dsh-plugin-subscription-oauth 0.7.0 → 0.8.1

package/lib/providers/antigravity.d.ts

@@ -218,6 +218,12 @@ export declare class AntigravityAdapter extends LlmAdapter {
     private shippedCatalog;
     resolveModel(_provider: string, model: string): Promise<LlmResolvedModelInfo>;
     stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+    /** Whether an account is remembered as spent until a future reset. */
+    private isSpent;
+    /** The moment an account's allowance is known to reset, when recorded. */
+    private resetAt;
+    /** Remember an account as spent (its exact reset is learned separately). */
+    private noteSpent;
     /** Translate an auth failure into the message a user can act on. */
     private refreshHint;
     /** Build and send one streaming request for one model. */

package/lib/providers/antigravity.js

@@ -12,6 +12,7 @@
 import { EMPTY_RESPONSE_CODE, errorChain, LlmAdapter, LlmError, } from '@deepseek-ai/dsh-llm';
 import { REAUTH_REQUIRED, ProviderError } from '../errors.js';
 import { attributedHeaders } from '../auth/headers.js';
+import { allowanceScheduler } from '../auth/allowance-scheduler.js';
 import { LoopbackFlow } from '../auth/pkce-flow.js';
 import { TokenStore, finiteInstant, nonEmpty } from '../auth/store.js';
 import { TokenManager } from '../auth/tokens.js';
@@ -415,25 +416,53 @@ export class AntigravityAdapter extends LlmAdapter {
         const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
         try {
             // `auto` owns the fallback chain now, so this route serves exactly the
-            // model it was asked for.
+            // model it was asked for — but it draws on every account the provider holds, so a
+            // spent allowance moves to the next account rather than failing the call.
             const model = options.model;
+            // Accounts come from the manager when it can list them; a minimal manager (or a
+            // test double) without `accounts()` means a single account, which is just the
+            // default one.
+            const accounts = typeof this.options.tokens.accounts === 'function'
+                ? await this.options.tokens.accounts()
+                : [];
+            const tried = new Set();
             let token = await this.options.tokens.resolve();
-            let response = await this.request(options, model, token.account, token.accessToken, watchdog.signal);
-            if (response.status === 401 || response.status === 403) {
-                // The stored token was accepted locally but refused on the wire; force
-                // one refresh, then report the credential as dead if it still fails.
-                token = await this.options.tokens.resolve(token.account, true);
-                response = await this.request(options, model, token.account, token.accessToken, watchdog.signal);
+            // Move an account known to be spent (from a past failure) to the back, so a fresh
+            // request starts on one that has allowance. A lone account still serves.
+            const order = [...accounts.filter((a) => a !== token.account && !this.isSpent(a)), token.account,
+                ...accounts.filter((a) => a !== token.account && this.isSpent(a))];
+            for (const accountKey of order) {
+                if (tried.has(accountKey))
+                    continue;
+                tried.add(accountKey);
+                token = await this.options.tokens.resolve(accountKey);
+                let response = await this.request(options, model, token.account, token.accessToken, watchdog.signal);
                 if (response.status === 401 || response.status === 403) {
-                    this.options.onCredentialRejected?.(token.account);
+                    // The stored token was accepted locally but refused on the wire; force
+                    // one refresh, then report the credential as dead if it still fails.
+                    token = await this.options.tokens.resolve(token.account, true);
+                    response = await this.request(options, model, token.account, token.accessToken, watchdog.signal);
+                    if (response.status === 401 || response.status === 403) {
+                        this.options.onCredentialRejected?.(token.account);
+                    }
                 }
+                // A spent allowance (402/429) moves to the next account, remembering when this
+                // one refills so later requests skip it until then.
+                if (!response.ok && (response.status === 402 || response.status === 429) && order.length > 1) {
+                    this.noteSpent(token.account);
+                    const resetAt = await this.resetAt(token.account);
+                    allowanceScheduler.noteReset(ANTIGRAVITY_PROVIDER_ID, token.account, resetAt);
+                    continue;
+                }
+                if (!response.ok)
+                    throw await httpLlmError(response, 'Antigravity API');
+                if (response.body === null) {
+                    throw new LlmError('Antigravity API returned no response body', EMPTY_RESPONSE_CODE);
+                }
+                yield* streamAntigravity(response.body, () => { watchdog.pulse(); });
+                return;
             }
-            if (!response.ok)
-                throw await httpLlmError(response, 'Antigravity API');
-            if (response.body === null) {
-                throw new LlmError('Antigravity API returned no response body', EMPTY_RESPONSE_CODE);
-            }
-            yield* streamAntigravity(response.body, () => { watchdog.pulse(); });
+            throw new LlmError('Antigravity API: every account\'s allowance is spent', EMPTY_RESPONSE_CODE);
         }
         catch (error) {
             throw mapFetchFailure('Antigravity API', this.refreshHint(error), watchdog, options.signal);
@@ -442,6 +471,28 @@ export class AntigravityAdapter extends LlmAdapter {
             watchdog.stop();
         }
     }
+    /** Whether an account is remembered as spent until a future reset. */
+    isSpent(account) {
+        return allowanceScheduler.isSpentUntilReset(ANTIGRAVITY_PROVIDER_ID, account);
+    }
+    /** The moment an account's allowance is known to reset, when recorded. */
+    async resetAt(account) {
+        const held = await this.options.tokens.session(account);
+        if (held === undefined)
+            return undefined;
+        try {
+            const read = await this.usage(held.session.accessToken, held.session.projectId ?? '', held.session.email);
+            const spent = read.windows.find((window) => (window.usedPercent ?? 0) >= 100);
+            return spent?.resetsAt;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /** Remember an account as spent (its exact reset is learned separately). */
+    noteSpent(account) {
+        this.options.onWarn?.(`antigravity: account ${account} allowance spent; moving to another account`);
+    }
     /** Translate an auth failure into the message a user can act on. */
     refreshHint(error) {
         if (error instanceof ProviderError && error.code === REAUTH_REQUIRED) {

package/lib/providers/ark-provider.js

@@ -100,6 +100,14 @@ export function createArkProvider(options) {
         discovery: options.discovery,
         streamIdleTimeoutMs: options.streamIdleTimeoutMs,
         tokens,
+        readUsage: async (account) => {
+            const held = await tokens.session(account);
+            const sts = held?.session.sts;
+            if (sts === undefined)
+                return [];
+            const read = await readArkUsage({ credentials: sts, fetchFn });
+            return read.windows;
+        },
         ...options.onWarn === undefined ? {} : { onWarn: options.onWarn },
         ...options.resolveAttachments === undefined ? {} : { resolveAttachments: options.resolveAttachments },
         hiddenModels: () => options.preferences.hiddenIds(ARK_PROVIDER_ID),

package/lib/providers/ark.d.ts

@@ -22,6 +22,7 @@ import type { TokenManager } from '../auth/tokens.js';
 import type { ArkStsCredentials } from '../auth/ark-control.js';
 import type { FetchFn } from '../http.js';
 import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
+import type { UsageWindow } from '../protocol.js';
 import type { CatalogEntry } from './catalog.js';
 import type { UsageRead } from './usage.js';
 /** Provider route this module serves. */
@@ -91,6 +92,8 @@ export interface ArkAdapterOptions {
     resolveAttachments?: () => AttachmentStore | undefined;
     onWarn?: (message: string) => void;
     onCredentialRejected?: (account: string) => void;
+    /** Read one account's metered windows, so the streamer can steer away from a spent one. */
+    readUsage?: ((account: string) => Promise<readonly UsageWindow[]>) | undefined;
     fetchFn?: FetchFn;
 }
 /** The adapter behind the `ark` route. */

package/lib/providers/ark.js

@@ -21,7 +21,7 @@ import { finiteInstant, nonEmpty } from '../auth/store.js';
 import { callArkControl, parseArkFreeUsage, parseArkPlanUsage } from '../auth/ark-control.js';
 import { proxiedFetch } from '../http.js';
 import { findEntry, resolveCatalog } from './catalog.js';
-import { streamProviderResponses } from './responses-stream.js';
+import { streamProviderResponses, accountPoolHooks } from './responses-stream.js';
 import { toResponsesInput, toResponsesTools } from '../translate/responses.js';
 /** Provider route this module serves. */
 export const ARK_PROVIDER_ID = 'ark';
@@ -167,6 +167,9 @@ export class ArkAdapter extends LlmAdapter {
             tokens: this.options.tokens,
             request: (call, model, accessToken, signal) => this.request(call, model, accessToken, signal),
             streamIdleTimeoutMs: this.options.streamIdleTimeoutMs,
+            // A 402/429 means this account's allowance is spent: draw on the next account's.
+            isAllowanceExhausted: (status) => status === 402 || status === 429,
+            ...accountPoolHooks({ provider: ARK_PROVIDER_ID, tokens: this.options.tokens, readUsage: this.options.readUsage }),
             ...this.options.onCredentialRejected === undefined
                 ? {}
                 : { onCredentialRejected: this.options.onCredentialRejected },

package/lib/providers/glm-provider.js

@@ -110,6 +110,11 @@ export function createGlmProvider(options) {
         ...options.resolveAttachments === undefined ? {} : { resolveAttachments: options.resolveAttachments },
         hiddenModels: () => options.preferences.hiddenIds(GLM_PROVIDER_ID),
         userModels: () => options.preferences.extraIds(GLM_PROVIDER_ID),
+        readUsage: async (account) => {
+            const token = await tokens.resolve(account);
+            const read = await readGlmUsage({ origin: GLM_ORIGIN, accessToken: token.accessToken, fetchFn });
+            return read.windows;
+        },
         ...options.extraModels === undefined ? {} : { extraModels: options.extraModels },
         fetchFn,
     });

package/lib/providers/glm.d.ts

@@ -86,6 +86,8 @@ export interface GlmAdapterOptions {
     resolveAttachments?: () => AttachmentStore | undefined;
     onWarn?: (message: string) => void;
     onCredentialRejected?: (account: string) => void;
+    /** Read one account's metered windows, so the streamer can steer away from a spent one. */
+    readUsage?: ((account: string) => Promise<readonly UsageWindow[]>) | undefined;
     /** Fetch implementation; defaults to the proxy-aware fetch. */
     fetchFn?: FetchFn;
 }

package/lib/providers/glm.js

@@ -13,7 +13,7 @@ import { REAUTH_REQUIRED, ProviderError } from '../errors.js';
 import { finiteInstant, nonEmpty } from '../auth/store.js';
 import { proxiedFetch } from '../http.js';
 import { findEntry, resolveCatalog } from './catalog.js';
-import { streamProviderResponses } from './responses-stream.js';
+import { streamProviderResponses, accountPoolHooks } from './responses-stream.js';
 import { toResponsesInput, toResponsesTools } from '../translate/responses.js';
 /** Provider route this module serves. */
 export const GLM_PROVIDER_ID = 'glm';
@@ -278,6 +278,9 @@ export class GlmAdapter extends LlmAdapter {
             tokens: this.options.tokens,
             request: (call, model, accessToken, signal) => this.request(call, model, accessToken, signal),
             streamIdleTimeoutMs: this.options.streamIdleTimeoutMs,
+            // A 402/429 means this account's allowance is spent: draw on the next account's.
+            isAllowanceExhausted: (status) => status === 402 || status === 429,
+            ...accountPoolHooks({ provider: GLM_PROVIDER_ID, tokens: this.options.tokens, readUsage: this.options.readUsage }),
             ...this.options.onCredentialRejected === undefined
                 ? {}
                 : { onCredentialRejected: this.options.onCredentialRejected },

package/lib/providers/grok.d.ts

@@ -18,6 +18,7 @@ import type { ProviderRoute } from '../auth/registry.js';
 import type { ModelPreferences } from '../settings.js';
 import type { FetchFn } from '../http.js';
 import type { CatalogEntry } from './catalog.js';
+import type { UsageWindow } from '../protocol.js';
 /** Route key this module registers. */
 export declare const GROK_PROVIDER_ID = "grok";
 /** Display name for selectors and diagnostics. */
@@ -135,6 +136,8 @@ export interface GrokAdapterOptions {
     modelOrder?: () => Promise<readonly string[]>;
     fetchFn?: FetchFn;
     onCredentialRejected?: (account: string) => void;
+    /** Read one account's metered windows, so the streamer can steer away from a spent one. */
+    readUsage?: ((account: string) => Promise<readonly UsageWindow[]>) | undefined;
 }
 /** Grok wire adapter: one instance serves the `grok` provider route. */
 export declare class GrokAdapter extends LlmAdapter {

package/lib/providers/grok.js

@@ -18,7 +18,7 @@ import { ProviderController } from '../auth/provider-controller.js';
 import { proxiedFetch } from '../http.js';
 import { fallbackEntry, findEntry, resolveCatalog } from './catalog.js';
 import { isMissingOrInvalidCredential } from './common.js';
-import { streamProviderResponses } from './responses-stream.js';
+import { streamProviderResponses, accountPoolHooks } from './responses-stream.js';
 import { readGrokUsage } from './usage.js';
 import { toResponsesInput, toResponsesTools } from '../translate/responses.js';
 /** Route key this module registers. */
@@ -334,6 +334,9 @@ export class GrokAdapter extends LlmAdapter {
             tokens: this.options.tokens,
             request: (call, model, accessToken, signal) => this.request(call, model, accessToken, signal),
             streamIdleTimeoutMs: this.options.streamIdleTimeoutMs,
+            // A 402/429 means this account's allowance is spent: draw on the next account's.
+            isAllowanceExhausted: (status) => status === 402 || status === 429,
+            ...accountPoolHooks({ provider: GROK_PROVIDER_ID, tokens: this.options.tokens, readUsage: this.options.readUsage }),
             ...this.options.onCredentialRejected === undefined
                 ? {}
                 : { onCredentialRejected: this.options.onCredentialRejected },
@@ -648,6 +651,11 @@ export function createGrokProvider(options) {
         hiddenModels: () => options.preferences.hiddenIds(GROK_PROVIDER_ID),
         userModels: () => options.preferences.extraIds(GROK_PROVIDER_ID),
         modelOrder: () => options.preferences.orderOf(GROK_PROVIDER_ID),
+        readUsage: async (account) => {
+            const token = await tokens.resolve(account);
+            const read = await readGrokUsage({ accessToken: token.accessToken, fetchFn: options.discoveryFetchFn ?? proxiedFetch });
+            return read === undefined ? [] : read.windows;
+        },
         ...options.discoveryFetchFn === undefined ? {} : { fetchFn: options.discoveryFetchFn },
     });
     const spec = {

package/lib/providers/kimi-provider.js

@@ -90,6 +90,11 @@ export function createKimiProvider(options) {
         ...options.onWarn === undefined ? {} : { onWarn: options.onWarn },
         ...options.resolveAttachments === undefined ? {} : { resolveAttachments: options.resolveAttachments },
         identityHeaders: async () => kimiIdentityHeaders(await loadOrCreateDeviceId(options.dataDir)),
+        readUsage: async (account) => {
+            const token = await tokens.resolve(account);
+            const read = await readKimiUsage({ apiBase: options.apiBase, accessToken: token.accessToken, fetchFn });
+            return read === undefined ? [] : read.windows;
+        },
         hiddenModels: () => options.preferences.hiddenIds(KIMI_PROVIDER_ID),
         userModels: () => options.preferences.extraIds(KIMI_PROVIDER_ID),
         modelOrder: () => options.preferences.orderOf(KIMI_PROVIDER_ID),

package/lib/providers/kimi.d.ts

@@ -10,6 +10,7 @@ import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
 import type { FetchFn } from '../http.js';
 import type { TokenManager } from '../auth/tokens.js';
 import type { SessionBase } from '../auth/store.js';
+import type { UsageWindow } from '../protocol.js';
 import type { CatalogEntry } from './catalog.js';
 /** One catalog entry exposed as a selectable model. */
 export type KimiModelEntry = CatalogEntry;
@@ -62,6 +63,14 @@ export interface KimiAdapterOptions {
     fetchFn?: FetchFn;
     /** Called when a call proved the stored credential unusable. */
     onCredentialRejected?: (account: string) => void;
+    /**
+     * Read one account's metered windows, so the streamer can steer away from an account
+     * whose allowance is spent before it fails there.
+     *
+     * Resolved per request; absence means the streamer only learns an account is spent by
+     * failing against it once.
+     */
+    readUsage?: (account: string) => Promise<readonly UsageWindow[]>;
     /** Extra model ids from the plugin configuration, appended to the catalog. */
     extraModels?: readonly string[];
     /**

package/lib/providers/kimi.js

@@ -11,7 +11,7 @@ import { kimiRequestHeaders } from '../auth/headers.js';
 import { REAUTH_REQUIRED, ProviderError } from '../errors.js';
 import { finiteInstant, nonEmpty } from '../auth/store.js';
 import { idleWatchdog, httpLlmError, isMissingOrInvalidCredential, mapFetchFailure } from './common.js';
-import { streamProviderResponses } from './responses-stream.js';
+import { streamProviderResponses, accountPoolHooks } from './responses-stream.js';
 import { fallbackEntry, findEntry, resolveCatalog } from './catalog.js';
 import { streamResponses, toResponsesInput, toResponsesTools } from '../translate/responses.js';
 import { prepareMoonshotTool } from '../translate/moonshot-schema.js';
@@ -228,6 +228,13 @@ export class KimiAdapter extends LlmAdapter {
             tokens: this.options.tokens,
             request: (call, model, accessToken, signal) => this.request(call, model, accessToken, signal),
             streamIdleTimeoutMs: this.options.streamIdleTimeoutMs,
+            // A 402/429 means this account's allowance is spent: draw on the next account's
+            // before giving up, so one model id uses the whole pool's quota.
+            isAllowanceExhausted: (status) => status === 402 || status === 429,
+            ...accountPoolHooks({ provider: KIMI_PROVIDER_ID, tokens: this.options.tokens, readUsage: this.options.readUsage }),
+            onAccountSwitch: (from, to, reason) => {
+                this.options.onWarn?.(`kimi: account ${from} allowance spent (${reason}); switching to ${to}`);
+            },
             ...this.options.onCredentialRejected === undefined
                 ? {}
                 : { onCredentialRejected: this.options.onCredentialRejected },

package/lib/providers/responses-stream.d.ts

@@ -14,6 +14,24 @@
 import type { GenerateOptions, StreamChunk } from '@deepseek-ai/dsh-llm';
 import type { SessionBase } from '../auth/store.js';
 import type { TokenManager } from '../auth/tokens.js';
+import type { UsageWindow } from '../protocol.js';
+/**
+ * Build the cross-account hooks one route needs to draw on its whole account pool.
+ *
+ * Every Responses-wire route (Kimi, Grok, GLM, Ark) meters per account and can run out;
+ * this wires the three account hooks identically, so a route only supplies how to read
+ * one account's allowance and its provider id. A route with no `readUsage` still rotates
+ * accounts on failure, it just cannot predict exhaustion before the first failure.
+ *
+ * @param provider - the provider route id, the scheduler's key.
+ * @param tokens - the route's token manager, enumerates accounts.
+ * @param readUsage - read one account's metered windows, when wired.
+ */
+export declare function accountPoolHooks<S extends SessionBase>(input: {
+    provider: string;
+    tokens: TokenManager<S>;
+    readUsage?: ((account: string) => Promise<readonly UsageWindow[]>) | undefined;
+}): Pick<ResponsesStreamInput<S>, 'accounts' | 'isAccountSpent' | 'noteAccountSpent' | 'resetsAt'>;
 /** Constructor inputs for {@link streamProviderResponses}. */
 export interface ResponsesStreamInput<S extends SessionBase> {
     /** Endpoint name used in failure messages, e.g. `Kimi API`. */
@@ -37,6 +55,32 @@ export interface ResponsesStreamInput<S extends SessionBase> {
     describeFailure?(error: unknown): unknown;
     /** Called when a model in the chain was skipped, with the reason. */
     onFallback?: (from: string, to: string, reason: string) => void;
+    /**
+     * Whether a 402/429 on this provider means "this account's allowance is spent",
+     * so the call should move to the next account rather than fail.
+     *
+     * When omitted, an exhausted allowance fails the call (the old behaviour). When
+     * set, the caller enumerates the provider's other accounts and retries each until
+     * one serves the request or every account is spent.
+     */
+    isAllowanceExhausted?: (status: number) => boolean;
+    /** Enumerate the provider's accounts, most preferred first; enables cross-account retry. */
+    accounts?: () => Promise<readonly string[]>;
+    /** Called when a call moved to another account because the first was spent. */
+    onAccountSwitch?: (from: string, to: string, reason: string) => void;
+    /**
+     * Whether one account's allowance is best not used for a fresh request right now.
+     *
+     * The caller supplies this to steer a request away from an account that is nearly
+     * spent (or already spent until a remembered reset), so the request starts on a fuller
+     * account instead of failing once to find out. It may read the account's live figures;
+     * an account flagged here is tried last, not skipped, so a lone account still serves.
+     */
+    isAccountSpent?: (account: string) => Promise<boolean>;
+    /** Remember that an account's allowance is spent until a given reset moment. */
+    noteAccountSpent?: (account: string, resetsAt: number | undefined) => void;
+    /** The moment one account's allowance is known to reset, when it was recorded. */
+    resetsAt?: (account: string) => Promise<number | undefined>;
 }
 /**
  * Run one model call over the Responses wire, walking a model chain.

package/lib/providers/responses-stream.js

@@ -12,8 +12,49 @@
  * @module dsh-plugin-subscription-oauth/providers/responses-stream
  */
 import { EMPTY_RESPONSE_CODE, LlmError } from '@deepseek-ai/dsh-llm';
+import { allowanceScheduler } from '../auth/allowance-scheduler.js';
 import { streamResponses } from '../translate/responses.js';
 import { httpLlmError, idleWatchdog, mapFetchFailure } from './common.js';
+/**
+ * Build the cross-account hooks one route needs to draw on its whole account pool.
+ *
+ * Every Responses-wire route (Kimi, Grok, GLM, Ark) meters per account and can run out;
+ * this wires the three account hooks identically, so a route only supplies how to read
+ * one account's allowance and its provider id. A route with no `readUsage` still rotates
+ * accounts on failure, it just cannot predict exhaustion before the first failure.
+ *
+ * @param provider - the provider route id, the scheduler's key.
+ * @param tokens - the route's token manager, enumerates accounts.
+ * @param readUsage - read one account's metered windows, when wired.
+ */
+export function accountPoolHooks(input) {
+    const { provider, tokens, readUsage } = input;
+    return {
+        accounts: () => tokens.accounts(),
+        // Steer away from an account that has no allowance: read its live figures when a
+        // reader is wired (so a 100 % window is avoided before it fails there), else fall
+        // back to the remembered reset time from a past failure.
+        isAccountSpent: async (account) => {
+            if (readUsage !== undefined) {
+                try {
+                    const windows = await readUsage(account);
+                    const spentWindow = windows.find((window) => (window.usedPercent ?? 0) >= 100);
+                    if (spentWindow !== undefined) {
+                        allowanceScheduler.noteReset(provider, account, spentWindow.resetsAt);
+                        return true;
+                    }
+                    return false;
+                }
+                catch {
+                    // A failed read is not a reason to avoid the account; fall through to memory.
+                }
+            }
+            return allowanceScheduler.isSpentUntilReset(provider, account);
+        },
+        noteAccountSpent: (account, resetsAt) => { allowanceScheduler.noteReset(provider, account, resetsAt); },
+        resetsAt: async (account) => allowanceScheduler.resetAt(provider, account),
+    };
+}
 /**
  * Whether a refusal says "this model cannot serve you now", as opposed to "this
  * request is wrong".
@@ -60,20 +101,92 @@ export async function* streamProviderResponses(options, input) {
         if (models.length === 0) {
             throw new LlmError(`${label} has no enabled model to dispatch to`, EMPTY_RESPONSE_CODE);
         }
-        let token = await tokens.resolve();
-        for (const [index, model] of models.entries()) {
-            try {
-                let response = await request(options, model, token.accessToken, watchdog.signal);
-                if (response.status === 401 || response.status === 403) {
-                    token = await tokens.resolve(token.account, true);
-                    response = await request(options, model, token.accessToken, watchdog.signal);
+        // When the provider meters per account and an account's allowance can run out,
+        // every account is a candidate: a spent one falls through to the next, so one
+        // model id draws on the whole pool's allowance. Accounts are tried in order;
+        // the first that serves the request wins.
+        let accounts = input.accounts === undefined
+            ? undefined
+            : [...await input.accounts()];
+        // Send work straight to an account that has allowance: one already known to be
+        // spent until a future reset is moved to the back, so a fresh request does not
+        // fail against it once to find out. This is a preference, not a skip — a lone
+        // account still serves, and the spent-retry below catches a stale record.
+        if (accounts !== undefined && accounts.length > 1 && input.isAccountSpent !== undefined) {
+            const fresh = [];
+            const tired = [];
+            for (const account of accounts) {
+                if (await input.isAccountSpent(account))
+                    tired.push(account);
+                else
+                    fresh.push(account);
+            }
+            if (tired.length > 0 && fresh.length > 0) {
+                accounts = [...fresh, ...tired];
+            }
+        }
+        const tryAccounts = accounts === undefined || accounts.length === 0
+            ? [undefined]
+            : accounts;
+        for (const accountKey of tryAccounts) {
+            let token = await tokens.resolve(accountKey);
+            // Track which accounts a spent-allowance already moved past, so a later model
+            // in the chain does not re-try an account known to be exhausted.
+            const spent = new Set();
+            for (const [index, model] of models.entries()) {
+                try {
+                    if (spent.has(token.account))
+                        continue;
+                    let response = await request(options, model, token.accessToken, watchdog.signal);
                     if (response.status === 401 || response.status === 403) {
-                        input.onCredentialRejected?.(token.account);
+                        token = await tokens.resolve(token.account, true);
+                        response = await request(options, model, token.accessToken, watchdog.signal);
+                        if (response.status === 401 || response.status === 403) {
+                            input.onCredentialRejected?.(token.account);
+                        }
+                    }
+                    // A spent allowance moves to the next account (when the provider supports
+                    // it), not to the next model: the model is fine, the account is not.
+                    if (!response.ok
+                        && input.isAllowanceExhausted !== undefined
+                        && input.accounts !== undefined
+                        && input.isAllowanceExhausted(response.status)
+                        && tryAccounts.length > 1) {
+                        spent.add(token.account);
+                        // Remember when this account's allowance refills, so later requests go
+                        // straight to another account until then instead of failing here again.
+                        input.noteAccountSpent?.(token.account, await input.resetsAt?.(token.account));
+                        const next = tryAccounts.find((candidate) => candidate !== undefined && !spent.has(candidate));
+                        if (next !== undefined) {
+                            lastError = await httpLlmError(response, label);
+                            input.onAccountSwitch?.(token.account, next, reasonOf(lastError));
+                            token = await tokens.resolve(next);
+                            // Re-try this same model on the fresh account.
+                            response = await request(options, model, token.accessToken, watchdog.signal);
+                        }
+                    }
+                    if (!response.ok) {
+                        const error = await httpLlmError(response, label);
+                        if (models.length > 1 && isModelFallbackWorthy(response.status) && index < models.length - 1) {
+                            const next = models[index + 1];
+                            if (next !== undefined) {
+                                lastError = error;
+                                input.onFallback?.(model, next, reasonOf(error));
+                                continue;
+                            }
+                        }
+                        throw error;
                     }
+                    if (response.body === null) {
+                        throw new LlmError(`${label} returned no response body`, EMPTY_RESPONSE_CODE);
+                    }
+                    yield* streamResponses(response.body, () => { watchdog.pulse(); });
+                    return;
                 }
-                if (!response.ok) {
-                    const error = await httpLlmError(response, label);
-                    if (models.length > 1 && isModelFallbackWorthy(response.status) && index < models.length - 1) {
+                catch (error) {
+                    // A transport failure on a chain is also worth another model.
+                    const transport = error instanceof TypeError || error.name === 'AbortError';
+                    if (transport && options.signal?.aborted !== true && index < models.length - 1) {
                         const next = models[index + 1];
                         if (next !== undefined) {
                             lastError = error;
@@ -81,26 +194,8 @@ export async function* streamProviderResponses(options, input) {
                             continue;
                         }
                     }
-                    throw error;
-                }
-                if (response.body === null) {
-                    throw new LlmError(`${label} returned no response body`, EMPTY_RESPONSE_CODE);
-                }
-                yield* streamResponses(response.body, () => { watchdog.pulse(); });
-                return;
-            }
-            catch (error) {
-                // A transport failure on a chain is also worth another model.
-                const transport = error instanceof TypeError || error.name === 'AbortError';
-                if (transport && options.signal?.aborted !== true && index < models.length - 1) {
-                    const next = models[index + 1];
-                    if (next !== undefined) {
-                        lastError = error;
-                        input.onFallback?.(model, next, reasonOf(error));
-                        continue;
-                    }
+                    throw input.describeFailure === undefined ? error : input.describeFailure(error);
                 }
-                throw input.describeFailure === undefined ? error : input.describeFailure(error);
             }
         }
         throw lastError ?? new LlmError(`${label} served none of the requested models`, EMPTY_RESPONSE_CODE);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-subscription-oauth",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "description": "Use subscription accounts as DeepSeek Harness LLM providers — Kimi Code (OAuth device flow), Grok / X Premium (OIDC + PKCE), Google Antigravity (Google OAuth + Cloud Code Assist) and GLM / BigModel (ZCode's browser sign-in) — with per-model visibility, drag-to-reorder Auto fallback and plan quotas from the web Settings page",
   "license": "MIT",
   "author": "EricFL1998",