dsh-plugin-subscriptions 0.5.1 → 0.5.3

package/README.md

@@ -111,6 +111,10 @@ Either way, restart `dsh web` afterwards so the new version loads.
 
 Not logged in? The provider stays out of the picker, and requests fail with `MISSING_CREDENTIAL` pointing at the Settings page; nothing else breaks.
 
+### Multiple accounts
+
+Every provider accepts several accounts: once one is connected, the card grows an **Add account** button (Claude offers **Browser authorization** and **Import Claude Code** separately). Accounts are keyed by their identity (email / login) — re-logging the same account updates it in place, a different account appends. Browser authorization signs in whichever account the browser currently uses, so switch accounts there first (or use an incognito window with the manual code) to add a different one. The ★ default account serves the direct provider routes; pool routes use every account. A Claude account imported from Claude Code stays synced with the CLI's credential store; OAuth-added Claude accounts refresh standalone so several accounts never fight over the Keychain entry.
+
 ## Config
 
 ```yaml
@@ -132,6 +136,43 @@ catalog does not know would otherwise default to `/chat/completions`, which
 responses-only families (gpt-5.5/5.6, …) reject. Pinning `chat-completions` also opts
 out of the tools+effort auto-reroute described above.
 
+## Model pools
+
+When a provider has **two or more logged-in accounts**, the picker shows the **union** of every account's catalog (duplicates dropped). Pick `claude-sonnet-5` under Claude (or `gpt-5.4` under ChatGPT) as usual — there is no extra pool group and no new model id.
+
+- **Shared models.** A model listed by ≥2 accounts failovers between them (sticky, quota-aware). Each account is discovered separately, so a Plus login is not asked to serve a Pro-only model.
+- **Account-only models.** A model listed by only one account is sent to that account. It still appears in the picker even if that account is not the default.
+- **Explicit account lists (`families`).** Replace the auto member list for one catalog model (same provider only; cross-provider members are ignored). Pin `account` or omit it for the default.
+- **Tier extras (`tiers`, optional).** Extra picker rows with heterogeneous fallbacks, listed under the first member's provider. Not created automatically.
+
+Selection is sticky per session (prompt caches survive) with two strategies: `priority` (first healthy member wins) and `quota_aware` (the default — each member is scored by its required burn rate, `remaining quota / time until window reset`, so a window about to reset with plenty left gets spent instead of wasted; the sticky member holds until a challenger out-scores it by `switchMargin`). Members past 95% on any usage window are gated out; failures fail over before the first stream chunk with cooldowns (`retry-after` when the provider sends one) — quota and auth failures cool the whole account down (its quota is account-level; Claude's model-scoped lanes cool per member), transient server failures cool only the failing member. Copilot exposes no usage telemetry, so it scores zero and naturally serves as the fallback of last resort.
+
+```yaml
+- id: llm-subscriptions
+  name: dsh-plugin-subscriptions
+  config:
+    pool:
+      enabled: true                   # default; needs ≥2 accounts of one provider
+      strategy: quota_aware           # or priority
+      switchMargin: 2                 # hysteresis factor for quota_aware
+      autoAccounts: true              # pool each catalog model across that provider's accounts
+      families:                       # explicit account list for one catalog model (same provider)
+        claude-sonnet-5:
+          - { provider: claude, model: claude-sonnet-5 }                   # default account
+          - { provider: claude, account: bob@example.com, model: claude-sonnet-5 }
+      tiers:                          # optional extra picker rows
+        smart:
+          - { provider: claude, model: claude-sonnet-5 }
+          - { provider: codex, model: gpt-5.6-sol }
+          - { provider: grok, model: grok-4.6 }
+```
+
+## Proxy
+
+Every subscription request — token exchanges, model-API streams, usage lookups, model discovery, and the `x_search` / `image_generate` / `video_generate` tools — can be routed through an HTTP(S) proxy. Configure it in **Settings → Subscriptions → Proxy → Configure…**: enable the flag, enter the proxy URL (`http://127.0.0.1:7890`), optional username/password, and an optional comma-separated bypass list of hostnames that stay direct (`127.0.0.1`, `localhost`, `*.example.com`). The password is stored in `~/.dsh/plugins/subscriptions/proxy.json` (mode 0600) and is never returned to the browser. A "Test" button probes one endpoint through the current configuration and shows the HTTP status/latency.
+
+Changes apply immediately to subsequent requests — no restart needed. The OAuth authorization page opens in your browser and follows the browser/system proxy, not this setting. SOCKS proxies are not supported.
+
 ## Develop
 
 ```sh
@@ -148,7 +189,7 @@ After `pnpm build`, restart `dsh web` to pick up changes.
 
 - `src/index.ts` — plugin entry: config schema, adapter registration, auth-change re-announce, RPC wiring
 - `src/auth/` — PKCE/JWT helpers, token store, OAuth flow engine (temp loopback callback server), Claude Code credential reader (Keychain/file), `/subscriptions-auth` RPC channel
-- `src/providers/` — per-provider OAuth constants/exchange/refresh + `LlmAdapter`s
+- `src/providers/` — per-provider OAuth constants/exchange/refresh + `LlmAdapter`s, multi-account token plumbing (`accounts.ts`), and the pool (`pool.ts` + `pool-health.ts` / `pool-usage.ts` / `pool-family.ts`)
 - `src/translate/` — dsh `Message[]` ⟷ OpenAI Responses / Anthropic Messages wire formats, SSE → `StreamChunk`
 - `src/tools/` — `x_search`, `image_generate`, and `video_generate`
 - `src/client/` — the Settings → Subscriptions page (browser half, zh/en, theme-token aware)

package/README.zh.md

@@ -111,6 +111,10 @@ GitHub 安装的:重新执行一遍 `add github:V1ki/dsh-plugin-subscriptions`
 
 未登录时:该 provider 不出现在选择器里;直接请求会报 `MISSING_CREDENTIAL` 并提示去设置页登录,不影响其他功能。
 
+### 多账号
+
+每个 provider 可以登录多个账号:连上第一个之后,卡片会出现「添加账号」按钮(Claude 拆分为「浏览器授权」和「导入 Claude Code」两种)。账号按身份(邮箱/用户名)归档——重复登录同一账号是覆盖更新,不同账号才是新增。浏览器授权以浏览器当前登录的账号为准,要添加不同账号请先在浏览器切换账号,或用无痕窗口走手动授权码。★ 默认账号服务直连路由;池路由会使用所有账号。从 Claude Code 导入的 Claude 账号会与 CLI 的凭据存储保持同步;OAuth 添加的 Claude 账号独立刷新,多个账号不会互相覆盖 Keychain。
+
 ## 配置
 
 ```yaml
@@ -131,6 +135,43 @@ GitHub 安装的:重新执行一遍 `add github:V1ki/dsh-plugin-subscriptions`
 responses-only 系列（gpt-5.5/5.6 等）会拒绝该端点。固定为 `chat-completions` 也会退出上文所述
 tools+effort 的自动改道。
 
+## 模型池
+
+同一订阅下登录了**两个及以上账号**时,选择器显示该 provider **所有账号目录的并集**(按模型 id 去重)。照常在 Claude 组选 `claude-sonnet-5`、在 ChatGPT 组选 `gpt-5.4`——不会多出一个池分组,也不会换 model id。
+
+- **共有模型**：至少两个账号的目录都列出的模型,在这些账号之间 failover(粘性、可按配额调度)。每个账号各自做一次目录发现,Plus 不会被拿去打 Pro 才有的模型。
+- **单账号模型**：只有一个账号目录里有的模型,请求就打到那个账号。即使它不是默认账号,选择器里也会出现。
+- **显式账号列表(`families`)**：覆盖某个目录模型的自动成员(仅同一 provider;跨 provider 的成员会被忽略)。可钉 `account`,省略则用默认账号。
+- **档位额外项(`tiers`,可选)**：额外的选择器条目,failover 可以跨模型;出现在首个成员所在的 provider 分组。不会自动创建。
+
+成员选择按会话粘性(prompt 缓存不失效),两种策略:`priority`(按顺序取第一个健康成员)和 `quota_aware`(默认——按"必需消耗速率 = 剩余配额 / 距重置时间"给成员打分,快重置且剩余多的窗口优先被用掉而不是浪费;粘性成员除非被挑战者以 `switchMargin` 倍分差击败否则不换)。任一用量窗口超过 95% 的成员会被硬门槛挡下;首个流式 chunk 之前的失败会记冷却并切换下一家(provider 给了 `retry-after` 就用它)——配额与认证类失败按整个账号冷却(配额是账号级的;Claude 的分模型窗口则只冷却出错成员),瞬时服务端失败只冷却出错成员。Copilot 没有用量接口,恒为 0 分,自然充当最后的保底。
+
+```yaml
+- id: llm-subscriptions
+  name: dsh-plugin-subscriptions
+  config:
+    pool:
+      enabled: true                   # 默认开;需同一 provider ≥2 个账号
+      strategy: quota_aware           # 或 priority
+      switchMargin: 2                 # quota_aware 的滞后切换倍率
+      autoAccounts: true              # 把该 provider 各账号自动池到每个目录模型
+      families:                       # 某个目录模型的显式账号列表(同一 provider)
+        claude-sonnet-5:
+          - { provider: claude, model: claude-sonnet-5 }                   # 默认账号
+          - { provider: claude, account: bob@example.com, model: claude-sonnet-5 }
+      tiers:                          # 可选的额外选择器条目
+        smart:
+          - { provider: claude, model: claude-sonnet-5 }
+          - { provider: codex, model: gpt-5.6-sol }
+          - { provider: grok, model: grok-4.6 }
+```
+
+## 代理
+
+所有订阅相关请求 —— token 交换、模型 API 流式调用、用量查询、模型目录发现,以及 `x_search` / `image_generate` / `video_generate` 工具 —— 都可以通过 HTTP(S) 代理发出。在 **设置 → 订阅 → 代理 → 配置…** 中设置:勾选启用,填写代理地址(`http://127.0.0.1:7890`)、可选用户名/密码,以及可选的逗号分隔绕过列表(保持直连的主机名,如 `127.0.0.1`、`localhost`、`*.example.com`)。密码保存在 `~/.dsh/plugins/subscriptions/proxy.json`(权限 0600),不会回传给浏览器;「测试」按钮会用当前配置探测一次端点,显示 HTTP 状态码与耗时。
+
+保存后立即对后续请求生效,无需重启。OAuth 授权页在浏览器中打开,走浏览器/系统自身的代理设置,不受此配置影响;不支持 socks 代理。
+
 ## 开发
 
 ```sh
@@ -147,7 +188,7 @@ pnpm test      # 编译后跑 node --test 单测
 
 - `src/index.ts` —— 插件入口:配置 schema、adapter 注册、登录态变更通告、RPC 接线
 - `src/auth/` —— PKCE/JWT 工具、token 存储、OAuth 流程引擎(临时本地回调服务)、Claude Code 凭据读取器(Keychain/文件)、`/subscriptions-auth` RPC 通道
-- `src/providers/` —— 各 provider 的 OAuth 常量/换发/刷新 + `LlmAdapter` 实现
+- `src/providers/` —— 各 provider 的 OAuth 常量/换发/刷新 + `LlmAdapter` 实现,多账号 token 管理(`accounts.ts`),以及模型池(`pool.ts` + `pool-health.ts` / `pool-usage.ts` / `pool-family.ts`)
 - `src/translate/` —— dsh `Message[]` 与 OpenAI Responses / Anthropic Messages 格式互转,SSE → `StreamChunk`
 - `src/tools/` —— `x_search`、`image_generate` 与 `video_generate`
 - `src/client/` —— 设置 → 订阅页面(浏览器面,中英文,跟随明暗主题)

package/lib/auth/device-flow.d.ts

@@ -1,12 +1,3 @@
-/**
- * GitHub OAuth device-authorization flow (RFC 8628) for providers that cannot
- * use the loopback redirect engine: no redirect URI, no PKCE, no client
- * secret. The user opens a verification URL and types a short code while the
- * plugin polls the token endpoint until GitHub releases the access token.
- * The management model (one attempt per provider, `isBusy`/`pending`/`cancel`)
- * mirrors {@link OAuthFlowManager} so the auth controller can treat both
- * engines uniformly.
- */
 /** Static per-provider device-flow facts. */
 export interface DeviceFlowSpec {
     /** OAuth App / GitHub App client id the device code is requested for. */

package/lib/auth/device-flow.js

@@ -7,6 +7,7 @@
  * mirrors {@link OAuthFlowManager} so the auth controller can treat both
  * engines uniformly.
  */
+import { proxiedFetch } from '../http.js';
 /** Default poll interval when the device-code response omits one. */
 const DEFAULT_INTERVAL_SEC = 5;
 /** Default device-code lifetime when the response omits one (GitHub: 15 minutes). */
@@ -64,7 +65,7 @@ export class DeviceFlowManager {
         if (this.attempts.has(provider)) {
             throw new Error(`a ${provider} login attempt is already in progress`);
         }
-        const fetchFn = spec.fetchFn ?? fetch;
+        const fetchFn = spec.fetchFn ?? proxiedFetch;
         const response = await fetchFn(spec.deviceCodeUrl, {
             method: 'POST',
             headers: {

package/lib/auth/rpc.d.ts

@@ -8,6 +8,7 @@ import type { Context } from '@deepseek-ai/cordis';
 import type { ImageAttachmentRef } from '@deepseek-ai/dsh-attachment';
 import { type ProviderId } from './store.js';
 import type { ProviderUsage } from '../providers/common.js';
+import type { ProxyConfigView, ProxyDraft, ProxyInput, ProxyTestResult } from '../http.js';
 /** The RPC channel this plugin registers on the host connection. */
 export declare const SUBSCRIPTIONS_AUTH_CHANNEL = "/subscriptions-auth";
 /** Decoded image bytes returned by the `image` endpoint. */
@@ -36,30 +37,57 @@ export interface SpeedController {
     /** Set one session's speed tier. */
     setSpeed(sessionId: string, tier: SpeedTier): Promise<void>;
 }
+/** One logged-in account, as rendered by the Settings page. */
+export interface AccountStatus {
+    /** Stable account key (store identity). */
+    key: string;
+    /** Display identity (email / login), when known. */
+    account?: string;
+    /** Epoch milliseconds at which the stored access token expires. */
+    expiresAt?: number;
+    /** Plan name the session carries (codex planType / claude subscriptionType), when known. */
+    plan?: string;
+    /** Whether direct (non-pool) routes serve this account. */
+    isDefault: boolean;
+}
 /** Login state of one provider, as rendered by the Settings page. */
 export interface ProviderStatus {
-    /** Whether a session exists in the store. */
-    loggedIn: boolean;
     /** Whether a login attempt is currently waiting for its code. */
     busy: boolean;
-    /** Epoch milliseconds at which the stored access token expires. */
-    expiresAt?: number;
-    /** Account email or account id, when known. */
-    account?: string;
-    /** Subscription detail (plan) or the last login error. */
+    /** Logged-in accounts, default first. */
+    accounts: AccountStatus[];
+    /** The last login error, shown until the next success. */
     detail?: string;
 }
+/** How a Claude login should acquire credentials (other providers ignore it). */
+export type LoginMethod = 'oauth' | 'keychain';
+/** Proxy config operations behind the `proxyGet/proxySet/proxyTest` endpoints. */
+export interface ProxyConfigController {
+    /** Current proxy configuration (secrets omitted). */
+    get(): Promise<ProxyConfigView>;
+    /** Validate, persist, and apply one config. */
+    set(input: ProxyInput): Promise<ProxyConfigView>;
+    /** Probe one destination through the draft (unsaved) or stored proxy. */
+    test(payload: {
+        url?: string;
+        proxy?: ProxyDraft;
+    }): Promise<ProxyTestResult>;
+}
 /** Provider-agnostic auth operations the RPC handler delegates to. */
 export interface AuthController {
     /** Current status of one provider. */
     status(provider: ProviderId): Promise<ProviderStatus>;
     /**
      * Start a background login attempt.
+     * @param provider - the provider route.
+     * @param method - Claude only: force the OAuth browser flow or the Claude
+     *   Code credential import; omitted keeps the auto behavior (import when
+     *   available, else OAuth).
      * @returns the authorize URL for the user's browser; device-flow providers
      *   (copilot) also return the `userCode` the user types at that URL.
      * @throws when an attempt is already running for this provider.
      */
-    login(provider: ProviderId): Promise<{
+    login(provider: ProviderId, method?: LoginMethod): Promise<{
         authorizeUrl: string;
         userCode?: string;
     }>;
@@ -70,15 +98,17 @@ export interface AuthController {
     manual(provider: ProviderId, input: string): Promise<void>;
     /** Abort the pending attempt; a no-op when none is pending. */
     cancel(provider: ProviderId): Promise<void>;
-    /** Delete the stored session. */
-    logout(provider: ProviderId): Promise<void>;
+    /** Delete one account's stored session. */
+    logout(provider: ProviderId, account: string): Promise<void>;
+    /** Pin the account direct (non-pool) routes serve. */
+    setDefault(provider: ProviderId, account: string): Promise<void>;
     /**
-     * Current subscription usage of one provider.
+     * Current subscription usage of one account.
      * @param signal - caller cancellation from the RPC transport.
      * @returns `{ supported: false }` when the provider has no usage endpoint.
      * @throws when logged out or the usage lookup fails.
      */
-    usage(provider: ProviderId, signal: AbortSignal): Promise<ProviderUsage>;
+    usage(provider: ProviderId, account: string, signal: AbortSignal): Promise<ProviderUsage>;
     /**
      * Read one image attachment's bytes for inline display.
      * @param ref - the full durable reference (`readImage` verifies against it).
@@ -102,5 +132,6 @@ export interface AuthController {
  * @param ctx - the plugin context (headless profiles have no `connection`).
  * @param controller - the auth operations backing the endpoints.
  * @param speed - the per-session speed-tier state backing the Speed toggle.
+ * @param proxy - optional proxy-config controller backing `proxyGet`/`proxySet`/`proxyTest`.
  */
-export declare function registerAuthRpc(ctx: Context, controller: AuthController, speed: SpeedController): void;
+export declare function registerAuthRpc(ctx: Context, controller: AuthController, speed: SpeedController, proxy?: ProxyConfigController | undefined): void;

package/lib/auth/rpc.js

@@ -42,6 +42,18 @@ function readString(payload, field) {
     }
     return value;
 }
+/** Validate the optional Claude login method. */
+function readLoginMethod(payload, provider) {
+    const method = payload.method;
+    if (method === undefined)
+        return undefined;
+    if (provider !== 'claude')
+        throw new BadRequest('payload.method is only valid for claude');
+    if (method !== 'oauth' && method !== 'keychain') {
+        throw new BadRequest('payload.method must be "oauth" or "keychain"');
+    }
+    return method;
+}
 /** Validate the `setSpeed` endpoint's tier. */
 function readSpeedTier(payload) {
     const tier = payload.tier;
@@ -102,14 +114,98 @@ function readSessionId(payload) {
         throw new BadRequest('payload must be an object');
     return readString(payload, 'sessionId');
 }
-async function dispatch(controller, speed, endpoint, payload, signal) {
+/** Validate a `proxySet` payload into a shape `ProxyInput` accepts. */
+function readProxyInput(payload) {
+    if (typeof payload !== 'object' || payload === null)
+        throw new BadRequest('payload must be an object');
+    const record = payload;
+    if (typeof record.enabled !== 'boolean')
+        throw new BadRequest('payload.enabled must be a boolean');
+    if (typeof record.url !== 'string')
+        throw new BadRequest('payload.url must be a string');
+    let username;
+    if (record.username !== undefined) {
+        if (typeof record.username !== 'string')
+            throw new BadRequest('payload.username must be a string when present');
+        username = record.username;
+    }
+    let password;
+    if (record.password !== undefined) {
+        if (record.password !== null && typeof record.password !== 'string') {
+            throw new BadRequest('payload.password must be a string or null when present');
+        }
+        password = record.password;
+    }
+    let bypass;
+    if (record.bypass !== undefined) {
+        if (!Array.isArray(record.bypass) || record.bypass.some(entry => typeof entry !== 'string')) {
+            throw new BadRequest('payload.bypass must be an array of strings when present');
+        }
+        bypass = record.bypass;
+    }
+    return {
+        enabled: record.enabled,
+        url: record.url,
+        ...username === undefined ? {} : { username },
+        ...password === undefined ? {} : { password },
+        ...bypass === undefined ? {} : { bypass },
+    };
+}
+/** Validate a `proxyTest` payload (the destination URL and an optional draft). */
+function readProxyTestPayload(payload) {
+    if (typeof payload !== 'object' || payload === null)
+        return {};
+    const record = payload;
+    const url = record.url;
+    if (url === undefined && record.proxy === undefined)
+        return {};
+    if (url !== undefined && (typeof url !== 'string' || url.length === 0)) {
+        throw new BadRequest('payload.url must be a non-empty string when present');
+    }
+    let proxy;
+    if (record.proxy !== undefined) {
+        if (typeof record.proxy !== 'object' || record.proxy === null) {
+            throw new BadRequest('payload.proxy must be an object when present');
+        }
+        const draftRecord = record.proxy;
+        if (typeof draftRecord.url !== 'string' || draftRecord.url.length === 0) {
+            throw new BadRequest('payload.proxy.url must be a non-empty string');
+        }
+        let username;
+        if (draftRecord.username !== undefined) {
+            if (typeof draftRecord.username !== 'string') {
+                throw new BadRequest('payload.proxy.username must be a string when present');
+            }
+            username = draftRecord.username;
+        }
+        let password;
+        if (draftRecord.password !== undefined) {
+            if (typeof draftRecord.password !== 'string') {
+                throw new BadRequest('payload.proxy.password must be a string when present');
+            }
+            password = draftRecord.password;
+        }
+        proxy = {
+            url: draftRecord.url,
+            ...username === undefined ? {} : { username },
+            ...password === undefined ? {} : { password },
+        };
+    }
+    return {
+        ...url === undefined ? {} : { url },
+        ...proxy === undefined ? {} : { proxy },
+    };
+}
+async function dispatch(controller, speed, proxy, endpoint, payload, signal) {
     switch (endpoint) {
         case 'status': {
             const entries = await Promise.all(PROVIDER_IDS.map(async (provider) => [provider, await controller.status(provider)]));
             return ok({ providers: Object.fromEntries(entries) });
         }
-        case 'login':
-            return ok(await controller.login(readProvider(payload)));
+        case 'login': {
+            const provider = readProvider(payload);
+            return ok(await controller.login(provider, readLoginMethod(payload, provider)));
+        }
         case 'manual': {
             const provider = readProvider(payload);
             await controller.manual(provider, readString(payload, 'input'));
@@ -118,11 +214,20 @@ async function dispatch(controller, speed, endpoint, payload, signal) {
         case 'cancel':
             await controller.cancel(readProvider(payload));
             return ok({ ok: true });
-        case 'logout':
-            await controller.logout(readProvider(payload));
+        case 'logout': {
+            const provider = readProvider(payload);
+            await controller.logout(provider, readString(payload, 'account'));
+            return ok({ ok: true });
+        }
+        case 'setDefault': {
+            const provider = readProvider(payload);
+            await controller.setDefault(provider, readString(payload, 'account'));
             return ok({ ok: true });
-        case 'usage':
-            return ok(await controller.usage(readProvider(payload), signal));
+        }
+        case 'usage': {
+            const provider = readProvider(payload);
+            return ok(await controller.usage(provider, readString(payload, 'account'), signal));
+        }
         case 'image':
             return ok(await controller.readImage(readImageRef(payload), signal));
         case 'video':
@@ -132,6 +237,18 @@ async function dispatch(controller, speed, endpoint, payload, signal) {
         case 'setSpeed':
             await speed.setSpeed(readSessionId(payload), readSpeedTier(payload));
             return ok({ ok: true });
+        case 'proxyGet':
+            if (proxy === undefined)
+                throw new BadRequest('proxy configuration is unavailable');
+            return ok(await proxy.get());
+        case 'proxySet':
+            if (proxy === undefined)
+                throw new BadRequest('proxy configuration is unavailable');
+            return ok(await proxy.set(readProxyInput(payload)));
+        case 'proxyTest':
+            if (proxy === undefined)
+                throw new BadRequest('proxy configuration is unavailable');
+            return ok(await proxy.test(readProxyTestPayload(payload)));
         default:
             throw new BadRequest(`unknown /subscriptions-auth endpoint "${endpoint}"`);
     }
@@ -141,8 +258,9 @@ async function dispatch(controller, speed, endpoint, payload, signal) {
  * @param ctx - the plugin context (headless profiles have no `connection`).
  * @param controller - the auth operations backing the endpoints.
  * @param speed - the per-session speed-tier state backing the Speed toggle.
+ * @param proxy - optional proxy-config controller backing `proxyGet`/`proxySet`/`proxyTest`.
  */
-export function registerAuthRpc(ctx, controller, speed) {
+export function registerAuthRpc(ctx, controller, speed, proxy = undefined) {
     // `connection` is not in this plugin's inject list (headless compositions
     // lack it), so its startup order is unconstrained: defer registration until
     // the service exists instead of probing once at apply time.
@@ -150,7 +268,7 @@ export function registerAuthRpc(ctx, controller, speed) {
         const connection = ctx.get('connection');
         ctx.effect(() => connection.rpc.handle(SUBSCRIPTIONS_AUTH_CHANNEL, async (endpoint, payload, signal) => {
             try {
-                return await dispatch(controller, speed, endpoint, payload, signal);
+                return await dispatch(controller, speed, proxy, endpoint, payload, signal);
             }
             catch (error) {
                 return failure(error);

package/lib/auth/store.d.ts

@@ -1,10 +1,16 @@
 /**
  * On-disk OAuth session store at `~/.dsh/plugins/subscriptions/auth.json`.
  *
- * The file is a JSON object keyed by provider id. Writes are atomic
- * (tmp file + rename) with mode 0600 because they carry bearer tokens.
- * Session shapes live here (not in the provider modules) because this file
- * owns the durable format.
+ * The file is a JSON object keyed by provider id, each entry holding that
+ * provider's ACCOUNTS: a map of account key → session plus the default
+ * account's key. Writes are atomic (tmp file + rename) with mode 0600
+ * because they carry bearer tokens. Session shapes live here (not in the
+ * provider modules) because this file owns the durable format.
+ *
+ * Backward compatibility: entries written by single-account versions hold
+ * the session fields directly (no `accounts` wrapper); reads migrate them
+ * in memory, and the next write persists the new shape — existing logins
+ * survive the upgrade untouched.
  */
 /** Provider routes this plugin can serve. */
 export type ProviderId = 'codex' | 'claude' | 'grok' | 'copilot';
@@ -34,6 +40,11 @@ export interface ClaudeSession {
     scopes: string;
     emailAddress?: string;
     subscriptionType?: string;
+    /**
+     * True when this account was imported from Claude Code's own credential
+     * store (Keychain/file): only bound accounts sync refreshes back to it.
+     */
+    keychainBound?: boolean;
 }
 /** Stored Grok (X Premium / xAI) subscription session. */
 export interface GrokSession {
@@ -64,15 +75,42 @@ export interface CopilotSession {
     /** GitHub login name, for the status display. */
     account?: string;
 }
-/** The durable store shape: one optional session per provider. */
+/** One provider's accounts: account key → session, plus the default account. */
+export interface ProviderAccounts<S> {
+    /** Key of the account direct (non-pool) routes serve; the first login wins. */
+    default?: string;
+    accounts: Record<string, S>;
+}
+/** The durable store shape: per provider, its accounts. */
 export interface SessionMap {
-    codex?: CodexSession;
-    claude?: ClaudeSession;
-    grok?: GrokSession;
-    copilot?: CopilotSession;
+    codex?: ProviderAccounts<CodexSession>;
+    claude?: ProviderAccounts<ClaudeSession>;
+    grok?: ProviderAccounts<GrokSession>;
+    copilot?: ProviderAccounts<CopilotSession>;
 }
 /** Any stored session, for provider-agnostic plumbing. */
 export type StoredSession = CodexSession | ClaudeSession | GrokSession | CopilotSession;
+/** The session type one provider stores. */
+export type SessionOf<K extends ProviderId> = NonNullable<SessionMap[K]>['accounts'][string];
+/** One account entry as returned by {@link listAccounts} (default first). */
+export interface AccountEntry<S> {
+    key: string;
+    session: S;
+}
+/**
+ * The stable identity of one session's account: codex keys on the always
+ * present `accountId` claim, the others on their display identity, falling
+ * back to a refresh-token hash for sessions stored before identity fields
+ * existed. Logging the same account in again lands on the same key, so a
+ * re-login updates in place instead of duplicating. (The hash fallback can
+ * miss that dedup once for a legacy session re-logged with a now-known
+ * identity — the duplicate is visible on the Settings page and can simply
+ * be logged out.)
+ * @param provider - the provider route.
+ * @param session - the session to key.
+ * @returns the account map key.
+ */
+export declare function accountKeyOf(provider: ProviderId, session: StoredSession): string;
 /**
  * Absolute path of the auth store file.
  * @returns `dshHomePath('plugins', 'subscriptions', 'auth.json')`.
@@ -81,28 +119,48 @@ export declare function authFilePath(): string;
 /**
  * Read the whole store. A missing file is an empty store; malformed JSON or a
  * malformed entry throws, because silently discarding tokens would strand the
- * user without a diagnosis.
+ * user without a diagnosis. Single-account entries are migrated in memory;
+ * the next write persists the new shape.
  * @param path - store file path; defaults to {@link authFilePath}.
  * @returns the parsed session map.
  */
 export declare function loadStore(path?: string): Promise<SessionMap>;
 /**
- * Read one provider's session.
+ * List one provider's accounts, default first.
+ * @param provider - the provider route.
+ * @param path - store file path; defaults to {@link authFilePath}.
+ * @returns the account entries in stable order (empty when logged out).
+ */
+export declare function listAccounts<K extends ProviderId>(provider: K, path?: string): Promise<AccountEntry<SessionOf<K>>[]>;
+/**
+ * Read one account's session.
  * @param provider - the provider route.
+ * @param account - the account key; defaults to the provider's default account.
  * @param path - store file path; defaults to {@link authFilePath}.
- * @returns the stored session, or `undefined` when logged out.
+ * @returns the stored session, or `undefined` when absent.
  */
-export declare function getSession<K extends ProviderId>(provider: K, path?: string): Promise<SessionMap[K] | undefined>;
+export declare function getAccountSession<K extends ProviderId>(provider: K, account?: string, path?: string): Promise<SessionOf<K> | undefined>;
 /**
- * Write one provider's session, preserving the others.
+ * Write one account's session, preserving the others. The first account of a
+ * provider becomes its default.
  * @param provider - the provider route.
+ * @param account - the account key (see {@link accountKeyOf}).
  * @param session - the fresh session from a login or refresh.
  * @param path - store file path; defaults to {@link authFilePath}.
  */
-export declare function saveSession<K extends ProviderId>(provider: K, session: NonNullable<SessionMap[K]>, path?: string): Promise<void>;
+export declare function saveAccountSession<K extends ProviderId>(provider: K, account: string, session: SessionOf<K>, path?: string): Promise<void>;
+/**
+ * Delete one account's session (logout). Deleting the default moves the badge
+ * to the next remaining account.
+ * @param provider - the provider route.
+ * @param account - the account key.
+ * @param path - store file path; defaults to {@link authFilePath}.
+ */
+export declare function deleteAccountSession(provider: ProviderId, account: string, path?: string): Promise<void>;
 /**
- * Delete one provider's session (logout).
+ * Pin the account direct (non-pool) routes serve.
  * @param provider - the provider route.
+ * @param account - the account key; must exist.
  * @param path - store file path; defaults to {@link authFilePath}.
  */
-export declare function deleteSession(provider: ProviderId, path?: string): Promise<void>;
+export declare function setDefaultAccount(provider: ProviderId, account: string, path?: string): Promise<void>;