dsh-xdpool 2.5.0 → 2.6.0

package/lib/index.js

@@ -3,7 +3,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import crypto, { createDecipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { appendFileSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, truncateSync, writeFileSync } from "node:fs";
-import { mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { execFile, execFileSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -15,6 +15,15 @@ import { env } from "node:process";
 import http, { createServer, request } from "node:http";
 import https, { request as request$1 } from "node:https";
 import { Readable, Transform } from "node:stream";
+//#region src/credit-reserve.ts
+/** Build a merge-safe reserve update. Zero overrides inherited/previous floors. */
+function creditReservesWith(current, accountId, reserve) {
+	return {
+		...current,
+		[accountId]: reserve
+	};
+}
+//#endregion
 //#region src/badges.ts
 /**
 * Promotion badges the upstream attaches to a model.
@@ -159,24 +168,53 @@ function isAbortError(error) {
 }
 /** Cap on the reassembled compaction reply, guarding against a runaway stream. */
 const COMPLETION_TEXT_LIMIT = 65536;
-/** Insufficient-credit markers, ASCII lowercase plus the original Chinese. */
+/**
+* Insufficient-credit markers, ASCII lowercase plus the original Chinese.
+*
+* The PLURAL forms are listed separately on purpose: this table is matched with
+* `includes`, so `'credits exhausted'.includes('credit exhausted')` is false.
+* The gateway's own 14018 message is `Credits exhausted.` — plural — which
+* therefore matched nothing, fell through to `soft_rate`, and cooled the account
+* and rotated instead of parking it. A rate-limit cooldown on a drained account
+* means every model on it keeps being retried and keeps failing (#from the
+* connect-workbuddy cross-check).
+*/
 const HARD_CREDIT_MARKERS = [
 	"insufficient credit",
+	"insufficient credits",
 	"no credit",
+	"no credits",
 	"credit exhausted",
+	"credits exhausted",
+	"credit exhausted.",
 	"out of credit",
+	"out of credits",
 	"quota exceeded",
 	"quota exhaust",
+	"quota exhausted",
 	"payment required",
 	"credit not enough",
+	"credits not enough",
 	"not enough credit",
+	"not enough credits",
 	"积分不足",
 	"额度不足",
 	"余额不足",
 	"积分用完",
 	"额度用尽",
-	"没有积分"
+	"没有积分",
+	"额度耗尽",
+	"积分耗尽"
 ];
+/**
+* Business codes that mean "this account cannot pay", independent of wording.
+*
+* `14018` is the gateway's credits-exhausted code; the number survived several
+* rewordings of the sentence around it, so matching it is steadier than matching
+* prose. Read from the body rather than from the HTTP status because the gateway
+* answers these inside a 200 or a 4xx envelope.
+*/
+const HARD_CREDIT_CODES = ["14018", "14003"];
 /** Session-invalidation markers that mean "this credential is dead; use another".
 *  Kept alongside the HTTP-status rule in `classifyUpstreamError`: the status is
 *  enough for a direct 401/403, but some failures arrive wrapped in a 200
@@ -421,7 +459,10 @@ const CHAT_IDENTITY_HEADERS = Object.freeze({
 const BANNED_SYSTEM_PHRASES = Object.freeze([
 	[/powered by DeepSeek Harness/gi, "running on DeepSeek Harness"],
 	[/DeepSeek Harness Web GUI/gi, "DeepSeek Harness web interface"],
-	[/Relative paths resolve from the workspace root/gi, "Relative paths are resolved against the workspace root"]
+	[/Relative paths resolve from the workspace root/gi, "Relative paths are resolved against the workspace root"],
+	[/You are a coding agent running in the Codex CLI, a terminal-based coding assistant/gi, "You are a coding agent running in this environment, a terminal-based coding assistant"],
+	[/You are a coding agent running in the Codex CLI/gi, "You are a coding agent running in this environment"],
+	[/Codex CLI is an open source project led by OpenAI/gi, "This coding agent is an open source project"]
 ]);
 /**
 * Rewrite fingerprinted system/assistant content, leaving everything else
@@ -731,6 +772,7 @@ function classifyUpstreamError(status, body) {
 	if (status === 402) return "hard_credit";
 	if (status === 401 || status === 403) return "session_dead";
 	const lower = body.toLowerCase();
+	for (const code of HARD_CREDIT_CODES) if (body.includes(`"code":${code}`) || body.includes(`"code": ${code}`) || body.includes(`"code":"${code}"`)) return "hard_credit";
 	for (const marker of HARD_CREDIT_MARKERS) if (lower.includes(marker.toLowerCase()) || body.includes(marker)) return "hard_credit";
 	for (const marker of SESSION_DEAD_MARKERS) if (body.includes(marker)) return "session_dead";
 	if (status === 429) return "soft_rate";
@@ -1153,7 +1195,8 @@ function parseTask(value) {
 		status: typeof raw["status"] === "string" ? raw["status"] : "",
 		claimable: !claimed && target > 0 && current >= target,
 		claimed,
-		locked: raw["locked"] === true
+		locked: raw["locked"] === true,
+		jumpUrl: typeof raw["jump_url"] === "string" ? raw["jump_url"] : ""
 	};
 }
 var WorkBuddyUpstreamClient = class {
@@ -2255,6 +2298,92 @@ var WorkBuddyUpstreamClient = class {
 	}
 };
 //#endregion
+//#region src/file-perms.ts
+/**
+* Write a file that holds credentials, without leaving it world-readable.
+*
+* Every credential this plugin keeps on disk — the durable account list, the
+* ignore list, any mirrored balance — travelled through a plain `writeFile` with
+* the process umask as the only protection. On a POSIX host that typically means
+* `0644`: readable by every other user on the machine, and these files carry
+* `accessToken` / `refreshToken` verbatim.
+*
+* Two rules, and the order matters:
+*
+* 1. **Create, don't patch.** `mode` on `writeFile` only applies when the file is
+*    created. The atomic-write pattern already writes a fresh temp file and
+*    renames it over the target, so the temp is created with `0600` and the
+*    rename carries that permission to the destination. Chmod'ing afterwards
+*    would also work but leaves a window where the file exists with the old
+*    mode.
+* 2. **Still chmod best-effort.** A file written by an older version already
+*    exists with `0644`; the rename replaces the inode, so rule 1 covers it —
+*    but a host that keeps the target in place (or a future caller that writes
+*    directly) would not be covered, and `chmod` is cheap.
+*
+* WINDOWS: `mode` is ignored by Node on win32, and there is no ACL equivalent in
+* the standard library. The honest statement is what actually protects these
+* files there: they live under the user's own profile (%USERPROFILE%, %LOCALAPPDATA%),
+* whose inherited ACL excludes other standard users by default. Calling `icacls`
+* per write would spawn a process on every balance update to re-apply a
+* protection the parent directory already provides, so this module does not. A
+* profile relocated to a shared directory is outside what this code can detect —
+* the README says where the files live so the user can check.
+*
+* @module dsh-xdpool/file-perms
+*/
+/** Owner-only, for a file that holds a secret. */
+const SECRET_FILE_MODE = 384;
+/** Owner-only, for the directory that holds them. */
+const SECRET_DIR_MODE = 448;
+/**
+* True on a platform where POSIX modes are meaningful.
+*
+* Computed through a `typeof process` guard rather than read straight off the
+* global: this module is host-only in intent, but `store.ts` imports it and the
+* browser bundle imports `store.ts` for its row types, so the module body DOES
+* get bundled for the browser. A bare `process.platform` there throws
+* `ReferenceError: process is not defined` at first render — and it is the kind
+* of failure that only shows up in the packaged app.
+*/
+const POSIX = typeof process === "undefined" ? false : process.platform !== "win32";
+/**
+* Create the directory a secret lives in, owner-only.
+*
+* `recursive` so a fresh install works, and the mode applies to every directory
+* this call creates. An existing directory keeps its mode — `mkdir` does not
+* change what is already there — so `chmod` runs too, best-effort: tightening a
+* directory that a previous version created permissively is exactly the case
+* worth fixing, and a failure is not worth aborting a save over.
+*/
+async function ensureSecretDir(dir) {
+	await mkdir(dir, {
+		recursive: true,
+		...POSIX ? { mode: SECRET_DIR_MODE } : {}
+	});
+	if (!POSIX) return;
+	try {
+		await chmod(dir, SECRET_DIR_MODE);
+	} catch {}
+}
+/**
+* Write `contents` to `path` with owner-only permissions.
+*
+* Not atomic on its own — callers that need the crash-safe temp+rename dance keep
+* doing it and just route the temp write through here, which is why the mode is
+* applied at creation: the rename then carries it to the final file.
+*/
+async function writeSecretFile(path, contents) {
+	await writeFile(path, contents, POSIX ? {
+		encoding: "utf8",
+		mode: SECRET_FILE_MODE
+	} : "utf8");
+	if (!POSIX) return;
+	try {
+		await chmod(path, SECRET_FILE_MODE);
+	} catch {}
+}
+//#endregion
 //#region src/ignored.ts
 /**
 * The permanent ignore list: accounts the user has thrown out of the pool.
@@ -2371,9 +2500,9 @@ async function writeIgnoredAccounts(accounts, path = ignoredIdsPath()) {
 		version: 1,
 		accounts
 	}, null, 2);
-	await mkdir(dirname(path), { recursive: true });
+	await ensureSecretDir(dirname(path));
 	const temp = `${path}.tmp`;
-	await writeFile(temp, `${payload}\n`, "utf8");
+	await writeSecretFile(temp, `${payload}\n`);
 	await rename(temp, path);
 }
 /**
@@ -2499,9 +2628,9 @@ async function saveStoredAccounts(path, accounts) {
 		version: 1,
 		accounts: stored
 	}, null, 2) + "\n";
-	await mkdir(join(path, ".."), { recursive: true });
+	await ensureSecretDir(join(path, ".."));
 	const tmp = `${path}.tmp`;
-	await writeFile(tmp, document, "utf8");
+	await writeSecretFile(tmp, document);
 	await rename(tmp, path);
 }
 //#endregion
@@ -3265,16 +3394,20 @@ function parseWorkBuddyAuth(text, sourcePath, decrypt) {
 	const refreshExpiresAtMs = typeof auth["refreshExpiresAt"] === "number" ? expiryToMs$1(auth["refreshExpiresAt"]) : void 0;
 	if (refreshExpiresAtMs !== void 0 && refreshExpiresAtMs > 0 && refreshExpiresAtMs < Date.now()) return;
 	const lastRefreshAtMs = typeof auth["lastRefreshTime"] === "number" ? expiryToMs$1(auth["lastRefreshTime"]) : void 0;
+	const nickname = optionalString(decryptableString(identity["nickname"], decrypt).value);
+	const uin = optionalString(identity["uin"]);
+	const uid = optionalString(identity["uid"]);
+	const enterpriseId = optionalString(identity["enterpriseId"]);
 	return {
 		accessToken,
 		refreshToken: decryptableString(auth["refreshToken"], decrypt).value,
 		expiresAtMs: typeof auth["expiresAt"] === "number" ? expiryToMs$1(auth["expiresAt"]) : 0,
 		...refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs },
 		...lastRefreshAtMs === void 0 ? {} : { lastRefreshAtMs },
-		...optionalString(decryptableString(identity["nickname"], decrypt).value) === void 0 ? {} : { nickname: optionalString(decryptableString(identity["nickname"], decrypt).value) },
-		...optionalString(identity["uin"]) === void 0 ? {} : { uin: optionalString(identity["uin"]) },
-		...optionalString(identity["uid"]) === void 0 ? {} : { uid: optionalString(identity["uid"]) },
-		...optionalString(identity["enterpriseId"]) === void 0 ? {} : { enterpriseId: optionalString(identity["enterpriseId"]) },
+		...nickname === void 0 ? {} : { nickname },
+		...uin === void 0 ? {} : { uin },
+		...uid === void 0 ? {} : { uid },
+		...enterpriseId === void 0 ? {} : { enterpriseId },
 		domain: typeof auth["domain"] === "string" ? auth["domain"] : "",
 		sourcePath
 	};
@@ -3619,6 +3752,16 @@ var WorkBuddyAccountPool = class {
 	*/
 	disabledIds = /* @__PURE__ */ new Set();
 	/**
+	* The account ids the store held after the last successful write.
+	*
+	* Read back on the next scan to say WHICH accounts left, not just how many.
+	* The list is written wholesale, so a scan that does not find an account
+	* deletes it — and that account's credential is then unrecoverable without a
+	* fresh sign-in (#117). `undefined` until the first write, so the first scan
+	* never reports every account as "leave".
+	*/
+	lastPersistedIds;
+	/**
 	* Account ids the user threw out of the pool for good.
 	*
 	* Enforced BEFORE the credential is parsed: `scan()` skips a file whose
@@ -3695,6 +3838,11 @@ var WorkBuddyAccountPool = class {
 	* A function rather than a list because that pool is mounted asynchronously
 	* and can be re-read on demand; `undefined` means "no such source", which is
 	* the state every test and every pre-mount startup is in.
+	*
+	* The `| undefined` is explicit because `applyExternalSource` CLEARS the field by
+	* assigning `undefined` — under `exactOptionalPropertyTypes` a bare `?:` means
+	* "may be absent, never undefined", which made that documented clearing action
+	* a type error.
 	*/
 	externalSource;
 	constructor(options = {}) {
@@ -3800,9 +3948,10 @@ var WorkBuddyAccountPool = class {
 		}
 		const byId = /* @__PURE__ */ new Map();
 		for (const account of this.accounts) byId.set(account.id, account);
-		if (this.persistent && this.accounts.length === 0) {
+		if (this.persistent) {
 			const stored = await loadStoredAccounts(this.storePath);
 			for (const entry of stored) {
+				if (this.ignoredIds.size > 0 && this.ignoredIds.has(entry.id)) continue;
 				if (byId.has(entry.id)) continue;
 				byId.set(entry.id, {
 					id: entry.id,
@@ -3852,7 +4001,10 @@ var WorkBuddyAccountPool = class {
 		this.accounts = ordered;
 		this.lastScanAtMs = Date.now();
 		if (this.persistent) try {
+			const leaving = this.lastPersistedIds === void 0 ? [] : [...this.lastPersistedIds].filter((id) => !this.accounts.some((account) => account.id === id));
+			if (leaving.length > 0) this.logger?.warn?.(`dsh-xdpool: ${String(leaving.length)} account(s) are no longer in the pool after a rescan and were removed from the store: ${leaving.join(", ")}. Their credentials are gone unless they are signed in again.`);
 			await saveStoredAccounts(this.storePath, this.accounts);
+			this.lastPersistedIds = new Set(this.accounts.map((account) => account.id));
 		} catch (error) {
 			this.logger?.warn?.("dsh-xdpool: could not persist the account store", error);
 		}
@@ -3872,11 +4024,11 @@ var WorkBuddyAccountPool = class {
 	* model id the legacy account-wide check applies (callers that cannot name a
 	* model, e.g. CLI diagnostics).
 	*/
-	available(now, modelId, region) {
+	available(now, modelId, region, reserveExempt) {
 		return this.accounts.filter((account) => {
 			if (this.disabledIds.has(account.id)) return false;
 			const reserve = this.creditReserves.get(account.id);
-			if (reserve !== void 0 && reserve > 0) {
+			if (!reserveExempt?.has(account.id) && reserve !== void 0 && reserve > 0) {
 				const balance = this.creditBalances.get(account.id);
 				if (balance !== void 0 && balance <= reserve) return false;
 			}
@@ -3900,7 +4052,7 @@ var WorkBuddyAccountPool = class {
 	* Counts are over the region's accounts, since a provider only ever sees its
 	* own gateway.
 	*/
-	unavailableReason(modelId, region) {
+	unavailableReason(modelId, region, reserveExempt) {
 		const now = Date.now();
 		const inRegion = this.accounts.filter((account) => region === void 0 || regionOf(account.credential.domain) === region);
 		if (inRegion.length === 0) return {
@@ -3913,6 +4065,29 @@ var WorkBuddyAccountPool = class {
 		let cooling = 0;
 		let disabled = 0;
 		let dead = 0;
+		/**
+		* Accounts that survived every OTHER filter and are held back only by their
+		* credit floor.
+		*
+		* Counted rather than returned on the first hit. The old `return` fired the
+		* moment it met one reserved account, so a single account parked under its
+		* floor reported `reserve` for the whole gateway — even while four other
+		* accounts were healthy and had just been tried. The caller turns
+		* `reason === 'reserve'` into a 402 telling the user to lower the reserve,
+		* which pointed at a setting that was not the problem (#98: a five-account
+		* pool reported `reserve_floor` because of one account that had sat below
+		* its floor for weeks, while the actual state was "the rest are cooling").
+		*/
+		let reserved = 0;
+		/**
+		* Accounts that reached the end of the walk unblocked.
+		*
+		* Non-zero means the pool still has somewhere to send a request, so a
+		* reserve is NOT what this answer is about: editing a number cannot fix a
+		* request that some other account is already able to serve, and saying
+		* otherwise sends the reader to the wrong setting.
+		*/
+		let usable = 0;
 		for (const account of inRegion) {
 			if (this.disabledIds.has(account.id)) {
 				disabled += 1;
@@ -3928,16 +4103,14 @@ var WorkBuddyAccountPool = class {
 				continue;
 			}
 			const reserve = this.creditReserves.get(account.id);
-			if (reserve !== void 0 && reserve > 0) {
+			if (!reserveExempt?.has(account.id) && reserve !== void 0 && reserve > 0) {
 				const balance = this.creditBalances.get(account.id);
-				if (balance !== void 0 && balance <= reserve) return {
-					total: inRegion.length,
-					cooling,
-					disabled,
-					dead,
-					reason: "reserve"
-				};
+				if (balance !== void 0 && balance <= reserve) {
+					reserved += 1;
+					continue;
+				}
 			}
+			usable += 1;
 		}
 		if (dead > 0) return {
 			total: inRegion.length,
@@ -3960,6 +4133,13 @@ var WorkBuddyAccountPool = class {
 			dead,
 			reason: "disabled"
 		};
+		if (usable === 0 && reserved > 0) return {
+			total: inRegion.length,
+			cooling,
+			disabled,
+			dead,
+			reason: "reserve"
+		};
 		return {
 			total: inRegion.length,
 			cooling,
@@ -4136,16 +4316,18 @@ var WorkBuddyAccountPool = class {
 	* Scans on first use, and rescans when every known account is cooling down: a
 	* fresh desktop login is the usual way out of an exhausted pool.
 	*
+	* `reserveExempt` is host-only: account ids whose own credentials freshly
+	* confirmed a zero-credit model. It never bypasses disabled, dead credentials, cooldowns or region.
 	* `conversationKey` is only consulted under `sticky`; other modes ignore it.
 	*/
-	async acquire(modelId, region, conversationKey) {
+	async acquire(modelId, region, conversationKey, reserveExempt) {
 		if (this.accounts.length === 0) await this.scan();
 		const maxTries = this.accounts.length + 1;
 		for (let attempt = 0; attempt < maxTries; attempt += 1) {
-			let pool = this.available(Date.now(), modelId, region);
+			let pool = this.available(Date.now(), modelId, region, reserveExempt);
 			if (pool.length === 0 && attempt === 0) {
 				await this.scan();
-				pool = this.available(Date.now(), modelId, region);
+				pool = this.available(Date.now(), modelId, region, reserveExempt);
 			}
 			if (pool.length === 0) return void 0;
 			if (this.preferredAccountId !== void 0) {
@@ -4338,6 +4520,43 @@ var WorkBuddyAccountPool = class {
 		return this.accounts.filter((account) => (account.credentialDeadUntilMs ?? 0) > now);
 	}
 	/**
+	* Try to bring benched accounts back WITHOUT waiting out the cooldown.
+	*
+	* The cooldown is a guess about how long a problem lasts, and the guess is
+	* usually wrong in one direction or the other: a token revoked by a password
+	* change stays dead for the full window even after the user signs in again in
+	* some other client, and a transient upstream hiccup benches a perfectly good
+	* account for half an hour.
+	*
+	* So instead of only waiting, ask. For each benched account, one cheap
+	* authenticated read: if it answers, the credential works and the account goes
+	* back into rotation immediately. Nothing about the failure is trusted — only a
+	* successful call clears it — and a probe that fails keeps the original
+	* cooldown untouched (probing must never EXTEND a bench, or a broken endpoint
+	* would keep every account locked out for as long as it stayed broken).
+	*
+	* `probe` is injected rather than imported so this class stays free of the
+	* upstream client: the pool knows about accounts, not about HTTP.
+	*
+	* Returns the accounts it revived, for logging and for the run summary.
+	*/
+	async reviveBenched(probe) {
+		const benched = this.deadCredentials();
+		if (benched.length === 0) return [];
+		const revived = [];
+		for (const account of benched) {
+			try {
+				await probe(account.credential);
+			} catch {
+				continue;
+			}
+			this.clearCredentialDead(account.id);
+			revived.push(account);
+			this.logger?.info?.(`dsh-xdpool: ${account.label} answered a probe; back in rotation without waiting out the cooldown`);
+		}
+		return revived;
+	}
+	/**
 	* Refresh the account's access token when it is within the margin (or already
 	* expired), in-flight de-duped per account. A failed refresh keeps the
 	* existing token when it has not yet expired, so an unreachable refresh
@@ -4484,8 +4703,23 @@ ${new Date(until).toISOString()}
 * (`kimi-k3-1`). A stale fallback is worse than a short one — it looks
 * authoritative while being wrong.
 *
-* `multiplier: 0` is the gateways' own spelling of "free" (`credits: "x0.00"`),
-* which is what turns on the free badge.
+* NO PRICES AND NO PROMO BADGES HERE. This table is what the picker shows when
+* the startup fetch fails, and a multiplier captured months ago is a price the
+* user will budget against while it is quietly wrong. Two specific harms:
+*
+*   - `multiplier: 0` renders the "free" badge, so a model that was free at
+*     capture time keeps claiming to be free after the promotion ends;
+*   - a non-zero multiplier renders next to the model, so a stale figure reads
+*     as the current rate.
+*
+* `undefined` is the honest state: the card prints no rate and no badge, which
+* is exactly true — this build does not know the price. The live fetch fills
+* both in within a second of a working startup, and `catalogSource` already
+* tells the card to say the list is the built-in one.
+*
+* Windows, output ceilings and the `craft` capability tag stay: those are
+* properties of the model, not of a campaign, and they are what makes the list
+* usable offline at all.
 */
 const FALLBACK_WORKBUDDY_MODELS = [
 	{
@@ -4502,8 +4736,7 @@ const FALLBACK_WORKBUDDY_MODELS = [
 		contextWindow: 96e4,
 		maxOutputTokens: 64e3,
 		supportsImages: true,
-		multiplier: .29,
-		tags: ["craft", "badge:夜间免费:#FF0000"]
+		tags: ["craft"]
 	},
 	{
 		id: "hy3",
@@ -4511,40 +4744,35 @@ const FALLBACK_WORKBUDDY_MODELS = [
 		contextWindow: 192e3,
 		maxOutputTokens: 64e3,
 		supportsImages: true,
-		multiplier: 0,
-		tags: ["craft", "badge:限时免费:#FF0000"]
+		tags: ["craft"]
 	},
 	{
 		id: "hy3-x",
 		name: "Hy3",
 		contextWindow: 192e3,
 		maxOutputTokens: 64e3,
-		supportsImages: true,
-		multiplier: .05
+		supportsImages: true
 	},
 	{
 		id: "space-bunny",
 		name: "Space-Bunny",
 		contextWindow: 1e6,
 		maxOutputTokens: 64e3,
-		supportsImages: true,
-		multiplier: .08
+		supportsImages: true
 	},
 	{
 		id: "deepseek-v4.1-flash",
 		name: "Deepseek-V4.1-Flash",
 		contextWindow: 1e6,
 		maxOutputTokens: 128e3,
-		supportsImages: true,
-		multiplier: .11
+		supportsImages: true
 	},
 	{
 		id: "deepseek-v4-pro",
 		name: "Deepseek-V4-Pro",
 		contextWindow: 1e6,
 		maxOutputTokens: 128e3,
-		supportsImages: true,
-		multiplier: .51
+		supportsImages: true
 	},
 	{
 		id: "deepseek-v4-flash",
@@ -4558,16 +4786,14 @@ const FALLBACK_WORKBUDDY_MODELS = [
 		name: "GLM-5.3",
 		contextWindow: 1e6,
 		maxOutputTokens: 64e3,
-		supportsImages: true,
-		multiplier: .79
+		supportsImages: true
 	},
 	{
 		id: "glm-5.3-flash",
 		name: "GLM-5.3-Flash",
 		contextWindow: 1e6,
 		maxOutputTokens: 131072,
-		supportsImages: true,
-		multiplier: .06
+		supportsImages: true
 	},
 	{
 		id: "glm-5.2",
@@ -4575,64 +4801,56 @@ const FALLBACK_WORKBUDDY_MODELS = [
 		contextWindow: 1e6,
 		maxOutputTokens: 64e3,
 		supportsImages: true,
-		multiplier: .79,
-		tags: ["craft", "badge:夜间折扣:#1E90FF"]
+		tags: ["craft"]
 	},
 	{
 		id: "glm-5.1",
 		name: "GLM-5.1",
 		contextWindow: 2e5,
 		maxOutputTokens: 48e3,
-		supportsImages: false,
-		multiplier: .79
+		supportsImages: false
 	},
 	{
 		id: "glm-5v-turbo",
 		name: "GLM-5v-Turbo",
 		contextWindow: 2e5,
 		maxOutputTokens: 64e3,
-		supportsImages: true,
-		multiplier: .71
+		supportsImages: true
 	},
 	{
 		id: "kimi-k3-1",
 		name: "Kimi-K3",
 		contextWindow: 1e6,
 		maxOutputTokens: 32e3,
-		supportsImages: true,
-		multiplier: 1.62
+		supportsImages: true
 	},
 	{
 		id: "kimi-k2.8-preview",
 		name: "Kimi-K2.8-Preview",
 		contextWindow: 1e6,
 		maxOutputTokens: 64e3,
-		supportsImages: true,
-		multiplier: .77
+		supportsImages: true
 	},
 	{
 		id: "kimi-k2.7",
 		name: "Kimi-K2.7-Code",
 		contextWindow: 256e3,
 		maxOutputTokens: 32e3,
-		supportsImages: true,
-		multiplier: .57
+		supportsImages: true
 	},
 	{
 		id: "kimi-k2.6",
 		name: "Kimi-K2.6",
 		contextWindow: 256e3,
 		maxOutputTokens: 32e3,
-		supportsImages: true,
-		multiplier: .52
+		supportsImages: true
 	},
 	{
 		id: "minimax-m3",
 		name: "MiniMax-M3",
 		contextWindow: 512e3,
 		maxOutputTokens: 64e3,
-		supportsImages: true,
-		multiplier: .25
+		supportsImages: true
 	}
 ];
 /**
@@ -4705,11 +4923,24 @@ var WorkBuddyCatalog = class {
 	}
 	/**
 	* The models DSH should actually offer, after applying the user's selection:
-	* disabled models are dropped, an explicit image list overrides the upstream
-	* capability flag, and a per-model budget caps the advertised window.
+	* disabled models are dropped, an explicit image list decides image support,
+	* and a per-model budget caps the advertised window.
 	*
 	* An absent `enabledModelIds` means "everything" — a fresh install with no
 	* saved selection must not present an empty picker.
+	*
+	* IMAGE SUPPORT IS THE USER'S SET, NOT AN OR. The upstream flag is `true` for
+	* essentially every model of this vendor (measured: 15 of 16 on CN, 23 of 23
+	* on international), so `supportsImages || imageSet.has(id)` could only ever
+	* turn the flag ON — un-ticking the box in the card changed nothing, and the
+	* adapter kept advertising `['text','image']`. The checkbox existed and did
+	* not work, which is worse than not offering it.
+	*
+	* So when the user HAS saved an image selection, that set is the answer, in
+	* both directions. When they have not (undefined — a fresh install, or a
+	* config written before this fix), the upstream capability stands: silently
+	* disabling image input for everyone who never touched the switch would be a
+	* regression, and the absent case is exactly "no opinion".
 	*/
 	visible() {
 		const enabled = this.selection.enabledModelIds;
@@ -4719,7 +4950,7 @@ var WorkBuddyCatalog = class {
 		const budgets = this.selection.contextBudgets;
 		return this.models.filter((model) => allow === void 0 || allow.has(model.id)).map((model) => {
 			const next = { ...model };
-			if (imageSet !== void 0) next.supportsImages = next.supportsImages || imageSet.has(model.id);
+			if (imageSet !== void 0) next.supportsImages = imageSet.has(model.id);
 			const budget = budgets?.[model.id];
 			if (budget !== void 0 && budget > 0 && budget < next.contextWindow) next.contextWindow = budget;
 			return next;
@@ -4998,22 +5229,6 @@ const POOL_COMBOS_SAVE_PATH = "/plugins/dsh-xdpool/combos/save";
 */
 const POOL_RELAY_PATH = "/plugins/dsh-xdpool/relay";
 /**
-* What the locally running billion-context proxy is doing, read-only.
-*
-* Its own route because the answer comes from ANOTHER plugin: billion-context
-* runs its own loopback listener and publishes its own JSON, so this route only
-* finds that listener and relays a filtered subset. Nothing here is folded into
-* {@link POOL_STATUS_PATH}: the pool card polls that every 30 seconds, and a
-* third-party proxy's session table is not something every pool poll should
-* carry.
-*
-* The word "read-only" is load-bearing on both ends. This plugin sends GETs
-* only — it never configures, restarts or writes to the proxy — and the payload
-* it relays deliberately omits every field that could carry conversation
-* material.
-*/
-const POOL_BILLION_PATH = "/plugins/dsh-xdpool/billion";
-/**
 * Read the usage panel's aggregate.
 *
 * GET only, and token-free by construction: the recorder holds counts and
@@ -5023,6 +5238,18 @@ const POOL_BILLION_PATH = "/plugins/dsh-xdpool/billion";
 * instead of a second one that could quietly drift.
 */
 const POOL_USAGE_PATH = "/plugins/dsh-xdpool/usage";
+/** The five strategies, as a value, so a request body can be validated against it. */
+const POOL_DISTRIBUTIONS = Object.freeze([
+	"priority",
+	"round-robin",
+	"balanced",
+	"sticky",
+	"expiry"
+]);
+/** True when `value` names one of the five documented strategies. */
+function isDistributionStrategy(value) {
+	return POOL_DISTRIBUTIONS.includes(value);
+}
 /**
 * The schedule every automation job falls back to.
 *
@@ -10279,6 +10506,24 @@ const PROVIDERS = Object.freeze([
 		"website": "https://openai.com/",
 		"local": false,
 		"source": "fcc"
+	},
+	{
+		"id": "custom_openai",
+		"name": "Custom OpenAI-compatible",
+		"category": "apikey",
+		"auth": {
+			"kind": "apiKey",
+			"env": "CUSTOM_OPENAI_API_KEY",
+			"url": null
+		},
+		"baseUrl": "",
+		"format": "openai-chat",
+		"models": [],
+		"notes": "Any OpenAI-compatible endpoint — vLLM, LiteLLM, one-api, LM Studio, a self-hosted gateway. Paste the base URL (ending in /v1) and the key on this card, then press Fetch models.",
+		"website": null,
+		"local": false,
+		"baseUrlOverrideEnv": "CUSTOM_OPENAI_BASE_URL",
+		"custom": true
 	}
 ].map((entry) => Object.freeze({
 	...entry,
@@ -10391,6 +10636,71 @@ const COMBO_PREFIX = "combo:";
 const COMBO_CHANNEL = "combo";
 /** Chain strategies. Anything else on disk falls back to `fallback`. */
 const COMBO_STRATEGIES = ["fallback", "round-robin"];
+/** The owner id the pool lane uses in a platform group. */
+const POOL_OWNER = "workbuddy";
+/**
+* Flatten platform groups into the member ids the router walks.
+*
+* Platform order first, then model order inside each platform — the documented
+* semantics ("same platform: try the next model; platform exhausted: the next
+* platform"). A pool model is its bare id; anything else carries its owner as the
+* `provider/` prefix, the same composite id the aggregate catalog and the picker
+* use.
+*
+* Duplicates are dropped: the same pair twice would spend two attempts on one
+* endpoint and report a fallback that never happened.
+*/
+function flattenPlatforms(platforms) {
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const platform of platforms) {
+		const owner = text$6(platform.owner);
+		if (owner === "") continue;
+		for (const raw of platform.models) {
+			const model = text$6(raw);
+			if (model === "" || isComboId(model)) continue;
+			const id = owner === "workbuddy" ? model : `${owner}/${model}`;
+			if (seen.has(id)) continue;
+			seen.add(id);
+			out.push(id);
+		}
+	}
+	return out;
+}
+/**
+* Group a flat member list back into platforms.
+*
+* For a chain saved flat, so the two-level editor can still open it: each id's
+* owner is read from its shape (`workbuddy` for a bare id, the prefix otherwise)
+* and groups come out in first-seen order — which is the order the members were
+* in, so re-flattening reproduces exactly what was stored.
+*/
+function splitPlatforms(models) {
+	const groups = /* @__PURE__ */ new Map();
+	const order = [];
+	for (const raw of models) {
+		const id = text$6(raw);
+		if (id === "") continue;
+		const parsed = parseProviderModelId(id);
+		const owner = parsed === null ? POOL_OWNER : parsed.providerId;
+		const model = parsed === null ? id : parsed.modelId;
+		let bucket = groups.get(owner);
+		if (bucket === void 0) {
+			bucket = [];
+			groups.set(owner, bucket);
+			order.push(owner);
+		}
+		if (!bucket.includes(model)) bucket.push(model);
+	}
+	return order.map((owner) => ({
+		owner,
+		models: groups.get(owner) ?? []
+	}));
+}
+/** Windows assumed when nothing on the chain declares one. */
+const COMBO_DEFAULT_CONTEXT_WINDOW = 131072;
+/** Output ceiling assumed when nothing on the chain declares one. */
+const COMBO_DEFAULT_MAX_OUTPUT = 32768;
 /** A trimmed non-empty string, or ''. */
 function text$6(value) {
 	return typeof value === "string" ? value.trim() : "";
@@ -10460,7 +10770,8 @@ function normalizeCombos(raw) {
 		const name = text$6(value.name) || text$6(value.id);
 		if (name === "") continue;
 		const id = text$6(value.id);
-		const models = stringList$2(value.models).filter((model) => model !== id && !isComboId(model));
+		const platforms = Array.isArray(value.platforms) ? normalizePlatforms(value.platforms) : void 0;
+		const models = platforms === void 0 ? stringList$2(value.models).filter((model) => model !== id && !isComboId(model)) : flattenPlatforms(platforms);
 		if (models.length === 0) continue;
 		const chainId = isComboId(id) ? id : comboId(name);
 		if (chainId === "" || seen.has(chainId)) continue;
@@ -10471,6 +10782,7 @@ function normalizeCombos(raw) {
 			id: chainId,
 			name,
 			models,
+			...platforms === void 0 ? {} : { platforms },
 			strategy,
 			stickyLimit: limit > 0 ? limit : 1,
 			enabled: value.enabled !== false
@@ -10479,6 +10791,30 @@ function normalizeCombos(raw) {
 	return out;
 }
 /**
+* Normalise the `platforms` array from an untrusted document.
+*
+* Drops a group with no owner or no models rather than keeping it: an empty group
+* renders as a platform card the user cannot act on, and it contributes no members,
+* so keeping it would make the editor disagree with the router about what the chain
+* contains.
+*/
+function normalizePlatforms(raw) {
+	const out = [];
+	for (const entry of raw) {
+		if (entry === null || typeof entry !== "object" || Array.isArray(entry)) continue;
+		const value = entry;
+		const owner = text$6(value.owner);
+		if (owner === "") continue;
+		const models = stringList$2(value.models).filter((model) => !isComboId(model));
+		if (models.length === 0) continue;
+		out.push({
+			owner,
+			models
+		});
+	}
+	return out;
+}
+/**
 * Classify one member id against both catalogs.
 *
 * `combo:` ids are rejected outright: a chain pointing at another chain would
@@ -10501,6 +10837,31 @@ function resolveComboMember(modelId, sources) {
 			supportsImages: aggregateRow.supportsImages
 		};
 	}
+	/**
+	* A 扫码登录 channel row, checked BEFORE the pool.
+	*
+	* Channel ids are `<channel>:<model>`, and the channel set is closed (it comes
+	* from the pack's own registered list), so a match here is unambiguous. Order
+	* still matters: a pool model id is bare and can never contain `:`, so trying the
+	* channel first cannot shadow one — and doing it first keeps a channel named after
+	* a pool id from being swallowed.
+	*
+	* The window and image flag are not known for a channel row (the host's listing
+	* publishes neither), so the chain's intersection falls back to the documented
+	* defaults. That is the honest answer: an unknown window must not be treated as a
+	* large one, or the host would size a compaction against a limit nobody promised.
+	*/
+	const hostRow = sources.host?.find((row) => row.id === id);
+	if (hostRow !== void 0) return {
+		modelId: id,
+		aggregate: false,
+		host: true,
+		channel: hostRow.channel,
+		name: hostRow.name,
+		contextWindow: COMBO_DEFAULT_CONTEXT_WINDOW,
+		maxOutputTokens: COMBO_DEFAULT_MAX_OUTPUT,
+		supportsImages: false
+	};
 	const poolRow = sources.pool.find((row) => row.id === id);
 	if (poolRow === void 0) return void 0;
 	return {
@@ -10513,6 +10874,54 @@ function resolveComboMember(modelId, sources) {
 	};
 }
 /**
+* The same model served by more than one lane, in the order to try them.
+*
+* This is the "same model, different route" tier: when a lane rate-limits, the
+* answer is usually to reach the SAME model through another provider, not to
+* fall back to a different model. Switching models changes context window, tool
+* calling, structured-output shape and writing style — a cross-model fallback is
+* a last resort, not a first one.
+*
+* The registry carries 86 model ids under two or more providers (kimi-k2.5 sits
+* under eight), so the tier is real and not theoretical. What was missing is
+* that a user had to spell it out: three separate chain members naming the same
+* model three times, in the right order, and re-edit the chain whenever a
+* provider was added.
+*
+* Derivation, not configuration: for one model id, every aggregate row sharing
+* `modelName` (or the bare id when the registry names no shared display name) is
+* a route to it. Pool rows are excluded — `buddy:`/`workbuddy:` are the pool's
+* own lanes and naming them here would silently spend the user's WorkBuddy
+* credits as a "fallback".
+*
+* The requested provider, when given, comes FIRST: the user chose that lane, so
+* it stays the primary and the others are the alternates.
+*/
+function siblingRoutes(modelId, sources, preferredProvider) {
+	const id = text$6(modelId);
+	if (id === "") return [];
+	const target = sources.aggregate.find((row) => row.id === id);
+	if (target === void 0) return [id];
+	const name = text$6(target.name);
+	const bare = bareModelIdOf(target);
+	const out = [id];
+	for (const row of sources.aggregate) {
+		if (row.id === id) continue;
+		if (row.providerId === target.providerId) continue;
+		const sameName = name !== "" && text$6(row.name) === name;
+		const sameBare = bare !== "" && bareModelIdOf(row) === bare;
+		if (!sameName && !sameBare) continue;
+		if (!out.includes(row.id)) out.push(row.id);
+	}
+	if (preferredProvider === void 0 || out.length <= 1) return out;
+	return [...out.filter((candidate) => candidate.startsWith(`${preferredProvider}/`)), ...out.filter((candidate) => !candidate.startsWith(`${preferredProvider}/`))];
+}
+/** The model id without its provider prefix, for cross-vendor comparison. */
+function bareModelIdOf(row) {
+	const parsed = parseProviderModelId(row.id);
+	return parsed === null ? text$6(row.modelId) : parsed.modelId;
+}
+/**
 * Every combo row that can currently answer, given the catalogs.
 *
 * Disabled chains are skipped, as are chains whose members have all gone away:
@@ -10636,6 +11045,13 @@ function normalizeSetting(raw) {
 	if (typeof value.enabled === "boolean") setting.enabled = value.enabled;
 	const key = text$5(value.apiKey);
 	if (key !== "") setting.apiKey = key;
+	if (Array.isArray(value.apiKeys)) {
+		const keys = stringList$1(value.apiKeys);
+		const [only] = keys;
+		if (keys.length > 1) setting.apiKeys = keys;
+		else if (only !== void 0 && setting.apiKey === void 0) setting.apiKey = only;
+	}
+	if (typeof value.distribution === "string" && isDistributionStrategy(value.distribution.trim())) setting.distribution = value.distribution.trim();
 	const baseUrl = text$5(value.baseUrl);
 	if (baseUrl !== "") setting.baseUrl = baseUrl.replace(/\/+$/, "");
 	if (Array.isArray(value.models)) {
@@ -10756,12 +11172,12 @@ function normalizeRelayModels(raw) {
 async function writeAggregateSettings(settings) {
 	const path = aggregateSettingsPath();
 	if (path === void 0) throw new Error("no home directory to store the aggregate settings in");
-	await mkdir(dirname(path), { recursive: true });
+	await ensureSecretDir(dirname(path));
 	const file = {
 		version: STORE_VERSION,
 		...settings
 	};
-	await writeFile(`${path}.tmp`, `${JSON.stringify(file, null, 2)}\n`, "utf8");
+	await writeSecretFile(`${path}.tmp`, `${JSON.stringify(file, null, 2)}\n`);
 	await rename(`${path}.tmp`, path);
 }
 /**
@@ -10783,16 +11199,42 @@ async function updateProviderSetting(providerId, patch) {
 		if (baseUrl === "") delete after.baseUrl;
 		else after.baseUrl = baseUrl;
 	}
-	if (patch.apiKey !== void 0) {
-		const key = text$5(patch.apiKey);
-		if (key === "") delete after.apiKey;
-		else after.apiKey = key;
+	if (patch.appendApiKey !== void 0) {
+		const added = text$5(patch.appendApiKey);
+		if (added !== "") {
+			const existing = [.../* @__PURE__ */ new Set([...providerApiKeys(after)])];
+			if (!existing.includes(added)) existing.push(added);
+			const first = existing[0];
+			if (first !== void 0) {
+				after.apiKey = first;
+				if (existing.length > 1) after.apiKeys = existing;
+				else delete after.apiKeys;
+			}
+		}
+	}
+	if (patch.apiKeys !== void 0 || patch.apiKey !== void 0) {
+		const incoming = patch.apiKeys !== void 0 ? patch.apiKeys : [patch.apiKey ?? ""];
+		const keys = [...new Set(incoming.map((entry) => text$5(entry)).filter((key) => key !== ""))];
+		const first = keys[0];
+		if (first === void 0) {
+			delete after.apiKey;
+			delete after.apiKeys;
+		} else {
+			after.apiKey = first;
+			if (keys.length > 1) after.apiKeys = keys;
+			else delete after.apiKeys;
+		}
 	}
 	if (patch.models !== void 0) {
 		const models = stringList$1(patch.models);
 		if (models.length === 0) delete after.models;
 		else after.models = models;
 	}
+	if (patch.distribution !== void 0) {
+		const strategy = text$5(patch.distribution);
+		if (strategy === "") delete after.distribution;
+		else after.distribution = strategy;
+	}
 	if (patch.discovered !== void 0) {
 		const discovered = stringList$1(patch.discovered);
 		if (discovered.length === 0) delete after.discovered;
@@ -10891,6 +11333,62 @@ function providerSettingOf(store, providerId) {
 	return store.providers?.[providerId] ?? {};
 }
 /**
+* Every usable key a provider holds, preferred first.
+*
+* One reader for two spellings. A config written before multi-key support has
+* only `apiKey`; one written by the multi-key card has `apiKeys` with a mirrored
+* `apiKey`. Both must answer the same list, deduplicated, with blanks dropped — a
+* blank entry is a request guaranteed to 401 and, worse, would make the card
+* believe the provider is configured.
+*
+* Order is meaningful: entry 0 is the preferred key, the rest are alternates.
+*/
+function providerApiKeys(setting) {
+	const list = Array.isArray(setting.apiKeys) ? setting.apiKeys : [];
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const raw of [...list, setting.apiKey]) {
+		const key = text$5(raw);
+		if (key === "" || seen.has(key)) continue;
+		seen.add(key);
+		out.push(key);
+	}
+	return out;
+}
+/**
+* The order to TRY this provider's keys in, per the chosen strategy.
+*
+* `priority` (the default) is the stored order, which is also what the retry loop
+* walks: the preferred key first, then the alternates. The other four strategies
+* reorder the FIRST attempt only — the alternates behind it still follow in
+* stored order, because the point of a fallback is to reach a working key quickly,
+* not to shuffle the whole list on every attempt.
+*
+* Deliberately a pure function of `(keys, strategy, picker)`: the pool lane's
+* strategies depend on live account state, which keys do not have. `picker`
+* returns a float in [0,1) so a test can drive the random branches.
+*/
+function orderApiKeys(keys, strategy, picker = Math.random) {
+	if (keys.length <= 1) return keys;
+	const [first, ...rest] = keys;
+	if (first === void 0) return keys;
+	switch (strategy) {
+		case "round-robin": {
+			const at = Math.floor(picker() * keys.length);
+			const index = at < 0 || at >= keys.length ? 0 : at;
+			return [...keys.slice(index), ...keys.slice(0, index)];
+		}
+		case "balanced": {
+			const at = Math.floor(picker() * keys.length);
+			const index = at < 0 || at >= keys.length ? 0 : at;
+			return [...keys.slice(index), ...keys.slice(0, index)];
+		}
+		case "expiry": return keys;
+		case "sticky": return keys;
+		default: return keys;
+	}
+}
+/**
 * Whether a provider could serve a model right now.
 *
 * Keyless and local providers are usable with nothing configured; `oauth` and
@@ -10900,7 +11398,7 @@ function providerSettingOf(store, providerId) {
 */
 function providerAuthUsable(provider, setting) {
 	if (provider.auth.kind === "oauth" || provider.auth.kind === "adc") return false;
-	if (provider.auth.kind === "apiKey") return text$5(setting.apiKey) !== "";
+	if (provider.auth.kind === "apiKey") return providerApiKeys(setting).length > 0;
 	return true;
 }
 /**
@@ -10945,275 +11443,653 @@ function configuredProviderIds(store) {
 	return out;
 }
 //#endregion
-//#region src/aggregate.ts
+//#region src/stats.ts
 /**
-* Aggregate lane: the 76 declared upstream providers, resolved per request and
-* forwarded to with the user's own key.
-*
-* WHY A SECOND LANE BESIDE THE POOL
-*
-* The pool serves exactly one family of gateways — WorkBuddy, CN and
-* international — from accounts the user already signed in on the desktop app.
-* This module serves the orthogonal case: a provider the user holds a key for,
-* reached at that provider's own endpoint, with no account rotation because
-* there is no account to rotate. Same card, same model picker, different wire.
-*
-* WHAT IT DELIBERATELY DOES NOT DO
-*
-* It does not invent endpoints. Every URL here comes from the registry record or
-* from a base-URL override the user typed; a provider whose endpoint cannot be
-* composed is reported as such rather than being probed at a guessed URL, because
-* "no listing" and "provider is down" must not read the same to the user.
-*
-* It also does not decide whether a provider is USABLE — that is the settings
-* layer's call (`providerAuthUsable`). This module resolves what a request
-* needs, and refuses with a message naming what is missing.
-*
-* KEYS
-*
-* Every string that can reach a message — a failure, a body snippet, a probe's
-* answer — passes through {@link redactAggregateSecret} first. Providers echo
-* rejected credentials back (a 401 body routinely repeats the key), and this
-* text is folded into messages the host writes to its durable session log.
-*
-* @module dsh-xdpool/aggregate
+* Retained calls. Bounded on purpose: a busy week is thousands of calls, and a
+* dashboard that grows without limit turns into a memory leak with a chart.
 */
-const WIRE_BY_FORMAT = Object.freeze({
-	"openai-chat": "chat",
-	"openai-responses": "responses",
-	"anthropic-messages": "messages"
-});
+const USAGE_MAX_SAMPLES = 2e3;
 /**
-* Wire suffixes, needed only for the one record the registry gives no base URL
-* to (Azure names its endpoint per deployment, so `chatEndpoint` is null there
-* and there is no registry endpoint to read the suffix off).
+* Minimum total decoding time before a throughput figure is published.
+*
+* A one-token answer that arrives in 20ms would otherwise report a tps two
+* orders of magnitude above anything a real turn reaches, and the panel would
+* rank models by that artefact instead of by speed.
 */
-const CHAT_SUFFIX = Object.freeze({
-	"openai-chat": "/chat/completions",
-	"openai-responses": "/responses",
-	"anthropic-messages": "/messages"
-});
+const MIN_DECODE_MS = 120;
 /**
-* Capacities for a row the registry describes only by id.
+* A reported token count, or null when the key is absent / not a finite
+* number.
 *
-* Deliberately conservative, and the reason is visible in the number: most
-* registry rows publish no context window at all. Publishing a plausible one
-* would put a fabricated field in front of the user — and unlike a display
-* label, a wrong window is a wrong capability, so DSH would hand the provider a
-* prompt it cannot accept.
+* Zero is ACCEPTED: an empty turn really can cost nothing, and reporting that
+* as "the gateway said nothing" would make the panel lie in the other
+* direction.
 */
-const DEFAULT_CONTEXT_WINDOW = 131072;
-const DEFAULT_MAX_OUTPUT = 32768;
-/** Listing round budget. Generous for a small JSON document, short for a UI. */
-const LISTING_TIMEOUT_MS = 15e3;
-/** One turn's budget, matching the pool shim's idle ceiling. */
-const TURN_TIMEOUT_MS = 3e5;
-/** Sent when the registry does not declare one (kimchi, and most of the roster). */
-const USER_AGENT = "dsh-xdpool/2.1";
-/** How much of an upstream body is quoted back in a failure message. */
-const BODY_SNIPPET_CHARS = 400;
-/** A trimmed non-empty string, or ''. */
-function text$4(value) {
-	return typeof value === "string" && value.trim() !== "" ? value.trim() : "";
-}
-/** A positive finite number, or undefined. */
-function number(value) {
-	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.trunc(value) : void 0;
-}
-function isRecord$3(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-/**
-* One aggregate-lane failure, carrying the class the caller maps onto HTTP.
-*
-* `kind` reuses the pool's vocabulary (`UpstreamErrorKind` in `upstream.ts`) so
-* the shim's existing error→status table serves both lanes: a third-party 429
-* is a `soft_rate`, a 401 is a `session_dead`, and neither needs a second table
-* that could drift from the first.
-*/
-var AggregateError = class extends Error {
-	kind;
-	status;
-	constructor(kind, message, status = 0) {
-		super(message);
-		this.name = "AggregateError";
-		this.kind = kind;
-		this.status = status;
-	}
-};
-/** Remove a credential from anything that may reach a message. */
-function redactAggregateSecret(value, apiKey) {
-	let source = typeof value === "string" ? value : String(value ?? "");
-	const key = text$4(apiKey);
-	if (key === "") return source;
-	const escaped = JSON.stringify(key).slice(1, -1);
-	for (const needle of escaped === key ? [key] : [key, escaped]) if (source.includes(needle)) source = source.split(needle).join("[redacted]");
-	return source;
-}
-/** A base URL a request can actually be sent to. */
-function hasPlaceholder(baseUrl) {
-	return /\{[^}]*\}/.test(baseUrl);
-}
-/** The user's `baseUrl` override when present, else the registry's own. */
-function effectiveBaseUrl(provider, setting) {
-	const override = text$4(setting.baseUrl);
-	return (override !== "" ? override : text$4(provider.baseUrl)).replace(/\/+$/, "");
-}
-/**
-* The provider's listing URL, moved by a `baseUrl` override when — and only
-* when — the declared listing actually lives under the registry base.
-*
-* Three providers (cohere, deepinfra, ollama_cloud) publish their listing on
-* another path. Rewriting a URL that never pointed at the override would invent
-* one, and a guessed listing is worse than none.
-*/
-function effectiveModelsUrl(provider, setting) {
-	const declared = modelsEndpoint(provider);
-	if (declared === null) return null;
-	const override = text$4(setting.baseUrl).replace(/\/+$/, "");
-	const registryBase = text$4(provider.baseUrl).replace(/\/+$/, "");
-	if (override === "" || registryBase === "" || !declared.startsWith(registryBase)) return declared;
-	return `${override}${declared.slice(registryBase.length)}`;
+function count(value) {
+	return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.floor(value) : null;
 }
-/**
-* The full URL a turn is posted to; null when the provider has no dialable
-* endpoint (Azure without a user base URL, or a base still carrying the
-* registry's `{account_id}`-style placeholder).
-*/
-function effectiveChatUrl(provider, setting) {
-	const override = text$4(setting.baseUrl).replace(/\/+$/, "");
-	const declared = chatEndpoint(provider);
-	if (declared !== null) {
-		const registryBase = text$4(provider.baseUrl).replace(/\/+$/, "");
-		const url = override === "" || registryBase === "" ? declared : `${override}${declared.slice(registryBase.length)}`;
-		return hasPlaceholder(url) ? null : url;
-	}
-	const suffix = CHAT_SUFFIX[provider.format];
-	if (override === "" || suffix === void 0 || hasPlaceholder(override)) return null;
-	return `${override}${suffix}`;
+function zero(value) {
+	return count(value) ?? 0;
 }
-/** The per-provider settings object, or `{}` when the store names none. */
-function settingFor(store, providerId) {
-	return store.providers?.[providerId] ?? {};
+function detailOf(value, key) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return 0;
+	return zero(value[key]);
 }
 /**
-* Resolve one provider's effective settings.
-*
-* Throws {@link AggregateError} with a `client` kind for every state the user
-* fixes in the settings page — an unknown id, a missing key, a placeholder base
-* URL. A `client` kind is deliberate: none of these is a transport fault, so
-* none of them should be retried against a different provider.
+* Read a gateway `usage` object, accepting both spellings OpenAI-compatible
+* gateways use (`prompt_tokens` / `input_tokens`).
 *
-* `options.requireEnabled` exists for the DISCOVERY calls. Fetching a provider's
-* model list publishes nothing: it asks "does this endpoint answer, and with
-* what", and writing the answer back is a separate step the user also takes.
-* Gating it on the enable switch made a read-only button report
-* `"OpenCode Free" is not enabled in the aggregate settings` — a failure to
-* LOOK, dressed up as a failure to connect, on rows that carry no key field and
-* so offered no way to answer it. Discovery therefore does not require the
-* switch; publishing still does, in {@link buildAggregateCatalog} and
-* {@link resolveAggregateProvider} as called by the serving paths.
+* Returns undefined when the document is not a usage report at all, so callers
+* can tell "the gateway sent zeroes" from "there was nothing here".
 */
-function resolveAggregateProvider(store, providerId, options = {}) {
-	const id = text$4(providerId);
-	const provider = id === "" ? null : getProvider(id);
-	if (provider === null) throw new AggregateError("client", `the aggregate lane has no provider "${id === "" ? String(providerId) : id}"`);
-	const setting = settingFor(store, provider.id);
-	if (setting.enabled === false) throw new AggregateError("client", `"${provider.name}" is switched off in the aggregate settings`);
-	if (!providerAuthUsable(provider, setting)) {
-		if (provider.auth.kind === "oauth" || provider.auth.kind === "adc") throw new AggregateError("session_dead", `"${provider.name}" signs in with ${provider.auth.kind}, not with an API key, so the aggregate lane does not serve it`);
-		const where = text$4(provider.auth.url) === "" ? "" : ` (the provider issues keys at ${provider.auth.url})`;
-		throw new AggregateError("client", `"${provider.name}" needs an API key: paste one in the aggregate settings${where}`);
-	}
-	if (options.requireEnabled !== false && !providerEnabled(provider, setting)) throw new AggregateError("client", `"${provider.name}" is not enabled in the aggregate settings`);
-	const baseUrl = effectiveBaseUrl(provider, setting);
-	if (baseUrl === "") throw new AggregateError("client", `"${provider.name}" has no base URL of its own — set one in the aggregate settings`);
-	if (hasPlaceholder(baseUrl)) throw new AggregateError("client", `"${provider.name}"'s base URL still carries a registry placeholder — set the real URL in the aggregate settings`);
-	const chatUrl = effectiveChatUrl(provider, setting);
-	if (chatUrl === null) throw new AggregateError("client", `"${provider.name}" has no usable ${provider.format} endpoint`);
-	const apiKey = text$4(setting.apiKey);
-	const headers = defaultHeaders(provider, apiKey);
-	if (headers["user-agent"] === void 0) headers["user-agent"] = USER_AGENT;
+function parseUsage(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const obj = value;
+	const input = count(obj["prompt_tokens"]) ?? count(obj["input_tokens"]);
+	const output = count(obj["completion_tokens"]) ?? count(obj["output_tokens"]);
+	if (input === null && output === null) return void 0;
 	return {
-		providerId: provider.id,
-		providerName: provider.name,
-		apiKey,
-		baseUrl,
-		format: provider.format,
-		wire: WIRE_BY_FORMAT[provider.format],
-		chatUrl,
-		modelsUrl: effectiveModelsUrl(provider, setting),
-		headers
+		inputTokens: input ?? 0,
+		outputTokens: output ?? 0,
+		reasoningTokens: detailOf(obj["completion_tokens_details"], "reasoning_tokens"),
+		cachedTokens: detailOf(obj["prompt_tokens_details"], "cached_tokens")
 	};
 }
 /**
-* The ids a provider should be served with, and where that list came from.
+* True for the trailer frame a gateway sends to report usage.
 *
-* `discovered` is the roster a fetch returned, `models` is the subset the user
-* kept, and the choice is applied LAST so it wins over both — otherwise pressing
-* "Fetch models" would silently undo the narrowing the card just saved.
+* It is recognised by an EMPTY `choices` array beside a `usage` field. A frame
+* that also carries content is a normal chunk that happens to mention usage,
+* and dropping it would delete the user's answer - which is why the strip step
+* downstream is allowed to remove exactly these and nothing else.
 */
-function modelIdsFor(provider, setting) {
-	const universe = modelChoicesFor(provider, setting);
-	const source = rosterIsDiscovered(provider, setting) ? "discovered" : "static";
-	const override = stringList(setting.models);
-	if (override.length === 0) return {
-		ids: universe,
-		source
-	};
-	const available = new Set(universe);
-	return {
-		ids: override.filter((id) => available.has(id)),
-		source
-	};
+function isUsageOnlyFrame(parsed) {
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return false;
+	const obj = parsed;
+	if (obj["usage"] === void 0 || obj["usage"] === null) return false;
+	const choices = obj["choices"];
+	return Array.isArray(choices) && choices.length === 0;
+}
+/** Local calendar day of an instant, as `YYYY-MM-DD`. */
+function usageDayKey(at) {
+	const d = new Date(at);
+	const month = String(d.getMonth() + 1).padStart(2, "0");
+	const day = String(d.getDate()).padStart(2, "0");
+	return `${d.getFullYear()}-${month}-${day}`;
 }
 /**
-* Whether the roster came from a live fetch rather than the registry.
+* Timing and usage captured while one stream is forwarded.
 *
-* A pre-split install has `models` and no `discovered`, because until the
-* chooser existed the only writer of `models` WAS the fetch button. Those ids
-* are a roster, not a choice, and treating them as one would shrink the vendor
-* to whatever handful the registry happens to declare.
+* Kept free of Node stream types so it can be unit tested with plain numbers;
+* the shim owns the Transform that feeds it chunks.
 */
-function rosterIsDiscovered(provider, setting) {
-	if ((setting.discovered?.length ?? 0) > 0) return true;
-	return stringList(setting.models).length > provider.models.length;
-}
-/** Every id a provider could offer: its roster, for the card's chooser. */
-function modelChoicesFor(provider, setting) {
-	const discovered = stringList(setting.discovered);
-	if (discovered.length === 0 && rosterIsDiscovered(provider, setting)) return stringList(setting.models);
-	return discovered.length > 0 ? discovered : provider.models.map((model) => model.id);
-}
-/** A de-duplicated list of non-empty trimmed strings from an untrusted array. */
-function stringList(value) {
-	if (!Array.isArray(value)) return [];
-	const seen = /* @__PURE__ */ new Set();
-	const ids = [];
-	for (const raw of value) {
-		const id = text$4(raw);
-		if (id === "" || seen.has(id)) continue;
-		seen.add(id);
-		ids.push(id);
+var StreamTracker = class {
+	/** Milliseconds from request start to the first byte, once seen. */
+	ttftMs;
+	/** Milliseconds from first byte to the end of the stream, once finished. */
+	decodeMs;
+	/** Usage seen in any frame, if the gateway sent any. */
+	usage;
+	firstAt;
+	startedAt;
+	constructor(startedAt = Date.now()) {
+		this.startedAt = startedAt;
 	}
-	return ids;
-}
+	/** Record the first byte. Repeated calls keep the earliest. */
+	markFirstByte(at = Date.now()) {
+		if (this.firstAt !== void 0) return;
+		this.firstAt = at;
+		const ttft = at - this.startedAt;
+		if (ttft >= 0) this.ttftMs = ttft;
+	}
+	/** Record stream completion. Repeated calls keep the earliest. */
+	finish(at = Date.now()) {
+		if (this.decodeMs !== void 0) return;
+		if (this.firstAt === void 0) return;
+		const decode = at - this.firstAt;
+		if (decode >= 0) this.decodeMs = decode;
+	}
+	/** Fold a parsed frame's usage in; later frames overwrite, as the gateway intends. */
+	observe(parsed) {
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return;
+		const usage = parseUsage(parsed["usage"]);
+		if (usage !== void 0) this.usage = usage;
+	}
+};
 /**
-* One catalog row.
+* A bounded window of recent calls, summarised on demand.
 *
-* Capacities come from the registry's model row where it has them, and fall back
-* to this module's own defaults where it does not (most rows carry no context
-* window, and none carries an output ceiling — the registry records ids and
-* published capacities, not a serving contract).
+* In-memory by design: this is a live panel, and persisting every prompt's
+* token counts would turn a convenience into a record of what the user asked.
+* A restart therefore starts the chart again, which the panel states rather
+* than hides.
 */
-function rowOf(provider, modelId, source) {
-	const declared = provider.models.find((model) => model.id === modelId);
-	const contextWindow = number(declared?.contextWindow) ?? DEFAULT_CONTEXT_WINDOW;
-	const label = text$4(declared?.name) !== "" ? text$4(declared?.name) : modelId;
-	return {
-		id: providerModelId(provider.id, modelId),
-		name: `${provider.name} ${label}`,
-		providerId: provider.id,
+var UsageRecorder = class {
+	samples = [];
+	limit;
+	constructor(limit = USAGE_MAX_SAMPLES) {
+		this.limit = limit > 0 ? limit : 1;
+	}
+	/** Retain one call, dropping the oldest once the window is full. */
+	record(call) {
+		this.samples.push(call);
+		while (this.samples.length > this.limit) this.samples.shift();
+	}
+	/** Samples currently retained. */
+	size() {
+		return this.samples.length;
+	}
+	/** Forget every retained call. */
+	reset() {
+		this.samples = [];
+	}
+	/** Aggregate the retained window. */
+	summary() {
+		const rows = /* @__PURE__ */ new Map();
+		const turns = /* @__PURE__ */ new Map();
+		let calls = 0;
+		let usageReported = false;
+		for (const call of this.samples) {
+			calls += 1;
+			if (call.usage !== void 0) usageReported = true;
+			const bucket = turns.get(call.turnId) ?? {
+				calls: 0,
+				succeeded: 0,
+				failed: 0
+			};
+			bucket.calls += 1;
+			if (call.ok) bucket.succeeded += 1;
+			else bucket.failed += 1;
+			turns.set(call.turnId, bucket);
+			const key = `${call.channel}\u0000${call.region}\u0000${call.model}`;
+			let acc = rows.get(key);
+			if (acc === void 0) {
+				acc = {
+					row: {
+						channel: call.channel,
+						region: call.region,
+						model: call.model,
+						calls: 0,
+						turns: 0,
+						failed: 0,
+						recovered: 0,
+						inputTokens: 0,
+						outputTokens: 0,
+						reasoningTokens: 0,
+						cachedTokens: 0,
+						tps: null,
+						avgTtftMs: null,
+						lastUsedAt: 0
+					},
+					turnIds: /* @__PURE__ */ new Set(),
+					decodeMs: 0,
+					ttftTotal: 0,
+					ttftCount: 0
+				};
+				rows.set(key, acc);
+			}
+			acc.row.calls += 1;
+			acc.turnIds.add(call.turnId);
+			if (!call.ok) acc.row.failed += 1;
+			if (call.at > acc.row.lastUsedAt) acc.row.lastUsedAt = call.at;
+			if (call.ttftMs !== void 0) {
+				acc.ttftTotal += call.ttftMs;
+				acc.ttftCount += 1;
+			}
+			if (call.decodeMs !== void 0) acc.decodeMs += call.decodeMs;
+			if (call.usage !== void 0) {
+				acc.row.inputTokens += call.usage.inputTokens;
+				acc.row.outputTokens += call.usage.outputTokens;
+				acc.row.reasoningTokens += call.usage.reasoningTokens;
+				acc.row.cachedTokens += call.usage.cachedTokens;
+			}
+		}
+		const failedTurnIds = /* @__PURE__ */ new Set();
+		let recoveredTurns = 0;
+		for (const [turnId, bucket] of turns) if (bucket.failed > 0 && bucket.succeeded === 0) failedTurnIds.add(turnId);
+		else if (bucket.failed > 0) recoveredTurns += 1;
+		const out = [];
+		for (const acc of rows.values()) {
+			let recovered = 0;
+			for (const turnId of acc.turnIds) {
+				const bucket = turns.get(turnId);
+				if (bucket !== void 0 && bucket.failed > 0 && bucket.succeeded > 0) recovered += 1;
+			}
+			out.push({
+				...acc.row,
+				turns: acc.turnIds.size,
+				recovered,
+				tps: acc.decodeMs >= MIN_DECODE_MS ? Math.round(acc.row.outputTokens / (acc.decodeMs / 1e3)) : null,
+				avgTtftMs: acc.ttftCount > 0 ? Math.round(acc.ttftTotal / acc.ttftCount) : null
+			});
+		}
+		out.sort((a, b) => b.calls - a.calls || b.lastUsedAt - a.lastUsedAt || a.model.localeCompare(b.model));
+		return {
+			samples: this.samples.length,
+			turns: turns.size,
+			failedTurns: failedTurnIds.size,
+			recoveredTurns,
+			calls,
+			usageReported,
+			entries: this.samples.slice().reverse(),
+			rows: out,
+			accounts: this.accountRows(),
+			days: this.days(failedTurnIds)
+		};
+	}
+	/**
+	* One row per account, busiest first.
+	*
+	* Samples that never named an account are grouped under an empty label
+	* rather than dropped: `account` is optional on `UsageCall`, so a caller that
+	* files a sample without one - a failure raised before any account was ever
+	* picked, say - would otherwise vanish from this view, and the account table
+	* would add up to less than the call total with nothing on screen to explain
+	* the gap. Every shim record site names its account; this branch exists so
+	* that a future one cannot quietly break the totals.
+	*
+	* `topModels` keeps the two most-used ids rather than every one: this column
+	* answers "what does this account usually run", and a list of nine ids is not
+	* an answer to that question, it is just the other table again.
+	*/
+	accountRows() {
+		const buckets = /* @__PURE__ */ new Map();
+		for (const call of this.samples) {
+			const label = call.account ?? "";
+			const key = `${call.channel}\u0000${call.region}\u0000${label}`;
+			let acc = buckets.get(key);
+			if (acc === void 0) {
+				acc = {
+					row: {
+						account: label,
+						channel: call.channel,
+						region: call.region,
+						calls: 0,
+						turns: 0,
+						failed: 0,
+						inputTokens: 0,
+						outputTokens: 0,
+						cachedTokens: 0,
+						lastUsedAt: 0,
+						topModels: []
+					},
+					turnIds: /* @__PURE__ */ new Set(),
+					modelCalls: /* @__PURE__ */ new Map()
+				};
+				buckets.set(key, acc);
+			}
+			acc.row.calls += 1;
+			acc.turnIds.add(call.turnId);
+			if (!call.ok) acc.row.failed += 1;
+			if (call.at > acc.row.lastUsedAt) acc.row.lastUsedAt = call.at;
+			acc.modelCalls.set(call.model, (acc.modelCalls.get(call.model) ?? 0) + 1);
+			if (call.usage !== void 0) {
+				acc.row.inputTokens += call.usage.inputTokens;
+				acc.row.outputTokens += call.usage.outputTokens;
+				acc.row.cachedTokens += call.usage.cachedTokens;
+			}
+		}
+		const out = [];
+		for (const acc of buckets.values()) {
+			const topModels = [...acc.modelCalls.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).slice(0, 2).map(([model]) => model);
+			out.push({
+				...acc.row,
+				turns: acc.turnIds.size,
+				topModels
+			});
+		}
+		out.sort((a, b) => b.calls - a.calls || b.lastUsedAt - a.lastUsedAt || a.account.localeCompare(b.account));
+		return out;
+	}
+	/**
+	* The daily series, oldest first, limited to the most recent days.
+	*
+	* Sorted by key rather than insertion order because a retained window can
+	* straddle a month boundary, and a chart whose axis jumps backwards reads as
+	* corrupted data rather than as history.
+	*
+	* `failedTurns` is counted by DISTINCT turn id, not by summing per-call
+	* failures: a turn that rotated three accounts and failed on all three is
+	* still one failed turn, and the whole reason this module keeps turns and
+	* calls apart is so that number stays honest in every place it appears.
+	*/
+	days(failedTurnIds) {
+		const buckets = /* @__PURE__ */ new Map();
+		for (const call of this.samples) {
+			const key = usageDayKey(call.at);
+			let acc = buckets.get(key);
+			if (acc === void 0) {
+				acc = {
+					day: key,
+					calls: 0,
+					inputTokens: 0,
+					outputTokens: 0,
+					failedTurnIds: /* @__PURE__ */ new Set()
+				};
+				buckets.set(key, acc);
+			}
+			acc.calls += 1;
+			acc.inputTokens += call.usage?.inputTokens ?? 0;
+			acc.outputTokens += call.usage?.outputTokens ?? 0;
+			if (failedTurnIds.has(call.turnId)) acc.failedTurnIds.add(call.turnId);
+		}
+		return [...buckets.values()].sort((a, b) => a.day.localeCompare(b.day)).slice(-14).map((acc) => ({
+			day: acc.day,
+			calls: acc.calls,
+			failedTurns: acc.failedTurnIds.size,
+			inputTokens: acc.inputTokens,
+			outputTokens: acc.outputTokens
+		}));
+	}
+};
+/**
+* Inspect one SSE frame's content, without its trailing separator.
+*
+* Returns undefined when no `data:` line parsed, which covers the `[DONE]`
+* sentinel, keep-alive comments and truncated JSON alike - a frame the forwarder
+* has no opinion about must come back untouched rather than guessed at.
+*/
+function inspectSseFrame(frame) {
+	for (const line of frame.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed.startsWith("data:")) continue;
+		const payload = trimmed.slice(5).trim();
+		if (payload === "" || payload === "[DONE]") continue;
+		let parsed;
+		try {
+			parsed = JSON.parse(payload);
+		} catch {
+			continue;
+		}
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) continue;
+		const usage = parsed["usage"];
+		if (usage === void 0 || usage === null) continue;
+		return {
+			parsed,
+			usageOnly: isUsageOnlyFrame(parsed)
+		};
+	}
+}
+//#endregion
+//#region src/aggregate.ts
+/**
+* Aggregate lane: the 76 declared upstream providers, resolved per request and
+* forwarded to with the user's own key.
+*
+* WHY A SECOND LANE BESIDE THE POOL
+*
+* The pool serves exactly one family of gateways — WorkBuddy, CN and
+* international — from accounts the user already signed in on the desktop app.
+* This module serves the orthogonal case: a provider the user holds a key for,
+* reached at that provider's own endpoint, with no account rotation because
+* there is no account to rotate. Same card, same model picker, different wire.
+*
+* WHAT IT DELIBERATELY DOES NOT DO
+*
+* It does not invent endpoints. Every URL here comes from the registry record or
+* from a base-URL override the user typed; a provider whose endpoint cannot be
+* composed is reported as such rather than being probed at a guessed URL, because
+* "no listing" and "provider is down" must not read the same to the user.
+*
+* It also does not decide whether a provider is USABLE — that is the settings
+* layer's call (`providerAuthUsable`). This module resolves what a request
+* needs, and refuses with a message naming what is missing.
+*
+* KEYS
+*
+* Every string that can reach a message — a failure, a body snippet, a probe's
+* answer — passes through {@link redactAggregateSecret} first. Providers echo
+* rejected credentials back (a 401 body routinely repeats the key), and this
+* text is folded into messages the host writes to its durable session log.
+*
+* @module dsh-xdpool/aggregate
+*/
+const WIRE_BY_FORMAT = Object.freeze({
+	"openai-chat": "chat",
+	"openai-responses": "responses",
+	"anthropic-messages": "messages"
+});
+/**
+* Wire suffixes, needed only for the one record the registry gives no base URL
+* to (Azure names its endpoint per deployment, so `chatEndpoint` is null there
+* and there is no registry endpoint to read the suffix off).
+*/
+const CHAT_SUFFIX = Object.freeze({
+	"openai-chat": "/chat/completions",
+	"openai-responses": "/responses",
+	"anthropic-messages": "/messages"
+});
+/**
+* Capacities for a row the registry describes only by id.
+*
+* Deliberately conservative, and the reason is visible in the number: most
+* registry rows publish no context window at all. Publishing a plausible one
+* would put a fabricated field in front of the user — and unlike a display
+* label, a wrong window is a wrong capability, so DSH would hand the provider a
+* prompt it cannot accept.
+*/
+const DEFAULT_CONTEXT_WINDOW = 131072;
+const DEFAULT_MAX_OUTPUT = 32768;
+/** Listing round budget. Generous for a small JSON document, short for a UI. */
+const LISTING_TIMEOUT_MS = 15e3;
+/** One turn's budget, matching the pool shim's idle ceiling. */
+const TURN_TIMEOUT_MS = 3e5;
+/** Sent when the registry does not declare one (kimchi, and most of the roster). */
+const USER_AGENT = "dsh-xdpool/2.1";
+/** How much of an upstream body is quoted back in a failure message. */
+const BODY_SNIPPET_CHARS = 400;
+/** A trimmed non-empty string, or ''. */
+function text$4(value) {
+	return typeof value === "string" && value.trim() !== "" ? value.trim() : "";
+}
+/** A positive finite number, or undefined. */
+function number(value) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.trunc(value) : void 0;
+}
+function isRecord$3(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/**
+* One aggregate-lane failure, carrying the class the caller maps onto HTTP.
+*
+* `kind` reuses the pool's vocabulary (`UpstreamErrorKind` in `upstream.ts`) so
+* the shim's existing error→status table serves both lanes: a third-party 429
+* is a `soft_rate`, a 401 is a `session_dead`, and neither needs a second table
+* that could drift from the first.
+*/
+var AggregateError = class extends Error {
+	kind;
+	status;
+	constructor(kind, message, status = 0) {
+		super(message);
+		this.name = "AggregateError";
+		this.kind = kind;
+		this.status = status;
+	}
+};
+/** Remove a credential from anything that may reach a message. */
+function redactAggregateSecret(value, apiKey) {
+	let source = typeof value === "string" ? value : String(value ?? "");
+	const key = text$4(apiKey);
+	if (key === "") return source;
+	const escaped = JSON.stringify(key).slice(1, -1);
+	for (const needle of escaped === key ? [key] : [key, escaped]) if (source.includes(needle)) source = source.split(needle).join("[redacted]");
+	return source;
+}
+/** A base URL a request can actually be sent to. */
+function hasPlaceholder(baseUrl) {
+	return /\{[^}]*\}/.test(baseUrl);
+}
+/** The user's `baseUrl` override when present, else the registry's own. */
+function effectiveBaseUrl(provider, setting) {
+	const override = text$4(setting.baseUrl);
+	return (override !== "" ? override : text$4(provider.baseUrl)).replace(/\/+$/, "");
+}
+/**
+* The provider's listing URL, moved by a `baseUrl` override when — and only
+* when — the declared listing actually lives under the registry base.
+*
+* Three providers (cohere, deepinfra, ollama_cloud) publish their listing on
+* another path. Rewriting a URL that never pointed at the override would invent
+* one, and a guessed listing is worse than none.
+*/
+function effectiveModelsUrl(provider, setting) {
+	const declared = modelsEndpoint(provider);
+	if (declared === null) return null;
+	const override = text$4(setting.baseUrl).replace(/\/+$/, "");
+	const registryBase = text$4(provider.baseUrl).replace(/\/+$/, "");
+	if (override === "" || registryBase === "" || !declared.startsWith(registryBase)) return declared;
+	return `${override}${declared.slice(registryBase.length)}`;
+}
+/**
+* The full URL a turn is posted to; null when the provider has no dialable
+* endpoint (Azure without a user base URL, or a base still carrying the
+* registry's `{account_id}`-style placeholder).
+*/
+function effectiveChatUrl(provider, setting) {
+	const override = text$4(setting.baseUrl).replace(/\/+$/, "");
+	const declared = chatEndpoint(provider);
+	if (declared !== null) {
+		const registryBase = text$4(provider.baseUrl).replace(/\/+$/, "");
+		const url = override === "" || registryBase === "" ? declared : `${override}${declared.slice(registryBase.length)}`;
+		return hasPlaceholder(url) ? null : url;
+	}
+	const suffix = CHAT_SUFFIX[provider.format];
+	if (override === "" || suffix === void 0 || hasPlaceholder(override)) return null;
+	return `${override}${suffix}`;
+}
+/** The per-provider settings object, or `{}` when the store names none. */
+function settingFor(store, providerId) {
+	return store.providers?.[providerId] ?? {};
+}
+/**
+* Resolve one provider's effective settings.
+*
+* Throws {@link AggregateError} with a `client` kind for every state the user
+* fixes in the settings page — an unknown id, a missing key, a placeholder base
+* URL. A `client` kind is deliberate: none of these is a transport fault, so
+* none of them should be retried against a different provider.
+*
+* `options.requireEnabled` exists for the DISCOVERY calls. Fetching a provider's
+* model list publishes nothing: it asks "does this endpoint answer, and with
+* what", and writing the answer back is a separate step the user also takes.
+* Gating it on the enable switch made a read-only button report
+* `"OpenCode Free" is not enabled in the aggregate settings` — a failure to
+* LOOK, dressed up as a failure to connect, on rows that carry no key field and
+* so offered no way to answer it. Discovery therefore does not require the
+* switch; publishing still does, in {@link buildAggregateCatalog} and
+* {@link resolveAggregateProvider} as called by the serving paths.
+*/
+function resolveAggregateProvider(store, providerId, options = {}) {
+	const id = text$4(providerId);
+	const provider = id === "" ? null : getProvider(id);
+	if (provider === null) throw new AggregateError("client", `the aggregate lane has no provider "${id === "" ? String(providerId) : id}"`);
+	const setting = settingFor(store, provider.id);
+	if (setting.enabled === false) throw new AggregateError("client", `"${provider.name}" is switched off in the aggregate settings`);
+	if (!providerAuthUsable(provider, setting)) {
+		if (provider.auth.kind === "oauth" || provider.auth.kind === "adc") throw new AggregateError("session_dead", `"${provider.name}" signs in with ${provider.auth.kind}, not with an API key, so the aggregate lane does not serve it`);
+		const where = text$4(provider.auth.url) === "" ? "" : ` (the provider issues keys at ${provider.auth.url})`;
+		throw new AggregateError("client", `"${provider.name}" needs an API key: paste one in the aggregate settings${where}`);
+	}
+	if (options.requireEnabled !== false && !providerEnabled(provider, setting)) throw new AggregateError("client", `"${provider.name}" is not enabled in the aggregate settings`);
+	const baseUrl = effectiveBaseUrl(provider, setting);
+	if (baseUrl === "") throw new AggregateError("client", `"${provider.name}" has no base URL of its own — set one in the aggregate settings`);
+	if (hasPlaceholder(baseUrl)) throw new AggregateError("client", `"${provider.name}"'s base URL still carries a registry placeholder — set the real URL in the aggregate settings`);
+	const chatUrl = effectiveChatUrl(provider, setting);
+	if (chatUrl === null) throw new AggregateError("client", `"${provider.name}" has no usable ${provider.format} endpoint`);
+	const apiKeys = orderApiKeys(providerApiKeys(setting), setting.distribution);
+	const apiKey = apiKeys[0] ?? "";
+	const headers = defaultHeaders(provider, apiKey);
+	if (headers["user-agent"] === void 0) headers["user-agent"] = USER_AGENT;
+	return {
+		providerId: provider.id,
+		providerName: provider.name,
+		apiKey,
+		/**
+		* Every key, preferred first — what rotation reads.
+		*
+		* `apiKey` above stays entry 0 because the redaction helper and every existing
+		* caller want one string. This is the field that makes several pasted keys
+		* mean something: a key the vendor rate-limits is swapped for the next one
+		* instead of failing the request.
+		*/
+		apiKeys,
+		baseUrl,
+		format: provider.format,
+		wire: WIRE_BY_FORMAT[provider.format],
+		chatUrl,
+		modelsUrl: effectiveModelsUrl(provider, setting),
+		headers
+	};
+}
+/**
+* The ids a provider should be served with, and where that list came from.
+*
+* `discovered` is the roster a fetch returned, `models` is the subset the user
+* kept, and the choice is applied LAST so it wins over both — otherwise pressing
+* "Fetch models" would silently undo the narrowing the card just saved.
+*/
+function modelIdsFor(provider, setting) {
+	const universe = modelChoicesFor(provider, setting);
+	const source = rosterIsDiscovered(provider, setting) ? "discovered" : "static";
+	const override = stringList(setting.models);
+	if (override.length === 0) return {
+		ids: universe,
+		source
+	};
+	const available = new Set(universe);
+	return {
+		ids: override.filter((id) => available.has(id)),
+		source
+	};
+}
+/**
+* Whether the roster came from a live fetch rather than the registry.
+*
+* A pre-split install has `models` and no `discovered`, because until the
+* chooser existed the only writer of `models` WAS the fetch button. Those ids
+* are a roster, not a choice, and treating them as one would shrink the vendor
+* to whatever handful the registry happens to declare.
+*/
+function rosterIsDiscovered(provider, setting) {
+	if ((setting.discovered?.length ?? 0) > 0) return true;
+	return stringList(setting.models).length > provider.models.length;
+}
+/** Every id a provider could offer: its roster, for the card's chooser. */
+function modelChoicesFor(provider, setting) {
+	const discovered = stringList(setting.discovered);
+	if (discovered.length === 0 && rosterIsDiscovered(provider, setting)) return stringList(setting.models);
+	return discovered.length > 0 ? discovered : provider.models.map((model) => model.id);
+}
+/** A de-duplicated list of non-empty trimmed strings from an untrusted array. */
+function stringList(value) {
+	if (!Array.isArray(value)) return [];
+	const seen = /* @__PURE__ */ new Set();
+	const ids = [];
+	for (const raw of value) {
+		const id = text$4(raw);
+		if (id === "" || seen.has(id)) continue;
+		seen.add(id);
+		ids.push(id);
+	}
+	return ids;
+}
+/**
+* One catalog row.
+*
+* Capacities come from the registry's model row where it has them, and fall back
+* to this module's own defaults where it does not (most rows carry no context
+* window, and none carries an output ceiling — the registry records ids and
+* published capacities, not a serving contract).
+*/
+function rowOf(provider, modelId, source) {
+	const declared = provider.models.find((model) => model.id === modelId);
+	const contextWindow = number(declared?.contextWindow) ?? DEFAULT_CONTEXT_WINDOW;
+	const label = text$4(declared?.name) !== "" ? text$4(declared?.name) : modelId;
+	return {
+		id: providerModelId(provider.id, modelId),
+		name: `${provider.name} ${label}`,
+		providerId: provider.id,
 		modelId,
 		contextWindow,
 		maxOutputTokens: Math.min(DEFAULT_MAX_OUTPUT, contextWindow),
@@ -11517,30 +12393,80 @@ async function forwardAggregateStreamed(resolved, modelId, body, options) {
 		stream: true
 	});
 	const controller = new AbortController();
+	/**
+	* Every payload goes through here first, so the tracker sees the first byte and
+	* any usage frame without the transport caring.
+	*
+	* Wrapped rather than instrumented at each `onData` call site: this function has
+	* four of them, and one missed would silently under-report the turn's tokens.
+	*/
+	const emit = (payload) => {
+		tracker.markFirstByte();
+		try {
+			tracker.observe(JSON.parse(payload));
+		} catch {}
+		options.onData(payload);
+	};
+	/**
+	* Measures this physical attempt for the ledger.
+	*
+	* Created before the request so `markFirstByte` reports from the moment the
+	* caller asked, and kept in the outer scope so the `finally` can file the call
+	* whether it succeeded or threw — a broken stream is a failed call from the
+	* user's side of the wire, and the panel must count it rather than show nothing.
+	*/
+	const tracker = new StreamTracker();
+	let delivered = false;
 	const timeoutMs = options.timeoutMs ?? TURN_TIMEOUT_MS;
 	const onCallerAbort = () => controller.abort();
 	options.signal?.addEventListener("abort", onCallerAbort, { once: true });
 	try {
-		const response = await fetch(resolved.chatUrl, {
-			method: "POST",
-			headers: {
+		/**
+		* POST, rotating the key when the vendor refuses the one we used.
+		*
+		* A provider holding several keys is a user who already knows a single key
+		* gets rate-limited. Failing the turn on a 429/401 from key #1 wastes the very
+		* thing they set up: the alternates. So a REFUSAL that looks like "this key,
+		* not this request" retries with the next key.
+		*
+		* Only the request-credential classes retry — `soft_rate` (429) and
+		* `session_dead` (401). A `client` (400), `not_found` (404), `hard_credit`
+		* (402) or `server` (5xx) failure is about the request or the account balance
+		* and would fail identically on every key, so retrying would only multiply the
+		* wait. Keys are tried in order and each at most once, so the attempt count is
+		* bounded by how many the user pasted.
+		*/
+		const keys = resolved.apiKeys.length === 0 ? [""] : resolved.apiKeys;
+		let response;
+		let usedKey = resolved.apiKey;
+		for (const [index, key] of keys.entries()) {
+			usedKey = key;
+			const headers = {
 				...resolved.headers,
 				accept: "text/event-stream"
-			},
-			body: bodyText,
-			redirect: "error",
-			signal: controller.signal
-		});
-		const retryAfter = retryAfterMs(response);
-		if (!response.ok) {
+			};
+			if (resolved.apiKey !== "") {
+				for (const [name, value] of Object.entries(headers)) if (value === resolved.apiKey) headers[name] = key;
+			}
+			response = await fetch(resolved.chatUrl, {
+				method: "POST",
+				headers,
+				body: bodyText,
+				redirect: "error",
+				signal: controller.signal
+			});
+			if (response.ok) break;
+			const retryAfter = retryAfterMs(response);
 			const refusal = await response.text().catch(() => "");
-			throw classifyUpstream(response.status, refusal, retryAfter, resolved.apiKey);
+			const failure = classifyUpstream(response.status, refusal, retryAfter, key);
+			if (!(failure.kind === "soft_rate" || failure.kind === "session_dead") || index === keys.length - 1) throw failure;
 		}
 		if (response.body === null) throw new AggregateError("server", "the provider returned no body", response.status);
 		const head = await readSseHead(response.body, controller.signal, timeoutMs);
 		if (head.shape === "empty") throw new AggregateError("server", "the provider returned no body", response.status);
 		if (head.shape === "sse") {
-			for (const payload of head.payloads) options.onData(payload);
+			for (const payload of head.payloads) emit(payload);
+			delivered = true;
 			return { status: response.status };
 		}
 		let raw = head.text;
@@ -11562,8 +12488,9 @@ async function forwardAggregateStreamed(resolved, modelId, body, options) {
 			if (/^\s*<(!doctype|html[\s>])/i.test(raw)) throw new AggregateError("client", `the provider's front proxy answered HTTP ${response.status} with an HTML error page`, response.status);
 			throw new AggregateError("server", `unexpected non-stream response: ${redactAggregateSecret(raw, resolved.apiKey).slice(0, 200)}`, response.status);
 		}
-		if (isRecord$3(payload) && (payload.error !== void 0 || payload.type === "error")) throw classifyUpstream(response.status, raw, retryAfter, resolved.apiKey);
-		for (const frame of synthesisedFrames(resolved.wire, payload, model)) options.onData(frame);
+		if (isRecord$3(payload) && (payload.error !== void 0 || payload.type === "error")) throw classifyUpstream(response.status, raw, retryAfterMs(response), usedKey);
+		for (const frame of synthesisedFrames(resolved.wire, payload, model)) emit(frame);
+		delivered = true;
 		return { status: response.status };
 	} catch (error) {
 		if (error instanceof AggregateError) throw error;
@@ -11573,6 +12500,18 @@ async function forwardAggregateStreamed(resolved, modelId, body, options) {
 		throw new AggregateError("server", `the request to ${resolved.providerName} failed: ${redactAggregateSecret(cause, resolved.apiKey)}`);
 	} finally {
 		options.signal?.removeEventListener("abort", onCallerAbort);
+		tracker.finish(Date.now());
+		options.usage?.recorder.record({
+			channel: resolved.providerId,
+			region: "",
+			model,
+			turnId: options.usage.turnId,
+			at: Date.now(),
+			ok: delivered,
+			...tracker.ttftMs === void 0 ? {} : { ttftMs: tracker.ttftMs },
+			...tracker.decodeMs === void 0 ? {} : { decodeMs: tracker.decodeMs },
+			...tracker.usage === void 0 ? {} : { usage: tracker.usage }
+		});
 	}
 }
 /**
@@ -12230,65 +13169,6 @@ function createWorkBuddyAdapter(options) {
 	};
 }
 //#endregion
-//#region src/billion-mount.ts
-/** The package name the loader resolves, exactly as our patch row names it. */
-const BILLION_PACKAGE = "billion-context";
-/**
-* Is this package installed and able to run?
-*
-* Any entry whose name matches counts — including one whose fiber has not
-* started yet. When this function still decided whether to mount, a fiber-less
-* entry had to be treated as absent: treating an import-in-flight as present
-* would have skipped the mount and left the compressor never starting. Now that
-* nothing mounts, the distinction only picks a label, and the honest one is
-* "installed": a user watching billion-context's own boot does not want the
-* card telling them it is missing while its proxy is half-way up.
-*
-* A DISABLED entry does not count. `loader.entries()` yields disabled rows too
-* — the host skips starting them, it does not drop them — and our own patch
-* row is disabled on purpose. Counting it would make every profile that never
-* installed billion-context read as "installed", which is precisely the lie the
-* card must not tell.
-*/
-function mountedInLoader(loader, packageName) {
-	for (const entry of loader.entries()) {
-		if (entry.options?.name !== packageName) continue;
-		if (entry.options?.disabled === true) continue;
-		return true;
-	}
-	return false;
-}
-/**
-* Report whether the compressor is already running. Never mounts.
-*
-* Resolves rather than rejects on every path: a compressor that will not start
-* is a card that says so, never a pool that fails to boot. The pool's own model
-* registry has nothing to do with compression, and one missing optional feature
-* must not take the accounts down with it.
-*/
-async function mountBillionContext(ctx, logger) {
-	try {
-		let loader;
-		ctx.inject(["loader"], (scoped) => {
-			loader = scoped.loader;
-		});
-		if (loader === void 0) return {
-			state: "unavailable",
-			reason: "the host exposes no plugin loader"
-		};
-		if (mountedInLoader(loader, BILLION_PACKAGE)) {
-			logger.info?.(`[xdpool] billion-context is already mounted; leaving it alone`);
-			return { state: "already-mounted" };
-		}
-		return { state: "not-required" };
-	} catch (error) {
-		return {
-			state: "unavailable",
-			reason: error instanceof Error ? error.message : String(error)
-		};
-	}
-}
-//#endregion
 //#region src/pack-accounts.ts
 /**
 * Channel ids whose accounts this plugin serves itself.
@@ -12343,6 +13223,7 @@ function packCredentialToWorkBuddy(entry, document) {
 	const expiresAtMs = expiryToMs(document.expires_at) || expiryToMs(entry.expiresAt);
 	const nickname = text$3(document.nickname) ?? text$3(entry.nickname);
 	const uid = text$3(document.user_id);
+	const enterpriseId = text$3(document.enterprise_id);
 	return {
 		accessToken,
 		refreshToken: text$3(document.refresh_token) ?? "",
@@ -12350,7 +13231,7 @@ function packCredentialToWorkBuddy(entry, document) {
 		...expiryToMs(document.refresh_expires_at) > 0 ? { refreshExpiresAtMs: expiryToMs(document.refresh_expires_at) } : {},
 		...nickname === void 0 ? {} : { nickname },
 		...uid === void 0 ? {} : { uid },
-		...text$3(document.enterprise_id) === void 0 ? {} : { enterpriseId: text$3(document.enterprise_id) },
+		...enterpriseId === void 0 ? {} : { enterpriseId },
 		domain,
 		sourcePath: `channel-pack:${provider}:${refName}`
 	};
@@ -12486,31 +13367,123 @@ function imageUrlOf(block, resolveImage, warnings) {
 			...typeof block.path === "string" ? { path: block.path } : {},
 			...typeof block.url === "string" ? { url: block.url } : {}
 		});
-		if (resolved !== void 0 && resolved !== "") return resolved;
+		if (resolved !== void 0 && resolved !== "") return resolved;
+	}
+	const nested = block.image_url;
+	const direct = typeof nested === "string" ? nested : text$2(block.url ?? block.data ?? (isRecord$2(nested) ? nested.url : void 0));
+	if (direct.startsWith("data:")) return direct;
+	if (direct.startsWith("http://") || direct.startsWith("https://")) return direct;
+	warnings.push("image-dropped");
+}
+/**
+* Drop tool calls nobody answered, and tool results nobody called.
+*
+* Every wire spells tool traffic as a PAIR: an assistant `tool_calls` entry with
+* an id, and a `role: 'tool'` message answering that same id. Upstream rejects a
+* conversation that breaks the pairing — and it rejects it EVERY TURN from then
+* on, because the offending messages stay in the history. A single interrupted
+* turn therefore makes a session permanently unusable, which is exactly what
+* users report as "this conversation broke and won't come back".
+*
+* Three shapes are repaired, all by DROPPING rather than inventing:
+*
+*   1. a `tool_calls` entry with no answer — the model called a tool, the turn
+*      was interrupted, and the result never arrived. Keeping the call and
+*      fabricating an answer would teach the model a lie; dropping the call
+*      leaves the assistant text intact and the conversation legible.
+*   2. a `tool` message whose id answers no call — the call was pruned in an
+*      earlier turn, or the result outlived its call.
+*   3. a `tool_calls` entry with an EMPTY name — it is "answered" by any result
+*      but cannot be replayed: upstream validates the name. Responding side is
+*      already safe (an unknown name is held back rather than streamed), but the
+*      HISTORY would otherwise keep shipping it.
+*
+* Dropping is safe here only because the alternative is a hard 400 that kills
+* every subsequent turn. It is reported through `warnings` so the drop is not
+* silent — the same channel the request body already uses for other repairs.
+*/
+function repairToolPairing(messages, warnings) {
+	const called = /* @__PURE__ */ new Set();
+	const answered = /* @__PURE__ */ new Set();
+	for (const message of messages) {
+		for (const call of toolCallsOf(message)) if (call.id !== "" && call.name !== "") called.add(call.id);
+		for (const result of toolResultsOf(message)) if (result.callId !== "") answered.add(result.callId);
+	}
+	let droppedCalls = 0;
+	let droppedResults = 0;
+	const out = [];
+	for (const message of messages) {
+		if (message.role === "tool") {
+			const id = text$2(message.tool_call_id ?? message.toolCallId ?? message.id);
+			if (id !== "" && !called.has(id)) {
+				droppedResults += 1;
+				continue;
+			}
+			out.push(message);
+			continue;
+		}
+		const calls = toolCallsOf(message);
+		if (calls.length === 0) {
+			out.push(message);
+			continue;
+		}
+		const kept = calls.filter((call) => call.id !== "" && call.name !== "" && answered.has(call.id));
+		if (kept.length === calls.length) {
+			out.push(message);
+			continue;
+		}
+		droppedCalls += calls.length - kept.length;
+		if (kept.length === 0) {
+			if (textOf(blocksOf(message.content)) === "") continue;
+			const stripped = { ...message };
+			delete stripped.tool_calls;
+			delete stripped.toolCalls;
+			out.push(stripped);
+			continue;
+		}
+		out.push({
+			...message,
+			tool_calls: kept
+		});
 	}
-	const nested = block.image_url;
-	const direct = typeof nested === "string" ? nested : text$2(block.url ?? block.data ?? (isRecord$2(nested) ? nested.url : void 0));
-	if (direct.startsWith("data:")) return direct;
-	if (direct.startsWith("http://") || direct.startsWith("https://")) return direct;
-	warnings.push("image-dropped");
+	if (droppedCalls > 0) warnings.push(`${String(droppedCalls)} unanswered tool call(s) were dropped so the conversation can continue`);
+	if (droppedResults > 0) warnings.push(`${String(droppedResults)} orphaned tool result(s) were dropped so the conversation can continue`);
+	return out;
 }
-/** Every tool result a message carries, in order. */
+/**
+* Every tool result a message carries, in order.
+*
+* The `role: 'tool'` case is the one that was silent and expensive: DSH's own
+* tool messages carry the RESULT as their content — there is no `tool-result`
+* block wrapper to find. Filtering for that wrapper therefore returned `[]`, and
+* the call sites skip a tool message with no results (`continue`), so the whole
+* result vanished from all three wires. The model then saw a conversation in
+* which it had called a tool and never learned the outcome, and re-issued the
+* same call forever — reported as "the tool returned no result" (#113).
+*
+* So: a tool message's content IS the result. Only a non-tool message is
+* searched for the wrapper blocks (that is the Anthropic-shaped spelling, where
+* a `user` turn can carry `tool-result` blocks).
+*/
 function toolResultsOf(message) {
-	if (message.role !== "tool") {
-		const blocks = blocksOf(message.content).filter((block) => block.type === "tool-result");
-		if (blocks.length === 0) return [];
+	if (message.role === "tool") {
+		const callId = text$2(message.tool_call_id ?? message.toolCallId ?? message.id);
+		const blocks = blocksOf(message.content);
 		return [{
-			callId: text$2(message.tool_call_id ?? message.toolCallId ?? message.id),
-			content: blocks
+			callId,
+			content: blocks.length > 0 ? blocks : [{
+				type: "text",
+				text: typeof message.content === "string" ? message.content : ""
+			}],
+			...message.is_error === true || message.isError === true ? { failed: true } : {}
 		}];
 	}
-	const out = [];
 	const blocks = blocksOf(message.content).filter((block) => block.type === "tool-result");
-	for (const block of blocks) out.push({
-		callId: text$2(block.tool_use_id ?? block.toolCallId ?? message.tool_call_id ?? message.id),
-		content: [block]
-	});
-	return out;
+	if (blocks.length === 0) return [];
+	return [{
+		callId: text$2(message.tool_call_id ?? message.toolCallId ?? message.id),
+		content: blocks
+	}];
 }
 /** The tool call a message's `tool_calls` array holds, when it holds one. */
 function toolCallsOf(message) {
@@ -12575,7 +13548,7 @@ function toolDefsFor(tools, wire) {
 */
 function requestBodyFor(wire, body, options) {
 	const { modelId, resolveImage, warnings } = options;
-	const messages = Array.isArray(body.messages) ? body.messages.filter(isRecord$2) : [];
+	const messages = repairToolPairing(Array.isArray(body.messages) ? body.messages.filter(isRecord$2) : [], warnings);
 	const stream = body.stream === true;
 	const reasoningEffort = text$2(body.reasoning_effort);
 	const out = {
@@ -12751,7 +13724,8 @@ function claudeTurns(messages, resolveImage, warnings) {
 				content: [{
 					type: "tool_result",
 					tool_use_id: result.callId,
-					content: body !== "" ? body : content.length > 0 ? content : "(no output)"
+					content: body !== "" ? body : content.length > 0 ? content : "(no output)",
+					...result.failed === true ? { is_error: true } : {}
 				}]
 			});
 		}
@@ -13758,6 +14732,33 @@ function withSessionQuotaHint(error, retryAfterMs) {
 	return new AggregateError(error.kind, `${error.message} — this quota is counted per conversation on the free tier, so a new conversation (or another model) starts with its own budget`, error.status);
 }
 /**
+* Say what a 403 on this lane actually means (#96).
+*
+* The gateway answers a client it does not recognise with `403 FreeTierError`
+* and no explanation of which of its four fingerprint facts was wrong. That
+* reaches the caller as a bare `client` failure, and a bare 4xx is what the
+* host then renders in its own words: the user in #96 saw "当前请求的额度已用尽"
+* for a request that had never been billed. The wording pointed at waiting,
+* while the actual cause was "this build's fingerprint no longer matches, update
+* the plugin" — the two need opposite responses.
+*
+* The lane cannot tell them apart from the outside (both look like a refusal
+* with a thin body), so this does not pretend to. It names the actionable
+* reading FIRST — the fingerprint, which the user can fix by updating — and
+* keeps the quota possibility second, because it is the one that fixes itself.
+*
+* A 429 keeps its own hint ({@link withSessionQuotaHint}): that one really is
+* quota, and blurring the two would lose a distinction worth keeping.
+*/
+function withFreeTierHint(status, refusal, retryAfterMs) {
+	const base = classifyUpstream(status, refusal, retryAfterMs, "");
+	if (status !== 403) return base;
+	const separator = base.message.indexOf(": ");
+	const detail = separator === -1 ? "" : base.message.slice(separator + 2);
+	const kept = detail === "" ? "" : ` (provider said: ${detail})`;
+	return new AggregateError(base.kind, `the free lane refused this client: its request fingerprint no longer matches what opencode.ai accepts, so this is NOT an exhausted quota and waiting will not help — update dsh-xdpool and try again; if it persists, report this message. The shared free quota is also metered per conversation, so one retry in a fresh conversation covers the case where only that budget is spent${kept}`, status);
+}
+/**
 * POST one streaming turn and hand back chat-shaped deltas.
 *
 * The shape of the ANSWER decides how it is read, never its Content-Type: a front
@@ -13801,7 +14802,7 @@ async function postFreeStreamed({ modelId, body, session, requestId, hooks, plan
 	const retryAfter = retryAfterMs(response);
 	if (!response.ok) {
 		const refusal = await response.text().catch(() => "");
-		throw withSessionQuotaHint(classifyUpstream(response.status, refusal, retryAfter, ""), retryAfter);
+		throw withSessionQuotaHint(withFreeTierHint(response.status, refusal, retryAfter), retryAfter);
 	}
 	if (response.body === null) throw new AggregateError("server", "the free lane returned no body", response.status);
 	let events;
@@ -13834,7 +14835,7 @@ async function postFreeStreamed({ modelId, body, session, requestId, hooks, plan
 		} catch {
 			continue;
 		}
-		if (isRecord$1(decoded) && (decoded.error !== void 0 || decoded.type === "error")) throw withSessionQuotaHint(classifyUpstream(response.status, event, retryAfter, ""), retryAfter);
+		if (isRecord$1(decoded) && (decoded.error !== void 0 || decoded.type === "error")) throw withSessionQuotaHint(withFreeTierHint(response.status, event, retryAfter), retryAfter);
 		const translated = chatChunksFor(wire, decoded, tools);
 		for (const delta of translated.frames) hooks.onDelta(delta);
 		if (translated.usage !== void 0) usage = translated.usage;
@@ -13849,7 +14850,7 @@ async function postFreeStreamed({ modelId, body, session, requestId, hooks, plan
 		result.usage = usage;
 	}
 	result.suppressedOnly = tools.suppressed();
-	result.finishReason = finish;
+	if (finish !== void 0) result.finishReason = finish;
 	return result;
 }
 /**
@@ -14057,542 +15058,213 @@ function capabilitiesFor(modelId) {
 		canDisableThinking: true
 	};
 }
-/** Is this id's availability known to depend on where the request leaves from? */
-function isRegionSensitive(modelId) {
-	const base = baseModelId(modelId);
-	return REGION_SENSITIVE.some((pattern) => pattern.test(base));
-}
-/** Title-case a bare upstream id into something a picker can show. */
-function displayModelName(modelId) {
-	const base = baseModelId(modelId);
-	const known = DISPLAY_NAMES[base];
-	if (known !== void 0) return known;
-	return base.replace(/[-_.]+/gu, " ").replace(/(\d)\s+/gu, "$1 ").trim().split(" ").map((word) => /^\d/u.test(word) ? word : word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
-}
-/** Parse the gateway's `{"data":[{"id":…}]}` listing. */
-function parseListing(payload) {
-	const rows = Array.isArray(payload?.data) ? payload.data : Array.isArray(payload?.models) ? payload.models : Array.isArray(payload) ? payload : [];
-	const out = [];
-	for (const row of rows) {
-		const id = typeof row === "string" ? row : row?.id;
-		if (typeof id === "string" && id !== "") out.push(id);
-	}
-	return out;
-}
-/**
-* The free rows for a raw listing, in listing order.
-*
-* The prefix is what the shim routes on, so it is applied here rather than at
-* the call sites: one place decides the lane's id shape, and every reader gets it
-* the same way.
-*/
-function buildFreeCatalog(ids) {
-	const seen = /* @__PURE__ */ new Set();
-	const rows = [];
-	for (const raw of ids) {
-		const id = raw.trim();
-		if (id === "" || !isFreeLane(id)) continue;
-		const base = baseModelId(id);
-		if (seen.has(base)) continue;
-		seen.add(base);
-		const caps = capabilitiesFor(base);
-		rows.push({
-			id: base,
-			modelId: `${FREE_MODEL_PREFIX}${base}`,
-			name: displayModelName(base),
-			wire: wireFor(base),
-			vision: caps.vision,
-			reasoning: caps.reasoning,
-			contextWindow: positiveInt(caps.contextWindow) ?? FALLBACK_CAPABILITY.contextWindow,
-			maxOutput: positiveInt(caps.maxOutput) ?? FALLBACK_CAPABILITY.maxOutput,
-			canDisableThinking: caps.canDisableThinking,
-			regionSensitive: isRegionSensitive(base)
-		});
-	}
-	return rows;
-}
-/** One listing round. Returns the parsed JSON document. */
-async function fetchFreeListing(options = {}) {
-	const controller = new AbortController();
-	const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 15e3);
-	timer.unref?.();
-	let callerAborted = false;
-	const onCallerAbort = () => {
-		callerAborted = true;
-		controller.abort();
-	};
-	options.signal?.addEventListener("abort", onCallerAbort, { once: true });
-	try {
-		const response = await freeFetch(`${FREE_UPSTREAM_BASE}${FREE_LISTING_PATH}`, {
-			headers: gatewayHeaders({
-				session: sessionForConversation(options.session),
-				requestId: mintRequestId(),
-				stream: false,
-				accept: "application/json"
-			}),
-			signal: controller.signal
-		});
-		const text = await response.text();
-		if (!response.ok) throw new Error(`the free lane answered HTTP ${response.status}: ${text.slice(0, 200)}`);
-		return JSON.parse(text);
-	} catch (error) {
-		if (callerAborted || options.signal?.aborted === true) throw new Error("request aborted");
-		if (error instanceof Error && error.name === "AbortError") throw new Error(`the free lane's listing did not answer within ${String(options.timeoutMs ?? 15e3)}ms`);
-		throw error instanceof Error ? error : new Error(String(error));
-	} finally {
-		clearTimeout(timer);
-		options.signal?.removeEventListener("abort", onCallerAbort);
-	}
-}
-/**
-* The static roster, used until the first listing lands and again whenever one
-* fails.
-*
-* An empty picker is the one outcome a user reads as "the plugin broke", so the
-* lane ships with rows it can serve without ever having reached the network.
-* These are the ids the gateway is known to serve免密 today; a row that later
-* disappears costs one dead model entry, while an empty lane costs everything.
-*/
-const FALLBACK_FREE_MODEL_IDS = Object.freeze([
-	"muse-spark-1.3-contributor-free",
-	"muse-spark-1.2-contributor-free",
-	"union-alpha",
-	"space-bunny-free",
-	"nemotron-3-ultra-free",
-	"deepseek-v4-flash-free",
-	"mimo-v2.6-flash-free",
-	"mimo-v2.5-free",
-	"jev-1.13-free"
-]);
-/** Live free roster with a static fallback behind it. */
-var FreeCatalog = class {
-	rows;
-	listeners = /* @__PURE__ */ new Set();
-	lastError;
-	lastUpdatedAt;
-	constructor(fallback = FALLBACK_FREE_MODEL_IDS) {
-		this.rows = Object.freeze(buildFreeCatalog(fallback));
-	}
-	current() {
-		return this.rows;
-	}
-	/** Why the last refresh failed, for display. Never a substitute for rows. */
-	error() {
-		return this.lastError;
-	}
-	/** When the live list last landed. */
-	updatedAt() {
-		return this.lastUpdatedAt;
-	}
-	/** The row behind a published id, or undefined. */
-	find(modelId) {
-		return this.rows.find((row) => row.modelId === modelId || row.id === modelId);
-	}
-	/** Whether anything is being served right now. */
-	hasRows() {
-		return this.rows.length > 0;
-	}
-	onChange(listener) {
-		this.listeners.add(listener);
-		return () => {
-			this.listeners.delete(listener);
-		};
-	}
-	/**
-	* Re-read the listing and notify when the roster actually changed.
-	*
-	* A failed refresh KEEPS the current rows and records the error. Dropping to
-	* empty here would make a network hiccup look like the models were deleted.
-	*/
-	async refresh(options = {}) {
-		let next;
-		try {
-			next = Object.freeze(buildFreeCatalog(parseListing(await fetchFreeListing(options))));
-		} catch (error) {
-			this.lastError = error instanceof Error ? error.message : String(error);
-			if (this.rows.length === 0) this.rows = Object.freeze(buildFreeCatalog(FALLBACK_FREE_MODEL_IDS));
-			for (const listener of this.listeners) listener();
-			return this.rows;
-		}
-		if (next.length === 0) {
-			this.lastError = "the gateway listing held no免密 models";
-			for (const listener of this.listeners) listener();
-			return this.rows;
-		}
-		this.lastError = void 0;
-		this.lastUpdatedAt = (/* @__PURE__ */ new Date()).toISOString();
-		if (next.length === this.rows.length && next.every((row, index) => row.modelId === this.rows[index]?.modelId)) return this.rows;
-		this.rows = next;
-		for (const listener of this.listeners) listener();
-		return this.rows;
-	}
-};
-//#endregion
-//#region src/stats.ts
-/**
-* Retained calls. Bounded on purpose: a busy week is thousands of calls, and a
-* dashboard that grows without limit turns into a memory leak with a chart.
-*/
-const USAGE_MAX_SAMPLES = 2e3;
-/**
-* Minimum total decoding time before a throughput figure is published.
-*
-* A one-token answer that arrives in 20ms would otherwise report a tps two
-* orders of magnitude above anything a real turn reaches, and the panel would
-* rank models by that artefact instead of by speed.
-*/
-const MIN_DECODE_MS = 120;
-/**
-* A reported token count, or null when the key is absent / not a finite
-* number.
-*
-* Zero is ACCEPTED: an empty turn really can cost nothing, and reporting that
-* as "the gateway said nothing" would make the panel lie in the other
-* direction.
-*/
-function count(value) {
-	return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.floor(value) : null;
-}
-function zero(value) {
-	return count(value) ?? 0;
-}
-function detailOf(value, key) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return 0;
-	return zero(value[key]);
-}
-/**
-* Read a gateway `usage` object, accepting both spellings OpenAI-compatible
-* gateways use (`prompt_tokens` / `input_tokens`).
-*
-* Returns undefined when the document is not a usage report at all, so callers
-* can tell "the gateway sent zeroes" from "there was nothing here".
-*/
-function parseUsage(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
-	const obj = value;
-	const input = count(obj["prompt_tokens"]) ?? count(obj["input_tokens"]);
-	const output = count(obj["completion_tokens"]) ?? count(obj["output_tokens"]);
-	if (input === null && output === null) return void 0;
-	return {
-		inputTokens: input ?? 0,
-		outputTokens: output ?? 0,
-		reasoningTokens: detailOf(obj["completion_tokens_details"], "reasoning_tokens"),
-		cachedTokens: detailOf(obj["prompt_tokens_details"], "cached_tokens")
-	};
-}
-/**
-* True for the trailer frame a gateway sends to report usage.
-*
-* It is recognised by an EMPTY `choices` array beside a `usage` field. A frame
-* that also carries content is a normal chunk that happens to mention usage,
-* and dropping it would delete the user's answer - which is why the strip step
-* downstream is allowed to remove exactly these and nothing else.
-*/
-function isUsageOnlyFrame(parsed) {
-	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return false;
-	const obj = parsed;
-	if (obj["usage"] === void 0 || obj["usage"] === null) return false;
-	const choices = obj["choices"];
-	return Array.isArray(choices) && choices.length === 0;
+/** Is this id's availability known to depend on where the request leaves from? */
+function isRegionSensitive(modelId) {
+	const base = baseModelId(modelId);
+	return REGION_SENSITIVE.some((pattern) => pattern.test(base));
 }
-/** Local calendar day of an instant, as `YYYY-MM-DD`. */
-function usageDayKey(at) {
-	const d = new Date(at);
-	const month = String(d.getMonth() + 1).padStart(2, "0");
-	const day = String(d.getDate()).padStart(2, "0");
-	return `${d.getFullYear()}-${month}-${day}`;
+/** Title-case a bare upstream id into something a picker can show. */
+function displayModelName(modelId) {
+	const base = baseModelId(modelId);
+	const known = DISPLAY_NAMES[base];
+	if (known !== void 0) return known;
+	return base.replace(/[-_.]+/gu, " ").replace(/(\d)\s+/gu, "$1 ").trim().split(" ").map((word) => /^\d/u.test(word) ? word : word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
+}
+/** Parse the gateway's `{"data":[{"id":…}]}` listing. */
+function parseListing(payload) {
+	const rows = Array.isArray(payload?.data) ? payload.data : Array.isArray(payload?.models) ? payload.models : Array.isArray(payload) ? payload : [];
+	const out = [];
+	for (const row of rows) {
+		const id = typeof row === "string" ? row : row?.id;
+		if (typeof id === "string" && id !== "") out.push(id);
+	}
+	return out;
 }
 /**
-* Timing and usage captured while one stream is forwarded.
+* The free rows for a raw listing, in listing order.
 *
-* Kept free of Node stream types so it can be unit tested with plain numbers;
-* the shim owns the Transform that feeds it chunks.
+* The prefix is what the shim routes on, so it is applied here rather than at
+* the call sites: one place decides the lane's id shape, and every reader gets it
+* the same way.
 */
-var StreamTracker = class {
-	/** Milliseconds from request start to the first byte, once seen. */
-	ttftMs;
-	/** Milliseconds from first byte to the end of the stream, once finished. */
-	decodeMs;
-	/** Usage seen in any frame, if the gateway sent any. */
-	usage;
-	firstAt;
-	startedAt;
-	constructor(startedAt = Date.now()) {
-		this.startedAt = startedAt;
-	}
-	/** Record the first byte. Repeated calls keep the earliest. */
-	markFirstByte(at = Date.now()) {
-		if (this.firstAt !== void 0) return;
-		this.firstAt = at;
-		const ttft = at - this.startedAt;
-		if (ttft >= 0) this.ttftMs = ttft;
-	}
-	/** Record stream completion. Repeated calls keep the earliest. */
-	finish(at = Date.now()) {
-		if (this.decodeMs !== void 0) return;
-		if (this.firstAt === void 0) return;
-		const decode = at - this.firstAt;
-		if (decode >= 0) this.decodeMs = decode;
+function buildFreeCatalog(ids) {
+	const seen = /* @__PURE__ */ new Set();
+	const rows = [];
+	for (const raw of ids) {
+		const id = raw.trim();
+		if (id === "" || !isFreeLane(id)) continue;
+		const base = baseModelId(id);
+		if (seen.has(base)) continue;
+		seen.add(base);
+		const caps = capabilitiesFor(base);
+		rows.push({
+			id: base,
+			modelId: `${FREE_MODEL_PREFIX}${base}`,
+			name: displayModelName(base),
+			wire: wireFor(base),
+			vision: caps.vision,
+			reasoning: caps.reasoning,
+			contextWindow: positiveInt(caps.contextWindow) ?? FALLBACK_CAPABILITY.contextWindow,
+			maxOutput: positiveInt(caps.maxOutput) ?? FALLBACK_CAPABILITY.maxOutput,
+			canDisableThinking: caps.canDisableThinking,
+			regionSensitive: isRegionSensitive(base)
+		});
 	}
-	/** Fold a parsed frame's usage in; later frames overwrite, as the gateway intends. */
-	observe(parsed) {
-		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return;
-		const usage = parseUsage(parsed["usage"]);
-		if (usage !== void 0) this.usage = usage;
+	return rows;
+}
+/** One listing round. Returns the parsed JSON document. */
+async function fetchFreeListing(options = {}) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 15e3);
+	timer.unref?.();
+	let callerAborted = false;
+	const onCallerAbort = () => {
+		callerAborted = true;
+		controller.abort();
+	};
+	options.signal?.addEventListener("abort", onCallerAbort, { once: true });
+	try {
+		const response = await freeFetch(`${FREE_UPSTREAM_BASE}${FREE_LISTING_PATH}`, {
+			headers: gatewayHeaders({
+				session: sessionForConversation(options.session),
+				requestId: mintRequestId(),
+				stream: false,
+				accept: "application/json"
+			}),
+			signal: controller.signal
+		});
+		const text = await response.text();
+		if (!response.ok) throw new Error(`the free lane answered HTTP ${response.status}: ${text.slice(0, 200)}`);
+		return JSON.parse(text);
+	} catch (error) {
+		if (callerAborted || options.signal?.aborted === true) throw new Error("request aborted");
+		if (error instanceof Error && error.name === "AbortError") throw new Error(`the free lane's listing did not answer within ${String(options.timeoutMs ?? 15e3)}ms`);
+		throw error instanceof Error ? error : new Error(String(error));
+	} finally {
+		clearTimeout(timer);
+		options.signal?.removeEventListener("abort", onCallerAbort);
 	}
-};
+}
 /**
-* A bounded window of recent calls, summarised on demand.
+* The static roster, used until the first listing lands and again whenever one
+* fails.
 *
-* In-memory by design: this is a live panel, and persisting every prompt's
-* token counts would turn a convenience into a record of what the user asked.
-* A restart therefore starts the chart again, which the panel states rather
-* than hides.
-*/
-var UsageRecorder = class {
-	samples = [];
-	limit;
-	constructor(limit = USAGE_MAX_SAMPLES) {
-		this.limit = limit > 0 ? limit : 1;
-	}
-	/** Retain one call, dropping the oldest once the window is full. */
-	record(call) {
-		this.samples.push(call);
-		while (this.samples.length > this.limit) this.samples.shift();
-	}
-	/** Samples currently retained. */
-	size() {
-		return this.samples.length;
-	}
-	/** Forget every retained call. */
-	reset() {
-		this.samples = [];
-	}
-	/** Aggregate the retained window. */
-	summary() {
-		const rows = /* @__PURE__ */ new Map();
-		const turns = /* @__PURE__ */ new Map();
-		let calls = 0;
-		let usageReported = false;
-		for (const call of this.samples) {
-			calls += 1;
-			if (call.usage !== void 0) usageReported = true;
-			const bucket = turns.get(call.turnId) ?? {
-				calls: 0,
-				succeeded: 0,
-				failed: 0
-			};
-			bucket.calls += 1;
-			if (call.ok) bucket.succeeded += 1;
-			else bucket.failed += 1;
-			turns.set(call.turnId, bucket);
-			const key = `${call.region}\u0000${call.model}`;
-			let acc = rows.get(key);
-			if (acc === void 0) {
-				acc = {
-					row: {
-						region: call.region,
-						model: call.model,
-						calls: 0,
-						turns: 0,
-						failed: 0,
-						recovered: 0,
-						inputTokens: 0,
-						outputTokens: 0,
-						reasoningTokens: 0,
-						cachedTokens: 0,
-						tps: null,
-						avgTtftMs: null,
-						lastUsedAt: 0
-					},
-					turnIds: /* @__PURE__ */ new Set(),
-					decodeMs: 0,
-					ttftTotal: 0,
-					ttftCount: 0
-				};
-				rows.set(key, acc);
-			}
-			acc.row.calls += 1;
-			acc.turnIds.add(call.turnId);
-			if (!call.ok) acc.row.failed += 1;
-			if (call.at > acc.row.lastUsedAt) acc.row.lastUsedAt = call.at;
-			if (call.ttftMs !== void 0) {
-				acc.ttftTotal += call.ttftMs;
-				acc.ttftCount += 1;
-			}
-			if (call.decodeMs !== void 0) acc.decodeMs += call.decodeMs;
-			if (call.usage !== void 0) {
-				acc.row.inputTokens += call.usage.inputTokens;
-				acc.row.outputTokens += call.usage.outputTokens;
-				acc.row.reasoningTokens += call.usage.reasoningTokens;
-				acc.row.cachedTokens += call.usage.cachedTokens;
-			}
-		}
-		const failedTurnIds = /* @__PURE__ */ new Set();
-		let recoveredTurns = 0;
-		for (const [turnId, bucket] of turns) if (bucket.failed > 0 && bucket.succeeded === 0) failedTurnIds.add(turnId);
-		else if (bucket.failed > 0) recoveredTurns += 1;
-		const out = [];
-		for (const acc of rows.values()) {
-			let recovered = 0;
-			for (const turnId of acc.turnIds) {
-				const bucket = turns.get(turnId);
-				if (bucket !== void 0 && bucket.failed > 0 && bucket.succeeded > 0) recovered += 1;
-			}
-			out.push({
-				...acc.row,
-				turns: acc.turnIds.size,
-				recovered,
-				tps: acc.decodeMs >= MIN_DECODE_MS ? Math.round(acc.row.outputTokens / (acc.decodeMs / 1e3)) : null,
-				avgTtftMs: acc.ttftCount > 0 ? Math.round(acc.ttftTotal / acc.ttftCount) : null
-			});
-		}
-		out.sort((a, b) => b.calls - a.calls || b.lastUsedAt - a.lastUsedAt || a.model.localeCompare(b.model));
-		return {
-			samples: this.samples.length,
-			turns: turns.size,
-			failedTurns: failedTurnIds.size,
-			recoveredTurns,
-			calls,
-			usageReported,
-			entries: this.samples.slice().reverse(),
-			rows: out,
-			accounts: this.accountRows(),
-			days: this.days(failedTurnIds)
-		};
-	}
+* An empty picker is the one outcome a user reads as "the plugin broke", so the
+* lane ships with rows it can serve without ever having reached the network.
+* These are the ids the gateway is known to serve免密 today; a row that later
+* disappears costs one dead model entry, while an empty lane costs everything.
+*/
+const FALLBACK_FREE_MODEL_IDS = Object.freeze([
+	"muse-spark-1.3-contributor-free",
+	"muse-spark-1.2-contributor-free",
+	"union-alpha",
+	"space-bunny-free",
+	"nemotron-3-ultra-free",
+	"deepseek-v4-flash-free",
+	"mimo-v2.6-flash-free",
+	"mimo-v2.5-free",
+	"jev-1.13-free"
+]);
+/** Live free roster with a static fallback behind it. */
+var FreeCatalog = class {
+	rows;
+	listeners = /* @__PURE__ */ new Set();
+	lastError;
+	lastUpdatedAt;
 	/**
-	* One row per account, busiest first.
+	* Whether this lane contributes models at all.
 	*
-	* Samples that never named an account are grouped under an empty label
-	* rather than dropped: `account` is optional on `UsageCall`, so a caller that
-	* files a sample without one - a failure raised before any account was ever
-	* picked, say - would otherwise vanish from this view, and the account table
-	* would add up to less than the call total with nothing on screen to explain
-	* the gap. Every shim record site names its account; this branch exists so
-	* that a future one cannot quietly break the totals.
+	* OFF unless the user turns it on, which is the opposite of every other lane
+	* here and deliberate: the 免密 lane is a shared third-party endpoint with no
+	* credential of its own, so it cannot be "configured" — it is either silently
+	* present or absent. Left on by default it dropped a group into the model
+	* picker that the user never asked for and could not remove: the aggregate
+	* switch does not govern it (it is not an aggregate provider), so the only
+	* way out was editing the file. Reported as "关不掉，应该默认是关闭的".
 	*
-	* `topModels` keeps the two most-used ids rather than every one: this column
-	* answers "what does this account usually run", and a list of nine ids is not
-	* an answer to that question, it is just the other table again.
+	* An explicit `true` is what enables it — `undefined` (a config written before
+	* this switch existed, or a fresh install) stays off.
 	*/
-	accountRows() {
-		const buckets = /* @__PURE__ */ new Map();
-		for (const call of this.samples) {
-			const label = call.account ?? "";
-			const key = `${call.region}\u0000${label}`;
-			let acc = buckets.get(key);
-			if (acc === void 0) {
-				acc = {
-					row: {
-						account: label,
-						region: call.region,
-						calls: 0,
-						turns: 0,
-						failed: 0,
-						inputTokens: 0,
-						outputTokens: 0,
-						cachedTokens: 0,
-						lastUsedAt: 0,
-						topModels: []
-					},
-					turnIds: /* @__PURE__ */ new Set(),
-					modelCalls: /* @__PURE__ */ new Map()
-				};
-				buckets.set(key, acc);
-			}
-			acc.row.calls += 1;
-			acc.turnIds.add(call.turnId);
-			if (!call.ok) acc.row.failed += 1;
-			if (call.at > acc.row.lastUsedAt) acc.row.lastUsedAt = call.at;
-			acc.modelCalls.set(call.model, (acc.modelCalls.get(call.model) ?? 0) + 1);
-			if (call.usage !== void 0) {
-				acc.row.inputTokens += call.usage.inputTokens;
-				acc.row.outputTokens += call.usage.outputTokens;
-				acc.row.cachedTokens += call.usage.cachedTokens;
-			}
-		}
-		const out = [];
-		for (const acc of buckets.values()) {
-			const topModels = [...acc.modelCalls.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).slice(0, 2).map(([model]) => model);
-			out.push({
-				...acc.row,
-				turns: acc.turnIds.size,
-				topModels
-			});
-		}
-		out.sort((a, b) => b.calls - a.calls || b.lastUsedAt - a.lastUsedAt || a.account.localeCompare(b.account));
-		return out;
+	laneEnabled = false;
+	constructor(fallback = FALLBACK_FREE_MODEL_IDS) {
+		this.rows = Object.freeze(buildFreeCatalog(fallback));
+	}
+	/** Turn the lane on or off; the roster readers all consult this. */
+	setEnabled(enabled) {
+		if (this.laneEnabled === enabled) return;
+		this.laneEnabled = enabled;
+		for (const listener of this.listeners) listener();
+	}
+	/** Whether the lane is contributing models right now. */
+	enabled() {
+		return this.laneEnabled;
 	}
 	/**
-	* The daily series, oldest first, limited to the most recent days.
-	*
-	* Sorted by key rather than insertion order because a retained window can
-	* straddle a month boundary, and a chart whose axis jumps backwards reads as
-	* corrupted data rather than as history.
+	* The rows that may be OFFERED.
 	*
-	* `failedTurns` is counted by DISTINCT turn id, not by summing per-call
-	* failures: a turn that rotated three accounts and failed on all three is
-	* still one failed turn, and the whole reason this module keeps turns and
-	* calls apart is so that number stays honest in every place it appears.
+	* Empty when the lane is off. Callers that need the roster regardless (the
+	* aggregate page's "free" filter, which lists what the lane COULD serve) use
+	* {@link allRows} instead — so switching the lane off hides it from the model
+	* picker without erasing it from the page that explains it.
 	*/
-	days(failedTurnIds) {
-		const buckets = /* @__PURE__ */ new Map();
-		for (const call of this.samples) {
-			const key = usageDayKey(call.at);
-			let acc = buckets.get(key);
-			if (acc === void 0) {
-				acc = {
-					day: key,
-					calls: 0,
-					inputTokens: 0,
-					outputTokens: 0,
-					failedTurnIds: /* @__PURE__ */ new Set()
-				};
-				buckets.set(key, acc);
-			}
-			acc.calls += 1;
-			acc.inputTokens += call.usage?.inputTokens ?? 0;
-			acc.outputTokens += call.usage?.outputTokens ?? 0;
-			if (failedTurnIds.has(call.turnId)) acc.failedTurnIds.add(call.turnId);
-		}
-		return [...buckets.values()].sort((a, b) => a.day.localeCompare(b.day)).slice(-14).map((acc) => ({
-			day: acc.day,
-			calls: acc.calls,
-			failedTurns: acc.failedTurnIds.size,
-			inputTokens: acc.inputTokens,
-			outputTokens: acc.outputTokens
-		}));
+	current() {
+		return this.laneEnabled ? this.rows : [];
 	}
-};
-/**
-* Inspect one SSE frame's content, without its trailing separator.
-*
-* Returns undefined when no `data:` line parsed, which covers the `[DONE]`
-* sentinel, keep-alive comments and truncated JSON alike - a frame the forwarder
-* has no opinion about must come back untouched rather than guessed at.
-*/
-function inspectSseFrame(frame) {
-	for (const line of frame.split("\n")) {
-		const trimmed = line.trim();
-		if (!trimmed.startsWith("data:")) continue;
-		const payload = trimmed.slice(5).trim();
-		if (payload === "" || payload === "[DONE]") continue;
-		let parsed;
+	/** Every row the lane knows about, offered or not. */
+	allRows() {
+		return this.rows;
+	}
+	/** Why the last refresh failed, for display. Never a substitute for rows. */
+	error() {
+		return this.lastError;
+	}
+	/** When the live list last landed. */
+	updatedAt() {
+		return this.lastUpdatedAt;
+	}
+	/** The row behind a published id, or undefined. */
+	find(modelId) {
+		return this.rows.find((row) => row.modelId === modelId || row.id === modelId);
+	}
+	/** Whether anything is being served right now. */
+	hasRows() {
+		return this.rows.length > 0;
+	}
+	onChange(listener) {
+		this.listeners.add(listener);
+		return () => {
+			this.listeners.delete(listener);
+		};
+	}
+	/**
+	* Re-read the listing and notify when the roster actually changed.
+	*
+	* A failed refresh KEEPS the current rows and records the error. Dropping to
+	* empty here would make a network hiccup look like the models were deleted.
+	*/
+	async refresh(options = {}) {
+		let next;
 		try {
-			parsed = JSON.parse(payload);
-		} catch {
-			continue;
+			next = Object.freeze(buildFreeCatalog(parseListing(await fetchFreeListing(options))));
+		} catch (error) {
+			this.lastError = error instanceof Error ? error.message : String(error);
+			if (this.rows.length === 0) this.rows = Object.freeze(buildFreeCatalog(FALLBACK_FREE_MODEL_IDS));
+			for (const listener of this.listeners) listener();
+			return this.rows;
 		}
-		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) continue;
-		const usage = parsed["usage"];
-		if (usage === void 0 || usage === null) continue;
-		return {
-			parsed,
-			usageOnly: isUsageOnlyFrame(parsed)
-		};
+		if (next.length === 0) {
+			this.lastError = "the gateway listing held no免密 models";
+			for (const listener of this.listeners) listener();
+			return this.rows;
+		}
+		this.lastError = void 0;
+		this.lastUpdatedAt = (/* @__PURE__ */ new Date()).toISOString();
+		if (next.length === this.rows.length && next.every((row, index) => row.modelId === this.rows[index]?.modelId)) return this.rows;
+		this.rows = next;
+		for (const listener of this.listeners) listener();
+		return this.rows;
 	}
-}
+};
 //#endregion
 //#region src/free-lane.ts
 /**
@@ -14703,6 +15375,7 @@ function createFreeLaneSource(catalog, logger, usageRecorder) {
 			} finally {
 				tracker.finish(Date.now());
 				usageRecorder?.record({
+					channel: "free",
 					region: "free",
 					model: modelId,
 					account: "free",
@@ -15051,6 +15724,71 @@ function appearanceChain(themeKey = APPEARANCE_THEME_KEY) {
 	};
 }
 /**
+* Pull the `expertId` out of a task's `jump_url`.
+*
+* The "体验XX专家" tasks (#98) name an expert that is NOT in the marketplace
+* listing — the reporter翻遍了 marketExpertList in both `agent` and `team`
+* types and got zero hits — so the only place the id appears is the deeplink
+* embedded in the task itself:
+*
+*   https://www.workbuddy.cn/work/launch/?deeplink=workbuddy%3A%2F%2Fexperts%3FexpertId%3Dex_GDl31WahyIH0&buddy_type=workbuddy
+*
+* The deeplink is percent-encoded, and it has to be: the `?` and `&` inside it
+* would otherwise end the outer query. So the parse is two steps — decode the
+* `deeplink` parameter, then read `expertId` off the scheme it decodes to — and
+* NOT a regex over the whole URL, which would also match the outer `expertId`
+* spelling in a future URL shape and silently pick the wrong one.
+*
+* Returns undefined for the tasks whose deeplink carries no id at all
+* (`WorkBuddy_Valorant` points at `workbuddy://expert` with no query), which is
+* the honest answer: those need a different source and are not guessed here.
+*/
+function expertIdFromJumpUrl(jumpUrl) {
+	if (jumpUrl === "") return void 0;
+	/** Read `expertId` off any URL-ish string, decoded or not. */
+	const readId = (value) => {
+		let query = value;
+		try {
+			const parsed = new URL(value);
+			query = parsed.search === "" ? value : parsed.search;
+		} catch {
+			query = value;
+		}
+		const marker = query.indexOf("expertId=");
+		if (marker === -1) return void 0;
+		const rest = query.slice(marker + 9);
+		const end = rest.search(/[&#]/u);
+		const id = (end === -1 ? rest : rest.slice(0, end)).trim();
+		return id === "" ? void 0 : id;
+	};
+	let source = jumpUrl;
+	try {
+		const raw = new URL(jumpUrl).searchParams.get("deeplink");
+		if (raw !== null && raw !== "") source = raw;
+	} catch {
+		source = jumpUrl;
+	}
+	return readId(source);
+}
+/**
+* Build a summon record for an expert the marketplace does not list.
+*
+* Everything the chains need beyond the id is cosmetic — the scorer keys on
+* `expertId` — so the title from the task is reused as the display name rather
+* than inventing one. `version` is left empty, which every consumer already
+* defaults to `1.0.0`.
+*/
+function expertFromTask(expertId, title) {
+	return {
+		expertId,
+		expertType: "agent",
+		displayName: title,
+		profession: title,
+		version: "",
+		categories: []
+	};
+}
+/**
 * The three "summon an expert" events (`expert_summon_click` and friends).
 *
 * Paid before the conversation, in the order the app emits them.
@@ -15173,7 +15911,12 @@ const EVENT_CHAIN_BUILDERS = {
 	skill_1: true,
 	expert_5: true,
 	Expert_team_use_3: true,
-	Expert_lighthouse: true
+	Expert_lighthouse: true,
+	expert_use_maidehao: true,
+	expert_use_douyinyin: true,
+	expert_use_shangjia_xuanchuan: true,
+	expert_use_bowangwang: true,
+	WorkBuddy_Valorant: true
 };
 const AUTOMATION_TICK_MS = 6e4;
 /** The jobs in the order a tick runs them: report before tasks, always. */
@@ -15307,10 +16050,35 @@ function isFireHour(now, hours) {
 	const { hour } = zonedParts(now);
 	return hours.includes(Number(hour));
 }
-/** Whether this account may be used: not switched off, not cooling. */
-function eligible(account, now) {
+/**
+* Which account classes each job may touch.
+*
+* This replaced a single `global → false`, which was right about the growth
+* system and wrong as a blanket: it excluded a global account from EVERY job,
+* including the ones that are idempotent, cheap, and pay credits regardless of
+* region. The blanket also made the rule unfalsifiable — "global does nothing"
+* cannot be checked, whereas "the checkin job tries global accounts and here is
+* what came back" can.
+*
+* So the scope is per job, and the default for a job that is not named is `cn`:
+* a new job must opt in explicitly rather than inherit an accident.
+*/
+const JOB_REGION_SCOPE = {
+	report: ["cn"],
+	tasks: ["cn"],
+	streak: ["cn"],
+	travel: ["cn"],
+	compensation: ["cn"],
+	checkin: ["cn", "global"]
+};
+/** Whether `job` may run against `region`; unnamed jobs stay CN. */
+function jobAllowsRegion(job, region) {
+	return (JOB_REGION_SCOPE[job] ?? ["cn"]).includes(region);
+}
+/** Whether this account may be used for a job: not cooling, and right region. */
+function eligible(account, now, job) {
 	if (account.cooldownUntilMs > now) return false;
-	if (regionOf(account.credential.domain) === "global") return false;
+	if (job !== void 0 && !jobAllowsRegion(job, regionOf(account.credential.domain))) return false;
 	return true;
 }
 const sleep$1 = (ms) => new Promise((resolve) => {
@@ -15381,6 +16149,16 @@ var WorkBuddyScheduler = class {
 	/** Host hooks that persist the ledger across restarts. */
 	loadEarnings;
 	saveEarningsFn;
+	/**
+	* The most recent ledger write that may still be in flight.
+	*
+	* `persistEarnings` is synchronous from its callers' point of view, but the
+	* host's settings write is not: it is an async document update. Keeping the
+	* promise here is what lets {@link flushEarnings} wait for the write that
+	* matters — the last one before a restart — without making every counter
+	* update await disk.
+	*/
+	pendingEarningsWrite = Promise.resolve();
 	constructor(pool, client, options = {}) {
 		this.pool = pool;
 		this.client = client;
@@ -15417,6 +16195,18 @@ var WorkBuddyScheduler = class {
 		this.saveEarningsFn = save;
 	}
 	/**
+	* Wait for the ledger write that is (or was last) in flight.
+	*
+	* Called at the END of a task pass, right after the last claim, so the rewards
+	* that were just collected are on disk before a restart can lose them. It is
+	* deliberately NOT awaited on every counter bump: the settings document write
+	* is the slow part, and paying it per account would slow the pass for no
+	* benefit while the process is still alive.
+	*/
+	async flushEarnings() {
+		await this.pendingEarningsWrite;
+	}
+	/**
 	* Fold a previously persisted ledger back in, when it belongs to today.
 	*
 	* Used after the settings document becomes readable, which happens after
@@ -15686,7 +16476,7 @@ var WorkBuddyScheduler = class {
 			compensationCredit: (existing?.compensationCredit ?? 0) + compensationCredit,
 			date: today
 		});
-		this.persistEarnings();
+		this.pendingEarningsWrite = this.persistEarnings();
 	}
 	/** Clear the per-account counters when the local day changes. */
 	rollEarnings(today) {
@@ -15702,9 +16492,18 @@ var WorkBuddyScheduler = class {
 	* Best effort on purpose: a failed save must never abort a run that has
 	* already collected rewards, and the in-memory ledger keeps serving the card
 	* for the rest of the session either way.
+	*
+	* The returned promise settles when the write has landed (or failed). Callers
+	* that are about to END a run await it: reported in #98, a task pass that
+	* claimed 21 tasks had its process restarted before the volatile settings
+	* write reached disk, so `automationEarnings` still read `credit: 0` while
+	* the upstream had really paid out. Fire-and-forget is fine for a counter the
+	* card will re-read in this process; it is not fine for the last write before
+	* exit.
 	*/
 	persistEarnings() {
-		if (this.saveEarningsFn === void 0) return;
+		const save = this.saveEarningsFn;
+		if (save === void 0) return Promise.resolve();
 		const accounts = {};
 		for (const [id, entry] of this.earnings) accounts[id] = entry;
 		const ledger = {
@@ -15712,12 +16511,14 @@ var WorkBuddyScheduler = class {
 			accounts
 		};
 		try {
-			const saved = this.saveEarningsFn(ledger);
-			if (saved !== void 0 && typeof saved.then === "function") saved.then(void 0, (error) => {
+			const saved = save(ledger);
+			if (saved !== void 0 && typeof saved.then === "function") return Promise.resolve(saved).then(void 0, (error) => {
 				this.logger.warn?.("dsh-xdpool: could not persist automation earnings:", error);
 			});
+			return Promise.resolve();
 		} catch (error) {
 			this.logger.warn?.("dsh-xdpool: could not persist automation earnings:", error);
+			return Promise.resolve();
 		}
 	}
 	/**
@@ -15744,8 +16545,22 @@ var WorkBuddyScheduler = class {
 		let energy = 0;
 		let claimed = 0;
 		const detail = [];
+		/**
+		* Every item this run considered, with a status attached.
+		*
+		* `detail` stays as the human-readable log line; this is the same work in a
+		* shape the card can GROUP and COUNT, so "3 tasks unclaimed — locked" is
+		* distinguishable from "0 tasks, everything already collected".
+		*/
+		const items = [];
 		let progressNote;
-		const accounts = this.accountsInOrder();
+		try {
+			const revived = await this.pool.reviveBenched((credential) => this.client.fetchCredits(credential));
+			for (const account of revived) detail.push(`复活 ${account.label}`);
+		} catch (error) {
+			this.logger.warn?.("automation: could not probe benched accounts:", error);
+		}
+		const accounts = this.accountsInOrder(kind);
 		if (kind === "tasks") await this.sendEventChains(accounts);
 		for (let index = 0; index < accounts.length; index++) {
 			if (this.stopped) break;
@@ -15753,12 +16568,22 @@ var WorkBuddyScheduler = class {
 			if (account === void 0) continue;
 			try {
 				switch (kind) {
-					case "checkin":
+					case "checkin": {
+						let alreadyDone = false;
+						try {
+							alreadyDone = (await this.client.fetchCheckinStatus(account.credential)).todayCheckedIn === true;
+						} catch (error) {
+							this.logger.warn?.(`automation checkin ${account.label}: status read failed, claiming anyway:`, error);
+						}
+						if (alreadyDone) {
+							this.logger.info?.(`automation checkin ${account.label}: already done today (read, not claimed)`);
+							break;
+						}
 						try {
 							const claim = await this.client.claimDailyCheckin(account.credential);
 							this.recordEarnings(account.id, today, { checkinCredit: claim.credit });
 							if (claim.credit > 0) {
-								if (claim.credit > 0) detail.push(`签到 +${claim.credit}`);
+								detail.push(`签到 +${claim.credit}`);
 								this.logger.info?.(`automation checkin ${account.label}: +${claim.credit} credit`);
 							}
 						} catch (error) {
@@ -15766,6 +16591,7 @@ var WorkBuddyScheduler = class {
 							this.logger.info?.(`automation checkin ${account.label}: already done today`);
 						}
 						break;
+					}
 					case "report": {
 						const days = await this.reportOne(account);
 						this.logger.info?.(`automation report ${account.label}: streak days=${days}`);
@@ -15777,6 +16603,7 @@ var WorkBuddyScheduler = class {
 						energy += result.energy;
 						claimed += result.claimed;
 						detail.push(...result.titles);
+						items.push(...result.items);
 						this.claimableSeen += result.claimableCount;
 						this.recordEarnings(account.id, today, {
 							credit: result.credit,
@@ -15824,8 +16651,11 @@ var WorkBuddyScheduler = class {
 		state.claimed = claimed;
 		state.message = this.summarise(kind, ok, failed, claimed, credit, energy);
 		state.detail = detail;
-		state.progress = progressNote;
+		state.items = items;
+		if (progressNote === void 0) delete state.progress;
+		else state.progress = progressNote;
 		this.logger.info?.(`automation ${accountWord}: ${state.message}`);
+		if (kind === "tasks" || kind === "checkin" || kind === "streak" || kind === "travel" || kind === "compensation") await this.flushEarnings();
 	}
 	/** Compose the one-line summary shown on the card. */
 	summarise(kind, ok, failed, claimed, credit, energy) {
@@ -15837,12 +16667,16 @@ var WorkBuddyScheduler = class {
 	*
 	* Disabled accounts are excluded here rather than filtered by the caller so a
 	* card switch takes effect on the next pass without any event plumbing.
+	*
+	* `job` narrows the set by region scope: the growth jobs are CN-only while
+	* check-in runs on both gateways, so eligibility cannot be decided without
+	* knowing which job is about to run.
 	*/
-	accountsInOrder() {
+	accountsInOrder(job) {
 		const now = Date.now();
 		return this.pool.list().filter((account) => {
 			if (this.pool.isDisabled(account.id)) return false;
-			return eligible(account, now);
+			return eligible(account, now, job);
 		});
 	}
 	/**
@@ -15948,10 +16782,88 @@ var WorkBuddyScheduler = class {
 			case "expert_5": return this.expertChains(credential, "agent", task);
 			case "Expert_team_use_3": return this.expertChains(credential, "team", task);
 			case "Expert_lighthouse": return this.lighthouseChains(credential);
+			case "expert_use_maidehao":
+			case "expert_use_douyinyin":
+			case "expert_use_shangjia_xuanchuan":
+			case "expert_use_bowangwang":
+			case "WorkBuddy_Valorant": return this.taskExpertChains(credential, task);
 			default: return [];
 		}
 	}
 	/**
+	* Summon-and-use one expert NAMED BY THE TASK.
+	*
+	* Structurally `expertChains` minus the marketplace: the expert id is read
+	* from the task's deeplink instead of by browsing `marketExpertList`, because
+	* this family's experts are not listed there at all (#98 measured 500 entries
+	* across both `agent` and `team`, zero hits).
+	*
+	* Returns `[]` — not a throw — when the task carries no usable id: the caller
+	* logs "could not be built" only for exceptions, and a task shape this code
+	* does not understand is information, not a fault.
+	*/
+	/**
+	* Find the expert a task is about, by matching its title against the
+	* marketplace.
+	*
+	* The marketplace listing is ~500 entries across `agent` and `team`, and this
+	* only runs for a task whose deeplink carried no id — at most a handful per
+	* run — so the cost is acceptable. It is not cached because a freshly
+	* published expert must become findable without a restart.
+	*
+	* Matching rules, all of them strict on purpose:
+	*   - the task's title must appear IN the expert's name or profession, or the
+	*     expert's display name must appear in the title (both directions, since
+	*     the board and the marketplace word things differently);
+	*   - comparison ignores case, whitespace and the punctuation vendors sprinkle
+	*     through names;
+	*   - several matches means NO answer. Summoning the wrong agent scores 0, so a
+	*     guess costs an upstream call and still fails — worse than declining.
+	*/
+	async expertIdByKeyword(credential, task) {
+		const normalise = (value) => value.toLowerCase().replace(/[\s_\-·:：,，.。()（）【】[\]「」]/gu, "");
+		const wanted = normalise(task.title);
+		if (wanted === "") return void 0;
+		let candidates;
+		try {
+			const [agents, teams] = await Promise.all([this.client.marketExpertList(credential, "agent"), this.client.marketExpertList(credential, "team")]);
+			candidates = [...agents, ...teams];
+		} catch (error) {
+			this.logger.warn?.(`automation events ${task.taskCode}: marketplace lookup failed:`, error);
+			return;
+		}
+		const matches = candidates.filter((candidate) => {
+			const name = normalise(candidate.displayName ?? "");
+			const profession = normalise(candidate.profession ?? "");
+			if (name === "" && profession === "") return false;
+			return name !== "" && (name.includes(wanted) || wanted.includes(name)) || profession !== "" && (profession.includes(wanted) || wanted.includes(profession));
+		});
+		if (matches.length !== 1) {
+			if (matches.length > 1) this.logger.info?.(`automation events ${task.taskCode}: ${String(matches.length)} marketplace experts match "${task.title}", not guessing`);
+			return;
+		}
+		const found = matches[0];
+		if (found === void 0) return void 0;
+		this.logger.info?.(`automation events ${task.taskCode}: resolved expertId ${found.expertId} by keyword "${task.title}"`);
+		return found.expertId;
+	}
+	async taskExpertChains(credential, task) {
+		const expertId = expertIdFromJumpUrl(task.jumpUrl) ?? await this.expertIdByKeyword(credential, task);
+		if (expertId === void 0) {
+			this.logger.warn?.(`automation events ${task.taskCode}: no expertId in jump_url and no marketplace match, skipping`);
+			return [];
+		}
+		const expert = expertFromTask(expertId, task.title);
+		await this.client.reportDesktopEvents(credential, expertSummonEvents(expert));
+		if (this.delayMs > 0 && !this.stopped) await sleep$1(this.delayMs);
+		const chat = await this.client.openConversation(credential, expert.expertId);
+		if (chat === void 0) throw new Error(`${task.taskCode}: no server conversation`);
+		return [{
+			transport: "desktop",
+			events: [...expertChatEvents(expert, chat.conversationId, chat.requestId), expertActualUseEvent(expert, chat.conversationId, chat.requestId)]
+		}];
+	}
+	/**
 	* The summon-and-use chains for the expert tasks.
 	*
 	* Two steps per expert, and both are load-bearing: the summon events alone are
@@ -16023,21 +16935,41 @@ var WorkBuddyScheduler = class {
 		const credential = account.credential;
 		const open = (await this.client.listTasks(credential)).filter((task) => task.acceptStatus === "not_accepted" && !task.locked).map((task) => task.taskCode);
 		if (open.length > 0) await this.client.acceptTasks(credential, open);
-		const claimable = (await this.client.listTasks(credential)).filter((task) => task.claimable && !task.locked);
+		const refreshed = await this.client.listTasks(credential);
+		const claimable = refreshed.filter((task) => task.claimable && !task.locked);
 		let credit = 0;
 		let energy = 0;
 		let claimed = 0;
 		const titles = [];
+		const items = [];
+		for (const task of refreshed) if (task.locked === true || task.claimable !== true) items.push({
+			title: task.title === "" ? task.taskCode : task.title,
+			status: "skipped",
+			note: task.locked === true ? "locked" : task.acceptStatus === "not_accepted" ? "not accepted" : "not scored yet"
+		});
 		for (const task of claimable) {
 			if (this.stopped) break;
 			const reward = await this.client.claimTaskReward(credential, task.taskCode);
 			credit += reward.credit;
 			energy += reward.energy;
+			const label = task.title === "" ? task.taskCode : task.title;
 			if (reward.credit > 0 || reward.energy > 0) {
 				claimed++;
 				titles.push(task.title);
+				items.push({
+					title: label,
+					status: "claimed",
+					...reward.credit > 0 ? { credit: reward.credit } : {},
+					...reward.energy > 0 ? { energy: reward.energy } : {}
+				});
 				this.logger.info?.(`automation claim ${account.label}: ${task.title} +${reward.credit}c +${reward.energy}e`);
-			} else this.logger.info?.(`automation claim ${account.label}: ${task.taskCode} already claimed`);
+			} else {
+				items.push({
+					title: label,
+					status: "already"
+				});
+				this.logger.info?.(`automation claim ${account.label}: ${task.taskCode} already claimed`);
+			}
 			if (this.delayMs > 0 && !this.stopped) await sleep$1(this.delayMs);
 		}
 		return {
@@ -16045,7 +16977,8 @@ var WorkBuddyScheduler = class {
 			credit,
 			energy,
 			claimableCount: claimable.length,
-			titles
+			titles,
+			items
 		};
 	}
 	/**
@@ -16214,6 +17147,7 @@ const PROVIDER_NOTES_ZH = Object.freeze({
 	"kimi_code": "Kimi Code 订阅，模型 id 取自 9router 的 kimi 注册表",
 	"lightning": "Lightning AI 的 Model APIs 网关",
 	"llamacpp": "本地服务器，模型列表取决于用户已加载的模型",
+	"custom_openai": "自定义 OpenAI 兼容端点：vLLM / LiteLLM / one-api / 自建网关，填 base URL 和 key 后拉取模型",
 	"llm7": "default/fast/pro 别名被固定，只留流式工具模型",
 	"lmstudio": "本地服务器，模型列表取决于用户已加载的模型",
 	"minimax": "推理内容从正文流中单独拆出，语音与图像 id 已剔除",
@@ -16573,6 +17507,24 @@ function parseAggregatePatch(body) {
 	};
 	if (typeof body["enabled"] === "boolean") patch.enabled = body["enabled"];
 	if (typeof body["apiKey"] === "string") patch.apiKey = body["apiKey"];
+	if (Array.isArray(body["apiKeys"])) {
+		const seen = /* @__PURE__ */ new Set();
+		const apiKeys = [];
+		for (const raw of body["apiKeys"]) {
+			if (typeof raw !== "string") continue;
+			const key = raw.trim();
+			if (key === "" || seen.has(key)) continue;
+			seen.add(key);
+			apiKeys.push(key);
+		}
+		patch.apiKeys = apiKeys;
+	}
+	if (typeof body["distribution"] === "string") {
+		const strategy = body["distribution"].trim();
+		if (!isDistributionStrategy(strategy)) return void 0;
+		patch.distribution = strategy;
+	}
+	if (typeof body["appendApiKey"] === "string") patch.appendApiKey = body["appendApiKey"];
 	if (typeof body["baseUrl"] === "string") patch.baseUrl = body["baseUrl"];
 	if (Array.isArray(body["models"])) {
 		const seen = /* @__PURE__ */ new Set();
@@ -16634,7 +17586,9 @@ function aggregateStatusOf(store, models) {
 			models: exposed,
 			availableModels: universe,
 			discovered: (setting.discovered?.length ?? 0) > 0,
-			...setting.addedAt === void 0 ? {} : { addedAt: setting.addedAt }
+			...setting.addedAt === void 0 ? {} : { addedAt: setting.addedAt },
+			keyCount: providerApiKeys(setting).length,
+			...setting.distribution === void 0 ? {} : { distribution: setting.distribution }
 		});
 	}
 	return {
@@ -16802,7 +17756,10 @@ async function poolWebStatus(deps, region = "cn") {
 		creditReserves: deps.pool.creditReservesInOrder(),
 		ignored: deps.ignoredAccounts?.() ?? [],
 		catalogSource: deps.catalogs[region].currentSource(),
-		...deps.catalogs[region].catalogUpdatedAt() === void 0 ? {} : { catalogUpdatedAt: deps.catalogs[region].catalogUpdatedAt() },
+		...(() => {
+			const updatedAt = deps.catalogs[region].catalogUpdatedAt();
+			return updatedAt === void 0 ? {} : { catalogUpdatedAt: updatedAt };
+		})(),
 		...deps.catalogs[region].lastFetchError() === void 0 ? {} : { catalogError: safeMessage(deps.catalogs[region].lastFetchError()) },
 		...deps.pool.skippedFilesInOrder().length === 0 ? {} : { skippedFiles: deps.pool.skippedFilesInOrder().map((entry) => ({
 			file: basename(entry.path),
@@ -17291,33 +18248,6 @@ function registerPoolStatusRoute(ctx, deps) {
 			}
 		});
 		/**
-		* The billion-context relay.
-		*
-		* GET only, loopback origin only. Its own route because it is the one
-		* document here that comes from ANOTHER plugin's loopback listener: the
-		* proxy publishes its own JSON and this only reads it, so folding it into
-		* the pool status document would put a third-party service on the critical
-		* path of every 30-second pool poll.
-		*
-		* Answered even when the proxy is absent — `state: 'missing'` with the
-		* install command is far more actionable than a 503, and it is the normal
-		* state on a machine that has not installed billion-context.
-		*/
-		const disposeBillion = ctx.webServer.register({
-			kind: "exact",
-			path: POOL_BILLION_PATH,
-			handler: async (req, res) => {
-				if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
-				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
-				if (deps.billionDocument === void 0) return json(res, 503, { error: "the billion-context relay is not available in this build" });
-				try {
-					json(res, 200, await deps.billionDocument());
-				} catch (error) {
-					json(res, 500, { error: safeMessage(error) });
-				}
-			}
-		});
-		/**
 		* The chain list plus the roster its members are drawn from.
 		*
 		* GET only. Deliberately not part of the pool status document: chains change
@@ -17328,12 +18258,12 @@ function registerPoolStatusRoute(ctx, deps) {
 		const disposeCombos = ctx.webServer.register({
 			kind: "exact",
 			path: POOL_COMBOS_PATH,
-			handler: (req, res) => {
+			handler: async (req, res) => {
 				if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
 				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
 				if (deps.combosDocument === void 0) return json(res, 503, { error: "the routing chains are not available in this build" });
 				try {
-					json(res, 200, deps.combosDocument());
+					json(res, 200, await deps.combosDocument());
 				} catch (error) {
 					json(res, 500, { error: safeMessage(error) });
 				}
@@ -17354,8 +18284,10 @@ function registerPoolStatusRoute(ctx, deps) {
 				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
 				if (deps.saveCombos === void 0) return json(res, 503, { error: "the routing chains are not available in this build" });
 				try {
-					const raw = (await readJsonBody(req))["combos"];
-					json(res, 200, await deps.saveCombos(Array.isArray(raw) ? raw : []));
+					const body = await readJsonBody(req);
+					const raw = Array.isArray(body) ? body : body["combos"];
+					if (!Array.isArray(raw)) return json(res, 400, { error: "expected {combos: [...]} (or a bare array from older clients); refusing to replace the chain table with an empty one" });
+					json(res, 200, await deps.saveCombos(raw));
 				} catch (error) {
 					json(res, 500, { error: safeMessage(error) });
 				}
@@ -17393,7 +18325,6 @@ function registerPoolStatusRoute(ctx, deps) {
 			disposeRelay();
 			disposeCombosSave();
 			disposeCombos();
-			disposeBillion();
 			disposeChannels();
 			disposeAggregate();
 			disposeAggregateDiscover();
@@ -17417,247 +18348,6 @@ function registerPoolStatusRoute(ctx, deps) {
 	}, "dsh-xdpool: Web status route");
 }
 //#endregion
-//#region src/billion.ts
-/**
-* Read-only observation of a locally running billion-context proxy.
-*
-* WHAT THIS IS, AND WHY IT IS NOT AN EMBEDDED COMPRESSOR
-*
-* billion-context is a separate DSH plugin that is very likely already
-* installed on this machine — on a stock desktop profile it is mounted by the
-* profile's bundle layer and runs its own loopback listener. This module never
-* implements compression and never proposes to: it finds that listener and
-* relays a few numbers so the card can show what the compressor is doing.
-* Re-implementing folding here would mean a second, divergent answer to the
-* same question and a second set of ways to get it wrong.
-*
-* HOW THE LISTENER IS FOUND
-*
-* The proxy picks an ephemeral port at spawn and records it in its own state
-* directory, which we read rather than guess. Guessing would mean scanning a
-* port range on every card poll, and a wrong guess is worse than no answer: it
-* could read some unrelated loopback service. The recorded file is
-* `<state>/billion-context/proxy-origin` and holds a JSON object with at least
-* an `origin`; `port-zone.json` is the same fact keyed by lane. Both are read,
-* and the origin file wins, because it is the one the proxy itself reads on
-* startup.
-*
-* `state` is resolved the same way the proxy resolves it: `XDG_STATE_HOME` when
-* set, else `<homedir>/.local/state` on every platform including Windows — not
-* `%LOCALAPPDATA%`, which is what a Windows developer would reach for first and
-* which would therefore be wrong.
-*
-* WHAT IS RELAYED
-*
-* Counts, sizes, timestamps. Not titles, not first-block hints, not any
-* conversation material. The proxy is happy to hand over more than that, and
-* taking it would put the user's own words into a document the card fetches
-* every 30 seconds and that lives in the plugin's HTTP log.
-*
-* The one addition to that list is the proxy's own origin, so the card can link
-* out to the dashboard the proxy already ships instead of redrawing it. That is
-* a service address rather than conversation material, and anyone who can read
-* this document can already reach that listener directly — which is why it is
-* safe to publish where a title would not be.
-*
-* The proxy also has NO AUTHENTICATION by its own documentation — the README
-* says so outright — so every request here is a hard local one, and the relay
-* only ever reads `/__bili/health` and `/__bili/sessions`. Both are GETs. This
-* module has no code path that could write to that proxy.
-*
-* @module dsh-xdpool/billion
-*/
-/** The proxy's own management prefix. Never guess it; it is theirs. */
-const BILI_PREFIX = "/__bili";
-/** Loopback only. The proxy binds 127.0.0.1 and we refuse anything else. */
-const LOOPBACK_HOSTS$1 = [
-	"127.0.0.1",
-	"localhost",
-	"[::1]",
-	"::1"
-];
-/**
-* How long one relay request may take.
-*
-* Short on purpose: this runs inside the card's status request, and a stalled
-* third-party proxy must degrade to a panel that says "no answer" rather than
-* hold the pool card hostage. The proxy answers these two endpoints in
-* milliseconds; the budget is for the case where it does not.
-*/
-const RELAY_TIMEOUT_MS = 1500;
-/** How many sessions the card is shown. 50 rows is already past the fold. */
-const MAX_SESSIONS = 50;
-/**
-* Where the proxy keeps its state directory.
-*
-* Mirrors the proxy's own resolution exactly: `XDG_STATE_HOME` when it holds an
-* absolute path, else `<homedir>/.local/state`. Deliberately NOT
-* `DSH_HOME ?? homedir()` — DSH_HOME is the profile root and a live value on a
-* real desktop install, so preferring it sent this reader to
-* `<profile>/.local/state/billion-context` and reported "missing" on a machine
-* where the proxy was running and answering. Probed against the live proxy,
-* which is the only way that mistake is visible: every unit test with a faked
-* state directory passes either way.
-*
-* Undefined when neither resolves, because inventing a path to probe would
-* turn "not installed" into a silent hunt through the filesystem.
-*/
-function stateRoot() {
-	const xdg = env.XDG_STATE_HOME;
-	if (typeof xdg === "string" && xdg !== "") {
-		if (xdg.startsWith("/") || /^[A-Za-z]:[\\/]/u.test(xdg)) return join(xdg, "billion-context");
-		return;
-	}
-	const home = homedir();
-	if (typeof home !== "string" || home === "") return void 0;
-	return join(home, ".local", "state", "billion-context");
-}
-/** A loopback http(s) origin, or undefined for anything else. */
-function parseLoopbackOrigin(raw) {
-	let url;
-	try {
-		url = new URL(raw);
-	} catch {
-		return;
-	}
-	if (url.protocol !== "http:" && url.protocol !== "https:") return void 0;
-	if (!LOOPBACK_HOSTS$1.includes(url.hostname.toLowerCase())) return void 0;
-	return url.origin;
-}
-/**
-* The proxy origin, from the file the proxy itself reads on startup.
-*
-* `port-zone.json` is the fallback because it is keyed by lane and therefore
-* distinguishes the dsh proxy from, say, a concurrently running opencode one —
-* but `proxy-origin` is preferred because it is the single-writer record.
-*/
-async function readProxyOrigin() {
-	const root = stateRoot();
-	if (root === void 0) return void 0;
-	for (const name of ["proxy-origin", "port-zone.json"]) {
-		let raw;
-		try {
-			raw = await readFile(join(root, name), "utf8");
-		} catch {
-			continue;
-		}
-		if (name === "proxy-origin") {
-			try {
-				const parsed = JSON.parse(raw);
-				const origin = typeof parsed.origin === "string" ? parseLoopbackOrigin(parsed.origin) : void 0;
-				if (origin !== void 0) return origin;
-			} catch {}
-			continue;
-		}
-		try {
-			const port = JSON.parse(raw).lanes?.dsh;
-			if (typeof port === "number" && Number.isInteger(port) && port > 0 && port < 65536) return `http://127.0.0.1:${port}`;
-		} catch {
-			continue;
-		}
-	}
-}
-/** One GET against the proxy, with the relay budget on it. Never throws. */
-async function fetchJson(origin, path) {
-	const controller = new AbortController();
-	const timer = setTimeout(() => {
-		controller.abort();
-	}, RELAY_TIMEOUT_MS);
-	try {
-		const response = await fetch(new URL(BILI_PREFIX + path, origin), {
-			method: "GET",
-			headers: { accept: "application/json" },
-			signal: controller.signal
-		});
-		if (!response.ok) return void 0;
-		return await response.json();
-	} catch {
-		return;
-	} finally {
-		clearTimeout(timer);
-	}
-}
-/** A finite number, or undefined. Guards every relayed field. */
-function num(value) {
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
-/** A string, or ''. */
-function str(value) {
-	return typeof value === "string" ? value : "";
-}
-/** A boolean, or false. */
-function bool(value) {
-	return value === true;
-}
-/**
-* One session row, reduced.
-*
-* Every field is defaulted rather than passed through: the proxy's document is
-* a moving target across versions, and an unreadable row should render as
-* zeroes we can explain, not as `undefined` reaching the card.
-*/
-function toSession(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return void 0;
-	const row = raw;
-	const id = str(row.id);
-	if (id === "") return void 0;
-	return {
-		id,
-		protocol: str(row.protocol),
-		live: bool(row.live),
-		requests: num(row.requests) ?? 0,
-		contextTokens: num(row.contextTokens) ?? 0,
-		contextTokensSource: str(row.contextTokensSource),
-		tokensSaved: num(row.tokensSaved) ?? 0,
-		inputTokens: num(row.inputTokens) ?? 0,
-		cachedTokens: num(row.cachedTokens) ?? 0,
-		outputTokens: num(row.outputTokens) ?? 0,
-		cacheHitPct: num(row.cacheHitPct) ?? -1,
-		blocks: num(row.blocks) ?? 0,
-		contextWindow: num(row.contextWindow) ?? 0,
-		lastSeen: str(row.lastSeen),
-		lastModel: str(row.lastModel)
-	};
-}
-/** The whole relay, safe to hand the card: it never rejects. */
-async function readBillionStatus() {
-	const origin = await readProxyOrigin();
-	if (origin === void 0) return {
-		state: "missing",
-		reason: "billion-context is not running on this machine. Install it with \"dsh plugin --profile <name> add billion-context\" and this page fills in.",
-		sessions: [],
-		totalSessions: 0
-	};
-	const health = await fetchJson(origin, "/health");
-	if (health === null || typeof health !== "object") return {
-		state: "unreachable",
-		reason: `billion-context is recorded at ${origin} but did not answer. It may have just been restarted.`,
-		origin,
-		sessions: [],
-		totalSessions: 0
-	};
-	const meta = health;
-	const sessionsDoc = await fetchJson(origin, "/sessions");
-	const rawSessions = sessionsDoc !== null && typeof sessionsDoc === "object" ? sessionsDoc.sessions : void 0;
-	const rows = Array.isArray(rawSessions) ? rawSessions.slice(0, MAX_SESSIONS) : [];
-	const sessions = [];
-	for (const row of rows) {
-		const session = toSession(row);
-		if (session !== void 0) sessions.push(session);
-	}
-	const total = num(sessionsDoc !== null && typeof sessionsDoc === "object" ? sessionsDoc.total : void 0) ?? sessions.length;
-	const version = str(meta.version);
-	const startedAt = num(meta.startedAt);
-	return {
-		state: "ready",
-		origin,
-		...version === "" ? {} : { version },
-		...startedAt === void 0 ? {} : { startedAt },
-		sessions,
-		totalSessions: total
-	};
-}
-//#endregion
 //#region src/diagnostics.ts
 /**
 * A startup trace this plugin owns.
@@ -17722,6 +18412,46 @@ function recordStartupNote(line) {
 	} catch {}
 	return text;
 }
+//#endregion
+//#region src/model-switch-bridge.ts
+/**
+* The lane id the host's picker uses for each region.
+*
+* The same two ids `POOL_OWNED_PROVIDERS` exempts inside the pack, and the same
+* two `REGION_CHANNEL_BY_REGION` maps in the card. Kept here as a literal
+* because this module is imported by the host half only, which must not pull in
+* the browser bundle's constants.
+*/
+const LANE_BY_REGION = {
+	cn: "buddy",
+	global: "workbuddy"
+};
+/**
+* Replace the selection and mirror it where the pack can see it.
+*
+* The mirror is `globalThis.__xdpoolLaneSelection`, which `pack.js` reads in its
+* `[xdpool-local] laneAllowedIds` helper. A global rather than a getter on the
+* account pool because the pack's adapters receive `accountPool` — this
+* plugin's own object — and nothing else that this module could hang a function
+* on without editing ten constructors.
+*/
+function applyLaneSelection(next) {
+	globalThis.__xdpoolLaneSelection = next;
+}
+/**
+* Derive the lane keyed selection from the two settings documents.
+*
+* Split out from the caller so the mapping is testable without a host: the one
+* thing worth asserting is that an ABSENT setting becomes `undefined` (no
+* restriction) while an explicitly EMPTY `enabledModelIds` stays an empty array
+* (nothing allowed).
+*/
+function laneSelectionFrom(cn, global) {
+	return {
+		[LANE_BY_REGION.cn]: cn,
+		[LANE_BY_REGION.global]: global
+	};
+}
 /** Hard ceiling on the whole probe, so a hung upstream cannot wedge the card. */
 const PROBE_TIMEOUT_MS = 3e4;
 /**
@@ -18044,9 +18774,7 @@ async function compactWithSummary(messages, options, deps, signal) {
 	const first = compactMessages(messages, options);
 	if (!first.changed) return {
 		messages: first.messages,
-		tokens: first.tokens,
-		summary: void 0,
-		skipped: void 0
+		tokens: first.tokens
 	};
 	const summaryBudget = Math.max(256, Math.floor(options.budget / 4));
 	let toSummarize = first.dropped;
@@ -18075,8 +18803,8 @@ async function compactWithSummary(messages, options, deps, signal) {
 	}
 	if (summary === void 0) return {
 		messages: first.messages,
-		skipped,
-		tokens: first.tokens
+		tokens: first.tokens,
+		...skipped === void 0 ? {} : { skipped }
 	};
 	const withSummary = injectSummary(first.messages, summary);
 	if (estimateMessagesTokens(withSummary) > options.budget) {
@@ -18496,6 +19224,19 @@ const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
 	"localhost",
 	"[::1]"
 ]);
+/**
+* How long one chain member may hold the request before it is given up on.
+*
+* The caller's own signal covers "the user cancelled", not "this provider decided
+* to keep the socket open". Without a per-member deadline a single non-answering
+* upstream blocks the request forever, and the chain's whole purpose — try the
+* next member — never runs.
+*
+* 180s is the value the reference router settled on: long enough for a slow
+* reasoning model to emit its first token, short enough to give up inside one
+* turn rather than leaving the user staring at a spinner.
+*/
+const MEMBER_TIMEOUT_MS = 18e4;
 /** HTTP status each upstream failure class surfaces as. */
 const KIND_STATUS = {
 	hard_credit: 402,
@@ -18505,6 +19246,27 @@ const KIND_STATUS = {
 	server: 502,
 	client: 400
 };
+/**
+* HTTP status for each "no account available" reason.
+*
+* The reason is already a complete diagnosis — `unavailableReason` separates
+* cooling from a drained reserve from a switched-off account from an empty pool
+* — and each of those needs a different user action. Flattening them into one
+* status throws that away: 401 universally reads as "invalid API key", so a
+* reserve or a disabled account sent the reader to re-authenticate over a
+* setting they had chosen themselves (#115).
+*
+* A reason this table does not know falls back to 503 at the call site rather
+* than 401: "this lane cannot serve you right now" is a true statement about an
+* unfamiliar state, while "bad key" is a specific and probably false one.
+*/
+const REASON_STATUS = {
+	cooling: 429,
+	session_dead: 401,
+	reserve: 402,
+	disabled: 403,
+	empty: 503
+};
 function hostnameOfHost(host) {
 	let hostname = host.trim().toLowerCase();
 	if (hostname.startsWith("[")) {
@@ -18663,6 +19425,34 @@ function createWorkBuddyShim(options) {
 	const server = createServer((req, res) => {
 		handle(req, res);
 	});
+	async function acquireForRequest(modelId, conversationKey, signal) {
+		const ordinary = await pool.acquire(modelId, region, conversationKey);
+		const reserveExempt = /* @__PURE__ */ new Set();
+		if (ordinary !== void 0 || modelId === void 0 || signal.aborted) return {
+			account: ordinary,
+			reserveExempt
+		};
+		const now = Date.now();
+		const held = pool.list(region).filter((account) => pool.isReserved(account.id) && !pool.isDisabled(account.id) && (account.credentialDeadUntilMs ?? 0) <= now && account.cooldownUntilMs <= now && (account.modelCooldowns[modelId] ?? 0) <= now);
+		const pricingSignal = AbortSignal.any([signal, AbortSignal.timeout(5e3)]);
+		await Promise.all(held.map(async (account) => {
+			try {
+				const price = (await client.fetchModels(account.credential, pricingSignal)).find((model) => model.id === modelId)?.creditMultiplier;
+				logger?.info?.(`dsh-xdpool: reserve pricing model=${modelId} region=${region ?? "any"} price=${price ?? "unknown"} exempt=${!pricingSignal.aborted && price === 0}`);
+				if (!pricingSignal.aborted && price === 0) reserveExempt.add(account.id);
+			} catch {
+				logger?.info?.(`dsh-xdpool: reserve pricing unavailable model=${modelId} region=${region ?? "any"} aborted=${pricingSignal.aborted}`);
+			}
+		}));
+		if (signal.aborted) return {
+			account: void 0,
+			reserveExempt
+		};
+		return {
+			account: await pool.acquire(modelId, region, conversationKey, reserveExempt),
+			reserveExempt
+		};
+	}
 	/**
 	* "The same model has a paid row" sentence for a 429 body, or undefined.
 	*
@@ -18954,10 +19744,22 @@ function createWorkBuddyShim(options) {
 		}
 		const body = withBareModelId(raw, parsed.modelId);
 		const frames = [];
+		/**
+		* One id per user request, so a retry across keys counts as ONE turn.
+		*
+		* The key-rotation loop inside the forwarder files each physical attempt, and
+		* they must share this id or the panel would report "3 turns" for one question
+		* that happened to trip a rate limit. Same spelling the pool lane uses.
+		*/
+		const aggregateTurnId = randomBytes(8).toString("hex");
 		try {
 			await forwardAggregateStreamed(resolved, parsed.modelId, body, {
 				signal,
-				onData: (payload) => frames.push(payload)
+				onData: (payload) => frames.push(payload),
+				...usageRecorder === void 0 ? {} : { usage: {
+					recorder: usageRecorder,
+					turnId: aggregateTurnId
+				} }
 			});
 		} catch (error) {
 			if (res.headersSent) {
@@ -19158,98 +19960,249 @@ function createWorkBuddyShim(options) {
 		}
 		const attempts = [];
 		let last;
+		/**
+		* Why the chain moved on from each member, in order.
+		*
+		* A chain hides its own machinery: the user sees one answer from an
+		* unspecified member, and when the answer is worse/different/slower than
+		* expected there is nothing on screen to explain it. The whole point of
+		* reading a fallback trace is answering "why did it switch, and where did it
+		* land" — so every skip records the member, the failure class and the wire
+		* status, and the finished turn logs the sequence once.
+		*
+		* Logged, not returned: the caller asked for a completion, and a response
+		* shape invented for diagnostics would break every client that parses it.
+		*/
+		const switches = [];
+		const noteSwitch = (member, kind, status) => {
+			switches.push(`${member} → ${kind} (${String(status)})`);
+			logger?.warn?.(`dsh-xdpool: chain ${row.id} skipped ${member}: ${kind} (${String(status)}); trying next`);
+		};
 		const conversationKey = conversationKeyOf(raw);
 		for (const member of members) {
 			if (signal.aborted) return;
 			attempts.push(member.modelId);
-			if (!member.aggregate) {
-				const account = await pool.acquire(member.modelId, region);
-				if (account === void 0) {
-					const why = pool.unavailableReason(member.modelId, region);
+			const memberController = new AbortController();
+			const memberSignal = memberController.signal;
+			const relayAbort = () => {
+				memberController.abort();
+			};
+			if (signal.aborted) relayAbort();
+			else signal.addEventListener("abort", relayAbort, { once: true });
+			const memberTimer = setTimeout(() => {
+				memberController.abort();
+			}, MEMBER_TIMEOUT_MS);
+			memberTimer.unref?.();
+			/** Release this member's timer and listener. Every exit path calls it. */
+			const releaseMember = () => {
+				clearTimeout(memberTimer);
+				signal.removeEventListener("abort", relayAbort);
+			};
+			try {
+				/**
+				* A 扫码登录 channel member, served by the HOST's adapter registry.
+				*
+				* This is the branch that makes a chain able to name TRAE / Qoder /
+				* CodeBuddy at all. It goes through `channels.turn`, the same seam the
+				* single-model path uses, so the credential, endpoint and wire dialect are
+				* the host's problem rather than ours — and the model a chain reaches is
+				* literally the one the picker shows.
+				*
+				* Frames are BUFFERED like every other member (`frames.push`, written only on
+				* success): "retry only before any visible content" is what the chain
+				* promises, and streaming straight to the socket here would leave two models'
+				* text spliced together on screen when a later member answered.
+				*/
+				if (member.host === true) {
+					if (channels === void 0) {
+						last = {
+							kind: "combo_config",
+							status: 503,
+							message: `member ${member.modelId} needs the login-channel lane, which this build does not mount`
+						};
+						noteSwitch(member.modelId, "combo_config", 503);
+						continue;
+					}
+					const channelTarget = channels.resolve(member.modelId);
+					if (channelTarget === void 0) {
+						last = {
+							kind: "combo_config",
+							status: 400,
+							message: `member ${member.modelId} is not a resolvable channel model id`
+						};
+						noteSwitch(member.modelId, "combo_config", 400);
+						continue;
+					}
+					const memberCreated = Math.floor(Date.now() / 1e3);
+					const memberCompletionId = `chatcmpl-xdpool-${randomBytes(6).toString("base64url")}`;
+					const hostFrames = [];
+					const frameOf = (delta, reason) => JSON.stringify({
+						id: memberCompletionId,
+						object: "chat.completion.chunk",
+						created: memberCreated,
+						model: channelTarget.modelId,
+						choices: [{
+							index: 0,
+							delta,
+							finish_reason: reason
+						}],
+						usage: null
+					});
+					try {
+						let finishReason = "stop";
+						for await (const event of channels.turn({
+							channel: channelTarget.channel,
+							modelId: channelTarget.modelId,
+							body: JSON.parse(withBareModelId(raw, channelTarget.modelId)),
+							signal: memberSignal
+						})) if (event.kind === "usage") {} else if (event.kind === "done") {
+							if (typeof event.finishReason === "string" && event.finishReason !== "") finishReason = event.finishReason;
+						} else {
+							const delta = event.delta;
+							if (delta["content"] !== void 0 || delta["reasoning_content"] !== void 0 || Array.isArray(delta["tool_calls"])) {}
+							hostFrames.push(frameOf(delta, null));
+						}
+						/**
+						* An empty answer is still an ANSWER.
+						*
+						* The reference router settled this and it is right: a model that replied
+						* with nothing visible has responded, so falling through to the next
+						* member would silently substitute a different model over a legitimate
+						* (if unhelpful) result. The terminal frame is therefore always emitted,
+						* whether or not anything preceded it.
+						*/
+						hostFrames.push(frameOf({}, finishReason));
+					} catch (error) {
+						const message = error instanceof Error ? error.message : String(error);
+						const kind = error instanceof ChannelRequestError ? "client" : "server";
+						last = {
+							kind,
+							status: kind === "client" ? 400 : 502,
+							message: `channel ${channelTarget.channel}: ${message}`
+						};
+						noteSwitch(member.modelId, kind, last.status);
+						continue;
+					}
+					res.writeHead(200, {
+						"Content-Type": "text/event-stream",
+						"Cache-Control": "no-cache",
+						"Connection": "keep-alive",
+						"X-Accel-Buffering": "no"
+					});
+					for (const payload of hostFrames) res.write(`data: ${payload}\n\n`);
+					res.write("data: [DONE]\n\n");
+					res.end();
+					return;
+				}
+				if (!member.aggregate) {
+					const { account, reserveExempt } = await acquireForRequest(member.modelId, conversationKey, memberSignal);
+					if (account === void 0) {
+						const why = pool.unavailableReason(member.modelId, region, reserveExempt);
+						last = {
+							kind: why.reason,
+							status: REASON_STATUS[why.reason] ?? 503,
+							message: `member ${member.modelId} has no usable WorkBuddy account (${why.reason})`
+						};
+						noteSwitch(member.modelId, why.reason, last.status);
+						continue;
+					}
+					const memberRaw = JSON.stringify({
+						...JSON.parse(raw),
+						model: member.modelId
+					});
+					const prepared = client.prepareChatBodyFor(memberRaw, region ?? "cn");
+					const result = await client.chatStream(account.credential, prepared, memberSignal, conversationKey);
+					if (result.ok) {
+						const turnId = randomBytes(8).toString("hex");
+						await serveSuccessfulStream(res, account, result, logger, refreshBalance, pool, usageRecorder === void 0 ? void 0 : {
+							recorder: usageRecorder,
+							region: region ?? "cn",
+							model: member.modelId,
+							turnId
+						});
+						return;
+					}
+					last = {
+						kind: result.kind,
+						status: result.status,
+						message: result.message
+					};
+					if (result.kind === "soft_rate") pool.penalize(account.id, parseRateLimitReset(result.message), member.modelId);
+					else if (result.kind === "session_dead") pool.penalizeCredentialDead(account.id);
+					else if (result.kind === "hard_credit") pool.penalizeExhausted(account.id);
+					noteSwitch(member.modelId, result.kind, result.status);
+					continue;
+				}
+				if (store === void 0 || aggregate === void 0) {
 					last = {
-						kind: why.reason,
-						status: why.reason === "cooling" ? 429 : 401,
-						message: `member ${member.modelId} has no usable WorkBuddy account (${why.reason})`
+						kind: "combo_config",
+						status: 503,
+						message: "the aggregate lane is not available on this profile"
 					};
+					noteSwitch(member.modelId, "combo_config", 503);
 					continue;
 				}
-				const prepared = client.prepareChatBodyFor(raw, region ?? "cn");
-				const result = await client.chatStream(account.credential, prepared, signal, conversationKey);
-				if (result.ok) {
-					const turnId = randomBytes(8).toString("hex");
-					await serveSuccessfulStream(res, account, result, logger, refreshBalance, pool, usageRecorder === void 0 ? void 0 : {
-						recorder: usageRecorder,
-						region: region ?? "cn",
-						model: member.modelId,
-						turnId
+				const parsed = parseProviderModelId(member.modelId);
+				if (parsed === null) {
+					last = {
+						kind: "combo_config",
+						status: 400,
+						message: `member ${member.modelId} is not a valid provider model id`
+					};
+					noteSwitch(member.modelId, "combo_config", 400);
+					continue;
+				}
+				let resolved;
+				try {
+					resolved = resolveAggregateProvider(store, parsed.providerId);
+				} catch (error) {
+					last = {
+						kind: "combo_config",
+						status: 400,
+						message: error instanceof Error ? error.message : String(error)
+					};
+					noteSwitch(member.modelId, "combo_config", 400);
+					continue;
+				}
+				const frames = [];
+				try {
+					await forwardAggregateStreamed(resolved, parsed.modelId, withBareModelId(raw, parsed.modelId), {
+						signal: memberSignal,
+						onData: (payload) => frames.push(payload),
+						...usageRecorder === void 0 ? {} : { usage: {
+							recorder: usageRecorder,
+							turnId: conversationKey ?? randomBytes(8).toString("hex")
+						} }
 					});
-					return;
+				} catch (error) {
+					const kind = error instanceof AggregateError ? error.kind : "server";
+					last = {
+						kind,
+						status: error instanceof AggregateError ? KIND_STATUS[error.kind] : 502,
+						message: error instanceof Error ? error.message : String(error)
+					};
+					noteSwitch(member.modelId, kind, last.status);
+					continue;
 				}
-				last = {
-					kind: result.kind,
-					status: result.status,
-					message: result.message
-				};
-				if (result.kind === "soft_rate") pool.penalize(account.id, parseRateLimitReset(result.message), member.modelId);
-				else if (result.kind === "session_dead") pool.penalizeCredentialDead(account.id);
-				else if (result.kind === "hard_credit") pool.penalizeExhausted(account.id);
-				continue;
-			}
-			if (store === void 0 || aggregate === void 0) {
-				last = {
-					kind: "combo_config",
-					status: 503,
-					message: "the aggregate lane is not available on this profile"
-				};
-				continue;
-			}
-			const parsed = parseProviderModelId(member.modelId);
-			if (parsed === null) {
-				last = {
-					kind: "combo_config",
-					status: 400,
-					message: `member ${member.modelId} is not a valid provider model id`
-				};
-				continue;
-			}
-			let resolved;
-			try {
-				resolved = resolveAggregateProvider(store, parsed.providerId);
-			} catch (error) {
-				last = {
-					kind: "combo_config",
-					status: 400,
-					message: error instanceof Error ? error.message : String(error)
-				};
-				continue;
-			}
-			const frames = [];
-			try {
-				await forwardAggregateStreamed(resolved, parsed.modelId, withBareModelId(raw, parsed.modelId), {
-					signal,
-					onData: (payload) => frames.push(payload)
+				if (switches.length > 0) logger?.info?.(`dsh-xdpool: chain ${row.id} served by ${member.modelId} after skipping ${String(switches.length)}/${String(members.length)}: ${switches.join("; ")}`);
+				res.writeHead(200, {
+					"Content-Type": "text/event-stream",
+					"Cache-Control": "no-cache",
+					"Connection": "keep-alive",
+					"X-Accel-Buffering": "no"
 				});
-			} catch (error) {
-				last = {
-					kind: error instanceof AggregateError ? error.kind : "server",
-					status: error instanceof AggregateError ? KIND_STATUS[error.kind] : 502,
-					message: error instanceof Error ? error.message : String(error)
-				};
-				continue;
+				for (const payload of frames) res.write(`data: ${payload}\n\n`);
+				res.write("data: [DONE]\n\n");
+				res.end();
+				return;
+			} finally {
+				releaseMember();
 			}
-			res.writeHead(200, {
-				"Content-Type": "text/event-stream",
-				"Cache-Control": "no-cache",
-				"Connection": "keep-alive",
-				"X-Accel-Buffering": "no"
-			});
-			for (const payload of frames) res.write(`data: ${payload}\n\n`);
-			res.write("data: [DONE]\n\n");
-			res.end();
-			return;
 		}
 		const kind = last?.kind ?? "combo_empty";
-		writeOpenAIError(res, last?.status ?? 503, `combo_${kind}`, `chain ${row.id}: no member answered after ${attempts.length} [${attempts.join(" → ")}]: ${(last?.message ?? "no member was reachable").slice(0, 300)}`);
+		const status = last?.status ?? 503;
+		const trace = switches.length === 0 ? "" : ` [${switches.join("; ")}]`;
+		writeOpenAIError(res, status, `combo_${kind}`, `chain ${row.id}: no member answered after ${attempts.length} [${attempts.join(" → ")}]: ${(last?.message ?? "no member was reachable").slice(0, 300)}${trace}`);
 	}
 	/**
 	* Serve one chat completion, rotating accounts on rate limits.
@@ -19338,9 +20291,9 @@ function createWorkBuddyShim(options) {
 		};
 		for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
 			if (controller.signal.aborted) return;
-			const account = await pool.acquire(modelId, region, conversationKey);
+			const { account, reserveExempt } = await acquireForRequest(modelId, conversationKey, controller.signal);
 			if (account === void 0) {
-				const why = pool.unavailableReason(modelId, region);
+				const why = pool.unavailableReason(modelId, region, reserveExempt);
 				if (why.reason === "cooling") {
 					const subject = modelId === void 0 ? "every WorkBuddy account is rate-limited" : `every account is rate-limited for model ${modelId}`;
 					const upstream = last === void 0 ? "" : ` — ${last.message.slice(0, 200)}`;
@@ -19353,7 +20306,7 @@ function createWorkBuddyShim(options) {
 					return;
 				}
 				if (why.reason === "reserve") {
-					writeOpenAIError(res, 402, "reserve_floor", `every WorkBuddy account is at or below its credit reserve (${why.total} account(s)); lower the reserve on the pool card or top up credits`);
+					writeOpenAIError(res, 402, "reserve_floor", `no WorkBuddy account is available; every account not excluded by a cooldown or a revoked sign-in is at or below its credit reserve (${why.total} account(s) total); lower the reserve on the pool card or top up credits`);
 					return;
 				}
 				if (why.reason === "session_dead") {
@@ -19370,6 +20323,7 @@ function createWorkBuddyShim(options) {
 				return;
 			}
 			usageRecorder?.record({
+				channel: "workbuddy",
 				region: region ?? "cn",
 				model: modelId ?? "(none)",
 				account: account.label,
@@ -19413,7 +20367,7 @@ function createWorkBuddyShim(options) {
 		}
 		if (isContextTooLong(last.message)) {
 			const recovered = await recoverFromContextOverrun({
-				raw,
+				raw: poolRaw,
 				modelId,
 				controller,
 				region,
@@ -19421,8 +20375,12 @@ function createWorkBuddyShim(options) {
 				client,
 				pool,
 				maxAttempts,
-				usage: usageContext,
-				contextWindow: modelId === void 0 ? void 0 : catalog.current().find((m) => m.id === modelId)?.contextWindow
+				acquireAccount: async () => (await acquireForRequest(modelId, conversationKey, controller.signal)).account,
+				...usageContext === void 0 ? {} : { usage: usageContext },
+				...(() => {
+					const window = modelId === void 0 ? void 0 : catalog.current().find((m) => m.id === modelId)?.contextWindow;
+					return window === void 0 ? {} : { contextWindow: window };
+				})()
 			});
 			if (recovered.ok) {
 				await serveSuccessfulStream(res, recovered.account, recovered.result, logger, refreshBalance, pool, usageContext);
@@ -19529,6 +20487,7 @@ async function serveSuccessfulStream(res, account, result, logger, refreshBalanc
 		recorded = true;
 		if (usage?.recorder === void 0) return;
 		usage.recorder.record({
+			channel: "workbuddy",
 			region: usage.region,
 			model: usage.model,
 			account: account.label,
@@ -19618,7 +20577,7 @@ async function recoverFromContextOverrun(options) {
 	let compacted = messages;
 	let compactionDetail = "";
 	try {
-		const summariser = await pool.acquire(modelId, region);
+		const summariser = await (options.acquireAccount?.() ?? pool.acquire(modelId, region));
 		if (summariser === void 0) compactionDetail = "no account available to summarise with";
 		else {
 			const outcome = await compactWithSummary(messages, {
@@ -19652,7 +20611,7 @@ async function recoverFromContextOverrun(options) {
 			ok: false,
 			detail: "client disconnected"
 		};
-		const account = await pool.acquire(modelId, region);
+		const account = await (options.acquireAccount?.() ?? pool.acquire(modelId, region));
 		if (account === void 0) return {
 			ok: false,
 			detail: "no account available after compaction"
@@ -19660,6 +20619,7 @@ async function recoverFromContextOverrun(options) {
 		tried.push(account.label);
 		const result = await client.chatStream(account.credential, retryBody, controller.signal, conversationKeyOf(raw));
 		if (!result.ok) usage?.recorder.record({
+			channel: "workbuddy",
 			region: usage.region,
 			model: usage.model,
 			account: account.label,
@@ -20454,7 +21414,7 @@ function readPreferredIdSync(path = preferredIdPath()) {
 * free of documents that describe the absence of a decision.
 */
 async function writePreferredId(accountId, path = preferredIdPath()) {
-	await mkdir(dirname(path), { recursive: true });
+	await ensureSecretDir(dirname(path));
 	if (accountId === void 0) {
 		await rm(path, { force: true });
 		return;
@@ -20464,7 +21424,7 @@ async function writePreferredId(accountId, path = preferredIdPath()) {
 		accountId: accountId.trim()
 	}, null, 2);
 	const temp = `${path}.tmp`;
-	await writeFile(temp, `${payload}\n`, "utf8");
+	await writeSecretFile(temp, `${payload}\n`);
 	await rename(temp, path);
 }
 //#endregion
@@ -20523,40 +21483,59 @@ function relaySettingsOf(store) {
 * itself looks like it obeyed, and the user is the only one who can tell that a
 * member they paid for is now a fallback to something free.
 */
-function combosStatusOf(store, catalog, poolRows) {
+function combosStatusOf(store, catalog, poolRows, hostRows = []) {
 	const chains = combosOf(store);
 	const providerRows = catalog.providerRows();
 	const settings = new Map(configuredProviderIds(store).map((providerId) => [providerId, providerSettingOf(store, providerId)]));
-	const candidates = [...poolRows.map((row) => ({
-		id: row.id,
-		name: row.name,
-		owner: "workbuddy",
-		usable: true,
-		contextWindow: row.contextWindow,
-		supportsImages: row.supportsImages
-	})), ...providerRows.map((row) => {
-		const setting = settings.get(row.providerId);
-		const provider = getProvider(row.providerId);
-		return {
+	const candidates = [
+		...poolRows.map((row) => ({
 			id: row.id,
 			name: row.name,
-			owner: row.providerId,
-			usable: provider === null || setting === void 0 ? false : providerAuthUsable(provider, setting),
+			owner: "workbuddy",
+			usable: true,
 			contextWindow: row.contextWindow,
-			supportsImages: row.supportsImages
-		};
-	})];
+			supportsImages: row.supportsImages,
+			siblings: []
+		})),
+		...providerRows.map((row) => {
+			const setting = settings.get(row.providerId);
+			const provider = getProvider(row.providerId);
+			return {
+				id: row.id,
+				name: row.name,
+				owner: row.providerId,
+				usable: provider === null || setting === void 0 ? false : providerAuthUsable(provider, setting),
+				contextWindow: row.contextWindow,
+				supportsImages: row.supportsImages,
+				siblings: siblingRoutes(row.id, {
+					pool: poolRows,
+					aggregate: providerRows
+				}, row.providerId).filter((candidate) => candidate !== row.id)
+			};
+		}),
+		...hostRows.map((row) => ({
+			id: row.id,
+			name: row.name,
+			owner: row.channel,
+			usable: true,
+			contextWindow: COMBO_DEFAULT_CONTEXT_WINDOW,
+			supportsImages: false,
+			siblings: []
+		}))
+	];
 	const known = new Set(candidates.map((candidate) => candidate.id));
 	return {
 		combos: chains.map((chain) => {
 			const resolved = buildComboCatalog([chain], {
 				pool: poolRows,
-				aggregate: providerRows
+				aggregate: providerRows,
+				host: hostRows
 			})[0];
 			return {
 				id: resolved?.id ?? comboId(chain.name),
 				name: chain.name,
 				models: resolved?.models ?? [],
+				platforms: splitPlatforms(resolved?.models ?? []),
 				missing: chain.models.filter((modelId) => !known.has(modelId)),
 				strategy: resolved?.strategy ?? chain.strategy ?? "fallback",
 				stickyLimit: resolved?.stickyLimit ?? chain.stickyLimit ?? 1,
@@ -20745,7 +21724,18 @@ const Config = z.object({
 	modelSelectionGlobal: asVolatile(modelSelectionSchema.description("Model selection for the international gateway")),
 	automation: asVolatile(automationSchema.description("Daily points automation (activity report, task claiming, check-in)")),
 	automationEarnings: asVolatile(z.any().description("Automation earnings ledger (written by the scheduler)")),
-	sidebarRow: asVolatile(z.boolean().default(true).description("Show the XD Pool entry in the left sidebar (the Settings page keeps working either way)"))
+	sidebarRow: asVolatile(z.boolean().default(true).description("Show the XD Pool entry in the left sidebar (the Settings page keeps working either way)")),
+	/**
+	* The 免密 free lane (`free:` models).
+	*
+	* OFF unless set, and it is the only lane that works that way. It is a shared
+	* third-party endpoint with no credential of its own, so there is nothing for
+	* a user to "configure" — it simply appears in the picker or does not. On by
+	* default it added a group nobody asked for that the aggregate switch does not
+	* govern (it is not an aggregate provider), leaving no way to remove it
+	* without editing a file. Reported as "关不掉，应该默认是关闭的".
+	*/
+	freeLane: asVolatile(z.boolean().default(false).description("Offer the shared 免密 free models (the \"XD Pool · 免费模型\" group). Off by default: it is a third-party endpoint with no key of your own."))
 });
 /** Live API, published for the CLI. */
 let api;
@@ -20802,6 +21792,16 @@ function warnOnPiAiGenerationMismatch(ctx) {
 	} catch {}
 }
 /**
+* Late-bound switch for the 免密 lane, set once the catalog exists.
+*
+* `applyConfigFromSource` is defined before the catalog is built and can be
+* called at any point after, so it cannot close over the object directly without
+* a declaration-order dance. A one-line indirection states the ordering instead
+* of leaving it to be inferred: before the catalog exists this is a no-op, and
+* the catalog applies the current value itself the moment it is built.
+*/
+let freeLaneSwitch = () => {};
+/**
 * Start the loopback endpoint, register the `xdpool` provider, and
 * discover accounts. The provider registers only after `shim.ready` resolves,
 * because its models read the shim origin at construction time.
@@ -20904,7 +21904,8 @@ function apply(ctx, config = {}) {
 		}
 	};
 	const applyConfigFromSource = () => {
-		const { authFile, cooldownMs, distribution, disabledAccountIds, creditReserves, enabledModelIds, imageModelIds, contextBudgets, modelSelectionCn, modelSelectionGlobal, automation } = current();
+		const { authFile, cooldownMs, distribution, disabledAccountIds, creditReserves, enabledModelIds, imageModelIds, contextBudgets, modelSelectionCn, modelSelectionGlobal, automation, freeLane: freeLaneEnabled } = current();
+		freeLaneSwitch(freeLaneEnabled === true);
 		core.pool.applyConfig({
 			...authFile === void 0 ? {} : { authDirs: [dirname(authFile)] },
 			...cooldownMs === void 0 ? {} : { cooldownMs },
@@ -20923,6 +21924,7 @@ function apply(ctx, config = {}) {
 		};
 		core.catalogs.cn.applySelection(modelSelectionCn ?? fallbackSelection("cn"));
 		core.catalogs.global.applySelection(modelSelectionGlobal ?? fallbackSelection("global"));
+		applyLaneSelection(laneSelectionFrom(core.catalogs.cn.currentSelection().enabledModelIds, core.catalogs.global.currentSelection().enabledModelIds));
 		core.scheduler.applyConfig(automationOptions(automation));
 	};
 	const settingsService = ctx.settings;
@@ -21008,6 +22010,10 @@ function apply(ctx, config = {}) {
 	const aggregateCatalog = new AggregateCatalog(() => readAggregateSettingsSync(), () => core.catalogs.cn.current());
 	aggregateCatalog.refresh();
 	const freeCatalog = new FreeCatalog();
+	freeLaneSwitch = (enabled) => {
+		freeCatalog.setEnabled(enabled);
+	};
+	freeLaneSwitch(current().freeLane === true);
 	const freeLane = createFreeLaneSource(freeCatalog, ctx.logger, usageRecorder);
 	/**
 	* The login channels, for the LAN gateway.
@@ -21038,6 +22044,33 @@ function apply(ctx, config = {}) {
 	* object has no reason to carry a list it never consults.
 	*/
 	const lanModelsOf = () => readAggregateSettingsSync().relay?.models;
+	/**
+	* The login channels' models, as the route editor needs them.
+	*
+	* `channelLane.rows()` already caches per channel (60s TTL) and de-duplicates
+	* concurrent requests, so calling it per routing-document request is cheap — but
+	* it is ASYNC, and the chain table is built synchronously. Hence this helper: the
+	* callers that can await do, and a failed listing degrades to the previous answer
+	* rather than emptying the platform list (a channel that cannot be listed right
+	* now must not make its models disappear from every chain).
+	*
+	* The two pool-owned channels are excluded by `channelLane` itself, so the same
+	* model cannot appear once as a pool row and again as a channel row.
+	*/
+	let hostRosterCache = [];
+	const hostRoster = async () => {
+		try {
+			hostRosterCache = (await channelLane.rows()).map((row) => ({
+				id: row.id,
+				channel: row.channel,
+				modelId: row.modelId,
+				name: row.name
+			}));
+		} catch (error) {
+			ctx.logger?.warn?.("dsh-xdpool: could not list login-channel models:", error);
+		}
+		return hostRosterCache;
+	};
 	const shims = {
 		cn: createWorkBuddyShim({
 			pool: core.pool,
@@ -21134,9 +22167,7 @@ function apply(ctx, config = {}) {
 			await setSetting("disabledAccountIds", next, next);
 		},
 		setCreditReserve: async (accountId, reserve) => {
-			const next = { ...current().creditReserves ?? {} };
-			if (reserve > 0) next[accountId] = reserve;
-			else delete next[accountId];
+			const next = creditReservesWith(current().creditReserves, accountId, reserve);
 			await setSetting("creditReserves", next, next);
 		},
 		setAccountIgnored: async (accountId, ignored) => {
@@ -21167,6 +22198,9 @@ function apply(ctx, config = {}) {
 			else await updateProviderSetting(patch.providerId, {
 				...patch.enabled === void 0 ? {} : { enabled: patch.enabled },
 				...patch.apiKey === void 0 ? {} : { apiKey: patch.apiKey },
+				...patch.apiKeys === void 0 ? {} : { apiKeys: patch.apiKeys },
+				...patch.appendApiKey === void 0 ? {} : { appendApiKey: patch.appendApiKey },
+				...patch.distribution === void 0 ? {} : { distribution: patch.distribution },
 				...patch.baseUrl === void 0 ? {} : { baseUrl: patch.baseUrl },
 				...patch.models === void 0 ? {} : { models: patch.models }
 			});
@@ -21304,13 +22338,12 @@ function apply(ctx, config = {}) {
 				}))
 			};
 		},
-		combosDocument: () => combosStatusOf(readAggregateSettingsSync(), aggregateCatalog, core.catalogs.cn.current()),
+		combosDocument: async () => combosStatusOf(readAggregateSettingsSync(), aggregateCatalog, core.catalogs.cn.current(), await hostRoster()),
 		saveCombos: async (raw) => {
 			await saveCombos(raw);
 			await aggregateCatalog.refresh();
-			return combosStatusOf(readAggregateSettingsSync(), aggregateCatalog, core.catalogs.cn.current());
+			return combosStatusOf(readAggregateSettingsSync(), aggregateCatalog, core.catalogs.cn.current(), await hostRoster());
 		},
-		billionDocument: readBillionStatus,
 		/**
 		* Relay state plus the gateway's model picker.
 		*
@@ -21388,12 +22421,6 @@ function apply(ctx, config = {}) {
 			adoptChannelPackAccounts(scoped, core.pool, ctx.logger);
 		});
 	});
-	mountBillionContext(ctx, ctx.logger).then((outcome) => {
-		recordStartupNote(`billion-context ${outcome.state}`);
-		if (outcome.state === "unavailable") ctx.logger.warn(`[xdpool] billion-context not mounted — ${outcome.reason}`);
-	}, (error) => {
-		recordStartupNote(`billion-context mount failed: ${describeError(error)}`);
-	});
 	Promise.all([shims.cn.ready, shims.global.ready]).then(async () => {
 		if (stopped) return;
 		recordStartupNote(`both shims ready cn=${shims.cn.baseUrl()} global=${shims.global.baseUrl()}; entering registration`);