dsh-subscriptions 0.1.4 → 0.2.0

package/lib/model-defaults.d.ts

@@ -6,12 +6,11 @@ export type ModelDefaults = Readonly<Partial<Record<ProviderId, ModelDefaultMap>
 /** Absolute path of the defaults file. */
 export declare function modelDefaultsFilePath(): string;
 /**
- * The last load failure, or a warning about entries that were skipped while
- * loading; consumers only use it for diagnostics.
+ * Ready the defaults store.
+ * index.ts calls it at apply time so every later synchronous read sees the
+ * persisted state; store tests also call it after resetting the singleton.
  */
-export declare function modelDefaultsLoadError(): unknown;
-/** A detached snapshot for the RPC surface (render + diffing). */
-export declare function modelDefaultsSnapshot(): ModelDefaults;
+export declare function loadModelDefaults(): Promise<void>;
 /**
  * Set or clear one model's configured default effort, then persist. The
  * memory snapshot updates only after the atomic write succeeds, so a failed

package/lib/model-defaults.js

@@ -8,10 +8,10 @@
  * chip the model picker shows when the discovered catalog advertises no
  * default at all.
  *
- * Writes are single-process and atomic, but *not* as serialised as the rest
- * of the page: the Settings page disables only the row being saved, so two
- * rows saved back to back can overlap. The write chain below serialises them,
- * so no update is lost to a read-modify-write race. Every read comes from the
+ * Writes are single-process and atomic. The account manager submits effort
+ * edits sequentially and disables its editor while saving, but concurrent RPC
+ * callers can still overlap. The write chain below serialises them, so no
+ * update is lost to a read-modify-write race. Every read comes from the
  * in-memory snapshot, so the on-disk file only needs to survive a restart: a
  * malformed file reads as empty and is rewritten on the next save, never
  * taking the plugin down with it.
@@ -29,21 +29,21 @@ const EMPTY = Object.freeze({});
 let current = EMPTY;
 /** One lazy load of the on-disk file (read once per process). */
 let ready;
-/** Last load failure, surfaced to callers that care; defaults stay empty. */
+/** Last load failure or skipped-entry warning, inspected only by tests. */
 let loadError;
 /**
  * Serialises every write: the read-modify-write sequence must not interleave,
  * or a fast second save would compute its snapshot from the stale `current`
- * and silently drop the first update (the UI disables only the row being
- * saved, so overlaps are reachable).
+ * and silently drop the first update. Concurrent RPC callers can overlap
+ * even though one account-manager dialog submits its edits sequentially.
  */
 let writeChain = Promise.resolve();
 /**
  * Validate one persisted provider section: a string→string map, or undefined.
  * Malformed *entries* are skipped, not the whole section: one bad value (a
  * hand edit losing its quotes) must not silently un-configure every model in
- * that provider. What was dropped is reported so the caller can surface it
- * instead of the loss disappearing.
+ * that provider. Dropped model ids are recorded in a test-only load warning;
+ * production callers do not surface this warning.
  */
 function sanitizeProvider(value, dropped) {
     if (typeof value !== 'object' || value === null || Array.isArray(value))
@@ -136,15 +136,16 @@ function sectionOf(defaults, provider) {
 }
 /**
  * Ready the defaults store.
- * @internal Exported for tests; index.ts calls it at apply time so every
- * later synchronous read sees the persisted state.
+ * index.ts calls it at apply time so every later synchronous read sees the
+ * persisted state; store tests also call it after resetting the singleton.
  */
 export async function loadModelDefaults() {
     await ensureReady();
 }
 /**
- * The last load failure, or a warning about entries that were skipped while
- * loading; consumers only use it for diagnostics.
+ * Test-only observation of the last load failure or skipped-entry warning.
+ * No production diagnostic consumer currently reads it.
+ * @internal Exported for tests only.
  */
 export function modelDefaultsLoadError() {
     return loadError;
@@ -164,7 +165,10 @@ export function defaultEffortOf(provider, model) {
     // breaks that model's resolution).
     return Object.prototype.hasOwnProperty.call(section, model) ? section[model] : undefined;
 }
-/** A detached snapshot for the RPC surface (render + diffing). */
+/**
+ * Detached snapshot for store assertions in tests; no production RPC uses it.
+ * @internal Exported for tests only.
+ */
 export function modelDefaultsSnapshot() {
     const result = {};
     for (const provider of PROVIDER_IDS) {

package/lib/provider-settings.d.ts

@@ -32,7 +32,8 @@ export declare class ProviderSettingsStore {
     constructor(path?: string);
     get(provider: ProviderId): ProviderPreferences;
     visible(provider: ProviderId, model: string): boolean;
-    contextWindow(model: string): number | undefined;
+    /** The user's local context-window override for one model; absent follows the provider. */
+    contextWindow(model: string, provider?: ProviderId): number | undefined;
     /** Creation-time policy survives restarts and never changes an existing session. */
     toolEnabled(provider: ProviderId, tool: SubscriptionTool, createdAt?: number): boolean;
     set(provider: ProviderId, input: unknown): Promise<void>;

package/lib/provider-settings.js

@@ -51,8 +51,9 @@ export function validatePreferences(provider, input) {
         result.visibleModels = [...new Set(raw.visibleModels)];
     }
     if (raw.contextWindows !== undefined) {
-        if (provider !== 'codex')
-            throw new Error('context window overrides are currently supported only for Codex');
+        if (provider !== 'codex' && provider !== 'claude') {
+            throw new Error('context window overrides are supported only for Codex and Claude');
+        }
         if (!raw.contextWindows || typeof raw.contextWindows !== 'object' || Array.isArray(raw.contextWindows)) {
             throw new Error('contextWindows must be a model-to-token map');
         }
@@ -110,8 +111,9 @@ export class ProviderSettingsStore {
     visible(provider, model) {
         return this.current.providers[provider]?.visibleModels?.includes(model) ?? true;
     }
-    contextWindow(model) {
-        const windows = this.current.providers.codex?.contextWindows;
+    /** The user's local context-window override for one model; absent follows the provider. */
+    contextWindow(model, provider = 'codex') {
+        const windows = this.current.providers[provider]?.contextWindows;
         return windows && Object.hasOwn(windows, model) ? windows[model] : undefined;
     }
     /** Creation-time policy survives restarts and never changes an existing session. */

package/lib/providers/antigravity.d.ts

@@ -60,8 +60,6 @@ export declare function isAntigravityPermanentRefreshError(error: unknown): bool
 export declare function fetchAntigravityModels(session: AntigravitySession, runtime?: AntigravityRuntimeConfig, fetchFn?: FetchFn, signal?: AbortSignal): Promise<DiscoveredModel[]>;
 /** Fetch plan and per-model quota windows when the upstream exposes them. */
 export declare function fetchAntigravityUsage(session: AntigravitySession, runtime?: AntigravityRuntimeConfig, fetchFn?: FetchFn, signal?: AbortSignal): Promise<ProviderUsage>;
-/** URL for either v1internal generation transport. */
-export declare function antigravityGenerateURL(baseURL: string | undefined, stream: boolean): string;
 /** Forward one already-built payload to generateContent or streamGenerateContent. */
 export declare function requestAntigravityContent(session: AntigravitySession, payload: AntigravityRequest, stream: boolean, runtime?: AntigravityRuntimeConfig, fetchFn?: FetchFn, signal?: AbortSignal): Promise<Response>;
 export interface AntigravityAdapterOptions {

package/lib/providers/antigravity.js

@@ -7,7 +7,7 @@ import { errorChain, EMPTY_RESPONSE_CODE, LlmAdapter, LlmError } from '@deepseek
 import { resolveImages } from '../translate/resolved.js';
 import { antigravityReasoning } from '../translate/antigravity-thinking.js';
 import { parseAntigravityResponse, streamAntigravity, toAntigravityRequest, } from '../translate/antigravity.js';
-import { httpLlmError, idleWatchdog, mapFetchFailure, mergeReasoning, ModelCatalogCache, discoverOrRetryAuth, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, discoverAcrossAccounts, isDiscoveryAborted, } from './common.js';
+import { httpLlmError, idleWatchdog, mapFetchFailure, mergeReasoning, ModelCatalogCache, discoverOrRetryAuth, isMissingOrInvalidCredential, parseProviderJson, oauthEndpointError, OAuthEndpointError, discoverAcrossAccounts, isDiscoveryAborted, } from './common.js';
 import { hostFetch } from '../http.js';
 import { ANTIGRAVITY_DEFAULT_CLIENT_ID, ANTIGRAVITY_DEFAULT_CLIENT_SECRET } from './antigravity-oauth-client.js';
 import { AccountTokenManager, DISCOVERY_TIMEOUT_MS, unionAccountCatalogs } from './accounts.js';
@@ -126,7 +126,7 @@ async function callInternal(method, body, accessToken, runtime, fetchFn, signal)
     }, runtime, fetchFn);
     if (!response.ok)
         throw await httpLlmError(response, `Antigravity ${method}`);
-    return response.json();
+    return parseProviderJson(response, `Antigravity ${method}`);
 }
 function projectIdOf(value) {
     if (typeof value === 'string' && value.length > 0)
@@ -217,7 +217,7 @@ export async function exchangeAntigravityCode(code, verifier, redirectUri, oauth
     });
     if (!response.ok)
         throw await oauthEndpointError(response, 'Antigravity');
-    const tokens = await response.json();
+    const tokens = await parseProviderJson(response, 'Antigravity token exchange');
     if (typeof tokens.access_token !== 'string')
         throw new Error('Antigravity token endpoint returned no access token');
     const account = await discoverAntigravityAccount(tokens.access_token, runtime, fetchFn);
@@ -238,7 +238,7 @@ export async function refreshAntigravity(session, oauth, fetchFn = hostFetch) {
     });
     if (!response.ok)
         throw await oauthEndpointError(response, 'Antigravity');
-    return sessionFromTokens(await response.json(), {
+    return sessionFromTokens(await parseProviderJson(response, 'Antigravity token refresh'), {
         projectId: session.projectId,
         ...session.account === undefined ? {} : { account: session.account },
         ...session.plan === undefined ? {} : { plan: session.plan },
@@ -313,10 +313,6 @@ export async function fetchAntigravityUsage(session, runtime = {}, fetchFn = hos
         ...displayPlan === undefined ? {} : { plan: displayPlan },
     };
 }
-/** URL for either v1internal generation transport. */
-export function antigravityGenerateURL(baseURL, stream) {
-    return `${antigravityBaseURL(baseURL)}/v1internal:${stream ? 'streamGenerateContent?alt=sse' : 'generateContent'}`;
-}
 /** Forward one already-built payload to generateContent or streamGenerateContent. */
 export async function requestAntigravityContent(session, payload, stream, runtime = {}, fetchFn = hostFetch, signal) {
     return fetchAntigravity(stream ? 'streamGenerateContent?alt=sse' : 'generateContent', {
@@ -511,6 +507,6 @@ export class AntigravityAdapter extends LlmAdapter {
         const response = await requestAntigravityContent(session, toAntigravityRequest(options, messages, session.projectId), false, this.options.runtime, this.options.fetchFn, options.signal);
         if (!response.ok)
             throw await httpLlmError(response, 'Antigravity API');
-        return parseAntigravityResponse(await response.json());
+        return parseAntigravityResponse(await parseProviderJson(response, 'Antigravity generateContent'));
     }
 }

package/lib/providers/claude.d.ts

@@ -127,6 +127,12 @@ export interface ClaudeAdapterOptions {
      * the provider's own default.
      */
     defaultEffortOf?: (model: string) => string | undefined;
+    /**
+     * The user's local context-window override for one model (the Settings
+     * editor). Returns undefined to follow the advertised window. The result
+     * is capped at that window: Anthropic advertises no separate maximum.
+     */
+    contextWindowOf?: (model: string) => number | undefined;
     /** Resolves the Claude Code version to present (npm-backed); absent means the local floor. */
     resolveCliVersion?: () => Promise<string>;
     /** Cache breakpoint lifetime; absent means the API's five-minute default. */
@@ -183,7 +189,14 @@ export declare class ClaudeAdapter extends LlmAdapter {
     listOwnModels(provider: string, account?: string, signal?: AbortSignal): Promise<readonly LlmModelInfo[]>;
     resolveModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
     /** Capability resolution of the provider's own models (the pool resolves members here). */
-    resolveOwnModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
+    resolveOwnModel(provider: string, model: string, account?: string): Promise<LlmResolvedModelInfo>;
+    /** The advertised window is both the default and the ceiling for a local override. */
+    private contextLimitsFor;
+    /** Account-specific bounds the Settings editor shows next to a model's override input. */
+    contextLimits(model: string, account?: string): Promise<{
+        default: number;
+        max: number;
+    }>;
     stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
     /** Pool seam: stream through one specific account instead of the default. */
     streamAccount(options: GenerateOptions, account: string): AsyncIterable<StreamChunk>;

package/lib/providers/claude.js

@@ -7,7 +7,7 @@ import { execFileSync } from 'node:child_process';
 import { EMPTY_RESPONSE_CODE, errorChain, LlmAdapter, LlmError, ReasoningEffortId } from '@deepseek-ai/dsh-llm';
 import { hostSupportsImageOffload, IMAGE_OFFLOAD_REQUIRED, requiredImageOffloadCount, resolveImages } from '../translate/resolved.js';
 import { markMessageCache, streamAnthropic, toAnthropicMessages, toAnthropicSystem, toAnthropicTools, } from '../translate/anthropic.js';
-import { httpLlmError, idleWatchdog, mapFetchFailure, mergeReasoning, ModelCatalogCache, discoverAcrossAccounts, discoverOrRetryAuth, isDiscoveryAborted, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, } from './common.js';
+import { httpLlmError, idleWatchdog, mapFetchFailure, mergeReasoning, ModelCatalogCache, discoverAcrossAccounts, discoverOrRetryAuth, isDiscoveryAborted, isMissingOrInvalidCredential, parseProviderJson, oauthEndpointError, OAuthEndpointError, } from './common.js';
 import { AccountTokenManager, DISCOVERY_TIMEOUT_MS, unionAccountCatalogs } from './accounts.js';
 import { hostFetch } from '../http.js';
 import { compareVersions } from './npm-cli-version.js';
@@ -212,7 +212,7 @@ export async function exchangeClaudeCode(code, verifier, redirectUri, state) {
     });
     if (!response.ok)
         throw await oauthEndpointError(response, 'claude');
-    return claudeSession(await response.json(), undefined, true);
+    return claudeSession(await parseProviderJson(response, 'claude token exchange'), undefined, true);
 }
 /**
  * Refresh a claude session (JSON grant echoing the issued scope).
@@ -232,7 +232,7 @@ export async function refreshClaude(session) {
     });
     if (!response.ok)
         throw await oauthEndpointError(response, 'claude');
-    const next = await claudeSession(await response.json(), session.refreshToken, false);
+    const next = await claudeSession(await parseProviderJson(response, 'claude token refresh'), session.refreshToken, false);
     return {
         ...next,
         ...session.emailAddress === undefined ? {} : { emailAddress: session.emailAddress },
@@ -398,7 +398,7 @@ export async function fetchClaudeUsage(session, fetchFn = hostFetch, signal, cli
     }
     if (!response.ok)
         throw await oauthEndpointError(response, 'claude usage');
-    const payload = await response.json();
+    const payload = await parseProviderJson(response, 'claude usage');
     const resetCredits = resetCreditsError === undefined ? claudeResetCredits(payload.cedar_ember, Date.now()) : undefined;
     const resets = {
         ...resetCredits === undefined ? {} : { resetCredits },
@@ -462,7 +462,7 @@ export async function fetchClaudeModels(session, fetchFn = hostFetch, signal, cl
     });
     if (!response.ok)
         throw await httpLlmError(response, 'claude models API');
-    const payload = await response.json();
+    const payload = await parseProviderJson(response, 'claude models API');
     if (!Array.isArray(payload.data)) {
         throw new Error('claude models API returned an invalid catalog');
     }
@@ -600,10 +600,14 @@ export class ClaudeAdapter extends LlmAdapter {
         }
         return cache;
     }
-    async discovered(model) {
+    async discovered(model, account) {
         if (!this.options.discovery)
             return undefined;
-        const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+        // A named account is looked up alone: its window must not be borrowed
+        // from another account's catalog.
+        const accounts = account === undefined
+            ? (await this.options.tokens.list()).map(entry => entry.key)
+            : [account];
         return discoverAcrossAccounts(accounts, async (account) => {
             const catalog = await this.catalogFor(account);
             const models = await catalog.resolve(() => this.fetchCatalog(account));
@@ -674,22 +678,30 @@ export class ClaudeAdapter extends LlmAdapter {
         return this.resolveOwnModel(provider, model);
     }
     /** Capability resolution of the provider's own models (the pool resolves members here). */
-    async resolveOwnModel(provider, model) {
-        const disc = await this.discovered(model);
+    async resolveOwnModel(provider, model, account) {
+        const disc = await this.discovered(model, account);
         const configured = this.options.models.find(entry => entry.id === model);
+        const limits = this.contextLimitsFor(disc, configured);
         const reasoning = mergeReasoning(this.options.defaultEffortOf?.(model), disc?.reasoning);
         return {
             provider,
             id: model,
             name: disc?.name ?? configured?.name ?? model,
             inputModalities: configured?.inputModalities ?? CLAUDE_MODALITIES,
-            context: {
-                contextWindow: disc?.contextWindow ?? configured?.contextWindow ?? CLAUDE_CONTEXT_WINDOW,
-            },
+            context: { contextWindow: Math.min(this.options.contextWindowOf?.(model) ?? limits.default, limits.max) },
             defaultMaxTokens: claudeMaxTokens(configured, disc),
             ...(reasoning === undefined ? {} : { reasoning }),
         };
     }
+    /** The advertised window is both the default and the ceiling for a local override. */
+    contextLimitsFor(disc, configured) {
+        const advertised = disc?.contextWindow ?? configured?.contextWindow ?? CLAUDE_CONTEXT_WINDOW;
+        return { default: advertised, max: advertised };
+    }
+    /** Account-specific bounds the Settings editor shows next to a model's override input. */
+    async contextLimits(model, account) {
+        return this.contextLimitsFor(await this.discovered(model, account), this.options.models.find(entry => entry.id === model));
+    }
     async *stream(options) {
         const pool = this.options.pool?.();
         if (pool !== undefined && await pool.owns(options.provider, options.model)) {
@@ -752,7 +764,7 @@ export class ClaudeAdapter extends LlmAdapter {
         if (hostSupportsImageOffload()) {
             const offloadImages = requiredImageOffloadCount(messages, CLAUDE_REQUEST_IMAGE_BUDGET);
             if (offloadImages > 0) {
-                // Older dsh-llm option types lack `offloadImages`; 0.2+ hosts read it.
+                // The supported 0.1.7-rc.2 floor reads `offloadImages`; older option types lack it.
                 throw new LlmError(`claude request images exceed the ${CLAUDE_REQUEST_IMAGE_BUDGET}-byte base64 budget; `
                     + `${offloadImages} more oldest image(s) must be offloaded`, IMAGE_OFFLOAD_REQUIRED, { offloadImages });
             }

package/lib/providers/codex-search.js

@@ -86,8 +86,11 @@ export class CodexWebSearchProvider {
             try {
                 return JSON.parse(text);
             }
-            catch (cause) {
-                throw new WebError('Codex Web Search returned invalid JSON', 'CODEX_SEARCH_RESPONSE', { cause });
+            catch {
+                // No cause: the host expands causes recursively, and Node's parse error
+                // quotes a bounded excerpt of the body, so attaching it would relocate
+                // the leak rather than remove it.
+                throw new WebError('Codex Web Search returned invalid JSON', 'CODEX_SEARCH_RESPONSE');
             }
         }
         throw new WebError('Codex Web Search exhausted its retry policy', 'CODEX_SEARCH_UPSTREAM');

package/lib/providers/codex.js

@@ -8,7 +8,7 @@ import { attributionHeaders, EMPTY_RESPONSE_CODE, errorChain, LlmAdapter, LlmErr
 import { decodeJwtPayload } from '../auth/jwt.js';
 import { resolveImages } from '../translate/resolved.js';
 import { streamResponses, toResponsesInput, toResponsesTools } from '../translate/responses.js';
-import { deterministicSessionId, effortDisplayName, httpLlmError, idleWatchdog, mapFetchFailure, mergeReasoning, ModelCatalogCache, discoverAcrossAccounts, discoverOrRetryAuth, isDiscoveryAborted, isDiscoveryAuthFailure, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, } from './common.js';
+import { deterministicSessionId, effortDisplayName, httpLlmError, idleWatchdog, mapFetchFailure, mergeReasoning, ModelCatalogCache, discoverAcrossAccounts, discoverOrRetryAuth, isDiscoveryAborted, isDiscoveryAuthFailure, isMissingOrInvalidCredential, parseProviderJson, oauthEndpointError, OAuthEndpointError, } from './common.js';
 import { AccountTokenManager, DISCOVERY_TIMEOUT_MS, unionAccountCatalogs } from './accounts.js';
 import { hostFetch } from '../http.js';
 import { DEFAULT_RATE_LIMIT_WAIT, DEFAULT_RETRY, jsonBody, resetFromFields, subscriptionRetryPolicy, } from './rate-limit.js';
@@ -185,7 +185,7 @@ export async function exchangeCodexCode(code, verifier, redirectUri) {
     });
     if (!response.ok)
         throw await oauthEndpointError(response, 'codex');
-    return codexSession(await response.json());
+    return codexSession(await parseProviderJson(response, 'codex token exchange'));
 }
 /**
  * Refresh a codex session (JSON grant — unlike the code exchange).
@@ -204,7 +204,7 @@ export async function refreshCodex(session) {
     });
     if (!response.ok)
         throw await oauthEndpointError(response, 'codex');
-    return codexSession(await response.json(), session);
+    return codexSession(await parseProviderJson(response, 'codex token refresh'), session);
 }
 /**
  * Whether a codex refresh failure means the login is permanently gone.
@@ -239,7 +239,7 @@ export async function fetchCodexResetCredits(session, fetchFn = hostFetch, signa
     });
     if (!response.ok)
         throw await oauthEndpointError(response, 'codex reset credits');
-    const payload = await response.json();
+    const payload = await parseProviderJson(response, 'codex reset credits');
     if (!Array.isArray(payload?.credits))
         throw new Error('codex reset credits: unexpected response (missing credits array)');
     return payload.credits.flatMap((value) => {
@@ -269,7 +269,7 @@ export async function consumeCodexResetCredit(session, creditId, requestId, fetc
     });
     if (!response.ok)
         throw await oauthEndpointError(response, 'codex consume reset');
-    const payload = await response.json();
+    const payload = await parseProviderJson(response, 'codex consume reset');
     if (payload?.code !== 'reset')
         throw new Error('Reset was not confirmed. Verify the account in Codex before retrying.');
 }
@@ -347,7 +347,7 @@ export async function fetchCodexUsage(session, fetchFn = hostFetch, signal) {
     });
     if (!response.ok)
         throw await oauthEndpointError(response, 'codex usage');
-    const payload = await response.json();
+    const payload = await parseProviderJson(response, 'codex usage');
     const windows = [];
     const primary = codexUsageWindow(payload.rate_limit?.primary_window, 'session');
     const secondary = codexUsageWindow(payload.rate_limit?.secondary_window, 'weekly');
@@ -410,7 +410,7 @@ export async function fetchCodexModels(session, fetchFn = hostFetch, signal, cli
     });
     if (!response.ok)
         throw await oauthEndpointError(response, 'codex models');
-    const payload = await response.json();
+    const payload = await parseProviderJson(response, 'codex models');
     if (!Array.isArray(payload.models))
         throw new Error('codex models endpoint returned no models array');
     const discovered = [];

package/lib/providers/common.d.ts

@@ -33,6 +33,26 @@ export interface ModelEntry {
  * @returns the validated entries.
  */
 export declare function validateModels(models: readonly ModelEntry[], label: string): ModelEntry[];
+/**
+ * Parse a provider response or stored JSON string without exposing input excerpts.
+ * Success returns the same JSON value; only SyntaxError is replaced, preserving
+ * parse-failure type checks and leaving body-read/abort failures unchanged.
+ * Node's Unexpected token errors include a bounded input excerpt. Do not retain
+ * the original error as cause: the host displays causes recursively.
+ * @param input - response to consume once, or JSON text to parse.
+ * @param origin - local endpoint/operation label; never response.url, a discovered
+ *   URL, a credential, or any other provider-controlled text.
+ * @returns the parsed value, without validation or credential filtering.
+ * @throws SyntaxError with the local origin and a fixed omission marker.
+ */
+export declare function parseProviderJson<T = unknown>(input: Response | string, origin: string): Promise<T>;
+/**
+ * Read a bounded JSON body; oversized or malformed payloads fail loudly.
+ * Bytes accumulate per chunk and the stream is cancelled past the cap, so
+ * the bound limits memory even when the body has no end; a declared
+ * over-cap `content-length` fails before the first read.
+ */
+export declare function readBoundedJson(response: Response, label: string, maxBytes: number): Promise<unknown>;
 /** Optional per-call hooks {@link httpLlmError} uses to read a rate-limit window. */
 export interface HttpLlmErrorOptions {
     /**
@@ -199,6 +219,13 @@ export interface UsageWindow {
     windowDurationMs?: number;
     /** Provider-verified fixed interval; permits deriving start from end and duration. */
     fixedWindow?: boolean;
+    /**
+     * Display-only start the reader assumed (kind or label based, clamped
+     * to now). The time marker may ride it; pace and color must never —
+     * it is not evidence of when the window opened. Mutually exclusive
+     * with `startsAt`.
+     */
+    displayStartsAt?: number;
 }
 /** One banked reset credit (Codex), or one grant containing resets (Claude). */
 export interface ResetCredit {

package/lib/providers/common.js

@@ -61,6 +61,76 @@ export function validateModels(models, label) {
 function providerDiagnostic(summary, hasBody) {
     return hasBody ? `${summary}: [provider response body omitted]` : summary;
 }
+/**
+ * Parse a provider response or stored JSON string without exposing input excerpts.
+ * Success returns the same JSON value; only SyntaxError is replaced, preserving
+ * parse-failure type checks and leaving body-read/abort failures unchanged.
+ * Node's Unexpected token errors include a bounded input excerpt. Do not retain
+ * the original error as cause: the host displays causes recursively.
+ * @param input - response to consume once, or JSON text to parse.
+ * @param origin - local endpoint/operation label; never response.url, a discovered
+ *   URL, a credential, or any other provider-controlled text.
+ * @returns the parsed value, without validation or credential filtering.
+ * @throws SyntaxError with the local origin and a fixed omission marker.
+ */
+export async function parseProviderJson(input, origin) {
+    try {
+        return (typeof input === 'string' ? JSON.parse(input) : await input.json());
+    }
+    catch (error) {
+        if (!(error instanceof SyntaxError))
+            throw error;
+        throw new SyntaxError(providerDiagnostic(`${origin}: invalid JSON`, true));
+    }
+}
+/**
+ * Read a bounded JSON body; oversized or malformed payloads fail loudly.
+ * Bytes accumulate per chunk and the stream is cancelled past the cap, so
+ * the bound limits memory even when the body has no end; a declared
+ * over-cap `content-length` fails before the first read.
+ */
+export async function readBoundedJson(response, label, maxBytes) {
+    const declared = Number(response.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > maxBytes) {
+        // Stop the socket too: the headers arrived, but the body must never flow.
+        await response.body?.cancel().catch(() => undefined);
+        throw new Error(`${label} response exceeds ${String(maxBytes)} bytes`);
+    }
+    if (response.body === null)
+        throw new Error(`${label} response has no body`);
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let bytes = 0;
+    let text = '';
+    try {
+        for (;;) {
+            const chunk = await reader.read();
+            if (chunk.done)
+                break;
+            bytes += chunk.value.byteLength;
+            if (bytes > maxBytes) {
+                // Cancel before throwing so the live stream does not linger behind
+                // a rejection the caller already stopped listening to.
+                await reader.cancel().catch(() => undefined);
+                throw new Error(`${label} response exceeds ${String(maxBytes)} bytes`);
+            }
+            text += decoder.decode(chunk.value, { stream: true });
+        }
+        text += decoder.decode();
+    }
+    finally {
+        try {
+            reader.releaseLock();
+        }
+        catch { /* best effort */ }
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error(`${label} response is not JSON`);
+    }
+}
 /**
  * Build an LlmError from a non-2xx provider response, mapping the status to a
  * stable code and, for a rate-limited request, the disclosed reset instant to

package/lib/providers/copilot.js

@@ -17,7 +17,7 @@ import { EMPTY_RESPONSE_CODE, errorChain, LlmAdapter, LlmError, ReasoningEffortI
 import { resolveImages } from '../translate/resolved.js';
 import { streamChatCompletions, toChatMessages, toChatTools, } from '../translate/chat-completions.js';
 import { streamResponses, toResponsesInput, toResponsesTools } from '../translate/responses.js';
-import { httpLlmError, idleWatchdog, mapFetchFailure, mergeReasoning, ModelCatalogCache, discoverAcrossAccounts, discoverOrRetryAuth, isDiscoveryAborted, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, } from './common.js';
+import { httpLlmError, idleWatchdog, mapFetchFailure, mergeReasoning, ModelCatalogCache, discoverAcrossAccounts, discoverOrRetryAuth, isDiscoveryAborted, isMissingOrInvalidCredential, parseProviderJson, oauthEndpointError, OAuthEndpointError, } from './common.js';
 import { AccountTokenManager, DISCOVERY_TIMEOUT_MS, unionAccountCatalogs } from './accounts.js';
 import { hostFetch } from '../http.js';
 import { DEFAULT_RATE_LIMIT_WAIT, DEFAULT_RETRY, subscriptionRetryPolicy, } from './rate-limit.js';
@@ -144,7 +144,7 @@ export async function exchangeCopilotToken(githubToken, fetchFn = hostFetch) {
     });
     if (!response.ok)
         throw await oauthEndpointError(response, 'copilot');
-    const wire = await response.json();
+    const wire = await parseProviderJson(response, 'copilot token exchange');
     if (typeof wire.token !== 'string' || wire.token.length === 0) {
         throw new Error('copilot token endpoint returned no token');
     }
@@ -268,7 +268,7 @@ export async function fetchCopilotModels(session, fetchFn = hostFetch, signal) {
     });
     if (!response.ok)
         throw await oauthEndpointError(response, 'copilot models');
-    const payload = await response.json();
+    const payload = await parseProviderJson(response, 'copilot models');
     if (!Array.isArray(payload.data))
         throw new Error('copilot models endpoint returned no data array');
     const seen = new Set();

package/lib/providers/cursor-adapter.d.ts

@@ -5,8 +5,43 @@ import { CursorAdapter } from 'dsh-subscriptions/cursor-transport';
  * blocks. DSH 0.1.7 carries them as first-class role=tool messages instead.
  */
 export declare function projectCursorMessages(messages: GenerateOptions['messages']): unknown[];
+/**
+ * Cursor adapter for the DSH host.
+ *
+ * Failure text contract: `finish/error` messages that originate from the
+ * vendor stream and can quote provider-controlled text (the response content
+ * type, trailers, end-stream errors, a frame-reader or other error whose message
+ * is not one of the literals below, and a transport-coded failure that is not a
+ * socket-layer error) are replaced by `<code> [provider response text omitted]`. Failures that are
+ * wholly local keep their own message and code:
+ *
+ * - anything the auth service threw (not signed in, sign-in expired, token
+ *   refresh status), and a host attachment read failure;
+ * - the vendor's own request validation, by code (`UNSUPPORTED_OPTION`,
+ *   `UNSUPPORTED_CONTENT`, `TOOL_LIMIT`);
+ * - the vendor's fixed-literal plain errors, by exact message: the HTTP status
+ *   (`Cursor agent returned HTTP 429`), the response, idle and progress
+ *   timeouts, a closed bridge or stream, an unreadable compressed frame, and
+ *   an invalid Cursor setting;
+ * - a network error raised by the operating system (`ECONNREFUSED`,
+ *   `ENOTFOUND`, ...), recognised from the thrown error's own code, not from
+ *   the vendor's classification.
+ *
+ * Not a provider-origin class: a network error such as `ECONNREFUSED` is a
+ * local failure (no network, daemon down, DNS), and is kept. What is still
+ * replaced although it is probably local is a transport failure with no
+ * socket-layer errno: a TLS or certificate failure and an HTTP/2 protocol
+ * error. The vendor's `TRANSPORT` code cannot decide those, because
+ * `classifyCursorError` derives it from message text (`network`, `connection`,
+ * `socket`, `fetch`, `ECONN`, `http2`) and a provider's end-stream message or
+ * `grpc-message` can contain any of them; so the code is never trusted alone.
+ * Telling these apart would need a check on the thrown error object, as the
+ * errno check above does, extended to the TLS and HTTP/2 error codes. That is
+ * not done here and is not verified.
+ */
 export declare class CursorCompatAdapter extends CursorAdapter {
     private readonly visibleModels;
+    private readonly localFailures;
     constructor(options: ConstructorParameters<typeof CursorAdapter>[0] & {
         visibleModels?: () => readonly string[] | undefined;
     });