } : {},
+			...grantedAt === void 0 ? {} : { grantedAt },
+			...expiresAt === void 0 ? {} : { expiresAt }
+		}];
+	});
+}
+/** Submit one explicit reset; ambiguous or unconfirmed responses throw without retry. */
+async function consumeCodexResetCredit(session, creditId, requestId, fetchFn = hostFetch, signal) {
+	const response = await fetchFn(CODEX_RESET_CREDITS_URL + "/consume", {
+		method: "POST",
+		headers: {
+			authorization: "Bearer " + session.accessToken,
+			"chatgpt-account-id": session.accountId,
+			originator: "Codex Desktop",
+			"openai-beta": "codex-1",
+			"content-type": "application/json",
+			accept: "application/json",
+			...attributionHeaders()
+		},
+		body: JSON.stringify({
+			redeem_request_id: requestId,
+			credit_id: creditId
+		}),
+		...signal === void 0 ? {} : { signal }
+	});
+	if (!response.ok) throw await oauthEndpointError(response, "codex consume reset");
+	if ((await response.json())?.code !== "reset") throw new Error("Reset was not confirmed. Verify the account in Codex before retrying.");
+}
 /** Seconds of the canonical 5-hour session and 7-day weekly windows. */
 const SESSION_WINDOW_SECONDS = 300 * 60;
 const WEEKLY_WINDOW_SECONDS = 10080 * 60;
@@ -7851,7 +8148,7 @@ async function fetchCodexModels(session, fetchFn = hostFetch, signal, clientVers
 	for (const entry of payload.models) {
 		if (typeof entry.slug !== "string" || entry.slug.length === 0) continue;
 		if (entry.visibility === "hide" || entry.visibility === "none") continue;
-		const efforts = (entry.supported_reasoning_levels ?? []).filter((level) => typeof level.effort === "string" && level.effort.length > 0).map((level) => ({
+		const efforts = (entry.supported_reasoning_levels ?? []).filter((level) => typeof level.effort === "string" && level.effort.length > 0 && level.effort !== "ultra").map((level) => ({
 			id: ReasoningEffortId(level.effort),
 			name: effortDisplayName(level.effort),
 			...level.description === void 0 ? {} : { description: level.description }
@@ -7952,6 +8249,16 @@ function reconcileResponsesToolCalls(input) {
 	return balanced;
 }
 /**
+* The `reasoning.effort` wire value for a selected effort. Codex's "ultra" is
+* a client-side selection (max reasoning plus proactive sub-agent delegation)
+* that the Codex CLI itself lowers to `max` at the Responses API boundary;
+* the backend answers HTTP 400 to a literal `ultra`. Discovery no longer
+* lists it, but an effort saved before that change may still arrive here.
+*/
+function codexWireEffort(effort) {
+	return effort === "ultra" ? "max" : effort;
+}
+/**
 * The Responses request body for one generation. A fast-tier request (the
 * composer Speed toggle, the codex CLI's fast mode) carries
 * `service_tier: priority`; the tier field is omitted entirely otherwise,
@@ -7968,7 +8275,7 @@ function codexRequestBody(options, resolved, fast) {
 			parallel_tool_calls: true
 		} : {},
 		...options.reasoningEffort !== void 0 ? { reasoning: {
-			effort: String(options.reasoningEffort),
+			effort: codexWireEffort(String(options.reasoningEffort)),
 			summary: "auto"
 		} } : {},
 		store: false,
@@ -8401,10 +8708,10 @@ function abortableDelay(ms, signal) {
 		throwIfAborted(signal);
 		return Promise.resolve();
 	}
-	return new Promise((resolve$1, reject) => {
+	return new Promise((resolve$2, reject) => {
 		const timer = setTimeout(() => {
 			cleanup();
-			resolve$1();
+			resolve$2();
 		}, ms);
 		const onAbort = () => {
 			cleanup();
@@ -8625,6 +8932,12 @@ var PoolHealthRegistry = class {
 		}
 		return earliest;
 	}
+	/** Active failure codes for the given keys; reading them does not change cooldowns. */
+	unavailableReasons(keys, now = Date.now()) {
+		const reasons = [];
+		for (const [key, record$4] of this.records) if (keys.has(key) && record$4.unavailableUntil > now) reasons.push(record$4.reason);
+		return reasons;
+	}
 	/** Drop records of one provider, or of a single account when given (auth changes). */
 	clear(provider, account) {
 		const prefix = account === void 0 ? `${provider}/` : `${provider}/${account}/`;
@@ -8632,6 +8945,67 @@ var PoolHealthRegistry = class {
 	}
 };
 
+//#endregion
+//#region src/providers/replay.ts
+const REPLAY_KIND = "subscriptions-account-replay";
+/** Bind opaque replay to the concrete account/model behind a route alias. */
+async function* streamAccountWithReplay(adapter, options, account, model = options.model) {
+	const key = createHash("sha256").update(JSON.stringify([
+		options.provider,
+		account,
+		model
+	])).digest("hex");
+	const messages = options.messages.map((message) => {
+		if (message.role !== "assistant" || message.source?.replayState === void 0) return message;
+		const source = message.source;
+		if (source.replayState === null || typeof source.replayState !== "object" || !("response" in source.replayState)) return message;
+		const replay = source.replayState;
+		const response = replay.response;
+		if (response !== null && typeof response === "object" && "kind" in response && response.kind === REPLAY_KIND) {
+			if ("version" in response && response.version === 1 && "key" in response && response.key === key && "state" in response) return {
+				...message,
+				source: {
+					...source,
+					provider: options.provider,
+					model,
+					replayState: {
+						...replay,
+						response: response.state
+					}
+				}
+			};
+			const { replayState: _discarded$1,...withoutReplay$1 } = source;
+			return {
+				...message,
+				source: withoutReplay$1
+			};
+		}
+		if (source.provider === options.provider && source.model === model) return message;
+		const { replayState: _discarded,...withoutReplay } = source;
+		return {
+			...message,
+			source: withoutReplay
+		};
+	});
+	for await (const chunk of adapter.streamAccount({
+		...options,
+		model,
+		messages
+	}, account)) if (chunk.type === "finish" && chunk.replayState !== void 0) yield {
+		...chunk,
+		replayState: {
+			...chunk.replayState,
+			response: {
+				kind: REPLAY_KIND,
+				version: 1,
+				key,
+				state: chunk.replayState.response
+			}
+		}
+	};
+	else yield chunk;
+}
+
 //#endregion
 //#region src/providers/pool.ts
 /** Bound on sticky-session memory; oldest entries evict past it. */
@@ -8810,34 +9184,39 @@ var PoolAdapter = class extends LlmAdapter {
 			...modalities === void 0 ? {} : { inputModalities: modalities }
 		};
 	}
+	/**
+	* Fail over before output. A single non-quota failure keeps its identity
+	* and shared provider message, with scoped pool recovery or its own hint as fallback.
+	* Multiple failures carry a bounded summary and all attempts in an AggregateError cause.
+	* Pure quota/rate exhaustion retains RATE_LIMIT and this pool's earliest recovery hint.
+	*/
 	async *stream(options) {
 		const definition = (await this.pools()).get(poolKey(options.provider, options.model));
 		if (definition === void 0) throw new LlmError(`unknown pool model "${options.model}"`, "NO_ADAPTER");
 		const members = await this.concrete(definition.members);
 		const candidates = await this.select(options.model, members, options.sessionId);
 		if (candidates.length === 0) throw this.exhausted(options.model, members);
-		let lastError;
+		const failures = [];
 		for (const member of candidates) {
 			const adapter = this.options.adapters[member.provider];
 			if (adapter === void 0) continue;
-			const iterator = adapter.streamAccount({
+			const iterator = streamAccountWithReplay(adapter, {
 				...options,
-				provider: member.provider,
-				model: member.model
-			}, member.account)[Symbol.asyncIterator]();
+				provider: member.provider
+			}, member.account, member.model)[Symbol.asyncIterator]();
 			let first;
 			try {
 				first = await iterator.next();
 				if (first.done === true) throw new LlmError(`${memberLabel(member)} returned an empty stream`, EMPTY_RESPONSE_CODE);
 			} catch (error) {
 				const classification = classifyPoolFailure(error, member.provider);
-				if (classification.action === "throw") throw error;
+				if (classification.action === "throw" || !(error instanceof LlmError)) throw error;
 				if ("cooldownMs" in classification) {
 					this.options.health.markUnavailable(classification.scope === "account" ? accountKey(member.provider, member.account) : memberKey(member.provider, member.account, member.model), classification.cooldownMs, classification.reason);
 					if (classification.reason === QUOTA_EXCEEDED_CODE || classification.reason === "RATE_LIMIT") this.options.usage.invalidate(member.provider, member.account);
 				}
 				this.options.onWarn(`pool "${options.model}": ${memberLabel(member)} failed before any output (${error instanceof Error ? error.message : String(error)}); trying the next member`);
-				lastError = error;
+				failures.push(error);
 				continue;
 			}
 			this.remember(options.model, options.sessionId, member);
@@ -8851,7 +9230,7 @@ var PoolAdapter = class extends LlmAdapter {
 			}
 			return;
 		}
-		throw this.exhausted(options.model, members, lastError);
+		throw this.exhausted(options.model, members, failures);
 	}
 	/**
 	* Order the candidates for one request. Health filters both strategies;
@@ -8892,12 +9271,9 @@ var PoolAdapter = class extends LlmAdapter {
 		}
 		this.sticky.set(key, memberKey(member.provider, member.account, member.model));
 	}
-	/**
-	* The error for an exhausted pool, carrying the earliest recovery hint of
-	* THIS pool's members (the health registry is shared across pools, so the
-	* hint is scoped to the keys this pool can actually recover through).
-	*/
-	exhausted(model, pool, cause) {
+	/** Report attempt failures or this pool's active cooldowns, never unrelated health records. */
+	exhausted(model, pool, failures = []) {
+		if (pool.length === 0) return new LlmError(`pool "${model}" has no usable member: no account could be resolved`, "NO_ADAPTER");
 		const keys = /* @__PURE__ */ new Set();
 		for (const member of pool) {
 			keys.add(memberKey(member.provider, member.account, member.model));
@@ -8905,12 +9281,53 @@ var PoolAdapter = class extends LlmAdapter {
 		}
 		const recovery = this.options.health.earliestRecovery(keys);
 		const retryAfterMs$1 = recovery === void 0 ? void 0 : Math.max(recovery - Date.now(), 1);
-		return new LlmError(`pool "${model}" exhausted: every member is unavailable or failed`, "RATE_LIMIT", {
+		const coolingReasons = this.options.health.unavailableReasons(keys);
+		const codes = [...failures.map((error) => error.code), ...coolingReasons];
+		if (codes.length === 0) return new LlmError(`pool "${model}" has no usable member`, "NO_ADAPTER");
+		const quotaOnly = codes.every(isQuotaFailure);
+		if (failures.length === 1 && !isQuotaFailure(failures[0].code)) {
+			const failure$1 = failures[0];
+			if (retryAfterMs$1 !== void 0 && retryAfterMs$1 !== failure$1.failure.providerRetryAfterMs) Object.defineProperty(failure$1, "failure", { value: Object.freeze({
+				...failure$1.failure,
+				providerRetryAfterMs: retryAfterMs$1
+			}) });
+			return failure$1;
+		}
+		const attemptedCodes = failures.map((error) => error.code);
+		const summary = failureSummary([...attemptedCodes, ...coolingReasons.filter((code) => !attemptedCodes.includes(code))]);
+		const cause = failures.length === 0 ? void 0 : failures.length === 1 ? failures[0] : new AggregateError(failures, `${failures.length} pool members failed: ${summary}`);
+		return new LlmError(quotaOnly ? `pool "${model}" exhausted: every member is unavailable or failed` : failures.length > 0 ? `pool "${model}" exhausted: ${failures.length} ${failures.length === 1 ? "member" : "members"} failed (${summary})` : `pool "${model}" unavailable: ${pool.length} members are cooling down (${summary})`, quotaOnly ? "RATE_LIMIT" : attemptedCodes.filter((code) => !isQuotaFailure(code)).at(-1) ?? coolingReasons.filter((code) => !isQuotaFailure(code)).at(-1), {
 			...retryAfterMs$1 === void 0 ? {} : { providerRetryAfterMs: retryAfterMs$1 },
 			...cause === void 0 ? {} : { cause }
 		});
 	}
 };
+function isQuotaFailure(code) {
+	return code === QUOTA_EXCEEDED_CODE || code === "RATE_LIMIT";
+}
+/** Summaries use stable codes only: adapter messages and nested causes can contain raw payloads. */
+function failureSummary(codes) {
+	const descriptions = {
+		AUTH: "authentication failed",
+		INVALID_CREDENTIAL: "credential is invalid",
+		MISSING_CREDENTIAL: "credential is missing",
+		SERVER: "provider server failed",
+		TIMEOUT: "provider request timed out",
+		EMPTY_RESPONSE: "provider returned no output",
+		TRANSPORT: "provider connection failed",
+		HTTP_402: "provider plan unavailable",
+		HTTP_404: "provider model unavailable",
+		QUOTA: "provider quota exhausted",
+		RATE_LIMIT: "provider rate limit reached"
+	};
+	const limit = 5;
+	const shown = codes.slice(0, limit).map((code) => {
+		const description = descriptions[code];
+		return description === void 0 ? "member unavailable" : `${code}: ${description}`;
+	});
+	if (codes.length > limit) shown.push(`${codes.length - limit} more`);
+	return shown.join("; ");
+}
 function stickyKey(poolId, sessionId) {
 	return `${String(sessionId)}|${poolId}`;
 }
@@ -9067,10 +9484,7 @@ var AccountPreferencesAdapter = class extends LlmAdapter {
 		const independent = parseAccountModelId(options.model);
 		if (independent) {
 			await this.requireAccount(independent.account, independent.model, true);
-			yield* this.options.adapter.streamAccount({
-				...options,
-				model: independent.model
-			}, independent.account);
+			yield* streamAccountWithReplay(this.options.adapter, options, independent.account, independent.model);
 			return;
 		}
 		const pool = this.options.pool();
@@ -9078,7 +9492,7 @@ var AccountPreferencesAdapter = class extends LlmAdapter {
 			yield* pool.stream(options);
 			return;
 		}
-		yield* this.options.adapter.streamAccount(options, await this.fallback(options.model));
+		yield* streamAccountWithReplay(this.options.adapter, options, await this.fallback(options.model));
 	}
 };
 
@@ -9227,6 +9641,11 @@ const FALLBACK_HORIZON_MS = {
 var PoolUsageTracker = class {
 	entries = /* @__PURE__ */ new Map();
 	inflight = /* @__PURE__ */ new Map();
+	/** Bumped by {@link invalidate} so a fetch started before it cannot repopulate the cache. */
+	generation = /* @__PURE__ */ new Map();
+	/** Monotonic per-key write order: only the newest settled fetch may cache. */
+	nextSequence = 0;
+	lastWritten = /* @__PURE__ */ new Map();
 	constructor(fetcherFor, ttlMs = USAGE_TTL_MS) {
 		this.fetcherFor = fetcherFor;
 		this.ttlMs = ttlMs;
@@ -9309,13 +9728,25 @@ var PoolUsageTracker = class {
 			throw error;
 		}
 	}
-	/** Drop cached snapshots: one account, or a whole provider when `account` is omitted. */
+	/**
+	* Drop cached snapshots: one account, or a whole provider when `account` is
+	* omitted. A fetch already in flight is abandoned too. It was started against
+	* state the caller has just declared changed — a redeemed credit, a completed
+	* login — so joining it would return the pre-change numbers and cache them for
+	* the full freshness window. Its result is discarded on arrival by the
+	* generation check in {@link refresh}.
+	*/
 	invalidate(provider, account) {
+		const drop = (key) => {
+			this.entries.delete(key);
+			this.inflight.delete(key);
+			this.generation.set(key, (this.generation.get(key) ?? 0) + 1);
+		};
 		if (account !== void 0) {
-			this.entries.delete(`${provider}/${account}`);
+			drop(`${provider}/${account}`);
 			return;
 		}
-		for (const key of [...this.entries.keys()]) if (key.startsWith(`${provider}/`)) this.entries.delete(key);
+		for (const key of [...this.entries.keys(), ...this.inflight.keys()]) if (key.startsWith(`${provider}/`)) drop(key);
 	}
 	/**
 	* Run (or join) the single in-flight fetch for one account key, caching
@@ -9330,6 +9761,8 @@ var PoolUsageTracker = class {
 		if (pending === void 0) {
 			const prior = this.entries.get(key);
 			const lastSnapshot = prior?.snapshot ?? prior?.lastSnapshot;
+			const generation = this.generation.get(key) ?? 0;
+			const sequence = ++this.nextSequence;
 			pending = fetcher().then((value) => {
 				const at = Date.now();
 				const snapshot = {
@@ -9337,21 +9770,27 @@ var PoolUsageTracker = class {
 					observedAt: at,
 					stale: false
 				};
-				this.entries.set(key, {
-					snapshot,
-					at
-				});
+				if ((this.generation.get(key) ?? 0) === generation && (this.lastWritten.get(key) ?? 0) < sequence) {
+					this.lastWritten.set(key, sequence);
+					this.entries.set(key, {
+						snapshot,
+						at
+					});
+				}
 				return snapshot;
 			}, (error) => {
-				if (!isMissingOrInvalidCredential(error)) this.entries.set(key, {
-					error,
-					at: Date.now(),
-					cooldownMs: cooldownFor(error, this.ttlMs),
-					...lastSnapshot === void 0 ? {} : { lastSnapshot }
-				});
+				if (!isMissingOrInvalidCredential(error) && (this.generation.get(key) ?? 0) === generation && (this.lastWritten.get(key) ?? 0) < sequence) {
+					this.lastWritten.set(key, sequence);
+					this.entries.set(key, {
+						error,
+						at: Date.now(),
+						cooldownMs: cooldownFor(error, this.ttlMs),
+						...lastSnapshot === void 0 ? {} : { lastSnapshot }
+					});
+				}
 				throw error;
 			}).finally(() => {
-				this.inflight.delete(key);
+				if (this.inflight.get(key) === pending) this.inflight.delete(key);
 			});
 			this.inflight.set(key, pending);
 		}
@@ -9433,8 +9872,8 @@ const GROK_RESET_FIELDS = [
 * whose values are rollover durations (`6m0s`) present on every response, one
 * per bucket — on a 429 the earliest of them is usually a bucket with room
 * (`0s` for the request bucket while the token bucket is the one exhausted),
-* which would burn the whole retry budget in seconds. They reach the operator
-* through `rateLimitDiagnostics` instead.
+* which would burn the whole retry budget in seconds. The parsed body reset
+* supplies the retry hint; diagnostics omit raw provider headers and body text.
 */
 const grokRateLimitReset = (_response, body, now) => resetFromFields(jsonBody(body), GROK_RESET_FIELDS, now);
 /** A discovered URL must be https on x.ai or a subdomain; anything else is a hostile document. */
@@ -10382,7 +10821,7 @@ async function* streamChatCompletions(stream, onActivity) {
 		try {
 			event = JSON.parse(sseEvent.data);
 		} catch {
-			throw new LlmError(`malformed SSE payload: ${sseEvent.data.slice(0, 120)}`, "MALFORMED_RESPONSE");
+			throw new LlmError("malformed SSE payload (MALFORMED_RESPONSE): [provider response body omitted]", "MALFORMED_RESPONSE");
 		}
 		yield* translator.push(event);
 		if (translator.terminated) return;
@@ -10969,13 +11408,16 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 	* account identity is the session's long-lived GitHub token (stable across
 	* Copilot-token refreshes, different per GitHub login); the conversation is
 	* the loop-stamped `sessionId`, falling back to the first message's id
-	* when a hand-built request carries no session stamp; the model separates
+	* when a hand-built request carries no session stamp. Identity-free
+	* requests have no replay scope; the model separates
 	* wire families. A call id captured in one scope is invisible to every
 	* other scope, so reused ids cannot leak reasoning across accounts,
 	* conversations, or models.
 	*/
 	replayScope(tokenKey, options) {
-		return `${tokenKey}\u0000${options.sessionId !== void 0 ? `session:${String(options.sessionId)}` : options.messages[0] !== void 0 ? `anchor:${String(options.messages[0].id)}` : "conversation:none"}\u0000${options.model}`;
+		const conversation = options.sessionId !== void 0 ? `session:${String(options.sessionId)}` : options.messages[0]?.id !== void 0 ? `anchor:${String(options.messages[0].id)}` : void 0;
+		if (conversation === void 0) return void 0;
+		return `${tokenKey}\u0000${conversation}\u0000${options.model}`;
 	}
 	/**
 	* Store one response's completed reasoning items behind every call id it
@@ -10988,6 +11430,7 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 	* per call.
 	*/
 	captureReasoning(scope, callIds, items) {
+		if (scope === void 0) return;
 		let entries = this.replayByScope.get(scope);
 		if (entries === void 0) {
 			entries = /* @__PURE__ */ new Map();
@@ -11023,6 +11466,7 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 	* degradation, never an error.
 	*/
 	replayFor(scope, callId) {
+		if (scope === void 0) return void 0;
 		const entries = this.replayByScope.get(scope);
 		const entry = entries?.get(callId);
 		if (entries === void 0 || entry === void 0) return void 0;
@@ -11178,8 +11622,8 @@ function object(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /** Resolve local references before removing definitions; reject cycles and remote references. */
-function resolve(value, root, refs = /* @__PURE__ */ new Set()) {
-	if (Array.isArray(value)) return value.map((item) => resolve(item, root, refs));
+function resolve$1(value, root, refs = /* @__PURE__ */ new Set()) {
+	if (Array.isArray(value)) return value.map((item) => resolve$1(item, root, refs));
 	if (!object(value)) return value;
 	if (typeof value.$ref === "string") {
 		const ref = value.$ref;
@@ -11191,7 +11635,7 @@ function resolve(value, root, refs = /* @__PURE__ */ new Set()) {
 		}
 		if (!object(target)) throw new LlmError(`Antigravity tool schema reference is missing: ${ref}`, "INVALID_REQUEST");
 		const { $ref: _ref,...siblings } = value;
-		return resolve({
+		return resolve$1({
 			...target,
 			...siblings
 		}, root, new Set([...refs, ref]));
@@ -11201,7 +11645,7 @@ function resolve(value, root, refs = /* @__PURE__ */ new Set()) {
 		"$id",
 		"$defs",
 		"definitions"
-	].includes(key)).map(([key, item]) => [key, key === "properties" && object(item) ? Object.fromEntries(Object.entries(item).map(([name$1, property]) => [name$1, resolve(property, root, refs)])) : resolve(item, root, refs)]));
+	].includes(key)).map(([key, item]) => [key, key === "properties" && object(item) ? Object.fromEntries(Object.entries(item).map(([name$1, property]) => [name$1, resolve$1(property, root, refs)])) : resolve$1(item, root, refs)]));
 }
 /** Numeric types widen to `number`: every integer is also a number. */
 const NUMERIC = new Set(["integer", "number"]);
@@ -11287,7 +11731,7 @@ function custom(value) {
 }
 /** Detach and normalize one tool's root object without changing the registry schema. */
 function antigravityToolParameters(parameters, legacy) {
-	const resolved = resolve(parameters, parameters);
+	const resolved = resolve$1(parameters, parameters);
 	const root = {
 		...resolved,
 		type: resolved.type ?? "object"
@@ -11303,9 +11747,11 @@ function antigravityToolParameters(parameters, legacy) {
 * `FunctionResponse.response` field requires. That field maps to a singular
 * protobuf `Struct`, so a bare array, string, number or boolean is rejected
 * by the endpoint with "Proto field is not repeating, cannot start list".
-* Only a non-array JSON object survives verbatim; every other JSON value is
+* Non-array JSON objects use their own fields; every other JSON value is
 * wrapped in the same "output" envelope the non-JSON path already uses --
 * the shape other Cloud Code Assist clients send for every tool result.
+* Failed results carry top-level `isError: true`, overriding a payload field;
+* successful results retain their existing serialized shape.
 */
 function toolResultValue(block) {
 	const text = block.content.map((part) => part.type === "text" ? part.text : "").join("");
@@ -11318,8 +11764,17 @@ function toolResultValue(block) {
 			...block.isError === true ? { isError: true } : {}
 		};
 	}
-	if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
-	return { output: parsed };
+	if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+		const value = parsed;
+		return block.isError === true ? {
+			...value,
+			isError: true
+		} : value;
+	}
+	return {
+		output: parsed,
+		...block.isError === true ? { isError: true } : {}
+	};
 }
 /** Safely read per-block replay metadata emitted by this adapter. */
 function replayBlocks(message, model) {
@@ -11369,7 +11824,8 @@ function toAntigravityContents(messages, model) {
 				response: toolResultValue({
 					type: "tool-result",
 					toolCallId: ToolCallId$1(id),
-					content: message.content
+					content: message.content,
+					...message.isError === void 0 ? {} : { isError: message.isError }
 				})
 			} };
 			const previous$1 = out.at(-1);
@@ -11657,7 +12113,7 @@ async function* streamAntigravity(stream, onActivity) {
 		try {
 			parsed = JSON.parse(event.data);
 		} catch {
-			throw new LlmError(`malformed Antigravity SSE payload: ${event.data.slice(0, 120)}`, "MALFORMED_RESPONSE");
+			throw new LlmError("malformed Antigravity SSE payload (MALFORMED_RESPONSE): [provider response body omitted]", "MALFORMED_RESPONSE");
 		}
 		yield* translator.push(parsed);
 		if (translator.terminated) return;
@@ -11821,7 +12277,7 @@ async function discoverAntigravityAccount(accessToken, runtime = {}, fetchFn = h
 				projectId = projectIdOf(result.response?.cloudaicompanionProject);
 				break;
 			}
-			await new Promise((resolve$1) => setTimeout(resolve$1, 1e3));
+			await new Promise((resolve$2) => setTimeout(resolve$2, 1e3));
 		}
 	}
 	if (projectId === void 0) throw new Error("Antigravity account has no Cloud AI Companion project; open Antigravity and complete onboarding, then log in again");
@@ -12847,14 +13303,14 @@ function truncate(text, max = 60) {
 /** Abort-aware sleep between two polls. */
 function sleep(ms, signal) {
 	if (ms <= 0) return Promise.resolve();
-	return new Promise((resolve$1, reject) => {
+	return new Promise((resolve$2, reject) => {
 		const onAbort = () => {
 			clearTimeout(timer);
 			reject(signal.reason instanceof Error ? signal.reason : /* @__PURE__ */ new Error("video_generate: aborted"));
 		};
 		const timer = setTimeout(() => {
 			signal.removeEventListener("abort", onAbort);
-			resolve$1();
+			resolve$2();
 		}, ms);
 		if (signal.aborted) {
 			onAbort();
@@ -13168,6 +13624,7 @@ const Config = z.object({
 	]),
 	codexClientVersion: z.string(),
 	streamIdleTimeoutMs: z.number().min(1).default(DEFAULT_STREAM_IDLE_TIMEOUT_MS),
+	claudePromptCacheTtl: z.union(["5m", "1h"]).default(DEFAULT_PROMPT_CACHE_TTL),
 	rateLimit: z.object({
 		wait: z.boolean().default(true),
 		maxWaitMs: z.number().min(1).default(DEFAULT_RATE_LIMIT_MAX_WAIT_MS)
@@ -13320,16 +13777,16 @@ const DEFAULT_MODELS = {
 };
 /** Validate and detach the model catalog for every provider. */
 function resolveCatalog(models) {
-	const resolve$1 = (provider) => {
+	const resolve$2 = (provider) => {
 		const configured = models?.[provider];
 		return validateModels(configured !== void 0 && configured.length > 0 ? configured : DEFAULT_MODELS[provider], `${name}: models.${provider}`);
 	};
 	return {
-		codex: resolve$1("codex"),
-		claude: resolve$1("claude"),
-		grok: resolve$1("grok"),
-		copilot: resolve$1("copilot"),
-		antigravity: resolve$1("antigravity")
+		codex: resolve$2("codex"),
+		claude: resolve$2("claude"),
+		grok: resolve$2("grok"),
+		copilot: resolve$2("copilot"),
+		antigravity: resolve$2("antigravity")
 	};
 }
 /** The display account of a stored session, for the status endpoint. */
@@ -13399,7 +13856,7 @@ var SubscriptionsAuthController = class {
 	* cannot be read off the flow manager.
 	*/
 	claims = /* @__PURE__ */ new Map();
-	constructor(flows, deviceFlows, onAuthChanged, resolveAttachments, usageFetchers = {}, readClaudeCreds = readClaudeCodeCredentials, poolUsage = void 0, antigravityConfig = {}, clientVersions = {}) {
+	constructor(flows, deviceFlows, onAuthChanged, resolveAttachments, usageFetchers = {}, readClaudeCreds = readClaudeCodeCredentials, poolUsage = void 0, antigravityConfig = {}, clientVersions = {}, resetRedemption) {
 		this.flows = flows;
 		this.deviceFlows = deviceFlows;
 		this.onAuthChanged = onAuthChanged;
@@ -13409,6 +13866,15 @@ var SubscriptionsAuthController = class {
 		this.poolUsage = poolUsage;
 		this.antigravityConfig = antigravityConfig;
 		this.clientVersions = clientVersions;
+		this.resetRedemption = resetRedemption;
+	}
+	prepareReset(account, signal) {
+		if (!this.resetRedemption) throw new BadRequest("Reset redemption unavailable");
+		return this.resetRedemption.prepare(account, AbortSignal.any([signal, AbortSignal.timeout(2e4)]));
+	}
+	async consumeReset(account, ticket, signal) {
+		if (!this.resetRedemption) throw new BadRequest("Reset redemption unavailable");
+		await this.resetRedemption.redeem(account, ticket, AbortSignal.any([signal, AbortSignal.timeout(2e4)]));
 	}
 	usage(provider, account, signal, force = false) {
 		const fetcher = this.usageFetchers[provider];
@@ -13599,8 +14065,8 @@ function presentedVersion(cache, waitMs = STATUS_VERSION_WAIT_MS) {
 			return cache.current();
 		}
 		let timer;
-		await Promise.race([cache.resolve(), new Promise((resolve$1) => {
-			timer = setTimeout(resolve$1, waitMs);
+		await Promise.race([cache.resolve(), new Promise((resolve$2) => {
+			timer = setTimeout(resolve$2, waitMs);
 		})]).finally(() => {
 			clearTimeout(timer);
 		});
@@ -13619,6 +14085,8 @@ function apply(ctx, config) {
 	const providers = [...new Set(config.providers ?? [...PROVIDER_IDS])];
 	const streamIdleTimeoutMs = config.streamIdleTimeoutMs ?? DEFAULT_STREAM_IDLE_TIMEOUT_MS;
 	if (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0) throw new Error(`${name}: streamIdleTimeoutMs must be a positive finite number`);
+	const claudePromptCacheTtl = config.claudePromptCacheTtl ?? DEFAULT_PROMPT_CACHE_TTL;
+	if (claudePromptCacheTtl !== "5m" && claudePromptCacheTtl !== "1h") throw new Error(`${name}: claudePromptCacheTtl must be '5m' or '1h'`);
 	const rateLimit = resolveRateLimitWait(config.rateLimit, `${name}: rateLimit`);
 	const catalog = resolveCatalog(config.models);
 	const overridden = new Set(PROVIDER_IDS.filter((provider) => (config.models?.[provider]?.length ?? 0) > 0));
@@ -13686,7 +14154,22 @@ function apply(ctx, config) {
 			});
 			codexTokens = tokens;
 			accountTokens.set("codex", tokens);
-			usageFetchers.codex = async (account, signal) => fetchCodexUsage(await tokens.session(account), hostFetch, signal);
+			usageFetchers.codex = async (account, signal) => {
+				const session = await tokens.session(account);
+				const usage = await fetchCodexUsage(session, hostFetch, signal);
+				try {
+					const resetCredits = await fetchCodexResetCredits(session, hostFetch, signal);
+					return {
+						...usage,
+						resetCredits
+					};
+				} catch {
+					return {
+						...usage,
+						resetCreditsError: "the usage-limit reset lookup did not answer"
+					};
+				}
+			};
 			let adapter;
 			adapter = new CodexAdapter({
 				...config.codexClientVersion === void 0 ? {} : { clientVersion: config.codexClientVersion },
@@ -13737,6 +14220,7 @@ function apply(ctx, config) {
 				catalogStore: catalogStore("claude"),
 				defaultEffortOf: (model) => defaultEffortOf("claude", model),
 				resolveCliVersion: () => claudeVersion.resolve(),
+				promptCacheTtl: claudePromptCacheTtl,
 				pool: () => poolAdapter
 			});
 			adapters.set("claude", adapter);
@@ -13844,8 +14328,8 @@ function apply(ctx, config) {
 		const fetcherFor = (provider, account) => {
 			switch (provider) {
 				case "codex": {
-					const tokens = codexTokens;
-					return tokens === void 0 ? void 0 : async () => fetchCodexUsage(await tokens.session(account), hostFetch, AbortSignal.timeout(POOL_USAGE_TIMEOUT_MS));
+					const fetcher = usageFetchers.codex;
+					return fetcher === void 0 ? void 0 : () => fetcher(account, AbortSignal.timeout(POOL_USAGE_TIMEOUT_MS));
 				}
 				case "claude": {
 					const tokens = claudeTokens;
@@ -14020,13 +14504,20 @@ function apply(ctx, config) {
 		cursorHandle = credentialsCtx.llm.registerAdapter(["cursor-subscription"], cursorAdapter);
 	});
 	const externalUsage = new ExternalUsageController(async (name$1) => resolveExternalCredential?.(name$1), hostFetch);
+	const resetRedemption = new ResetRedemption(async (account, signal) => {
+		if (!usageFetchers.codex) throw new BadRequest("Codex unavailable");
+		return usageFetchers.codex(account, signal);
+	}, async (account, creditId, requestId, signal) => {
+		if (!codexTokens) throw new BadRequest("Codex unavailable");
+		await consumeCodexResetCredit(await codexTokens.session(account), creditId, requestId, hostFetch, signal);
+	}, (account) => poolUsage?.invalidate("codex", account), async (account) => resolveAccountKey("codex", account));
 	registerAuthRpc(ctx, new SubscriptionsAuthController(flows, deviceFlows, authChanged, resolveAttachments, usageFetchers, void 0, poolUsage, config.antigravity, {
 		...providers.includes("codex") ? { codex: config.codexClientVersion === void 0 ? presentedVersion(codexVersion) : async () => ({
 			version: config.codexClientVersion,
 			source: "config"
 		}) } : {},
 		...providers.includes("claude") ? { claude: presentedVersion(claudeVersion) } : {}
-	}), speed, modelDefaults, {
+	}, resetRedemption), speed, modelDefaults, {
 		async get(provider, force) {
 			await loadModelDefaults();
 			const adapter = adapters.get(provider);