@mars-sea/dsh-commandcode-provider 0.11.5 → 0.11.7

package/lib/index.js

@@ -56,6 +56,11 @@ const KNOWN_EFFORTS = {
 		"medium",
 		"xhigh"
 	],
+	"Qwen/Qwen3.8-Omni-Flash": [
+		"low",
+		"medium",
+		"xhigh"
+	],
 	"claude-fable-5-1": [
 		"low",
 		"medium",
@@ -219,6 +224,11 @@ const KNOWN_EFFORTS = {
 		"high",
 		"max"
 	],
+	"z-ai/glm-5.3-flashx": [
+		"low",
+		"high",
+		"max"
+	],
 	"zai-org/GLM-5.2": ["high", "max"],
 	"zai-org/GLM-5.3": [
 		"low",
@@ -293,6 +303,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"Qwen/Qwen3.8-Flash",
 	"Qwen/Qwen3.8-Max",
 	"Qwen/Qwen3.8-Max-0902",
+	"Qwen/Qwen3.8-Omni-Flash",
 	"claude-fable-5-1",
 	"claude-fable-5",
 	"claude-haiku-4-5-20251001",
@@ -334,7 +345,8 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"xai/grok-4.5",
 	"xai/grok-4.6",
 	"xiaomi/mimo-v2.5",
-	"z-ai/glm-5.3-flash"
+	"z-ai/glm-5.3-flash",
+	"z-ai/glm-5.3-flashx"
 ]);
 /**
 * Models the official CLI's model table (command-code@1.53.0) marks
@@ -355,8 +367,9 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 * `['low', 'medium', 'high']` efforts in command-code@1.38.0 and moved to
 * `KNOWN_EFFORTS`. `moonshotai/Kimi-K3` followed the same path in
 * command-code@1.39.3 — it gained `['low', 'high', 'max']` efforts and moved
-* to `KNOWN_EFFORTS`. command-code@1.42.0 added `meituan/LongCat-2.0:free`
-* (reasoning:!0, no efforts). command-code@1.45.0 gave the Muse Spark family
+* to `KNOWN_EFFORTS`. command-code@1.42.0 added LongCat 2.0 (then
+* `meituan/LongCat-2.0:free`, now the paid `meituan/LongCat-2.0`; reasoning:!0,
+* no efforts). command-code@1.45.0 gave the Muse Spark family
 * (1.1, 1.2, 1.2-contributor, 1.3, 1.3-contributor) selectable
 * `['low', 'medium', 'high', 'xhigh']` efforts — they moved to `KNOWN_EFFORTS`.
 * command-code@1.51.3 gave `MiniMaxAI/MiniMax-M3` selectable
@@ -382,7 +395,7 @@ const KNOWN_THINKING_MODELS = /* @__PURE__ */ new Set([
 	"thinkingmachines/inkling",
 	"thinkingmachines/inkling-small",
 	"poolside/laguna-s-2.1-free",
-	"meituan/LongCat-2.0:free",
+	"meituan/LongCat-2.0",
 	"inclusionai/ling-3.0-flash-sante:free"
 ]);
 /**
@@ -438,11 +451,14 @@ function requiresMessagesEndpoint(modelId) {
 * the official plan/pricing pages grants individual-provider/max/ultra and
 * teams-pro only, and the CLI's plan-access map blocks it on Go/GOAT/Pro.
 * command-code@1.41.0 added `Qwen/Qwen3.8-Max-0902` (Go) and 1.42.0 added
-* `meituan/LongCat-2.0:free` (Go, free promo); command-code@1.43.0 added
+* LongCat 2.0 (Go — a free promo until 2026-09-19, when the backend renamed
+* `meituan/LongCat-2.0:free` to the paid `meituan/LongCat-2.0`); 1.43.0 added
 * `google/gemini-3.8-flash` (GOAT) and 1.44.0 added `meta/muse-spark-1.3`
 * (GOAT) plus its Contributor sibling (Go); command-code@1.52.0 added the
 * free `inclusionai/ling-3.0-flash-sante:free` (Go); command-code@1.53.0
-* added `deepseek/deepseek-v4.1-flash` (Go).
+* added `deepseek/deepseek-v4.1-flash` (Go); command-code@1.56.0 added
+* `Qwen/Qwen3.8-Omni-Flash` (Go); command-code@1.57.0 added
+* `z-ai/glm-5.3-flashx` (Go).
 *
 * The Provider API exposes no plan metadata, so this snapshot is the source of
 * truth for the picker's plan annotation — it answers "which plan do I need to
@@ -465,13 +481,14 @@ const KNOWN_PLANS = {
 	"Qwen/Qwen3.8-Flash": "go",
 	"Qwen/Qwen3.8-Max": "go",
 	"Qwen/Qwen3.8-Max-0902": "go",
+	"Qwen/Qwen3.8-Omni-Flash": "go",
 	"deepseek/deepseek-v4-flash-fast": "go",
 	"deepseek/deepseek-v4.1-flash": "go",
 	"deepseek/deepseek-v4-flash": "go",
 	"deepseek/deepseek-v4-flash-vision-exp": "go",
 	"deepseek/deepseek-v4-pro": "go",
 	"gpt-5.6-luna": "go",
-	"meituan/LongCat-2.0:free": "go",
+	"meituan/LongCat-2.0": "go",
 	"inclusionai/ling-3.0-flash-sante:free": "go",
 	"meta/muse-spark-1.2-contributor": "go",
 	"meta/muse-spark-1.3-contributor": "go",
@@ -492,6 +509,7 @@ const KNOWN_PLANS = {
 	"xiaomi/mimo-v2.5": "go",
 	"xiaomi/mimo-v2.5-pro": "go",
 	"z-ai/glm-5.3-flash": "go",
+	"z-ai/glm-5.3-flashx": "go",
 	"zai-org/GLM-5": "go",
 	"zai-org/GLM-5.1": "go",
 	"zai-org/GLM-5.2": "go",
@@ -652,6 +670,23 @@ function modelVisibleInPlan(modelId, access) {
 	if (weight === void 0) return true;
 	return weight <= access.tierWeight;
 }
+/**
+* Whether the picker lists `modelId` for a whole POOL of accounts: true when
+* at least one of them includes it. The picker's plan filter is asked this
+* rather than {@link modelVisibleInPlan} for a single account because the pool
+* — not any one account — is what serves a request: keying the list on
+* whichever account rotation happened to reach made models appear and vanish
+* as accounts rotated, and hid models the user's other accounts could run.
+*
+* An account whose facts are unknown counts as "may include it" (the same
+* fail-open rule `modelVisibleInPlan` applies one level down), and an empty
+* pool is "show everything": hiding a model somebody can run is the one
+* failure this filter must never cause.
+*/
+function modelVisibleForAnyAccount(modelId, accounts) {
+	if (accounts === void 0 || accounts.length === 0) return true;
+	return accounts.some((access) => modelVisibleInPlan(modelId, access));
+}
 const KNOWN_DEALS = {
 	"MiniMaxAI/MiniMax-M3": { label: "50% off" },
 	"xiaomi/mimo-v2.5-pro": { label: "99% off" },
@@ -660,10 +695,6 @@ const KNOWN_DEALS = {
 		label: "FREE",
 		free: true
 	},
-	"meituan/LongCat-2.0:free": {
-		label: "FREE",
-		free: true
-	},
 	"inclusionai/ling-3.0-flash-sante:free": {
 		label: "FREE",
 		free: true
@@ -1078,6 +1109,14 @@ const MODEL_PRICE_ROWS = [
 			.03
 		]
 	},
+	{
+		id: "glm-5.3-flashx",
+		rates: [
+			.37,
+			1.25,
+			.075
+		]
+	},
 	{
 		id: "gpt-5.3-codex",
 		rates: [
@@ -1290,6 +1329,14 @@ const MODEL_PRICE_ROWS = [
 			.3
 		]
 	},
+	{
+		id: "longcat-2.0",
+		rates: [
+			.3,
+			1.2,
+			.006
+		]
+	},
 	{
 		id: "mimo-v2.5",
 		rates: [
@@ -1507,6 +1554,14 @@ const MODEL_PRICE_ROWS = [
 			.25
 		]
 	},
+	{
+		id: "qwen-3.8-omni-flash",
+		rates: [
+			.15,
+			.47,
+			.016
+		]
+	},
 	{
 		id: "step-3.5-flash",
 		rates: [
@@ -1869,15 +1924,20 @@ function installCostProjection(ctx) {
 *     usable, the routed account — resolving each slot's key lazily (literal
 *     config key → credential seam → launch environment → the official CLI
 *     auth file for the default slot only).
-*   - {@link CommandCodeAccountPool.markRejected} records a 429 (rate limit,
-*     window unknown) or 401 (invalid key, disabled until the config changes)
-*     against the exact API key, so several slots sharing one key share one
-*     state.
+*   - {@link CommandCodeAccountPool.markRejected} records a 429 or 401 against
+*     the exact API key, so several slots sharing one key share one state. A
+*     429 that NAMED a usage window marks the window exhausted; a 429 that
+*     named none is recorded as a plain throttle, which rotates the same way
+*     but is never reported as an exhausted window (issue #54).
 *   - When every account is marked, the pool probes each key's
 *     `/alpha/billing/credits` window limits (through the injected
 *     {@link CommandCodeAccountPoolDeps.probeWindow}): an account whose window
 *     no longer reports `exceeded` is revived, otherwise the pool throws a
 *     `RATE_LIMIT` error naming the earliest reset time.
+*   - An account the user explicitly asked for — the manual pin
+*     ({@link CommandCodeAccountPoolDeps.preferredId}) or a model rule's
+*     routed account — is probed the same way when a mark would demote it, so
+*     a fallback is never permanent (issue #51).
 *
 * The pool is deliberately cordis-free (like the adapter): every host fact
 * arrives through injected thunks, so node tests can drive it directly.
@@ -1894,6 +1954,18 @@ function installCostProjection(ctx) {
 * window opens" into "fail now".
 */
 const RETRY_MAX_DELAY_MS = 9e5;
+/**
+* How long an explicitly selected account's rate-limit mark may stand before
+* its window is probed again. A 429 whose reset was never learned marks the
+* key `unknown`, which {@link accountUsable} refuses forever — deliberately,
+* because the all-marked revival pass is the only thing meant to clear it and
+* it costs one billing call per key. That is fine for a key nobody asked for,
+* and wrong for the one the user pinned: a single 429 would otherwise demote
+* the user's own selection until the process restarts (issue #51). The probe
+* is therefore allowed once per interval per key, which bounds an endpoint
+* that keeps failing while a successful probe resolves the mark for good.
+*/
+const EXPLICIT_ACCOUNT_PROBE_INTERVAL_MS = 6e4;
 /** A labeled, human-readable clock reading for error messages. */
 function clockLabel(ms) {
 	return new Date(ms).toLocaleString();
@@ -1951,6 +2023,8 @@ var CommandCodeAccountPool = class {
 	deps;
 	/** Rotation state by API key. */
 	states = /* @__PURE__ */ new Map();
+	/** Last explicit-revival probe attempt by API key (throttles a failing probe). */
+	explicitProbes = /* @__PURE__ */ new Map();
 	constructor(deps) {
 		this.deps = deps;
 	}
@@ -2005,22 +2079,40 @@ var CommandCodeAccountPool = class {
 	* `options.model` is the request's model id; routing rules re-read per
 	* resolution, so a settings change applies live.
 	*
-	* `options.exclude` skips one key during the probe-revival pass: the
-	* rotation hook excludes the just-rejected key so a probe that clears its
-	* window cannot re-offer the same key within the same request (the adapter
-	* refuses already-tried keys; the next request picks the revived key up).
+	* `options.tried` lists the keys this request has already used — the
+	* just-rejected one included. They are removed from the resolution entirely,
+	* which is what lets one request walk a four-account pool: an account-scoped
+	* rejection that does not mark the key (no credits, a model outside the
+	* account's plan) would otherwise be offered again on every attempt, and the
+	* accounts behind it would never be reached.
+	*
+	* An explicit selection (the pin or a model rule) that a rate-limit mark
+	* would demote is probed before the fallback serves, so "falls back while
+	* exhausted" never becomes "stays demoted until the process restarts".
 	*/
 	async resolveKey(options) {
 		const accounts = await this.resolvedAccounts();
 		if (accounts.length === 0) return;
-		const routed = selectAccountForModel(accounts, options?.model ?? "", this.deps.modelAccountRules?.());
-		if (routed !== void 0) return this.pick(routed);
+		const tried = options?.tried;
+		const available = tried === void 0 || tried.length === 0 ? accounts : accounts.filter((account) => !tried.includes(account.key));
 		const preferred = this.deps.preferredId?.();
-		const chosen = selectActiveAccount(accounts, preferred);
-		if (chosen !== void 0) return this.pick(chosen);
-		await Promise.all(accounts.map(async (account) => {
+		if (available.length === 0) {
+			if (selectActiveAccount(accounts, preferred) !== void 0) return void 0;
+			throw allAccountsUnusable(accounts);
+		}
+		const routed = selectAccountForModel(available, options?.model ?? "", this.deps.modelAccountRules?.());
+		if (routed !== void 0) return this.pick(routed);
+		const chosen = selectActiveAccount(available, preferred);
+		if (chosen !== void 0) {
+			const explicit = this.explicitAccount(available, options?.model ?? "", preferred);
+			if (explicit !== void 0 && explicit.key !== chosen.key && this.canProbeExplicit(explicit)) {
+				const revived = await this.probeExplicit(explicit);
+				if (revived !== void 0) return this.pick(revived);
+			}
+			return this.pick(chosen);
+		}
+		await Promise.all(available.map(async (account) => {
 			if (account.state?.kind === "disabled") return;
-			if (options?.exclude !== void 0 && account.key === options.exclude) return;
 			let probe;
 			try {
 				probe = await this.deps.probeWindow(account.key);
@@ -2028,39 +2120,71 @@ var CommandCodeAccountPool = class {
 				return;
 			}
 			if (probe === void 0) return;
-			if (!probe.exceeded) this.states.delete(account.key);
-			else this.states.set(account.key, {
+			if (!probe.exceeded) {
+				this.states.delete(account.key);
+				return;
+			}
+			if (probe.resetAt > 0) this.states.set(account.key, {
 				kind: "cooldown",
-				reason: account.state?.reason ?? "rate limited (429)",
+				cause: "window",
+				reason: account.state?.reason ?? "usage window exhausted (429)",
 				until: probe.resetAt
 			});
+			else if (account.state?.kind !== "cooldown") this.states.set(account.key, {
+				kind: "unknown",
+				cause: "window",
+				reason: account.state?.reason ?? "usage window exhausted (429)",
+				until: 0
+			});
 		}));
-		const latest = await this.resolvedAccounts();
-		const revived = selectActiveAccount(latest, preferred);
+		const latestAccounts = await this.resolvedAccounts();
+		const revived = selectActiveAccount(tried === void 0 || tried.length === 0 ? latestAccounts : latestAccounts.filter((account) => !tried.includes(account.key)), preferred);
 		if (revived !== void 0) return this.pick(revived);
-		if (latest.filter((account) => account.state?.kind === "disabled").length === latest.length) throw new LlmError(`llm-commandcode: every configured Command Code account (${latest.length}) was rejected with 401 — check the stored API keys (Models page / settings) or the auth file；已配置的 ${latest.length} 个 Command Code 账户密钥均被拒绝（401）——请在设置页检查存储的 API 密钥，或重新运行 command-code login`, "INVALID_CREDENTIAL");
-		const resets = latest.map((account) => account.state).filter((state) => state !== void 0 && state.kind === "cooldown" && state.until > 0).map((state) => state.until);
-		const earliest = resets.length > 0 ? Math.min(...resets) : 0;
-		const wait = earliest > 0 ? Math.max(1e3, earliest - Date.now()) : 0;
-		throw new LlmError(`llm-commandcode: all ${latest.length} Command Code account(s) have exhausted their usage window` + (earliest > 0 ? `; the earliest window resets at ${clockLabel(earliest)}` : "") + ` — requests will succeed again after the reset (or add another account)；已用尽全部 ${latest.length} 个 Command Code 账户的用量窗口` + (earliest > 0 ? `，最早的重置时间为 ${clockLabel(earliest)}` : "") + "——窗口重置后请求会自动恢复（也可以添加更多账户）", "RATE_LIMIT", wait > 0 && wait <= 9e5 ? { providerRetryAfterMs: wait } : void 0);
+		if (selectActiveAccount(latestAccounts, preferred) !== void 0) return void 0;
+		throw allAccountsUnusable(latestAccounts.length > 0 ? latestAccounts : accounts);
 	}
 	/**
-	* Record a rejection against one key. `rate-limit` (429) marks the key
-	* exhausted with an unknown reset (probed lazily at the next resolution
-	* once every account is marked); `invalid-credential` (401) disables the
-	* key until the stored credential changes.
+	* Record a rejection against one key. `rate-limit` marks the key's usage
+	* WINDOW exhausted — as a `cooldown` until `resetAtMs` when the rejection
+	* body named the provider's own reset time, otherwise as an `unknown` mark
+	* whose window is probed lazily. `throttled` (the plain 429 that named no
+	* window) marks the key with the `throttle` cause instead: it leaves rotation
+	* exactly like a window mark does, but the pool's own diagnosis keeps saying
+	* "rate limited" rather than inventing an exhausted window. A 401
+	* (`invalid-credential`) disables the key until the stored credential
+	* changes.
+	*
+	* `resetAtMs` is seconds-to-millis converted by the adapter from the
+	* provider's `error.rateLimit.reset`: knowing the real reset immediately is
+	* what keeps an exhausted account out of rotation for exactly as long as the
+	* provider said. It only applies to a window mark; a plain throttle keeps the
+	* window unknown on purpose, so a probe can still find out.
 	*/
-	markRejected(apiKey, rejection) {
+	markRejected(apiKey, rejection, resetAtMs) {
 		if (rejection === "invalid-credential") this.states.set(apiKey, {
 			kind: "disabled",
+			cause: "auth",
 			reason: "invalid API key (401)",
 			until: 0
 		});
-		else this.states.set(apiKey, {
+		else if (rejection === "throttled") this.states.set(apiKey, {
 			kind: "unknown",
+			cause: "throttle",
 			reason: "rate limited (429)",
 			until: 0
 		});
+		else if (resetAtMs !== void 0 && resetAtMs > Date.now()) this.states.set(apiKey, {
+			kind: "cooldown",
+			cause: "window",
+			reason: "usage window exhausted (429)",
+			until: resetAtMs
+		});
+		else this.states.set(apiKey, {
+			kind: "unknown",
+			cause: "window",
+			reason: "usage window exhausted (429)",
+			until: 0
+		});
 	}
 	/**
 	* One account's key: literal → credential seam → auth file (default slot).
@@ -2096,6 +2220,74 @@ var CommandCodeAccountPool = class {
 			}
 		}
 	}
+	/**
+	* The account the user explicitly asked for: the slot a model rule routes
+	* the request to when that id exists among the resolved slots, else the
+	* manually pinned slot. Consulted only on the fallback path — a usable
+	* routed account already returned above — so unlike
+	* {@link selectAccountForModel} it does NOT require the account to be
+	* usable, which is exactly what {@link resolveKey} re-probes.
+	*/
+	explicitAccount(accounts, model, preferredId) {
+		const rule = matchModelRule(model, this.deps.modelAccountRules?.());
+		const id = rule !== void 0 && accounts.some((account) => account.slot.id === rule.account) ? rule.account : preferredId;
+		return id === void 0 ? void 0 : accounts.find((account) => account.slot.id === id);
+	}
+	/**
+	* Whether an explicitly selected account's mark is due for a window probe.
+	* Only an `unknown` mark (a 429 whose reset was never learned) is worth
+	* re-probing: a `cooldown` already carries its reset time and expires by
+	* itself, and a `disabled` (401) key stays out until the stored credential
+	* changes. The interval bounds a probe endpoint that keeps failing.
+	*/
+	canProbeExplicit(account) {
+		if (account.state?.kind !== "unknown") return false;
+		const last = this.explicitProbes.get(account.key);
+		return last === void 0 || this.now() - last >= EXPLICIT_ACCOUNT_PROBE_INTERVAL_MS;
+	}
+	/** The clock the probe throttle reads; injected so a test can travel in time. */
+	now() {
+		return this.deps.now?.() ?? Date.now();
+	}
+	/**
+	* Probe one explicitly selected account's window and apply the answer. A
+	* window that is no longer exceeded drops the mark, so the user's own
+	* selection serves again on this very request. An exceeded one is stamped
+	* as a cooldown carrying the provider's reset time, after which
+	* {@link accountUsable} lets the account back in with no further probe. A
+	* probe that fails changes nothing: the mark stays `unknown` and the next
+	* attempt waits out the interval.
+	*/
+	async probeExplicit(account) {
+		this.explicitProbes.set(account.key, this.now());
+		let probe;
+		try {
+			probe = await this.deps.probeWindow(account.key);
+		} catch {
+			return;
+		}
+		if (probe === void 0) return void 0;
+		if (!probe.exceeded) {
+			this.states.delete(account.key);
+			return {
+				slot: account.slot,
+				key: account.key,
+				state: void 0
+			};
+		}
+		if (probe.resetAt > 0) this.states.set(account.key, {
+			kind: "cooldown",
+			cause: "window",
+			reason: account.state?.reason ?? "usage window exhausted (429)",
+			until: probe.resetAt
+		});
+		else if (account.state?.kind !== "cooldown") this.states.set(account.key, {
+			kind: "unknown",
+			cause: "window",
+			reason: account.state?.reason ?? "usage window exhausted (429)",
+			until: 0
+		});
+	}
 	/** Hand out the chosen account's key. */
 	pick(account) {
 		return {
@@ -2105,6 +2297,41 @@ var CommandCodeAccountPool = class {
 	}
 };
 /**
+* The error for "accounts exist but none of them can serve". Three shapes, each
+* claiming only what the pool actually knows:
+*
+*   - every account rejected with 401 → `INVALID_CREDENTIAL`;
+*   - at least one account marked by a NAMED usage window (or by a probe that
+*     read a window as exceeded) → the window diagnosis, naming the earliest
+*     known reset when the provider published one;
+*   - every mark a plain throttle (a 429 that said nothing about a window, and
+*     no probe could confirm one) → a throttle diagnosis that says so. Claiming
+*     "all accounts have exhausted their usage window" here is issue #54: the
+*     report's account panel showed the five-hour window at 2% and the weekly
+*     one at 10% while the turn failed with exactly that sentence.
+*
+* Shared by the all-marked tail of {@link CommandCodeAccountPool.resolveKey}
+* and by its already-tried diagnosis, so the two can never drift apart.
+*
+* The attached `providerRetryAfterMs` is the exact wait until the earliest
+* known window reset, so dsh-llm-retry sleeps through the window instead of
+* polling at its backoff cadence. It is capped at {@link RETRY_MAX_DELAY_MS}:
+* the executor honors a provider wait verbatim only at or below the policy's
+* `maxDelayMs` — a LONGER attached wait makes it abandon the retry entirely
+* (normal mode), which would turn "poll until the window opens" into "fail
+* now". Longer resets simply ride the capped local backoff and the probe
+* revival. A throttle diagnosis attaches none: its marks carry no reset.
+*/
+function allAccountsUnusable(accounts) {
+	if (accounts.filter((account) => account.state?.kind === "disabled").length === accounts.length) return new LlmError(`llm-commandcode: every configured Command Code account (${accounts.length}) was rejected with 401 — check the stored API keys (Models page / settings) or the auth file；已配置的 ${accounts.length} 个 Command Code 账户密钥均被拒绝（401）——请在设置页检查存储的 API 密钥，或重新运行 command-code login`, "INVALID_CREDENTIAL");
+	const windowMarked = accounts.map((account) => account.state).filter((state) => state !== void 0).filter((state) => state.cause === "window");
+	if (windowMarked.length === 0) return new LlmError(`llm-commandcode: all ${accounts.length} Command Code account(s) are rate limited (429) — the provider did not report an exhausted usage window; retrying；全部 ${accounts.length} 个 Command Code 账户被限流（429）——服务商未报告用量窗口用尽，正在重试`, "RATE_LIMIT");
+	const resets = windowMarked.filter((state) => state.kind === "cooldown" && state.until > 0).map((state) => state.until);
+	const earliest = resets.length > 0 ? Math.min(...resets) : 0;
+	const wait = earliest > 0 ? Math.max(1e3, earliest - Date.now()) : 0;
+	return new LlmError(`llm-commandcode: all ${accounts.length} Command Code account(s) have exhausted their usage window` + (earliest > 0 ? `; the earliest window resets at ${clockLabel(earliest)}` : " — the provider published no reset time for it") + ` — requests will succeed again after the reset (or add another account)；已用尽全部 ${accounts.length} 个 Command Code 账户的用量窗口` + (earliest > 0 ? `，最早的重置时间为 ${clockLabel(earliest)}` : "，服务商未公布重置时间") + "——窗口重置后请求会自动恢复（也可以添加更多账户）", "RATE_LIMIT", wait > 0 && wait <= 9e5 ? { providerRetryAfterMs: wait } : void 0);
+}
+/**
 * Normalize one resolved credential to the form every consumer sees. Trim
 * only: a blank-after-trim value means "no key" (the slot is omitted and the
 * caller reports `MISSING_CREDENTIAL`), while characters an HTTP header cannot
@@ -2353,7 +2580,7 @@ function scaleBy(size, factor) {
 * and API key or subscription, and Command Code's terms apply.
 *
 * Wire protocol (reverse-engineered by the pi plugin, command-code@1.28.4;
-* re-verified against command-code@1.54.0 — endpoints, request shape, and
+* re-verified against command-code@1.58.0 — endpoints, request shape, and
 * stream events unchanged):
 *   POST {apiBase}/alpha/generate
 *   body: { config, memory, taste, skills, params: { model, messages, tools,
@@ -2366,7 +2593,7 @@ function scaleBy(size, factor) {
 * per-request options thunk and an API-key resolver from the plugin entry
 * (src/index.ts), so a settings change reaches the very next request.
 */
-const COMMAND_CODE_CLI_VERSION = "1.54.0";
+const COMMAND_CODE_CLI_VERSION = "1.58.0";
 const DEFAULT_API_BASE = "https://api.commandcode.ai";
 const DEFAULT_GENERATE_MAX_TOKENS = 64e3;
 const DEFAULT_MAX_OUTPUT_TOKENS = 65536;
@@ -2404,15 +2631,22 @@ function booleanValue(value) {
 	return typeof value === "boolean" ? value : void 0;
 }
 /**
-* Thinking text carried by an OpenRouter-shaped `reasoning_details` array
-* (`[{ type: 'reasoning.text', text, format, index }]`), concatenated in the
-* order the gateway sent it.
+* Thinking text carried by an OpenRouter-shaped `reasoning_details` array,
+* concatenated in the order the gateway sent it.
+*
+* Entries are read by their own text members rather than filtered on `type`:
+* DeepSeek sends `{ type: 'reasoning.text', text }` while the OpenAI family
+* sends `{ type: 'reasoning.summary', summary, format: 'openai-responses-v1' }`
+* — the same summary text the scalar `delta.reasoning` carries, in the
+* Responses protocol's vocabulary. A `type` filter would drop one family or the
+* other, and losing thinking is the failure this exists to prevent.
+*
+* `text` wins per entry, but an EMPTY `text` must not shadow a populated
+* `summary` (the Responses wire emits `text: ''` placeholders), so the fallback
+* tests for non-empty rather than merely present. Entries carrying neither
+* member — the encrypted blobs — contribute nothing, and no entry contributes
+* both, so a summary is never counted twice.
 *
-* Entries are read by their `text` member alone rather than filtered on
-* `type === 'reasoning.text'`: the sibling shapes in that protocol carry
-* `summary` or an encrypted blob instead of `text`, so a plain read already
-* ignores them, while a type filter would silently drop a text-bearing variant
-* added later — and losing thinking is the failure this exists to prevent.
 * Returns undefined when the array yields nothing, so the caller's `??` chain
 * keeps falling through instead of treating "no text" as a reasoning delta.
 */
@@ -2421,10 +2655,24 @@ function reasoningDetailsText(value) {
 	let text = "";
 	for (const entry of value) {
 		if (!isRecord(entry)) continue;
-		text += stringValue(entry.text) ?? "";
+		const exact = stringValue(entry.text);
+		const summary = stringValue(entry.summary);
+		text += exact !== void 0 && exact !== "" ? exact : summary ?? "";
 	}
 	return text === "" ? void 0 : text;
 }
+/**
+* One SCALAR thinking delta, treating an empty string as "this chunk carries
+* none" — the same rule {@link reasoningDetailsText} applies inside the array.
+* The scalar and the array describe the same thinking, so an empty spelling of
+* one must not shadow populated text in the other (the Responses wire pads with
+* `text: ''`). `??` alone cannot express this: an empty string is not nullish,
+* so `reasoning: ''` beside a populated `reasoning_details` used to drop the
+* whole chunk's thinking.
+*/
+function nonEmptyText(value) {
+	return value === void 0 || value === "" ? void 0 : value;
+}
 /** Parse a billing-period timestamp (ISO string or millis) into millis; 0 when absent/invalid. */
 function periodEndValue(value) {
 	const asNumber = numberValue(value);
@@ -3674,11 +3922,11 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			};
 		};
 		if (opts?.unfiltered === true) return catalog.map(toInfo).sort(compareByPlan);
-		const access = this.deps.options().filterModelsByPlan === false ? void 0 : await this.loadBillingAccess();
+		const accesses = this.deps.options().filterModelsByPlan === false ? void 0 : await this.loadPoolBillingAccess();
 		const visible = this.deps.options().visibleModels;
 		const allow = Array.isArray(visible) && visible.length > 0 ? new Set(visible.filter((id) => typeof id === "string" && id !== "")) : void 0;
 		const overrides = this.deps.options().modelVisibility;
-		return catalog.filter((model) => modelVisibleInPlan(model.id, access)).filter((model) => {
+		return catalog.filter((model) => modelVisibleForAnyAccount(model.id, accesses)).filter((model) => {
 			const override = overrides?.[model.id];
 			if (typeof override === "boolean") return override;
 			return allow === void 0 || allow.has(model.id);
@@ -3734,17 +3982,44 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		};
 	}
 	/**
-	* The billing facts behind the picker's plan filter, cached for
-	* {@link BILLING_ACCESS_TTL_MS} and shared across concurrent callers.
-	* `undefined` means "unknown — show everything" (fail-open).
+	* Every account's billing facts behind the picker's plan filter, in the
+	* pool's rotation order and cached per key for {@link BILLING_ACCESS_TTL_MS}
+	* (so the extra accounts cost their three requests once per TTL, not once
+	* per picker load). `undefined` means the filter cannot be evaluated at all
+	* — no key resolved — which {@link modelVisibleForAnyAccount} reads as
+	* "show everything".
+	*
+	* The serving account is only the first entry: with several accounts the
+	* model list must not depend on which of them rotation happens to be using.
 	*/
-	async loadBillingAccess() {
-		let apiKey;
+	async loadPoolBillingAccess() {
+		const keys = await this.poolAccountKeys();
+		if (keys.length === 0) return void 0;
+		return Promise.all(keys.map((key) => this.loadBillingAccessForKey(key)));
+	}
+	/**
+	* The API keys the picker's plan filter must consult: every account the host
+	* can serve from, in rotation order, when the host exposes one. A host
+	* without a pool (or without the seam) reports just the key that would serve
+	* this request — exactly the pre-pool behaviour.
+	*/
+	async poolAccountKeys() {
+		try {
+			const usable = (await this.deps.resolveAccountKeys?.() ?? []).filter((key) => typeof key === "string" && key !== "");
+			if (usable.length > 0) return usable;
+		} catch {}
 		try {
-			apiKey = await this.deps.resolveApiKey(this.deps.options());
+			return [await this.deps.resolveApiKey(this.deps.options())];
 		} catch {
-			return;
+			return [];
 		}
+	}
+	/**
+	* One account's billing facts, cached for {@link BILLING_ACCESS_TTL_MS} and
+	* shared across concurrent callers. `undefined` means "unknown — show
+	* everything" (fail-open).
+	*/
+	async loadBillingAccessForKey(apiKey) {
 		const cached = this.billingAccess.get(apiKey);
 		if (cached !== void 0 && Date.now() - cached.at < 3e5) return cached.value;
 		const existing = this.billingAccessInflight.get(apiKey);
@@ -3906,14 +4181,29 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		return report;
 	}
 	/**
-	* Probe one account's five-hour window from `/alpha/billing/credits`. The
+	* Probe one account's real usage windows from `/alpha/billing/credits`. The
 	* multi-account pool calls this when every account is marked exhausted: an
-	* account whose window no longer reports `exceeded` is revived, and the
-	* `resetAt` values feed the "earliest reset" error message. Returns
-	* `undefined` when the probe itself failed (transport, non-200, or a
-	* payload without window limits) — a failed probe never changes pool state.
+	* account whose windows no longer report `exceeded` is revived, and the
+	* `resetAt` values feed the "earliest reset" error message.
+	*
+	* BOTH windows the endpoint publishes are read, not just `fiveHour`. An
+	* account can have an open five-hour window and an exhausted WEEKLY quota at
+	* the same time (the two are metered separately), and reading only the
+	* shorter one revived such an account as "usable" — the pool then handed it
+	* out, the provider rejected the request again, and the next all-marked pass
+	* revived it once more, so a used-up account kept coming back (issue #51's
+	* follow-up: "切到一个不可用账号"). `exceeded` is therefore true when ANY
+	* published window is exceeded, and `resetAt` is the LATEST reset among the
+	* exceeded ones — the binding constraint, because a clear five-hour window
+	* buys nothing while the weekly quota is spent.
+	*
+	* Returns `undefined` when the probe itself failed (transport, non-200, or a
+	* payload with no window limits at all) — a failed probe never changes pool
+	* state. The monthly/purchased/free credit balances are deliberately NOT part
+	* of this answer: they are balances rather than windows, they carry no reset
+	* time, and the server remains the final gate on them.
 	*/
-	async probeFiveHourWindow(apiKey) {
+	async probeWindowLimits(apiKey) {
 		try {
 			const connection = this.deps.options();
 			const response = await this.fetchImpl(`${connection.apiBase}/alpha/billing/credits`, {
@@ -3924,11 +4214,22 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			const parsed = await response.json();
 			if (!isRecord(parsed)) return void 0;
 			const windowLimits = isRecord(parsed.windowLimits) ? parsed.windowLimits : void 0;
-			const fiveHour = windowLimits && isRecord(windowLimits.fiveHour) ? windowLimits.fiveHour : void 0;
-			if (fiveHour === void 0) return void 0;
+			if (windowLimits === void 0) return void 0;
+			let reported = false;
+			let exceeded = false;
+			let resetAt = 0;
+			for (const raw of [windowLimits.fiveHour, windowLimits.weekly]) {
+				const window = isRecord(raw) ? parseWindowLimit(raw) : void 0;
+				if (window === void 0) continue;
+				reported = true;
+				if (!window.exceeded) continue;
+				exceeded = true;
+				resetAt = Math.max(resetAt, window.resetAt);
+			}
+			if (!reported) return void 0;
 			return {
-				exceeded: fiveHour.exceeded === true,
-				resetAt: numberValue(fiveHour.resetAt) ?? 0
+				exceeded,
+				resetAt: exceeded ? resetAt : 0
 			};
 		} catch {
 			return;
@@ -4002,13 +4303,24 @@ var CommandCodeAdapter = class extends LlmAdapter {
 				}
 			}
 			const rotate = this.deps.rotateApiKey;
-			if ((attempt.status === 429 || attempt.status === 401) && rotate !== void 0 && options.signal?.aborted !== true && tried.size < MAX_ACCOUNT_ROTATIONS) {
-				const next = await rotate(apiKey, attempt.status === 429 ? "rate-limit" : "invalid-credential", connection, options.model);
+			const rejection = classifyAccountRejection(attempt.status, attempt.errText);
+			if (rejection !== void 0 && rotate !== void 0 && options.signal?.aborted !== true && tried.size < MAX_ACCOUNT_ROTATIONS) {
+				const next = await rotate(apiKey, rejection.reason, connection, options.model, {
+					tried: [...tried],
+					...rejection.resetAtMs !== void 0 && { resetAtMs: rejection.resetAtMs }
+				});
 				if (next !== void 0 && !tried.has(next)) {
 					apiKey = next;
 					continue;
 				}
 			}
+			if (rejection !== void 0 && (rejection.reason === "rate-limit" || rejection.reason === "throttled") && (rejection.resetAtMs !== void 0 || attempt.status !== 429)) {
+				const reset = rejection.resetAtMs;
+				const wait = reset === void 0 ? 0 : Math.min(Math.max(1e3, reset - Date.now()), RETRY_MAX_DELAY_MS);
+				const when = reset === void 0 ? void 0 : new Date(reset).toISOString();
+				const window = rejection.reason === "rate-limit";
+				throw new LlmError((window ? "llm-commandcode: the Command Code account is rate limited" : "llm-commandcode: the Command Code account is rate limited (429) — the provider did not report an exhausted usage window") + (when === void 0 ? "" : ` — the provider reports it resets at ${when}`) + (window ? "；当前 Command Code 账户已被限流" : "；当前 Command Code 账户被限流（429），服务商未报告用量窗口用尽") + (when === void 0 ? "" : `，服务商给出的重置时间为 ${when}`), "RATE_LIMIT", wait > 0 ? { providerRetryAfterMs: wait } : void 0);
+			}
 			throw generateHttpError(attempt.status, attempt.errText, attempt.retryAfterMs);
 		}
 		if (connected === void 0) throw new LlmError("Command Code API connection failed without a response", "TRANSPORT");
@@ -4284,7 +4596,7 @@ function handleOpenAIEvent(asm, event) {
 	}
 	const choice = isRecord(choices[0]) ? choices[0] : {};
 	const delta = isRecord(choice.delta) ? choice.delta : {};
-	const reasoningDelta = stringValue(delta.reasoning) ?? stringValue(delta.reasoning_content) ?? reasoningDetailsText(delta.reasoning_details) ?? "";
+	const reasoningDelta = nonEmptyText(stringValue(delta.reasoning)) ?? nonEmptyText(stringValue(delta.reasoning_content)) ?? reasoningDetailsText(delta.reasoning_details) ?? "";
 	if (reasoningDelta !== "") {
 		chunks.push(...closeText(asm));
 		if (asm.reasoningIndex < 0) {
@@ -4400,6 +4712,112 @@ function mapFinishReason(reason) {
 * back to the CLI /alpha/generate transport; other 4xx/5xx must surface as
 * ordinary errors so real account/model problems are not masked.
 */
+/**
+* Classify a pre-stream rejection that is about the ACCOUNT rather than about
+* the request, using the official CLI's own rules (command-code@1.56.0:
+* `parseWindowLimitError`, `isInsufficientCreditsRequestError`,
+* `parseSpendCapError` and the terminal-marker list
+* `["premium_credits_exhausted", "model_not_in_plan", "insufficient credits"]`).
+* Undefined means "not an account-scoped rejection": a malformed request, an
+* oversized body or a context overflow must fail fast instead of walking the
+* whole account pool.
+*
+* Issue #51's follow-up is why this exists. Only 429/401 used to rotate, so
+* every other account-scoped rejection was terminal AND invisible to the pool:
+* an account that could not pay, or could not run the model, stayed "usable",
+* was handed out again on the next request, and produced the same error again
+* ("切到一个不可用账号后就报 400，还挺频繁"). The three reasons differ in what
+* the host should do with them, which is the caller's decision, not this
+* function's:
+*
+*   - `rate-limit`: a usage WINDOW is spent. The code `RATE_LIMITED` is the
+*     authoritative signal — the CLI accepts the code OR a 429 status — and the
+*     body's `error.rateLimit` names the window and its `reset` (in seconds),
+*     so the host can hold the account out until the provider's own reset time.
+*   - `throttled`: the provider refused the request (429 or a bare
+*     `RATE_LIMITED` code) without naming a usage window. It is account-scoped
+*     like the above, so it rotates and marks the key the same way, but it is
+*     NOT evidence that a metered window is spent: the CLI's own
+*     `parseWindowLimitError` returns a window limit only when
+*     `resolveWindowLabel` can name one, and a burst/model/spend limiter the
+*     billing endpoint cannot see is exactly this shape (issue #54's report: a
+*     429 whose probe read five-hour 2% and weekly 10% while the error claimed
+*     both were exhausted).
+*   - `invalid-credential`: 401; the key itself is bad.
+*   - `unavailable`: the key is fine but this account cannot serve: no credits
+*     (`400 Insufficient credits`, the codes `INSUFFICIENT_CREDITS`,
+*     `USAGE_EXCEEDED`, `PREMIUM_CREDITS_EXHAUSTED`, or a spend-cap wording)
+*     or a model outside its plan (`MODEL_NOT_IN_PLAN`). Rotating must NOT mark
+*     the account: the fact is about the model or the balance, it can change
+*     without the key changing, and a `:free` model can still be served by an
+*     account with an empty balance.
+*/
+function classifyAccountRejection(status, errText) {
+	if (status === 429 || readProviderErrorCode(errText)?.toUpperCase() === "RATE_LIMITED") {
+		const evidence = readWindowLimitEvidence(errText);
+		if (evidence.window === void 0) return { reason: "throttled" };
+		return evidence.resetAtMs === void 0 ? { reason: "rate-limit" } : {
+			reason: "rate-limit",
+			resetAtMs: evidence.resetAtMs
+		};
+	}
+	if (status === 401) return { reason: "invalid-credential" };
+	if (status < 400 || status >= 500) return void 0;
+	const lower = errText.toLowerCase().replaceAll("_", " ");
+	const code = readProviderErrorCode(errText)?.toUpperCase();
+	if (code === "USAGE_EXCEEDED" || code === "INSUFFICIENT_CREDITS" || code === "PREMIUM_CREDITS_EXHAUSTED" || code === "MODEL_NOT_IN_PLAN" || lower.includes("insufficient credits") || lower.includes("premium credits exhausted") || lower.includes("model not in plan") || /insufficient (credit|balance)/.test(lower) || /out of credit/.test(lower) || /not (available|included)[^.]{0,40}plan/.test(lower) || lower.includes("upgrade your plan")) return { reason: "unavailable" };
+}
+/** The machine-readable `error.code`/`error.type` of a pre-stream failure body. */
+function readProviderErrorCode(errText) {
+	try {
+		const parsed = JSON.parse(errText);
+		if (!isRecord(parsed)) return void 0;
+		const error = isRecord(parsed.error) ? parsed.error : parsed;
+		return stringValue(error.code) ?? stringValue(error.type);
+	} catch {
+		return;
+	}
+}
+/**
+* The usage-window evidence carried by a rejected request, mirroring the CLI's
+* `parseWindowLimitError` → `resolveWindowLabel`/`extractResetAtMs` pair.
+*
+* `window` is present only when the body actually names one: a
+* `error.rateLimit.window` of `fiveHour`/`weekly`/`daily`, or the
+* "usage limit for your plan" wording (read as `weekly` when it says so, else
+* `fiveHour`). That is the CLI's own bar for calling a rejection a WINDOW
+* limit, and it is what keeps a bare 429 — a burst limiter, a model-level
+* limit, a spend cap `windowLimits` cannot show — from being reported as an
+* exhausted window (issue #54).
+*
+* `resetAtMs` is the reset the body publishes: `error.rateLimit.reset` is
+* SECONDS (`1e3 * reset`, like the CLI), and a `resets at <ISO>` stamp in the
+* message is honored as the fallback. Either can be present without the other;
+* the window label is what decides the classification.
+*/
+function readWindowLimitEvidence(errText) {
+	let named;
+	let message = "";
+	let seconds;
+	try {
+		const parsed = JSON.parse(errText);
+		if (isRecord(parsed)) {
+			const error = isRecord(parsed.error) ? parsed.error : parsed;
+			const rateLimit = isRecord(error.rateLimit) ? error.rateLimit : void 0;
+			named = stringValue(rateLimit?.window);
+			message = stringValue(error.message) ?? stringValue(parsed.message) ?? "";
+			seconds = numberValue(rateLimit?.reset);
+		}
+	} catch {}
+	const window = named === "fiveHour" || named === "weekly" || named === "daily" ? named : /usage limit for your plan/i.test(message) || /usage limit for your plan/i.test(errText) ? /weekly/i.test(message) ? "weekly" : "fiveHour" : void 0;
+	const stamp = /resets at (\d{4}-\d{2}-\d{2}T[\d:.]+Z)/i.exec(message)?.[1] ?? /resets at (\d{4}-\d{2}-\d{2}T[\d:.]+Z)/i.exec(errText)?.[1];
+	const stamped = stamp === void 0 ? void 0 : Date.parse(stamp);
+	const resetAtMs = seconds !== void 0 && seconds > 0 ? Math.round(seconds * 1e3) : stamped !== void 0 && !Number.isNaN(stamped) ? stamped : void 0;
+	return {
+		...window === void 0 ? {} : { window },
+		...resetAtMs === void 0 ? {} : { resetAtMs }
+	};
+}
 function isUpgradeRequiredError(status, errText) {
 	if (status !== 403) return false;
 	const lower = errText.toLowerCase();
@@ -6335,7 +6753,7 @@ function apply(ctx, config) {
 		slots,
 		resolveRef,
 		authFileKey: resolveAuthFileApiKey,
-		probeWindow: (apiKey) => adapter.probeFiveHourWindow(apiKey),
+		probeWindow: (apiKey) => adapter.probeWindowLimits(apiKey),
 		preferredId,
 		modelAccountRules: () => current().modelAccountRules ?? []
 	});
@@ -6348,10 +6766,11 @@ function apply(ctx, config) {
 	const adapter = new CommandCodeAdapter({
 		options,
 		resolveApiKey,
-		rotateApiKey: async (rejectedKey, rejection, _connection, model) => {
-			pool.markRejected(rejectedKey, rejection);
-			const resolved = await pool.resolveKey(model === void 0 ? { exclude: rejectedKey } : {
-				exclude: rejectedKey,
+		rotateApiKey: async (rejectedKey, rejection, _connection, model, rotation) => {
+			if (rejection !== "unavailable") pool.markRejected(rejectedKey, rejection, rotation?.resetAtMs);
+			const tried = rotation?.tried?.length ? rotation.tried : [rejectedKey];
+			const resolved = await pool.resolveKey(model === void 0 ? { tried } : {
+				tried,
 				model
 			});
 			return resolved === void 0 ? void 0 : assertUsableApiKey(resolved.key, "llm-commandcode", resolved.slot.ref ?? `${resolved.slot.label} (config.apiKey)`);
@@ -6359,6 +6778,9 @@ function apply(ctx, config) {
 		resolveAttachments: () => {
 			const attachments = ctx.get("attachments");
 			return attachments === void 0 ? void 0 : attachments;
+		},
+		resolveAccountKeys: async () => {
+			return (await pool.resolvedAccounts()).map((account) => account.key);
 		}
 	});
 	ctx.llm.registerConfigurableProviders([{