magpie-gemini-web 0.8.0 → 0.8.1

package/README.en.md

@@ -21,7 +21,7 @@ The plugin provides two independent providers that can be used individually or t
 | **Image generation** | Nano Banana models, for Magpie's image generation (Magpie v0.1.2075+, see below) | Not supported |
 | **Sign-in method** | Sign in directly in an isolated popup browser window | Copy `cookie` from a private/incognito window |
 | **Usage cards** | Shows models currently on cooldown and recovery times | Syncs **5-hour** & **weekly** usage and reset times from the web |
-| **Local backend** | AIStudio2API (`v0.2.18`) | gemini-web2api-go (`4.26.0-magpie.1` optimized build) |
+| **Local backend** | AIStudio2API (`v0.2.18`) | gemini-web2api-go (`4.26.0-magpie.2` optimized build) |
 
 ---
 
@@ -58,7 +58,7 @@ Install **magpie-gemini-web** from the Magpie plugin market, then sign in to eit
   - *Migrating older Gemini Web accounts:* For accounts added in earlier versions, add a Gemini Web account in Magpie and choose **「添加本地后端里已有的 Google 账号」** (Add an existing Google account from the local backend) to create individual cards, then remove the old pooled `API key …` card.
 - **Automatic account rotation:** The local backend selects which Google account serves each request (Gemini Web rotates across the pool; AI Studio uses one account until cooldown and switches to the next). Switching cards in Magpie does not change which account the backend picks.
 - **Usage reporting:**
-  - `gemini-web`: Available only with the one-click local backend. To minimize requests to Google, usage is refreshed only after an account is used or a quota window resets (at least 10 minutes apart, and at most once every 6 hours when idle).
+  - `gemini-web`: Available only with the one-click local backend. Usage is read from Google again whenever Magpie asks for it (at most once every 30 seconds per account), so pressing refresh shows the current allowance, including usage from the Gemini app, the website or other devices. On its own, Magpie asks about once a minute while the Usage page or the menu bar's allowances panel is open, whenever it updates allowances shown in the menu bar (every 3 minutes by default), and at most once a minute while it routes requests among accounts; otherwise it doesn't ask. A failed read isn't retried on its own for 10 minutes; pressing refresh in that time retries it at once (press it again if the first press doesn't).
   - `ai-studio`: AI Studio does not report remaining total quota; cards display models currently on cooldown and their recovery times, or prompt when re-authentication is needed.
 
 ---
@@ -67,10 +67,15 @@ Install **magpie-gemini-web** from the Magpie plugin market, then sign in to eit
 
 `ai-studio` lists the Nano Banana image models your account can use (such as `gemini-3.1-flash-image` and `gemini-3-pro-image`), for Magpie's image generation. **This needs Magpie v0.1.2075 or later**, the first to take a plugin's Gemini image models as models that draw.
 
-- **No need to tick them, or to pick them for a chat:** Magpie's Settings list them under **Images → Image generation**. Pick one there, or leave it on Automatic.
-- **How agents draw:** an agent calls Magpie's `generate_image` tool (the Magpie Image MCP from the Library), which draws with the model picked there; reference images make it an edit. To try it from the command line: `magpie tool generate_image "a magpie on a branch, watercolour" --size 16:9 -o magpie.png`.
+**Drawing from an agent** (pi, Claude Code, Codex and the rest alike):
+
+1. **Pick the model to draw with:** Magpie's Settings list these models under **Images → Image generation**. Pick one (such as `ai-studio/gemini-nano-banana-2.1`), or leave it on Automatic. There's no need to tick them in any model list.
+2. **Give the agent the drawing tool:** click **Give agents Magpie Image…** under that row, tick the agents that should draw in the Library it opens, then start a new session in the agent. With the Library turned off, the row says **Turn on the Library** instead: click that first. From the command line: `magpie library mcp add magpie-image magpie mcp image agents=pi` (several agents separated by commas, as in `agents=pi,claude`).
+3. **Chat as usual:** keep the agent on its usual chat model and ask it to draw something. It calls the `generate_image` tool, which draws with the model from step 1 and saves the image in the project's `generated-images/` folder; reference images make it an edit.
+
+- **Don't pick an image model as the chat model:** Magpie still keeps a plugin's models that draw in its chat model lists ([yetone/magpie#2792](https://github.com/yetone/magpie/issues/2792)). Picked there, they show no picture: an agent such as pi has no place for an image in the model's reply, so the image the model draws is dropped, while the model believes it was shown. They take no tool calls either, and have 32K–128K context windows.
+- **Drawing from the command line:** `magpie tool generate_image "a magpie on a branch, watercolour" --size 16:9 -o magpie.png`; add `--model ai-studio/gemini-3-pro-image` to draw with another model this once. If the terminal can't find the `magpie` command (step 2's command too), click **Add to PATH** on the **Command line** row of Magpie's Settings, then open a new terminal.
 - **Size:** `size` gives the aspect ratio. A ratio (such as `16:9` or `1:4`) is used as it is when the model takes it, else the nearest one it does; a size such as `1536x1024` is made the nearest usual ratio by Magpie first. `quality` makes no difference for these models.
-- **Don't tick them as chat models:** Magpie still keeps a plugin's models that draw in its chat model lists ([yetone/magpie#2792](https://github.com/yetone/magpie/issues/2792)). They take no tool calls and have 32K–128K context windows, so they make poor chat models for agents.
 - If you don't want the image models, turn them off with `studio.imageModels` (see the options below).
 
 ---
@@ -103,7 +108,7 @@ magpie plugin options magpie-gemini-web '{"studio":{"proxy":"http://127.0.0.1:78
 | :--- | :--- | :--- | :--- |
 | `allowTools` | `true` | Shared (override via `studio.allowTools`) | Allow tool calls. When `false`, requests with tools return 400 |
 | `allowImages` | Web: `false`; Studio: `true` | Shared (override via `studio.allowImages`) | Allow image input in a chat (an image model's reference images don't need it). Gemini Web reads images only when signed in and returns 400 otherwise; in testing, `gemini-3.6-flash` waited until the timeout on a chat with an image, while `gemini-3.5-flash-lite` and `gemini-3.8-flash` answered |
-| `requestTimeoutMs` / `modelTimeoutMs` | Web: `240000` / `10000`; Studio: `1800000` / `10000` | Shared (override via `studio.*`) | Timeout (ms) per backend wait or model list fetch; resets on stream data, explicit settings take precedence |
+| `requestTimeoutMs` / `modelTimeoutMs` | Web: `570000` / `10000`; Studio: `1800000` / `10000` | Shared (override via `studio.*`) | Timeout (ms) per backend wait or model list fetch; resets on stream data, explicit settings take precedence |
 | `stripCitations` | `true` | `gemini-web` only | Strip `[cite: 1]` and `[cite_start]` markers from replies and tool arguments (not supported on AI Studio) |
 | `proxy` | none | `gemini-web` only | Proxy for the managed Gemini Web backend to reach Google (`http` / `https` / `socks5` / `socks5h`), or set `GEMINI_WEB_PROXY` env var / enter during sign-in |
 | `baseURL` | `http://127.0.0.1:8083/v1` | `gemini-web` only | Default Gemini Web backend URL |
@@ -164,7 +169,7 @@ When a plugin error asks you to run a command, it includes the full ready-to-cop
 - Both backends listen on `127.0.0.1` only. Cookies and sessions remain on your machine; Magpie stores only a locally generated API key.
 - **Gemini Web data directory:** `~/.local/share/magpie-gemini-web` (override with `GEMINI_WEB_DATA_DIR`), logs at `backend.log`. Supports macOS, Linux, and Windows (x64 / arm64).
 - **AI Studio data directory:** `~/.local/share/magpie-ai-studio` (override with `AI_STUDIO_DATA_DIR`), logs at `backend.log` (rotated on next start after exceeding 10 MB). Uses port 2048 by default (or picks a free port and saves it in `config.json`). Supports macOS, Linux (x64 / arm64), and Windows x64.
-- Concurrency is capped at 1, but Google account rate-limiting or flagging cannot be completely ruled out—use at your own risk.
+- Gemini Web takes at most 2 requests at once per sign-in (AI Studio 1), adjustable in Magpie's provider settings. Google account rate-limiting or flagging cannot be completely ruled out—use at your own risk.
 
 **AI Studio upgrades and model selection:**
 - The plugin pins SHA-256-verified `v0.2.18-magpie.1`, based on upstream `v0.2.18`. Upgrade the plugin to update the backend. Official releases at or below that upstream version, and managed backends an older plugin installed, are upgraded on the next managed startup, preserving accounts, port and sign-in credentials.
@@ -177,7 +182,7 @@ When a plugin error asks you to run a command, it includes the full ready-to-cop
 - Models with `-build` or `assistant_route` are filtered out: they inject the Build coding assistant's own system prompt and are not offered as ordinary Agent models. Refresh with `magpie provider models ai-studio` after upgrading.
 
 **Gemini Web optimized backend upgrades & rollback:**
-- One-click setup uses [4.26.0-magpie.1](https://github.com/BUKOWSKIREAL/magpie-gemini-web/releases/tag/backend-v4.26.0-magpie.1) by default (built from pinned upstream v4.26.0 with XSRF caching, request cancellation propagation, early tool-call completion, and Argon model verification).
+- One-click setup uses [4.26.0-magpie.2](https://github.com/BUKOWSKIREAL/magpie-gemini-web/releases/tag/backend-v4.26.0-magpie.2) by default (built from pinned upstream v4.26.0 with XSRF caching, request cancellation propagation, early tool-call completion, and Argon model verification). Chat requests are timed by silence: while Google queues a request it sends a heartbeat every 60 s, and the backend waits through it for the first words. A try is given up, and retried, only after Google has sent nothing for `request_timeout_sec` (180 s by default), so a long reply that keeps coming is never cut off either.
 - **Upgrading:** Running backends are not interrupted automatically. Stop the existing process (PID in `backend.pid` inside the data directory); the next Magpie launch or request will upgrade the binary while preserving config and cookies.
 - **Rollback to upstream / restore optimized build** (run in the plugin directory after stopping the backend):
   ```bash

package/README.md

@@ -21,7 +21,7 @@
 | **图片生成** | Nano Banana 系列模型，供 Magpie 的图片生成使用（需要 Magpie v0.1.2075+，见下文） | 不支持 |
 | **登录方式** | 弹出独立浏览器窗口直接登录 Google | 用无痕窗口登录并复制 `cookie` |
 | **额度卡片** | 显示冷却中的模型与恢复时间 | 同步网页版 **5 小时** 与 **每周** 用量及重置时间 |
-| **本地后端** | AIStudio2API (`v0.2.18`) | gemini-web2api-go (`4.26.0-magpie.1` 优化版) |
+| **本地后端** | AIStudio2API (`v0.2.18`) | gemini-web2api-go (`4.26.0-magpie.2` 优化版) |
 
 ---
 
@@ -58,7 +58,7 @@
   - *旧版迁移（Gemini Web）*：若后端里已有早期版本添加的账号，在登录时选 **「添加本地后端里已有的 Google 账号」** 即可生成独立卡片，随后可删掉旧的 `API key …` 汇总卡片。
 - **账号池自动调度**：请求实际使用哪个账号由本地后端决定（Gemini Web 在账号池中轮流挑选；AI Studio 先用一个，进入冷却再切下一个）。在 Magpie 界面切换卡片不会改变后端的账号调度。
 - **用量刷新说明**：
-  - `gemini-web`：仅一键配置的本地后端可读取用量。为减少向 Google 发请求，仅在账号被使用或窗口重置后低频刷新（最短间隔 10 分钟，闲置时最多 6 小时刷新一次）。
+  - `gemini-web`：仅一键配置的本地后端可读取用量。Magpie 每次来查都会向 Google 重新读取（同一账号 30 秒内只读一次），点刷新即显示最新额度，包括在 Gemini 官方 App、网页或其他设备上的用量。Magpie 自己来查的频率：用量页或菜单栏的额度面板开着时约每分钟一次；菜单栏显示任何一家额度时随菜单栏更新（默认每 3 分钟）；经 Magpie 转发请求时最多每分钟一次；都没有时不查。读取失败后 10 分钟内不自动重试，这期间点刷新会立即重试，若未生效再点一次。
   - `ai-studio`：AI Studio 不提供剩余总额度，卡片会展示当前账号正在冷却的模型、恢复时间或重新登录提示。
 
 ---
@@ -67,10 +67,15 @@
 
 `ai-studio` 会列出账号可用的 Nano Banana 系列图像模型（如 `gemini-3.1-flash-image`、`gemini-3-pro-image`），供 Magpie 的图片生成使用。**需要 Magpie v0.1.2075 及以上**：从这个版本起，Magpie 才会把插件的 Gemini 图像模型列为出图模型。
 
-- **不用勾选，也不用在对话里选它们**：Magpie 设置的 **Images → Image generation** 会直接列出这些模型，选中一个，或保持 Automatic（自动）即可。
-- **Agent 怎么出图**：Agent 调用 Magpie 的 `generate_image` 工具（Library 里的 Magpie Image MCP），Magpie 用上面选的模型出图；带参考图就是改图。也可以在命令行试：`magpie tool generate_image "a magpie on a branch, watercolour" --size 16:9 -o magpie.png`。
+**让 Agent 出图**（pi、Claude Code、Codex 等都一样）：
+
+1. **选画图模型**：Magpie 设置的 **Images → Image generation** 会直接列出这些模型，选中一个（如 `ai-studio/gemini-nano-banana-2.1`），或保持 Automatic（自动）。不用在模型列表里勾选它们。
+2. **把画图工具交给 Agent**：点这一行下面的 **Give agents Magpie Image…**，在打开的 Library 里勾选要出图的 Agent，然后新开一个 Agent 会话。Library 被关掉时，这里显示的是 **Turn on the Library**，先点它。也可以用命令行：`magpie library mcp add magpie-image magpie mcp image agents=pi`（多个 Agent 用逗号隔开，如 `agents=pi,claude`）。
+3. **照常对话**：Agent 继续用平常的对话模型，跟它说「画一张……」就行。它会调用 `generate_image` 工具，用第 1 步选的模型出图，图片存进项目的 `generated-images/` 文件夹；带参考图就是改图。
+
+- **别把图像模型选成对话模型**：Magpie 目前会把能出图的插件模型也留在对话模型列表里（[yetone/magpie#2792](https://github.com/yetone/magpie/issues/2792)）。选了也看不到图：pi 等 Agent 的回复里放不下图片，模型画出的图会被直接丢掉，模型却以为已经发出去了。它们也不支持工具调用，上下文只有 32K–128K。
+- **在命令行出图**：`magpie tool generate_image "a magpie on a branch, watercolour" --size 16:9 -o magpie.png`，加 `--model ai-studio/gemini-3-pro-image` 可以临时换模型。终端里找不到 `magpie` 命令时（第 2 步的命令也一样），在 Magpie 设置的 **Command line** 一行点 **Add to PATH**，再开一个新终端。
 - **尺寸**：`size` 决定宽高比：写比例（如 `16:9`、`1:4`）时，模型支持就照用，不支持就取它支持的最接近的比例；写 `1536x1024` 这样的尺寸时，Magpie 先换成最接近的常用比例。`quality` 对这些模型不起作用。
-- **别把它们勾进对话模型**：Magpie 目前会把能出图的插件模型也留在对话模型列表里（[yetone/magpie#2792](https://github.com/yetone/magpie/issues/2792)）。它们不支持工具调用，上下文也只有 32K–128K，不适合当 Agent 的对话模型。
 - 不需要图像模型时，可以用 `studio.imageModels` 关掉（见下方选项）。
 
 ---
@@ -103,7 +108,7 @@ magpie plugin options magpie-gemini-web '{"studio":{"proxy":"http://127.0.0.1:78
 | :--- | :--- | :--- | :--- |
 | `allowTools` | `true` | 共用（可用 `studio.allowTools` 单独覆盖） | 允许工具调用。设为 `false` 时带工具的请求返回 400 |
 | `allowImages` | Web：`false`；Studio：`true` | 共用（可用 `studio.allowImages` 单独覆盖） | 允许对话中的图片输入（图像模型的参考图不受它限制）。Gemini Web 读图需要登录，未登录时返回 400；实测 `gemini-3.6-flash` 带图请求会一直等到超时，`gemini-3.5-flash-lite`、`gemini-3.8-flash` 正常 |
-| `requestTimeoutMs` / `modelTimeoutMs` | Web：`240000` / `10000`；Studio：`1800000` / `10000` | 共用（`studio.*` 可覆盖） | 单次等待后端 / 拉取模型列表的超时（毫秒）；收到流数据后重新计时，显式配置优先 |
+| `requestTimeoutMs` / `modelTimeoutMs` | Web：`570000` / `10000`；Studio：`1800000` / `10000` | 共用（`studio.*` 可覆盖） | 单次等待后端 / 拉取模型列表的超时（毫秒）；收到流数据后重新计时，显式配置优先 |
 | `stripCitations` | `true` | 仅 `gemini-web` | 剥离回复与工具参数中的 `[cite: 1]`、`[cite_start]` 标记（AI Studio 不支持剥离） |
 | `proxy` | 无 | 仅 `gemini-web` | 一键配置后端访问 Google 的代理（`http` / `https` / `socks5` / `socks5h`），也可用环境变量 `GEMINI_WEB_PROXY` 或在登录第一步填写 |
 | `baseURL` | `http://127.0.0.1:8083/v1` | 仅 `gemini-web` | Gemini Web 默认后端地址 |
@@ -164,7 +169,7 @@ magpie plugin options magpie-gemini-web '{"studio":{"proxy":"http://127.0.0.1:78
 - 两个后端均只监听 `127.0.0.1`，Cookie 与登录态仅保存在本机，Magpie 仅保存本地生成的随机 API Key。
 - **Gemini Web 数据目录**：`~/.local/share/magpie-gemini-web`（可通过 `GEMINI_WEB_DATA_DIR` 修改），日志位于 `backend.log`。支持 macOS、Linux、Windows（x64 / arm64）。
 - **AI Studio 数据目录**：`~/.local/share/magpie-ai-studio`（可通过 `AI_STUDIO_DATA_DIR` 修改），日志位于 `backend.log`（超 10 MB 下次启动自动轮转）。默认使用 2048 端口，被占用时自动顺延并记录在 `config.json`。支持 macOS、Linux（x64 / arm64）与 Windows x64。
-- 插件将请求并发限制为 1，但仍无法完全排除 Google 账号风控风险，请自行评估使用。
+- Gemini Web 每个登录同时最多 2 个请求（AI Studio 为 1），可在 Magpie 的 provider 设置里调整；仍无法完全排除 Google 账号风控风险，请自行评估使用。
 
 **AI Studio 升级与模型范围：**
 - 插件固定使用经过 SHA-256 校验的 `v0.2.18-magpie.1`（基于上游 `v0.2.18`），通过升级插件更新后端。同基线或更旧的官方版、以及旧版插件装的托管后端，在下次管理启动时自动升级，保留账号、端口与登录凭据。
@@ -177,7 +182,7 @@ magpie plugin options magpie-gemini-web '{"studio":{"proxy":"http://127.0.0.1:78
 - 模型列表过滤 `-build` / `assistant_route` 模型：这类模型附带 Build 写代码助手的系统提示词，不作为普通 Agent 模型提供。升级后可执行 `magpie provider models ai-studio` 刷新列表。
 
 **Gemini Web 优化后端升级与回退：**
-- 插件默认使用本仓库发布的 [4.26.0-magpie.1](https://github.com/BUKOWSKIREAL/magpie-gemini-web/releases/tag/backend-v4.26.0-magpie.1)（基于上游 v4.26.0 集成 XSRF 缓存、请求取消传播、工具调用提前收尾与 Argon 校验补丁）。
+- 插件默认使用本仓库发布的 [4.26.0-magpie.2](https://github.com/BUKOWSKIREAL/magpie-gemini-web/releases/tag/backend-v4.26.0-magpie.2)（基于上游 v4.26.0 集成 XSRF 缓存、请求取消传播、工具调用提前收尾与 Argon 校验补丁）。对话请求按上游沉默计时：Google 让请求排队时每 60 秒发一次心跳，后端会一直等到出字；连续 `request_timeout_sec`（默认 180 秒）没有任何数据才放弃这一次并重试，还在出字的长回复也不会被截断。
 - **旧版升级**：插件不会打断运行中的后端。先停止旧进程（PID 见数据目录 `backend.pid`），下次启动 Magpie 或发请求时会自动更新二进制并保留原有配置与账号。
 - **回退官方版 / 恢复优化版**（停止后端后在插件目录执行）：
   ```bash

package/index.mjs

@@ -102,7 +102,11 @@ export const GeminiWebPlugin = async (_input, options = {}) => {
     auth: {
       provider: ID,
       icon: PLUGIN_ICON,
-      maxConcurrency: 1,
+      // Two at once per sign-in, as a person with two Gemini tabs: an agent's first turn and
+      // the session title it asks for alongside no longer wait one behind the other, which
+      // Gemini Web can take minutes to answer (#33). The backend still caps each way out to
+      // Google (per-IP limits), and Magpie's own setting on the provider goes over this.
+      maxConcurrency: 2,
       methods: [{
         type: 'oauth',
         label: '一键配置本地 Gemini Web（推荐）',

package/lib/backend-release.json

@@ -1,7 +1,7 @@
 {
-  "version": "4.26.0-magpie.1",
+  "version": "4.26.0-magpie.2",
   "repository": "BUKOWSKIREAL/magpie-gemini-web",
-  "tag": "backend-v4.26.0-magpie.1",
+  "tag": "backend-v4.26.0-magpie.2",
   "upstream": {
     "repository": "https://github.com/zexadev/gemini-web2api-go.git",
     "commit": "7ce02d89512058b2bd147fb2dc4e40187f5135ad"
@@ -9,28 +9,28 @@
   "goVersion": "1.27.1",
   "binaries": {
     "darwin-arm64": {
-      "asset": "gemini-web2api-go_v4.26.0-magpie.1_darwin_arm64",
-      "sha256": "ae2581dfba30d7566c2c55cd53b0b65c56aab5e5f592ccac983a65c4444f069e"
+      "asset": "gemini-web2api-go_v4.26.0-magpie.2_darwin_arm64",
+      "sha256": "2407896cf76917499cca4cc4c932a774ba65cb6ccbf8b6901fb2c47a29c89e41"
     },
     "darwin-x64": {
-      "asset": "gemini-web2api-go_v4.26.0-magpie.1_darwin_amd64",
-      "sha256": "e220a5c53284c0c17ca9bc1a3e454448c95b84155fc460c17e0c8fcbae3b9d88"
+      "asset": "gemini-web2api-go_v4.26.0-magpie.2_darwin_amd64",
+      "sha256": "73774ee8a4687baa5c39cb1911f038e2293326c876e373745385a41378622b3d"
     },
     "linux-x64": {
-      "asset": "gemini-web2api-go_v4.26.0-magpie.1_linux_amd64",
-      "sha256": "cbbb9784823301f4f90e44d33a087d4d745770f4f35d77735fbae370087a7a43"
+      "asset": "gemini-web2api-go_v4.26.0-magpie.2_linux_amd64",
+      "sha256": "b320b050916090ab34e7025596a1daf8d2cb83880908b38786b24c0d3d621c74"
     },
     "linux-arm64": {
-      "asset": "gemini-web2api-go_v4.26.0-magpie.1_linux_arm64",
-      "sha256": "cf503f30ed3cfd358de926cf58b455b9ce7951dfa51b24584bd11559e9cfe7c0"
+      "asset": "gemini-web2api-go_v4.26.0-magpie.2_linux_arm64",
+      "sha256": "9ac7e4feed66a17d1719b2a0057130098640ee0f6cea2d6192e6938bd4f5259d"
     },
     "win32-x64": {
-      "asset": "gemini-web2api-go_v4.26.0-magpie.1_windows_amd64.exe",
-      "sha256": "e0d0bc52acd1c0c7dc7d1bdc8eb3da09dee2be8ed9a36173ab3be1bf4c58f667"
+      "asset": "gemini-web2api-go_v4.26.0-magpie.2_windows_amd64.exe",
+      "sha256": "16574f5863dae4dc806e1066c9bd515161c9250cbc7e949d8b8e46eca072628a"
     },
     "win32-arm64": {
-      "asset": "gemini-web2api-go_v4.26.0-magpie.1_windows_arm64.exe",
-      "sha256": "d038049af66365f0a6ab634664ca3d3715dd26e42d67f4c7f0b4f2ccba64f143"
+      "asset": "gemini-web2api-go_v4.26.0-magpie.2_windows_arm64.exe",
+      "sha256": "8bcefc92a56d26736651cd009c15bf4c0858e41a04f65a0d83d06df7f94296b3"
     }
   }
 }

package/lib/backend.mjs

@@ -165,7 +165,13 @@ export function settings(options = {}) {
     throw new Error('Invalid option outputLimit: cannot exceed contextLimit');
   }
 
-  let requestTimeoutMs = 240000;
+  // The backend sends nothing until a reply's first words, and Gemini Web can queue a request
+  // for minutes before them (3.6 Flash: 48 s to 6.5 minutes), sending the backend only a heartbeat
+  // a minute, which it waits through. The plugin can't tell that queue from a stuck backend, so
+  // it waits as long as it may: under the 10 minutes Magpie gives a provider to begin answering,
+  // so this timeout reaches the client rather than Magpie's. That also outlasts
+  // 4.26.0-magpie.1's three tries of 180 s each, 2 s apart: 544 s (#33).
+  let requestTimeoutMs = 570000;
   if (options.requestTimeoutMs !== undefined) {
     if (!Number.isInteger(options.requestTimeoutMs) || options.requestTimeoutMs <= 0) {
       throw new Error('Invalid option requestTimeoutMs: must be a positive integer');

package/lib/usage.mjs

@@ -35,14 +35,26 @@ const CLIENT_HEADERS = {
   'Sec-CH-UA-Platform': '"Windows"'
 };
 
-// When an account's pools are read again. They move only while the account is used, which the
-// backend records (usedAt, see poolAccounts), or when a window starts over; use from the Gemini
-// app itself is caught by USAGE_MAX_AGE_MS. No two reads of an account are closer than
-// USAGE_MIN_GAP_MS: Magpie set to read allowances automatically asks every few minutes, far
-// more often than a person opens the Usage page. A failed read stands that long too, so a
-// cookie Google turned away isn't asked about again on every refresh.
-export const USAGE_MIN_GAP_MS = 10 * 60 * 1000;
-export const USAGE_MAX_AGE_MS = 6 * 3600 * 1000;
+// When an account's pools are read again: whenever Magpie asks, once the last reading is
+// USAGE_FRESH_MS old. Magpie keeps an account's reading a minute itself (loginUsageCache in its
+// internal/provider/login_usage.go) and dates the card by when it got it, so a reading kept here
+// any longer would show old figures as new, and a refresh would show them again (#34); use from
+// the Gemini app, the website or another device leaves no trace here to read again on. On its
+// own Magpie asks about once a minute while its Usage page or tray panel is open, whenever it
+// brings the menu bar's allowances up to date (every 3 minutes unless set otherwise) and, a
+// minute apart, while it routes requests among the accounts; it asks sooner only when it puts
+// its minute aside. USAGE_FRESH_MS takes in asks that come together, a refresh pressed twice; a
+// read under way is shared.
+// A failed read stands USAGE_RETRY_MS, so a cookie Google turned away, or an account it is
+// limiting, isn't asked about again every minute. Magpie asking again within
+// USAGE_ASKED_AGAIN_MS of the last time tries it again at once: it does that only when it put
+// its minute aside, for a card's refresh button, the Usage page or tray panel brought up or
+// refreshed, `magpie quota` or a sign-in check. Its hook doesn't tell a refresh (auth.usage is
+// given getAuth and the provider alone), so one pressed later than that tries again only when
+// pressed once more.
+export const USAGE_FRESH_MS = 30 * 1000;
+export const USAGE_RETRY_MS = 10 * 60 * 1000;
+export const USAGE_ASKED_AGAIN_MS = 60 * 1000;
 
 // The pools the Usage page shows, under the names Magpie gives the same windows elsewhere.
 const POOLS = [
@@ -64,17 +76,13 @@ async function openReadOnly(file) {
 }
 
 // poolAccounts lists the enabled accounts in the backend's pool, each with the proxy it is
-// bound to, if any, and whether that proxy is enabled (proxyEnabled), whether the pool has
-// proxies at all (pooled: disabled ones count, as they do for the backend), and when the
-// backend last used it (usedAt, Unix seconds): the later of when it last took the account for
-// a request and when it last finished one.
+// bound to, if any, and whether that proxy is enabled (proxyEnabled), and whether the pool has
+// proxies at all (pooled: disabled ones count, as they do for the backend).
 export async function poolAccounts(dataDir = getDataDir()) {
   const db = await openReadOnly(path.join(dataDir, 'gemini.db'));
   try {
     return db.all(`SELECT a.id, a.label, a.cookie, p.url AS proxy, p.enabled AS proxyEnabled,
-        EXISTS (SELECT 1 FROM proxies) AS pooled,
-        MAX(a.last_used_at, COALESCE((SELECT MAX(r.ts) FROM requests r
-          WHERE r.ts >= a.last_used_at AND r.account_id = a.id), 0)) AS usedAt
+        EXISTS (SELECT 1 FROM proxies) AS pooled
       FROM accounts a LEFT JOIN proxies p ON p.id = a.proxy_id
       WHERE a.status = 'enabled' ORDER BY a.id`);
   } finally {
@@ -160,42 +168,48 @@ export async function accountUsage(account, options = {}) {
   }, options));
 }
 
-// The last read of each account: id -> { at, read, pools }, pools once it has succeeded.
+// The last read of each account: id -> { at, read, pools, failed }, pools once it has
+// succeeded, failed once it hasn't, neither while it is under way.
 const reads = new Map();
+// When Magpie last asked for each account's usage: id -> ms.
+const asked = new Map();
 
-// due says whether the account's last read is to be made again (see USAGE_MIN_GAP_MS).
-function due(last, account, options) {
-  const now = Date.now();
-  const age = now - last.at;
-  if (age < (options.minGapMs ?? USAGE_MIN_GAP_MS)) return false;
-  if (!last.pools || age >= (options.maxAgeMs ?? USAGE_MAX_AGE_MS)) return true;
-  if ((account.usedAt ?? 0) >= Math.floor(last.at / 1000)) return true;
-  return last.pools.some(p => {
-    const at = Date.parse(p?.gxu?.windowRefreshesAt ?? '');
-    return at > last.at && at <= now;
-  });
+// due says whether the account's last read is to be made again (see USAGE_FRESH_MS); one under
+// way never is. again: Magpie asked within USAGE_ASKED_AGAIN_MS of the time before.
+function due(last, again, options) {
+  const age = Date.now() - last.at;
+  const fresh = options.freshMs ?? USAGE_FRESH_MS;
+  if (last.pools) return age >= fresh;
+  return !!last.failed && age >= (again ? fresh : (options.retryMs ?? USAGE_RETRY_MS));
 }
 
 function readUsage(account, options) {
+  const now = Date.now();
+  const again = now - asked.get(account.id) < (options.askedAgainMs ?? USAGE_ASKED_AGAIN_MS);
+  asked.set(account.id, now);
   const last = reads.get(account.id);
-  if (last && !due(last, account, options)) return last.read;
-  const entry = { at: Date.now() };
-  entry.read = accountUsage(account, options).then(u => ((entry.pools = u.pools), u));
+  if (last && !due(last, again, options)) return last.read;
+  const entry = { at: now };
+  entry.read = accountUsage(account, options).then(
+    u => ((entry.pools = u.pools), u),
+    err => { entry.failed = true; throw err; }
+  );
   reads.set(account.id, entry);
   return entry.read;
 }
 
 // The Google account's email, from the signed-in app page's bootstrap data (WIZ_global_data's
 // oPEP7c), kept per backend account: the page is large and the email doesn't change. A page
-// that didn't give it is asked for again no sooner than USAGE_MAX_AGE_MS: the email only names
+// that didn't give it is asked for again no sooner than EMAIL_RETRY_MS: the email only names
 // a card. An account with no certain way out (egress) isn't asked yet, and that isn't a try.
 const emails = new Map(); // id -> { email }, or { at } since the last try that got none
 const EMAIL_FIELD = /"oPEP7c":"([^"@\s]+@[^"\s]+)"/;
+const EMAIL_RETRY_MS = 6 * 3600 * 1000;
 
 export async function accountEmail(account, options = {}) {
   const known = emails.get(account.id);
   if (known?.email) return known.email;
-  if (known && Date.now() - known.at < (options.maxAgeMs ?? USAGE_MAX_AGE_MS)) return undefined;
+  if (known && Date.now() - known.at < (options.emailRetryMs ?? EMAIL_RETRY_MS)) return undefined;
   egress(account, options);
   emails.set(account.id, { at: Date.now() });
   const page = await geminiRequest('https://gemini.google.com/app', account, {
@@ -250,7 +264,7 @@ export function poolWindows(read) {
 // usage is the Magpie usage card: one account's 5-hour and weekly windows, as
 // gemini.google.com/usage shows them, when the sign-in names its backend account; else the
 // whole pool's, as one card. Accounts go by their Google emails (#id until that is known).
-// An account is read from Google again only when due (see USAGE_MIN_GAP_MS).
+// An account is read from Google again only when due (see USAGE_FRESH_MS).
 // Magpie hides a card's windows behind an error, so a pool account that can't be read only
 // says so in the tooltip while the others still show.
 export async function usage(options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "magpie-gemini-web",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Gemini Web and Google AI Studio provider for Magpie, backed by gemini-web2api-go and AIStudio2API",
   "type": "module",
   "main": "./index.mjs",
@@ -83,6 +83,6 @@
   },
   "magpie": {
     "icon": "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNCIgaGVpZ2h0PSIyNCIgdmlld0JveD0iMCAwIDI0IDI0IiBmaWxsPSJub25lIj48ZGVmcz48bGluZWFyR3JhZGllbnQgaWQ9ImEiIHgxPSIyIiB5MT0iMyIgeDI9IjIwIiB5Mj0iMjEiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBvZmZzZXQ9IjAlIiBzdG9wLWNvbG9yPSIjMDZCNkQ0Ii8+PHN0b3Agb2Zmc2V0PSI1MCUiIHN0b3AtY29sb3I9IiMzQjgyRjYiLz48c3RvcCBvZmZzZXQ9IjEwMCUiIHN0b3AtY29sb3I9IiM4QjVDRjYiLz48L2xpbmVhckdyYWRpZW50PjxsaW5lYXJHcmFkaWVudCBpZD0iYiIgeDE9IjE0IiB5MT0iMiIgeDI9IjIyIiB5Mj0iMTAiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBvZmZzZXQ9IjAlIiBzdG9wLWNvbG9yPSIjOEI1Q0Y2Ii8+PHN0b3Agb2Zmc2V0PSIxMDAlIiBzdG9wLWNvbG9yPSIjRUM0ODk5Ii8+PC9saW5lYXJHcmFkaWVudD48L2RlZnM+PHBhdGggZD0iTTEwIDMuMkMxMC4zNSAzLjIgMTAuNjIgMy40NSAxMC43MiAzLjhDMTEuNDUgNi44NSAxMy4xNSA4LjU1IDE2LjIgOS4yOEMxNi41NSA5LjM4IDE2LjggOS42NSAxNi44IDEwQzE2LjggMTAuMzUgMTYuNTUgMTAuNjIgMTYuMiAxMC43MkMxMy4xNSAxMS40NSAxMS40NSAxMy4xNSAxMC43MiAxNi4yQzEwLjYyIDE2LjU1IDEwLjM1IDE2LjggMTAgMTYuOEM5LjY1IDE2LjggOS4zOCAxNi41NSA5LjI4IDE2LjJDOC41NSAxMy4xNSA2Ljg1IDExLjQ1IDMuOCAxMC43MkMzLjQ1IDEwLjYyIDMuMiAxMC4zNSAzLjIgMTBDMy4yIDkuNjUgMy40NSA5LjM4IDMuOCA5LjI4QzYuODUgOC41NSA4LjU1IDYuODUgOS4yOCAzLjhDOS4zOCAzLjQ1IDkuNjUgMy4yIDEwIDMuMloiIHRyYW5zZm9ybT0idHJhbnNsYXRlKC0wLjUgMi41KSBzY2FsZSgxLjEyKSIgZmlsbD0idXJsKCNhKSIvPjxwYXRoIGQ9Ik0xOC4yIDEuOEMxOC40MiAxLjggMTguNiAxLjk1IDE4LjY2IDIuMTZDMTkuMDggMy44MiAyMC4wMiA0Ljc2IDIxLjY4IDUuMThDMjEuODkgNS4yNCAyMi4wNCA1LjQyIDIyLjA0IDUuNjRDMjIuMDQgNS44NiAyMS44OSA2LjA0IDIxLjY4IDYuMUMyMC4wMiA2LjUyIDE5LjA4IDcuNDYgMTguNjYgOS4xMkMxOC42IDkuMzMgMTguNDIgOS40OCAxOC4yIDkuNDhDMTcuOTggOS40OCAxNy44IDkuMzMgMTcuNzQgOS4xMkMxNy4zMiA3LjQ2IDE2LjM4IDYuNTIgMTQuNzIgNi4xQzE0LjUxIDYuMDQgMTQuMzYgNS44NiAxNC4zNiA1LjY0QzE0LjM2IDUuNDIgMTQuNTEgNS4yNCAxNC43MiA1LjE4QzE2LjM4IDQuNzYgMTcuMzIgMy44MiAxNy43NCAyLjE2QzE3LjggMS45NSAxNy45OCAxLjggMTguMiAxLjhaIiBmaWxsPSJ1cmwoI2IpIi8+PGNpcmNsZSBjeD0iMTcuOCIgY3k9IjE4LjIiIHI9IjEuMzUiIGZpbGw9IiM2MzY2RjEiLz48L3N2Zz4=",
-    "maxConcurrency": 1
+    "maxConcurrency": 2
   }
 }

package/patches/argon.patch

@@ -1,3 +1,23 @@
+diff --git a/go.mod b/go.mod
+index c6a75e2..db2c8f5 100644
+--- a/go.mod
++++ b/go.mod
+@@ -9,6 +9,7 @@ require (
+ 	github.com/google/uuid v1.6.0
+ 	github.com/lib/pq v1.12.3
+ 	github.com/pkoukk/tiktoken-go v0.1.8
++	golang.org/x/net v0.59.0
+ 	modernc.org/sqlite v1.51.0
+ )
+ 
+@@ -29,7 +30,6 @@ require (
+ 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+ 	github.com/tam7t/hpkp v0.0.0-20160821193359-2b70b4024ed5 // indirect
+ 	golang.org/x/crypto v0.57.0 // indirect
+-	golang.org/x/net v0.59.0 // indirect
+ 	golang.org/x/sys v0.48.0 // indirect
+ 	golang.org/x/text v0.42.0 // indirect
+ 	modernc.org/libc v1.72.3 // indirect
 diff --git a/internal/app/admin_cookies.go b/internal/app/admin_cookies.go
 index f17a675..c90f08a 100644
 --- a/internal/app/admin_cookies.go
@@ -50,6 +70,20 @@ index f17a675..c90f08a 100644
  		if p.Label != nil || p.Note != nil {
  			// 只改传了的字段：没传的沿用当前值。
  			var curLabel, curNote string
+diff --git a/internal/app/admin_ui/index.html b/internal/app/admin_ui/index.html
+index a765bb1..eb073b6 100644
+--- a/internal/app/admin_ui/index.html
++++ b/internal/app/admin_ui/index.html
+@@ -1020,7 +1020,8 @@ const RT_GROUPS = [
+       { k: 'retry_attempts', label: '重试次数', type: 'int', min: 1, max: 10,
+         hint: '含首次；流式已吐字后不再重试' },
+       { k: 'retry_delay_sec', label: '重试间隔（秒）', type: 'int', min: 0, max: 60 },
+-      { k: 'request_timeout_sec', label: '上游超时（秒）', type: 'int', min: 5, max: 600 },
++      { k: 'request_timeout_sec', label: '上游超时（秒）', type: 'int', min: 5, max: 600,
++        hint: '对话请求按上游沉默计时：这么久一个字节都没来才放弃这一次（没出字前会重试）。排队时上游每 60 秒发一次心跳，回复一直在出也不会截断。其它请求（取页面、上传等）仍是整次请求的上限' },
+     ],
+   },
+   {
 diff --git a/internal/app/argon.go b/internal/app/argon.go
 new file mode 100644
 index 0000000..a2a5e77
@@ -939,10 +973,165 @@ index 0000000..f36c700
 +	t.Fatal("没有记录这次请求")
 +}
 diff --git a/internal/app/client.go b/internal/app/client.go
-index c63b3a9..de635f7 100644
+index c63b3a9..da8ccb8 100644
 --- a/internal/app/client.go
 +++ b/internal/app/client.go
-@@ -200,6 +200,37 @@ func currentBrowserUA() string {
+@@ -1,9 +1,11 @@
+ package app
+ 
+ import (
++	"context"
+ 	"crypto/sha1"
+ 	"encoding/hex"
+ 	"fmt"
++	"net"
+ 	"net/http"
+ 	"net/url"
+ 	"os"
+@@ -11,8 +13,10 @@ import (
+ 	"sync"
+ 	"time"
+ 
++	fhttp "github.com/bogdanfinn/fhttp"
+ 	tls_client "github.com/bogdanfinn/tls-client"
+ 	"github.com/bogdanfinn/tls-client/profiles"
++	"golang.org/x/net/proxy"
+ )
+ 
+ var (
+@@ -56,10 +60,20 @@ func resolveProfile(name string) profiles.ClientProfile {
+ // For proxied connections we use stdlib (see getStdlibClient) — tls-client's SOCKS5
+ // implementation is fragile compared to net/http.
+ func getTLSClient() tls_client.HttpClient {
++	return tlsClientWithin(rtCfg().RequestTimeout)
++}
++
++// getTLSStreamClient 同 getTLSClient，但不限整次请求的时长，给 StreamGenerate 用：
++// 还在出字的回复可以比 request_timeout_sec 长，上游沉默太久由 stallWatch 掐掉。
++func getTLSStreamClient() tls_client.HttpClient {
++	return tlsClientWithin(0)
++}
++
++// tlsClientWithin 是整次请求限时 timeout 秒（0 = 不限）的 tls-client。
++func tlsClientWithin(timeout int) tls_client.HttpClient {
+ 	imp := effectiveImpersonate()
+ 	// 缓存 key 带上超时：超时是建客户端时定死的，面板改了 request_timeout_sec
+ 	// 要换一个新客户端才生效（只按 imp 缓存时要重启进程才生效）。
+-	timeout := rtCfg().RequestTimeout
+ 	key := fmt.Sprintf("%s|%d", imp, timeout)
+ 	clientCacheMu.RLock()
+ 	if c, ok := clientCache[key]; ok {
+@@ -73,12 +87,7 @@ func getTLSClient() tls_client.HttpClient {
+ 	if c, ok := clientCache[key]; ok {
+ 		return c
+ 	}
+-	opts := []tls_client.HttpClientOption{
+-		tls_client.WithTimeoutSeconds(timeout),
+-		tls_client.WithClientProfile(resolveProfile(imp)),
+-		tls_client.WithNotFollowRedirects(),
+-	}
+-	client, err := tls_client.NewHttpClient(tls_client.NewNoopLogger(), opts...)
++	client, err := newTLSClient(imp, timeout)
+ 	if err != nil {
+ 		fmt.Fprintf(os.Stderr, "[client] tls-client init failed: %v\n", err)
+ 		os.Exit(1)
+@@ -87,6 +96,67 @@ func getTLSClient() tls_client.HttpClient {
+ 	return client
+ }
+ 
++// newTLSClient 新建一个指纹 imp、整次请求限时 timeout 秒（0 = 不限）的 tls-client，
++// 拨号用 tlsDialer（见下）。测试在 extra 里加上不校验证书，别的配置跟线上同一套。
++func newTLSClient(imp string, timeout int, extra ...tls_client.HttpClientOption) (tls_client.HttpClient, error) {
++	opts := append([]tls_client.HttpClientOption{
++		tls_client.WithTimeoutSeconds(timeout),
++		tls_client.WithClientProfile(resolveProfile(imp)),
++		tls_client.WithNotFollowRedirects(),
++		tls_client.WithProxyDialerFactory(newTLSDialer),
++	}, extra...)
++	return tls_client.NewHttpClient(tls_client.NewNoopLogger(), opts...)
++}
++
++// ─── tls-client 的拨号 ───────────────────────────────────────────────────────
++//
++// tls-client 的 HTTP/2 连接断了（空闲被关、对端 GOAWAY）之后，下一个请求要重新拨号，
++// 这一步却不带请求的 ctx：tls-client 的 dialTLSHTTP2 传的是 context.Background()，fhttp
++// 的连接池也只是干等拨号结束。整次请求的超时、stallWatch、客户端断开都管不到它；拨号时
++// 它还占着这个客户端的锁，同一个客户端里要新建连接的请求都得等它。tls-client 自带的
++// 拨号器只拿整次请求的超时去限 TCP 连接（不限时的客户端就完全不限），TLS 握手从来不限：
++// 对方连上了却不回话，这个客户端就一直卡死。
++//
++// 所以换成自己的拨号器，两步各自限时，数值同 Go 标准库 http.DefaultTransport 的拨号、
++// 握手超时：TCP 30 秒连不上算失败；连上后对方 10 秒内一个字节都没回（握手没有回音）就
++// 断开。tls-client 只连 Google 的 https，对方回的第一个字节总是握手。
++var (
++	dialTimeout      = 30 * time.Second
++	handshakeTimeout = 10 * time.Second
++)
++
++// newTLSDialer 当 tls-client 的 ProxyDialerFactory 用。我们不给 tls-client 配代理（走代理
++// 用 stdlib，见下），它就只管直连，tls-client 传进来的参数都用不上。
++func newTLSDialer(string, time.Duration, *net.TCPAddr, fhttp.Header, tls_client.Logger) (proxy.ContextDialer, error) {
++	return tlsDialer{}, nil
++}
++
++type tlsDialer struct{}
++
++func (tlsDialer) DialContext(ctx context.Context, network, addr string) (net.Conn, error) {
++	d := net.Dialer{Timeout: dialTimeout}
++	conn, err := d.DialContext(ctx, network, addr)
++	if err != nil {
++		return nil, err
++	}
++	conn.SetReadDeadline(time.Now().Add(handshakeTimeout))
++	return &answeredConn{Conn: conn}, nil
++}
++
++// answeredConn 在对方头一回回话时撤掉拨号时设的读超时，之后这条连接怎么用都不再限时。
++type answeredConn struct {
++	net.Conn
++	once sync.Once
++}
++
++func (c *answeredConn) Read(p []byte) (int, error) {
++	n, err := c.Conn.Read(p)
++	if n > 0 {
++		c.once.Do(func() { c.Conn.SetReadDeadline(time.Time{}) })
++	}
++	return n, err
++}
++
+ // ─── Stdlib HTTP client for proxied requests ─────────────────────────────────
+ //
+ // 走代理时改用 stdlib 而不是 tls-client，因为：
+@@ -112,13 +182,26 @@ var (
+ // getStdlibClient returns an http.Client routed through proxyURL.
+ // proxyURL must not be empty (caller checks).
+ func getStdlibClient(proxyURL string) *http.Client {
++	return stdlibClientWithin(proxyURL, rtCfg().RequestTimeout)
++}
++
++// getStdlibStreamClient 同 getStdlibClient，但不限整次请求的时长（见 getTLSStreamClient）。
++func getStdlibStreamClient(proxyURL string) *http.Client {
++	return stdlibClientWithin(proxyURL, 0)
++}
++
++// stdlibClientWithin 是走 proxyURL、整次请求限时 timeout 秒（0 = 不限）的 http.Client。
++func stdlibClientWithin(proxyURL string, timeout int) *http.Client {
+ 	// 同 getTLSClient：超时进 key，面板改超时后换新客户端。
+-	timeout := rtCfg().RequestTimeout
+ 	key := fmt.Sprintf("%s|%d", proxyURL, timeout)
+ 	if cached, ok := stdlibClientCache.Load(key); ok {
+ 		return cached.(*http.Client)
+ 	}
+ 	t := &http.Transport{
++		// 跟 Google 的 TLS 握手限时，同 tlsDialer：对话请求不限整次时长，握手没回音时
++		// 不必等满 stallWatch 的上限。连代理那步不另外限：配了 DialContext，Transport 会
++		// 悄悄关掉 HTTP/2；它本来就带着请求的 ctx，stallWatch 管得到。
++		TLSHandshakeTimeout: handshakeTimeout,
+ 		MaxIdleConns:        100,
+ 		MaxIdleConnsPerHost: 20,
+ 		IdleConnTimeout:     90 * time.Second,
+@@ -200,6 +283,37 @@ func currentBrowserUA() string {
  	return ChromeUA
  }
  
@@ -980,7 +1169,7 @@ index c63b3a9..de635f7 100644
  // applyChromeHeaders 给 stdlib 请求填上应用层 header（根据 impersonate 配置自动适配 Chrome 或 Firefox）。
  func applyChromeHeaders(req *http.Request) {
  	applyBrowserHeaders(req)
-@@ -207,21 +238,5 @@ func applyChromeHeaders(req *http.Request) {
+@@ -207,21 +321,5 @@ func applyChromeHeaders(req *http.Request) {
  
  // applyBrowserHeaders 给 stdlib 请求填上对应 impersonate 配置的应用层 header。
  func applyBrowserHeaders(req *http.Request) {
@@ -1003,6 +1192,119 @@ index c63b3a9..de635f7 100644
 -	req.Header.Set("Sec-Fetch-Site", "same-origin")
 +	setChromeHeaders(req.Header)
  }
+diff --git a/internal/app/client_timeout_test.go b/internal/app/client_timeout_test.go
+index 94c0b70..2a4b697 100644
+--- a/internal/app/client_timeout_test.go
++++ b/internal/app/client_timeout_test.go
+@@ -1,6 +1,12 @@
+ package app
+ 
+ import (
++	"context"
++	"errors"
++	"net"
++	"net/http"
++	"net/http/httptest"
++	"sync"
+ 	"testing"
+ 	"time"
+ )
+@@ -27,3 +33,95 @@ func TestClientCacheFollowsTimeout(t *testing.T) {
+ 		t.Fatal("tls client nil")
+ 	}
+ }
++
++// tls-client 的 HTTP/2 连接断了要重拨时，这一步不带请求的 ctx（见 tlsDialer）：对方连上了
++// 却不回话，以前请求就一直卡着，stallWatch 和客户端断开都掐不掉。
++func TestTLSRedialGivesUpOnASilentServer(t *testing.T) {
++	prev := handshakeTimeout
++	handshakeTimeout = 200 * time.Millisecond
++	t.Cleanup(func() { handshakeTimeout = prev })
++	useInsecureTLSClients(t)
++
++	ln, err := net.Listen("tcp", "127.0.0.1:0")
++	if err != nil {
++		t.Fatal(err)
++	}
++	quiet := &quietAfterFirst{Listener: ln}
++	t.Cleanup(quiet.closeHeld)
++	srv := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++		w.WriteHeader(200)
++	}))
++	srv.Listener.Close()
++	srv.Listener = quiet
++	srv.EnableHTTP2 = true
++	srv.StartTLS()
++	t.Cleanup(srv.Close)
++
++	send := func() error {
++		_, _, _, _, err := doGeminiRequestStop(context.Background(), srv.URL+"/StreamGenerate", "f.req=x",
++			map[string]string{}, "", nil, nil)
++		return err
++	}
++	if err := send(); err != nil {
++		t.Fatalf("头一个请求就失败了：%v", err)
++	}
++	srv.CloseClientConnections()      // 断掉这条 HTTP/2 连接，下一个请求只能重拨
++	time.Sleep(50 * time.Millisecond) // 等客户端看到连接断了
++
++	done := make(chan error, 1)
++	go func() { done <- send() }()
++	select {
++	case err := <-done:
++		var ne net.Error
++		if !errors.As(err, &ne) || !ne.Timeout() {
++			t.Fatalf("对方不回话应报超时，实际 %v", err)
++		}
++	case <-time.After(5 * time.Second):
++		t.Fatal("重拨时对方不回话，请求一直卡着")
++	}
++	if n := quiet.accepted(); n != 2 {
++		t.Fatalf("应该重拨一次，实际连上来 %d 次", n)
++	}
++}
++
++// quietAfterFirst 只把第一条连接交给服务器，之后连上来的都留着不理：TCP 连得上，
++// TLS 握手没有回音。
++type quietAfterFirst struct {
++	net.Listener
++	mu   sync.Mutex
++	n    int
++	held []net.Conn
++}
++
++func (l *quietAfterFirst) Accept() (net.Conn, error) {
++	for {
++		c, err := l.Listener.Accept()
++		if err != nil {
++			return nil, err
++		}
++		l.mu.Lock()
++		l.n++
++		first := l.n == 1
++		if !first {
++			l.held = append(l.held, c)
++		}
++		l.mu.Unlock()
++		if first {
++			return c, nil
++		}
++	}
++}
++
++func (l *quietAfterFirst) accepted() int {
++	l.mu.Lock()
++	defer l.mu.Unlock()
++	return l.n
++}
++
++func (l *quietAfterFirst) closeHeld() {
++	l.mu.Lock()
++	defer l.mu.Unlock()
++	for _, c := range l.held {
++		c.Close()
++	}
++}
 diff --git a/internal/app/context_file.go b/internal/app/context_file.go
 index bfc577b..cb60661 100644
 --- a/internal/app/context_file.go
@@ -1198,7 +1500,7 @@ index 6a88ac2..dc828d6 100644
  	if extractSAPISID(a.Cookie) == "" {
  		detail += "，但缺 SAPISID（算不出授权头，部分接口会被当匿名）"
 diff --git a/internal/app/gemini.go b/internal/app/gemini.go
-index 7c9186f..a6b0213 100644
+index 7c9186f..c04b69c 100644
 --- a/internal/app/gemini.go
 +++ b/internal/app/gemini.go
 @@ -3,6 +3,7 @@ package app
@@ -1471,7 +1773,7 @@ index 7c9186f..a6b0213 100644
  // upstreamModelRe 匹配响应帧里服务端自报的模型显示名（帧的 [42] 位）。
  // 形如 ...,"fbb127bbb056c959",null,null,"3.6 Flash",true,...
  var upstreamModelRe = regexp.MustCompile(`\\"[0-9a-f]{16}\\",null,null,\\"([^"\\]{1,40})\\"`)
-@@ -964,10 +1033,43 @@ func buildGeminiHeaders(cookieStr, sapisid, hexID string) map[string]string {
+@@ -964,10 +1033,122 @@ func buildGeminiHeaders(cookieStr, sapisid, hexID string) map[string]string {
  // 实测号活一两小时就失效 —— 所以这些必须收下来并写回账号。
  func doGeminiRequest(endpoint, body string, headers map[string]string, proxyURL string,
  	onLine func(string) error) (int, []byte, int64, []string, error) {
@@ -1504,11 +1806,90 @@ index 7c9186f..a6b0213 100644
 +	return s.r.Read(p)
 +}
 +
++// stallLimit 是 StreamGenerate 上游最多能沉默多久：request_timeout_sec，0 = 不限
++// （同客户端 Timeout 的 0）。测试里换短。
++var stallLimit = func() time.Duration { return time.Duration(rtCfg().RequestTimeout) * time.Second }
++
++// StallError 说上游沉默了 Limit 这么久，这次请求被 stallWatch 掐掉了。
++type StallError struct{ Limit time.Duration }
++
++func (e *StallError) Error() string {
++	return fmt.Sprintf("上游 %s 没有任何数据（request_timeout_sec）", e.Limit)
++}
++
++// stallWatch 盯着一次 StreamGenerate：上游 limit 这么久一个字节都没来（连上了却迟迟
++// 不回、或者回复写到一半停住）就取消这次请求，没出字的照常重试。计的是沉默，不是整次
++// 请求。
++//
++// 原来客户端的 Timeout 管整次请求，而上游会让请求排很久的队：同一个号问一句「你是谁」，
++// 3.6 Flash 首字在 48–393 秒之间（3.5 Flash-Lite 4 秒）。排队时上游每 60 秒发一个
++// 38 字节的心跳帧，出字后 1 秒内写完。整次限时 180 秒，排队超过 180 秒的请求一律被
++// 掐掉重发，重发又从头排队，三次都掐完才报错；还在出字的长回复也被拦腰截断。按沉默
++// 计时，心跳就让排队的请求一直等下去，只有连心跳都断了（limit 默认 180 秒，等于连着
++// 丢三个）才算卡住。
++type stallWatch struct {
++	ctx    context.Context
++	limit  time.Duration
++	timer  *time.Timer
++	cancel context.CancelCauseFunc
++}
++
++func newStallWatch(ctx context.Context, limit time.Duration) *stallWatch {
++	ctx, cancel := context.WithCancelCause(ctx)
++	w := &stallWatch{ctx: ctx, limit: limit, cancel: cancel}
++	if limit > 0 {
++		w.timer = time.AfterFunc(limit, func() { cancel(&StallError{Limit: limit}) })
++	}
++	return w
++}
++
++// heard 说上游又来了数据，沉默从现在重新算。
++func (w *stallWatch) heard() {
++	if w.timer != nil {
++		w.timer.Reset(w.limit)
++	}
++}
++
++// done 结束盯梢。
++func (w *stallWatch) done() {
++	if w.timer != nil {
++		w.timer.Stop()
++	}
++	w.cancel(nil)
++}
++
++// explain 把被 stallWatch 掐掉的请求报的 context canceled 换成 StallError；
++// 别的错误（包括客户端断开）原样返回。
++func (w *stallWatch) explain(err error) error {
++	var stall *StallError
++	if err != nil && errors.As(context.Cause(w.ctx), &stall) {
++		return stall
++	}
++	return err
++}
++
++// heardReader 每读到数据就告诉 stallWatch 一声。
++type heardReader struct {
++	r io.Reader
++	w *stallWatch
++}
++
++func (h heardReader) Read(p []byte) (int, error) {
++	n, err := h.r.Read(p)
++	if n > 0 {
++		h.w.heard()
++	}
++	return n, err
++}
++
 +// doGeminiRequestStop 同 doGeminiRequest，stop 置位后提前结束读取（见 stopReader），
-+// ctx 结束时中止连接和读取。
++// ctx 结束时中止连接和读取。整次请求不限时，上游沉默超过 stallLimit 才放弃（见 stallWatch）。
 +func doGeminiRequestStop(ctx context.Context, endpoint, body string, headers map[string]string, proxyURL string,
 +	onLine func(string) error, stop *atomic.Bool) (int, []byte, int64, []string, error) {
  	sendAt := time.Now()
++	watch := newStallWatch(ctx, stallLimit())
++	defer watch.done()
++	ctx = watch.ctx
  	if proxyURL != "" {
  		// 走 stdlib 的 http.ProxyURL，已知能过 socks5/socks5h。
 -		req, err := http.NewRequest("POST", endpoint, strings.NewReader(body))
@@ -1516,16 +1897,25 @@ index 7c9186f..a6b0213 100644
  		if err != nil {
  			return 0, nil, 0, nil, err
  		}
-@@ -981,7 +1083,7 @@ func doGeminiRequest(endpoint, body string, headers map[string]string, proxyURL
- 			return 0, nil, 0, nil, err
+@@ -975,36 +1156,37 @@ func doGeminiRequest(endpoint, body string, headers map[string]string, proxyURL
+ 		for k, v := range headers {
+ 			req.Header.Set(k, v)
+ 		}
+-		client := getStdlibClient(proxyURL)
++		client := getStdlibStreamClient(proxyURL)
+ 		resp, err := client.Do(req)
+ 		if err != nil {
+-			return 0, nil, 0, nil, err
++			return 0, nil, 0, nil, watch.explain(err)
  		}
  		defer resp.Body.Close()
 -		raw, ttfb, err := readBody(resp.Body, onLine, sendAt)
-+		raw, ttfb, err := readModelCheckedBody(stopReader{resp.Body, stop}, onLine, sendAt, resp.StatusCode, headers["x-goog-ext-525001261-jspb"])
++		raw, ttfb, err := readModelCheckedBody(stopReader{heardReader{resp.Body, watch}, stop}, onLine, sendAt, resp.StatusCode, headers["x-goog-ext-525001261-jspb"])
  		if err != nil {
- 			return resp.StatusCode, nil, ttfb, resp.Header.Values("Set-Cookie"), err
+-			return resp.StatusCode, nil, ttfb, resp.Header.Values("Set-Cookie"), err
++			return resp.StatusCode, nil, ttfb, resp.Header.Values("Set-Cookie"), watch.explain(err)
  		}
-@@ -989,10 +1091,11 @@ func doGeminiRequest(endpoint, body string, headers map[string]string, proxyURL
+ 		return resp.StatusCode, raw, ttfb, resp.Header.Values("Set-Cookie"), nil
  	}
  
  	// 直连 → tls-client，保留 chrome146 TLS/HTTP2 真指纹
@@ -1538,16 +1928,23 @@ index 7c9186f..a6b0213 100644
  	for k, v := range headers {
  		req.Header.Set(k, v)
  	}
-@@ -1002,7 +1105,7 @@ func doGeminiRequest(endpoint, body string, headers map[string]string, proxyURL
- 		return 0, nil, 0, nil, err
+-	client := getTLSClient()
++	client := getTLSStreamClient()
+ 	resp, err := client.Do(req)
+ 	if err != nil {
+-		return 0, nil, 0, nil, err
++		return 0, nil, 0, nil, watch.explain(err)
  	}
  	defer resp.Body.Close()
 -	raw, ttfb, err := readBody(resp.Body, onLine, sendAt)
-+	raw, ttfb, err := readModelCheckedBody(stopReader{resp.Body, stop}, onLine, sendAt, resp.StatusCode, headers["x-goog-ext-525001261-jspb"])
++	raw, ttfb, err := readModelCheckedBody(stopReader{heardReader{resp.Body, watch}, stop}, onLine, sendAt, resp.StatusCode, headers["x-goog-ext-525001261-jspb"])
  	if err != nil {
- 		return resp.StatusCode, nil, ttfb, resp.Header.Values("Set-Cookie"), err
+-		return resp.StatusCode, nil, ttfb, resp.Header.Values("Set-Cookie"), err
++		return resp.StatusCode, nil, ttfb, resp.Header.Values("Set-Cookie"), watch.explain(err)
  	}
-@@ -1313,6 +1416,7 @@ func probeGemini(prompt, proxyURL string) ProbeResult {
+ 	return resp.StatusCode, raw, ttfb, resp.Header.Values("Set-Cookie"), nil
+ }
+@@ -1313,6 +1495,7 @@ func probeGemini(prompt, proxyURL string) ProbeResult {
  			res.Diagnostic = "构建请求失败: " + e.Error()
  			return res
  		}
@@ -1645,26 +2042,23 @@ index 00eb305..2b4c6ca 100644
  		name, mc, err := resolveModel(c.name)
 diff --git a/internal/app/headers_test.go b/internal/app/headers_test.go
 new file mode 100644
-index 0000000..9613045
+index 0000000..ef9b476
 --- /dev/null
 +++ b/internal/app/headers_test.go
-@@ -0,0 +1,98 @@
+@@ -0,0 +1,74 @@
 +package app
 +
 +import (
 +	"context"
-+	"fmt"
 +	"net/http"
 +	"net/http/httptest"
 +	"testing"
-+
-+	tls_client "github.com/bogdanfinn/tls-client"
 +)
 +
 +// 同一个账号的请求不能因为走没走代理而呈现两种客户端：两条路径都要带齐 chromeHeaders，
 +// 调用方自己的 header 照样生效。直连那条以前一个都不带，UA 是 Go-http-client/2.0。
 +//
-+// 直连走 tls-client，这里换成跳过证书校验的同款客户端，打本机的 HTTPS 测试服务器；
++// 直连走 tls-client，这里换成不校验证书的同款客户端，打本机的 HTTPS 测试服务器；
 +// 代理那条把 http:// 目标以绝对 URI 发给代理，测试服务器本身就能当代理（同 cancel_test）。
 +func TestDirectAndProxyPathsSendSameBrowserHeaders(t *testing.T) {
 +	got := map[string]http.Header{}
@@ -1681,28 +2075,7 @@ index 0000000..9613045
 +	proxy := httptest.NewServer(record("proxy"))
 +	defer proxy.Close()
 +
-+	imp := effectiveImpersonate()
-+	key := fmt.Sprintf("%s|%d", imp, rtCfg().RequestTimeout)
-+	insecure, err := tls_client.NewHttpClient(tls_client.NewNoopLogger(),
-+		tls_client.WithClientProfile(resolveProfile(imp)),
-+		tls_client.WithInsecureSkipVerify(),
-+		tls_client.WithNotFollowRedirects())
-+	if err != nil {
-+		t.Fatal(err)
-+	}
-+	clientCacheMu.Lock()
-+	prev, had := clientCache[key]
-+	clientCache[key] = insecure
-+	clientCacheMu.Unlock()
-+	t.Cleanup(func() {
-+		clientCacheMu.Lock()
-+		defer clientCacheMu.Unlock()
-+		if had {
-+			clientCache[key] = prev
-+		} else {
-+			delete(clientCache, key)
-+		}
-+	})
++	useInsecureTLSClients(t)
 +
 +	own := map[string]string{"Accept-Language": "en-US,en;q=0.9", "X-Same-Domain": "1"}
 +	paths := []struct {
@@ -2063,6 +2436,65 @@ index 0000000..236a51d
 +		t.Fatalf("非流式: stop=%v reads=%d tracker=%q", lh.stop.Load(), src.reads, lh.tracker.emitted)
 +	}
 +}
+diff --git a/internal/app/main_test.go b/internal/app/main_test.go
+index 38e1a44..e3f7636 100644
+--- a/internal/app/main_test.go
++++ b/internal/app/main_test.go
+@@ -1,9 +1,12 @@
+ package app
+ 
+ import (
++	"fmt"
+ 	"os"
+ 	"path/filepath"
+ 	"testing"
++
++	tls_client "github.com/bogdanfinn/tls-client"
+ )
+ 
+ // TestMain 把 DB 指向临时目录再跑测试。
+@@ -31,3 +34,41 @@ func withPoolCookie(t *testing.T) {
+ 	}
+ 	t.Cleanup(func() { _ = accountDelete(id) })
+ }
++
++// useInsecureTLSClients 把直连用的两个 tls-client 换成不校验证书的同款，好打本机的
++// HTTPS 测试服务器。限时的那个给上传等请求，不限时的给 StreamGenerate（getTLSStreamClient）；
++// 除了不校验证书，配置跟线上一样（newTLSClient）。
++func useInsecureTLSClients(t *testing.T) {
++	t.Helper()
++	imp := effectiveImpersonate()
++	for _, timeout := range []int{rtCfg().RequestTimeout, 0} {
++		c, err := newTLSClient(imp, timeout, tls_client.WithInsecureSkipVerify())
++		if err != nil {
++			t.Fatal(err)
++		}
++		key := fmt.Sprintf("%s|%d", imp, timeout)
++		clientCacheMu.Lock()
++		prev, had := clientCache[key]
++		clientCache[key] = c
++		clientCacheMu.Unlock()
++		t.Cleanup(func() {
++			clientCacheMu.Lock()
++			defer clientCacheMu.Unlock()
++			if had {
++				clientCache[key] = prev
++			} else {
++				delete(clientCache, key)
++			}
++		})
++	}
++}
++
++// withRequestTimeout 把面板的 request_timeout_sec 临时改成 sec 秒。
++func withRequestTimeout(t *testing.T, sec int) {
++	t.Helper()
++	rtMu.Lock()
++	saved := rtVal.RequestTimeout
++	rtVal.RequestTimeout = sec
++	rtMu.Unlock()
++	t.Cleanup(func() { rtMu.Lock(); rtVal.RequestTimeout = saved; rtMu.Unlock() })
++}
 diff --git a/internal/app/mcp_media.go b/internal/app/mcp_media.go
 index acb1131..a8bab02 100644
 --- a/internal/app/mcp_media.go
@@ -2294,7 +2726,7 @@ index 376171f..87b91fe 100644
  // 返回 (mode, forcedName)：mode ∈ {"auto","none","required"}；
  // forcedName 非空表示客户端点名了某个函数。
 diff --git a/internal/app/server.go b/internal/app/server.go
-index b451d12..b0dbbd3 100644
+index b451d12..5d3cf5b 100644
 --- a/internal/app/server.go
 +++ b/internal/app/server.go
 @@ -1,6 +1,7 @@
@@ -2310,19 +2742,19 @@ index b451d12..b0dbbd3 100644
  )
  
 -const Version = "4.26.0"
-+const Version = "4.26.0-magpie.1"
++const Version = "4.26.0-magpie.2"
  
  func writeJSON(w http.ResponseWriter, status int, data interface{}) {
  	body, _ := json.Marshal(data)
 @@ -43,6 +44,7 @@ func handleRoot(w http.ResponseWriter, r *http.Request) {
- 	writeJSON(w, 200, map[string]interface{}{
  		"status":  "ok",
  		"version": Version,
  		"models":  modelNames,
 +		"capabilities": map[string]bool{"account_proxy_binding": true},
  	})
  }
-@@ -130,9 +131,9 @@ func rejectUnsupported(req map[string]interface{}, messages []map[string]interfa
+ 
+@@ -130,9 +132,9 @@ func rejectUnsupported(req map[string]interface{}, messages []map[string]interfa
  	return nil
  }
  
@@ -2334,7 +2766,7 @@ index b451d12..b0dbbd3 100644
  	if err != nil {
  		// res 非 nil：失败时它只带归属（哪个号 / 哪个出口），给 recordRequest 用
  		return "", nil, res, err
-@@ -268,7 +269,7 @@ func handleChatCompletions(w http.ResponseWriter, r *http.Request) {
+@@ -268,7 +270,7 @@ func handleChatCompletions(w http.ResponseWriter, r *http.Request) {
  		return
  	}
  
@@ -2343,7 +2775,7 @@ index b451d12..b0dbbd3 100644
  	if strings.TrimSpace(prompt) == "" && len(images) == 0 {
  		writeJSON(w, 400, map[string]interface{}{"error": map[string]string{"message": "empty prompt"}})
  		return
-@@ -305,11 +306,14 @@ func handleChatCompletions(w http.ResponseWriter, r *http.Request) {
+@@ -305,11 +307,14 @@ func handleChatCompletions(w http.ResponseWriter, r *http.Request) {
  	var res *StreamResult
  	if rtCfg().MultiTurn && len(images) == 0 && modelCfg.Tool == 0 {
  		// 多轮：按历史前缀识别续接，命中就只发新消息、历史留服务端。带 tools 也走这条。
@@ -2360,7 +2792,7 @@ index b451d12..b0dbbd3 100644
  		mde, downgraded := err.(*ModelDowngradedError)
  		status := 502
  		if downgraded {
-@@ -400,6 +404,21 @@ func handleChatCompletions(w http.ResponseWriter, r *http.Request) {
+@@ -400,6 +405,21 @@ func handleChatCompletions(w http.ResponseWriter, r *http.Request) {
  	})
  }
  
@@ -2382,7 +2814,7 @@ index b451d12..b0dbbd3 100644
  // usageOf 是 buildUsageWithReasoning 的便捷包装，res 可能为 nil。
  func usageOf(prompt, text string, res *StreamResult) map[string]int {
  	r := ""
-@@ -575,7 +594,7 @@ func handleResponses(w http.ResponseWriter, r *http.Request) {
+@@ -575,7 +595,7 @@ func handleResponses(w http.ResponseWriter, r *http.Request) {
  		return
  	}
  
@@ -2391,7 +2823,7 @@ index b451d12..b0dbbd3 100644
  	if strings.TrimSpace(prompt) == "" && len(images) == 0 {
  		writeJSON(w, 400, map[string]interface{}{"error": map[string]string{"message": "empty input"}})
  		return
-@@ -669,11 +688,14 @@ func handleResponses(w http.ResponseWriter, r *http.Request) {
+@@ -669,11 +689,14 @@ func handleResponses(w http.ResponseWriter, r *http.Request) {
  	var toolCalls []ToolCall
  	var res *StreamResult
  	if rtCfg().MultiTurn && len(images) == 0 && modelCfg.Tool == 0 {
@@ -2408,6 +2840,211 @@ index b451d12..b0dbbd3 100644
  		mde, downgraded := err.(*ModelDowngradedError)
  		status := 502
  		if downgraded {
+diff --git a/internal/app/stall_test.go b/internal/app/stall_test.go
+new file mode 100644
+index 0000000..cfdd6cf
+--- /dev/null
++++ b/internal/app/stall_test.go
+@@ -0,0 +1,199 @@
++package app
++
++import (
++	"context"
++	"errors"
++	"fmt"
++	"io"
++	"net/http"
++	"net/http/httptest"
++	"testing"
++	"time"
++)
++
++func withStallLimit(t *testing.T, d time.Duration) {
++	t.Helper()
++	prev := stallLimit
++	stallLimit = func() time.Duration { return d }
++	t.Cleanup(func() { stallLimit = prev })
++}
++
++// 每个用例都在两条路上各跑一遍，假上游的行为一样：代理那条（同 cancel_test：http:// 目标
++// 以绝对 URI 发给代理，httptest 服务器本身就能当上游），直连那条（HTTPS + HTTP/2 的测试
++// 服务器，tls-client 换成不校验证书的同款，见 useInsecureTLSClients）。
++var upstreamPaths = []struct {
++	name  string
++	start func(t *testing.T, h http.Handler) (endpoint, proxyURL string)
++}{
++	{"proxy", func(t *testing.T, h http.Handler) (string, string) {
++		srv := httptest.NewServer(h)
++		t.Cleanup(srv.Close)
++		return "http://upstream.invalid/StreamGenerate", srv.URL
++	}},
++	{"direct", func(t *testing.T, h http.Handler) (string, string) {
++		useInsecureTLSClients(t)
++		srv := httptest.NewUnstartedServer(h)
++		srv.EnableHTTP2 = true
++		srv.StartTLS()
++		t.Cleanup(srv.Close)
++		return srv.URL + "/StreamGenerate", ""
++	}},
++}
++
++// 一直在出字的回复比 request_timeout_sec 长也不能被截断：以前整次请求限时，
++// 180 秒时还在写的回复被拦腰掐掉。
++func TestStallWatchKeepsAReplyThatKeepsComing(t *testing.T) {
++	withRequestTimeout(t, 1) // 整次限时的客户端 1 秒就掐，回复要写 1.2 秒
++	withStallLimit(t, 150*time.Millisecond)
++	for _, p := range upstreamPaths {
++		t.Run(p.name, func(t *testing.T) {
++			endpoint, proxyURL := p.start(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++				w.WriteHeader(200)
++				for i := 0; i < 20; i++ {
++					fmt.Fprintf(w, "frame %d\n", i)
++					w.(http.Flusher).Flush()
++					time.Sleep(60 * time.Millisecond)
++				}
++			}))
++
++			lines := 0
++			start := time.Now()
++			status, _, _, _, err := doGeminiRequestStop(context.Background(), endpoint, "f.req=x",
++				map[string]string{}, proxyURL, func(line string) error {
++					lines++
++					return nil
++				}, nil)
++			if err != nil || status != 200 {
++				t.Fatalf("持续出字的回复被掐了：status=%d err=%v", status, err)
++			}
++			if lines != 20 {
++				t.Fatalf("只读到 %d 行", lines)
++			}
++			if took := time.Since(start); took < time.Second {
++				t.Fatalf("测试前提不成立：回复只用了 %v，没比整次限时长", took)
++			}
++		})
++	}
++}
++
++// 上游让请求排队时只发心跳帧（实测每 60 秒一个），排得比沉默上限还久也要等到出字：
++// 以前整次请求限时，排队超过 180 秒的请求一律被掐掉重发。
++func TestStallWatchWaitsThroughHeartbeats(t *testing.T) {
++	withStallLimit(t, 150*time.Millisecond)
++	for _, p := range upstreamPaths {
++		t.Run(p.name, func(t *testing.T) {
++			endpoint, proxyURL := p.start(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++				w.WriteHeader(200)
++				w.Write([]byte(")]}'\nfirst frame\n"))
++				w.(http.Flusher).Flush()
++				for i := 0; i < 6; i++ {
++					time.Sleep(100 * time.Millisecond)
++					w.Write([]byte("heartbeat\n"))
++					w.(http.Flusher).Flush()
++				}
++				w.Write([]byte("answer\n"))
++			}))
++
++			var got []string
++			start := time.Now()
++			_, _, _, _, err := doGeminiRequestStop(context.Background(), endpoint, "f.req=x",
++				map[string]string{}, proxyURL, func(line string) error {
++					got = append(got, line)
++					return nil
++				}, nil)
++			if err != nil {
++				t.Fatalf("还在发心跳的上游被当成卡住了：%v", err)
++			}
++			if len(got) == 0 || got[len(got)-1] != "answer" {
++				t.Fatalf("没等到排队之后的回复：%q", got)
++			}
++			if took := time.Since(start); took < 4*150*time.Millisecond {
++				t.Fatalf("测试前提不成立：排队只用了 %v，没比沉默上限长", took)
++			}
++		})
++	}
++}
++
++// 首帧之后就不再出字的上游，沉默满上限就放弃，报 StallError，并真的断开上游连接。
++func TestStallWatchEndsAQuietUpstream(t *testing.T) {
++	withStallLimit(t, 150*time.Millisecond)
++	for _, p := range upstreamPaths {
++		t.Run(p.name, func(t *testing.T) {
++			upstreamGone := make(chan struct{})
++			endpoint, proxyURL := p.start(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++				w.WriteHeader(200)
++				w.Write([]byte(")]}'\nfirst frame\n"))
++				w.(http.Flusher).Flush()
++				select {
++				case <-r.Context().Done():
++					close(upstreamGone)
++				case <-time.After(10 * time.Second):
++				}
++			}))
++
++			start := time.Now()
++			_, _, _, _, err := doGeminiRequestStop(context.Background(), endpoint, "f.req=x",
++				map[string]string{}, proxyURL, func(string) error { return nil }, nil)
++			var stall *StallError
++			if !errors.As(err, &stall) {
++				t.Fatalf("沉默的上游应报 StallError，实际 %v", err)
++			}
++			if took := time.Since(start); took > 3*time.Second {
++				t.Fatalf("沉默 150ms 就该放弃，实际等了 %v", took)
++			}
++			select {
++			case <-upstreamGone:
++			case <-time.After(3 * time.Second):
++				t.Fatal("上游连接没有被关闭")
++			}
++		})
++	}
++}
++
++// 连上了却一直不回响应头，同样按沉默计时。
++func TestStallWatchEndsAnUpstreamThatNeverAnswers(t *testing.T) {
++	withStallLimit(t, 150*time.Millisecond)
++	for _, p := range upstreamPaths {
++		t.Run(p.name, func(t *testing.T) {
++			endpoint, proxyURL := p.start(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++				io.Copy(io.Discard, r.Body) // 读完请求体，服务端才盯得到连接断开
++				select {
++				case <-r.Context().Done():
++				case <-time.After(10 * time.Second):
++				}
++			}))
++
++			_, _, _, _, err := doGeminiRequestStop(context.Background(), endpoint, "f.req=x",
++				map[string]string{}, proxyURL, nil, nil)
++			var stall *StallError
++			if !errors.As(err, &stall) {
++				t.Fatalf("不回响应头的上游应报 StallError，实际 %v", err)
++			}
++		})
++	}
++}
++
++// 客户端断开不是上游沉默：照旧报 context.Canceled，调用方据此不重试、不记出口的错。
++func TestStallWatchLeavesClientCancelAlone(t *testing.T) {
++	withStallLimit(t, 10*time.Second)
++	for _, p := range upstreamPaths {
++		t.Run(p.name, func(t *testing.T) {
++			endpoint, proxyURL := p.start(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++				io.Copy(io.Discard, r.Body) // 读完请求体，服务端才盯得到连接断开
++				select {
++				case <-r.Context().Done():
++				case <-time.After(10 * time.Second):
++				}
++			}))
++
++			ctx, cancel := context.WithCancel(context.Background())
++			time.AfterFunc(50*time.Millisecond, cancel)
++			_, _, _, _, err := doGeminiRequestStop(ctx, endpoint, "f.req=x",
++				map[string]string{}, proxyURL, nil, nil)
++			var stall *StallError
++			if errors.As(err, &stall) || !errors.Is(err, context.Canceled) {
++				t.Fatalf("客户端断开应报 context.Canceled，实际 %v", err)
++			}
++		})
++	}
++}
 diff --git a/internal/app/strict_model.go b/internal/app/strict_model.go
 index ecc17ac..88267c5 100644
 --- a/internal/app/strict_model.go