dsh-plugin-subscriptions 0.5.1 → 0.5.3

package/lib/providers/copilot.js

@@ -17,7 +17,9 @@ import { EMPTY_RESPONSE_CODE, errorChain, LlmAdapter, LlmError, ReasoningEffortI
 import { resolveImages } from '../translate/resolved.js';
 import { streamChatCompletions, toChatMessages, toChatTools, } from '../translate/chat-completions.js';
 import { streamResponses, toResponsesInput, toResponsesTools } from '../translate/responses.js';
-import { httpLlmError, idleWatchdog, mapFetchFailure, ModelCatalogCache, discoverOrRetryAuth, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, TokenManager, } from './common.js';
+import { httpLlmError, idleWatchdog, mapFetchFailure, ModelCatalogCache, discoverAcrossAccounts, discoverOrRetryAuth, isDiscoveryAborted, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, } from './common.js';
+import { AccountTokenManager, DISCOVERY_TIMEOUT_MS, unionAccountCatalogs } from './accounts.js';
+import { proxiedFetch } from '../http.js';
 /**
  * Client id of the VS Code Copilot Chat GitHub App (pi-mono and
  * copilot2api-go use the same value): the app is pre-authorized for the
@@ -57,7 +59,7 @@ let vscodeVersionInflight;
  * @param forceRefresh - bypass the cache (a 401 `IDE token expired` retry).
  * @returns a `major.minor.patch` version string.
  */
-export async function latestVsCodeVersion(fetchFn = fetch, forceRefresh = false) {
+export async function latestVsCodeVersion(fetchFn = proxiedFetch, forceRefresh = false) {
     if (!forceRefresh && vscodeVersionCache !== undefined
         && Date.now() - vscodeVersionCache.at < VSCODE_VERSION_TTL_MS) {
         return vscodeVersionCache.version;
@@ -122,7 +124,7 @@ export function copilotHeaders(hasVision = false, vscodeVersion = FALLBACK_VSCOD
  * @param fetchFn - fetch implementation (injectable for tests).
  * @returns the Copilot API token and its expiry.
  */
-export async function exchangeCopilotToken(githubToken, fetchFn = fetch) {
+export async function exchangeCopilotToken(githubToken, fetchFn = proxiedFetch) {
     const response = await fetchFn(COPILOT_TOKEN_URL, {
         headers: {
             'authorization': `Bearer ${githubToken}`,
@@ -152,7 +154,7 @@ export async function exchangeCopilotToken(githubToken, fetchFn = fetch) {
  * @param fetchFn - fetch implementation (injectable for tests).
  * @returns the session to store.
  */
-export async function completeCopilotLogin(githubToken, fetchFn = fetch) {
+export async function completeCopilotLogin(githubToken, fetchFn = proxiedFetch) {
     const pair = await exchangeCopilotToken(githubToken, fetchFn);
     let account;
     try {
@@ -187,7 +189,7 @@ export async function completeCopilotLogin(githubToken, fetchFn = fetch) {
  * @param fetchFn - fetch implementation (injectable for tests).
  * @returns the fresh session to store.
  */
-export async function refreshCopilot(session, fetchFn = fetch) {
+export async function refreshCopilot(session, fetchFn = proxiedFetch) {
     const pair = await exchangeCopilotToken(session.refreshToken, fetchFn);
     return {
         accessToken: pair.accessToken,
@@ -242,15 +244,17 @@ function copilotReasoning(entry) {
  * reasoning efforts (the endpoint discloses no default, so none is claimed).
  * @param session - the stored session (used as-is; never refreshed here).
  * @param fetchFn - fetch implementation (injectable for tests).
+ * @param signal - caller cancellation (pool-assembly timeout).
  * @returns discovered chat models in endpoint order.
  */
-export async function fetchCopilotModels(session, fetchFn = fetch) {
+export async function fetchCopilotModels(session, fetchFn = proxiedFetch, signal) {
     const response = await fetchFn(COPILOT_MODELS_URL, {
         headers: {
             'authorization': `Bearer ${session.accessToken}`,
             'accept': 'application/json',
             ...copilotHeaders(false, await latestVsCodeVersion(fetchFn)),
         },
+        ...signal === undefined ? {} : { signal },
     });
     if (!response.ok)
         throw await oauthEndpointError(response, 'copilot models');
@@ -509,6 +513,10 @@ export class CopilotResponsesItemNormalizer {
 export class CopilotAdapter extends LlmAdapter {
     options;
     catalog;
+    /** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+    accountCatalogs = new Map();
+    /** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+    catalogOwner;
     /**
      * [2026-08-23]-[a reasoning model continuing a tool chain must get its
      * reasoning back or it restarts from scratch every tool round trip; the
@@ -531,8 +539,37 @@ export class CopilotAdapter extends LlmAdapter {
         this.catalog = new ModelCatalogCache(options.catalogStore);
     }
     /** Discovery fetcher: resolves the session through the refresh-aware path. */
-    async fetchCatalog() {
-        return fetchCopilotModels(await this.options.tokens.session(), this.options.fetchFn);
+    async fetchCatalog(account, signal) {
+        return fetchCopilotModels(await this.options.tokens.session(account), this.options.fetchFn, signal);
+    }
+    /** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+    clearAccountCatalog(account) {
+        if (account === undefined)
+            this.accountCatalogs.clear();
+        else
+            this.accountCatalogs.delete(account);
+        if (account === undefined || this.catalogOwner === account || this.catalogOwner === undefined) {
+            this.catalogOwner = undefined;
+            this.catalog.invalidate();
+        }
+    }
+    /** Persisted cache for the default account; a throwaway cache for any other. */
+    async catalogFor(account) {
+        const defaultKey = await this.options.tokens.defaultAccount();
+        const key = account ?? defaultKey;
+        if (key === undefined || key === defaultKey) {
+            if (this.catalogOwner !== undefined && this.catalogOwner !== defaultKey) {
+                this.catalog.invalidate();
+            }
+            this.catalogOwner = defaultKey;
+            return this.catalog;
+        }
+        let cache = this.accountCatalogs.get(key);
+        if (cache === undefined) {
+            cache = new ModelCatalogCache();
+            this.accountCatalogs.set(key, cache);
+        }
+        return cache;
     }
     providerInfo(provider) {
         return { id: provider, name: 'GitHub Copilot' };
@@ -546,17 +583,34 @@ export class CopilotAdapter extends LlmAdapter {
         }));
     }
     async listModels(provider) {
-        // Not logged in → empty catalog, so the web picker drops the provider.
-        const session = await this.options.tokens.peek();
-        if (session === undefined)
+        const own = await this.listOwnModels(provider);
+        const pool = this.options.pool?.();
+        if (pool === undefined)
+            return own;
+        const extra = await pool.modelsForProvider(provider);
+        const seen = new Set(own.map(model => model.id));
+        // Account pools reuse the catalog row; only configured tiers are extra.
+        return [...own, ...extra.filter(model => !seen.has(model.id))];
+    }
+    /** The provider's own catalog: union of every account, or one account when named. */
+    async listOwnModels(provider, account, signal) {
+        if (account === undefined) {
+            const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+            if (accounts.length === 0)
+                return [];
+            return unionAccountCatalogs(accounts, (key, accountSignal) => this.listOwnModels(provider, key, accountSignal), { timeoutMs: DISCOVERY_TIMEOUT_MS, ...signal === undefined ? {} : { signal } });
+        }
+        if (!await this.options.tokens.hasSession(account)) {
             return [];
+        }
         if (!this.options.discovery)
             return this.staticModels(provider);
+        const catalog = await this.catalogFor(account);
         try {
             // The fetcher runs only on a cache miss, and resolves the session
             // through the refresh-aware path so an expired access token renews here
             // instead of failing discovery into the static fallback.
-            const discovered = await discoverOrRetryAuth(force => this.options.tokens.session(force), this.catalog, () => this.catalog.get(() => this.fetchCatalog()));
+            const discovered = await discoverOrRetryAuth(force => this.options.tokens.session(account, force), catalog, () => catalog.get(() => this.fetchCatalog(account, signal)));
             return discovered.map(model => ({
                 provider,
                 id: model.id,
@@ -566,6 +620,8 @@ export class CopilotAdapter extends LlmAdapter {
             }));
         }
         catch (error) {
+            if (isDiscoveryAborted(error, signal))
+                throw error;
             // A permanent refresh failure deletes the stored session: the provider
             // is logged out, so hide it instead of showing a stale static catalog.
             if (isMissingOrInvalidCredential(error))
@@ -583,8 +639,12 @@ export class CopilotAdapter extends LlmAdapter {
     async discovered(model) {
         if (!this.options.discovery)
             return undefined;
-        const models = await this.catalog.resolve(() => this.fetchCatalog());
-        return models?.find(entry => entry.id === model);
+        const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+        return discoverAcrossAccounts(accounts, async (account) => {
+            const catalog = await this.catalogFor(account);
+            const models = await catalog.resolve(() => this.fetchCatalog(account));
+            return models?.find(entry => entry.id === model);
+        });
     }
     /**
      * [2026-08-23]-[a manually configured responses-only model combined with
@@ -698,6 +758,14 @@ export class CopilotAdapter extends LlmAdapter {
         this.replayByScope.clear();
     }
     async resolveModel(provider, model) {
+        const pool = this.options.pool?.();
+        if (pool !== undefined && await pool.owns(provider, model)) {
+            return pool.resolveModel(provider, model);
+        }
+        return this.resolveOwnModel(provider, model);
+    }
+    /** Capability resolution of the provider's own models (the pool resolves members here). */
+    async resolveOwnModel(provider, model) {
         const discovered = await this.discovered(model);
         const configured = this.options.models.find(entry => entry.id === model);
         return {
@@ -716,6 +784,18 @@ export class CopilotAdapter extends LlmAdapter {
         };
     }
     async *stream(options) {
+        const pool = this.options.pool?.();
+        if (pool !== undefined && await pool.owns(options.provider, options.model)) {
+            yield* pool.stream(options);
+            return;
+        }
+        yield* this.streamCore(options);
+    }
+    /** Pool seam: stream through one specific account instead of the default. */
+    streamAccount(options, account) {
+        return this.streamCore(options, account);
+    }
+    async *streamCore(options, account) {
         const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
         try {
             // The discovered catalog decides the protocol: `/responses`-only model
@@ -724,7 +804,7 @@ export class CopilotAdapter extends LlmAdapter {
             // tools with a reasoning effort (gpt-5.4 400s on the chat wire then).
             // A configured `wire` outranks the catalog (see configuredWireEntry).
             const wire = copilotRequestWire(this.configuredWireEntry(options.model) ?? await this.discovered(options.model), options);
-            let session = await this.options.tokens.session();
+            let session = await this.options.tokens.session(account);
             // Replay scope: account identity × conversation × model (see
             // replayScope); a Copilot-token refresh preserves the GitHub token, so
             // the 401 retry below reuses it too.
@@ -735,8 +815,8 @@ export class CopilotAdapter extends LlmAdapter {
                 // editor version is force-refreshed too: a 401 `IDE token expired`
                 // means GitHub raised its minimum VS Code version, and only a fresh
                 // Editor-Version header fixes that (a new token does not).
-                await latestVsCodeVersion(this.options.fetchFn ?? fetch, true);
-                session = await this.options.tokens.session(true);
+                await latestVsCodeVersion(this.options.fetchFn ?? proxiedFetch, true);
+                session = await this.options.tokens.session(account, true);
                 response = await this.request(options, session, watchdog.signal, wire, scope);
             }
             if (!response.ok)
@@ -771,13 +851,13 @@ export class CopilotAdapter extends LlmAdapter {
             // Captured completed reasoning replays ahead of its tool call.
             callId => this.replayFor(replayScopeKey, callId)))
             : copilotChatRequestBody(options, toChatMessages(messages, options.system));
-        return fetch(wire === 'responses' ? COPILOT_RESPONSES_URL : COPILOT_API_URL, {
+        return proxiedFetch(wire === 'responses' ? COPILOT_RESPONSES_URL : COPILOT_API_URL, {
             method: 'POST',
             headers: {
                 'authorization': `Bearer ${session.accessToken}`,
                 'accept': 'text/event-stream',
                 'content-type': 'application/json',
-                ...copilotHeaders(hasVision, await latestVsCodeVersion(this.options.fetchFn ?? fetch)),
+                ...copilotHeaders(hasVision, await latestVsCodeVersion(this.options.fetchFn ?? proxiedFetch)),
             },
             body: JSON.stringify(body),
             signal,

package/lib/providers/grok.d.ts

@@ -7,8 +7,9 @@ import { LlmAdapter } from '@deepseek-ai/dsh-llm';
 import type { GenerateOptions, LlmModelInfo, LlmProviderInfo, LlmResolvedModelInfo, StreamChunk } from '@deepseek-ai/dsh-llm';
 import type { FlowSpec } from '../auth/oauth-flow.js';
 import type { GrokSession } from '../auth/store.js';
+import type { PoolAdapter } from './pool.js';
 import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
-import { TokenManager } from './common.js';
+import { AccountTokenManager } from './accounts.js';
 import type { CatalogPersistence, DiscoveredModel, FetchFn, ModelEntry, ProviderUsage } from './common.js';
 export declare const GROK_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
 export declare const GROK_DISCOVERY_URL = "https://auth.x.ai/.well-known/openid-configuration";
@@ -93,9 +94,10 @@ type GrokCliModelMeta = Partial<Pick<DiscoveredModel, 'name' | 'description' | '
  * Fetch the CLI catalog and index its per-model metadata by model id.
  * @param session - the stored session (used as-is; never refreshed here).
  * @param fetchFn - fetch implementation (injectable for tests).
+ * @param signal - caller cancellation (pool-assembly timeout).
  * @returns model id → contributed metadata.
  */
-export declare function fetchGrokCliCatalog(session: GrokSession, fetchFn?: FetchFn): Promise<Map<string, GrokCliModelMeta>>;
+export declare function fetchGrokCliCatalog(session: GrokSession, fetchFn?: FetchFn, signal?: AbortSignal): Promise<Map<string, GrokCliModelMeta>>;
 /**
  * Fetch the live grok model list, enriched with the CLI catalog's per-model
  * metadata (display name, context window, reasoning efforts). The api.x.ai
@@ -109,14 +111,17 @@ export declare function fetchGrokCliCatalog(session: GrokSession, fetchFn?: Fetc
  * @param onWarn - warning sink for a failed CLI catalog fetch.
  * @param previous - last-known catalog used to keep enrichment when the CLI
  *   catalog is down or omits a model.
+ * @param signal - caller cancellation (pool-assembly timeout).
  * @returns discovered chat models in endpoint order.
  */
-export declare function fetchGrokModels(session: GrokSession, fetchFn?: FetchFn, onWarn?: (message: string) => void, previous?: readonly DiscoveredModel[]): Promise<DiscoveredModel[]>;
+export declare function fetchGrokModels(session: GrokSession, fetchFn?: FetchFn, onWarn?: (message: string) => void, previous?: readonly DiscoveredModel[], signal?: AbortSignal): Promise<DiscoveredModel[]>;
 /** Constructor dependencies for {@link GrokAdapter}. */
 export interface GrokAdapterOptions {
     models: readonly ModelEntry[];
     streamIdleTimeoutMs: number;
-    tokens: TokenManager<GrokSession>;
+    tokens: AccountTokenManager<GrokSession>;
+    /** Late-bound pool facade (wired after adapter construction); pools list under their first member's provider. */
+    pool?: () => PoolAdapter | undefined;
     /** Whether to fetch the live catalog when logged in (false when config `models` overrides). */
     discovery: boolean;
     /** Warning sink for discovery failures that fall back to the static catalog. */
@@ -132,13 +137,23 @@ export interface GrokAdapterOptions {
 export declare class GrokAdapter extends LlmAdapter {
     private readonly options;
     private readonly catalog;
+    /** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+    private readonly accountCatalogs;
+    /** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+    private catalogOwner;
     constructor(options: GrokAdapterOptions);
     /** Discovery fetcher: resolves the session through the refresh-aware path. */
     private fetchCatalog;
+    /** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+    clearAccountCatalog(account?: string): void;
+    /** Persisted cache for the default account; a throwaway cache for any other. */
+    private catalogFor;
     private listed;
     providerInfo(provider: string): LlmProviderInfo;
     private staticModels;
     listModels(provider: string): Promise<readonly LlmModelInfo[]>;
+    /** The provider's own catalog: union of every account, or one account when named. */
+    listOwnModels(provider: string, account?: string, signal?: AbortSignal): Promise<readonly LlmModelInfo[]>;
     /**
      * The discovered entry for one model. Resolved through the cache's
      * stale-while-revalidate path: capability metadata must stay stable across
@@ -149,7 +164,12 @@ export declare class GrokAdapter extends LlmAdapter {
      */
     private discovered;
     resolveModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
+    /** Capability resolution of the provider's own models (the pool resolves members here). */
+    resolveOwnModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
     stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+    /** Pool seam: stream through one specific account instead of the default. */
+    streamAccount(options: GenerateOptions, account: string): AsyncIterable<StreamChunk>;
+    private streamCore;
     private request;
 }
 export {};

package/lib/providers/grok.js

@@ -7,7 +7,9 @@ import { attributionHeaders, EMPTY_RESPONSE_CODE, errorChain, LlmAdapter, LlmErr
 import { decodeJwtPayload } from '../auth/jwt.js';
 import { resolveImages } from '../translate/resolved.js';
 import { streamResponses, toResponsesInput, toResponsesTools } from '../translate/responses.js';
-import { httpLlmError, idleWatchdog, mapFetchFailure, ModelCatalogCache, discoverOrRetryAuth, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, TokenManager, } from './common.js';
+import { httpLlmError, idleWatchdog, mapFetchFailure, ModelCatalogCache, discoverAcrossAccounts, discoverOrRetryAuth, isDiscoveryAborted, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, } from './common.js';
+import { AccountTokenManager, DISCOVERY_TIMEOUT_MS, unionAccountCatalogs } from './accounts.js';
+import { proxiedFetch } from '../http.js';
 export const GROK_CLIENT_ID = 'b1a00492-073a-47ea-816f-4c329264a828';
 export const GROK_DISCOVERY_URL = 'https://auth.x.ai/.well-known/openid-configuration';
 export const GROK_API_URL = 'https://api.x.ai/v1/responses';
@@ -40,7 +42,7 @@ let discoveryCache;
 export async function grokDiscovery() {
     if (discoveryCache !== undefined)
         return discoveryCache;
-    const response = await fetch(GROK_DISCOVERY_URL);
+    const response = await proxiedFetch(GROK_DISCOVERY_URL);
     if (!response.ok)
         throw await oauthEndpointError(response, 'grok OIDC discovery');
     const document = await response.json();
@@ -147,7 +149,7 @@ function grokSession(tokens, tokenEndpoint, fallbackRefreshToken) {
  */
 export async function exchangeGrokCode(code, verifier, redirectUri, challenge) {
     const discovery = await grokDiscovery();
-    const response = await fetch(discovery.tokenEndpoint, {
+    const response = await proxiedFetch(discovery.tokenEndpoint, {
         method: 'POST',
         headers: { 'content-type': 'application/x-www-form-urlencoded' },
         body: new URLSearchParams({
@@ -174,7 +176,7 @@ export async function exchangeGrokCode(code, verifier, redirectUri, challenge) {
  * @returns the fresh session to store.
  */
 export async function refreshGrok(session) {
-    const response = await fetch(session.tokenEndpoint, {
+    const response = await proxiedFetch(session.tokenEndpoint, {
         method: 'POST',
         headers: { 'content-type': 'application/x-www-form-urlencoded' },
         body: new URLSearchParams({
@@ -223,7 +225,7 @@ function grokResetsAt(value) {
  * @param signal - caller cancellation from the RPC transport.
  * @returns the mapped usage snapshot.
  */
-export async function fetchGrokUsage(session, fetchFn = fetch, signal) {
+export async function fetchGrokUsage(session, fetchFn = proxiedFetch, signal) {
     const response = await fetchFn(GROK_BILLING_URL, {
         headers: {
             'authorization': `Bearer ${session.accessToken}`,
@@ -311,9 +313,10 @@ function grokCliReasoning(entry) {
  * Fetch the CLI catalog and index its per-model metadata by model id.
  * @param session - the stored session (used as-is; never refreshed here).
  * @param fetchFn - fetch implementation (injectable for tests).
+ * @param signal - caller cancellation (pool-assembly timeout).
  * @returns model id → contributed metadata.
  */
-export async function fetchGrokCliCatalog(session, fetchFn = fetch) {
+export async function fetchGrokCliCatalog(session, fetchFn = proxiedFetch, signal) {
     const response = await fetchFn(GROK_CLI_MODELS_URL, {
         headers: {
             'authorization': `Bearer ${session.accessToken}`,
@@ -322,6 +325,7 @@ export async function fetchGrokCliCatalog(session, fetchFn = fetch) {
             'accept': 'application/json',
             ...attributionHeaders(),
         },
+        ...signal === undefined ? {} : { signal },
     });
     if (!response.ok)
         throw await oauthEndpointError(response, 'grok CLI catalog');
@@ -383,9 +387,10 @@ function grokPriorMeta(prior) {
  * @param onWarn - warning sink for a failed CLI catalog fetch.
  * @param previous - last-known catalog used to keep enrichment when the CLI
  *   catalog is down or omits a model.
+ * @param signal - caller cancellation (pool-assembly timeout).
  * @returns discovered chat models in endpoint order.
  */
-export async function fetchGrokModels(session, fetchFn = fetch, onWarn, previous) {
+export async function fetchGrokModels(session, fetchFn = proxiedFetch, onWarn, previous, signal) {
     const previousById = previous === undefined || previous.length === 0
         ? undefined
         : new Map(previous.map(model => [model.id, model]));
@@ -396,8 +401,11 @@ export async function fetchGrokModels(session, fetchFn = fetch, onWarn, previous
                 'accept': 'application/json',
                 ...attributionHeaders(),
             },
+            ...signal === undefined ? {} : { signal },
         }),
-        fetchGrokCliCatalog(session, fetchFn).catch((error) => {
+        fetchGrokCliCatalog(session, fetchFn, signal).catch((error) => {
+            if (isDiscoveryAborted(error, signal))
+                throw error;
             onWarn?.(previousById === undefined
                 ? `grok CLI catalog fetch failed; reasoning efforts are unavailable (${errorChain(error)})`
                 : `grok CLI catalog fetch failed; keeping last-known reasoning efforts (${errorChain(error)})`);
@@ -435,14 +443,50 @@ export async function fetchGrokModels(session, fetchFn = fetch, onWarn, previous
 export class GrokAdapter extends LlmAdapter {
     options;
     catalog;
+    /** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+    accountCatalogs = new Map();
+    /** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+    catalogOwner;
     constructor(options) {
         super();
         this.options = options;
         this.catalog = new ModelCatalogCache(options.catalogStore);
     }
     /** Discovery fetcher: resolves the session through the refresh-aware path. */
-    async fetchCatalog() {
-        return fetchGrokModels(await this.options.tokens.session(), this.options.fetchFn, this.options.onWarn, this.catalog.lastKnown());
+    async fetchCatalog(account, signal) {
+        const lastKnown = account === undefined || account === await this.options.tokens.defaultAccount()
+            ? this.catalog.lastKnown()
+            : this.accountCatalogs.get(account)?.lastKnown();
+        return fetchGrokModels(await this.options.tokens.session(account), this.options.fetchFn, this.options.onWarn, lastKnown, signal);
+    }
+    /** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+    clearAccountCatalog(account) {
+        if (account === undefined)
+            this.accountCatalogs.clear();
+        else
+            this.accountCatalogs.delete(account);
+        if (account === undefined || this.catalogOwner === account || this.catalogOwner === undefined) {
+            this.catalogOwner = undefined;
+            this.catalog.invalidate();
+        }
+    }
+    /** Persisted cache for the default account; a throwaway cache for any other. */
+    async catalogFor(account) {
+        const defaultKey = await this.options.tokens.defaultAccount();
+        const key = account ?? defaultKey;
+        if (key === undefined || key === defaultKey) {
+            if (this.catalogOwner !== undefined && this.catalogOwner !== defaultKey) {
+                this.catalog.invalidate();
+            }
+            this.catalogOwner = defaultKey;
+            return this.catalog;
+        }
+        let cache = this.accountCatalogs.get(key);
+        if (cache === undefined) {
+            cache = new ModelCatalogCache();
+            this.accountCatalogs.set(key, cache);
+        }
+        return cache;
     }
     listed(provider, discovered) {
         return discovered.map(model => ({
@@ -465,19 +509,38 @@ export class GrokAdapter extends LlmAdapter {
         }));
     }
     async listModels(provider) {
-        // Not logged in → empty catalog, so the web picker drops the provider.
-        const session = await this.options.tokens.peek();
-        if (session === undefined)
+        const own = await this.listOwnModels(provider);
+        const pool = this.options.pool?.();
+        if (pool === undefined)
+            return own;
+        const extra = await pool.modelsForProvider(provider);
+        const seen = new Set(own.map(model => model.id));
+        // Account pools reuse the catalog row; only configured tiers are extra.
+        return [...own, ...extra.filter(model => !seen.has(model.id))];
+    }
+    /** The provider's own catalog: union of every account, or one account when named. */
+    async listOwnModels(provider, account, signal) {
+        if (account === undefined) {
+            const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+            if (accounts.length === 0)
+                return [];
+            return unionAccountCatalogs(accounts, (key, accountSignal) => this.listOwnModels(provider, key, accountSignal), { timeoutMs: DISCOVERY_TIMEOUT_MS, ...signal === undefined ? {} : { signal } });
+        }
+        if (!await this.options.tokens.hasSession(account)) {
             return [];
+        }
         if (!this.options.discovery)
             return this.staticModels(provider);
+        const catalog = await this.catalogFor(account);
         try {
             // The fetcher runs only on a cache miss, and resolves the session
             // through the refresh-aware path so an expired access token renews here
             // instead of failing discovery into the static fallback.
-            return this.listed(provider, await discoverOrRetryAuth(force => this.options.tokens.session(force), this.catalog, () => this.catalog.get(() => this.fetchCatalog())));
+            return this.listed(provider, await discoverOrRetryAuth(force => this.options.tokens.session(account, force), catalog, () => catalog.get(() => this.fetchCatalog(account, signal))));
         }
         catch (error) {
+            if (isDiscoveryAborted(error, signal))
+                throw error;
             // A permanent refresh failure deletes the stored session: the provider
             // is logged out, so hide it instead of showing a stale static catalog.
             if (isMissingOrInvalidCredential(error))
@@ -497,10 +560,22 @@ export class GrokAdapter extends LlmAdapter {
     async discovered(model) {
         if (!this.options.discovery)
             return undefined;
-        const models = await this.catalog.resolve(() => this.fetchCatalog());
-        return models?.find(entry => entry.id === model);
+        const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+        return discoverAcrossAccounts(accounts, async (account) => {
+            const catalog = await this.catalogFor(account);
+            const models = await catalog.resolve(() => this.fetchCatalog(account));
+            return models?.find(entry => entry.id === model);
+        });
     }
     async resolveModel(provider, model) {
+        const pool = this.options.pool?.();
+        if (pool !== undefined && await pool.owns(provider, model)) {
+            return pool.resolveModel(provider, model);
+        }
+        return this.resolveOwnModel(provider, model);
+    }
+    /** Capability resolution of the provider's own models (the pool resolves members here). */
+    async resolveOwnModel(provider, model) {
         const discovered = await this.discovered(model);
         const configured = this.options.models.find(entry => entry.id === model);
         return {
@@ -518,13 +593,25 @@ export class GrokAdapter extends LlmAdapter {
         };
     }
     async *stream(options) {
+        const pool = this.options.pool?.();
+        if (pool !== undefined && await pool.owns(options.provider, options.model)) {
+            yield* pool.stream(options);
+            return;
+        }
+        yield* this.streamCore(options);
+    }
+    /** Pool seam: stream through one specific account instead of the default. */
+    streamAccount(options, account) {
+        return this.streamCore(options, account);
+    }
+    async *streamCore(options, account) {
         const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
         try {
-            let session = await this.options.tokens.session();
+            let session = await this.options.tokens.session(account);
             let response = await this.request(options, session, watchdog.signal);
             if (response.status === 401) {
                 // One forced refresh + retry on an unexpired-but-rejected token.
-                session = await this.options.tokens.session(true);
+                session = await this.options.tokens.session(account, true);
                 response = await this.request(options, session, watchdog.signal);
             }
             if (!response.ok)
@@ -562,7 +649,7 @@ export class GrokAdapter extends LlmAdapter {
             store: false,
             stream: true,
         };
-        return fetch(GROK_API_URL, {
+        return proxiedFetch(GROK_API_URL, {
             method: 'POST',
             headers: {
                 'authorization': `Bearer ${session.accessToken}`,

package/lib/providers/pool-family.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Same-subscription account routing: the picker is the union of every
+ * account's catalog (deduped by wire id). A model listed by two or more
+ * accounts failovers between them; a model listed by only one account is
+ * sent to that account. No extra pool identity, no cross-provider
+ * aggregation.
+ */
+import type { LlmModelInfo } from '@deepseek-ai/dsh-llm';
+import type { ProviderId } from '../auth/store.js';
+/** One pool member: an exact provider/account/model route. */
+export interface PoolMemberRef {
+    provider: ProviderId;
+    /** Account key; omitted in configured members to mean "the default account". */
+    account?: string;
+    model: string;
+}
+/** A member with its account resolved (no config indirection left). */
+export type ConcretePoolMember = PoolMemberRef & {
+    account: string;
+};
+/** One pool: its members plus display metadata for the picker. */
+export interface PoolDefinition {
+    members: PoolMemberRef[];
+    /** Display name of the catalog entry (account pools) or the pool id (extras). */
+    name?: string;
+    /** Description of the catalog entry, when the pool borrowed one. */
+    description?: string;
+    /**
+     * When true, the pool is an extra picker entry (a configured tier). Account
+     * pools leave this unset so they reuse the provider's existing catalog row.
+     */
+    extra?: boolean;
+}
+/** One account's catalog as seen through that account's credentials. */
+export interface AccountCatalog {
+    account: string;
+    models: readonly LlmModelInfo[];
+}
+/** One provider's contribution to account-pool aggregation. */
+export interface ProviderPoolSource {
+    /** Per-account catalogs, default first. A model pools only the accounts that list it. */
+    catalogs: readonly AccountCatalog[];
+}
+/** Map key for one provider's pool of one model (ids collide across providers). */
+export declare function poolKey(provider: string, model: string): string;
+/**
+ * Build per-provider account routes. Each model id becomes a definition of
+ * the accounts that list it: two or more fail over; one is pinned to that
+ * account (so a Max-only model is never sent to a Plus login). The picker
+ * unions these catalogs; a logout that drops a model to one account keeps
+ * the same id and pins it to whoever remains.
+ * @param sources - per-account catalogs (providers with no accounts list
+ *   nothing and simply never join a pool).
+ * @returns `provider/model` → pool definition (not listed as an extra entry).
+ */
+export declare function buildAccountPools(sources: Partial<Record<ProviderId, ProviderPoolSource>>): Map<string, PoolDefinition>;