dsh-codex-subscription 1.11.4 → 1.12.1-beta.0

package/AGENTS.md

@@ -6,7 +6,7 @@ Use this guide when a user asks an Agent to install, update, verify, or remove
 ## Safety
 
 - Confirm the target DSH installation and profile. Use `web` only when it is the user's target.
-- Use the exact `1.11.4` package below; do not install a moving branch.
+- Use the exact `1.12.0` package below; do not install a moving branch.
 - Never print OAuth credentials, account IDs, authorization callbacks, or credential-store contents.
 - Preserve the DSH profile, unrelated plugins, sessions, and saved sign-in.
 - Do not start, stop, or restart DSH without explicit permission.
@@ -34,13 +34,13 @@ For an official DSH installation run through npm, keep the complete `npx` prefix
 run command does not create a global `dsh` command:
 
 ```sh
-npx -y @deepseek-ai/dsh@0.1.1-rc.2 plugin --profile web add dsh-codex-subscription@1.11.4
+npx -y @deepseek-ai/dsh@0.1.1-rc.2 plugin --profile web add dsh-codex-subscription@1.12.0
 ```
 
 With an existing global `dsh` command:
 
 ```sh
-dsh plugin --profile web add dsh-codex-subscription@1.11.4
+dsh plugin --profile web add dsh-codex-subscription@1.12.0
 ```
 
 Use the same `add` command to update or repair. This is the complete package-changing operation.
@@ -58,7 +58,7 @@ dsh --profile web --dump-config
 
 For the official npm route, run the same checks with `npx -y @deepseek-ai/dsh@0.1.1-rc.2` in place of `dsh`.
 
-1. `dsh-codex-subscription` version `1.11.4` appears exactly once.
+1. `dsh-codex-subscription` version `1.12.0` appears exactly once.
 2. `codex-subscription` appears exactly once in the composed config.
 3. No unrelated plugin or profile was changed and DSH was not restarted.
 

package/README.en.md

@@ -133,7 +133,7 @@ Restart DSH manually after installation, then:
 
 ## Features
 
-- ChatGPT OAuth sign-in with credentials kept on the host;
+- ChatGPT OAuth sign-in with credentials kept on the host; manually add, switch, and remove accounts without automatic rotation or quota pooling;
 - Codex models and Beta image generation/editing directly inside DSH conversations;
 - A clear global choice between DSH default search and Codex subscription search; it applies to every model and session rather than following the selected model;
 - Actual backend-provided quota, reset time, and freshness;
@@ -153,7 +153,7 @@ The plugin can follow an existing HTTPS proxy from the process environment or op
   <img src="https://raw.githubusercontent.com/WSL043/dsh-codex-subscription/main/docs/assets/composer-quota-en.png" width="800" alt="Codex quota inside the composer">
 </p>
 
-Choose Off, Percent, Progress bar, or Beta Runway in Settings. The compact display appears only for a selected Codex model. Runway is opt-in and estimates the current pace only from official remaining-percentage observations kept in local runtime memory; it stays quiet with insufficient evidence and recalibrates after a reset, account change, or disable.
+Choose Off, Percent, Progress bar, or Beta Runway in Settings. The compact display appears only for a selected Codex model. Runway is opt-in and estimates pace only from official remaining-percentage observations. It needs at least three samples; sustained high use usually produces a range in 5–10 minutes, while low use takes longer or reports a stable state. Non-sensitive observations from the last 24 hours are kept locally so calibration can continue after restart; a quota reset, account switch, or disabling the feature starts a new calibration period.
 Standard Codex uses the lowest remaining window returned by the service; Spark uses its independent quota. The plugin does not hard-code a
 “5-hour + weekly” layout or invent Credits and spending caps that the service did not return.
 

package/README.md

@@ -134,7 +134,7 @@ dsh --profile web --dump-config
 
 ## 功能
 
-- ChatGPT OAuth 登录，凭据保留在本机；
+- ChatGPT OAuth 登录，凭据保留在本机；可手动添加、切换和移除多个账号，不会自动轮换或合并额度；
 - Codex 模型和 Beta 图片生成与编辑直接出现在 DSH 会话中；
 - 搜索来源是全局设置，可在 DSH 默认搜索与 Codex 订阅搜索之间切换；它对所有模型和会话生效，不会随当前模型自动切换；
 - 设置页显示服务端返回的额度、重置时间和更新时间；
@@ -154,7 +154,7 @@ dsh --profile web --dump-config
   <img src="https://raw.githubusercontent.com/WSL043/dsh-codex-subscription/main/docs/assets/composer-quota.png" width="800" alt="中文 DSH 输入框内的 Codex 剩余额度进度条">
 </p>
 
-可在设置中选择关闭、百分比、进度条或 Beta 续航预测；紧凑额度只在选择 Codex 模型时显示。续航预测仅在用户主动选择后，根据本机运行内存中观察到的官方剩余百分比估算当前消耗速度；样本不足时保持安静，额度重置、登录变化或关闭功能后会重新校准。普通 Codex 使用服务端返回窗口中剩余最少的一项，
+可在设置中选择关闭、百分比、进度条或 Beta 续航预测；紧凑额度只在选择 Codex 模型时显示。续航预测仅在用户主动选择后，根据官方剩余百分比估算当前消耗速度。它至少需要 3 个样本；持续高消耗时通常 5–10 分钟即可给出范围，消耗较低时会延长观察或显示稳定。最近 24 小时的无敏感信息观测会保存在本机，重启后可以继续校准；额度重置、账号切换或关闭功能会开启新的校准周期。普通 Codex 使用服务端返回窗口中剩余最少的一项，
 Spark 使用独立额度。插件不会写死“5 小时 + 每周”，也不会虚构服务端没有返回的 Credits 或消费上限。
 
 ### 安全使用额度重置

package/compatibility.json

@@ -9,6 +9,7 @@
   ],
   "previews": [
     "0.1.2-alpha.2",
-    "0.1.2-alpha.3"
+    "0.1.2-alpha.3",
+    "0.1.2-alpha.4"
   ]
 }

package/lib/client.js

@@ -245,6 +245,13 @@ window.__ModuleLoader__.load({
 			browserLogin: "浏览器登录",
 			deviceLogin: "设备代码登录",
 			logout: "退出登录",
+			addAccount: "添加账号",
+			accountLabel: "账号名称",
+			switchAccount: "切换",
+			removeAccount: "移除",
+			removeConfirm: "确认移除",
+			removeCancel: "保留",
+			signOutAll: "退出全部账号",
 			cancel: "取消",
 			submit: "提交授权码",
 			openLogin: "打开登录页",
@@ -329,7 +336,7 @@ window.__ModuleLoader__.load({
 			quickQuotaBar: "进度条",
 			quickQuotaForecast: "续航预测",
 			quickQuotaBeta: "Beta",
-			quickQuotaForecastHint: "至少观察 30 分钟且额度变化 1% 后显示；重启 DSH 后重新校准。",
+			quickQuotaForecastHint: "按消耗速度自适应校准；高消耗通常 5–10 分钟可估算，低消耗会显示用量稳定。进度会在本机保留。",
 			contextTitle: "上下文窗口",
 			contextStandard: "标准",
 			contextStandardHint: "使用模型目录默认值；官方 Agent 预设会自动管理上下文。",
@@ -421,6 +428,13 @@ window.__ModuleLoader__.load({
 			browserLogin: "Browser sign-in",
 			deviceLogin: "Device-code sign-in",
 			logout: "Sign out",
+			addAccount: "Add account",
+			accountLabel: "Account name",
+			switchAccount: "Switch",
+			removeAccount: "Remove",
+			removeConfirm: "Confirm remove",
+			removeCancel: "Keep",
+			signOutAll: "Sign out all",
 			cancel: "Cancel",
 			submit: "Submit authorization code",
 			openLogin: "Open sign-in page",
@@ -505,7 +519,7 @@ window.__ModuleLoader__.load({
 			quickQuotaBar: "Progress bar",
 			quickQuotaForecast: "Runway",
 			quickQuotaBeta: "Beta",
-			quickQuotaForecastHint: "Appears after at least 30 minutes and a 1% quota change; restarting DSH recalibrates it.",
+			quickQuotaForecastHint: "Calibrates to actual consumption: high use is usually estimated in 5–10 minutes, while low use is shown as stable. Progress is kept locally.",
 			contextTitle: "Context window",
 			contextStandard: "Standard",
 			contextStandardHint: "Use the model catalog default; official agent presets manage context automatically.",
@@ -602,6 +616,7 @@ window.__ModuleLoader__.load({
 .codexSubscriptionSwitch{position:relative;flex:0 0 auto;width:32px;height:18px;padding:0;border:1px solid var(--dsw-alias-border-l3);border-radius:999px;background:var(--dsw-alias-bg-module-platform);cursor:pointer}.codexSubscriptionSwitch:disabled{cursor:not-allowed;opacity:.5}.codexSubscriptionSwitch[aria-checked=true]{background:var(--dsw-alias-label-secondary);border-color:var(--dsw-alias-label-secondary)}.codexSubscriptionSwitchKnob{position:absolute;top:2px;left:2px;width:12px;height:12px;border-radius:50%;background:var(--dsw-alias-bg-layer-1);transition:transform 120ms var(--ds-ease-in-out)}.codexSubscriptionSwitch[aria-checked=true] .codexSubscriptionSwitchKnob{transform:translateX(14px)}
 .codexSubscriptionSearch{display:flex;flex-direction:column;gap:7px}.codexSubscriptionSearchChoices{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:6px}.codexSubscriptionSearchChoice{display:grid;grid-template-columns:14px minmax(0,1fr);align-items:center;column-gap:8px;min-width:0;border:1px solid var(--dsw-alias-border-l2);border-radius:10px;background:var(--dsw-alias-bg-module-platform);color:var(--dsw-alias-label-primary);padding:9px 10px;text-align:left;cursor:pointer}.codexSubscriptionSearchChoice:has(input:disabled){cursor:not-allowed;opacity:.5}.codexSubscriptionSearchChoice:has(input:checked){border-color:var(--dsw-alias-label-primary);background:var(--dsw-alias-bg-layer-2)}.codexSubscriptionSearchChoice:has(input:focus-visible){outline:2px solid var(--dsw-alias-border-l3);outline-offset:2px}.codexSubscriptionSearchInput{width:14px;height:14px;margin:0;accent-color:var(--dsw-alias-label-primary);cursor:inherit}.codexSubscriptionSearchCopy{display:block;min-width:0;pointer-events:none}.codexSubscriptionSearchCopy strong,.codexSubscriptionSearchCopy span{display:block}.codexSubscriptionSearchCopy strong{font-size:12px;line-height:18px;font-weight:500;color:var(--dsw-alias-label-secondary)}.codexSubscriptionSearchChoice:has(input:checked) strong{color:var(--dsw-alias-label-primary)}.codexSubscriptionSearchCopy span{font-size:11px;line-height:16px;color:var(--dsw-alias-label-tertiary)}.codexSubscriptionDivider{height:1px;background:var(--dsw-alias-border-l2)}
 .codexSubscriptionAccountRow,.codexSubscriptionSectionHead{display:flex;align-items:center;justify-content:space-between;gap:12px}.codexSubscriptionStatus{display:flex;align-items:center;gap:8px;font-size:14px;line-height:22px;font-weight:500}
+.codexSubscriptionAccounts{display:flex;flex-direction:column;border-top:1px solid var(--dsw-alias-border-l2)}.codexSubscriptionAccount{display:flex;align-items:center;justify-content:space-between;gap:10px;min-height:42px;border-bottom:1px solid var(--dsw-alias-border-l2);font-size:13px}.codexSubscriptionAccount:last-child{border-bottom:0}.codexSubscriptionAccount[data-active=true]>span{font-weight:600}.codexSubscriptionFlow label{display:flex;flex-direction:column;gap:6px;font-size:12px;color:var(--dsw-alias-label-secondary)}
 .codexSubscriptionDot{width:8px;height:8px;border-radius:50%;background:var(--dsw-alias-label-dimmed)}.codexSubscriptionDot[data-state=connected]{background:var(--dsw-alias-state-success-primary)}.codexSubscriptionDot[data-state=disconnected]{background:var(--dsw-alias-state-error-primary)}
 .codexSubscriptionActions{display:flex;align-items:center;gap:8px;flex-wrap:wrap}.codexSubscriptionFlow{display:flex;flex-direction:column;gap:10px;padding:12px 14px;border-radius:10px;background:var(--dsw-alias-bg-module-platform)}
 .codexSubscriptionFlow p{font-size:13px;line-height:20px;color:var(--dsw-alias-label-secondary)}.codexSubscriptionCode{width:max-content;max-width:100%;font:600 16px/22px ui-monospace,SFMono-Regular,Consolas,monospace;letter-spacing:.08em;overflow-wrap:anywhere}
@@ -1873,6 +1888,9 @@ window.__ModuleLoader__.load({
 		function AccountCard({ rpc, t, account, setAccount, onSignedOut }) {
 			const [flow, setFlow] = (0, react.useState)();
 			const [manualCode, setManualCode] = (0, react.useState)("");
+			const [adding, setAdding] = (0, react.useState)(false);
+			const [accountLabel, setAccountLabel] = (0, react.useState)("");
+			const [removeId, setRemoveId] = (0, react.useState)();
 			const [busy, setBusy] = (0, react.useState)(false);
 			const [error, setError] = (0, react.useState)();
 			const call = (endpoint, payload = {}) => rpc.call(CHANNEL, endpoint, payload).then(unwrap);
@@ -1883,35 +1901,52 @@ window.__ModuleLoader__.load({
 					"cancelled"
 				].includes(flow.phase)) return void 0;
 				const timer = window.setInterval(() => {
-					readLoginProgress({
+					(adding ? call("login/status", { id: flow.id }).then(async (nextFlow) => ({
+						flow: nextFlow,
+						account: nextFlow.phase === "authenticated" ? await call("status") : void 0
+					})) : readLoginProgress({
 						flow,
 						readFlow: () => call("login/status", { id: flow.id }),
 						readAccount: () => call("status")
-					}).then((next) => {
+					})).then((next) => {
 						setFlow(next.flow);
 						setError(void 0);
 						if (next.account !== void 0) {
 							setAccount(next.account);
+							onSignedOut();
+							setAdding(false);
+							setAccountLabel("");
+							setFlow(void 0);
 							notifyQuickQuota();
 						}
 					}).catch(() => setError(t("failed")));
 				}, 800);
 				return () => window.clearInterval(timer);
-			}, [flow?.id, flow?.phase]);
-			const begin = (method) => {
+			}, [
+				flow?.id,
+				flow?.phase,
+				adding
+			]);
+			const begin = (method, label) => {
 				setFlow(void 0);
 				setBusy(true);
 				setError(void 0);
 				call("login/start", {
 					method,
-					openExternal: true
+					openExternal: true,
+					...label === void 0 ? {} : { label }
 				}).then(setFlow).catch(() => setError(t("failed"))).finally(() => setBusy(false));
 			};
 			const cancel = () => {
 				if (flow?.id === void 0) return;
 				setBusy(true);
 				call("login/cancel", { id: flow.id }).then((next) => {
-					setFlow(next);
+					setFlow(adding ? void 0 : next);
+					if (adding) {
+						setAdding(false);
+						setAccountLabel("");
+					}
+					if (adding) return void 0;
 					return call("status").then((account) => {
 						if (account.authenticated === true) {
 							setAccount(account);
@@ -1948,8 +1983,38 @@ window.__ModuleLoader__.load({
 					notifyQuickQuota();
 				}).catch(() => setError(t("failed"))).finally(() => setBusy(false));
 			};
+			const selectAccount = (id) => {
+				setBusy(true);
+				setError(void 0);
+				call("account/select", { id }).then((next) => {
+					setAccount(next);
+					onSignedOut();
+					notifyQuickQuota();
+				}).catch(() => setError(t("failed"))).finally(() => setBusy(false));
+			};
+			const removeAccount = (id) => {
+				if (removeId !== id) {
+					setRemoveId(id);
+					return;
+				}
+				setBusy(true);
+				setError(void 0);
+				call("account/remove", { id }).then((next) => {
+					setAccount(next);
+					setRemoveId(void 0);
+					onSignedOut();
+					notifyQuickQuota();
+				}).catch(() => setError(t("failed"))).finally(() => setBusy(false));
+			};
 			const signedIn = account?.authenticated === true;
 			const accountReady = account !== void 0;
+			const accounts = account?.accounts ?? [];
+			const activeAccount = accounts.find((candidate) => candidate.active);
+			const loginVisible = flow !== void 0 && ![
+				"authenticated",
+				"failed",
+				"cancelled"
+			].includes(flow.phase);
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				className: "codexSubscriptionCard",
 				children: [
@@ -1963,16 +2028,26 @@ window.__ModuleLoader__.load({
 								className: "codexSubscriptionDot",
 								"data-state": accountReady ? signedIn ? "connected" : "disconnected" : "loading",
 								"aria-hidden": "true"
-							}), accountReady ? signedIn ? t("connected") : t("disconnected") : t("accountLoading")]
+							}), accountReady ? signedIn ? activeAccount?.label ?? t("connected") : t("disconnected") : t("accountLoading")]
 						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 							className: "codexSubscriptionActions",
-							children: signedIn ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+							children: signedIn ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
 								type: "button",
 								variant: "outline",
-								disabled: busy,
+								disabled: busy || loginVisible,
+								onClick: () => {
+									setFlow(void 0);
+									setAdding(true);
+									setAccountLabel(`Account ${accounts.length + 1}`);
+								},
+								children: t("addAccount")
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+								type: "button",
+								variant: "outline",
+								disabled: busy || loginVisible,
 								onClick: logout,
-								children: t("logout")
-							}) : accountReady && (flow === void 0 || ["failed", "cancelled"].includes(flow.phase)) ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+								children: t("signOutAll")
+							})] }) : accountReady && (flow === void 0 || ["failed", "cancelled"].includes(flow.phase)) ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
 								type: "button",
 								variant: "primary",
 								disabled: busy,
@@ -1987,7 +2062,77 @@ window.__ModuleLoader__.load({
 							})] }) : null
 						})]
 					}),
-					!signedIn && flow?.phase === "waiting_device" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					signedIn && accounts.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "codexSubscriptionAccounts",
+						children: accounts.map((candidate) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: "codexSubscriptionAccount",
+							"data-active": candidate.active,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: candidate.label }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "codexSubscriptionActions",
+								children: [
+									candidate.active ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+										type: "button",
+										variant: "outline",
+										disabled: busy || loginVisible,
+										onClick: () => selectAccount(candidate.id),
+										children: t("switchAccount")
+									}),
+									accounts.length > 1 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+										type: "button",
+										variant: "outline",
+										disabled: busy || loginVisible,
+										onClick: () => removeAccount(candidate.id),
+										children: removeId === candidate.id ? t("removeConfirm") : t("removeAccount")
+									}) : null,
+									removeId === candidate.id ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+										type: "button",
+										variant: "outline",
+										disabled: busy,
+										onClick: () => setRemoveId(void 0),
+										children: t("removeCancel")
+									}) : null
+								]
+							})]
+						}, candidate.id))
+					}) : null,
+					signedIn && adding && flow === void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "codexSubscriptionFlow",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [t("accountLabel"), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Input, {
+							className: "codexSubscriptionInput",
+							value: accountLabel,
+							maxLength: 48,
+							onChange: (event) => setAccountLabel(event.currentTarget.value)
+						})] }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: "codexSubscriptionActions",
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+									type: "button",
+									variant: "primary",
+									disabled: busy || accountLabel.trim() === "",
+									onClick: () => begin("browser", accountLabel.trim()),
+									children: t("browserLogin")
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+									type: "button",
+									variant: "outline",
+									disabled: busy || accountLabel.trim() === "",
+									onClick: () => begin("device_code", accountLabel.trim()),
+									children: t("deviceLogin")
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+									type: "button",
+									variant: "outline",
+									disabled: busy,
+									onClick: () => {
+										setAdding(false);
+										setAccountLabel("");
+									},
+									children: t("cancel")
+								})
+							]
+						})]
+					}) : null,
+					flow?.phase === "waiting_device" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "codexSubscriptionFlow",
 						children: [
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("deviceHint") }),
@@ -2004,7 +2149,7 @@ window.__ModuleLoader__.load({
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("waiting") })
 						]
 					}) : null,
-					!signedIn && flow?.phase === "waiting_input" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("form", {
+					flow?.phase === "waiting_input" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("form", {
 						className: "codexSubscriptionFlow",
 						onSubmit: submit,
 						children: [
@@ -2033,7 +2178,7 @@ window.__ModuleLoader__.load({
 							})
 						]
 					}) : null,
-					!signedIn && flow !== void 0 && ["starting", "waiting_browser"].includes(flow.phase) ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					flow !== void 0 && ["starting", "waiting_browser"].includes(flow.phase) ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "codexSubscriptionFlow",
 						children: [
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("waiting") }),

package/lib/index.js

@@ -1,7 +1,9 @@
-import { credentialRef } from "@deepseek-ai/dsh-credentials";
+import * as dshCredentials from "@deepseek-ai/dsh-credentials";
+import { dshHomePath, resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import { LlmError, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import z from "@deepseek-ai/schemastery";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { execFile, spawn } from "node:child_process";
 import { request } from "node:https";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -10,13 +12,269 @@ import { promisify } from "node:util";
 import { HttpsProxyAgent } from "https-proxy-agent";
 import { openaiCodexProvider as createOpenAICodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
 import { createModels } from "@earendil-works/pi-ai";
-import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { WebError } from "@deepseek-ai/dsh-web";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { constants } from "node:fs";
-import { lstat, mkdir, open, readFile, rename, rm } from "node:fs/promises";
+import { lstat, mkdir, open, readFile, rename, rm, stat } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
-import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
+//#region src/account-vault.js
+const VERSION = 1;
+const DEFAULT_LABEL = "Account 1";
+const clone$1 = (value) => value === void 0 ? void 0 : structuredClone(value);
+function assertOAuthCredential$1(value) {
+	if (value === null || typeof value !== "object" || value.type !== "oauth" || typeof value.access !== "string" || value.access.length === 0 || typeof value.refresh !== "string" || value.refresh.length === 0 || typeof value.expires !== "number" || !Number.isFinite(value.expires)) throw new Error("Codex account vault received a malformed OAuth credential");
+	return clone$1(value);
+}
+function parseOAuthCredential$1(value) {
+	try {
+		return assertOAuthCredential$1(JSON.parse(value));
+	} catch (error) {
+		if (error?.message === "Codex account vault received a malformed OAuth credential") throw error;
+		throw new Error("Codex account vault contains malformed OAuth JSON", { cause: error });
+	}
+}
+function normalizeLabel(value) {
+	if (typeof value !== "string") throw new Error("Codex account label must be text");
+	const label = value.trim().replace(/\s+/gu, " ");
+	if (label.length === 0 || label.length > 48) throw new Error("Codex account label must contain 1 to 48 characters");
+	return label;
+}
+function assertVaultRecord(record) {
+	if (record?.kind !== "grant" || record.payload?.version !== VERSION || typeof record.payload.activeId !== "string" || !Array.isArray(record.payload.accounts) || record.payload.accounts.length === 0) throw new Error("Codex account vault contains a malformed grant record");
+	const ids = /* @__PURE__ */ new Set();
+	const accounts = record.payload.accounts.map((account) => {
+		if (account === null || typeof account !== "object" || typeof account.id !== "string" || account.id.length === 0 || ids.has(account.id)) throw new Error("Codex account vault contains a malformed account id");
+		ids.add(account.id);
+		return {
+			id: account.id,
+			label: normalizeLabel(account.label),
+			credential: assertOAuthCredential$1(account.credential)
+		};
+	});
+	if (!ids.has(record.payload.activeId)) throw new Error("Codex account vault active account is missing");
+	const legacyAccountId = record.payload.legacyAccountId;
+	if (legacyAccountId !== void 0 && !ids.has(legacyAccountId)) throw new Error("Codex account vault legacy account is missing");
+	return {
+		version: VERSION,
+		activeId: record.payload.activeId,
+		legacyAccountId,
+		accounts
+	};
+}
+const grant = (payload) => ({
+	kind: "grant",
+	payload
+});
+var PendingOAuthCredentialStore = class {
+	#credential;
+	async read(providerId) {
+		if (providerId !== "openai-codex") throw new Error("Pending Codex login received an unknown provider");
+		return clone$1(this.#credential);
+	}
+	async list() {
+		return this.#credential === void 0 ? [] : [{
+			providerId: "openai-codex",
+			type: "oauth"
+		}];
+	}
+	async modify(providerId, update) {
+		if (providerId !== "openai-codex") throw new Error("Pending Codex login received an unknown provider");
+		const next = await update(clone$1(this.#credential));
+		if (next !== void 0) this.#credential = assertOAuthCredential$1(next);
+		return clone$1(this.#credential);
+	}
+	async delete(providerId) {
+		if (providerId !== "openai-codex") throw new Error("Pending Codex login received an unknown provider");
+		this.#credential = void 0;
+	}
+	credential() {
+		return clone$1(this.#credential);
+	}
+};
+/**
+* Multi-account owner state stored in DSH's atomic plugin credential record.
+* The old single-account reference remains as a rollback source and is kept in
+* sync whenever that imported account rotates its refresh token.
+*/
+var DshOAuthAccountVault = class {
+	#tail = Promise.resolve();
+	constructor(credentials, options) {
+		if (credentials === void 0 || credentials === null || typeof credentials.readRecord !== "function" || typeof credentials.modifyRecord !== "function") throw new Error("Codex multi-account requires DSH credential records");
+		this.credentials = credentials;
+		this.key = options.key;
+		this.legacyRef = options.legacyRef;
+		this.legacyRefs = Object.freeze([...options.legacyRefs ?? []]);
+		this.createId = options.createId ?? randomUUID;
+		this.onLegacySyncFailure = options.onLegacySyncFailure ?? (() => {});
+	}
+	#enqueue(operation) {
+		const current = this.#tail.catch(() => void 0).then(operation);
+		this.#tail = current.catch(() => void 0);
+		return current;
+	}
+	async #legacyCredential() {
+		for (const ref of [this.legacyRef, ...this.legacyRefs]) {
+			const hit = await this.credentials.resolve(ref);
+			if (hit?.value === void 0 || hit.value === "") continue;
+			return {
+				ref,
+				credential: parseOAuthCredential$1(hit.value)
+			};
+		}
+	}
+	async #ensurePayload() {
+		const existing = await this.credentials.readRecord(this.key);
+		if (existing !== void 0) return assertVaultRecord(existing);
+		const legacy = await this.#legacyCredential();
+		if (legacy === void 0) return void 0;
+		const id = this.createId();
+		return assertVaultRecord(await this.credentials.modifyRecord(this.key, (current) => {
+			if (current !== void 0) return Promise.resolve(current);
+			return Promise.resolve(grant({
+				version: VERSION,
+				activeId: id,
+				legacyAccountId: id,
+				accounts: [{
+					id,
+					label: DEFAULT_LABEL,
+					credential: legacy.credential
+				}]
+			}));
+		}));
+	}
+	async #modifyPayload(update) {
+		await this.#ensurePayload();
+		let previousLegacy;
+		const payload = assertVaultRecord(await this.credentials.modifyRecord(this.key, async (current) => {
+			if (current === void 0) throw new Error("Codex account vault is not signed in");
+			const payload = assertVaultRecord(current);
+			previousLegacy = payload.accounts.find((account) => account.id === payload.legacyAccountId)?.credential;
+			const next = await update(clone$1(payload));
+			return grant(next);
+		}));
+		const legacy = payload.accounts.find((account) => account.id === payload.legacyAccountId)?.credential;
+		try {
+			if (legacy === void 0) {
+				if (previousLegacy !== void 0) await this.credentials.unset(this.legacyRef);
+			} else if (JSON.stringify(legacy) !== JSON.stringify(previousLegacy)) await this.credentials.set(this.legacyRef, JSON.stringify(legacy));
+		} catch {
+			this.onLegacySyncFailure();
+		}
+		return payload;
+	}
+	list() {
+		return this.#enqueue(async () => {
+			const payload = await this.#ensurePayload();
+			if (payload === void 0) return [];
+			return payload.accounts.map((account) => ({
+				id: account.id,
+				label: account.label,
+				active: account.id === payload.activeId,
+				expiresAt: account.credential.expires
+			}));
+		});
+	}
+	readActive() {
+		return this.#enqueue(async () => {
+			const payload = await this.#ensurePayload();
+			return clone$1(payload?.accounts.find((account) => account.id === payload.activeId)?.credential);
+		});
+	}
+	activeId() {
+		return this.#enqueue(async () => (await this.#ensurePayload())?.activeId);
+	}
+	add(label, credential) {
+		return this.#enqueue(async () => {
+			const normalizedLabel = normalizeLabel(label);
+			const validated = assertOAuthCredential$1(credential);
+			await this.#ensurePayload();
+			const id = this.createId();
+			const account = (await this.#modifyPayload((current) => ({
+				...current,
+				activeId: id,
+				accounts: [...current.accounts, {
+					id,
+					label: normalizedLabel,
+					credential: validated
+				}]
+			}))).accounts.find((candidate) => candidate.id === id);
+			return {
+				id,
+				label: account.label,
+				active: true,
+				expiresAt: account.credential.expires
+			};
+		});
+	}
+	select(id) {
+		return this.#enqueue(async () => {
+			await this.#modifyPayload((current) => {
+				if (!current.accounts.some((account) => account.id === id)) throw new Error("Unknown Codex account");
+				return {
+					...current,
+					activeId: id
+				};
+			});
+		});
+	}
+	modifyActive(update) {
+		return this.#enqueue(async () => {
+			if (await this.#ensurePayload() === void 0) {
+				const initial = await update(void 0);
+				if (initial === void 0) return void 0;
+				const credential = assertOAuthCredential$1(initial);
+				await this.credentials.set(this.legacyRef, JSON.stringify(credential));
+				await this.#ensurePayload();
+				return clone$1(credential);
+			}
+			let result;
+			await this.#modifyPayload(async (current) => {
+				const index = current.accounts.findIndex((account) => account.id === current.activeId);
+				const previous = clone$1(current.accounts[index].credential);
+				const next = await update(previous);
+				if (next === void 0) {
+					result = previous;
+					return current;
+				}
+				const credential = assertOAuthCredential$1(next);
+				const accounts = [...current.accounts];
+				accounts[index] = {
+					...accounts[index],
+					credential
+				};
+				result = clone$1(credential);
+				return {
+					...current,
+					accounts
+				};
+			});
+			return result;
+		});
+	}
+	deleteAll() {
+		return this.#enqueue(async () => {
+			await this.credentials.deleteRecord(this.key);
+			await this.credentials.unset(this.legacyRef);
+			for (const ref of this.legacyRefs) await this.credentials.unset(ref);
+		});
+	}
+	remove(id) {
+		return this.#enqueue(async () => {
+			await this.#modifyPayload((current) => {
+				if (!current.accounts.some((account) => account.id === id)) throw new Error("Unknown Codex account");
+				if (current.accounts.length === 1) throw new Error("Cannot remove the last account; sign out instead");
+				const accounts = current.accounts.filter((account) => account.id !== id);
+				return {
+					...current,
+					activeId: current.activeId === id ? accounts[0].id : current.activeId,
+					legacyAccountId: current.legacyAccountId === id ? void 0 : current.legacyAccountId,
+					accounts
+				};
+			});
+		});
+	}
+};
+//#endregion
 //#region src/credential-store.js
 const PROVIDER$1 = "openai-codex";
 const abortIfNeeded = (options) => options?.signal?.throwIfAborted();
@@ -52,6 +310,7 @@ var DshOAuthCredentialStore = class {
 		this.ref = ref;
 		this.legacyRefs = Object.freeze([...legacyRefs]);
 		this.expirySkewMs = expirySkewMs;
+		this.vault = options.vault;
 	}
 	#enqueue(providerId, operation, options) {
 		assertProvider(providerId);
@@ -69,6 +328,14 @@ var DshOAuthCredentialStore = class {
 	async #read(providerId, options) {
 		assertProvider(providerId);
 		abortIfNeeded(options);
+		if (this.vault !== void 0) {
+			const current = await this.vault.readActive();
+			if (current === void 0) return void 0;
+			return this.expirySkewMs === 0 ? current : {
+				...current,
+				expires: current.expires - this.expirySkewMs
+			};
+		}
 		let hit = await this.credentials.resolve(this.ref);
 		if (hit?.value === void 0 || hit.value === "") for (const legacyRef of this.legacyRefs) {
 			const legacy = await this.credentials.resolve(legacyRef);
@@ -99,6 +366,18 @@ var DshOAuthCredentialStore = class {
 	}
 	modify(providerId, update, options) {
 		return this.#enqueue(providerId, async () => {
+			if (this.vault !== void 0) {
+				const next = await this.vault.modifyActive(async (current) => {
+					const visible = current === void 0 || this.expirySkewMs === 0 ? current : {
+						...current,
+						expires: current.expires - this.expirySkewMs
+					};
+					const updated = await update(clone(visible));
+					return updated === void 0 ? void 0 : assertOAuthCredential(updated);
+				});
+				abortIfNeeded(options);
+				return clone(next);
+			}
 			const current = await this.#read(providerId, options);
 			const next = await update(clone(current));
 			abortIfNeeded(options);
@@ -112,6 +391,11 @@ var DshOAuthCredentialStore = class {
 	}
 	delete(providerId, options) {
 		return this.#enqueue(providerId, async () => {
+			if (this.vault !== void 0) {
+				await this.vault.deleteAll();
+				abortIfNeeded(options);
+				return;
+			}
 			await this.credentials.unset(this.ref);
 			for (const legacyRef of this.legacyRefs) await this.credentials.unset(legacyRef);
 			abortIfNeeded(options);
@@ -121,23 +405,49 @@ var DshOAuthCredentialStore = class {
 /** Return only account state that is safe to expose to the browser client. */
 function createCodexAuthService(models, store, options = {}) {
 	const runLogin = options.runLogin ?? ((run) => run());
+	const accountVault = options.accountVault;
+	const createLoginModels = options.createLoginModels;
+	const createPendingStore = options.createPendingStore ?? (() => new PendingOAuthCredentialStore());
 	return Object.freeze({
 		async status(options) {
 			const current = await store.read(PROVIDER$1, options);
+			const accounts = await accountVault?.list();
 			if (current === void 0) return {
 				authenticated: false,
-				provider: PROVIDER$1
+				provider: PROVIDER$1,
+				...accounts === void 0 ? {} : { accounts }
 			};
 			return {
 				authenticated: true,
 				provider: PROVIDER$1,
 				type: "oauth",
-				expiresAt: current.expires
+				expiresAt: current.expires,
+				...accounts === void 0 ? {} : { accounts }
 			};
 		},
-		login(interaction) {
+		login(interaction, input = {}) {
+			if (input.label !== void 0) {
+				if (accountVault === void 0 || createLoginModels === void 0) throw new Error("Codex multi-account is unavailable");
+				return runLogin(async () => {
+					const pending = createPendingStore();
+					await createLoginModels(pending).login(PROVIDER$1, "oauth", interaction);
+					const credential = pending.credential();
+					if (credential === void 0) throw new Error("Codex login did not return credentials");
+					await accountVault.add(input.label, credential);
+				});
+			}
 			return runLogin(() => models.login(PROVIDER$1, "oauth", interaction));
 		},
+		async select(id) {
+			if (accountVault === void 0) throw new Error("Codex multi-account is unavailable");
+			await accountVault.select(id);
+			return this.status();
+		},
+		async remove(id) {
+			if (accountVault === void 0) throw new Error("Codex multi-account is unavailable");
+			await accountVault.remove(id);
+			return this.status();
+		},
 		logout(options) {
 			return models.logout(PROVIDER$1, options);
 		}
@@ -263,8 +573,9 @@ var CodexLoginCoordinator = class {
 			...active.view.phase === "failed" ? { failure: classifyLoginFailure(active.hostError) } : {}
 		};
 	}
-	async start({ method }) {
+	async start({ method, label }) {
 		if (!LOGIN_METHODS.has(method)) throw new Error(`unsupported Codex login method: ${String(method)}`);
+		if (label !== void 0 && (typeof label !== "string" || label.trim().length === 0 || label.trim().length > 48)) throw new Error("unsupported Codex account label");
 		const active = this.#activeId === void 0 ? void 0 : this.#sessions.get(this.#activeId);
 		if (active !== void 0 && !TERMINAL_PHASES.has(active.view.phase)) {
 			active.view = {
@@ -349,7 +660,7 @@ var CodexLoginCoordinator = class {
 				publishReady();
 			}
 		};
-		session.run = Promise.resolve().then(() => this.auth.login(interaction)).then(async () => {
+		session.run = Promise.resolve().then(() => this.auth.login(interaction, label === void 0 ? {} : { label: label.trim() })).then(async () => {
 			if (controller.signal.aborted) return;
 			const status = await this.auth.status();
 			session.view = {
@@ -372,6 +683,7 @@ var CodexLoginCoordinator = class {
 				return;
 			}
 			try {
+				if (label !== void 0) throw error;
 				const status = await this.auth.status();
 				if (status.authenticated === true) {
 					session.view = {
@@ -440,6 +752,12 @@ var CodexLoginCoordinator = class {
 		await this.auth.logout(options);
 		return this.accountStatus(options);
 	}
+	async selectAccount(id) {
+		return publicClone(await this.auth.select(id));
+	}
+	async removeAccount(id) {
+		return publicClone(await this.auth.remove(id));
+	}
 };
 /** Map the loopback-only DSH Connection channel onto the coordinator. */
 function createCodexRpcHandler(coordinator, options = {}) {
@@ -450,7 +768,10 @@ function createCodexRpcHandler(coordinator, options = {}) {
 			const input = asObject(payload);
 			if (endpoint === "status") return ok(await coordinator.accountStatus({ signal }));
 			if (endpoint === "login/start") {
-				const started = await coordinator.start({ method: input.method });
+				const started = await coordinator.start({
+					method: input.method,
+					label: input.label
+				});
 				if (input.openExternal !== true) return ok(started);
 				const url = started.authUrl ?? started.deviceCode?.verificationUri;
 				if (typeof url !== "string" || openExternal === void 0) return ok({
@@ -477,6 +798,8 @@ function createCodexRpcHandler(coordinator, options = {}) {
 			}));
 			if (endpoint === "login/cancel") return ok(await coordinator.cancel(input.id));
 			if (endpoint === "logout") return ok(await coordinator.logout({ signal }));
+			if (endpoint === "account/select") return ok(await coordinator.selectAccount(input.id));
+			if (endpoint === "account/remove") return ok(await coordinator.removeAccount(input.id));
 			return badRequest(`unknown Codex auth endpoint: ${endpoint}`);
 		} catch (error) {
 			if (signal.aborted) throw error;
@@ -942,7 +1265,7 @@ function openaiCodexSubscriptionProvider({ resolveSpeedMode = () => void 0, reso
 }
 //#endregion
 //#region src/version.js
-const PACKAGE_VERSION = "1.11.4";
+const PACKAGE_VERSION = "1.12.1-beta.0";
 const USER_AGENT = `dsh-codex-subscription/${PACKAGE_VERSION}`;
 //#endregion
 //#region src/model-catalog.js
@@ -2060,18 +2383,33 @@ function createCodexUsageReader(options) {
 //#region src/quota-forecast.js
 const HOUR_MS = 3600 * 1e3;
 const HISTORY_MS = 24 * HOUR_MS;
-const MIN_SPAN_MS = 1800 * 1e3;
-const MIN_CONSUMED_PERCENT = 1;
+const MIN_SAMPLES = 3;
 const PLATEAU_SAMPLE_MS = 900 * 1e3;
 const finite = (value) => Number.isFinite(Number(value));
 const clampPercent = (value) => Math.max(0, Math.min(100, Number(value)));
-const keyFor = (window) => `codex:${Number(window.windowSeconds) || "limit"}`;
-function observeQuotaForecast(state, windows, now = Date.now()) {
+const cleanSegment = (value) => String(value ?? "default").slice(0, 96);
+const keyFor = (window, context = {}) => JSON.stringify([
+	cleanSegment(context.scope),
+	cleanSegment(context.limitId ?? "codex"),
+	Number(window.windowSeconds) || "limit"
+]);
+const median = (values) => {
+	const ordered = [...values].sort((a, b) => a - b);
+	const middle = Math.floor(ordered.length / 2);
+	return ordered.length % 2 === 0 ? (ordered[middle - 1] + ordered[middle]) / 2 : ordered[middle];
+};
+function requiredSpanMs(consumedPercent) {
+	if (consumedPercent >= 2) return 300 * 1e3;
+	if (consumedPercent >= 1) return 600 * 1e3;
+	if (consumedPercent >= .5) return 1200 * 1e3;
+	return 1800 * 1e3;
+}
+function observeQuotaForecast(state, windows, now = Date.now(), context = {}) {
 	const next = { windows: { ...state?.windows ?? {} } };
 	let changed = false;
 	for (const window of windows ?? []) {
 		if (!finite(window?.remainingPercent)) continue;
-		const key = keyFor(window);
+		const key = keyFor(window, context);
 		const resetsAt = finite(window.resetsAt) ? Number(window.resetsAt) : null;
 		const remainingPercent = Math.round(clampPercent(window.remainingPercent) * 1e4) / 1e4;
 		const previous = next.windows[key];
@@ -2101,14 +2439,14 @@ function observeQuotaForecast(state, windows, now = Date.now()) {
 		changed
 	};
 }
-function estimateQuotaForecast(state, window, now = Date.now()) {
+function estimateQuotaForecast(state, window, now = Date.now(), context = {}) {
 	if (!finite(window?.remainingPercent)) return { status: "calibrating" };
-	const record = state?.windows?.[keyFor(window)];
+	const record = state?.windows?.[keyFor(window, context)];
 	if (record === void 0) return { status: "calibrating" };
 	const resetsAt = finite(window.resetsAt) ? Number(window.resetsAt) : null;
 	if (record.resetsAt === null !== (resetsAt === null) || resetsAt !== null && Math.abs(record.resetsAt - resetsAt) > 300) return { status: "calibrating" };
 	const samples = record.samples.filter((sample) => sample.at >= now - HISTORY_MS && sample.at <= now + 6e4);
-	if (samples.length < 3) return {
+	if (samples.length < MIN_SAMPLES) return {
 		status: "calibrating",
 		sampleCount: samples.length
 	};
@@ -2116,77 +2454,190 @@ function estimateQuotaForecast(state, window, now = Date.now()) {
 	const last = samples.at(-1);
 	const spanMs = last.at - first.at;
 	const consumedPercent = Math.max(0, first.remainingPercent - last.remainingPercent);
-	if (spanMs < MIN_SPAN_MS || consumedPercent < MIN_CONSUMED_PERCENT) return {
+	if (spanMs < requiredSpanMs(consumedPercent)) return {
 		status: "calibrating",
 		sampleCount: samples.length,
 		observedSpanMs: spanMs,
 		consumedPercent
 	};
-	const firstAt = first.at;
-	const weighted = samples.map((sample) => ({
-		x: (sample.at - firstAt) / HOUR_MS,
-		y: first.remainingPercent - sample.remainingPercent,
-		weight: Math.exp((sample.at - last.at) / (6 * HOUR_MS))
-	}));
-	const totalWeight = weighted.reduce((sum, point) => sum + point.weight, 0);
-	const meanX = weighted.reduce((sum, point) => sum + point.x * point.weight, 0) / totalWeight;
-	const meanY = weighted.reduce((sum, point) => sum + point.y * point.weight, 0) / totalWeight;
-	const numerator = weighted.reduce((sum, point) => sum + point.weight * (point.x - meanX) * (point.y - meanY), 0);
-	const denominator = weighted.reduce((sum, point) => sum + point.weight * (point.x - meanX) ** 2, 0);
-	const pacePerHour = denominator > 0 ? numerator / denominator : 0;
+	const slopes = [];
+	for (let left = 0; left < samples.length - 1; left += 1) for (let right = left + 1; right < samples.length; right += 1) {
+		const hours = (samples[right].at - samples[left].at) / HOUR_MS;
+		if (hours <= 0) continue;
+		slopes.push((samples[left].remainingPercent - samples[right].remainingPercent) / hours);
+	}
+	const positive = slopes.filter((value) => Number.isFinite(value) && value >= 0);
+	const pacePerHour = positive.length === 0 ? 0 : median(positive);
 	if (!Number.isFinite(pacePerHour) || pacePerHour < .02) return {
 		status: "idle",
-		pacePerHour: 0
+		pacePerHour: 0,
+		sampleCount: samples.length,
+		observedSpanMs: spanMs,
+		consumedPercent
 	};
-	const runwaySeconds = clampPercent(window.remainingPercent) / pacePerHour * 3600;
+	const deviations = positive.map((value) => Math.abs(value - pacePerHour));
+	const uncertaintyPerHour = deviations.length === 0 ? 0 : median(deviations) * 1.4826;
+	const lowerPacePerHour = Math.max(.02, pacePerHour - uncertaintyPerHour);
+	const upperPacePerHour = pacePerHour + uncertaintyPerHour;
+	const remaining = clampPercent(window.remainingPercent);
+	const runwaySeconds = remaining / pacePerHour * 3600;
+	const runwayMinSeconds = remaining / upperPacePerHour * 3600;
+	const runwayMaxSeconds = remaining / lowerPacePerHour * 3600;
 	const resetSeconds = resetsAt === null ? null : Math.max(0, resetsAt - now / 1e3);
 	return {
 		status: "ready",
 		pacePerHour,
+		uncertaintyPerHour,
 		runwaySeconds,
-		survivesReset: resetSeconds !== null && runwaySeconds >= resetSeconds,
+		runwayMinSeconds,
+		runwayMaxSeconds,
+		survivesReset: resetSeconds !== null && runwayMinSeconds >= resetSeconds,
 		sampleCount: samples.length,
 		observedSpanMs: spanMs,
 		consumedPercent
 	};
 }
-function forecastUsage(usage, state = { windows: {} }, now = Date.now()) {
-	const observed = observeQuotaForecast(state, usage?.rateLimits?.find((limit) => limit.id === "codex")?.windows ?? [], now);
+function forecastUsage(usage, state = { windows: {} }, now = Date.now(), options = {}) {
+	let nextState = state;
+	let changed = false;
+	const rateLimits = (usage?.rateLimits ?? []).map((limit) => {
+		const context = {
+			scope: options.scope,
+			limitId: limit.id
+		};
+		const observed = observeQuotaForecast(nextState, limit.windows, now, context);
+		nextState = observed.state;
+		changed ||= observed.changed;
+		return {
+			...limit,
+			windows: limit.windows.map((window) => ({
+				...window,
+				forecast: estimateQuotaForecast(nextState, window, now, context)
+			}))
+		};
+	});
 	return {
-		state: observed.state,
-		changed: observed.changed,
+		state: nextState,
+		changed,
 		usage: {
 			...usage,
-			rateLimits: (usage?.rateLimits ?? []).map((limit) => limit.id !== "codex" ? limit : {
-				...limit,
-				windows: limit.windows.map((window) => ({
-					...window,
-					forecast: estimateQuotaForecast(observed.state, window, now)
-				}))
-			})
+			rateLimits
 		}
 	};
 }
-function createQuotaForecastReader({ reader, enabled, now = Date.now }) {
+function createQuotaForecastReader({ reader, enabled, now = Date.now, scope = () => "default", stateStore }) {
 	let state = { windows: {} };
+	let loaded = false;
+	const load = async () => {
+		if (loaded) return;
+		loaded = true;
+		const restored = await stateStore?.load?.();
+		if (restored?.windows !== null && typeof restored?.windows === "object") state = restored;
+	};
 	return Object.freeze({
 		async read(options) {
 			const usage = await reader.read(options);
+			await load();
 			if (!enabled()) {
 				state = { windows: {} };
+				await stateStore?.clear?.();
 				return usage;
 			}
-			const forecast = forecastUsage(usage, state, now());
+			const forecast = forecastUsage(usage, state, now(), { scope: await scope() });
 			state = forecast.state;
+			if (forecast.changed) await stateStore?.save?.(state);
 			return forecast.usage;
 		},
-		clear() {
+		async clear() {
 			state = { windows: {} };
+			loaded = true;
+			reader.clear();
+			await stateStore?.clear?.();
+		},
+		clearCache() {
 			reader.clear();
+		},
+		async clearScope(targetScope) {
+			await load();
+			const prefix = `[${JSON.stringify(cleanSegment(targetScope))},`;
+			state = { windows: Object.fromEntries(Object.entries(state.windows).filter(([key]) => !key.startsWith(prefix))) };
+			await stateStore?.save?.(state);
 		}
 	});
 }
 //#endregion
+//#region src/quota-forecast-store.js
+const DEFAULT_MAX_BYTES = 256 * 1024;
+const MAX_WINDOWS = 128;
+const MAX_SAMPLES = 192;
+function sanitize(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value) || value.windows === null || typeof value.windows !== "object" || Array.isArray(value.windows)) return void 0;
+	const entries = Object.entries(value.windows);
+	if (entries.length > MAX_WINDOWS) return void 0;
+	const windows = {};
+	for (const [key, record] of entries) {
+		if (key.length === 0 || key.length > 320 || record === null || typeof record !== "object" || !Array.isArray(record.samples) || record.samples.length > MAX_SAMPLES) return void 0;
+		const resetsAt = record.resetsAt === null ? null : Number(record.resetsAt);
+		if (resetsAt !== null && !Number.isFinite(resetsAt)) return void 0;
+		const samples = [];
+		for (const sample of record.samples) {
+			const at = Number(sample?.at);
+			const remainingPercent = Number(sample?.remainingPercent);
+			if (!Number.isFinite(at) || !Number.isFinite(remainingPercent) || remainingPercent < 0 || remainingPercent > 100) return void 0;
+			samples.push({
+				at,
+				remainingPercent
+			});
+		}
+		windows[key] = {
+			resetsAt,
+			samples
+		};
+	}
+	return { windows };
+}
+var QuotaForecastStateStore = class {
+	constructor({ filename, maxBytes = DEFAULT_MAX_BYTES }) {
+		this.filename = filename;
+		this.maxBytes = maxBytes;
+	}
+	async load() {
+		try {
+			if ((await stat(this.filename)).size > this.maxBytes) return void 0;
+			return sanitize(JSON.parse(await readFile(this.filename, "utf8")));
+		} catch (error) {
+			if (error?.code === "ENOENT" || error instanceof SyntaxError) return void 0;
+			throw error;
+		}
+	}
+	async save(state) {
+		const safe = sanitize(state);
+		if (safe === void 0) throw new Error("Refusing to persist malformed quota forecast state");
+		const data = `${JSON.stringify(safe)}\n`;
+		if (Buffer.byteLength(data) > this.maxBytes) throw new Error("Quota forecast state is too large");
+		await mkdir(dirname(this.filename), {
+			recursive: true,
+			mode: 448
+		});
+		const temporary = `${this.filename}.${process.pid}.${randomUUID()}.tmp`;
+		let handle;
+		try {
+			handle = await open(temporary, "wx", 384);
+			await handle.writeFile(data);
+			await handle.sync();
+			await handle.close();
+			handle = void 0;
+			await rename(temporary, this.filename);
+		} finally {
+			await handle?.close().catch(() => void 0);
+			await rm(temporary, { force: true }).catch(() => void 0);
+		}
+	}
+	async clear() {
+		await rm(this.filename, { force: true });
+	}
+};
+//#endregion
 //#region src/reset-credits.js
 const CODEX_RESET_CREDITS_URL = "https://chatgpt.com/backend-api/wham/rate-limit-reset-credits";
 const CODEX_RESET_CONSUME_URL = `${CODEX_RESET_CREDITS_URL}/consume`;
@@ -2444,8 +2895,9 @@ const inject = [
 ];
 const PROVIDER = "openai-codex";
 const OAUTH_EXPIRY_SKEW_MS = 6e4;
-const CREDENTIAL_REF = credentialRef("OPENAI_CODEX_SUBSCRIPTION_OAUTH");
-const LEGACY_CREDENTIAL_REF = credentialRef("WSL043_OPENAI_CODEX_OAUTH");
+const CREDENTIAL_REF = dshCredentials.credentialRef("OPENAI_CODEX_SUBSCRIPTION_OAUTH");
+const LEGACY_CREDENTIAL_REF = dshCredentials.credentialRef("WSL043_OPENAI_CODEX_OAUTH");
+const ACCOUNT_VAULT_KEY = typeof dshCredentials.credentialKey === "function" ? dshCredentials.credentialKey("codex-subscription", "accounts") : void 0;
 const CHANNEL = "/codex-subscription";
 const WEB_ENTRY_ID = "web";
 const DSH_SEARCH_PROVIDER_FALLBACK = "deepseek-official";
@@ -2592,10 +3044,16 @@ function createSubscriptionRpcHandler({ authHandler, usageReader, resetCreditSer
 			return publicError("internal", message);
 		}
 		const result = await authHandler(endpoint, payload, signal);
+		if (endpoint === "account/remove" && result.ok === true && typeof payload?.id === "string") await usageReader.clearScope(payload.id);
 		if (endpoint === "logout" && result.ok === true) {
-			usageReader.clear();
+			await usageReader.clear();
+			resetCreditService.clear();
+			modelCatalog?.clear();
+		} else if (result.ok === true && (endpoint === "account/select" || endpoint === "account/remove" || endpoint === "login/status" && result.value?.authenticated === true)) {
+			usageReader.clearCache();
 			resetCreditService.clear();
 			modelCatalog?.clear();
+			modelCatalog?.refresh({ signal: void 0 }).catch(() => {});
 		} else if (result.ok === true && (endpoint === "status" || result.value?.authenticated === true)) modelCatalog?.refresh({ signal: void 0 }).catch(() => {});
 		return result;
 	};
@@ -2656,7 +3114,15 @@ function apply(ctx) {
 	const searchProvider = createSearchProviderSwitcher(ctx.loader);
 	const network = createCodexNetworkTransport();
 	const originalImages = new OriginalImageStore();
-	const store = new DshOAuthCredentialStore(ctx.credentials, CREDENTIAL_REF, [LEGACY_CREDENTIAL_REF], { expirySkewMs: OAUTH_EXPIRY_SKEW_MS });
+	const accountVault = ACCOUNT_VAULT_KEY !== void 0 && typeof ctx.credentials.readRecord === "function" && typeof ctx.credentials.modifyRecord === "function" && typeof ctx.credentials.deleteRecord === "function" ? new DshOAuthAccountVault(ctx.credentials, {
+		key: ACCOUNT_VAULT_KEY,
+		legacyRef: CREDENTIAL_REF,
+		legacyRefs: [LEGACY_CREDENTIAL_REF]
+	}) : void 0;
+	const store = new DshOAuthCredentialStore(ctx.credentials, CREDENTIAL_REF, [LEGACY_CREDENTIAL_REF], {
+		expirySkewMs: OAUTH_EXPIRY_SKEW_MS,
+		vault: accountVault
+	});
 	const baseProvider = createOpenAICodexProvider();
 	let resolveAuth = async () => void 0;
 	const modelCatalog = createOfficialModelCatalog({
@@ -2778,7 +3244,15 @@ function apply(ctx) {
 		select(settings.get());
 		return settings.watch(select);
 	}, "codex-subscription: search provider selection");
-	const auth = createCodexAuthService(authModels, store, { runLogin: (operation) => network.run("login", operation) });
+	const auth = createCodexAuthService(authModels, store, {
+		runLogin: (operation) => network.run("login", operation),
+		accountVault,
+		createLoginModels: (credentials) => {
+			const loginModels = createModels({ credentials });
+			loginModels.setProvider(provider);
+			return loginModels;
+		}
+	});
 	const coordinator = new CodexLoginCoordinator(auth);
 	const usageReader = createQuotaForecastReader({
 		reader: createCodexUsageReader({
@@ -2786,8 +3260,18 @@ function apply(ctx) {
 			readCredential: (options) => store.read(PROVIDER, options),
 			fetch: (input, init) => network.fetch("quota", input, init)
 		}),
-		enabled: () => normalizeQuickQuotaMode(settings.get()[QUICK_QUOTA_MODE_FIELD], settings.get()[LEGACY_QUICK_QUOTA_FIELD]) === QUICK_QUOTA_MODE_FORECAST
+		enabled: () => normalizeQuickQuotaMode(settings.get()[QUICK_QUOTA_MODE_FIELD], settings.get()[LEGACY_QUICK_QUOTA_FIELD]) === QUICK_QUOTA_MODE_FORECAST,
+		scope: async () => await accountVault?.activeId() ?? "legacy",
+		stateStore: new QuotaForecastStateStore({ filename: dshHomePath("state", "codex-subscription", "quota-forecast.json") })
 	});
+	ctx.effect(() => {
+		const warmForecast = (value) => {
+			if (normalizeQuickQuotaMode(value["quickQuotaMode"], value["quickQuotaVisible"]) !== "forecast") return;
+			usageReader.read().catch((error) => ctx.logger?.debug?.("could not warm Codex quota forecast: %s", error.message));
+		};
+		warmForecast(settings.get());
+		return settings.watch(warmForecast);
+	}, "codex-subscription: quota forecast warm-up");
 	const resetCreditService = createCodexResetCreditService({
 		getAuth: resolveAuth,
 		readCredential: (options) => store.read(PROVIDER, options),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-codex-subscription",
-  "version": "1.11.4",
+  "version": "1.12.1-beta.0",
   "description": "Use ChatGPT and Codex subscriptions in DeepSeek Harness with OAuth, quota, safe resets, web search, images, and Fast mode",
   "type": "module",
   "main": "./lib/index.js",
@@ -77,22 +77,22 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "4.0.1 || 4.0.2",
-    "@deepseek-ai/dsh-api-remotes": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-connection": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-locale": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-runtime": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-ui-model-selection": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-ui-tool": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3",
-    "@deepseek-ai/dsh-credentials": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3",
-    "@deepseek-ai/dsh-llm": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3",
-    "@deepseek-ai/dsh-settings": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3",
-    "@deepseek-ai/dsh-tools": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3",
-    "@deepseek-ai/dsh-web": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3",
+    "@deepseek-ai/dsh-api-remotes": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3 || 0.1.2-alpha.4",
+    "@deepseek-ai/dsh-client-connection": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3 || 0.1.2-alpha.4",
+    "@deepseek-ai/dsh-client-locale": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3 || 0.1.2-alpha.4",
+    "@deepseek-ai/dsh-client-runtime": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3 || 0.1.2-alpha.4",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3 || 0.1.2-alpha.4",
+    "@deepseek-ai/dsh-client-ui-model-selection": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3 || 0.1.2-alpha.4",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3 || 0.1.2-alpha.4",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3 || 0.1.2-alpha.4",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3 || 0.1.2-alpha.4",
+    "@deepseek-ai/dsh-client-ui-tool": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3 || 0.1.2-alpha.4",
+    "@deepseek-ai/dsh-credentials": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3 || 0.1.2-alpha.4",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3 || 0.1.2-alpha.4",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3 || 0.1.2-alpha.4",
+    "@deepseek-ai/dsh-settings": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3 || 0.1.2-alpha.4",
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3 || 0.1.2-alpha.4",
+    "@deepseek-ai/dsh-web": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3 || 0.1.2-alpha.4",
     "@deepseek-ai/schemastery": "3.18.1",
     "@earendil-works/pi-ai": "0.82.1",
     "react": "^18.2.0",