@mars-sea/dsh-commandcode-provider 0.4.2 → 0.6.0

package/lib/index.js

@@ -18,7 +18,7 @@ import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 * community-maintained integration; you need your own Command Code account
 * and API key or subscription, and Command Code's terms apply.
 *
-* Wire protocol (reverse-engineered by the pi plugin, command-code@1.27.1):
+* Wire protocol (reverse-engineered by the pi plugin, command-code@1.28.4):
 *   POST {apiBase}/alpha/generate
 *   body: { config, memory, taste, skills, params: { model, messages, tools,
 *          system, max_tokens, temperature, stream, reasoning_effort? }, threadId }
@@ -36,6 +36,11 @@ const KNOWN_EFFORTS = {
 		"medium",
 		"xhigh"
 	],
+	"Qwen/Qwen3.8-27B": [
+		"low",
+		"medium",
+		"xhigh"
+	],
 	"claude-fable-5": [
 		"low",
 		"medium",
@@ -188,6 +193,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"Qwen/Qwen3.6-Plus",
 	"Qwen/Qwen3.7-Flash",
 	"Qwen/Qwen3.7-Plus",
+	"Qwen/Qwen3.8-27B",
 	"Qwen/Qwen3.8-Max",
 	"claude-fable-5",
 	"claude-haiku-4-5-20251001",
@@ -224,7 +230,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"xiaomi/mimo-v2.5"
 ]);
 /**
-* Models the official CLI's model table (`ZA` in command-code@1.27.1) marks
+* Models the official CLI's model table (`ZA` in command-code@1.28.4) marks
 * `reasoning:!0` but defines no selectable `reasoning_effort` levels — they
 * think automatically, with Command Code driving the depth. This is the
 * authoritative "thinks, effort not adjustable" set: `KNOWN_EFFORTS` (which
@@ -232,7 +238,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 * effort levels, and this snapshot is not surfaced in the picker's compact
 * description — it exists for programmatic consumers.
 *
-* Source: the command-code@1.27.1 bundled model table (dist/cli.mjs, the `ZA`
+* Source: the command-code@1.28.4 bundled model table (dist/cli.mjs, the `ZA`
 * object), cross-checked with https://commandcode.ai/docs/reference/cli/models.
 * Keep in sync via the dsh-commandcode-upstream skill.
 */
@@ -281,6 +287,7 @@ const KNOWN_PLANS = {
 	"Qwen/Qwen3.7-Flash": "go",
 	"Qwen/Qwen3.7-Max": "go",
 	"Qwen/Qwen3.7-Plus": "go",
+	"Qwen/Qwen3.8-27B": "go",
 	"Qwen/Qwen3.8-Max": "go",
 	"deepseek/deepseek-v4-flash": "go",
 	"deepseek/deepseek-v4-pro": "go",
@@ -362,7 +369,7 @@ function compareByPlan(a, b) {
 }
 /**
 * Subscription plan table, synced from the official CLI bundle's plan maps
-* (`Nn`/`$n` in command-code@1.27.1 `dist/cli.mjs`): subscription `planId`
+* (`Nn`/`$n` in command-code@1.28.4 `dist/cli.mjs`): subscription `planId`
 * prefix → display name and the plan's monthly credit total. This is the
 * account's own subscription (from `/alpha/billing/subscriptions`) — distinct
 * from {@link KNOWN_PLANS}, which maps catalog models to their minimum tier.
@@ -492,7 +499,7 @@ function peakPricingLabel(modelId, now = Date.now()) {
 	if (state === void 0) return void 0;
 	return state === "peak" ? "Peak" : "Half";
 }
-const COMMAND_CODE_CLI_VERSION = "1.27.1";
+const COMMAND_CODE_CLI_VERSION = "1.28.4";
 const DEFAULT_API_BASE = "https://api.commandcode.ai";
 const DEFAULT_GENERATE_MAX_TOKENS = 64e3;
 const DEFAULT_MAX_OUTPUT_TOKENS = 65536;
@@ -803,8 +810,8 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	catalog = [];
 	fetchImpl;
 	resolveAttachments;
-	billingAccess;
-	billingAccessInflight;
+	billingAccess = /* @__PURE__ */ new Map();
+	billingAccessInflight = /* @__PURE__ */ new Map();
 	constructor(deps) {
 		super();
 		this.deps = deps;
@@ -877,10 +884,10 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		};
 	}
 	/** The headers every authenticated account endpoint shares. */
-	async accountHeaders() {
+	async accountHeaders(apiKey) {
 		const connection = this.deps.options();
 		return {
-			Authorization: `Bearer ${await this.deps.resolveApiKey(connection)}`,
+			Authorization: `Bearer ${apiKey ?? await this.deps.resolveApiKey(connection)}`,
 			"x-command-code-version": COMMAND_CODE_CLI_VERSION,
 			"x-cli-environment": "production",
 			...attributionHeaders()
@@ -892,18 +899,27 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	* `undefined` means "unknown — show everything" (fail-open).
 	*/
 	async loadBillingAccess() {
-		const cached = this.billingAccess;
+		let apiKey;
+		try {
+			apiKey = await this.deps.resolveApiKey(this.deps.options());
+		} catch {
+			return;
+		}
+		const cached = this.billingAccess.get(apiKey);
 		if (cached !== void 0 && Date.now() - cached.at < 3e5) return cached.value;
-		this.billingAccessInflight ??= this.fetchBillingAccess().then((value) => {
-			this.billingAccess = {
+		const existing = this.billingAccessInflight.get(apiKey);
+		if (existing !== void 0) return existing;
+		const inflight = this.fetchBillingAccess(apiKey).then((value) => {
+			this.billingAccess.set(apiKey, {
 				value,
 				at: Date.now()
-			};
+			});
 			return value;
 		}).finally(() => {
-			this.billingAccessInflight = void 0;
+			this.billingAccessInflight.delete(apiKey);
 		});
-		return this.billingAccessInflight;
+		this.billingAccessInflight.set(apiKey, inflight);
+		return inflight;
 	}
 	/**
 	* The billing facts behind the picker's plan filter, mirroring the CLI's
@@ -914,10 +930,10 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	* fallback (the CLI stamps plan identity from it too). Any failure resolves
 	* to `undefined` (fail-open) rather than breaking the picker.
 	*/
-	async fetchBillingAccess() {
+	async fetchBillingAccess(apiKey) {
 		try {
 			const connection = this.deps.options();
-			const headers = await this.accountHeaders();
+			const headers = await this.accountHeaders(apiKey);
 			const base = connection.apiBase;
 			const getJson = async (path) => {
 				const response = await this.fetchImpl(`${base}${path}`, {
@@ -955,10 +971,12 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	* Each endpoint degrades independently: a failed one lands in `failures`
 	* while the rest still report, so a transient outage never blanks the whole
 	* view. Requires a usable API key (throws `MISSING_CREDENTIAL` otherwise).
+	* Pass `apiKey` to report on a specific account of a multi-account pool;
+	* the default resolves the currently active account.
 	*/
-	async getUsage() {
+	async getUsage(apiKey) {
 		const base = this.deps.options().apiBase;
-		const headers = await this.accountHeaders();
+		const headers = await this.accountHeaders(apiKey);
 		const failures = [];
 		const getJson = async (path) => {
 			try {
@@ -1036,6 +1054,35 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		}
 		return report;
 	}
+	/**
+	* Probe one account's five-hour window from `/alpha/billing/credits`. The
+	* multi-account pool calls this when every account is marked exhausted: an
+	* account whose window no longer reports `exceeded` is revived, and the
+	* `resetAt` values feed the "earliest reset" error message. Returns
+	* `undefined` when the probe itself failed (transport, non-200, or a
+	* payload without window limits) — a failed probe never changes pool state.
+	*/
+	async probeFiveHourWindow(apiKey) {
+		try {
+			const connection = this.deps.options();
+			const response = await this.fetchImpl(`${connection.apiBase}/alpha/billing/credits`, {
+				headers: await this.accountHeaders(apiKey),
+				signal: AbortSignal.timeout(MODELS_TIMEOUT_MS)
+			});
+			if (!response.ok) return void 0;
+			const parsed = await response.json();
+			if (!isRecord(parsed)) return void 0;
+			const windowLimits = isRecord(parsed.windowLimits) ? parsed.windowLimits : void 0;
+			const fiveHour = windowLimits && isRecord(windowLimits.fiveHour) ? windowLimits.fiveHour : void 0;
+			if (fiveHour === void 0) return void 0;
+			return {
+				exceeded: fiveHour.exceeded === true,
+				resetAt: numberValue(fiveHour.resetAt) ?? 0
+			};
+		} catch {
+			return;
+		}
+	}
 	async *stream(options) {
 		if (options.stop?.length) throw new LlmError("Command Code adapter does not support stop sequences", "UNSUPPORTED_OPTION");
 		const hasImages = options.messages.some(hasImageContent);
@@ -1047,7 +1094,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			readImage = (ref) => attachments.readImage(ref).then((stored) => stored.data);
 		}
 		const connection = this.deps.options();
-		const apiKey = await this.deps.resolveApiKey(connection);
+		let apiKey = await this.deps.resolveApiKey(connection);
 		const modelMax = this.catalog.find((m) => m.id === options.model)?.maxTokens ?? 65536;
 		const maxTokens = Math.min(options.maxTokens ?? modelMax, modelMax, DEFAULT_GENERATE_MAX_TOKENS);
 		const effort = options.reasoningEffort;
@@ -1086,58 +1133,83 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			},
 			threadId: randomUUID()
 		};
-		const connectAbort = new AbortController();
-		let connectTimedOut = false;
-		const connectTimer = setTimeout(() => {
-			connectTimedOut = true;
-			connectAbort.abort(new DOMException(`Command Code API request to ${connection.apiBase}/alpha/generate did not respond within ${connection.requestTimeoutMs}ms`, "TimeoutError"));
-		}, connection.requestTimeoutMs);
-		const onCallerAbort = () => {
-			connectAbort.abort(options.signal?.reason);
-		};
-		if (options.signal) {
-			if (options.signal.aborted) onCallerAbort();
-			else options.signal.addEventListener("abort", onCallerAbort, { once: true });
-		}
-		let response;
-		try {
-			response = await this.fetchImpl(`${connection.apiBase}/alpha/generate`, {
-				method: "POST",
-				headers: {
-					"Content-Type": "application/json",
-					Authorization: `Bearer ${apiKey}`,
-					"x-command-code-version": COMMAND_CODE_CLI_VERSION,
-					"x-cli-environment": "production",
-					"x-project-slug": projectSlugFromPath(connection.workingDir),
-					"x-taste-learning": "true",
-					"x-co-flag": "false",
-					...attributionHeaders()
-				},
-				body: JSON.stringify(body),
-				signal: connectAbort.signal
-			});
-			clearTimeout(connectTimer);
-		} catch (error) {
-			clearTimeout(connectTimer);
-			if (options.signal) options.signal.removeEventListener("abort", onCallerAbort);
-			if (options.signal?.aborted) throw error;
-			if (connectTimedOut || error instanceof DOMException && error.name === "TimeoutError") throw new LlmError(`Command Code API request to ${connection.apiBase}/alpha/generate did not respond within ${connection.requestTimeoutMs}ms: ${errorChain(error)}`, "TIMEOUT", { cause: error });
-			throw new LlmError(`Command Code API request to ${connection.apiBase}/alpha/generate failed: ${errorChain(error)}`, "TRANSPORT", { cause: error });
-		}
-		if (!response.ok) {
-			if (options.signal) options.signal.removeEventListener("abort", onCallerAbort);
-			const errText = await response.text().catch(() => "");
-			let providerCode;
+		const connect = async (key) => {
+			const connectAbort = new AbortController();
+			let connectTimedOut = false;
+			const connectTimer = setTimeout(() => {
+				connectTimedOut = true;
+				connectAbort.abort(new DOMException(`Command Code API request to ${connection.apiBase}/alpha/generate did not respond within ${connection.requestTimeoutMs}ms`, "TimeoutError"));
+			}, connection.requestTimeoutMs);
+			const onCallerAbort = () => {
+				connectAbort.abort(options.signal?.reason);
+			};
+			if (options.signal) {
+				if (options.signal.aborted) onCallerAbort();
+				else options.signal.addEventListener("abort", onCallerAbort, { once: true });
+			}
+			const cleanup = () => {
+				clearTimeout(connectTimer);
+				if (options.signal) options.signal.removeEventListener("abort", onCallerAbort);
+			};
+			let response;
 			try {
-				const parsed = JSON.parse(errText);
-				if (isRecord(parsed) && isRecord(parsed.error)) providerCode = stringValue(parsed.error.code);
-			} catch {}
-			const detail = providerCode ?? `HTTP ${response.status}`;
-			if (response.status === 401) throw new LlmError(`Command Code API error 401 (${detail}): the API key is missing or invalid — check the key stored for COMMANDCODE_API_KEY (Models page) or the auth file`, "INVALID_CREDENTIAL", { status: 401 });
-			throw new LlmError(`Command Code API error ${response.status}${detail === `HTTP ${response.status}` ? "" : ` (${detail})`}: ${errText.slice(0, 500)}`, response.status === 429 ? "RATE_LIMIT" : "PROVIDER_HTTP_ERROR", { status: response.status });
+				response = await this.fetchImpl(`${connection.apiBase}/alpha/generate`, {
+					method: "POST",
+					headers: {
+						"Content-Type": "application/json",
+						Authorization: `Bearer ${key}`,
+						"x-command-code-version": COMMAND_CODE_CLI_VERSION,
+						"x-cli-environment": "production",
+						"x-project-slug": projectSlugFromPath(connection.workingDir),
+						"x-taste-learning": "true",
+						"x-co-flag": "false",
+						...attributionHeaders()
+					},
+					body: JSON.stringify(body),
+					signal: connectAbort.signal
+				});
+				clearTimeout(connectTimer);
+			} catch (error) {
+				cleanup();
+				if (options.signal?.aborted) throw error;
+				if (connectTimedOut || error instanceof DOMException && error.name === "TimeoutError") throw new LlmError(`Command Code API request to ${connection.apiBase}/alpha/generate did not respond within ${connection.requestTimeoutMs}ms: ${errorChain(error)}`, "TIMEOUT", { cause: error });
+				throw new LlmError(`Command Code API request to ${connection.apiBase}/alpha/generate failed: ${errorChain(error)}`, "TRANSPORT", { cause: error });
+			}
+			if (!response.ok) {
+				const errText = await response.text().catch(() => "");
+				cleanup();
+				return {
+					status: response.status,
+					errText
+				};
+			}
+			return {
+				response,
+				cleanup
+			};
+		};
+		const tried = /* @__PURE__ */ new Set();
+		let connected;
+		for (;;) {
+			tried.add(apiKey);
+			const attempt = await connect(apiKey);
+			if ("response" in attempt) {
+				connected = attempt;
+				break;
+			}
+			const rotate = this.deps.rotateApiKey;
+			if ((attempt.status === 429 || attempt.status === 401) && rotate !== void 0 && options.signal?.aborted !== true && tried.size < MAX_ACCOUNT_ROTATIONS) {
+				const next = await rotate(apiKey, attempt.status === 429 ? "rate-limit" : "invalid-credential", connection);
+				if (next !== void 0 && !tried.has(next)) {
+					apiKey = next;
+					continue;
+				}
+			}
+			throw generateHttpError(attempt.status, attempt.errText);
 		}
+		const { response, cleanup } = connected;
 		if (!response.body) {
-			if (options.signal) options.signal.removeEventListener("abort", onCallerAbort);
+			cleanup();
 			throw new LlmError("Command Code API returned no response body", "PROVIDER_PROTOCOL_ERROR");
 		}
 		const reader = response.body.getReader();
@@ -1348,18 +1420,220 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			}
 		} finally {
 			clearIdle();
-			if (options.signal) options.signal.removeEventListener("abort", onCallerAbort);
+			cleanup();
 			await reader.cancel().catch(() => void 0);
 			reader.releaseLock();
 		}
 	}
 };
+/** Hard cap on account rotations within one request (one attempt per distinct key). */
+const MAX_ACCOUNT_ROTATIONS = 16;
+/**
+* Map a pre-stream generate HTTP failure onto a stable LlmError. Command
+* Code folds several business rejections into 403 (plan limits, CLI version,
+* model access): prefer the machine-readable `error.code` when present; the
+* status alone cannot distinguish them.
+*/
+function generateHttpError(status, errText) {
+	let providerCode;
+	try {
+		const parsed = JSON.parse(errText);
+		if (isRecord(parsed) && isRecord(parsed.error)) providerCode = stringValue(parsed.error.code);
+	} catch {}
+	const detail = providerCode ?? `HTTP ${status}`;
+	if (status === 401) return new LlmError(`Command Code API error 401 (${detail}): the API key is missing or invalid — check the key stored for COMMANDCODE_API_KEY (Models page) or the auth file`, "INVALID_CREDENTIAL", { status: 401 });
+	return new LlmError(`Command Code API error ${status}${detail === `HTTP ${status}` ? "" : ` (${detail})`}: ${errText.slice(0, 500)}`, status === 429 ? "RATE_LIMIT" : "PROVIDER_HTTP_ERROR", { status });
+}
 function mapFinishReason(reason) {
 	if (reason === "tool-calls") return { kind: "tool-calls" };
 	if (reason === "length" || reason === "max_tokens" || reason === "max-tokens" || reason === "max_output_tokens") return { kind: "max-tokens" };
 	return { kind: "stop" };
 }
 //#endregion
+//#region src/accounts.ts
+/**
+* Multi-account pool for the Command Code provider (host side).
+*
+* One Command Code subscription (e.g. the Go plan's 5-hour window) is
+* metered; a user with several subscriptions wants a request that hits one
+* account's limit to continue on the next account without a visible failure.
+* This module owns that rotation:
+*
+*   - {@link CommandCodeAccountPool.resolveKey} hands out the first account
+*     whose key is not currently marked exhausted, resolving each slot's key
+*     lazily (literal config key → credential seam → launch environment → the
+*     official CLI auth file for the default slot only).
+*   - {@link CommandCodeAccountPool.markRejected} records a 429 (rate limit,
+*     window unknown) or 401 (invalid key, disabled until the config changes)
+*     against the exact API key, so several slots sharing one key share one
+*     state.
+*   - When every account is marked, the pool probes each key's
+*     `/alpha/billing/credits` window limits (through the injected
+*     {@link CommandCodeAccountPoolDeps.probeWindow}): an account whose window
+*     no longer reports `exceeded` is revived, otherwise the pool throws a
+*     `RATE_LIMIT` error naming the earliest reset time.
+*
+* The pool is deliberately cordis-free (like the adapter): every host fact
+* arrives through injected thunks, so node tests can drive it directly.
+*
+* @module dsh-commandcode-provider/accounts
+*/
+/** A labeled, human-readable clock reading for error messages. */
+function clockLabel(ms) {
+	return new Date(ms).toLocaleString();
+}
+/**
+* Whether an account with this rotation state can serve a request right now.
+* `undefined` (never rejected) is usable; a cooldown becomes usable again
+* once its reset time passes; `unknown` (429, reset unprobed) and
+* `disabled` (401) are not.
+*/
+function accountUsable(state) {
+	if (state === void 0) return true;
+	if (state.kind === "cooldown") return state.until > 0 && Date.now() >= state.until;
+	return false;
+}
+/**
+* Pick the account that should serve now: the manually preferred slot when it
+* is usable, otherwise the first usable account in rotation order; undefined
+* when no account is usable. Shared by the pool (request path) and the plugin
+* entry (the usage view's active badge) so both always agree.
+*/
+function selectActiveAccount(accounts, preferredId) {
+	const usable = accounts.filter((account) => accountUsable(account.state));
+	if (preferredId !== void 0) {
+		const preferred = usable.find((account) => account.slot.id === preferredId);
+		if (preferred !== void 0) return preferred;
+	}
+	return usable[0];
+}
+/**
+* The account pool. Rotation state is keyed by API key (never logged), so two
+* slots resolving to the same credential share one mark, and a key changed in
+* the credentials service starts with a clean slate.
+*/
+var CommandCodeAccountPool = class {
+	deps;
+	/** Rotation state by API key. */
+	states = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Resolve every slot's key, deduplicated by key (first slot wins). Slots
+	* without any resolvable key are omitted — they still appear in the
+	* settings page as unconfigured, they just cannot serve requests.
+	*/
+	async resolvedAccounts() {
+		const out = [];
+		const seen = /* @__PURE__ */ new Set();
+		for (const slot of this.deps.slots()) {
+			const key = await this.resolveSlotKey(slot);
+			if (key === void 0 || seen.has(key)) continue;
+			seen.add(key);
+			out.push({
+				slot,
+				key,
+				state: this.states.get(key)
+			});
+		}
+		return out;
+	}
+	/**
+	* Every slot paired with its resolved key and rotation state — NOT
+	* deduplicated: two slots sharing one credential both appear (the usage
+	* view reports them individually), while slots without any resolvable key
+	* are omitted. The serving path uses {@link resolvedAccounts} instead.
+	*/
+	async describeAccounts() {
+		const out = [];
+		for (const slot of this.deps.slots()) {
+			const key = await this.resolveSlotKey(slot);
+			if (key === void 0) continue;
+			out.push({
+				slot,
+				key,
+				state: this.states.get(key)
+			});
+		}
+		return out;
+	}
+	/**
+	* Hand out the first usable account's key (the manually preferred account
+	* when usable, else rotation order). Returns `undefined` when no account
+	* resolves any key at all (the caller then reports the missing credential).
+	* Throws `RATE_LIMIT` — naming the earliest window reset — or
+	* `INVALID_CREDENTIAL` when accounts exist but none can serve.
+	*
+	* `options.exclude` skips one key during the probe-revival pass: the
+	* rotation hook excludes the just-rejected key so a probe that clears its
+	* window cannot re-offer the same key within the same request (the adapter
+	* refuses already-tried keys; the next request picks the revived key up).
+	*/
+	async resolveKey(options) {
+		const accounts = await this.resolvedAccounts();
+		if (accounts.length === 0) return;
+		const chosen = selectActiveAccount(accounts, this.deps.preferredId?.());
+		if (chosen !== void 0) return this.pick(chosen);
+		await Promise.all(accounts.map(async (account) => {
+			if (account.state?.kind === "disabled") return;
+			if (options?.exclude !== void 0 && account.key === options.exclude) return;
+			const probe = await this.deps.probeWindow(account.key);
+			if (probe === void 0) return;
+			if (!probe.exceeded) this.states.delete(account.key);
+			else this.states.set(account.key, {
+				kind: "cooldown",
+				reason: account.state?.reason ?? "rate limited (429)",
+				until: probe.resetAt
+			});
+		}));
+		const revived = selectActiveAccount(await this.resolvedAccounts(), this.deps.preferredId?.());
+		if (revived !== void 0) return this.pick(revived);
+		const latest = await this.resolvedAccounts();
+		if (latest.filter((account) => account.state?.kind === "disabled").length === latest.length) throw new LlmError(`llm-commandcode: every configured Command Code account (${latest.length}) was rejected with 401 — check the stored API keys (Models page / settings) or the auth file`, "INVALID_CREDENTIAL");
+		const resets = latest.map((account) => account.state).filter((state) => state !== void 0 && state.kind === "cooldown" && state.until > 0).map((state) => state.until);
+		const earliest = resets.length > 0 ? Math.min(...resets) : 0;
+		throw new LlmError(`llm-commandcode: all ${latest.length} Command Code account(s) have exhausted their usage window` + (earliest > 0 ? `; the earliest window resets at ${clockLabel(earliest)}` : "") + " — requests will succeed again after the reset (or add another account)", "RATE_LIMIT");
+	}
+	/**
+	* Record a rejection against one key. `rate-limit` (429) marks the key
+	* exhausted with an unknown reset (probed lazily at the next resolution
+	* once every account is marked); `invalid-credential` (401) disables the
+	* key until the stored credential changes.
+	*/
+	markRejected(apiKey, rejection) {
+		if (rejection === "invalid-credential") this.states.set(apiKey, {
+			kind: "disabled",
+			reason: "invalid API key (401)",
+			until: 0
+		});
+		else this.states.set(apiKey, {
+			kind: "unknown",
+			reason: "rate limited (429)",
+			until: 0
+		});
+	}
+	/** One account's key: literal → credential seam → auth file (default slot). */
+	async resolveSlotKey(slot) {
+		if (slot.literal !== void 0 && slot.literal !== "") return slot.literal;
+		if (slot.ref !== void 0) {
+			const hit = await this.deps.resolveRef(slot.ref);
+			if (hit !== void 0 && hit !== "") return hit;
+		}
+		if (slot.allowAuthFile) {
+			const fromFile = this.deps.authFileKey();
+			if (fromFile !== void 0 && fromFile !== "") return fromFile;
+		}
+	}
+	/** Hand out the chosen account's key. */
+	pick(account) {
+		return {
+			key: account.key,
+			slot: account.slot
+		};
+	}
+};
+//#endregion
 //#region src/commands.ts
 /** Format a dollar amount. */
 function money(value) {
@@ -1392,11 +1666,18 @@ function bar(used, cap) {
 	const filled = Math.round(ratio * 10);
 	return "█".repeat(filled) + "░".repeat(10 - filled);
 }
+/** Render one account's rotation mark / cooldown as a short badge. */
+function markLabel(entry) {
+	if (entry.mark === "invalid-credential") return "  ⛔ 密钥无效";
+	if (entry.cooldownUntil > 0) return `  ⏳ 限额冷却中，重置 ${resetLabel(entry.cooldownUntil)}`;
+	if (entry.mark === "rate-limit") return "  ⏳ 已达限额（等待窗口探测）";
+	return "";
+}
 /** Render the usage report as a structured, aligned, bar-chart text view. */
-function renderReport(report) {
+function renderReport(report, title) {
 	const lines = [];
 	const account = report.account ? ` (${report.account.userName || report.account.name})` : "";
-	lines.push(`📊 Command Code 用量${account}`, "");
+	lines.push(title ?? `📊 Command Code 用量${account}`, "");
 	if (report.plan && report.plan.name !== "") {
 		const p = report.plan;
 		const status = p.status !== "" && p.status !== "active" ? ` (${p.status})` : "";
@@ -1425,6 +1706,18 @@ function commandDefinition(deps) {
 		input: { hint: "[status]" },
 		handler: async () => {
 			try {
+				if (deps.reports !== void 0) {
+					const { accounts } = await deps.reports();
+					return {
+						kind: "success",
+						text: accounts.map((entry) => {
+							const badges = `${entry.active ? "  ✅ 当前使用" : ""}${markLabel(entry)}`;
+							const title = `📊 ${entry.label}${badges}`;
+							if (!entry.configured) return `${title}\n\n  (未配置 API 密钥)`;
+							return renderReport(entry.report, title);
+						}).join("\n\n────────────────────\n\n")
+					};
+				}
 				return {
 					kind: "success",
 					text: renderReport(await adapter.getUsage())
@@ -1541,12 +1834,31 @@ function parseUsageReport(value) {
 	}
 	return report;
 }
+/** Parse one untrusted boundary value into a {@link CommandCodeAccountUsage}. */
+function parseAccountUsage(value) {
+	const source = record(value, "account");
+	return {
+		id: stringField(source, "id", "account.id"),
+		label: stringField(source, "label", "account.label"),
+		configured: booleanField(source, "configured", "account.configured"),
+		active: booleanField(source, "active", "account.active"),
+		mark: stringField(source, "mark", "account.mark"),
+		cooldownUntil: numberField(source, "cooldownUntil", "account.cooldownUntil"),
+		report: parseUsageReport(source.report)
+	};
+}
+/** Parse the wire result into a {@link CommandCodeAccountsReport}. */
+function parseAccountsReport(value) {
+	const accounts = record(value, "result").accounts;
+	if (!Array.isArray(accounts)) reject("accounts");
+	return { accounts: accounts.map(parseAccountUsage) };
+}
 /**
 * The strict result codec both halves attach to the descriptor. Hand-rolled:
 * the client bundle may not require a schema library, and `TypertSchema` is
 * deliberately minimal so one `parse` function satisfies it.
 */
-const usageReportSchema = { parse: parseUsageReport };
+const usageReportSchema = { parse: parseAccountsReport };
 /** The Host-face contribution registered on `ctx.typert`. */
 const USAGE_HOST_CONTRIBUTION = {
 	package: USAGE_REMOTE_PACKAGE,
@@ -1561,7 +1873,7 @@ const USAGE_HOST_CONTRIBUTION = {
 		parameters: [],
 		result: {
 			mode: "strict",
-			typeSymbol: `${USAGE_REMOTE_PACKAGE}#CommandCodeUsageReport`,
+			typeSymbol: `${USAGE_REMOTE_PACKAGE}#CommandCodeAccountsReport`,
 			schema: usageReportSchema
 		}
 	}]
@@ -1582,13 +1894,24 @@ var CommandCodeUsageService = class extends TypertRemoteService {
 		this.deps = deps;
 	}
 	/**
-	* Account, usage, and credit state for the settings page's account card.
-	* Degrades per endpoint like the `/commandcode` command (failures land in
-	* `report.failures`); throws `MISSING_CREDENTIAL` when no key resolves, which
-	* the Gateway folds into the failure branch the page renders as a hint.
+	* Account, usage, and credit state for the settings page's account card —
+	* one entry per pool account when the plugin entry wired `reports`, a
+	* single default-account entry otherwise. Degrades per endpoint like the
+	* `/commandcode` command (failures land in `report.failures`); throws
+	* `MISSING_CREDENTIAL` when no key resolves, which the Gateway folds into
+	* the failure branch the page renders as a hint.
 	*/
 	async report() {
-		return this.deps.adapter.getUsage();
+		if (this.deps.reports !== void 0) return this.deps.reports();
+		return { accounts: [{
+			id: "default",
+			label: "Default",
+			configured: true,
+			active: true,
+			mark: "",
+			cooldownUntil: 0,
+			report: await this.deps.adapter.getUsage()
+		}] };
 	}
 };
 /**
@@ -1648,7 +1971,13 @@ const Config = z.object({
 	modelsCachePath: z.string(),
 	requestTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
 	streamIdleTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
-	filterModelsByPlan: z.boolean()
+	filterModelsByPlan: z.boolean(),
+	accounts: z.array(z.object({
+		label: z.string(),
+		apiKeyEnv: z.string().role("credential-ref"),
+		apiKey: z.string()
+	})),
+	activeAccount: z.string()
 });
 /**
 * The one explicit resolve step from raw config to validated connection
@@ -1680,25 +2009,60 @@ function apply(ctx, config) {
 		return next;
 	};
 	options();
+	const slots = () => {
+		const raw = current();
+		const list = [{
+			id: "default",
+			label: "Default",
+			ref: credentialRef(raw.apiKeyEnv ?? DEFAULT_API_KEY_ENV),
+			literal: raw.apiKey,
+			allowAuthFile: true
+		}];
+		for (const [index, account] of (raw.accounts ?? []).entries()) {
+			const refName = typeof account.apiKeyEnv === "string" && account.apiKeyEnv.trim() !== "" ? account.apiKeyEnv.trim() : void 0;
+			const literal = typeof account.apiKey === "string" && account.apiKey !== "" ? account.apiKey : void 0;
+			if (refName === void 0 && literal === void 0) continue;
+			list.push({
+				id: refName ?? `account-${index + 2}`,
+				label: typeof account.label === "string" && account.label.trim() !== "" ? account.label.trim() : `Account ${index + 2}`,
+				ref: refName === void 0 ? void 0 : credentialRef(refName),
+				literal,
+				allowAuthFile: false
+			});
+		}
+		return list;
+	};
+	const preferredId = () => {
+		const raw = current().activeAccount;
+		return typeof raw === "string" && raw.trim() !== "" ? raw.trim() : void 0;
+	};
+	const resolveRef = async (ref) => {
+		const credentials = ctx.get("credentials");
+		if (credentials !== void 0) return (await credentials.resolve(ref))?.value;
+		const ambient = launchEnvironmentOf(ctx).get(ref);
+		return ambient !== void 0 && ambient.value.length > 0 ? ambient.value : void 0;
+	};
+	const pool = new CommandCodeAccountPool({
+		slots,
+		resolveRef,
+		authFileKey: resolveAuthFileApiKey,
+		probeWindow: (apiKey) => adapter.probeFiveHourWindow(apiKey),
+		preferredId
+	});
 	const resolveApiKey = async (connection) => {
-		const literal = current().apiKey;
-		if (literal) return assertUsableApiKey(literal, "llm-commandcode", "config.apiKey");
+		const resolved = await pool.resolveKey();
+		if (resolved !== void 0) return assertUsableApiKey(resolved.key, "llm-commandcode", resolved.slot.ref ?? `${resolved.slot.label} (config.apiKey)`);
 		const ref = connection.apiKeyEnv;
-		const credentials = ctx.get("credentials");
-		if (credentials !== void 0) {
-			const hit = await credentials.resolve(ref);
-			if (hit !== void 0) return assertUsableApiKey(hit.value, "llm-commandcode", ref);
-		} else {
-			const ambient = launchEnvironmentOf(ctx).get(ref);
-			if (ambient !== void 0 && ambient.value.length > 0) return assertUsableApiKey(ambient.value, "llm-commandcode", ref);
-		}
-		const authFileKey = resolveAuthFileApiKey();
-		if (authFileKey) return assertUsableApiKey(authFileKey, "llm-commandcode", "~/.commandcode/auth.json");
 		throw new LlmError(`llm-commandcode: no API key for provider route "${PROVIDER}"; store ${ref} through the credentials service (the web Models page writes it), export it in the launching environment, set config.apiKey, or run \`command-code login\` to write ~/.commandcode/auth.json`, "MISSING_CREDENTIAL");
 	};
 	const adapter = new CommandCodeAdapter({
 		options,
 		resolveApiKey,
+		rotateApiKey: async (rejectedKey, rejection) => {
+			pool.markRejected(rejectedKey, rejection);
+			const resolved = await pool.resolveKey({ exclude: rejectedKey });
+			return resolved === void 0 ? void 0 : assertUsableApiKey(resolved.key, "llm-commandcode", resolved.slot.ref ?? `${resolved.slot.label} (config.apiKey)`);
+		},
 		resolveAttachments: () => {
 			const attachments = ctx.get("attachments");
 			return attachments === void 0 ? void 0 : attachments;
@@ -1711,10 +2075,42 @@ function apply(ctx, config) {
 		settingsPath: []
 	}]);
 	ctx.llm.registerAdapter([PROVIDER], adapter);
+	const usageReports = async () => {
+		const described = await pool.describeAccounts();
+		const byId = new Map(described.map((account) => [account.slot.id, account]));
+		const active = selectActiveAccount(await pool.resolvedAccounts(), preferredId());
+		return { accounts: await Promise.all(slots().map(async (slot) => {
+			const account = byId.get(slot.id);
+			let report;
+			if (account === void 0) report = { failures: [] };
+			else try {
+				report = await adapter.getUsage(account.key);
+			} catch (error) {
+				report = { failures: [error instanceof Error ? error.message : String(error)] };
+			}
+			const state = account?.state;
+			const usable = accountUsable(state);
+			return {
+				id: slot.id,
+				label: slot.label,
+				configured: account !== void 0,
+				active: account !== void 0 && active?.slot.id === slot.id,
+				mark: usable ? "" : state?.kind === "disabled" ? "invalid-credential" : "rate-limit",
+				cooldownUntil: !usable && state?.kind === "cooldown" ? state.until : 0,
+				report
+			};
+		})) };
+	};
 	ctx.inject(["commands"], (commandCtx) => {
-		applyCommands(commandCtx, { adapter });
+		applyCommands(commandCtx, {
+			adapter,
+			reports: usageReports
+		});
+	});
+	applyUsageRemote(ctx, {
+		adapter,
+		reports: usageReports
 	});
-	applyUsageRemote(ctx, { adapter });
 	installSettingsSection(ctx, NS, Config, config, {
 		setSource: (source) => {
 			current = source;
@@ -1723,6 +2119,6 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { BILLING_ACCESS_TTL_MS, COMMAND_CODE_CLI_VERSION, CommandCodeAdapter, CommandCodeUsageService, Config, DEFAULT_API_BASE, DEFAULT_GENERATE_MAX_TOKENS, DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_MODELS_CACHE_PATH, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_STREAM_IDLE_TIMEOUT_MS, KNOWN_DEALS, KNOWN_EFFORTS, KNOWN_IMAGE_MODELS, KNOWN_PEAK_PRICING, KNOWN_PLANS, KNOWN_SUBSCRIPTION_PLANS, KNOWN_THINKING_MODELS, PLAN_LABELS, PLAN_ORDER, PROVIDER, USAGE_REPORT_ENDPOINT, apply, applyCommands, applyUsageRemote, capabilityDescription, commandDefinition, compareByPlan, dealLabel, formatContext, inject, modelVisibleInPlan, name, peakPricingLabel, peakPricingState, planLabel, projectSlugFromPath, resolveAdapterOptions, resolveAuthFileApiKey, subscriptionPlanInfo, usageReportSchema };
+export { BILLING_ACCESS_TTL_MS, COMMAND_CODE_CLI_VERSION, CommandCodeAccountPool, CommandCodeAdapter, CommandCodeUsageService, Config, DEFAULT_API_BASE, DEFAULT_GENERATE_MAX_TOKENS, DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_MODELS_CACHE_PATH, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_STREAM_IDLE_TIMEOUT_MS, KNOWN_DEALS, KNOWN_EFFORTS, KNOWN_IMAGE_MODELS, KNOWN_PEAK_PRICING, KNOWN_PLANS, KNOWN_SUBSCRIPTION_PLANS, KNOWN_THINKING_MODELS, PLAN_LABELS, PLAN_ORDER, PROVIDER, USAGE_REPORT_ENDPOINT, accountUsable, apply, applyCommands, applyUsageRemote, capabilityDescription, commandDefinition, compareByPlan, dealLabel, formatContext, inject, modelVisibleInPlan, name, peakPricingLabel, peakPricingState, planLabel, projectSlugFromPath, resolveAdapterOptions, resolveAuthFileApiKey, selectActiveAccount, subscriptionPlanInfo, usageReportSchema };
 
 //# sourceMappingURL=index.js.map