@mars-sea/dsh-commandcode-provider 0.5.0 → 0.6.1

package/lib/index.d.ts

@@ -24,7 +24,7 @@ declare const KNOWN_EFFORTS: Readonly<Record<string, readonly string[]>>;
  */
 declare const KNOWN_IMAGE_MODELS: ReadonlySet<string>;
 /**
- * Models the official CLI's model table (`ZA` in command-code@1.28.1) marks
+ * Models the official CLI's model table (`ZA` in command-code@1.31.0) marks
  * `reasoning:!0` but defines no selectable `reasoning_effort` levels — they
  * think automatically, with Command Code driving the depth. This is the
  * authoritative "thinks, effort not adjustable" set: `KNOWN_EFFORTS` (which
@@ -32,7 +32,7 @@ declare const KNOWN_IMAGE_MODELS: ReadonlySet<string>;
  * effort levels, and this snapshot is not surfaced in the picker's compact
  * description — it exists for programmatic consumers.
  *
- * Source: the command-code@1.28.1 bundled model table (dist/cli.mjs, the `ZA`
+ * Source: the command-code@1.31.0 bundled model table (dist/cli.mjs, the `ZA`
  * object), cross-checked with https://commandcode.ai/docs/reference/cli/models.
  * Keep in sync via the dsh-commandcode-upstream skill.
  */
@@ -73,7 +73,7 @@ declare function compareByPlan(a: {
 }): number;
 /**
  * Subscription plan table, synced from the official CLI bundle's plan maps
- * (`Nn`/`$n` in command-code@1.28.1 `dist/cli.mjs`): subscription `planId`
+ * (`Nn`/`$n` in command-code@1.31.0 `dist/cli.mjs`): subscription `planId`
  * prefix → display name and the plan's monthly credit total. This is the
  * account's own subscription (from `/alpha/billing/subscriptions`) — distinct
  * from {@link KNOWN_PLANS}, which maps catalog models to their minimum tier.
@@ -172,7 +172,7 @@ declare function peakPricingState(modelId: string, now?: number): 'peak' | 'off-
  * for models without time-of-day pricing.
  */
 declare function peakPricingLabel(modelId: string, now?: number): string | undefined;
-declare const COMMAND_CODE_CLI_VERSION = "1.28.1";
+declare const COMMAND_CODE_CLI_VERSION = "1.31.0";
 declare const DEFAULT_API_BASE = "https://api.commandcode.ai";
 declare const DEFAULT_GENERATE_MAX_TOKENS = 64000;
 declare const DEFAULT_MAX_OUTPUT_TOKENS = 65536;
@@ -331,12 +331,21 @@ declare class CommandCodeAdapter<C extends CommandCodeConnectionOptions = Comman
   private readonly billingAccessInflight;
   constructor(deps: CommandCodeAdapterDeps<C>);
   /**
-   * Command Code is a metered subscription API: 429 (rate limit) and 5xx
-   * (transient server errors) are worth retrying at the agent-step boundary,
-   * which is where dsh-llm-retry executes the policy returned here. The
-   * default policy already retries `RATE_LIMIT` and `SERVER`; declaring it
-   * explicitly documents the intent and gives the plugin entry a stable hook
-   * to override (e.g. a stricter cap for a metered plan).
+   * Near-unbounded retry for transient failures only (`mode: 'normal'` with
+   * an explicit 1000-attempt cap — opencode-style persistence without the
+   * unbounded loop): `RATE_LIMIT`/`SERVER`/`TIMEOUT`/`TRANSPORT`/
+   * `EMPTY_RESPONSE` retry up to 1000 times with waits doubling from 500 ms
+   * and capping at 15 minutes (±10% jitter), so an exhausted 5-hour window
+   * recovers in-session instead of failing after two tries. Permanent
+   * failures (an invalid key's `INVALID_CREDENTIAL`, `UNSUPPORTED_CONTENT`,
+   * plan rejections) are absent from the whitelist and surface immediately
+   * instead of looping. Waits the pool/adapter attach as
+   * `providerRetryAfterMs` are honored verbatim at or below the 15-minute
+   * cap and never attached above it (in normal mode a longer attached wait
+   * makes the executor abandon the retry outright — see RETRY_MAX_DELAY_MS).
+   *
+   * Captured once at route registration (dsh-llm snapshots this value), so a
+   * future config knob for it would apply on profile restart, not per request.
    */
   providerRetryPolicy(_provider: string): ResolvedRetryPolicy;
   /** Refresh the catalog (live fetch, cache fallback) and return it. */

package/lib/index.js

@@ -10,6 +10,201 @@ import { existsSync, readFileSync } from "node:fs";
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
+//#region src/accounts.ts
+/**
+* Multi-account pool for the Command Code provider (host side).
+*
+* One Command Code subscription (e.g. the Go plan's 5-hour window) is
+* metered; a user with several subscriptions wants a request that hits one
+* account's limit to continue on the next account without a visible failure.
+* This module owns that rotation:
+*
+*   - {@link CommandCodeAccountPool.resolveKey} hands out the first account
+*     whose key is not currently marked exhausted, resolving each slot's key
+*     lazily (literal config key → credential seam → launch environment → the
+*     official CLI auth file for the default slot only).
+*   - {@link CommandCodeAccountPool.markRejected} records a 429 (rate limit,
+*     window unknown) or 401 (invalid key, disabled until the config changes)
+*     against the exact API key, so several slots sharing one key share one
+*     state.
+*   - When every account is marked, the pool probes each key's
+*     `/alpha/billing/credits` window limits (through the injected
+*     {@link CommandCodeAccountPoolDeps.probeWindow}): an account whose window
+*     no longer reports `exceeded` is revived, otherwise the pool throws a
+*     `RATE_LIMIT` error naming the earliest reset time.
+*
+* The pool is deliberately cordis-free (like the adapter): every host fact
+* arrives through injected thunks, so node tests can drive it directly.
+*
+* @module dsh-commandcode-provider/accounts
+*/
+/**
+* Upper bound on the retry wait this pool attaches to the all-exhausted
+* `RATE_LIMIT` error. Must equal the `backoff.maxDelayMs` in the adapter's
+* `providerRetryPolicy` (which imports it from here): dsh-llm-retry honors a
+* provider-specified wait verbatim only at or below that cap — in normal mode
+* a LONGER attached wait makes the executor abandon the retry entirely
+* instead of falling back to local backoff, which would turn "poll until the
+* window opens" into "fail now".
+*/
+const RETRY_MAX_DELAY_MS = 9e5;
+/** A labeled, human-readable clock reading for error messages. */
+function clockLabel(ms) {
+	return new Date(ms).toLocaleString();
+}
+/**
+* Whether an account with this rotation state can serve a request right now.
+* `undefined` (never rejected) is usable; a cooldown becomes usable again
+* once its reset time passes; `unknown` (429, reset unprobed) and
+* `disabled` (401) are not.
+*/
+function accountUsable(state) {
+	if (state === void 0) return true;
+	if (state.kind === "cooldown") return state.until > 0 && Date.now() >= state.until;
+	return false;
+}
+/**
+* Pick the account that should serve now: the manually preferred slot when it
+* is usable, otherwise the first usable account in rotation order; undefined
+* when no account is usable. Shared by the pool (request path) and the plugin
+* entry (the usage view's active badge) so both always agree.
+*/
+function selectActiveAccount(accounts, preferredId) {
+	const usable = accounts.filter((account) => accountUsable(account.state));
+	if (preferredId !== void 0) {
+		const preferred = usable.find((account) => account.slot.id === preferredId);
+		if (preferred !== void 0) return preferred;
+	}
+	return usable[0];
+}
+/**
+* The account pool. Rotation state is keyed by API key (never logged), so two
+* slots resolving to the same credential share one mark, and a key changed in
+* the credentials service starts with a clean slate.
+*/
+var CommandCodeAccountPool = class {
+	deps;
+	/** Rotation state by API key. */
+	states = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Resolve every slot's key, deduplicated by key (first slot wins). Slots
+	* without any resolvable key are omitted — they still appear in the
+	* settings page as unconfigured, they just cannot serve requests.
+	*/
+	async resolvedAccounts() {
+		const out = [];
+		const seen = /* @__PURE__ */ new Set();
+		for (const slot of this.deps.slots()) {
+			const key = await this.resolveSlotKey(slot);
+			if (key === void 0 || seen.has(key)) continue;
+			seen.add(key);
+			out.push({
+				slot,
+				key,
+				state: this.states.get(key)
+			});
+		}
+		return out;
+	}
+	/**
+	* Every slot paired with its resolved key and rotation state — NOT
+	* deduplicated: two slots sharing one credential both appear (the usage
+	* view reports them individually), while slots without any resolvable key
+	* are omitted. The serving path uses {@link resolvedAccounts} instead.
+	*/
+	async describeAccounts() {
+		const out = [];
+		for (const slot of this.deps.slots()) {
+			const key = await this.resolveSlotKey(slot);
+			if (key === void 0) continue;
+			out.push({
+				slot,
+				key,
+				state: this.states.get(key)
+			});
+		}
+		return out;
+	}
+	/**
+	* Hand out the first usable account's key (the manually preferred account
+	* when usable, else rotation order). Returns `undefined` when no account
+	* resolves any key at all (the caller then reports the missing credential).
+	* Throws `RATE_LIMIT` — naming the earliest window reset — or
+	* `INVALID_CREDENTIAL` when accounts exist but none can serve.
+	*
+	* `options.exclude` skips one key during the probe-revival pass: the
+	* rotation hook excludes the just-rejected key so a probe that clears its
+	* window cannot re-offer the same key within the same request (the adapter
+	* refuses already-tried keys; the next request picks the revived key up).
+	*/
+	async resolveKey(options) {
+		const accounts = await this.resolvedAccounts();
+		if (accounts.length === 0) return;
+		const chosen = selectActiveAccount(accounts, this.deps.preferredId?.());
+		if (chosen !== void 0) return this.pick(chosen);
+		await Promise.all(accounts.map(async (account) => {
+			if (account.state?.kind === "disabled") return;
+			if (options?.exclude !== void 0 && account.key === options.exclude) return;
+			const probe = await this.deps.probeWindow(account.key);
+			if (probe === void 0) return;
+			if (!probe.exceeded) this.states.delete(account.key);
+			else this.states.set(account.key, {
+				kind: "cooldown",
+				reason: account.state?.reason ?? "rate limited (429)",
+				until: probe.resetAt
+			});
+		}));
+		const revived = selectActiveAccount(await this.resolvedAccounts(), this.deps.preferredId?.());
+		if (revived !== void 0) return this.pick(revived);
+		const latest = await this.resolvedAccounts();
+		if (latest.filter((account) => account.state?.kind === "disabled").length === latest.length) throw new LlmError(`llm-commandcode: every configured Command Code account (${latest.length}) was rejected with 401 — check the stored API keys (Models page / settings) or the auth file`, "INVALID_CREDENTIAL");
+		const resets = latest.map((account) => account.state).filter((state) => state !== void 0 && state.kind === "cooldown" && state.until > 0).map((state) => state.until);
+		const earliest = resets.length > 0 ? Math.min(...resets) : 0;
+		const wait = earliest > 0 ? Math.max(1e3, earliest - Date.now()) : 0;
+		throw new LlmError(`llm-commandcode: all ${latest.length} Command Code account(s) have exhausted their usage window` + (earliest > 0 ? `; the earliest window resets at ${clockLabel(earliest)}` : "") + " — requests will succeed again after the reset (or add another account)", "RATE_LIMIT", wait > 0 && wait <= 9e5 ? { providerRetryAfterMs: wait } : void 0);
+	}
+	/**
+	* Record a rejection against one key. `rate-limit` (429) marks the key
+	* exhausted with an unknown reset (probed lazily at the next resolution
+	* once every account is marked); `invalid-credential` (401) disables the
+	* key until the stored credential changes.
+	*/
+	markRejected(apiKey, rejection) {
+		if (rejection === "invalid-credential") this.states.set(apiKey, {
+			kind: "disabled",
+			reason: "invalid API key (401)",
+			until: 0
+		});
+		else this.states.set(apiKey, {
+			kind: "unknown",
+			reason: "rate limited (429)",
+			until: 0
+		});
+	}
+	/** One account's key: literal → credential seam → auth file (default slot). */
+	async resolveSlotKey(slot) {
+		if (slot.literal !== void 0 && slot.literal !== "") return slot.literal;
+		if (slot.ref !== void 0) {
+			const hit = await this.deps.resolveRef(slot.ref);
+			if (hit !== void 0 && hit !== "") return hit;
+		}
+		if (slot.allowAuthFile) {
+			const fromFile = this.deps.authFileKey();
+			if (fromFile !== void 0 && fromFile !== "") return fromFile;
+		}
+	}
+	/** Hand out the chosen account's key. */
+	pick(account) {
+		return {
+			key: account.key,
+			slot: account.slot
+		};
+	}
+};
+//#endregion
 //#region src/adapter.ts
 /**
 * DeepSeek Harness LLM adapter for the Command Code Provider API.
@@ -18,7 +213,9 @@ import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 * community-maintained integration; you need your own Command Code account
 * and API key or subscription, and Command Code's terms apply.
 *
-* Wire protocol (reverse-engineered by the pi plugin, command-code@1.28.1):
+* Wire protocol (reverse-engineered by the pi plugin, command-code@1.28.4;
+* re-verified against command-code@1.31.0 — endpoints, request shape, and
+* stream events unchanged):
 *   POST {apiBase}/alpha/generate
 *   body: { config, memory, taste, skills, params: { model, messages, tools,
 *          system, max_tokens, temperature, stream, reasoning_effort? }, threadId }
@@ -223,6 +420,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"moonshotai/Kimi-K2.7-Code-Highspeed",
 	"moonshotai/Kimi-K3",
 	"sakana/fugu-ultra",
+	"stealth/ox-alpha",
 	"stepfun/Step-3.7-Flash",
 	"thinkingmachines/inkling",
 	"thinkingmachines/inkling-small",
@@ -230,7 +428,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"xiaomi/mimo-v2.5"
 ]);
 /**
-* Models the official CLI's model table (`ZA` in command-code@1.28.1) marks
+* Models the official CLI's model table (`ZA` in command-code@1.31.0) marks
 * `reasoning:!0` but defines no selectable `reasoning_effort` levels — they
 * think automatically, with Command Code driving the depth. This is the
 * authoritative "thinks, effort not adjustable" set: `KNOWN_EFFORTS` (which
@@ -238,7 +436,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 * effort levels, and this snapshot is not surfaced in the picker's compact
 * description — it exists for programmatic consumers.
 *
-* Source: the command-code@1.28.1 bundled model table (dist/cli.mjs, the `ZA`
+* Source: the command-code@1.31.0 bundled model table (dist/cli.mjs, the `ZA`
 * object), cross-checked with https://commandcode.ai/docs/reference/cli/models.
 * Keep in sync via the dsh-commandcode-upstream skill.
 */
@@ -261,7 +459,8 @@ const KNOWN_THINKING_MODELS = /* @__PURE__ */ new Set([
 	"poolside/laguna-s-2.1-free",
 	"meta/muse-spark-1.1",
 	"meta/muse-spark-1.2",
-	"meta/muse-spark-1.2-contributor"
+	"meta/muse-spark-1.2-contributor",
+	"stealth/ox-alpha"
 ]);
 /**
 * The minimum subscription plan a model is included in, per the official plan
@@ -300,6 +499,7 @@ const KNOWN_PLANS = {
 	"moonshotai/Kimi-K3": "go",
 	"nvidia/nemotron-3-ultra-550b-a55b": "go",
 	"poolside/laguna-s-2.1-free": "go",
+	"stealth/ox-alpha": "go",
 	"stepfun/Step-3.5-Flash": "go",
 	"stepfun/Step-3.7-Flash": "go",
 	"tencent/hy3-paid": "go",
@@ -369,7 +569,7 @@ function compareByPlan(a, b) {
 }
 /**
 * Subscription plan table, synced from the official CLI bundle's plan maps
-* (`Nn`/`$n` in command-code@1.28.1 `dist/cli.mjs`): subscription `planId`
+* (`Nn`/`$n` in command-code@1.31.0 `dist/cli.mjs`): subscription `planId`
 * prefix → display name and the plan's monthly credit total. This is the
 * account's own subscription (from `/alpha/billing/subscriptions`) — distinct
 * from {@link KNOWN_PLANS}, which maps catalog models to their minimum tier.
@@ -461,6 +661,10 @@ const KNOWN_DEALS = {
 	"poolside/laguna-s-2.1-free": {
 		label: "FREE",
 		free: true
+	},
+	"stealth/ox-alpha": {
+		label: "FREE",
+		free: true
 	}
 };
 /**
@@ -499,7 +703,7 @@ function peakPricingLabel(modelId, now = Date.now()) {
 	if (state === void 0) return void 0;
 	return state === "peak" ? "Peak" : "Half";
 }
-const COMMAND_CODE_CLI_VERSION = "1.28.1";
+const COMMAND_CODE_CLI_VERSION = "1.31.0";
 const DEFAULT_API_BASE = "https://api.commandcode.ai";
 const DEFAULT_GENERATE_MAX_TOKENS = 64e3;
 const DEFAULT_MAX_OUTPUT_TOKENS = 65536;
@@ -819,15 +1023,39 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		this.resolveAttachments = deps.resolveAttachments;
 	}
 	/**
-	* Command Code is a metered subscription API: 429 (rate limit) and 5xx
-	* (transient server errors) are worth retrying at the agent-step boundary,
-	* which is where dsh-llm-retry executes the policy returned here. The
-	* default policy already retries `RATE_LIMIT` and `SERVER`; declaring it
-	* explicitly documents the intent and gives the plugin entry a stable hook
-	* to override (e.g. a stricter cap for a metered plan).
+	* Near-unbounded retry for transient failures only (`mode: 'normal'` with
+	* an explicit 1000-attempt cap — opencode-style persistence without the
+	* unbounded loop): `RATE_LIMIT`/`SERVER`/`TIMEOUT`/`TRANSPORT`/
+	* `EMPTY_RESPONSE` retry up to 1000 times with waits doubling from 500 ms
+	* and capping at 15 minutes (±10% jitter), so an exhausted 5-hour window
+	* recovers in-session instead of failing after two tries. Permanent
+	* failures (an invalid key's `INVALID_CREDENTIAL`, `UNSUPPORTED_CONTENT`,
+	* plan rejections) are absent from the whitelist and surface immediately
+	* instead of looping. Waits the pool/adapter attach as
+	* `providerRetryAfterMs` are honored verbatim at or below the 15-minute
+	* cap and never attached above it (in normal mode a longer attached wait
+	* makes the executor abandon the retry outright — see RETRY_MAX_DELAY_MS).
+	*
+	* Captured once at route registration (dsh-llm snapshots this value), so a
+	* future config knob for it would apply on profile restart, not per request.
 	*/
 	providerRetryPolicy(_provider) {
-		return resolveRetryPolicy(void 0, "llm-commandcode: retryPolicy");
+		return resolveRetryPolicy({
+			mode: "normal",
+			maxRetries: 1e3,
+			retryableCodes: [
+				"EMPTY_RESPONSE",
+				"RATE_LIMIT",
+				"SERVER",
+				"TIMEOUT",
+				"TRANSPORT"
+			],
+			backoff: {
+				initialDelayMs: 500,
+				maxDelayMs: RETRY_MAX_DELAY_MS,
+				jitterRatio: .1
+			}
+		}, "llm-commandcode: retryPolicy");
 	}
 	/** Refresh the catalog (live fetch, cache fallback) and return it. */
 	async loadCatalog(signal) {
@@ -1178,9 +1406,14 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			if (!response.ok) {
 				const errText = await response.text().catch(() => "");
 				cleanup();
-				return {
+				const retryAfterMs = parseRetryAfterMs(response.headers.get("retry-after"));
+				return retryAfterMs === void 0 ? {
 					status: response.status,
 					errText
+				} : {
+					status: response.status,
+					errText,
+					retryAfterMs
 				};
 			}
 			return {
@@ -1205,7 +1438,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 					continue;
 				}
 			}
-			throw generateHttpError(attempt.status, attempt.errText);
+			throw generateHttpError(attempt.status, attempt.errText, attempt.retryAfterMs);
 		}
 		const { response, cleanup } = connected;
 		if (!response.body) {
@@ -1432,9 +1665,13 @@ const MAX_ACCOUNT_ROTATIONS = 16;
 * Map a pre-stream generate HTTP failure onto a stable LlmError. Command
 * Code folds several business rejections into 403 (plan limits, CLI version,
 * model access): prefer the machine-readable `error.code` when present; the
-* status alone cannot distinguish them.
+* status alone cannot distinguish them. A 429's `Retry-After` rides along as
+* `providerRetryAfterMs` so dsh-llm-retry can wait exactly that long instead
+* of guessing at the backoff cadence — capped at RETRY_MAX_DELAY_MS, because
+* in normal mode a longer attached wait makes the executor abandon the retry
+* outright instead of falling back to local backoff.
 */
-function generateHttpError(status, errText) {
+function generateHttpError(status, errText, retryAfterMs) {
 	let providerCode;
 	try {
 		const parsed = JSON.parse(errText);
@@ -1442,7 +1679,30 @@ function generateHttpError(status, errText) {
 	} catch {}
 	const detail = providerCode ?? `HTTP ${status}`;
 	if (status === 401) return new LlmError(`Command Code API error 401 (${detail}): the API key is missing or invalid — check the key stored for COMMANDCODE_API_KEY (Models page) or the auth file`, "INVALID_CREDENTIAL", { status: 401 });
-	return new LlmError(`Command Code API error ${status}${detail === `HTTP ${status}` ? "" : ` (${detail})`}: ${errText.slice(0, 500)}`, status === 429 ? "RATE_LIMIT" : "PROVIDER_HTTP_ERROR", { status });
+	return new LlmError(`Command Code API error ${status}${detail === `HTTP ${status}` ? "" : ` (${detail})`}: ${errText.slice(0, 500)}`, status === 429 ? "RATE_LIMIT" : "PROVIDER_HTTP_ERROR", {
+		status,
+		...retryAfterMs !== void 0 && retryAfterMs > 0 && retryAfterMs <= 9e5 ? { providerRetryAfterMs: retryAfterMs } : {}
+	});
+}
+/**
+* Parse an HTTP `Retry-After` value (delay-seconds or an HTTP-date) into
+* milliseconds; undefined when absent or unparseable. An HTTP-date in the
+* past yields 0, which the caller drops (LlmError wants a positive delay).
+* A delay-seconds value whose millisecond product is not finite (e.g. `1e308`)
+* also yields undefined: LlmError validates its options and would otherwise
+* replace the provider failure with an internal construction error.
+*/
+function parseRetryAfterMs(value, now = Date.now()) {
+	if (value === void 0 || value === null) return void 0;
+	const trimmed = value.trim();
+	if (trimmed === "") return void 0;
+	const seconds = Number(trimmed);
+	if (Number.isFinite(seconds) && seconds >= 0) {
+		const ms = seconds * 1e3;
+		return Number.isFinite(ms) ? Math.round(ms) : void 0;
+	}
+	const date = Date.parse(trimmed);
+	if (!Number.isNaN(date)) return Math.max(0, date - now);
 }
 function mapFinishReason(reason) {
 	if (reason === "tool-calls") return { kind: "tool-calls" };
@@ -1450,190 +1710,6 @@ function mapFinishReason(reason) {
 	return { kind: "stop" };
 }
 //#endregion
-//#region src/accounts.ts
-/**
-* Multi-account pool for the Command Code provider (host side).
-*
-* One Command Code subscription (e.g. the Go plan's 5-hour window) is
-* metered; a user with several subscriptions wants a request that hits one
-* account's limit to continue on the next account without a visible failure.
-* This module owns that rotation:
-*
-*   - {@link CommandCodeAccountPool.resolveKey} hands out the first account
-*     whose key is not currently marked exhausted, resolving each slot's key
-*     lazily (literal config key → credential seam → launch environment → the
-*     official CLI auth file for the default slot only).
-*   - {@link CommandCodeAccountPool.markRejected} records a 429 (rate limit,
-*     window unknown) or 401 (invalid key, disabled until the config changes)
-*     against the exact API key, so several slots sharing one key share one
-*     state.
-*   - When every account is marked, the pool probes each key's
-*     `/alpha/billing/credits` window limits (through the injected
-*     {@link CommandCodeAccountPoolDeps.probeWindow}): an account whose window
-*     no longer reports `exceeded` is revived, otherwise the pool throws a
-*     `RATE_LIMIT` error naming the earliest reset time.
-*
-* The pool is deliberately cordis-free (like the adapter): every host fact
-* arrives through injected thunks, so node tests can drive it directly.
-*
-* @module dsh-commandcode-provider/accounts
-*/
-/** A labeled, human-readable clock reading for error messages. */
-function clockLabel(ms) {
-	return new Date(ms).toLocaleString();
-}
-/**
-* Whether an account with this rotation state can serve a request right now.
-* `undefined` (never rejected) is usable; a cooldown becomes usable again
-* once its reset time passes; `unknown` (429, reset unprobed) and
-* `disabled` (401) are not.
-*/
-function accountUsable(state) {
-	if (state === void 0) return true;
-	if (state.kind === "cooldown") return state.until > 0 && Date.now() >= state.until;
-	return false;
-}
-/**
-* Pick the account that should serve now: the manually preferred slot when it
-* is usable, otherwise the first usable account in rotation order; undefined
-* when no account is usable. Shared by the pool (request path) and the plugin
-* entry (the usage view's active badge) so both always agree.
-*/
-function selectActiveAccount(accounts, preferredId) {
-	const usable = accounts.filter((account) => accountUsable(account.state));
-	if (preferredId !== void 0) {
-		const preferred = usable.find((account) => account.slot.id === preferredId);
-		if (preferred !== void 0) return preferred;
-	}
-	return usable[0];
-}
-/**
-* The account pool. Rotation state is keyed by API key (never logged), so two
-* slots resolving to the same credential share one mark, and a key changed in
-* the credentials service starts with a clean slate.
-*/
-var CommandCodeAccountPool = class {
-	deps;
-	/** Rotation state by API key. */
-	states = /* @__PURE__ */ new Map();
-	constructor(deps) {
-		this.deps = deps;
-	}
-	/**
-	* Resolve every slot's key, deduplicated by key (first slot wins). Slots
-	* without any resolvable key are omitted — they still appear in the
-	* settings page as unconfigured, they just cannot serve requests.
-	*/
-	async resolvedAccounts() {
-		const out = [];
-		const seen = /* @__PURE__ */ new Set();
-		for (const slot of this.deps.slots()) {
-			const key = await this.resolveSlotKey(slot);
-			if (key === void 0 || seen.has(key)) continue;
-			seen.add(key);
-			out.push({
-				slot,
-				key,
-				state: this.states.get(key)
-			});
-		}
-		return out;
-	}
-	/**
-	* Every slot paired with its resolved key and rotation state — NOT
-	* deduplicated: two slots sharing one credential both appear (the usage
-	* view reports them individually), while slots without any resolvable key
-	* are omitted. The serving path uses {@link resolvedAccounts} instead.
-	*/
-	async describeAccounts() {
-		const out = [];
-		for (const slot of this.deps.slots()) {
-			const key = await this.resolveSlotKey(slot);
-			if (key === void 0) continue;
-			out.push({
-				slot,
-				key,
-				state: this.states.get(key)
-			});
-		}
-		return out;
-	}
-	/**
-	* Hand out the first usable account's key (the manually preferred account
-	* when usable, else rotation order). Returns `undefined` when no account
-	* resolves any key at all (the caller then reports the missing credential).
-	* Throws `RATE_LIMIT` — naming the earliest window reset — or
-	* `INVALID_CREDENTIAL` when accounts exist but none can serve.
-	*
-	* `options.exclude` skips one key during the probe-revival pass: the
-	* rotation hook excludes the just-rejected key so a probe that clears its
-	* window cannot re-offer the same key within the same request (the adapter
-	* refuses already-tried keys; the next request picks the revived key up).
-	*/
-	async resolveKey(options) {
-		const accounts = await this.resolvedAccounts();
-		if (accounts.length === 0) return;
-		const chosen = selectActiveAccount(accounts, this.deps.preferredId?.());
-		if (chosen !== void 0) return this.pick(chosen);
-		await Promise.all(accounts.map(async (account) => {
-			if (account.state?.kind === "disabled") return;
-			if (options?.exclude !== void 0 && account.key === options.exclude) return;
-			const probe = await this.deps.probeWindow(account.key);
-			if (probe === void 0) return;
-			if (!probe.exceeded) this.states.delete(account.key);
-			else this.states.set(account.key, {
-				kind: "cooldown",
-				reason: account.state?.reason ?? "rate limited (429)",
-				until: probe.resetAt
-			});
-		}));
-		const revived = selectActiveAccount(await this.resolvedAccounts(), this.deps.preferredId?.());
-		if (revived !== void 0) return this.pick(revived);
-		const latest = await this.resolvedAccounts();
-		if (latest.filter((account) => account.state?.kind === "disabled").length === latest.length) throw new LlmError(`llm-commandcode: every configured Command Code account (${latest.length}) was rejected with 401 — check the stored API keys (Models page / settings) or the auth file`, "INVALID_CREDENTIAL");
-		const resets = latest.map((account) => account.state).filter((state) => state !== void 0 && state.kind === "cooldown" && state.until > 0).map((state) => state.until);
-		const earliest = resets.length > 0 ? Math.min(...resets) : 0;
-		throw new LlmError(`llm-commandcode: all ${latest.length} Command Code account(s) have exhausted their usage window` + (earliest > 0 ? `; the earliest window resets at ${clockLabel(earliest)}` : "") + " — requests will succeed again after the reset (or add another account)", "RATE_LIMIT");
-	}
-	/**
-	* Record a rejection against one key. `rate-limit` (429) marks the key
-	* exhausted with an unknown reset (probed lazily at the next resolution
-	* once every account is marked); `invalid-credential` (401) disables the
-	* key until the stored credential changes.
-	*/
-	markRejected(apiKey, rejection) {
-		if (rejection === "invalid-credential") this.states.set(apiKey, {
-			kind: "disabled",
-			reason: "invalid API key (401)",
-			until: 0
-		});
-		else this.states.set(apiKey, {
-			kind: "unknown",
-			reason: "rate limited (429)",
-			until: 0
-		});
-	}
-	/** One account's key: literal → credential seam → auth file (default slot). */
-	async resolveSlotKey(slot) {
-		if (slot.literal !== void 0 && slot.literal !== "") return slot.literal;
-		if (slot.ref !== void 0) {
-			const hit = await this.deps.resolveRef(slot.ref);
-			if (hit !== void 0 && hit !== "") return hit;
-		}
-		if (slot.allowAuthFile) {
-			const fromFile = this.deps.authFileKey();
-			if (fromFile !== void 0 && fromFile !== "") return fromFile;
-		}
-	}
-	/** Hand out the chosen account's key. */
-	pick(account) {
-		return {
-			key: account.key,
-			slot: account.slot
-		};
-	}
-};
-//#endregion
 //#region src/commands.ts
 /** Format a dollar amount. */
 function money(value) {