fix(merge): restore chat.js imports, trust-vision floor, gitignore entries

Audit of every branch-owned line the -X theirs merge dropped from
the 32 pre-merge commits found three more real regressions:

* src/sse/handlers/chat.js: merge kept the capsOverride feature
  (bb8d67ba) but reverted the import block, so getCustomModels and
  capabilitiesFromServiceKind were undefined. The runtime error was
  swallowed by the feature's own fail-open try/catch — custom
  models silently lost their vision override. Restored both imports.
* open-sse/providers/capabilities.js: TRUST_UPSTREAM_VISION (the
  floor that keeps vision on for unknown models on upstream-validating
  gateways like openrouter) was left as dead code by the merge —
  upstream rewrote step 4 as refine() and dropped the check.
  Re-applied it on top of the new refine() so catalog/limits
  refinement still applies.
* tests/unit/chat-connection-pin.test.js: mock auth module lacked
  isModelAllowedForKey added by f0adfb20.
* .gitignore: re-add .pi-subagents/.

.gitignore

@@ -88,4 +88,10 @@ graphify-out/*
 .next-analyze/*
 
 # Kiro local workspace state
-.kiro/
+.kiro/
+
+# CommandCode CLI local state (auth/taste/projects)
+.commandcode/
+
+# Pi subagent run artifacts
+.pi-subagents/

open-sse/providers/capabilities.js

@@ -476,6 +476,9 @@ export function getCapabilitiesForModel(provider, model) {
     }
   }
 
-  // 4. Floor
+  // 4. Floor (upstream-validated gateways keep vision on for unknown models)
+  if (provider && TRUST_UPSTREAM_VISION.has(provider)) {
+    return { ...refine(null, provider, model), vision: true };
+  }
   return refine(null, provider, model);
 }

open-sse/services/usage.js

@@ -15,6 +15,7 @@ import { getXaiUsage } from "./usage/xai.js";
 import { getGrokCliUsage } from "./usage/grok-cli.js";
 import { getKimiUsage } from "./usage/kimi.js";
 import { getDeepseekUsage } from "./usage/deepseek.js";
+import { getCommandCodeUsage } from "./usage/commandcode.js";
 import { getOpenCodeGoUsage } from "./usage/opencode-go.js";
 import { getGroqUsage } from "./usage/groq.js";
 import { getZedUsage } from "./usage/zed.js";
@@ -60,6 +61,7 @@ const USAGE_HANDLERS = {
   kimi: (c) => getKimiUsage(c.accessToken, c.apiKey, c.proxyOptions, c.providerSpecificData),
   "opencode-go": (c) => getOpenCodeGoUsage(c.apiKey, c.proxyOptions),
   deepseek: (c) => getDeepseekUsage(c.apiKey, c.proxyOptions),
+  commandcode: (c) => getCommandCodeUsage(c.apiKey, c.proxyOptions),
   groq: (c) => getGroqUsage(c.apiKey, c.proxyOptions),
   zed: (c) => getZedUsage(c.accessToken, c.providerSpecificData, c.proxyOptions),
 };

src/app/(dashboard)/dashboard/profile/page.js

@@ -295,7 +295,9 @@ export default function ProfilePage() {
   const handleGlobalTimeoutChange = async (e) => {
     const raw = e.target.value.replace(/[^0-9]/g, "");
     const numTimeout = parseInt(raw, 10);
-    const patchValue = (raw !== "" && Number.isFinite(numTimeout) && numTimeout > 0) ? numTimeout : null;
+    // Enforce a sane minimum (1s) so a stray "60" never becomes a 60ms
+    // connect timeout — same guard as the per-provider timeout input.
+    const patchValue = (raw !== "" && Number.isFinite(numTimeout) && numTimeout > 0) ? Math.max(1000, numTimeout) : null;
 
     try {
       const res = await fetch("/api/settings", {

src/app/(dashboard)/dashboard/providers/[id]/page.js

@@ -326,7 +326,7 @@ export default function ProviderDetailPage() {
       setProviderStrategy(override.fallbackStrategy || null);
       setProviderStickyLimit(override.stickyRoundRobinLimit != null ? String(override.stickyRoundRobinLimit) : "1");
       setProviderNoAuthEnabled(override.enabled !== false);
-      // Load per-provider connect timeout
+      // Load per-provider connect timeout (ms)
       const timeoutCfg = (settingsData.providerTimeouts || {})[providerId] || {};
       setProviderTimeout(timeoutCfg.timeoutMs != null ? String(timeoutCfg.timeoutMs) : "");
       // Load per-provider thinking config
@@ -478,8 +478,10 @@ export default function ProviderDetailPage() {
         delete updated[providerId];
       } else {
         const timeoutMs = parseInt(ms, 10);
+        // Stored in ms; enforce a sane minimum (1s) so a stray "60" means
+        // 60 SECONDS-worth of protection — never a 60ms connect timeout.
         if (Number.isFinite(timeoutMs) && timeoutMs > 0) {
-          updated[providerId] = { timeoutMs };
+          updated[providerId] = { timeoutMs: Math.max(1000, timeoutMs) };
         } else {
           delete updated[providerId];
         }

src/app/(dashboard)/dashboard/usage/components/ProviderLimits/utils.js

@@ -648,6 +648,24 @@ export function parseQuotaData(provider, data) {
         }
         break;
 
+      case "commandcode":
+        // CommandCode reports currency credits (5-hour/weekly windows + monthly
+        // credits) with used/total in dollars. Forward remainingPercentage (the
+        // UI would otherwise render "$0.05" balances as "0%") and unit "$".
+        if (data.quotas) {
+          Object.entries(data.quotas).forEach(([name, quota]) => {
+            normalizedQuotas.push({
+              name,
+              used: quota.used || 0,
+              total: quota.total || 0,
+              unit: quota.unit || "$",
+              resetAt: quota.resetAt || null,
+              remainingPercentage: quota.remainingPercentage,
+            });
+          });
+        }
+        break;
+
       default:
         // Generic fallback for unknown providers
         if (data.quotas) {

src/sse/handlers/chat.js

@@ -10,8 +10,9 @@ import {
   isModelAllowedForKey,
 } from "../services/auth.js";
 import { handleAntigravityQuotaError, clearAntigravityStrikes } from "../services/antigravityQuota.js";
-import { getSettings } from "@/lib/localDb";
+import { getSettings, getCustomModels } from "@/lib/localDb";
 import { getModelInfo, getComboModels } from "../services/model.js";
+import { capabilitiesFromServiceKind } from "open-sse/providers/capabilities.js";
 import { handleChatCore } from "open-sse/handlers/chatCore.js";
 import { DEFAULT_HEADROOM_URL } from "@/lib/headroom/detect";
 import { getTransform as getPxpipeTransform } from "@/lib/pxpipe/loader.js";

tests/unit/chat-connection-pin.test.js

@@ -16,6 +16,7 @@ const authMocks = vi.hoisted(() => ({
   clearAccountError: vi.fn(async () => {}),
   extractApiKey: vi.fn(() => null),
   isValidApiKey: vi.fn(async () => true),
+  isModelAllowedForKey: vi.fn(() => true),
 }));
 const tokenMocks = vi.hoisted(() => ({
   checkAndRefreshToken: vi.fn(async (_p, creds) => creds),