dsh-cline-pass 0.2.5 → 0.2.7

package/lib/adapter.js

@@ -54,11 +54,16 @@ export const DEFAULT_MAX_CONCURRENT_REQUESTS = 16
  */
 export const DEFAULT_CONTEXT_WINDOW = 128000
 /**
- * Conservative per-request output cap for a model the catalog does not
- * describe. It must stay well below the smallest published window, because
- * the default is materialized into requests whose callers omit `maxTokens`.
+ * Per-request output budget for a model whose caller names no `maxTokens`.
+ *
+ * A budget, not a ceiling: the harness materializes it into requests that omit
+ * `maxTokens` and reserves the same number as completion room before it compacts,
+ * so this is the number that decides how much of the window stays available to the
+ * conversation. 64k is far past any single response a tool-calling agent emits
+ * while keeping the reserve well under the point where it would start displacing
+ * the compaction ratio. The published ceiling clamps it per model.
  */
-export const DEFAULT_MAX_TOKENS = 32000
+export const DEFAULT_MAX_TOKENS = 64000
 /**
  * Request-image budget applied when the caller names none.
  *
@@ -469,9 +474,14 @@ function closeBlock(block) {
 /** Map a gateway error payload to a stable harness code. */
 export function streamErrorCode(message, status) {
   const detail = String(message ?? '')
-  if (isQuotaExceededError(detail)) return QUOTA_EXCEEDED_CODE
+  // The harness vocabulary covers balances, but Cline also refuses spent
+  // subscription windows. Require exhaustion, not just a window name, so a
+  // temporary error fetching weekly usage does not stand an account down.
+  const windowDetail = detail.replace(/[_-]/g, ' ')
+  const spentWindow = /\b(?:weekly|monthly|daily|(?:five|5)\s*hour|plan)\b[\s\S]{0,80}?\b(?:exceed\w*|exhaust\w*|reach\w*|used\s+up|out\s+of|deplet\w*|spent)\b|\b(?:exceed\w*|exhaust\w*|reach\w*|used\s+up|out\s+of|deplet\w*)\b[\s\S]{0,80}?\b(?:weekly|monthly|daily|(?:five|5)\s*hour|plan)\b[\s\S]{0,40}?\b(?:limit|cap|quota|credits|budget|allowance)\b/i.test(windowDetail)
+  if (status === 402 || isQuotaExceededError(detail) || spentWindow) return QUOTA_EXCEEDED_CODE
   if (/unauthorized|re-authenticate|invalid api key|401|403/i.test(detail)) return 'AUTH'
-  if (/429|rate limit|rate-?limited/i.test(detail)) return 'RATE_LIMIT'
+  if (status === 429 || /429|rate limit|rate-?limited/i.test(detail)) return 'RATE_LIMIT'
   if (isContextWindowExceededError(detail)) return CONTEXT_WINDOW_EXCEEDED_CODE
   if (status === 400) return 'INVALID_REQUEST'
   if (status !== undefined && status >= 500) return 'SERVER'
@@ -804,7 +814,9 @@ export class ClinePassAdapter extends LlmAdapter {
      * nothing is left, which is when the real error is raised below.
      */
     const refused = new Set()
-    for (const attempt of attempts) {
+    let attemptIndex = 0
+    while (attemptIndex < attempts.length) {
+      const attempt = attempts[attemptIndex++]
       const account = await this.config.resolveAccount({ exclude: [...refused] })
       if (account === undefined) break
       const body = injectPrefs(buildRequestBody(options, connection, images), meta, attempt)
@@ -860,12 +872,15 @@ export class ClinePassAdapter extends LlmAdapter {
           // nothing left and this error is raised unchanged.
           if (lastError.code === 'AUTH' || lastError.code === QUOTA_EXCEEDED_CODE) {
             refused.add(account.name)
+            // A spent account says nothing about this channel. Give the next
+            // account the full chain, including a lone auto route or strict pin.
+            attemptIndex = 0
             this.config.record(options.model, {
               provider: null,
               attempts: trace.map((row) => row.upstream),
               ms: Date.now() - startedAt,
               stream: true,
-              error: firstLine(lastError.message, 200),
+              error: lastError.message.replace(/\s+/g, ' ').trim().slice(0, 200),
               code: lastError.code,
               account: account.name,
             })
@@ -934,6 +949,7 @@ export class ClinePassAdapter extends LlmAdapter {
           }
           if (code === 'AUTH' || code === QUOTA_EXCEEDED_CODE) {
             refused.add(account.name)
+            attemptIndex = 0
             this.config.record(options.model, {
               provider: observed.provider,
               canonical: observed.canonical,

package/lib/catalog.js

@@ -165,11 +165,44 @@ function pick(configured, published, fallback) {
  */
 const SEAM_MODALITIES = new Set(['text', 'image'])
 
+/**
+ * The output budget to advertise for one model.
+ *
+ * `defaultMaxTokens` is what a request asks for, not what the model can emit, and
+ * the harness spends it twice: it fills a request's `max_tokens` from it, and it
+ * reserves the same number as completion room before deciding to compact. So the
+ * published output ceiling clamps the configured budget rather than becoming it.
+ * Reporting the ceiling instead reserves that much of every window — at the
+ * shipped 384k ceiling compaction moves from 80% of a 1M window down to 55% — and
+ * a ceiling equal to the window leaves the compaction policy no message budget at
+ * all, which it answers with an error rather than a reading.
+ *
+ * A budget is also never taken past half the window: reserving more than half of it
+ * leaves the conversation less room than a single response, which is the state the
+ * policy refuses. Every shipped model still clears the harness's headroom at that
+ * bound, so the guard only ever catches a hand-set value.
+ *
+ * @param budget - the configured per-request budget, when one is set.
+ * @param ceiling - the model's published output ceiling, when one is known.
+ * @param contextWindow - the resolved window, when one is known.
+ * @returns the tokens to advertise, or undefined when nothing constrains it.
+ */
+function resolveOutputBudget(budget, ceiling, contextWindow) {
+  const wanted = Number.isFinite(budget) && budget > 0 ? budget : undefined
+  const most = Number.isFinite(ceiling) && ceiling > 0 ? ceiling : undefined
+  const chosen = wanted === undefined ? most : most === undefined ? wanted : Math.min(wanted, most)
+  if (chosen === undefined) return undefined
+  const half = Number.isFinite(contextWindow) && contextWindow > 0 ? Math.floor(contextWindow / 2) : undefined
+  return half === undefined ? chosen : Math.min(chosen, half)
+}
+
 /**
  * Resolve the metadata seam fields for one model.
  *
  * Precedence per field: the configured override, then the shipped catalog, then
- * what the last official scan published, then the route-wide fallback.
+ * what the last official scan published, then the route-wide fallback. The output
+ * budget is the exception — there the published figure is a ceiling that bounds the
+ * configured budget, which is why it goes through {@link resolveOutputBudget}.
  *
  * The live scan sits below the shipped table rather than above it because the
  * shipped entry is curated: models.dev reports `audio`/`video`/`pdf`, and the
@@ -185,7 +218,11 @@ export function resolveModelMetadata(provider, model, override, fallback, discov
   const published = { ...(discovered ?? {}), ...(catalogEntry(model) ?? {}) }
   const name = pick(override?.name, published.name, model)
   const contextWindow = pick(override?.contextWindow, published.contextWindow, fallback.contextWindow)
-  const maxTokens = pick(override?.maxTokens, published.maxTokens, fallback.maxTokens)
+  const maxTokens = resolveOutputBudget(
+    fallback.maxTokens,
+    pick(override?.maxTokens, published.maxTokens, undefined),
+    contextWindow,
+  )
   const modality = pick(override?.input, published.input ?? published.inputModalities, undefined)
   const reasoning = override?.reasoning ?? published.reasoning ?? fallback.reasoning
   const offered = (modality ?? ['text']).filter((entry) => SEAM_MODALITIES.has(entry))

package/lib/client.js

@@ -250,6 +250,14 @@ window.__ModuleLoader__.load({
       '.cp-pill-pop{position:absolute;bottom:calc(100% + 8px);right:0;z-index:40;min-width:236px}',
       '.cp-pill-card{background:var(--dsw-alias-bg-layer-1);border:0.5px solid var(--dsw-alias-border-l2);border-radius:10px;box-shadow:0 8px 24px rgba(0,0,0,.16);padding:12px 14px;display:flex;flex-direction:column;gap:9px}',
       '.cp-pill-title{font-size:12.5px;font-weight:600;color:var(--dsw-alias-label-primary)}',
+      // The heading row carries the account switcher in a pool, so the title and
+      // the arrows sit on one line and the reading keeps the width below them.
+      '.cp-pill-head{display:flex;align-items:center;justify-content:space-between;gap:10px}',
+      '.cp-pill-nav{display:flex;align-items:center;gap:5px;min-width:0}',
+      '.cp-pill-arrow{border:0.5px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-secondary);border-radius:6px;width:18px;height:18px;line-height:1;font:inherit;font-size:12px;cursor:pointer;padding:0;flex:none}',
+      '.cp-pill-arrow:hover{background:var(--dsw-alias-bg-layer-3);color:var(--dsw-alias-label-primary)}',
+      '.cp-pill-who{font-size:11.5px;color:var(--dsw-alias-label-secondary);max-width:96px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}',
+      '.cp-pill-pos{font-size:11px;color:var(--dsw-alias-label-tertiary);font-variant-numeric:tabular-nums;flex:none}',
       '.cp-pill-row{display:flex;flex-direction:column;gap:4px}',
       '.cp-pill-row-head{display:flex;align-items:center;justify-content:space-between;gap:12px;font-size:12px;color:var(--dsw-alias-label-primary)}',
       '.cp-pill-percent{font-variant-numeric:tabular-nums;font-weight:600}',
@@ -1536,6 +1544,19 @@ window.__ModuleLoader__.load({
       ])
     }
 
+    /** Select cached quota without substituting another account's reading. */
+    function usageIndex(accounts, effectiveAccount, picked) {
+      if (accounts.length === 0) return -1
+      if (picked !== null) return Math.min(Math.max(picked, 0), accounts.length - 1)
+      // Undefined is an older host; an explicit empty string means no account.
+      if (effectiveAccount !== undefined) {
+        if (effectiveAccount === '') return -1
+        return accounts.findIndex((entry) => String(entry.account) === String(effectiveAccount))
+      }
+      const usable = accounts.findIndex((entry) => entry.ok === true)
+      return Math.max(0, usable)
+    }
+
     /**
      * The official quota card.
      *
@@ -1546,16 +1567,23 @@ window.__ModuleLoader__.load({
      * One reading per window: the official percentage, plus when it resets.
      */
     function UsageCard(props) {
-      const { t, usage, disabled, actions, unavailable, activeAccount, accountMode } = props
+      const { t, usage, disabled, actions, unavailable, activeAccount, accountMode, effectiveAccount } = props
       const fetched = Number(usage?.fetchedAt ?? 0) > 0
       const accounts = usage?.accounts ?? []
       // A pool is shown one account at a time. Stacking every account turned the
       // card into a wall of bars and pushed the one reading a user came for below
       // the fold, so the arrows — not a scroll — are what moves between accounts.
-      const [picked, setPicked] = React.useState(0)
+      //
+      // `null` means "still following the account a request would use". Opening on
+      // the first entry puts the reading a user came for behind an arrow, and the
+      // reading is per account, so the first entry answers a question about a key
+      // that may not be about to be spent. Once they page, their choice wins: the
+      // cursor moving underneath must not yank the card away mid-review.
+      const [picked, setPicked] = React.useState(null)
       // The selection is an index, so a shorter list — an account removed, or its
       // key deleted — can leave it past the end. Clamp instead of rendering nothing.
-      const index = accounts.length === 0 ? 0 : Math.min(Math.max(picked, 0), accounts.length - 1)
+      const index = usageIndex(accounts, effectiveAccount, picked)
+      const account = accounts[index]
       const step = (delta) => setPicked((accounts.length + index + delta) % accounts.length)
       const windowRow = (type, key, limit) => {
         const percent = Math.max(0, Math.min(100, Number(limit.percentUsed ?? 0)))
@@ -1626,13 +1654,17 @@ window.__ModuleLoader__.load({
       }
       let body
       if (!fetched) body = h('div', { key: 'wait', className: 'cp-muted' }, unavailable === true ? t('usageUnavailable') : t('usageLoading'))
+      else if (account === undefined && effectiveAccount !== undefined) {
+        body = h('div', { key: 'wait', className: 'cp-muted' }, effectiveAccount === '' || unavailable === true ? t('usageUnavailable') : t('usageLoading'))
+      }
       else if (accounts.length === 0) body = h('div', { key: 'none', className: 'cp-muted' }, t('usageEmpty'))
       // `index` is the account on screen; its own key remounts the block so the
       // windows never animate between two accounts' readings.
-      else body = h('div', { key: 'groups', className: 'cp-usage-groups' }, accountGroup(accounts[index], index))
+      else body = h('div', { key: 'groups', className: 'cp-usage-groups' }, accountGroup(account, index))
+      const name = account?.account ?? effectiveAccount
       const title = accounts.length > 1
         ? `${t('usageTitle')} · ${fill(t('accountsCount'), { n: accounts.length })}`
-        : `${t('usageTitle')}${accounts[0] ? ` · ${fill(t('usageAccount'), { name: accounts[0].account })}` : ''}`
+        : `${t('usageTitle')}${name ? ` · ${fill(t('usageAccount'), { name })}` : ''}`
       return h('div', { className: 'cp-card' }, [
         h('div', { key: 'title', className: 'cp-card-title' }, [
           h('span', { key: 'l' }, title),
@@ -1750,12 +1782,16 @@ window.__ModuleLoader__.load({
           key: 'usage',
           t,
           usage: data.usage,
-          // Which account the pool would use, resolved the same way the accounts
-          // card resolves it: an empty `activeAccount` means "first enabled", not
-          // "none", so the badge has to name that account rather than nobody.
-          activeAccount: data.activeAccount !== ''
-            ? data.activeAccount
-            : (data.accounts.find((account) => account.enabled)?.key ?? ''),
+          // Which account the pool would use. The host resolves it, so round-robin
+          // is covered too: `activeAccount` only decides single mode, and the badge
+          // claims to mark the account a request would actually spend. The fallback
+          // covers a state read from a host that predates the field.
+          activeAccount: data.effectiveAccount !== undefined && data.effectiveAccount !== ''
+            ? data.effectiveAccount
+            : (data.activeAccount !== ''
+              ? data.activeAccount
+              : (data.accounts.find((account) => account.enabled)?.key ?? '')),
+          effectiveAccount: data.effectiveAccount,
           accountMode: data.accountMode,
           unavailable: readFailed,
           disabled,
@@ -1891,13 +1927,28 @@ window.__ModuleLoader__.load({
     /** The pill itself: a compact reading, expanding into the window breakdown. */
     function UsagePillActive(props) {
       const t = props.t
+      // The panel's live snapshot, which an account switch updates at once. The
+      // reading below arrives on a timer, so the account is taken from here: a
+      // pill keyed to its own reading would keep naming the previous account for
+      // up to a minute after the user changed it.
+      const panel = React.useSyncExternalStore(props.store.subscribe, props.store.getSnapshot, props.store.getSnapshot)
       const [snapshot, setSnapshot] = React.useState(null)
       const [failed, setFailed] = React.useState(false)
       const [open, setOpen] = React.useState(false)
+      // Which account the popover reads. `null` keeps following the account a
+      // request would use; paging sets it and wins while the popover is open.
+      const [picked, setPicked] = React.useState(null)
       const root = React.useRef(null)
       // Kept across renders so the timer's callback always sees the latest one.
       const read = React.useRef(() => {})
 
+      // Closing forgets the page, so the next look starts from the account a
+      // request would use — which is what someone reopening after switching
+      // accounts expects to see, rather than the page they left behind.
+      React.useEffect(() => {
+        if (!open) setPicked(null)
+      }, [open])
+
       React.useEffect(() => {
         let alive = true
         let busy = false
@@ -1948,8 +1999,28 @@ window.__ModuleLoader__.load({
       }, [open])
 
       const accounts = snapshot?.value?.usage?.accounts ?? []
-      const account = accounts.find((entry) => entry.ok === true) ?? accounts[0]
-      const limits = account?.limits ?? []
+      // The account a request would use, not merely the first one that answered.
+      // Quota is per account, so showing a healthy reading from an account the
+      // next request will not touch is worse than showing nothing: it answers a
+      // question about a key that is not about to be spent. The host names the
+      // effective account because only it knows the cursor. A reading missing
+      // that account must not borrow another key's quota.
+      //
+      // The account is read from the panel's snapshot, not from this reading: a
+      // switch lands there at once, while a reading only arrives on a timer. The
+      // reading's own copy is the fallback for a state taken before the store had
+      // one.
+      //
+      // The selection is by index so the arrows can move it, and a cursor that
+      // advances underneath only moves the reading while the popover is closed:
+      // once the user pages, their choice holds for as long as it is open.
+      const effectiveAccount = panel?.data?.effectiveAccount !== undefined
+        ? panel.data.effectiveAccount
+        : snapshot?.value?.effectiveAccount
+      const index = usageIndex(accounts, effectiveAccount, picked)
+      const account = accounts[index]
+      const step = (delta) => setPicked((accounts.length + index + delta) % accounts.length)
+      const limits = account?.ok === true ? account.limits ?? [] : []
       const byType = new Map(limits.map((limit) => [String(limit.type), limit]))
       const percentOf = (type) => {
         const limit = byType.get(type)
@@ -1978,7 +2049,26 @@ window.__ModuleLoader__.load({
           h('button', { key: 'r', type: 'button', className: 'cp-pill-retry', onClick: () => read.current() }, t('usagePillRetry')),
         ])
         : h('div', { key: 'card', className: 'cp-pill-card' }, [
-          h('div', { key: 'title', className: 'cp-pill-title' }, t('usagePillTitle')),
+          h('div', { key: 'head', className: 'cp-pill-head' }, [
+            h('span', { key: 't', className: 'cp-pill-title' }, t('usagePillTitle')),
+            // A pool is read one account at a time, the way the settings card reads
+            // it: the quota is per account, so the arrows move between them rather
+            // than stacking every window at once. Absent with a single account,
+            // where there is nowhere to go.
+            accounts.length <= 1 || account === undefined ? null : h('span', { key: 'nav', className: 'cp-pill-nav' }, [
+              h('button', {
+                key: 'prev', type: 'button', className: 'cp-pill-arrow',
+                title: t('usagePrev'), 'aria-label': t('usagePrev'), onClick: () => step(-1),
+              }, '‹'),
+              h('span', { key: 'who', className: 'cp-pill-who', title: account?.displayName ?? account?.account ?? '' },
+                account?.displayName ?? account?.account ?? ''),
+              h('span', { key: 'pos', className: 'cp-pill-pos' }, `${index + 1} / ${accounts.length}`),
+              h('button', {
+                key: 'next', type: 'button', className: 'cp-pill-arrow',
+                title: t('usageNext'), 'aria-label': t('usageNext'), onClick: () => step(1),
+              }, '›'),
+            ]),
+          ]),
           rows === null
             ? h('div', { key: 'empty', className: 'cp-pill-fail' }, t('usagePillUnavailable'))
             : rows.map(([type, key, limit]) => {
@@ -2101,7 +2191,18 @@ window.__ModuleLoader__.load({
           // read has landed. Read it at render time rather than capturing it:
           // the pill can mount before the first read completes.
           route: () => controller.store.getSnapshot().data?.provider ?? NS,
-          readUsage: async () => await controller.call('usage', {}),
+          // The panel's own snapshot. Switching accounts is a panel action that
+          // updates this store at once, whereas a usage reading is only taken on
+          // mount and on a timer — so the account is read from here, and a pill
+          // keyed to its own reading names the previous account until the poll.
+          store: controller.store,
+          readUsage: async () => {
+            const value = await controller.call('usage', {})
+            // Keep the panel's snapshot as fresh as this reading, so whatever the
+            // host has just named is visible everywhere without waiting a minute.
+            controller.applyState(value)
+            return value
+          },
           t: translate,
         }),
       }, UsagePill))

package/lib/index.js

@@ -17,7 +17,7 @@
  */
 import z from '@deepseek-ai/schemastery'
 import { credentialRef } from '@deepseek-ai/dsh-credentials'
-import { assertUsableApiKey, errorChain, LlmError } from '@deepseek-ai/dsh-llm'
+import { assertUsableApiKey, errorChain, LlmError, QUOTA_EXCEEDED_CODE } from '@deepseek-ai/dsh-llm'
 import { launchEnvironmentOf } from '@deepseek-ai/dsh-launch-environment'
 import {
   ClinePassAdapter,
@@ -89,6 +89,12 @@ export const AccountProfile = z.object({
 export const ModelProfile = z.object({
   name: z.string().default(''),
   contextWindow: z.number().default(0),
+  /**
+   * This model's output ceiling, overriding the published one. It bounds what a
+   * request may ask for; it is not itself the ask, because the harness reserves the
+   * asked-for budget as completion room before it compacts. Raise `defaultMaxTokens`
+   * to spend more of the window on output.
+   */
   maxTokens: z.number().default(0),
   reasoning: z.union([z.boolean(), z.const(undefined)]).default(undefined),
   input: z.array(z.string()).default([]),
@@ -135,6 +141,15 @@ export const Config = z.object({
   perModel: markVolatile(z.dict(PinProfile).default({})),
   reasoningModels: z.boolean().default(true),
   defaultContextWindow: z.number().default(DEFAULT_CONTEXT_WINDOW),
+  /**
+   * What one request asks for as output, and therefore how much of the window the
+   * harness holds back as completion room before it compacts.
+   *
+   * A policy rather than a ceiling: the model's published output capacity is much
+   * larger, and reporting that here reserves it on every request — at the shipped
+   * 384k figure a 1M window compacts at 55% instead of the 80% the threshold ratio
+   * asks for. Each model's published ceiling clamps whatever is set here.
+   */
   defaultMaxTokens: z.number().default(DEFAULT_MAX_TOKENS),
   streamIdleTimeoutMs: z.number().default(DEFAULT_STREAM_IDLE_TIMEOUT_MS),
   /**
@@ -227,7 +242,7 @@ export function apply(ctx, config) {
    * by the channel retry already, and standing an account down for it would cost
    * capacity the request never proved was gone.
    */
-  const COOLDOWN_MS = { QUOTA_EXCEEDED: 15 * 60_000, AUTH: 30 * 60_000 }
+  const COOLDOWN_MS = { [QUOTA_EXCEEDED_CODE]: 15 * 60_000, AUTH: 30 * 60_000 }
 
   /**
    * Resolve the configured accounts.
@@ -270,27 +285,53 @@ export function apply(ctx, config) {
     return ambient !== undefined && ambient.value.length > 0 ? ambient.value : undefined
   }
 
-  /** Pick the account for the next request and resolve its key. */
-  const resolveAccount = async ({ exclude = [] } = {}) => {
-    const cfg = live()
+  /**
+   * The enabled accounts in the order the router would consider them.
+   *
+   * Shared by the pick and by the read-only peek the panel uses, because the two
+   * have to agree: the peek is what the usage pill shows, and a pill that named
+   * an account the next request would not use is exactly the bug it exists to
+   * avoid. Keeping one ordering is also what stops the cooldown rule from being
+   * applied in one place and forgotten in the other.
+   */
+  const candidateAccounts = (exclude = []) => {
     const skip = new Set(exclude.map(String))
     const enabled = accountProfiles().filter(([, profile]) => profile.enabled)
-    if (enabled.length === 0) {
-      throw new LlmError('cline-pass: every configured account is disabled; enable one or add another', 'MISSING_CREDENTIAL')
-    }
     // Accounts that just refused a request are stood down for a while, so a pool
     // does not spend one failed round trip per call rediscovering the same
     // exhausted key. When every candidate is cooling the oldest one is used
     // anyway: a window can reset, and refusing to try at all would be worse.
     const now = Date.now()
     const eligible = enabled.filter(([key]) => !skip.has(key) && (cooling.get(key) ?? 0) <= now)
-    const pool = eligible.length > 0
-      ? eligible
-      : enabled.filter(([key]) => !skip.has(key))
-    if (pool.length === 0) return undefined
-    const ordered = eligible.length > 0
-      ? pool
-      : [...pool].sort((left, right) => (cooling.get(left[0]) ?? 0) - (cooling.get(right[0]) ?? 0))
+    if (eligible.length > 0) return eligible
+    const pool = enabled.filter(([key]) => !skip.has(key))
+    return [...pool].sort((left, right) => (cooling.get(left[0]) ?? 0) - (cooling.get(right[0]) ?? 0))
+  }
+
+  /**
+   * The account the next request would use, without consuming a round-robin turn.
+   *
+   * Reading quota is not a request that advances the cursor, so asking which
+   * account is in line must not move it either — otherwise showing the user their
+   * quota would change which account answers them.
+   */
+  const effectiveAccount = () => {
+    const cfg = live()
+    const ordered = candidateAccounts()
+    if (ordered.length === 0) return ''
+    if (cfg.accountMode === 'roundrobin' && ordered.length > 1) return ordered[roundRobin % ordered.length][0]
+    return (ordered.find(([key]) => key === cfg.activeAccount) ?? ordered[0])[0]
+  }
+
+  /** Pick the account for the next request and resolve its key. */
+  const resolveAccount = async ({ exclude = [] } = {}) => {
+    const cfg = live()
+    const enabled = accountProfiles().filter(([, profile]) => profile.enabled)
+    if (enabled.length === 0) {
+      throw new LlmError('cline-pass: every configured account is disabled; enable one or add another', 'MISSING_CREDENTIAL')
+    }
+    const ordered = candidateAccounts(exclude)
+    if (ordered.length === 0) return undefined
     let picked
     if (cfg.accountMode === 'roundrobin' && ordered.length > 1) {
       picked = ordered[roundRobin % ordered.length]
@@ -556,6 +597,11 @@ export function apply(ctx, config) {
       }
     })),
     readCredential: async (ref) => (await resolveKey(credentialRef(ref))) ?? '',
+    // The account a request would use right now. The panel reads this so its
+    // usage surfaces can name the account a request would actually spend, which
+    // is what a pool makes non-obvious: `activeAccount` is only the single-mode
+    // choice, and in round-robin it is not the account in line at all.
+    effectiveAccount,
     usageAccounts,
     setCredential: async (ref, value) => {
       const credentials = ctx.get('credentials')

package/lib/panel.js

@@ -130,6 +130,11 @@ export function createPanel({ control, engine, store }) {
       settingsAvailable: control.settingsAvailable(),
       accountMode: config.accountMode === 'roundrobin' ? 'roundrobin' : 'single',
       activeAccount: String(config.activeAccount ?? ''),
+      // The account a request would use, which in a pool is not the configured
+      // one: `activeAccount` only decides single mode, and round-robin picks from
+      // the cursor. Usage is per account, so a reading has to name the account it
+      // belongs to or the surface showing it describes someone else's quota.
+      effectiveAccount: control.effectiveAccount(),
       accounts,
       ready: usable,
       models,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cline-pass",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "Self-contained Cline Pass provider for dsh: register Cline Pass subscription models on the harness LLM seam, enumerate and validate the upstream channels behind each model, pin or exclude them with failover, and drive an account pool. No proxy process and no external cline-pass-switcher install required.",
   "type": "module",
   "main": "lib/index.js",
@@ -18,7 +18,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "node test/smoke.mjs && node test/client.mjs && node test/pin-adherence.mjs",
+    "test": "node test/smoke.mjs && node test/client.mjs && node test/pin-adherence.mjs && node test/account-failover.mjs",
     "test:protocol": "node test/pin-adherence.mjs",
     "test:client": "node test/client.mjs",
     "test:mount": "node test/mount.mjs",