dsh-connect-trae 3.8.1 → 3.9.2

package/lib/index.js

@@ -1012,6 +1012,49 @@ const TRAE_ACCOUNT_STATUS_PATH = "/plugins/dsh-connect-trae/account-status";
 */
 const TRAE_CHECKIN_PATH = "/plugins/dsh-connect-trae/checkin";
 /**
+* Plugin-owned account-pool endpoint: one route for the pool's batch actions.
+*
+* 参考：`dsh-connect-workbuddy` 的 `WORKBUDDY_POOL_PATH`。本路由与该实现同形
+*   （同一 `?action=` 风格、POST、loopback-only、per-row `accountId`），这样同时
+*   装了两个插件的用户面对的是同一套交互。
+*
+* `?action=checkin` and `?action=test` run over the whole member set; `remove`
+* addresses ONE account (the body carries `accountId`) and is the only way a
+* measurement of an account the user no longer wants can leave the store — a
+* deleted member otherwise keeps its row in the file forever, and a re-added
+* member would silently inherit an old exclusion.
+*
+* POST + loopback-only because both batches SPEND something: check-in sends a
+* claim, and a test is a real chat call. A page that is not the Host's own
+* loopback must not be able to trigger either.
+*/
+const TRAE_POOL_PATH = "/plugins/dsh-connect-trae/pool";
+/** Query parameter selecting which pool batch action a request means. */
+const TRAE_POOL_ACTION_PARAM = "action";
+/** Query parameter naming ONE pool account a per-row request addresses. */
+const TRAE_POOL_ACCOUNT_PARAM = "accountId";
+/** Read the pool action off a request URL; unknown/absent means undefined. */
+function poolActionOf(url) {
+	const at = url.indexOf("?");
+	if (at === -1) return void 0;
+	const value = new URLSearchParams(url.slice(at + 1)).get(TRAE_POOL_ACTION_PARAM);
+	return value === "checkin" || value === "test" || value === "remove" ? value : void 0;
+}
+/**
+* Read the ONE account a per-row pool request addresses, from the QUERY string.
+*
+* Unlike the transfer route, the pool's `accountId` rides the URL rather than the
+* body, so a row action and a batch action are distinguishable before any bytes
+* are read — which is what lets the route refuse a malformed request without ever
+* touching the store.
+*/
+function poolAccountIdOf(url) {
+	const at = url.indexOf("?");
+	if (at === -1) return void 0;
+	const value = new URLSearchParams(url.slice(at + 1)).get(TRAE_POOL_ACCOUNT_PARAM);
+	return value === null || value === "" ? void 0 : value;
+}
+/**
 * Plugin-owned account transfer endpoint: batch export and import of a region's
 * stored credentials (issue #37).
 *
@@ -1739,6 +1782,14 @@ const CLI_DEFAULT_HOST = "https://api.trae.cn";
 * working and upgrades itself the next time a credential is written; it is
 * never written again.
 */
+/**
+* How long a FAILED per-account refresh is remembered.
+*
+* Long enough that a revoked refresh token costs one exchange per five minutes
+* instead of two per card poll, short enough that a transient network failure is
+* retried on the next screen the user opens.
+*/
+const REFRESH_RETRY_MS = 3e5;
 const OWN_VERSION = 2;
 /** The superseded single-credential layout, still read for migration. */
 const OWN_VERSION_SINGLE = 1;
@@ -1819,6 +1870,22 @@ function traeAccountId(credential) {
 	const stable = `${credential.edition}\0${credential.userId || credential.accountName || "unknown"}`;
 	return createHash("sha256").update(stable).digest("hex").slice(0, 24);
 }
+/**
+* The exact shape of an account id — sha256 hex sliced to 24 characters, which is
+* what {@link traeAccountId} emits and therefore the only string a request may
+* legitimately name.
+*
+* This regex is a traversal guard as much as a validator: an id becomes part of a
+* path (`$DSH_HOME/.trae-pool.<panel>.json` uses it as a key, and a credential
+* lookup receives it), so `../../etc/passwd` has to fail here rather than fail
+* somewhere closer to the filesystem. Exported so an HTTP route can answer a bad
+* id with 400 instead of letting an exception surface as a 500.
+*/
+const TRAE_ACCOUNT_ID_RE = /^[0-9a-f]{24}$/;
+/** Whether a request-supplied value is a well-formed Trae account id. */
+function isTraeAccountId(value) {
+	return typeof value === "string" && TRAE_ACCOUNT_ID_RE.test(value);
+}
 /** One stored credential, validated. Returns undefined for a malformed row. */
 function credentialOfStored(stored) {
 	if (typeof stored !== "object" || stored === null || Array.isArray(stored)) return void 0;
@@ -1897,6 +1964,37 @@ var TraeCredentialStore = class {
 	refresh;
 	refreshMarginMs;
 	inflight;
+	/**
+	* In-flight refreshes of individual accounts, one per account id.
+	*
+	* The card reads every member's balance in one poll and each balance can
+	* decide to refresh, so without this dedupe the same account would exchange
+	* its token several times in a second and the last writer would win over a
+	* copy another read already holds.
+	*/
+	inflightByAccount = /* @__PURE__ */ new Map();
+	/**
+	* When a per-account refresh last FAILED, so a dead refresh token is not
+	* exchanged again on every poll.
+	*
+	* The card reads every member's balance on each refresh, and a revoked refresh
+	* token fails forever: without this memo each poll would spend two upstream
+	* calls (the current contract and the superseded one) on an account no retry
+	* can fix. Five minutes keeps a transient network failure cheap to retry while
+	* a revoked sign-in costs almost nothing.
+	*/
+	refreshFailedAtMs = /* @__PURE__ */ new Map();
+	/**
+	* The account the NEXT request should bill, when a pool — not the user's
+	* binding — is choosing (issue #44).
+	*
+	* Runtime only, never persisted: the binding in settings is what a save
+	* writes and what the card's account table reports as selected, while this is
+	* "who serves right now". Keeping them apart is what lets the pool rotate
+	* without silently rewriting the user's choice, and what makes turning the
+	* pool off restore the bound account with no rebind at all.
+	*/
+	rotatedAccountId;
 	constructor(options) {
 		this.storagePathOverride = options.storagePath;
 		this.edition = options.edition ?? "auto";
@@ -2106,9 +2204,50 @@ var TraeCredentialStore = class {
 		if (this.requireTenant && !isEnterpriseAccount(selected)) return this.preferred(offered);
 		return selected;
 	}
+	/**
+	* Point this store at one specific account for the NEXT request, without
+	* touching the user's saved binding (issue #44).
+	*
+	* Called by the account pool before each chat request. `undefined` clears the
+	* override, which is how switching the pool off immediately restores the
+	* binding — no rebind, no settings write, nothing to undo.
+	*
+	* A rotation is a REQUEST, not an assertion: `current()` honours it only when
+	* the account still exists locally and this store's own eligibility rules
+	* allow it, and otherwise falls back to the binding. So a rotation can never
+	* invent a credential that {@link current} would refuse.
+	*/
+	setRotatedAccount(accountId) {
+		if (this.rotatedAccountId === accountId) return;
+		this.rotatedAccountId = accountId;
+		this.inflight = void 0;
+	}
+	/** The rotation currently in effect, for diagnostics and the pool's own card. */
+	rotatedAccount() {
+		return this.rotatedAccountId;
+	}
+	/**
+	* The credential a rotation points at, or `undefined` when it cannot be
+	* honoured (the login was removed from this machine, or a tenant-scoped store
+	* refuses a personal account).
+	*
+	* Never substitutes a different account here: the caller then applies the
+	* user's binding, which is the honest answer when the pool's choice is gone.
+	*/
+	rotated(discovered, offered) {
+		const id = this.rotatedAccountId;
+		if (id === void 0) return void 0;
+		const credential = offered.find((item) => traeAccountId(item) === id) ?? discovered.find((item) => traeAccountId(item) === id);
+		if (credential === void 0) return void 0;
+		if (this.requireTenant && !isEnterpriseAccount(credential)) return void 0;
+		return credential;
+	}
 	async current() {
 		const discovered = await this.readAll();
-		return this.inUse(discovered, this.offered(discovered));
+		const offered = this.offered(discovered);
+		const rotated = this.rotated(discovered, offered);
+		if (rotated !== void 0) return rotated;
+		return this.inUse(discovered, offered);
 	}
 	/**
 	* The stored credential of one specific account, without changing which
@@ -2130,6 +2269,41 @@ var TraeCredentialStore = class {
 		return (await this.readAll()).find((credential) => traeAccountId(credential) === accountId);
 	}
 	/**
+	* A SPECIFIC account's credential, refreshed when its access token is due.
+	*
+	* {@link credentialOf} is a pure lookup and hands back an expired token as-is,
+	* which is right for the chat path (that request fails honestly) but wrong for
+	* a READ of that account's own data: Trae's access token lives for days while
+	* the refresh token lives for months, so a pooled account the user has not
+	* used this week reads as "no balance" — the card showed a bare `—` for an
+	* account whose refresh token was still good. Only the refresh margin decides
+	* here, and a FAILED refresh still yields the stored credential so the caller
+	* reports the failure it actually hit instead of inventing "not signed in".
+	*
+	* This never touches the binding or the rotation: refreshing account B must
+	* not make B the account the next chat request bills.
+	*/
+	async resolveCredentialOf(accountId) {
+		const credential = await this.credentialOf(accountId);
+		if (credential === void 0) return void 0;
+		if (credential.expiresAtMs > Date.now() + this.refreshMarginMs) return credential;
+		const pending = this.inflightByAccount.get(accountId);
+		if (pending !== void 0) return pending;
+		const failedAt = this.refreshFailedAtMs.get(accountId);
+		if (failedAt !== void 0 && Date.now() - failedAt < REFRESH_RETRY_MS) return credential;
+		const attempt = this.refreshNow(credential).then((refreshed) => {
+			this.refreshFailedAtMs.delete(accountId);
+			return refreshed;
+		}).catch(() => {
+			this.refreshFailedAtMs.set(accountId, Date.now());
+			return credential;
+		}).finally(() => {
+			this.inflightByAccount.delete(accountId);
+		});
+		this.inflightByAccount.set(accountId, attempt);
+		return attempt;
+	}
+	/**
 	* Store imported credentials (issue #37), replacing any entry with the same
 	* account id and leaving every other entry alone.
 	*
@@ -2555,7 +2729,7 @@ async function refreshTraeCredential(credential, signal, device) {
 }
 //#endregion
 //#region src/identity.ts
-function nonEmpty(value) {
+function nonEmpty$1(value) {
 	return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
 }
 function deviceCenterId(storage) {
@@ -2580,8 +2754,8 @@ function deviceKeyPairOf(storage) {
 		const plaintext = parseTraeAuthValue(encoded);
 		if (typeof plaintext !== "object" || plaintext === null || Array.isArray(plaintext)) return void 0;
 		const value = plaintext;
-		const privateKeyPEM = nonEmpty(value["privateKeyPEM"]);
-		const publicKeyPEM = nonEmpty(value["publicKeyPEM"]);
+		const privateKeyPEM = nonEmpty$1(value["privateKeyPEM"]);
+		const publicKeyPEM = nonEmpty$1(value["publicKeyPEM"]);
 		return privateKeyPEM === void 0 || publicKeyPEM === void 0 ? void 0 : {
 			privateKeyPEM,
 			publicKeyPEM
@@ -2597,14 +2771,14 @@ async function readTraeIdentity(candidate, options = {}) {
 	const env = options.env ?? process.env;
 	const storage = JSON.parse(await readFile(candidate.path, "utf8"));
 	const appRoot = dirname(dirname(dirname(candidate.path)));
-	const machineFile = nonEmpty(await readFile(join(appRoot, "machineid"), "utf8").catch(() => ""));
-	const telemetryMachine = nonEmpty(storage["telemetry.machineId"]);
-	const devDevice = nonEmpty(storage["telemetry.devDeviceId"]);
+	const machineFile = nonEmpty$1(await readFile(join(appRoot, "machineid"), "utf8").catch(() => ""));
+	const telemetryMachine = nonEmpty$1(storage["telemetry.machineId"]);
+	const devDevice = nonEmpty$1(storage["telemetry.devDeviceId"]);
 	const dcDevice = deviceCenterId(storage);
 	const machineId = telemetryMachine ?? machineFile;
 	if (machineId === void 0) throw new Error(`Trae ${candidate.edition} has no stable machine identity`);
 	const deviceId = dcDevice ?? devDevice ?? createHash("sha256").update(machineId).digest("hex").slice(0, 32);
-	const buildVersion = nonEmpty(storage["iCubeLastVersion"]);
+	const buildVersion = nonEmpty$1(storage["iCubeLastVersion"]);
 	const appName = {
 		cn: "Trae CN",
 		sg: "Trae",
@@ -2624,18 +2798,18 @@ async function readTraeIdentity(candidate, options = {}) {
 		product = JSON.parse(await readFile(path, "utf8"));
 		break;
 	} catch {}
-	const appVersion = nonEmpty(product["appVersion"]);
-	const deviceBrand = platform === "darwin" ? nonEmpty(env["TRAE_DEVICE_BRAND"]) : void 0;
+	const appVersion = nonEmpty$1(product["appVersion"]);
+	const deviceBrand = platform === "darwin" ? nonEmpty$1(env["TRAE_DEVICE_BRAND"]) : void 0;
 	const deviceCpu = cpus()[0]?.model.split(" ")[0];
 	const osVersion = `${platform === "darwin" ? "macOS" : platform === "win32" ? "Windows" : platform} ${release()}`;
 	const deviceName = (() => {
 		try {
-			return nonEmpty(userInfo().username);
+			return nonEmpty$1(userInfo().username);
 		} catch {
 			return;
 		}
 	})();
-	const deviceModel = nonEmpty(env["TRAE_DEVICE_MODEL"]);
+	const deviceModel = nonEmpty$1(env["TRAE_DEVICE_MODEL"]);
 	const deviceKeyPair = deviceKeyPairOf(storage);
 	return {
 		edition: candidate.edition,
@@ -2712,12 +2886,12 @@ async function readTraeCliIdentity(edition, options = {}) {
 	const cliHome = join(home, CLI_HOME_BY_EDITION[edition]);
 	const argv = await readJsonFile(join(cliHome, "argv.json"));
 	const version = await readJsonFile(join(cliHome, "builtin", "ide_version.json"));
-	const crashReporterId = nonEmpty(argv?.["crash-reporter-id"]);
-	const host = nonEmpty(env["HOSTNAME"]) ?? await readHostname() ?? "unknown-host";
-	const user = nonEmpty(env["USER"]) ?? nonEmpty(env["USERNAME"]) ?? "unknown-user";
+	const crashReporterId = nonEmpty$1(argv?.["crash-reporter-id"]);
+	const host = nonEmpty$1(env["HOSTNAME"]) ?? await readHostname() ?? "unknown-host";
+	const user = nonEmpty$1(env["USER"]) ?? nonEmpty$1(env["USERNAME"]) ?? "unknown-user";
 	const deviceId = crashReporterId ?? createHash("sha256").update(`trae-cli\0${host}\0${user}`).digest("hex").slice(0, 32);
 	const machineId = createHash("sha256").update(`trae-cli-machine\0${deviceId}\0${host}`).digest("hex");
-	const appVersion = nonEmpty(version?.["version"]);
+	const appVersion = nonEmpty$1(version?.["version"]);
 	const deviceCpu = cpus()[0]?.model.split(" ")[0];
 	const osVersion = `${platform === "darwin" ? "macOS" : platform === "win32" ? "Windows" : platform} ${release()}`;
 	return {
@@ -2743,7 +2917,7 @@ async function readJsonFile(path) {
 async function readHostname() {
 	try {
 		const { hostname } = await import("node:os");
-		return nonEmpty(hostname());
+		return nonEmpty$1(hostname());
 	} catch {
 		return;
 	}
@@ -2803,6 +2977,29 @@ const STATUS_BY_KIND = {
 	client: 400,
 	unconfigured: 503
 };
+/**
+* Failures that say something about the ACCOUNT and are therefore worth another
+* account: a rejected token, a drained quota, a rate limit, a 5xx.
+*
+* `not_found`, `client` and `unconfigured` are deliberately absent — they say
+* something about the request or this build, and replaying them on a second
+* account would burn the same error twice while teaching the pool a false fact
+* about an account that never got a chance to serve.
+*/
+const FAILOVER_KINDS = /* @__PURE__ */ new Set([
+	"authentication",
+	"hard_credit",
+	"soft_rate",
+	"server"
+]);
+/**
+* Accounts one request may try.
+*
+* Not "all of them": every attempt costs a round-trip before the user sees a
+* byte, and a pool whose every member is down must fail with a reason instead of
+* turning one request into a slow tour of the roster.
+*/
+const MAX_POOL_ATTEMPTS = 3;
 function hostnameOfHost(host) {
 	let hostname = host.trim().toLowerCase();
 	if (hostname.startsWith("[")) {
@@ -2892,6 +3089,49 @@ function createTraeShim(options) {
 			if (actual.length === expected.length && timingSafeEqual(actual, expected)) return route;
 		}
 	}
+	/**
+	* Run one chat request, failing over across pooled accounts when the account
+	* that was chosen cannot serve it (issue #44).
+	*
+	* The happy path makes exactly one upstream call, so a pool that is switched
+	* off — or on, with the first choice healthy — costs nothing but one cheap
+	* ranking lookup. A failure is reported to the pool BEFORE the decision to
+	* retry, because a rate limit the pool never hears about is a rate limit it
+	* will walk straight back into on the next request.
+	*/
+	async function chatWithFailover(route, raw, signal) {
+		const pool = route.pool;
+		let client = route.client;
+		let accountId = pool === void 0 ? void 0 : await pool.prepare().catch(() => void 0);
+		const tried = [];
+		for (let attempt = 0;; attempt += 1) {
+			const result = await client.chatStream(raw, signal);
+			if (result.ok) return {
+				kind: "stream",
+				response: result.response
+			};
+			const retryable = pool !== void 0 && !signal.aborted && FAILOVER_KINDS.has(result.kind);
+			if (retryable && accountId !== void 0) await pool.failed(accountId, result.kind, result.message).catch(() => {});
+			const failed = {
+				kind: "failed",
+				status: STATUS_BY_KIND[result.kind],
+				code: result.kind,
+				message: result.message
+			};
+			if (!retryable) return failed;
+			if (accountId !== void 0) tried.push(accountId);
+			const next = attempt + 1 >= MAX_POOL_ATTEMPTS ? void 0 : await pool.next(tried).catch(() => void 0);
+			if (next === void 0) {
+				const reason = await pool.shortfall(tried).catch(() => void 0);
+				return reason === void 0 ? failed : {
+					...failed,
+					message: `${failed.message} (${reason})`
+				};
+			}
+			client = next.client;
+			accountId = next.accountId;
+		}
+	}
 	async function handle(req, res) {
 		try {
 			if (!hostIsLoopback(req.headers.host)) return writeError(res, 403, "host_not_allowed", "Host must be loopback");
@@ -2931,8 +3171,8 @@ function createTraeShim(options) {
 				const abort = () => controller.abort();
 				req.once("aborted", abort);
 				req.socket.once("close", abort);
-				const result = await route.client.chatStream(raw, controller.signal);
-				if (!result.ok) return writeError(res, STATUS_BY_KIND[result.kind], result.kind, result.message);
+				const result = await chatWithFailover(route, raw, controller.signal);
+				if (result.kind === "failed") return writeError(res, result.status, result.code, result.message);
 				res.writeHead(200, {
 					"Content-Type": "text/event-stream",
 					"Cache-Control": "no-cache",
@@ -4975,13 +5215,37 @@ async function readProbeOutput(response) {
 		};
 	}
 }
-/** The minimal chat call one probe makes. */
-function probeBody(model) {
+/**
+* The chat call one probe makes.
+*
+* `inputTokens` pads the user turn so the probe carries roughly as much text as
+* a real conversation. Size matters because an upstream that refuses LARGE
+* requests will happily answer a one-word probe, and a verdict earned by a
+* 1-token request says nothing about the 30k-token turn the user is about to
+* send. `0` keeps the historical minimal probe (one word) — that is the default
+* because it spends the least credit and answers the question the pool ranks on
+* ("can this account talk at all").
+*
+* The filler is `x` words: one ASCII word is about one token, so the body size
+* is predictable (tokens ≈ inputTokens × 2 characters) without a tokenizer.
+*/
+/**
+* The largest probe this plugin will pad.
+*
+* A 100k-token probe is already ~200 KB of JSON; anything above that is a request
+* the user's real turn would not plausibly reach in this product, and a config
+* file edited by hand must not turn one "test all" click into a multi-megabyte
+* upload.
+*/
+const MAX_PROBE_INPUT_TOKENS = 1e5;
+function probeBody(model, inputTokens = 0) {
+	const padded = Math.min(Math.max(0, Math.floor(inputTokens)), MAX_PROBE_INPUT_TOKENS);
+	const content = padded > 0 ? `ping ${"x ".repeat(padded).trimEnd()}` : "ping";
 	return JSON.stringify({
 		model,
 		messages: [{
 			role: "user",
-			content: "ping"
+			content
 		}]
 	});
 }
@@ -4990,11 +5254,11 @@ function probeBody(model) {
 * recorded verdict describes the user's real path (same wire resolution, same
 * function stamping, same error translation).
 */
-async function probeOneModel(chat, id, timeoutMs = TRAE_PROBE_TIMEOUT_MS) {
+async function probeOneModel(chat, id, timeoutMs = TRAE_PROBE_TIMEOUT_MS, inputTokens = 0) {
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), timeoutMs);
 	try {
-		const result = await chat(probeBody(id), controller.signal);
+		const result = await chat(probeBody(id, inputTokens), controller.signal);
 		if (!result.ok) return {
 			id,
 			...classifyProbeResult(result, false)
@@ -5314,6 +5578,322 @@ var TraeUsageClient = class {
 	}
 };
 //#endregion
+//#region src/account-pool.ts
+/**
+* How long an account stays out of the pool when the upstream stated no time.
+*
+* A conservative FALLBACK, not a measurement: it applies whenever a failed
+* outcome carries no `retryAtMs` — every rate limit that came without a reset
+* sentence AND every transient failure (a transport error, a 5xx). In both cases
+* "when can I use this again" has no honest answer.
+*
+* The two failure directions it avoids: keeping the account in the pool would
+* re-bill it immediately and re-trip the same limit; dropping it FOREVER would
+* discard a working account over an event that said nothing about it. A short,
+* stated cooldown is the least-wrong of the two — and it is what lets the pool
+* heal itself, since nothing else re-probes an excluded member.
+*/
+const POOL_UNKNOWN_COOLDOWN_MS = 18e5;
+/**
+* Whether one account can be billed at `nowMs`.
+*
+* Returns the exclusion reason, or undefined when the account is a candidate.
+* The order matters and is NOT arbitrary:
+*
+* - A `credential-rejected` account is excluded regardless of any cooldown: its
+*   token is not accepted, so waiting cannot help and the user must re-auth.
+*   (`401` / `403` from Trae, and the `ExchangeToken` rejection of an expired
+*   refresh token, land here.)
+* - A limited, unreachable or failed outcome is checked against its stated (or
+*   fallback) cooldown, so an account whose limit has already reset — or whose
+*   gateway blipped once — is back in the pool without needing another test.
+* - An `ok` measurement, and no measurement at all, are both candidates. The
+*   latter matters: a freshly discovered account has never been tested and must
+*   not be invisible.
+*
+* `not-found`, `credential-rejected` and `plan-gated` deliberately get NO
+* cooldown: one describes a model this channel does not serve (a catalog fact),
+* one needs the user to sign in again, and one needs a plan change. None is fixed
+* by waiting, and pretending otherwise would re-bill a state the upstream has
+* already refused.
+*
+* `policy-rejected` is NOT the `default` branch: a content-policy refusal is a
+* fact about ONE REQUEST, not about the account, so the account stays a candidate
+* exactly like `ok`. The measurement is still recorded so the card can explain
+* what happened.
+*
+* An outcome this build does not know becomes `unusable` rather than a candidate:
+* billing through a state we cannot interpret is worse than leaving the account
+* out until a later version explains it.
+*/
+function exclusionOf(probe, nowMs) {
+	if (probe === void 0) return void 0;
+	switch (probe.outcome) {
+		case "ok": return;
+		case "credential-rejected": return "credential-rejected";
+		case "not-found": return "not-found";
+		case "plan-gated": return "plan-gated";
+		case "unavailable": return retryDue(probe, nowMs) ? void 0 : "unavailable";
+		case "failed": return retryDue(probe, nowMs) ? void 0 : "failed";
+		case "rate-limited": return retryDue(probe, nowMs) ? void 0 : "rate-limited";
+		case "model-busy": return retryDue(probe, nowMs, 12e4) ? void 0 : "model-busy";
+		case "out-of-credit": return retryDue(probe, nowMs) ? void 0 : "out-of-credit";
+		case "policy-rejected": return;
+		default: return "unusable";
+	}
+}
+/**
+* Whether an account's cooldown has elapsed (or was never stated).
+*
+* The fallback is the ONLY thing a transient outcome relies on: `retryAtMs` is
+* attached for a rate limit or a drained quota, never for a transport failure, so
+* `atMs + POOL_UNKNOWN_COOLDOWN_MS` is what brings those back.
+*
+* `fallbackMs` lets one outcome carry a SHORTER clock than the generic one. It is
+* a parameter rather than a second function so every outcome shares one definition
+* of "due".
+*/
+function retryDue(probe, nowMs, fallbackMs = POOL_UNKNOWN_COOLDOWN_MS) {
+	return nowMs >= (probe.retryAtMs ?? probe.atMs + fallbackMs);
+}
+/**
+* Rank a pool's members best-first.
+*
+* The rule, in priority order — this is the whole feature:
+*
+* 1. **Usability.** Only accounts that can be billed right now are candidates;
+*    they always outrank every excluded one.
+* 2. **Expiring credits first, soonest first.** Points about to expire are worth
+*    exactly zero after they do, so spending them before they lapse is strictly
+*    better than saving them.
+* 3. **Largest expiring amount.** Between two accounts that both have expiring
+*    points, the one with more at risk goes first.
+* 4. **Credits, highest first.** Among accounts with nothing expiring, spend the
+*    one with the most, so a nearly-drained account is conserved.
+* 5. **Freshest credential.** Tie-break so a stale token never wins a draw.
+* 6. **Account id.** Final tie-break, making the order TOTAL: two accounts equal on
+*    every key would otherwise keep the caller's array order, so the same pool
+*    could rotate differently between two runs.
+*
+* WHY EXPIRY OUTRANKS SIZE (workbuddy issue #70). These used to be strict
+* lexicographic keys: total, THEN expiry. Since totals are almost never exactly
+* equal, the expiry rule was unreachable — an account with 196 points lapsing that
+* day ranked LAST behind accounts that expire weeks later, simply because it held
+* ~1,200 fewer points overall. It was never selected, so those points always
+* lapsed. A "use it or lose it" rule that another rule completely shadows is not a
+* tie-break, it is dead code.
+*
+* WHY SPENDING THE SMALL EXPIRING ACCOUNT IS STILL RIGHT. Credits are fungible, so
+* using the rich account instead does not preserve the 1 point — it spends the 1
+* point's chance and loses it. Using the expiring account spends a point that was
+* going to be lost anyway, and the rich account is still there for the next
+* request. The only real cost is a failover round-trip if the expiring account
+* cannot cover a whole request, which the exclusion/failover path already absorbs.
+*
+* Excluded accounts are still RETURNED (sorted after the candidates) so the card
+* can explain why each is out; they differ from candidates by `excludedBy` being
+* set, never by being silently dropped.
+*
+* Pure and total: the same input always yields the same order, and it never throws
+* on missing data (an account with no credits is ranked as 0, not crashed on).
+*/
+function rankPool(members, nowMs) {
+	const rows = members.map((member) => {
+		const excludedBy = exclusionOf(member.probe, nowMs);
+		return {
+			account: member.account,
+			score: scoreOf(member),
+			...excludedBy === void 0 ? {} : { excludedBy },
+			_usable: excludedBy === void 0,
+			_atRisk: (member.credits?.expiringSoon ?? 0) > 0,
+			_expiringAmount: member.credits?.expiringSoon ?? 0,
+			_expiring: member.credits?.nearestExpiryMs ?? Number.POSITIVE_INFINITY,
+			_tokenExpiresAtMs: member.tokenExpiresAtMs ?? 0
+		};
+	});
+	rows.sort((left, right) => {
+		if (left._usable !== right._usable) return left._usable ? -1 : 1;
+		if (left._atRisk !== right._atRisk) return left._atRisk ? -1 : 1;
+		if (left._atRisk && right._atRisk && left._expiring !== right._expiring) return left._expiring - right._expiring;
+		if (left._expiringAmount !== right._expiringAmount) return right._expiringAmount - left._expiringAmount;
+		if (left.score !== right.score) return right.score - left.score;
+		if (left._tokenExpiresAtMs !== right._tokenExpiresAtMs) return right._tokenExpiresAtMs - left._tokenExpiresAtMs;
+		return left.account.id < right.account.id ? -1 : left.account.id > right.account.id ? 1 : 0;
+	});
+	return rows.map(({ account, score, excludedBy }) => ({
+		account,
+		score,
+		...excludedBy === void 0 ? {} : { excludedBy }
+	}));
+}
+/**
+* The checked ids that still resolve to a local sign-in, in the caller's order.
+*
+* This is THE definition of "effective members". It exists because the same
+* predicate wants to be written in several places (the status document, the batch
+* route's empty-pool guard, the host dependency the card reads) and "fixed one
+* end, missed the other" is this project's most productive bug shape, so the rule
+* has one home and every site delegates to it.
+*
+* ORDER IS THE CALLER'S: the answer preserves the order of `orderedIds`. Callers
+* pass whichever list's order they want to show — the saved list for the user's
+* own order, the store's roster for the account table's.
+*/
+function effectiveMembersOf(orderedIds, listedIds) {
+	return orderedIds.filter((id) => listedIds.has(id));
+}
+/**
+* The members that may actually be billed, in the store's order.
+*
+* Three rules in one place, because a request path and a batch that each decide
+* "who counts" separately is how a pool ends up billing an account the user did
+* not opt into:
+*
+* - the SAVED opt-in list is the roster (`effectiveMembersOf` — an id the user
+*   never selected, or one this machine no longer has, is not a candidate);
+* - `triedIds` are the accounts that already failed THIS request, so a failover
+*   never walks back into the one that just refused it;
+* - a ghost (saved but not listed) is absent from `members`, so it drops out here
+*   without a second check.
+*
+* An EMPTY `savedIds` yields an empty result on purpose: an enabled pool with no
+* members bills nobody, rather than silently meaning "all of them".
+*/
+function billableMembers(members, savedIds, triedIds = []) {
+	const saved = new Set(effectiveMembersOf(savedIds, new Set(members.map((member) => member.account.id))));
+	const tried = new Set(triedIds);
+	return members.filter((member) => saved.has(member.account.id) && !tried.has(member.account.id));
+}
+/**
+* The account to bill, or undefined when the pool has no usable member.
+*
+* A thin selector over {@link rankPool} so the winner is decided in exactly one
+* place: every caller that needs "who serves now" gets the same answer.
+*/
+function pickAccount(members, nowMs) {
+	return rankPool(members, nowMs).find((row) => row.excludedBy === void 0)?.account;
+}
+/**
+* The credit figure used for ordering.
+*
+* Absent credits rank as zero. Deliberately NOT "unknown ranks first": an account
+* whose balance could not be read must never outrank one we positively know is
+* full, or a failing credit read would capture all the traffic.
+*/
+function scoreOf(member) {
+	return member.credits?.total ?? 0;
+}
+/**
+* Pick the free model to test against, from one panel's catalog.
+*
+* "Free" means `creditMultiplier === 0` EXACTLY. An absent multiplier is NOT free:
+* the CN static fallback catalog carries no multiplier at all, so treating absence
+* as zero would silently bill real credits on a "free" probe.
+*
+* Among the free candidates the LARGEST context window wins, because the probe
+* sends a real payload and a long-conversation probe is the point.
+*
+* Returns undefined when the panel has no free model, which the caller must render
+* as "none available" — never as a fallback to a paid model.
+*/
+function pickFreeModel(catalog) {
+	let best;
+	for (const model of catalog) {
+		if (model.creditMultiplier !== 0) continue;
+		if (best === void 0 || (model.contextWindow ?? 0) > (best.contextWindow ?? 0)) best = model;
+	}
+	return best;
+}
+/**
+* Resolve the model the pool should test against.
+*
+* A user-specified id always wins (it is a preference, not a computed default) and
+* is returned even when it is a PAID model: the card says so explicitly rather than
+* silently overriding the user's choice.
+*
+* The choice is VALIDATED against the panel's catalog, because the catalog changes:
+* the CN roster is empty until its first refresh, and models come and go. A saved
+* id that is no longer offered used to be returned as `preferred`, which let the
+* card enable its test button and the host run a batch against a model nobody
+* offers. It is reported as `stale` instead — never silently replaced by the free
+* model (that would test something the user did not choose) and never run.
+*/
+function resolveTargetModel(catalog, preferredId) {
+	if (preferredId !== void 0 && preferredId !== "") return catalog.some((model) => model.id === preferredId) ? {
+		modelId: preferredId,
+		source: "preferred"
+	} : {
+		staleModelId: preferredId,
+		source: "stale"
+	};
+	const free = pickFreeModel(catalog);
+	return free === void 0 ? { source: "none" } : {
+		modelId: free.id,
+		source: "free"
+	};
+}
+/**
+* Map one Trae probe verdict onto the pool's outcome vocabulary.
+*
+* The mapping is the whole bridge between `src/model-probe.ts` (which answers a
+* QUESTION ABOUT A MODEL) and the pool (which must decide a FACT ABOUT AN ACCOUNT),
+* so every row states which side it is reading:
+*
+*  - `available`      → `ok`.
+*  - `auth`           → `credential-rejected`: 401/403 means THIS token is refused;
+*    waiting cannot help and the user must sign in again.
+*  - `gated` (`1005`) → `plan-gated`: the account's plan does not cover this model,
+*    which is an ACCOUNT fact (a paying account may pass) but not one that heals on
+*    a clock.
+*  - `rate_limited`   → `rate-limited`: `4011` or an honest 429 — transient by
+*    definition, so it cools down rather than leaving the pool forever.
+*  - `unsupported`    → `not-found`: `4001` says no SOLO function serves this
+*    `config_name`. It is MODEL-scoped, so the recorded `modelId` is what keeps the
+*    row honest, and nothing about the account changes by waiting.
+*  - `unknown`        → `failed`: a timeout, a transport error or a proxy problem.
+*    It cools down (it is not a statement about the account) and carries the
+*    upstream text so the user can retest.
+*
+* There is deliberately NO Trae source for `model-busy`, `out-of-credit` and
+* `policy-rejected` in this table — they are produced by the live-request path
+* (`src/account-pool.ts` has no network), from `4008` (quota exhausted) and from a
+* content refusal. A verdict NOT in this table falls through to `failed`, so a new
+* upstream verdict can never silently mean "healthy".
+*/
+function outcomeOfVerdict(verdict) {
+	switch (verdict) {
+		case "available": return "ok";
+		case "auth": return "credential-rejected";
+		case "gated": return "plan-gated";
+		case "rate_limited": return "rate-limited";
+		case "unsupported": return "not-found";
+		default: return "failed";
+	}
+}
+/**
+* Which pool a panel's members belong to, for the on-disk probe store and the
+* `pool` settings slot.
+*
+* `enterprise` is its OWN bucket even though it shares the CN credential store:
+* an account that serves the personal SOLO channel says nothing about whether it
+* passes the tenant gate (`4019` is only revealed at the first chat), so measuring
+* one must not silently answer the other.
+*/
+function poolKeyOfPanel(panel) {
+	return panel;
+}
+/**
+* WHY THERE IS NO SCHEDULER HERE.
+*
+* Like the reference implementation, this module carries no timer: rotation is a
+* PERSISTENT change of who pays while failover is a PER-REQUEST borrow of another
+* account, and having both with an automatic re-test on a clock made "who is being
+* billed right now" unanswerable on one card. Recovery is expressed as the cooldown
+* in {@link exclusionOf} instead, which needs no timer: it is evaluated at ranking
+* time, so a cooled-down member simply becomes a candidate again on the next
+* request.
+*/
+//#endregion
 //#region src/transfer.ts
 /**
 * Account transfer: the export / import file format shared with sibling
@@ -5586,7 +6166,7 @@ function mergeTransferRecords(records, indexes, region, knownRegionOfCredential
 * matched on the code rather than on the HTTP status: read as a transport
 * failure it looks like the plugin is broken, when the day is simply spent.
 */
-const CHECKIN_DEVICE_ALREADY_CLAIMED = 9095;
+const CHECKIN_DEVICE_ALREADY_CLAIMED$1 = 9095;
 /** Redact token-like content before it crosses to the browser. */
 function safeMessage(error) {
 	return (error instanceof Error ? error.message : String(error)).replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[redacted token]").replace(/(\b(?:code|token|refresh_token|access_token)=)[^&\s]+/giu, "$1[redacted]").slice(0, 500);
@@ -5726,7 +6306,8 @@ function toCredits(snapshot, nowMs = Date.now()) {
 		displayDesc: pack.displayDesc,
 		remain: credit(Math.max(0, (pack.creditsLimit ?? 0) - (pack.consumedCredits ?? 0))),
 		size: pack.creditsLimit ?? 0,
-		...usableExpiry(pack.endTimeMs) ? { expiresAtMs: pack.endTimeMs } : {}
+		...usableExpiry(pack.endTimeMs) ? { expiresAtMs: pack.endTimeMs } : {},
+		...pack.availableEndpoint === void 0 ? {} : { endpoint: pack.availableEndpoint }
 	}));
 	const remaining = (endpoint) => snapshot.packs.filter((pack) => pack.availableEndpoint === endpoint).reduce((sum, pack) => credit(sum + Math.max(0, (pack.creditsLimit ?? 0) - (pack.consumedCredits ?? 0))), 0);
 	return {
@@ -5880,18 +6461,21 @@ async function traeWebUsage(deps, panel) {
 		enabledModelIds: [...deps.enabledModelIds(panel)],
 		...deps.rawDiagnostic === void 0 ? {} : { rawChat: deps.rawDiagnostic(panel) }
 	};
+	const poolSection = await poolSectionOf(deps, panel);
 	const client = deps.client(panel);
 	if (regionOfPanel(panel) === "ai") try {
 		const payStatus = await client.payStatus();
 		return {
 			status: "signed-in",
 			...account,
+			...poolSection,
 			payStatus
 		};
 	} catch (error) {
 		return {
 			status: "signed-in",
 			...account,
+			...poolSection,
 			payStatusError: safeMessage(error)
 		};
 	}
@@ -5909,6 +6493,7 @@ async function traeWebUsage(deps, panel) {
 	if (panel === "enterprise") return {
 		status: "signed-in",
 		...account,
+		...poolSection,
 		creditsUnavailable: "enterprise"
 	};
 	const [snapshotResult, checkinResult] = await Promise.allSettled([client.snapshot(), client.checkinStatus()]);
@@ -5917,6 +6502,7 @@ async function traeWebUsage(deps, panel) {
 	return {
 		status: "signed-in",
 		...account,
+		...poolSection,
 		...credits === void 0 ? { creditsError: snapshotResult.status === "rejected" ? safeMessage(snapshotResult.reason) : "unknown" } : { credits },
 		...checkinResult.status === "fulfilled" ? { checkin: toCheckin(checkinResult.value) } : { checkinError: safeMessage(checkinResult.reason) },
 		...alternatives === void 0 ? {} : { alternatives }
@@ -5957,6 +6543,185 @@ async function creditAlternatives(deps, panel, accounts) {
 	return alternatives.length === 0 ? void 0 : alternatives;
 }
 /**
+* The panel's pool section, or an empty standpoint when this Host cannot run one.
+*
+* THE rule of this file: the pool is an ADD-ON to the status document, so no
+* failure inside it may cost the user the sign-in panel. A member with a broken
+* balance read, a probe store that cannot be parsed, a clock — all of it degrades
+* to "no pool section" rather than to a 500 that hides the account table.
+*
+* What is deliberately NOT swallowed here: a `credential`-class failure of the
+* BOUND account, which `traeWebUsage` reports as `status: error` before the pool
+* is even assembled.
+*/
+async function poolSectionOf(deps, panel) {
+	if (deps.pool === void 0) return {};
+	try {
+		const pool = await traeWebPool(deps, panel);
+		return pool === void 0 ? {} : { pool };
+	} catch {
+		return {};
+	}
+}
+/**
+* Assemble one panel's pool document (see {@link TraeWebPool}).
+*
+* Rows come from TWO sources and are kept in the Host's ranking order: checked
+* members (ranked by {@link rankPool}) first, then the local sign-ins the pool
+* does NOT cover, so the card can offer them to check. Unchecked rows carry no
+* credits and no measurement — nothing has been read for an account the pool does
+* not bill, and printing a friendlier-looking zero would be a lie.
+*
+* Every per-row read is failure-tolerant on purpose: one account whose balance
+* read throws must not remove the other members from the table.
+*/
+async function traeWebPool(deps, panel) {
+	const pool = deps.pool;
+	if (pool === void 0) return void 0;
+	const preferences = pool.preferences(panel);
+	const members = await pool.members(panel);
+	const nowMs = Date.now();
+	const ranked = rankPool(members, nowMs);
+	const target = resolveTargetModel(pool.catalog?.(panel) ?? [], preferences.targetModelId);
+	const byId = new Map(members.map((member) => [member.account.id, member]));
+	const excludedById = new Map(ranked.flatMap((row) => row.excludedBy === void 0 ? [] : [[row.account.id, row.excludedBy]]));
+	const rankedIds = new Set(ranked.map((row) => row.account.id));
+	const others = (await pool.otherAccounts?.(panel) ?? []).filter((account) => !rankedIds.has(account.id));
+	const checkinState = await pool.checkinState?.(panel).catch(() => ({})) ?? {};
+	const memberNames = await pool.memberNames?.(panel).catch(() => ({})) ?? {};
+	const currentAccountId = await pool.currentAccountId?.(panel).catch(() => void 0);
+	/**
+	* A row per listed account, members first.
+	*
+	* `member` is the membership source of truth: the saved list is what a batch
+	* runs on, so a local sign-in that is not checked must not render as one —
+	* otherwise the card would claim "N accounts will be tested" over a set the
+	* Host never touches.
+	*/
+	const savedMembers = new Set(preferences.memberAccountIds ?? []);
+	const rows = [];
+	const rowIds = /* @__PURE__ */ new Set();
+	for (const row of ranked) {
+		rows.push({
+			account: row.account,
+			member: savedMembers.has(row.account.id)
+		});
+		rowIds.add(row.account.id);
+	}
+	for (const account of others) {
+		rows.push({
+			account,
+			member: savedMembers.has(account.id)
+		});
+		rowIds.add(account.id);
+	}
+	for (const accountId of savedMembers) {
+		if (rowIds.has(accountId)) continue;
+		rows.push({
+			account: {
+				id: accountId,
+				accountName: ""
+			},
+			member: true
+		});
+		rowIds.add(accountId);
+	}
+	const reachableIds = new Set(members.map((member) => member.account.id));
+	const tokenExpiresById = /* @__PURE__ */ new Map();
+	for (const member of members) if (member.tokenExpiresAtMs !== void 0) tokenExpiresById.set(member.account.id, member.tokenExpiresAtMs);
+	const accounts = rows.map((row) => {
+		const entry = byId.get(row.account.id);
+		const measured = entry?.probe;
+		const credits = entry?.credits;
+		const checkin = checkinState[row.account.id];
+		const excludedBy = excludedById.get(row.account.id);
+		const accountName = row.account.accountName !== "" ? row.account.accountName : memberNames[row.account.id] ?? measured?.accountName ?? "";
+		return {
+			accountId: row.account.id,
+			accountName,
+			...credits === void 0 ? {} : {
+				credits: credits.total,
+				...credits.generalAvailable === void 0 ? {} : { generalAvailable: credits.generalAvailable },
+				...credits.workAvailable === void 0 ? {} : { workAvailable: credits.workAvailable },
+				expiringSoon: credits.expiringSoon,
+				...credits.nearestExpiryMs === void 0 ? {} : { nearestExpiryMs: credits.nearestExpiryMs }
+			},
+			...measured === void 0 ? {} : { probe: {
+				outcome: measured.outcome,
+				atMs: measured.atMs,
+				...measured.source === void 0 ? {} : { source: measured.source },
+				...measured.modelId === void 0 ? {} : { modelId: measured.modelId },
+				...measured.retryAtMs === void 0 ? {} : { retryAtMs: measured.retryAtMs },
+				...measured.message === void 0 ? {} : { message: safeMessage(measured.message) }
+			} },
+			...excludedBy === void 0 ? {} : { excludedBy },
+			...credits === void 0 && (tokenExpiresById.get(row.account.id) ?? Infinity) <= nowMs ? { tokenExpired: true } : {},
+			current: currentAccountId !== void 0 && currentAccountId === row.account.id,
+			member: row.member,
+			reachable: reachableIds.has(row.account.id),
+			...checkin === void 0 ? {} : {
+				checkedInToday: checkin.checkedIn,
+				...checkin.deviceCheckedIn === void 0 ? {} : { deviceCheckedIn: checkin.deviceCheckedIn }
+			}
+		};
+	});
+	/**
+	* Why the pool cannot pick anybody, when it cannot.
+	*
+	* Only meaningful for an ENABLED pool: a disabled pool is not picking anybody by
+	* design, and saying "no candidate" there would describe a fault that is not
+	* one. Every member excluded is the case the card must explain, because traffic
+	* then falls back to the saved selection while the table shows a full roster.
+	*/
+	let noCandidate;
+	if (preferences.enabled === true) {
+		if (members.length === 0) noCandidate = "empty";
+		else if (ranked.every((row) => row.excludedBy !== void 0)) noCandidate = new Set(ranked.map((row) => row.excludedBy)).size === 1 ? ranked[0]?.excludedBy ?? "unusable" : "unusable";
+	}
+	const effectiveMemberAccountIds = effectiveMembersOf(rows.filter((row) => row.member).map((row) => row.account.id), new Set(members.map((member) => member.account.id)));
+	return {
+		enabled: preferences.enabled === true,
+		checkinSupported: pool.checkin !== void 0 && regionOfPanel(panel) === "cn",
+		...target.modelId === void 0 ? {} : { targetModelId: target.modelId },
+		targetModelSource: target.source,
+		probeInputTokens: Math.max(0, preferences.probeInputTokens ?? 0),
+		...target.staleModelId === void 0 ? {} : { staleTargetModelId: target.staleModelId },
+		...preferences.memberAccountIds === void 0 ? {} : { memberAccountIds: preferences.memberAccountIds },
+		effectiveMemberAccountIds,
+		...Object.keys(memberNames).length === 0 ? {} : { memberNames },
+		accounts,
+		...noCandidate === void 0 ? {} : { noCandidate }
+	};
+}
+/**
+* One test row, translated into the pool vocabulary the card renders.
+*
+* The runner answers in the model-probe verdicts (`available` / `auth` / `gated` /
+* `rate_limited` / `unsupported`); the card must not have to know that `gated` and
+* `1005` are the same event, so the translation happens here — once, for both the
+* batch and the single-row probe.
+*/
+function poolTestRowViewOf(row) {
+	return {
+		accountId: row.accountId,
+		accountName: row.accountName,
+		modelId: row.modelId,
+		outcome: outcomeOfVerdict(row.outcome),
+		detail: safeMessage(row.detail),
+		...row.retryAtMs === void 0 ? {} : { retryAtMs: row.retryAtMs }
+	};
+}
+/** One check-in row, redacted on the way out. */
+function poolCheckinRowViewOf(row) {
+	return {
+		accountId: row.accountId,
+		accountName: row.accountName,
+		status: row.status,
+		...row.credit === void 0 ? {} : { credit: row.credit },
+		...row.message === void 0 ? {} : { message: safeMessage(row.message) }
+	};
+}
+/**
 * The panel a request addresses, or a 400 answer. Absent parameter means the
 * domestic tab; an unknown value is refused rather than guessed.
 */
@@ -6238,7 +7003,7 @@ function registerTraeUsageRoute(ctx, deps) {
 						const outcome = await deps.claimCheckinOf(panel, accountId);
 						if (outcome === void 0) return json(res, 404, { error: "unknown account" });
 						const { claim, checkin: after } = outcome;
-						const deviceClaimed = claim.code === CHECKIN_DEVICE_ALREADY_CLAIMED;
+						const deviceClaimed = claim.code === CHECKIN_DEVICE_ALREADY_CLAIMED$1;
 						return json(res, 200, {
 							claimed: claim.claimed,
 							alreadyCheckedIn: after.checkedIn,
@@ -6261,13 +7026,13 @@ function registerTraeUsageRoute(ctx, deps) {
 						claimed: false,
 						alreadyCheckedIn: false,
 						deviceCheckedIn: true,
-						code: CHECKIN_DEVICE_ALREADY_CLAIMED,
+						code: CHECKIN_DEVICE_ALREADY_CLAIMED$1,
 						message: "this device already used today's check-in",
 						checkin: toCheckin(current)
 					});
 					const claim = await client.claimCheckin();
 					const checkin = await client.checkinStatus();
-					const deviceClaimed = claim.code === CHECKIN_DEVICE_ALREADY_CLAIMED;
+					const deviceClaimed = claim.code === CHECKIN_DEVICE_ALREADY_CLAIMED$1;
 					json(res, 200, {
 						claimed: claim.claimed,
 						alreadyCheckedIn: false,
@@ -6281,7 +7046,131 @@ function registerTraeUsageRoute(ctx, deps) {
 				}
 			}
 		});
+		/**
+		* The account pool's ONE mutation surface: `?action=checkin|test|remove`.
+		*
+		* Everything the pool does that costs something happens here and nowhere else —
+		* `checkin` sends a claim, `test` spends a real chat call per member, `remove`
+		* drops one account's measurement. The pool is therefore POST-only and
+		* loopback-only, like the model test and the check-in it wraps.
+		*
+		* The empty-pool guard runs on `effectiveMemberAccountIds` — what this Host can
+		* actually reach — rather than on the saved list. A saved id whose sign-in
+		* disappeared would otherwise let a batch answer `200` with zero rows, which
+		* the card reads as "全部正常".
+		*
+		* Answers are JSON except for a streaming test batch, which writes one NDJSON
+		* line per account as it lands: the loop is serial, so without a stream a user
+		* cannot tell a slow member from a dead button.
+		*/
+		const disposePool = ctx.webServer.register({
+			kind: "exact",
+			path: TRAE_POOL_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				const panel = requestRegion(req, res);
+				if (panel === void 0) return;
+				const pool = deps.pool;
+				if (pool === void 0) return json(res, 503, { error: "account pool unavailable" });
+				const url = req.url ?? "/";
+				const action = poolActionOf(url);
+				if (action === void 0) return json(res, 400, { error: `missing or unknown action parameter (${TRAE_POOL_ACTION_PARAM})` });
+				const accountId = poolAccountIdOf(url);
+				if (accountId !== void 0 && !isTraeAccountId(accountId)) return json(res, 400, { error: "malformed account id" });
+				if (action === "remove") {
+					if (accountId === void 0) return json(res, 400, { error: "remove needs an accountId" });
+					if (pool.removeOne === void 0) return json(res, 503, { error: "pool removal unavailable" });
+					try {
+						json(res, 200, {
+							accountId,
+							removed: await pool.removeOne(panel, accountId)
+						});
+					} catch (error) {
+						json(res, 500, { error: safeMessage(error) });
+					}
+					return;
+				}
+				/**
+				* Both remaining actions need a NON-EMPTY effective pool.
+				*
+				* `effectiveMemberAccountIds` is optional; when the Host does not supply it
+				* the guard falls back to the saved list, which is weaker but never worse
+				* than no guard at all. `no-live-members` and `no-members` are separate
+				* reasons because the advice differs: re-check the accounts you lost versus
+				* check some accounts in.
+				*/
+				const saved = pool.preferences(panel).memberAccountIds ?? [];
+				let effective = saved;
+				if (pool.effectiveMemberAccountIds !== void 0) try {
+					effective = await pool.effectiveMemberAccountIds(panel);
+				} catch (error) {
+					return json(res, 500, { error: safeMessage(error) });
+				}
+				if (effective.length === 0) return json(res, 409, {
+					action,
+					reason: saved.length === 0 ? "no-members" : "no-live-members",
+					error: saved.length === 0 ? "no accounts are checked into this pool" : "none of the checked accounts can be reached on this machine"
+				});
+				if (action === "checkin") {
+					const supported = pool.checkinSupported?.(panel) ?? true;
+					if (!supported || pool.checkin === void 0) return json(res, 409, {
+						action,
+						reason: "checkin-unsupported",
+						error: supported ? "check-in is unavailable in this build" : "this panel has no daily check-in"
+					});
+					try {
+						json(res, 200, { rows: (await pool.checkin(panel)).map((row) => poolCheckinRowViewOf(row)) });
+					} catch (error) {
+						json(res, 500, { error: safeMessage(error) });
+					}
+					return;
+				}
+				const targetModelId = pool.preferences(panel).targetModelId;
+				if (pool.test === void 0) return json(res, 409, {
+					action,
+					reason: "test-unsupported",
+					error: "the pool cannot test this panel"
+				});
+				const single = accountId === void 0 ? void 0 : pool.testOne;
+				if (single !== void 0 && accountId !== void 0) {
+					const resolved = resolveTargetModel(pool.catalog?.(panel) ?? [], targetModelId);
+					if (resolved.modelId === void 0) return json(res, 409, {
+						action,
+						reason: resolved.source === "stale" ? "stale-target" : "no-target-model",
+						error: resolved.source === "stale" ? "the saved test model is no longer offered by this panel" : "no free model is available to test against"
+					});
+					resolved.modelId;
+				}
+				if (single !== void 0 && accountId !== void 0) try {
+					const row = await single(panel, accountId);
+					if (row === void 0) return json(res, 404, { error: "unknown account" });
+					return json(res, 200, { rows: [poolTestRowViewOf(row)] });
+				} catch (error) {
+					return json(res, 500, { error: safeMessage(error) });
+				}
+				res.writeHead(200, {
+					"Content-Type": "application/x-ndjson",
+					"Cache-Control": "no-store"
+				});
+				const writeLine = (value) => {
+					res.write(`${JSON.stringify(value)}\n`);
+				};
+				try {
+					writeLine({ rows: (await pool.test(panel, targetModelId ?? "", (row) => {
+						writeLine({ row: poolTestRowViewOf(row) });
+					})).map((row) => poolTestRowViewOf(row)) });
+				} catch (error) {
+					writeLine({
+						reason: "pool-failed",
+						error: safeMessage(error)
+					});
+				}
+				res.end();
+			}
+		});
 		return () => {
+			disposePool();
 			disposeCheckin();
 			disposeRefresh();
 			disposeTransfer();
@@ -6294,6 +7183,538 @@ function registerTraeUsageRoute(ctx, deps) {
 	}, "dsh-connect-trae: Web usage route");
 }
 //#endregion
+//#region src/account-pool-run.ts
+/** The upstream's business code for "this DEVICE already checked in today". */
+const CHECKIN_DEVICE_ALREADY_CLAIMED = 9095;
+/**
+* Check in every account, one at a time.
+*
+* Idempotent by design (see the module note): an account already checked in today
+* is reported as `already` and NO write is attempted. A failure on one account is
+* recorded on that row and the batch continues — EXCEPT for the device-level
+* refusal (`9095`), which stops the run: it is a fact about this MACHINE, so every
+* later account would hit the same wall and each of those calls is a wasted
+* upstream request against an endpoint that just said "stop".
+*
+* Never throws: every problem becomes a row.
+*/
+async function checkinAllAccounts(targets, deps) {
+	const rows = [];
+	for (const [index, target] of targets.entries()) {
+		if (index > 0) await (deps.wait ?? defaultWait)(400);
+		const row = await checkinOne(target, deps);
+		rows.push(row);
+		if (row.status === "device-already") {
+			for (const skipped of targets.slice(index + 1)) rows.push({
+				accountId: skipped.accountId,
+				accountName: skipped.accountName,
+				status: "device-already",
+				message: "skipped: this device has already claimed today"
+			});
+			break;
+		}
+	}
+	return rows;
+}
+/** One account's check-in, reduced to its row. */
+async function checkinOne(target, deps) {
+	const base = {
+		accountId: target.accountId,
+		accountName: target.accountName
+	};
+	let credential;
+	try {
+		credential = await deps.credentialFor(target.accountId);
+	} catch (error) {
+		return {
+			...base,
+			status: "failed",
+			message: messageOf(error)
+		};
+	}
+	if (credential === void 0) return {
+		...base,
+		status: "failed",
+		message: "no stored credential for this account"
+	};
+	let status;
+	try {
+		status = await deps.checkinStatusOf(credential);
+	} catch (error) {
+		return {
+			...base,
+			status: "failed",
+			message: messageOf(error)
+		};
+	}
+	if (!status.enabled) return {
+		...base,
+		status: "disabled",
+		message: "check-in is not enabled for this account"
+	};
+	if (status.checkedIn) return {
+		...base,
+		status: "already",
+		credit: status.credits
+	};
+	if (status.didCheckedIn) {}
+	try {
+		const claim = await deps.claimCheckinOf(credential);
+		if (claim.claimed) return {
+			...base,
+			status: "claimed",
+			credit: status.credits,
+			...nonEmpty(claim.message)
+		};
+		if (claim.code === CHECKIN_DEVICE_ALREADY_CLAIMED) return {
+			...base,
+			status: "device-already",
+			message: claim.message
+		};
+		return {
+			...base,
+			status: "failed",
+			message: claim.message === "" ? `code ${String(claim.code)}` : claim.message
+		};
+	} catch (error) {
+		return {
+			...base,
+			status: "failed",
+			message: messageOf(error)
+		};
+	}
+}
+/**
+* Test every account against one model, one at a time.
+*
+* The model is resolved by the caller (see `resolveTargetModel`) so this function
+* never has to decide "free or not" — an unresolvable target is the caller's
+* problem to report, and testing against a model nobody chose would be exactly the
+* silent spend this feature forbids.
+*
+* ONE model for the whole batch, deliberately. Letting each row test a different
+* model makes a green batch UNCOMPARABLE — one account's `ok` on model X and
+* another's on model Y — which is the reading ("all green") that the reference
+* implementation removed its per-account override for. What stays is that every
+* measurement RECORDS the model it probed and each row displays it.
+*
+* Never throws: a failed probe is a ROW, not an aborted batch. A credential
+* rejection does NOT stop the run (unlike the region-wide model test, where every
+* later probe would fail the same way): here each account has its OWN credential,
+* so one account's bad token says nothing about its neighbours.
+*
+* `onRow` fires the moment one account's row exists, which is what lets a caller
+* report progress. The loop is SERIAL by design, so without this a caller cannot
+* say anything until the SLOWEST member answers: one stuck account made a working
+* batch look like a dead button.
+*/
+async function testAllAccounts(targets, modelId, probe, deps, onRow) {
+	const rows = [];
+	for (const [index, target] of targets.entries()) {
+		if (index > 0) await (deps.wait ?? defaultWait)(400);
+		const row = await testOne(target, modelId, probe, deps);
+		rows.push(row);
+		onRow?.(row);
+	}
+	return rows;
+}
+/** One account's probe, reduced to its row. */
+async function testOne(target, modelId, probe, deps) {
+	const base = {
+		accountId: target.accountId,
+		accountName: target.accountName,
+		modelId
+	};
+	let credential;
+	try {
+		credential = await deps.credentialFor(target.accountId);
+	} catch (error) {
+		return {
+			...base,
+			outcome: "auth",
+			detail: messageOf(error)
+		};
+	}
+	if (credential === void 0) return {
+		...base,
+		outcome: "auth",
+		detail: "no stored credential for this account"
+	};
+	const result = await probe(deps.chatFor, credential, modelId);
+	return {
+		...base,
+		outcome: result.verdict,
+		detail: result.detail
+	};
+}
+/**
+* Turn a test batch's rows into the per-account measurements to remember.
+*
+* A row is stored only when the probe actually measured the MODEL. A row that
+* failed because the credential could not even be read says nothing about the
+* model, and recording it would exclude a possibly-perfect account from the pool —
+* so those accounts keep their previous measurement instead.
+*
+* `atMs` is stamped here, once for the batch, so the card's "tested N minutes ago"
+* reflects when the batch finished rather than drifting per row.
+*
+* `detail` is carried through as `message`. It was already produced from the
+* upstream's own (translated) text, so persisting it cannot leak a token, and
+* without it the pool table could only repeat one generic sentence for a DNS
+* failure, a gateway 502 and a cancelled request alike.
+*/
+function probeUpdatesOf(rows, nowMs = Date.now()) {
+	const updates = {};
+	for (const row of rows) {
+		if (isTransportFailure(row)) continue;
+		const outcome = outcomeOfVerdict(row.outcome);
+		updates[row.accountId] = {
+			outcome,
+			atMs: nowMs,
+			source: "test-batch",
+			modelId: row.modelId,
+			...row.accountName === "" ? {} : { accountName: row.accountName },
+			...row.retryAtMs === void 0 ? {} : { retryAtMs: row.retryAtMs },
+			...row.detail === "" ? {} : { message: row.detail }
+		};
+	}
+	return updates;
+}
+/**
+* Whether a row measures the transport rather than the account/model.
+*
+* `auth` carrying the pool's own "no stored credential" message is the one case we
+* can attribute to ourselves rather than the upstream: the request never left.
+* Every other rejection came from the upstream and IS a statement about this
+* account, so it is kept.
+*/
+function isTransportFailure(row) {
+	return row.outcome === "auth" && row.detail.startsWith("no stored credential");
+}
+/** Carry an optional upstream sentence only when it says something. */
+function nonEmpty(message) {
+	return message === "" ? {} : { message };
+}
+/** The default inter-account pause. */
+function defaultWait(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** A safe message from an unknown throwable, bounded in length. */
+function messageOf(error) {
+	return (error instanceof Error ? error.message : String(error)).slice(0, 300);
+}
+//#endregion
+//#region src/reset-time.ts
+/**
+* Parse a reset TIME out of an upstream failure message, when the upstream stated
+* one.
+*
+* 参考：`dsh-connect-workbuddy` 的 `src/probe.ts`（`parseUpstreamResetAt`）。
+*   该实现在 WorkBuddy 上是实测出来的（其网关的 429 正文里带一句「将在 … 重置」
+*   与一句英文 `will reset at …`），本文件把同一套解析规则搬过来，并把「偏移量
+*   必须显式」这条硬约束原样保留。
+* 改动：诚实标注**证据状态**。Trae 目前被记录在案的限流/配额文案里**没有任何一条
+*   带时间**：
+*
+*   - `4011` → `We're sorry, your requests have exceeded the rate limit.
+*     Please wait and try again later.`（docs/ISSUE33_DIAGNOSIS.md:30，实测原文）
+*   - `4008` → `Your requests have exceeded the quota.`（同文档:55，实测原文）
+*
+*   所以本函数在 Trae 上大概率永远返回 `undefined`，而**这正是它应有的行为**：
+*   没有给出的时间不能变成插件自己编的倒计时（池会退回
+*   `POOL_UNKNOWN_COOLDOWN_MS` 的 30 分钟兜底并在卡片上如实显示「上游未给出
+*   何时恢复」）。它存在的理由只有一个：Trae 的中文网关将来若在正文里写了时间
+*   （与 WorkBuddy 中文网关同一族文案），不要把一个真实存在的时间当没有解析出来
+*   丢掉 —— 参考实现里那是一条实测的 bug（英文正文解析不到 → 账号比上游要求的
+*   早 ~18 小时回到池里，再花一次请求重新撞上同一个限制）。
+*
+* NEVER use it for a credit PACK's `endTimeMs`: that is when a balance STOPS
+* being usable, not when a new allowance ARRIVES. Attaching it as a retry time
+* would put an exhausted account back into rotation at the exact moment its
+* credit disappears.
+*
+* @module dsh-connect-trae/reset-time
+*/
+/**
+* The timestamp shape both spellings share: `YYYY-MM-DD HH:MM:SS` followed by an
+* EXPLICIT UTC offset.
+*
+* The offset is required, not optional. `2026-09-30 02:30:30` with no zone is a
+* moment the plugin would have to guess at, and `Date.parse` guesses LOCAL time —
+* right on a UTC+8 machine by accident, silently wrong everywhere else. A message
+* that names a time without a zone therefore yields no time, which is the honest
+* answer.
+*/
+const RESET_STAMP = "(\\d{4})-(\\d{2})-(\\d{2})\\s+(\\d{2}):(\\d{2}):(\\d{2})\\s*UTC\\s*([+-])(\\d{1,2})(?::?(\\d{2}))?";
+/** Chinese spelling: the marker sits AFTER the timestamp (将在 … 重置). */
+const UPSTREAM_RESET_PATTERN_ZH = new RegExp(`将在?\\s*${RESET_STAMP}[\\s\\S]*?重置`, "u");
+/**
+* English spelling: the marker sits BEFORE the timestamp (`reset at` /
+* `refresh on`). It needs its own pattern because the two languages put the
+* keyword on different sides of the time, so loosening the surrounding prose
+* alone cannot cover both.
+*/
+const UPSTREAM_RESET_PATTERN_EN = new RegExp(`(?:reset|resets|refresh|refreshes|renew|renews)\\s+(?:at|on)\\s+${RESET_STAMP}`, "iu");
+/**
+* Parse the reset time out of an upstream failure message.
+*
+* Returns epoch ms, or undefined when the message names no parsable time — the
+* caller must then say "the upstream gave no time", never invent one.
+*
+* THE OFFSET IS HONOURED, NOT ASSUMED. `2026-09-30 02:30:30 UTC+8` is 18:30:30 UTC
+* the previous day, so the components are assembled with `Date.UTC` and the stated
+* offset subtracted — correct on every host regardless of its own zone.
+*
+* A whole-second resolution is what the upstream prints; sub-second precision would
+* be fiction in the other direction.
+*/
+function parseUpstreamResetAt(message) {
+	const match = UPSTREAM_RESET_PATTERN_ZH.exec(message) ?? UPSTREAM_RESET_PATTERN_EN.exec(message);
+	if (match === null) return void 0;
+	const [, year, month, day, hour, minute, second, sign, offsetHours, offsetMinutes] = match;
+	const offsetTotalMinutes = (sign === "-" ? -1 : 1) * (Number(offsetHours) * 60 + Number(offsetMinutes ?? "0"));
+	const utcMs = Date.UTC(Number(year), Number(month) - 1, Number(day), Number(hour), Number(minute), Number(second));
+	const parsed = new Date(utcMs);
+	if (parsed.getUTCFullYear() !== Number(year) || parsed.getUTCMonth() !== Number(month) - 1 || parsed.getUTCDate() !== Number(day) || parsed.getUTCHours() !== Number(hour) || parsed.getUTCMinutes() !== Number(minute) || parsed.getUTCSeconds() !== Number(second)) return;
+	if (Math.abs(offsetTotalMinutes) > 840) return void 0;
+	return utcMs - offsetTotalMinutes * 6e4;
+}
+//#endregion
+//#region src/account-pool-store.ts
+/**
+* The account pool's RUNTIME store: measured facts, on disk, outside settings.
+*
+* 参考：`dsh-connect-workbuddy` 的 `src/account-pool-store.ts`，以及本仓库
+*   `src/auth.ts` 的插件自有文件约定（`$DSH_HOME` 下的 `.trae-auth.<region>.json`，
+*   `withFileLock` + `writeFileAtomic`，`mode: 0o600`）。
+* 改动：一份、按**面板**分文件（cn / enterprise / ai），因为 enterprise 与 cn 共用
+*   同一份凭据却走不同的网关 —— 一个账号在个人 SOLO 通道能用，完全不说明它过得了
+*   租户门（`4019` 只在第一次真实对话时暴露），所以两份测量必须分开落盘。
+*
+* 为什么这些事实不放 settings（`regions[panel].pool`）：
+*
+*   卡片对用户偏好用的是「草稿 → 保存 → 丢弃草稿」模式：保存成功会丢弃草稿。
+*   如果探测结果也住在那个槽里，用户手工点一次「保存」就会用**几分钟前的草稿**
+*   覆盖掉刚刚写进去的测量结果 —— 那等于把测量回退，测试白做。
+*   观测数据由插件高频写入、且不是用户偏好，所以它必须落在自己的文件里。
+*
+* 本模块的读写**从不抛异常给调用方**：池是增强功能，一个损坏的观测文件绝不能让
+* 卡片或 host 启动失败 —— 最坏情况是「回到未测试」，而不是整个插件不可用。
+*
+* @module dsh-connect-trae/account-pool-store
+*/
+/** On-disk format version; readers reject anything else. */
+const STORE_FORMAT_VERSION = 1;
+/** Filename prefix for one panel's measured pool facts. */
+const POOL_STORE_PREFIX = ".trae-pool";
+/** Whether a parsed value looks like a stored probe. */
+function isProbe(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const candidate = value;
+	return typeof candidate["outcome"] === "string" && typeof candidate["atMs"] === "number" && (candidate["retryAtMs"] === void 0 || typeof candidate["retryAtMs"] === "number") && (candidate["message"] === void 0 || typeof candidate["message"] === "string") && (candidate["accountName"] === void 0 || typeof candidate["accountName"] === "string") && (candidate["modelId"] === void 0 || typeof candidate["modelId"] === "string") && (candidate["source"] === void 0 || typeof candidate["source"] === "string");
+}
+/**
+* One panel's path for measured pool facts.
+*
+* Panel-keyed for the same reason the credential copies are region-keyed: the
+* panels are parallel stacks and must never overwrite each other's measurements.
+*/
+function traePoolStorePath(panel) {
+	return join(resolveDshHome(), `${POOL_STORE_PREFIX}.${panel}.json`);
+}
+/**
+* The recovery time a stored record implies — declared, or recoverable from its
+* own body.
+*
+* The field itself wins when present: it is what the writer computed with the
+* full input set, and re-deriving it could only lose information.
+*
+* The fallback exists because a record can state a time in its `message` and
+* still have no `retryAtMs`. Read-time healing is the only place this can be
+* repaired for EXISTING records: every consumer receives probes through
+* {@link readTraePoolProbes}, so healing here fixes all of them at once. Re-
+* deriving at each consumer instead would be several copies of one rule, and the
+* next consumer added would silently miss it.
+*
+* Not a permanent second derivation: {@link writeTraePoolProbes} reads through
+* this function before it writes, so the very next write persists the healed
+* value.
+*
+* Scoped to the two outcomes whose vocabulary HAS a stated time. Widening it
+* would let an incidental sentence in an `ok` body attach a countdown to a
+* healthy account — the card prints any present `retryAtMs` beside the outcome,
+* so that would render a waiting time on an account waiting for nothing.
+*/
+function retryAtMsOf(probe) {
+	if (probe.retryAtMs !== void 0) return probe.retryAtMs;
+	if (probe.outcome !== "rate-limited" && probe.outcome !== "out-of-credit") return void 0;
+	if (probe.message === void 0) return void 0;
+	return parseUpstreamResetAt(probe.message);
+}
+/**
+* Read one panel's measured facts.
+*
+* Contains NO credentials. The one free-text field is `message`, and it is
+* REDACTED BY THE WRITER before it ever reaches this file, so a token-shaped
+* string cannot survive into storage.
+*
+* Returns an empty map for a missing, unreadable, malformed, or
+* version-mismatched file: all four mean "nothing measured yet", which is a valid
+* state the pool renders as "untested".
+*/
+async function readTraePoolProbes(panel) {
+	let raw;
+	try {
+		raw = await readFile(traePoolStorePath(panel), "utf8");
+	} catch {
+		return {};
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return {};
+	}
+	if (typeof parsed !== "object" || parsed === null) return {};
+	const document = parsed;
+	if (document.version !== STORE_FORMAT_VERSION) return {};
+	if (typeof document.probes !== "object" || document.probes === null) return {};
+	const probes = {};
+	for (const [accountId, probe] of Object.entries(document.probes)) {
+		if (accountId === "" || !isProbe(probe)) continue;
+		const retryAtMs = retryAtMsOf(probe);
+		const source = knownProbeSource(probe.source);
+		probes[accountId] = {
+			outcome: probe.outcome,
+			atMs: probe.atMs,
+			...source === void 0 ? {} : { source },
+			...retryAtMs === void 0 ? {} : { retryAtMs },
+			...probe.message === void 0 ? {} : { message: probe.message },
+			...probe.accountName === void 0 ? {} : { accountName: probe.accountName },
+			...probe.modelId === void 0 ? {} : { modelId: probe.modelId }
+		};
+	}
+	return probes;
+}
+/**
+* A stored source string reduced to a source this build understands.
+*
+* `isProbe` accepts any string so a newer build's label cannot destroy the
+* measurement it describes; this narrows it at the point of use. An unknown value
+* becomes `undefined`, which the card renders as "unknown" — the honest answer,
+* rather than mislabelling it as one of the two kinds we do know.
+*/
+function knownProbeSource(value) {
+	return value === "test-batch" || value === "live-request" ? value : void 0;
+}
+/**
+* Merge ONE new measurement over the record already stored for that account.
+*
+* A plain `{ ...existing, ...update }` is wrong here, and the damage is silent.
+* The two writers describe the same account at different moments and carry
+* different fields:
+*
+*   - `test-batch` measures the TARGET MODEL deliberately, so it is the writer
+*     that can produce a reset point (`retryAtMs`) parsed out of the upstream's
+*     own failure body.
+*   - `live-request` reports what a real chat request just hit. It often carries
+*     no `retryAtMs` at all (a transport blip names no time), and a spread would
+*     therefore DELETE the reset point the probe had already resolved.
+*
+* Measured consequence of the spread (reference implementation, a real
+* quota-exhausted account): the probe recorded "quota refreshes 2026-11-01", the
+* next live failure rewrote the record without that field, and the pool then
+* reported "retry in about 30 minutes" — putting an exhausted account back into
+* rotation to be refused again. The correct value was in the file one write
+* earlier.
+*
+* So `retryAtMs` is INHERITED when the update does not state one, and every other
+* field is the update's (the newer measurement owns `outcome`, `atMs`, `source`
+* and `message`). Inheriting is only about the one field whose absence is not a
+* statement: an update that DOES carry a time still overrides, which is what lets
+* a fresh, shorter cooldown supersede a stale longer one.
+*
+* `accountName` is INHERITED for the same reason: its absence is not a statement.
+* A writer that could not see the account must not erase the name an earlier
+* measurement DID see — that name is the only thing that can identify a member
+* whose sign-in has gone.
+*
+* `modelId` is deliberately NOT inherited (see the field note in
+* `account-pool.ts`): it describes THIS measurement, not the account.
+*
+* Pure and exported so the rule is unit-testable without a filesystem — this is
+* exactly the kind of "two writers, one slot" rule that bites silently.
+*/
+function mergePoolProbe(existing, update) {
+	if (existing === void 0) return update;
+	const merged = update.accountName === void 0 && existing.accountName !== void 0 ? {
+		...update,
+		accountName: existing.accountName
+	} : update;
+	if (update.retryAtMs !== void 0) return merged;
+	if (existing.retryAtMs === void 0 || existing.retryAtMs <= update.atMs) return merged;
+	return {
+		...merged,
+		retryAtMs: existing.retryAtMs
+	};
+}
+/**
+* Merge measurements into one panel's store and write it atomically.
+*
+* A MERGE rather than a replace, because batches measure one account at a time and
+* a partial failure must not erase what earlier runs learned. An account absent
+* from `updates` keeps its previous measurement, and an account present in both is
+* combined by {@link mergePoolProbe} rather than overwritten.
+*
+* Never throws: a failed write loses only the newest measurements, and the
+* caller's results are still returned to the user. Surfacing a disk error here
+* would fail an operation that actually succeeded.
+*/
+async function writeTraePoolProbes(panel, updates) {
+	if (Object.keys(updates).length === 0) return;
+	const path = traePoolStorePath(panel);
+	try {
+		await withFileLock(path, async () => {
+			const existing = await readTraePoolProbes(panel);
+			const merged = { ...existing };
+			for (const [accountId, update] of Object.entries(updates)) merged[accountId] = mergePoolProbe(existing[accountId], update);
+			await writeFileAtomic(path, `${JSON.stringify({
+				version: STORE_FORMAT_VERSION,
+				probes: merged
+			}, null, 2)}\n`, {
+				mode: 384,
+				dirMode: 448
+			});
+		});
+	} catch {}
+}
+/**
+* Forget one account's measurement, keeping every other row.
+*
+* Used when the user removes a pool member: its measurement is no longer about a
+* member, and leaving it in the file would resurrect a stale `rate-limited` row if
+* the account were added back later. Written through the same lock/atomic path so a
+* removal cannot interleave with a batch.
+*/
+async function dropTraePoolProbe(panel, accountId) {
+	const existing = await readTraePoolProbes(panel);
+	if (existing[accountId] === void 0) return;
+	const path = traePoolStorePath(panel);
+	const probes = {};
+	for (const [id, probe] of Object.entries(existing)) if (id !== accountId) probes[id] = probe;
+	try {
+		await withFileLock(path, async () => {
+			await writeFileAtomic(path, `${JSON.stringify({
+				version: STORE_FORMAT_VERSION,
+				probes
+			}, null, 2)}\n`, {
+				mode: 384,
+				dirMode: 448
+			});
+		});
+	} catch {}
+}
+//#endregion
 //#region src/model-config.ts
 /**
 * Parse a secret-free CustomModel debug line emitted by Trae. Optional values
@@ -6615,7 +8036,13 @@ const regionStateConfig = z.object({
 	enabledModelIds: z.array(z.string()).default([]),
 	imageModelIds: z.array(z.string()).default([]),
 	contextBudgets: z.dict(z.number().step(1).min(1)).default({}),
-	creditPosition: z.union([z.const("composer"), z.const("stats")]).default("composer").description("积分读数显示位置：\"composer\" = 输入框工具栏（默认），\"stats\" = 输入框下方（与「轮次 / 步数 / token」统计同一行）。装了别的插件后读数不显示时改成 stats。")
+	creditPosition: z.union([z.const("composer"), z.const("stats")]).default("composer").description("积分读数显示位置：\"composer\" = 输入框工具栏（默认），\"stats\" = 输入框下方（与「轮次 / 步数 / token」统计同一行）。装了别的插件后读数不显示时改成 stats。"),
+	pool: z.object({
+		enabled: z.boolean().default(false).description("账号池：打开后本面板由池中可用账号轮流计费（关闭时按下面的绑定账号）"),
+		targetModelId: z.string().default("").description("账号池测速使用的模型 id（留空 = 自动选择免费模型）"),
+		memberAccountIds: z.array(z.string()).default([]).description("加入本面板账号池的账号 id（显式勾选，默认为空）"),
+		probeInputTokens: z.number().default(0).description("账号池测试请求填充的 token 量（0 = 最小请求，不填充）")
+	}).default({})
 });
 const accountSelectionConfig = z.object({
 	cn: z.string().description("Selected domestic (CN) account id (never a token)"),
@@ -6644,6 +8071,28 @@ const Config = z.object({
 });
 /** Every region, in card tab order. */
 const REGION_KEYS = ["cn", "ai"];
+/**
+* What ONE failed real request means for the account that served it (issue #44).
+*
+* The shim only reports account-scoped kinds here, so this table never has to
+* interpret `not_found` (a model the account cannot see) or `client` (our own bad
+* body) — both would exclude a healthy account for good over something that is
+* not about the account at all.
+*
+* `credential-rejected` is the one permanent entry, and deliberately so: a 401
+* from the chat gateway means the stored token cannot be refreshed into one that
+* works, and the honest recovery is a re-login (which the card offers), not a
+* silent retry every half hour.
+*/
+const POOL_OUTCOME_BY_KIND = {
+	authentication: "credential-rejected",
+	hard_credit: "out-of-credit",
+	soft_rate: "rate-limited",
+	server: "unavailable",
+	not_found: "not-found",
+	client: "failed",
+	unconfigured: "failed"
+};
 function apply(ctx, config) {
 	const settingsNs = settingsNamespaceOf(ctx);
 	let current = () => config;
@@ -6854,7 +8303,8 @@ function apply(ctx, config) {
 			};
 			shimRoutes.push({
 				label: route,
-				client: delegating
+				client: delegating,
+				pool: poolShimHooksOf(panel)
 			});
 		}
 		const shim = createTraeShim({
@@ -6922,11 +8372,13 @@ function apply(ctx, config) {
 			* A throwaway client is used on purpose: the shared `usageClient` reads
 			* `store.resolve()`, which is bound to the selected account, and calling
 			* `selectAccount` to look at a neighbour would both race concurrent chat
-			* requests and persist a switch the user never made. A stale token simply
-			* fails here and the account is left out of the answer.
+			* requests and persist a switch the user never made. The credential is
+			* resolved (not merely looked up) so an account whose short-lived access
+			* token lapsed overnight still answers: its refresh token is good for
+			* months, and reporting `—` for a recoverable account is a lie.
 			*/
 			creditsOfAccount: async (accountId) => {
-				const credential = await store.credentialOf(accountId);
+				const credential = await store.resolveCredentialOf(accountId);
 				if (credential === void 0) return void 0;
 				return toCredits(await new TraeUsageClient({ credential: async () => credential }).snapshot());
 			},
@@ -6934,7 +8386,7 @@ function apply(ctx, config) {
 				const state = { id: accountId };
 				const selectedCredential = await store.current();
 				const client = selectedCredential !== void 0 && traeAccountId(selectedCredential) === accountId ? usageClient : (() => {
-					const credential = store.credentialOf(accountId);
+					const credential = store.resolveCredentialOf(accountId);
 					return new TraeUsageClient({
 						credential: async () => credential,
 						deviceId: async () => (await identity()).deviceId
@@ -6952,7 +8404,7 @@ function apply(ctx, config) {
 			claimCheckinOf: async (accountId) => {
 				const selectedCredential = await store.current();
 				const client = selectedCredential !== void 0 && traeAccountId(selectedCredential) === accountId ? usageClient : (() => {
-					const credential = store.credentialOf(accountId);
+					const credential = store.resolveCredentialOf(accountId);
 					return new TraeUsageClient({
 						credential: async () => credential,
 						deviceId: async () => (await identity()).deviceId
@@ -7012,10 +8464,389 @@ function apply(ctx, config) {
 				};
 			},
 			invalidateAdapter: () => {},
-			rawDiagnostic: () => rawDiagnostic()
+			rawDiagnostic: () => rawDiagnostic(),
+			wireResolver,
+			identity,
+			routeOf: (provider) => routeOfTraeProvider(provider) ?? "solo"
+		};
+	}
+	/** This panel's saved pool preferences, unwrapped and defaulted to OFF. */
+	const poolPreferencesOf = (panel) => unwrapVolatileDeep(regionStateOf(current(), panel).pool) ?? {};
+	/**
+	* Project one account's card credits onto the pool's ranking shape.
+	*
+	* The pool's `total` is the figure a request can SPEND, which on Trae is the
+	* General bucket alone (SOLO chat never drains Work). The card's `total` is the
+	* wider `available` figure, so it is deliberately NOT reused here: ranking by it
+	* would put an account with a large Work balance and no General credit in front
+	* of one that can actually serve. `undefined` (the read failed) stays undefined
+	* so `rankPool` treats it as zero rather than as full.
+	*/
+	/**
+	* Credit totals the pool ranks on, cached per account.
+	*
+	* The CHAT path must not spend an upstream round-trip per candidate just to
+	* decide who bills: {@link poolMembersOf} reads every balance, which is right
+	* for the card (one read per poll) and far too slow per request. So the card's
+	* poll warms this cache and the router only reads it.
+	*
+	* A cold cache means "unknown", not "no credit": `rankPool` orders a missing
+	* figure as zero and then falls back to token freshness, so a cold start still
+	* picks a member — the user chose the roster — instead of refusing to bill.
+	*/
+	const poolCreditCache = {
+		cn: /* @__PURE__ */ new Map(),
+		enterprise: /* @__PURE__ */ new Map(),
+		ai: /* @__PURE__ */ new Map()
+	};
+	const poolCreditsOfAccount = async (panel, accountId) => {
+		const credits = await stacks[panel].creditsOfAccount(accountId);
+		if (credits === void 0) return void 0;
+		const within3d = credits.expiry?.within3d;
+		const projected = {
+			total: credits.generalAvailable,
+			generalAvailable: credits.generalAvailable,
+			workAvailable: credits.workAvailable,
+			expiringSoon: within3d?.total ?? 0,
+			...within3d?.earliestExpiresAtMs === void 0 ? {} : { nearestExpiryMs: within3d.earliestExpiresAtMs }
+		};
+		poolCreditCache[panel].set(accountId, projected);
+		return projected;
+	};
+	/**
+	* Assemble one pool member per LOCAL account, in the store's order.
+	*
+	* "Member" means the account still has a sign-in this machine can use: a saved
+	* id whose desktop credentials vanished is a ghost, and a ghost cannot be tested
+	* or checked in, so listing it as a member would enable a batch over nothing.
+	* The saved list is intersected separately (see
+	* {@link TraePoolDeps.effectiveMemberAccountIds}) — here the store is the source.
+	*
+	* Balance reads are settled independently: one account whose credit read fails
+	* must not take the whole pool document down, and it ranks as zero rather than
+	* disappearing.
+	*/
+	const poolMembersOf = async (panel) => {
+		const probes = await readTraePoolProbes(poolKeyOfPanel(panel));
+		const choices = await stacks[panel].store.accounts();
+		return await Promise.all(choices.map(async (choice) => {
+			const credits = await poolCreditsOfAccount(panel, choice.id).catch(() => void 0);
+			return {
+				account: {
+					id: choice.id,
+					accountName: choice.accountName
+				},
+				...credits === void 0 ? {} : { credits },
+				...probes[choice.id] === void 0 ? {} : { probe: probes[choice.id] },
+				...choice.tokenExpiresAtMs === void 0 ? {} : { tokenExpiresAtMs: choice.tokenExpiresAtMs }
+			};
+		}));
+	};
+	/**
+	* The catalog a pool test resolves its target model against.
+	*
+	* The LAST discovery wins, and the saved/live catalog is the fallback: a test
+	* clicked before the first discovery lands must still find the free models the
+	* region already knows, and one clicked after it must not be judged against a
+	* roster the upstream has since replaced.
+	*/
+	const poolCatalogOf = (panel) => stacks[panel].lastDiscovery.length > 0 ? stacks[panel].lastDiscovery : stacks[panel].catalog.current();
+	/** Id → display name for one panel, for the rows a batch reports. */
+	const poolMemberNamesOf = async (panel) => {
+		const names = {};
+		for (const member of await poolMembersOf(panel)) names[member.account.id] = member.account.accountName;
+		return names;
+	};
+	/**
+	* The accounts a batch runs on: the SAVED member list, narrowed to what this
+	* machine can still reach, in the user's own order.
+	*
+	* Order is the user's, not the ranking's, on purpose: a batch result table that
+	* reorders itself between presses is hard to read row by row, and the ranking
+	* is already shown by the table above it.
+	*/
+	const poolTargetsOf = async (panel) => {
+		const saved = poolPreferencesOf(panel).memberAccountIds ?? [];
+		const names = await poolMemberNamesOf(panel);
+		return effectiveMembersOf(saved, new Set(Object.keys(names))).map((accountId) => ({
+			accountId,
+			accountName: names[accountId] ?? ""
+		}));
+	};
+	/**
+	* Pool members from LOCAL state only: the store's logins, the saved probes and
+	* the cached credit totals. No upstream call, so it is safe on the request
+	* path (see {@link poolCreditCache} for why the cache exists).
+	*/
+	async function localPoolMembers(panel) {
+		const probes = await readTraePoolProbes(poolKeyOfPanel(panel)).catch(() => ({}));
+		const choices = await stacks[panel].store.accounts().catch(() => []);
+		const cache = poolCreditCache[panel];
+		return choices.map((choice) => {
+			const credits = cache.get(choice.id);
+			return {
+				account: {
+					id: choice.id,
+					accountName: choice.accountName
+				},
+				...credits === void 0 ? {} : { credits },
+				...probes[choice.id] === void 0 ? {} : { probe: probes[choice.id] },
+				...choice.tokenExpiresAtMs === void 0 ? {} : { tokenExpiresAtMs: choice.tokenExpiresAtMs }
+			};
+		});
+	}
+	/**
+	* The members that may actually be billed: the user's SAVED opt-in list
+	* intersected with what this machine can still reach, minus the accounts that
+	* already failed this request (`billableMembers` is the one definition of that
+	* rule, shared with the batch paths).
+	*/
+	async function poolBillableMembers(panel, tried = []) {
+		return billableMembers(await localPoolMembers(panel), poolPreferencesOf(panel).memberAccountIds ?? [], tried);
+	}
+	/**
+	* Point the NEXT request at the best pooled account, or back at the bound one
+	* when the pool is off (issue #44).
+	*
+	* Returns the account it chose. Both the chat path and the card's usage read go
+	* through here, so "currently serving" on screen and the next real request
+	* cannot disagree — one rule, one answer.
+	*
+	* When EVERY member is excluded the rotation is cleared rather than pointed at
+	* an excluded account: the bound account then serves, which is the user's own
+	* explicit choice and the only account a refusal would not have served anyway.
+	* The card reports the exclusion reasons, so this is never silent.
+	*/
+	async function applyPoolSelection(panel) {
+		const store = stacks[panel].store;
+		if (poolPreferencesOf(panel).enabled !== true) {
+			store.setRotatedAccount(void 0);
+			return;
+		}
+		try {
+			const winner = pickAccount(await poolBillableMembers(panel), Date.now());
+			store.setRotatedAccount(winner?.id);
+			return winner?.id;
+		} catch {
+			store.setRotatedAccount(void 0);
+			return;
+		}
+	}
+	/**
+	* The client for the next account worth trying, bound to THAT account.
+	*
+	* Built per attempt from the account's own stored credential, so a failover
+	* never rebinds the store and never disturbs a request that is already billing
+	* the chosen account (the same rule per-account probes follow, issue #25). The
+	* bridge is the same one a normal turn uses, so display ids still resolve to
+	* their wire names.
+	*/
+	async function failoverClientFor(panel, tried) {
+		const next = pickAccount(await poolBillableMembers(panel, tried), Date.now());
+		if (next === void 0) return void 0;
+		const stack = stacks[panel];
+		const accountId = next.id;
+		return {
+			accountId,
+			client: new TraeSoloBridge(new TraeSoloUpstreamClient({
+				credential: async () => {
+					const credential = await stack.store.resolveCredentialOf(accountId);
+					if (credential === void 0) throw new Error(`no stored credential for account ${accountId}`);
+					return credential;
+				},
+				identity: () => stack.identity(),
+				route: stack.routeOf(providerOfPanel(panel)),
+				log: (message, detail) => ctx.logger.warn(message, detail)
+			}), stack.catalog, stack.wireResolver)
+		};
+	}
+	/**
+	* Persist what a real request taught us about an account (issue #44).
+	*
+	* Written as a `live-request` probe so the card can tell a measurement taken by
+	* a batch from one taken by traffic, and so the ranking excludes the account on
+	* its next turn instead of walking back into the same limit.
+	*/
+	async function recordPoolFailure(panel, accountId, kind, message) {
+		const outcome = POOL_OUTCOME_BY_KIND[kind];
+		if (outcome === void 0) return;
+		await writeTraePoolProbes(poolKeyOfPanel(panel), { [accountId]: {
+			outcome,
+			atMs: Date.now(),
+			source: "live-request",
+			message: `${kind}: ${message}`
+		} }).catch(() => {});
+	}
+	/**
+	* Why nothing else could serve, as one clause for the error the caller sees.
+	*
+	* `undefined` when the pool is off (the plain upstream error is the whole
+	* story) or when there was in fact a candidate left — the shim asked because it
+	* ran out of attempts, not out of accounts.
+	*/
+	async function poolShortfallOf(panel, tried) {
+		if (poolPreferencesOf(panel).enabled !== true) return void 0;
+		let members;
+		let remaining;
+		try {
+			members = await poolBillableMembers(panel);
+			if (members.length === 0) return "the account pool is enabled but has no usable member";
+			remaining = await poolBillableMembers(panel, tried);
+		} catch {
+			return;
+		}
+		if (remaining.length === 0) return `all ${members.length} pooled account(s) were tried for this request`;
+		const ranked = rankPool(remaining, Date.now());
+		const reasons = [...new Set(ranked.flatMap((entry) => entry.excludedBy === void 0 ? [] : [entry.excludedBy]))];
+		return reasons.length === 0 ? void 0 : `every remaining pooled account is excluded (${reasons.join(", ")})`;
+	}
+	/**
+	* The shim's view of one panel's pool.
+	*
+	* Declared as a hoisted function because the shim's route table is built ABOVE
+	* this point in `apply`; only the bodies run later, on a real request.
+	*/
+	function poolShimHooksOf(panel) {
+		return {
+			prepare: () => applyPoolSelection(panel),
+			next: (tried) => failoverClientFor(panel, tried),
+			failed: (accountId, kind, message) => recordPoolFailure(panel, accountId, kind, message),
+			shortfall: (tried) => poolShortfallOf(panel, tried)
 		};
 	}
 	/**
+	* The pool's dependency bag for ONE panel.
+	*
+	* Every member re-reads the store on each call rather than capturing a list:
+	* a batch runs for minutes, and a sign-in the user performed half-way through
+	* must be visible to the rows it has not reached yet.
+	*
+	* The bag is built per REQUEST, so it captures the panel and never has to be
+	* told which tab asked.
+	*/
+	const poolDepsOf = (panel) => {
+		const bridges = /* @__PURE__ */ new Map();
+		const chatBridgeFor = (accountId) => {
+			const existing = bridges.get(accountId);
+			if (existing !== void 0) return existing;
+			const stack = stacks[panel];
+			const bridge = new TraeSoloBridge(new TraeSoloUpstreamClient({
+				credential: async () => {
+					const credential = await stack.store.resolveCredentialOf(accountId);
+					if (credential === void 0) throw new Error(`no stored credential for account ${accountId}`);
+					return credential;
+				},
+				identity: () => stack.identity(),
+				route: stack.routeOf(providerOfPanel(panel)),
+				log: (message, detail) => ctx.logger.warn(message, detail)
+			}), stack.catalog, stack.wireResolver);
+			const chat = (body, signal) => bridge.chatStream(body, signal);
+			bridges.set(accountId, chat);
+			return chat;
+		};
+		const probeDeps = () => ({
+			credentialFor: (accountId) => stacks[panel].store.resolveCredentialOf(accountId),
+			checkinStatusOf: async (credential) => {
+				return new TraeUsageClient({
+					credential: async () => credential,
+					deviceId: async () => (await stacks[panel].identity()).deviceId
+				}).checkinStatus();
+			},
+			claimCheckinOf: async (credential) => {
+				return new TraeUsageClient({
+					credential: async () => credential,
+					deviceId: async () => (await stacks[panel].identity()).deviceId
+				}).claimCheckin();
+			},
+			chatFor: (credential) => chatBridgeFor(traeAccountId(credential))
+		});
+		/** How much text a probe should carry for this panel (0 = the minimal probe). */
+		const probeInputTokensOf = (stored) => {
+			const tokens = poolPreferencesOf(stored).probeInputTokens;
+			return typeof tokens === "number" && Number.isFinite(tokens) && tokens > 0 ? Math.min(tokens, MAX_PROBE_INPUT_TOKENS) : 0;
+		};
+		/** One account's row, through the same bridge and probe the batch uses. */
+		const testWith = async (target, modelId, probeInputTokens) => {
+			const [row] = await testAllAccounts([target], modelId, (chatFor, credential, id) => {
+				if (credential === void 0) return Promise.resolve({
+					id,
+					verdict: "auth",
+					detail: "no stored credential for this account"
+				});
+				return probeOneModel(chatFor(credential), id, void 0, probeInputTokens);
+			}, probeDeps());
+			return row;
+		};
+		return {
+			preferences: (stored) => poolPreferencesOf(stored),
+			members: (stored) => poolMembersOf(stored),
+			effectiveMemberAccountIds: async (stored) => {
+				return effectiveMembersOf(poolPreferencesOf(stored).memberAccountIds ?? [], new Set((await poolMembersOf(stored)).map((member) => member.account.id)));
+			},
+			memberNames: async (stored) => {
+				const names = {};
+				for (const member of await poolMembersOf(stored)) names[member.account.id] = member.account.accountName;
+				return names;
+			},
+			otherAccounts: async (stored) => (await poolMembersOf(stored)).map((member) => member.account),
+			currentAccountId: async (stored) => {
+				const configured = configuredAccountsOf(current())[stored];
+				return isTraeAccountId(configured) ? configured : void 0;
+			},
+			catalog: (stored) => poolCatalogOf(stored),
+			checkinSupported: (stored) => regionOfPanel(stored) === "cn",
+			checkin: async (stored) => checkinAllAccounts(await poolTargetsOf(stored), probeDeps()),
+			checkinState: async (stored) => {
+				const state = {};
+				for (const target of await poolTargetsOf(stored)) {
+					const credential = await stacks[stored].store.resolveCredentialOf(target.accountId);
+					if (credential === void 0) continue;
+					const client = new TraeUsageClient({
+						credential: async () => credential,
+						deviceId: async () => (await stacks[stored].identity()).deviceId
+					});
+					try {
+						const status = await client.checkinStatus();
+						state[target.accountId] = {
+							checkedIn: status.checkedIn,
+							deviceCheckedIn: status.didCheckedIn,
+							enabled: status.enabled
+						};
+					} catch {}
+				}
+				return state;
+			},
+			test: async (stored, modelId, onRow) => {
+				const probeInputTokens = probeInputTokensOf(stored);
+				const rows = await testAllAccounts(await poolTargetsOf(stored), modelId, (chatFor, credential, id) => {
+					if (credential === void 0) return Promise.resolve({
+						id,
+						verdict: "auth",
+						detail: "no stored credential for this account"
+					});
+					return probeOneModel(chatFor(credential), id, void 0, probeInputTokens);
+				}, probeDeps(), onRow);
+				await writeTraePoolProbes(poolKeyOfPanel(stored), probeUpdatesOf(rows));
+				return rows;
+			},
+			testOne: async (stored, accountId) => {
+				const model = resolveTargetModel(poolCatalogOf(stored), poolPreferencesOf(stored).targetModelId);
+				if (model.modelId === void 0) return void 0;
+				const names = await poolMemberNamesOf(stored);
+				const row = await testWith({
+					accountId,
+					accountName: names[accountId] ?? ""
+				}, model.modelId, probeInputTokensOf(stored));
+				await writeTraePoolProbes(poolKeyOfPanel(stored), probeUpdatesOf([row]));
+				return row;
+			},
+			removeOne: async (stored, accountId) => {
+				await dropTraePoolProbe(poolKeyOfPanel(stored), accountId);
+				return true;
+			}
+		};
+	};
+	/**
 	* The app's current sign-in when it differs from the bound account (issue
 	* #29). Pure read: the store resolves the bound account verbatim, so billing
 	* never moves from here — the card's hint and the follow switch below are
@@ -7071,7 +8902,28 @@ function apply(ctx, config) {
 		creditsOfAccount: (panel, accountId) => stacks[panel].creditsOfAccount(accountId),
 		accountStateOf: (panel, accountId) => stacks[panel].accountStateOf(accountId),
 		claimCheckinOf: (panel, accountId) => stacks[panel].claimCheckinOf(accountId),
-		liveLogin: (panel) => liveLoginOf(panel)
+		liveLogin: (panel) => liveLoginOf(panel),
+		pool: {
+			preferences: (panel) => poolPreferencesOf(panel),
+			members: (panel) => poolMembersOf(panel),
+			effectiveMemberAccountIds: async (panel) => {
+				return effectiveMembersOf(poolPreferencesOf(panel).memberAccountIds ?? [], new Set((await poolMembersOf(panel)).map((member) => member.account.id)));
+			},
+			memberNames: (panel) => poolMemberNamesOf(panel),
+			otherAccounts: async (panel) => (await poolMembersOf(panel)).map((member) => member.account),
+			currentAccountId: async (panel) => {
+				await applyPoolSelection(panel).catch(() => void 0);
+				const credential = await stacks[panel].store.current().catch(() => void 0);
+				return credential === void 0 ? void 0 : traeAccountId(credential);
+			},
+			catalog: (panel) => poolCatalogOf(panel),
+			checkinSupported: (panel) => regionOfPanel(panel) === "cn",
+			checkin: (panel) => poolDepsOf(panel).checkin?.(panel) ?? Promise.resolve([]),
+			checkinState: (panel) => poolDepsOf(panel).checkinState?.(panel) ?? Promise.resolve({}),
+			test: (panel, modelId, onRow) => poolDepsOf(panel).test?.(panel, modelId, onRow) ?? Promise.resolve([]),
+			testOne: (panel, accountId) => poolDepsOf(panel).testOne?.(panel, accountId) ?? Promise.resolve(void 0),
+			removeOne: (panel, accountId) => poolDepsOf(panel).removeOne?.(panel, accountId) ?? Promise.resolve(false)
+		}
 	}));
 	/**
 	* Live registration handles per region, filled once the shim is listening.
@@ -7306,4 +9158,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { Config, FALLBACK_TRAE_MODELS, FALLBACK_TRAE_MODELS_AI, REGION_GATEWAYS, SseDecoder, TRAE_ACCOUNT_STATUS_PATH, TRAE_AI_PROVIDER, TRAE_CHECKIN_PATH, TRAE_CN_AGENT_TASK_PATH, TRAE_CN_TITLE_PATH, TRAE_ENTERPRISE_PROVIDER, TRAE_MODELS_TEST_PATH, TRAE_MODEL_DETAIL_FUNCTIONS, TRAE_MODEL_DETAIL_PATH, TRAE_PANELS, TRAE_PAY_BASE, TRAE_PROBE_TIMEOUT_MS, TRAE_PROVIDER, TRAE_PROVIDERS, TRAE_PROVIDER_DISPLAY_NAMES, TRAE_PROVIDER_IDS, TRAE_PROVIDER_ID_DISPLAY_NAMES, TRAE_PROVIDER_ROUTES, TRAE_RAW_CHAT_V1_PATH, TRAE_RAW_CHAT_V2_PATH, TRAE_REASONING_EFFORTS, TRAE_REGIONS, TRAE_REGION_PARAM, TRAE_SETTINGS_NS, TRAE_SOLO_CHAT_PATH, TRAE_SOLO_FUNCTION, TRAE_SOLO_MODELS_PATH, TRAE_SOLO_REMOTE_BASE, TRAE_STATE_DB_FILENAME, TRAE_STREAM_IDLE_TIMEOUT_MS, TRAE_USAGE_PATH, TRAE_VERSION_CODE_FALLBACK, TraeCatalog, TraeCredentialStore, TraeDelegatingUpstreamClient, TraeFallbackUpstreamClient, TraeGatedUpstreamClient, TraeRawCapabilityController, TraeRawCapabilityState, TraeRawChatUpstreamClient, TraeSoloBridge, TraeSoloRemoteCatalogClient, TraeSoloUpstreamClient, TraeUsageClient, UnconfiguredTraeUpstreamClient, adaptLegacyPiAiContext, adaptModernPiAiContext, apply, applyContextBudgets, applyImageSelection, applyReasoningEffort, asVolatile, bridgeTraeSoloStream, buildTraeAgentTaskBody, buildTraeCnHeaders, buildTraeFusionRawChatEnvelope, buildTraeModelDetailRequest, buildTraeRawChatDraft, buildTraeRawChatRuntimeConfig, classifyProbeError, classifyProbeResult, classifyTraeRawChatFailure, configuredAccountsOf, createTraeAdapter, createTraeRawGateway, createTraeShim, creditPosition, decidePiAiGeneration, decodeRawChatChunk, decodeTraeEvent, decryptTraeStorageValue, deriveCatalog, describeIdShape, describeNameShape, describeTraeFailure, discoveredCatalog, displayNameOfTraeProvider, fallbackModelsFor, followAppLoginEnabled, generationOf, hashTraeRawChatArg, identityHeaders, inject, isEnterpriseAccount, legacyTraeOwnAuthPath, maskUserPath, mergeTraeModelSources, name, nextRegionCreditPosition, nextRegionEnabled, nextRegionSlots, normalizeTraeCredential, normalizeTraeVersionCode, panelOfKey, panelOfProvider, parseObservedModelConfig, parseReasoningCapability, parseTraeAuthValue, parseTraeCachedModel, parseTraeModelExtraConfigLogLine, parseTraeRawChatBehaviorConfig, parseTraeRemoteModel, parseTraeStorageDocument, piAiRuntimeInfo, pickTraeStorageIdentity, prepareSoloBody, probeBody, probeModelsSequentially, probeOneModel, probeTraeRawChatCapability, providerOfPanel, rawCapabilityDiagnostic, rawCapabilityFingerprint, readTraeCachedModel, readTraeCliIdentity, readTraeIdentity, refreshTraeCredential, regionCreditPositionOf, regionEnabled, regionEnabledOf, regionOfCredential, regionOfEdition, regionOfHost, regionOfPanel, regionOfTraeProvider, regionOfTraeStatusUrl, regionOfUserRegion, regionStateOf, registerTraeUsageRoute, resolveTraeIdentity, resolveTraeRawRuntime, routeOfTraeProvider, sanitizeCatalog, settingsNamespaceOf, traeEndpoint, traeInputModalities, traeModelDisplayName, traeOwnAuthPath, traeRawChatExtraInfo, traeStateDatabaseCandidates, traeStorageCandidates, traeWebUsage, traeWindowsAppNames, unwrapVolatile, unwrapVolatileDeep, withContextAdaptation, withTraeRegion };
+export { Config, FALLBACK_TRAE_MODELS, FALLBACK_TRAE_MODELS_AI, MAX_PROBE_INPUT_TOKENS, REGION_GATEWAYS, SseDecoder, TRAE_ACCOUNT_STATUS_PATH, TRAE_AI_PROVIDER, TRAE_CHECKIN_PATH, TRAE_CN_AGENT_TASK_PATH, TRAE_CN_TITLE_PATH, TRAE_ENTERPRISE_PROVIDER, TRAE_MODELS_TEST_PATH, TRAE_MODEL_DETAIL_FUNCTIONS, TRAE_MODEL_DETAIL_PATH, TRAE_PANELS, TRAE_PAY_BASE, TRAE_PROBE_TIMEOUT_MS, TRAE_PROVIDER, TRAE_PROVIDERS, TRAE_PROVIDER_DISPLAY_NAMES, TRAE_PROVIDER_IDS, TRAE_PROVIDER_ID_DISPLAY_NAMES, TRAE_PROVIDER_ROUTES, TRAE_RAW_CHAT_V1_PATH, TRAE_RAW_CHAT_V2_PATH, TRAE_REASONING_EFFORTS, TRAE_REGIONS, TRAE_REGION_PARAM, TRAE_SETTINGS_NS, TRAE_SOLO_CHAT_PATH, TRAE_SOLO_FUNCTION, TRAE_SOLO_MODELS_PATH, TRAE_SOLO_REMOTE_BASE, TRAE_STATE_DB_FILENAME, TRAE_STREAM_IDLE_TIMEOUT_MS, TRAE_USAGE_PATH, TRAE_VERSION_CODE_FALLBACK, TraeCatalog, TraeCredentialStore, TraeDelegatingUpstreamClient, TraeFallbackUpstreamClient, TraeGatedUpstreamClient, TraeRawCapabilityController, TraeRawCapabilityState, TraeRawChatUpstreamClient, TraeSoloBridge, TraeSoloRemoteCatalogClient, TraeSoloUpstreamClient, TraeUsageClient, UnconfiguredTraeUpstreamClient, adaptLegacyPiAiContext, adaptModernPiAiContext, apply, applyContextBudgets, applyImageSelection, applyReasoningEffort, asVolatile, bridgeTraeSoloStream, buildTraeAgentTaskBody, buildTraeCnHeaders, buildTraeFusionRawChatEnvelope, buildTraeModelDetailRequest, buildTraeRawChatDraft, buildTraeRawChatRuntimeConfig, classifyProbeError, classifyProbeResult, classifyTraeRawChatFailure, configuredAccountsOf, createTraeAdapter, createTraeRawGateway, createTraeShim, creditPosition, decidePiAiGeneration, decodeRawChatChunk, decodeTraeEvent, decryptTraeStorageValue, deriveCatalog, describeIdShape, describeNameShape, describeTraeFailure, discoveredCatalog, displayNameOfTraeProvider, fallbackModelsFor, followAppLoginEnabled, generationOf, hashTraeRawChatArg, identityHeaders, inject, isEnterpriseAccount, legacyTraeOwnAuthPath, maskUserPath, mergeTraeModelSources, name, nextRegionCreditPosition, nextRegionEnabled, nextRegionSlots, normalizeTraeCredential, normalizeTraeVersionCode, panelOfKey, panelOfProvider, parseObservedModelConfig, parseReasoningCapability, parseTraeAuthValue, parseTraeCachedModel, parseTraeModelExtraConfigLogLine, parseTraeRawChatBehaviorConfig, parseTraeRemoteModel, parseTraeStorageDocument, piAiRuntimeInfo, pickTraeStorageIdentity, prepareSoloBody, probeBody, probeModelsSequentially, probeOneModel, probeTraeRawChatCapability, providerOfPanel, rawCapabilityDiagnostic, rawCapabilityFingerprint, readTraeCachedModel, readTraeCliIdentity, readTraeIdentity, refreshTraeCredential, regionCreditPositionOf, regionEnabled, regionEnabledOf, regionOfCredential, regionOfEdition, regionOfHost, regionOfPanel, regionOfTraeProvider, regionOfTraeStatusUrl, regionOfUserRegion, regionStateOf, registerTraeUsageRoute, resolveTraeIdentity, resolveTraeRawRuntime, routeOfTraeProvider, sanitizeCatalog, settingsNamespaceOf, traeEndpoint, traeInputModalities, traeModelDisplayName, traeOwnAuthPath, traeRawChatExtraInfo, traeStateDatabaseCandidates, traeStorageCandidates, traeWebUsage, traeWindowsAppNames, unwrapVolatile, unwrapVolatileDeep, withContextAdaptation, withTraeRegion };