dsh-plugin-subscriptions 0.5.1 → 0.5.3

package/lib/index.js

@@ -2,13 +2,14 @@ import z from "@deepseek-ai/schemastery";
 import { CONTEXT_WINDOW_EXCEEDED_CODE, CallId, EMPTY_RESPONSE_CODE, LlmAdapter, LlmError, QUOTA_EXCEEDED_CODE, ReasoningEffortId, attributionHeaders, errorChain, isContextWindowExceededError, isQuotaExceededError, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { createServer } from "node:http";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { ProxyAgent, fetch as fetch$1 } from "undici";
 import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
+import { dshHomePath } from "@deepseek-ai/dsh-home-paths";
 import { execFileSync } from "node:child_process";
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { AttachmentId } from "@deepseek-ai/dsh-attachment";
-import { dshHomePath } from "@deepseek-ai/dsh-home-paths";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 
 //#region src/auth/pkce.ts
@@ -251,16 +252,355 @@ var OAuthFlowManager = class {
 };
 
 //#endregion
-//#region src/auth/device-flow.ts
+//#region src/http.ts
+/**
+* undici's own fetch, typed to the DOM fetch signature: its bundled types are
+* stricter (Request requires `duplex`, `RequestInit.body` is non-null) and
+* incompatible with the DOM shapes the provider code passes. The runtime
+* object is the same Web-fetch implementation Node uses.
+*/
+const dispatchFetch = fetch$1;
+/** Destination the `proxyTest` endpoint probes when none is given. */
+const DEFAULT_PROXY_TEST_URL = "https://api.x.ai/v1/models";
+/** Probe deadline; a hung proxy must not pin the Settings dialog forever. */
+const DEFAULT_PROXY_TEST_TIMEOUT_MS = 15e3;
+/** Disabled configuration: the module state before the first load. */
+const DISABLED = {
+	enabled: false,
+	url: "",
+	bypass: []
+};
+/** Current config; updated by every load/apply/save. */
+let current = DISABLED;
+/** The live dispatcher, or undefined when proxies are off/errored. */
+let agent;
+/** Last load/apply failure, surfaced by the config view. */
+let configError;
+/** One lazy load of the on-disk config (module-import cheap; file read once). */
+let ready;
+/** Absolute path of the proxy config file. */
+function proxyFilePath() {
+	return dshHomePath("plugins", "subscriptions", "proxy.json");
+}
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/**
+* Flatten a fetch failure into a readable message: undici wraps the true
+* cause (`connect ECONNREFUSED ...`) behind a bare "fetch failed", so walk
+* the cause chain and append each distinct layer (up to four, cycle-safe).
+* A hostname resolving to several addresses (e.g. `localhost` → ::1 and
+* 127.0.0.1) fails as an `AggregateError` with an empty message, so its
+* per-address `errors` entries are folded in too.
+*/
+function describeFetchError(error) {
+	const parts = [];
+	let node = error;
+	for (let depth = 0; depth < 4 && node !== void 0 && node !== null; depth += 1) {
+		const layer = node;
+		if (Array.isArray(layer.errors)) for (const child of layer.errors) {
+			const childText = child instanceof Error && child.message !== "" ? child.message : String(child);
+			if (childText !== "" && !parts.includes(childText)) parts.push(childText);
+		}
+		let text = layer instanceof Error ? layer.message : String(node);
+		const code = layer.code;
+		if (typeof code === "string" && code !== "") {
+			if (text === "") text = code;
+			else if (!text.includes(code)) text = `${text} (${code})`;
+		}
+		if (text !== "" && !parts.includes(text)) parts.push(text);
+		const next = layer.cause;
+		if (next === void 0 || next === null || next === node) break;
+		node = next;
+	}
+	return parts.join(" → ");
+}
+function withError(error) {
+	configError = errorMessage(error);
+}
+/**
+* Parse and validate a proxy URL. Only HTTP(S) proxies are supported because
+* the undici dispatcher speaks CONNECT over HTTP; socks5 is not supported.
+* @param raw - the URL the user configured.
+* @returns the parsed URL (credentials attached by the caller).
+*/
+function parseProxyUrl(raw) {
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		throw new Error(`proxy URL "${raw}" is not a valid URL`);
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error(`proxy URL must use the http:// or https:// scheme (got "${raw}")`);
+	if (url.hostname === "") throw new Error("proxy URL must include a host");
+	return url;
+}
+/**
+* Whether a request hostname bypasses the proxy.
+* @param hostname - the request's hostname.
+* @param entries - configured bypass entries: exact host, plain suffix
+*   (`example.com` also matches `api.example.com`), or `*.example.com`.
+*/
+function matchesBypass(hostname, entries) {
+	const host = hostname.toLowerCase();
+	for (const raw of entries) {
+		let entry = raw.trim().toLowerCase();
+		if (entry === "") continue;
+		if (entry.includes("://")) try {
+			entry = new URL(entry).hostname;
+		} catch {
+			continue;
+		}
+		entry = entry.replace(/:\d+$/, "");
+		if (entry === "" || entry === "*") continue;
+		if (entry.startsWith("*.")) {
+			if (host.endsWith(entry.slice(1))) return true;
+		} else if (host === entry || host.endsWith(`.${entry}`)) return true;
+	}
+	return false;
+}
+/** Validate and normalize one config (throws with a user-facing message). */
+function normalizeConfig(input) {
+	const url = input.url.trim();
+	if (input.enabled && url === "") throw new Error("a proxy URL is required when the proxy is enabled");
+	if (url !== "") parseProxyUrl(url);
+	const bypass = Array.from(new Set((input.bypass ?? []).map((entry) => entry.trim()).filter((entry) => entry !== "")));
+	return {
+		enabled: input.enabled,
+		url,
+		...input.username !== void 0 && input.username !== "" ? { username: input.username.trim() } : {},
+		...input.password !== void 0 && input.password !== "" && input.password !== null ? { password: input.password } : {},
+		bypass
+	};
+}
+/** Build the undici agent for a config (throws on an unusable URL). */
+function buildAgent(cfg) {
+	if (!cfg.enabled || cfg.url === "") return void 0;
+	const url = parseProxyUrl(cfg.url);
+	if (cfg.username !== void 0) url.username = cfg.username;
+	if (cfg.password !== void 0) url.password = cfg.password;
+	return new ProxyAgent(url.toString());
+}
+/** Swap in a config and its agent; a failed agent keeps the requests direct. */
+async function applyConfig(cfg) {
+	let next;
+	if (cfg !== void 0) {
+		configError = void 0;
+		try {
+			next = buildAgent(cfg);
+		} catch (error) {
+			withError(error);
+			next = void 0;
+		}
+		current = cfg;
+	}
+	const previous = agent;
+	agent = next;
+	if (previous !== void 0) previous.close().catch(() => void 0);
+}
+/** Read the on-disk config. A missing file is the disabled default. */
+async function loadConfigFile(path) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return {
+			...DISABLED,
+			bypass: []
+		};
+		throw error;
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		throw new Error(`subscriptions proxy config at ${path} is not valid JSON; fix or delete the file`);
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("subscriptions proxy config must be a JSON object");
+	const record = parsed;
+	const enabled = record.enabled === true;
+	const url = typeof record.url === "string" ? record.url : "";
+	const username = typeof record.username === "string" ? record.username : void 0;
+	const password = typeof record.password === "string" ? record.password : void 0;
+	const bypass = Array.isArray(record.bypass) ? record.bypass.filter((entry) => typeof entry === "string") : [];
+	return normalizeConfig({
+		enabled,
+		url,
+		...username === void 0 ? {} : { username },
+		...password === void 0 ? {} : { password },
+		bypass
+	});
+}
+/** Resolve the module state once from disk; failures disable the proxy. */
+async function ensureReady() {
+	ready ??= loadConfigFile(proxyFilePath()).then(async (cfg) => {
+		await applyConfig(cfg);
+		return current;
+	}, async (error) => {
+		withError(error);
+		await applyConfig(void 0);
+		return current;
+	});
+	return ready;
+}
+/** Persist a config atomically with owner-only permissions, then apply it. */
+async function persistConfig(cfg, path) {
+	await mkdir(dirname(path), { recursive: true });
+	const tmp = `${path}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
+	try {
+		await writeFile(tmp, JSON.stringify(cfg, null, 2), { mode: 384 });
+		await chmod(tmp, 384);
+		await rename(tmp, path);
+	} catch (error) {
+		await rm(tmp, { force: true });
+		throw error;
+	}
+}
+/**
+* Current proxy config as served to the client (secrets omitted).
+* @returns the view; {@link ProxyConfigView.error} carries the last
+*   load/apply failure when the stored config is unusable.
+*/
+async function proxyGetConfig() {
+	await ensureReady();
+	return {
+		enabled: current.enabled,
+		url: current.url,
+		...current.username === void 0 ? {} : { username: current.username },
+		passwordSet: current.password !== void 0 && current.password !== "",
+		bypass: [...current.bypass],
+		...configError === void 0 ? {} : { error: configError }
+	};
+}
+/**
+* Validate, persist, and apply one proxy config. A `password` of `undefined`
+* keeps the stored value; `null` or `''` clears it.
+* @param input - the client's payload.
+* @returns the resulting view (secrets omitted).
+*/
+async function proxySetConfig(input) {
+	await ensureReady();
+	const password = input.password === void 0 ? current.password : input.password === null || input.password === "" ? void 0 : input.password;
+	const next = normalizeConfig({
+		enabled: input.enabled,
+		url: input.url,
+		...input.username === void 0 ? {} : { username: input.username },
+		...password === void 0 ? {} : { password },
+		bypass: input.bypass ?? current.bypass
+	});
+	await persistConfig(next, proxyFilePath());
+	await applyConfig(next);
+	return proxyGetConfig();
+}
 /**
-* GitHub OAuth device-authorization flow (RFC 8628) for providers that cannot
-* use the loopback redirect engine: no redirect URI, no PKCE, no client
-* secret. The user opens a verification URL and types a short code while the
-* plugin polls the token endpoint until GitHub releases the access token.
-* The management model (one attempt per provider, `isBusy`/`pending`/`cancel`)
-* mirrors {@link OAuthFlowManager} so the auth controller can treat both
-* engines uniformly.
+* The fetch caller all subscription code uses: routes through the configured
+* proxy unless the host bypasses it. Identity-passthrough otherwise.
+*
+* Proxied requests run on undici's own fetch (not the global one) so the
+* ProxyAgent dispatcher always comes from the same undici build the request
+* is issued with — a mismatched dispatcher can be silently ignored by the
+* host's global fetch.
 */
+async function proxiedFetch(input, init = {}) {
+	await ensureReady();
+	let dispatcher;
+	if (current.enabled && agent !== void 0) {
+		let hostname = "";
+		try {
+			hostname = (typeof input === "string" ? new URL(input) : input instanceof URL ? input : new URL(input.url)).hostname;
+		} catch {
+			hostname = "";
+		}
+		if (!matchesBypass(hostname, current.bypass)) dispatcher = agent;
+	}
+	if (dispatcher === void 0) return fetch(input, init);
+	return dispatchFetch(input, {
+		...init,
+		dispatcher
+	});
+}
+/**
+* Probe a destination through a proxy, answering with the HTTP status or a
+* flattened transport error. The probe uses `draft` when given (the dialog's
+* current inputs, without saving) and the stored config otherwise.
+* @param target - `http(s)` URL to fetch; defaults to {@link DEFAULT_PROXY_TEST_URL}.
+* @param draft - unsaved proxy inputs to test; absent means the stored config.
+* @returns the result; any HTTP status counts as a successful connection,
+*   only a transport failure is an error.
+*/
+async function proxyTestConnection(target = DEFAULT_PROXY_TEST_URL, draft) {
+	let parsed;
+	try {
+		parsed = new URL(target);
+		if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return {
+			ok: false,
+			viaProxy: false,
+			error: `test destination must be http or https (got "${parsed.protocol}//")`
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			viaProxy: false,
+			error: errorMessage(error)
+		};
+	}
+	await ensureReady();
+	let probeAgent;
+	let viaProxy;
+	let closeProbe = false;
+	if (draft !== void 0) try {
+		probeAgent = buildAgent(normalizeConfig({
+			enabled: true,
+			url: draft.url,
+			...draft.username === void 0 || draft.username === "" ? {} : { username: draft.username },
+			...draft.password === void 0 || draft.password === "" ? {} : { password: draft.password },
+			bypass: []
+		}));
+		viaProxy = probeAgent !== void 0;
+		closeProbe = true;
+	} catch (error) {
+		return {
+			ok: false,
+			viaProxy: false,
+			error: errorMessage(error)
+		};
+	}
+	else {
+		viaProxy = current.enabled && agent !== void 0 && !matchesBypass(parsed.hostname, current.bypass);
+		probeAgent = viaProxy ? agent : void 0;
+	}
+	const started = Date.now();
+	try {
+		const init = probeAgent !== void 0 ? {
+			method: "GET",
+			dispatcher: probeAgent,
+			signal: AbortSignal.timeout(DEFAULT_PROXY_TEST_TIMEOUT_MS)
+		} : {
+			method: "GET",
+			signal: AbortSignal.timeout(DEFAULT_PROXY_TEST_TIMEOUT_MS)
+		};
+		const response = probeAgent !== void 0 ? await dispatchFetch(parsed.toString(), init) : await fetch(parsed.toString(), init);
+		response.arrayBuffer().catch(() => void 0);
+		return {
+			ok: true,
+			viaProxy,
+			status: response.status,
+			latencyMs: Date.now() - started
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			viaProxy,
+			latencyMs: Date.now() - started,
+			error: describeFetchError(error)
+		};
+	} finally {
+		if (closeProbe && probeAgent !== void 0) await probeAgent.close().catch(() => void 0);
+	}
+}
+
+//#endregion
+//#region src/auth/device-flow.ts
 /** Default poll interval when the device-code response omits one. */
 const DEFAULT_INTERVAL_SEC = 5;
 /** Default device-code lifetime when the response omits one (GitHub: 15 minutes). */
@@ -316,7 +656,7 @@ var DeviceFlowManager = class {
 	*/
 	async start(provider, spec) {
 		if (this.attempts.has(provider)) throw new Error(`a ${provider} login attempt is already in progress`);
-		const fetchFn = spec.fetchFn ?? fetch;
+		const fetchFn = spec.fetchFn ?? proxiedFetch;
 		const response = await fetchFn(spec.deviceCodeUrl, {
 			method: "POST",
 			headers: {
@@ -599,6 +939,31 @@ const PROVIDER_IDS = [
 	"copilot"
 ];
 /**
+* The stable identity of one session's account: codex keys on the always
+* present `accountId` claim, the others on their display identity, falling
+* back to a refresh-token hash for sessions stored before identity fields
+* existed. Logging the same account in again lands on the same key, so a
+* re-login updates in place instead of duplicating. (The hash fallback can
+* miss that dedup once for a legacy session re-logged with a now-known
+* identity — the duplicate is visible on the Settings page and can simply
+* be logged out.)
+* @param provider - the provider route.
+* @param session - the session to key.
+* @returns the account map key.
+*/
+function accountKeyOf(provider, session) {
+	switch (provider) {
+		case "codex": return session.accountId;
+		case "claude": return session.emailAddress ?? tokenHash(session.refreshToken);
+		case "grok": return session.account ?? tokenHash(session.refreshToken);
+		case "copilot": return session.account ?? tokenHash(session.refreshToken);
+	}
+}
+/** Short stable hash for sessions without an identity field. */
+function tokenHash(refreshToken) {
+	return `token-${createHash("sha256").update(refreshToken).digest("hex").slice(0, 16)}`;
+}
+/**
 * Absolute path of the auth store file.
 * @returns `dshHomePath('plugins', 'subscriptions', 'auth.json')`.
 */
@@ -609,16 +974,17 @@ function authFilePath() {
 function legacyAuthFilePath() {
 	return dshHomePath("plugins", "router", "auth.json");
 }
-/** Check that one durable entry carries the fields every session needs. */
-function assertSessionShape(provider, value) {
-	if (typeof value !== "object" || value === null) throw new Error(`subscriptions auth store: entry "${provider}" is not an object; fix or delete the store file`);
+/** Check that one durable session carries the fields every session needs. */
+function assertSessionShape(provider, account, value) {
+	if (typeof value !== "object" || value === null) throw new Error(`subscriptions auth store: entry "${provider}/${account}" is not an object; fix or delete the store file`);
 	const entry = value;
-	if (typeof entry.accessToken !== "string" || entry.accessToken.length === 0 || typeof entry.refreshToken !== "string" || entry.refreshToken.length === 0 || typeof entry.expiresAt !== "number" || !Number.isFinite(entry.expiresAt)) throw new Error(`subscriptions auth store: entry "${provider}" is missing accessToken/refreshToken/expiresAt; fix or delete the store file`);
+	if (typeof entry.accessToken !== "string" || entry.accessToken.length === 0 || typeof entry.refreshToken !== "string" || entry.refreshToken.length === 0 || typeof entry.expiresAt !== "number" || !Number.isFinite(entry.expiresAt)) throw new Error(`subscriptions auth store: entry "${provider}/${account}" is missing accessToken/refreshToken/expiresAt; fix or delete the store file`);
 }
 /**
 * Read the whole store. A missing file is an empty store; malformed JSON or a
 * malformed entry throws, because silently discarding tokens would strand the
-* user without a diagnosis.
+* user without a diagnosis. Single-account entries are migrated in memory;
+* the next write persists the new shape.
 * @param path - store file path; defaults to {@link authFilePath}.
 * @returns the parsed session map.
 */
@@ -642,7 +1008,7 @@ async function loadStore(path = authFilePath()) {
 	}
 	return parseStore(text, path);
 }
-/** Parse and validate store JSON read from `path`. */
+/** Parse, validate, and migrate store JSON read from `path`. */
 function parseStore(text, path) {
 	let parsed;
 	try {
@@ -651,10 +1017,28 @@ function parseStore(text, path) {
 		throw new Error(`subscriptions auth store at ${path} is not valid JSON; fix or delete the file`);
 	}
 	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error(`subscriptions auth store at ${path} must be a JSON object keyed by provider; fix or delete the file`);
-	const store = parsed;
+	const raw = parsed;
+	const store = {};
 	for (const provider of PROVIDER_IDS) {
-		const entry = store[provider];
-		if (entry !== void 0) assertSessionShape(provider, entry);
+		const entry = raw[provider];
+		if (entry === void 0) continue;
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) throw new Error(`subscriptions auth store: entry "${provider}" is not an object; fix or delete the store file`);
+		const record = entry;
+		if (typeof record.accessToken === "string") {
+			assertSessionShape(provider, "(legacy)", record);
+			const session = record;
+			const key = accountKeyOf(provider, session);
+			store[provider] = {
+				default: key,
+				accounts: { [key]: session }
+			};
+			continue;
+		}
+		const accounts = record.accounts;
+		if (typeof accounts !== "object" || accounts === null || Array.isArray(accounts)) throw new Error(`subscriptions auth store: entry "${provider}" has no accounts map; fix or delete the store file`);
+		if (record.default !== void 0 && typeof record.default !== "string") throw new Error(`subscriptions auth store: entry "${provider}" default is not a string; fix or delete the store file`);
+		for (const [account, session] of Object.entries(accounts)) assertSessionShape(provider, account, session);
+		store[provider] = record;
 	}
 	return store;
 }
@@ -674,8 +1058,8 @@ async function writeStore(store, path) {
 /**
 * One write chain per store path. Every mutation is a read-modify-write of a
 * single JSON file, and the plugin has several independent writers — a login,
-* a logout, and one token refresh per provider adapter, each on its own
-* schedule. Overlapping them unserialized costs whichever provider read the
+* a logout, and one token refresh per provider account, each on its own
+* schedule. Overlapping them unserialized costs whichever account read the
 * store first its entry.
 *
 * A chain is dropped once nothing is queued behind it, so the map holds an
@@ -700,37 +1084,94 @@ async function serialize(path, action) {
 	}
 }
 /**
-* Read one provider's session.
+* List one provider's accounts, default first.
 * @param provider - the provider route.
 * @param path - store file path; defaults to {@link authFilePath}.
-* @returns the stored session, or `undefined` when logged out.
+* @returns the account entries in stable order (empty when logged out).
 */
-async function getSession(provider, path = authFilePath()) {
-	return (await loadStore(path))[provider];
+async function listAccounts(provider, path = authFilePath()) {
+	const entry = (await loadStore(path))[provider];
+	if (entry === void 0) return [];
+	const accounts = Object.entries(entry.accounts).map(([key, session]) => ({
+		key,
+		session
+	}));
+	accounts.sort((a, b) => Number(b.key === entry.default) - Number(a.key === entry.default));
+	return accounts;
 }
 /**
-* Write one provider's session, preserving the others.
+* Read one account's session.
 * @param provider - the provider route.
+* @param account - the account key; defaults to the provider's default account.
+* @param path - store file path; defaults to {@link authFilePath}.
+* @returns the stored session, or `undefined` when absent.
+*/
+async function getAccountSession(provider, account, path = authFilePath()) {
+	const entry = (await loadStore(path))[provider];
+	if (entry === void 0) return void 0;
+	const key = account ?? entry.default;
+	if (key === void 0) return void 0;
+	return entry.accounts[key];
+}
+/**
+* Write one account's session, preserving the others. The first account of a
+* provider becomes its default.
+* @param provider - the provider route.
+* @param account - the account key (see {@link accountKeyOf}).
 * @param session - the fresh session from a login or refresh.
 * @param path - store file path; defaults to {@link authFilePath}.
 */
-async function saveSession(provider, session, path = authFilePath()) {
+async function saveAccountSession(provider, account, session, path = authFilePath()) {
 	return serialize(path, async () => {
 		const store = await loadStore(path);
-		store[provider] = session;
+		const entry = store[provider];
+		store[provider] = {
+			default: entry?.default ?? account,
+			accounts: {
+				...entry?.accounts,
+				[account]: session
+			}
+		};
 		await writeStore(store, path);
 	});
 }
 /**
-* Delete one provider's session (logout).
+* Delete one account's session (logout). Deleting the default moves the badge
+* to the next remaining account.
 * @param provider - the provider route.
+* @param account - the account key.
 * @param path - store file path; defaults to {@link authFilePath}.
 */
-async function deleteSession(provider, path = authFilePath()) {
+async function deleteAccountSession(provider, account, path = authFilePath()) {
 	return serialize(path, async () => {
 		const store = await loadStore(path);
-		if (store[provider] === void 0) return;
-		delete store[provider];
+		const entry = store[provider];
+		if (entry === void 0 || !(account in entry.accounts)) return;
+		const accounts = { ...entry.accounts };
+		delete accounts[account];
+		if (Object.keys(accounts).length === 0) delete store[provider];
+		else store[provider] = {
+			...entry.default === account ? { default: Object.keys(accounts)[0] } : { default: entry.default },
+			accounts
+		};
+		await writeStore(store, path);
+	});
+}
+/**
+* Pin the account direct (non-pool) routes serve.
+* @param provider - the provider route.
+* @param account - the account key; must exist.
+* @param path - store file path; defaults to {@link authFilePath}.
+*/
+async function setDefaultAccount(provider, account, path = authFilePath()) {
+	return serialize(path, async () => {
+		const store = await loadStore(path);
+		const entry = store[provider];
+		if (entry === void 0 || !(account in entry.accounts)) throw new Error(`no ${provider} account "${account}" is logged in`);
+		store[provider] = {
+			...entry,
+			default: account
+		};
 		await writeStore(store, path);
 	});
 }
@@ -786,6 +1227,14 @@ function readString(payload, field) {
 	if (typeof value !== "string" || value.length === 0) throw new BadRequest(`payload.${field} must be a non-empty string`);
 	return value;
 }
+/** Validate the optional Claude login method. */
+function readLoginMethod(payload, provider) {
+	const method = payload.method;
+	if (method === void 0) return void 0;
+	if (provider !== "claude") throw new BadRequest("payload.method is only valid for claude");
+	if (method !== "oauth" && method !== "keychain") throw new BadRequest("payload.method must be \"oauth\" or \"keychain\"");
+	return method;
+}
 /** Validate the `setSpeed` endpoint's tier. */
 function readSpeedTier(payload) {
 	const tier = payload.tier;
@@ -835,13 +1284,78 @@ function readSessionId(payload) {
 	if (typeof payload !== "object" || payload === null) throw new BadRequest("payload must be an object");
 	return readString(payload, "sessionId");
 }
-async function dispatch(controller, speed, endpoint, payload, signal) {
+/** Validate a `proxySet` payload into a shape `ProxyInput` accepts. */
+function readProxyInput(payload) {
+	if (typeof payload !== "object" || payload === null) throw new BadRequest("payload must be an object");
+	const record = payload;
+	if (typeof record.enabled !== "boolean") throw new BadRequest("payload.enabled must be a boolean");
+	if (typeof record.url !== "string") throw new BadRequest("payload.url must be a string");
+	let username;
+	if (record.username !== void 0) {
+		if (typeof record.username !== "string") throw new BadRequest("payload.username must be a string when present");
+		username = record.username;
+	}
+	let password;
+	if (record.password !== void 0) {
+		if (record.password !== null && typeof record.password !== "string") throw new BadRequest("payload.password must be a string or null when present");
+		password = record.password;
+	}
+	let bypass;
+	if (record.bypass !== void 0) {
+		if (!Array.isArray(record.bypass) || record.bypass.some((entry) => typeof entry !== "string")) throw new BadRequest("payload.bypass must be an array of strings when present");
+		bypass = record.bypass;
+	}
+	return {
+		enabled: record.enabled,
+		url: record.url,
+		...username === void 0 ? {} : { username },
+		...password === void 0 ? {} : { password },
+		...bypass === void 0 ? {} : { bypass }
+	};
+}
+/** Validate a `proxyTest` payload (the destination URL and an optional draft). */
+function readProxyTestPayload(payload) {
+	if (typeof payload !== "object" || payload === null) return {};
+	const record = payload;
+	const url = record.url;
+	if (url === void 0 && record.proxy === void 0) return {};
+	if (url !== void 0 && (typeof url !== "string" || url.length === 0)) throw new BadRequest("payload.url must be a non-empty string when present");
+	let proxy;
+	if (record.proxy !== void 0) {
+		if (typeof record.proxy !== "object" || record.proxy === null) throw new BadRequest("payload.proxy must be an object when present");
+		const draftRecord = record.proxy;
+		if (typeof draftRecord.url !== "string" || draftRecord.url.length === 0) throw new BadRequest("payload.proxy.url must be a non-empty string");
+		let username;
+		if (draftRecord.username !== void 0) {
+			if (typeof draftRecord.username !== "string") throw new BadRequest("payload.proxy.username must be a string when present");
+			username = draftRecord.username;
+		}
+		let password;
+		if (draftRecord.password !== void 0) {
+			if (typeof draftRecord.password !== "string") throw new BadRequest("payload.proxy.password must be a string when present");
+			password = draftRecord.password;
+		}
+		proxy = {
+			url: draftRecord.url,
+			...username === void 0 ? {} : { username },
+			...password === void 0 ? {} : { password }
+		};
+	}
+	return {
+		...url === void 0 ? {} : { url },
+		...proxy === void 0 ? {} : { proxy }
+	};
+}
+async function dispatch(controller, speed, proxy, endpoint, payload, signal) {
 	switch (endpoint) {
 		case "status": {
 			const entries = await Promise.all(PROVIDER_IDS.map(async (provider) => [provider, await controller.status(provider)]));
 			return ok({ providers: Object.fromEntries(entries) });
 		}
-		case "login": return ok(await controller.login(readProvider(payload)));
+		case "login": {
+			const provider = readProvider(payload);
+			return ok(await controller.login(provider, readLoginMethod(payload, provider)));
+		}
 		case "manual": {
 			const provider = readProvider(payload);
 			await controller.manual(provider, readString(payload, "input"));
@@ -850,16 +1364,35 @@ async function dispatch(controller, speed, endpoint, payload, signal) {
 		case "cancel":
 			await controller.cancel(readProvider(payload));
 			return ok({ ok: true });
-		case "logout":
-			await controller.logout(readProvider(payload));
+		case "logout": {
+			const provider = readProvider(payload);
+			await controller.logout(provider, readString(payload, "account"));
+			return ok({ ok: true });
+		}
+		case "setDefault": {
+			const provider = readProvider(payload);
+			await controller.setDefault(provider, readString(payload, "account"));
 			return ok({ ok: true });
-		case "usage": return ok(await controller.usage(readProvider(payload), signal));
+		}
+		case "usage": {
+			const provider = readProvider(payload);
+			return ok(await controller.usage(provider, readString(payload, "account"), signal));
+		}
 		case "image": return ok(await controller.readImage(readImageRef(payload), signal));
 		case "video": return ok(await controller.readVideo(readVideoName(payload), signal));
 		case "speed": return ok(await speed.speed(readSessionId(payload)));
 		case "setSpeed":
 			await speed.setSpeed(readSessionId(payload), readSpeedTier(payload));
 			return ok({ ok: true });
+		case "proxyGet":
+			if (proxy === void 0) throw new BadRequest("proxy configuration is unavailable");
+			return ok(await proxy.get());
+		case "proxySet":
+			if (proxy === void 0) throw new BadRequest("proxy configuration is unavailable");
+			return ok(await proxy.set(readProxyInput(payload)));
+		case "proxyTest":
+			if (proxy === void 0) throw new BadRequest("proxy configuration is unavailable");
+			return ok(await proxy.test(readProxyTestPayload(payload)));
 		default: throw new BadRequest(`unknown /subscriptions-auth endpoint "${endpoint}"`);
 	}
 }
@@ -868,13 +1401,14 @@ async function dispatch(controller, speed, endpoint, payload, signal) {
 * @param ctx - the plugin context (headless profiles have no `connection`).
 * @param controller - the auth operations backing the endpoints.
 * @param speed - the per-session speed-tier state backing the Speed toggle.
+* @param proxy - optional proxy-config controller backing `proxyGet`/`proxySet`/`proxyTest`.
 */
-function registerAuthRpc(ctx, controller, speed) {
+function registerAuthRpc(ctx, controller, speed, proxy = void 0) {
 	ctx.inject(["connection"], (ctx$1) => {
 		const connection = ctx$1.get("connection");
 		ctx$1.effect(() => connection.rpc.handle(SUBSCRIPTIONS_AUTH_CHANNEL, async (endpoint, payload, signal) => {
 			try {
-				return await dispatch(controller, speed, endpoint, payload, signal);
+				return await dispatch(controller, speed, proxy, endpoint, payload, signal);
 			} catch (error) {
 				return failure(error);
 			}
@@ -1075,13 +1609,41 @@ var TokenManager = class {
 		}
 	}
 	async doRefresh(session) {
-		const current = await this.options.load();
-		if (current !== void 0 && current.accessToken !== session.accessToken && current.expiresAt - Date.now() > this.options.preemptMs) return current;
-		const next = await this.options.refresh(current ?? session);
+		const current$1 = await this.options.load();
+		if (current$1 !== void 0 && current$1.accessToken !== session.accessToken && current$1.expiresAt - Date.now() > this.options.preemptMs) return current$1;
+		const next = await this.options.refresh(current$1 ?? session);
 		await this.options.save(next);
 		return next;
 	}
 };
+/** Bound on one account catalog fetch or usage poll — a hang must not block the picker. */
+const DISCOVERY_TIMEOUT_MS = 1e4;
+/**
+* Run `work` with an aborting signal. Resolves undefined when the timeout
+* fires (the fetch is aborted); other failures propagate.
+*/
+function withTimeout(work, timeoutMs) {
+	const signal = AbortSignal.timeout(timeoutMs);
+	const aborted = new Promise((resolve) => {
+		if (signal.aborted) resolve(void 0);
+		else signal.addEventListener("abort", () => resolve(void 0), { once: true });
+	});
+	return Promise.race([work(signal).then((value) => signal.aborted ? void 0 : value, (error) => {
+		if (signal.aborted) return void 0;
+		throw error;
+	}), aborted]);
+}
+/**
+* First account catalog that lists `model` (callers pass default-first).
+* One failing lookup sits that account out so a sibling's metadata still
+* resolves — the same isolation as the picker catalog union.
+*/
+async function discoverAcrossAccounts(accounts, lookup) {
+	for (const account of accounts) try {
+		const found = await lookup(account);
+		if (found !== void 0) return found;
+	} catch {}
+}
 /** How long a discovered catalog is trusted before re-fetching. */
 const DISCOVERY_TTL_MS = 5 * 6e4;
 /**
@@ -1103,6 +1665,8 @@ var ModelCatalogCache = class {
 	seeded;
 	/** Set by {@link invalidate} so an in-flight disk read cannot resurrect dropped state. */
 	seedDisabled = false;
+	/** Bumped by {@link invalidate} so a loser in-flight fetch cannot write back. */
+	generation = 0;
 	constructor(persistence, ttlMs = DISCOVERY_TTL_MS) {
 		this.persistence = persistence;
 		this.ttlMs = ttlMs;
@@ -1133,7 +1697,10 @@ var ModelCatalogCache = class {
 	}
 	/** Run (or join) the single in-flight fetch, updating memory and disk on success. */
 	refresh(fetcher) {
-		this.inflight ??= fetcher().then((models) => {
+		if (this.inflight !== void 0) return this.inflight;
+		const gen = this.generation;
+		const pending = fetcher().then((models) => {
+			if (this.generation !== gen) return models;
 			const snapshot = {
 				at: Date.now(),
 				models
@@ -1142,9 +1709,10 @@ var ModelCatalogCache = class {
 			this.persistence?.save(snapshot).catch(() => void 0);
 			return models;
 		}).finally(() => {
-			this.inflight = void 0;
+			if (this.generation === gen) this.inflight = void 0;
 		});
-		return this.inflight;
+		this.inflight = pending;
+		return pending;
 	}
 	/**
 	* Return the cached catalog when fresh, otherwise fetch and cache it.
@@ -1182,7 +1750,9 @@ var ModelCatalogCache = class {
 	}
 	/** Drop the cached catalog (e.g. after a 401 proved the credential changed). */
 	invalidate() {
+		this.generation += 1;
 		this.entry = void 0;
+		this.inflight = void 0;
 		this.seedDisabled = true;
 		this.persistence?.clear().catch(() => void 0);
 	}
@@ -1191,6 +1761,11 @@ var ModelCatalogCache = class {
 function isMissingOrInvalidCredential(error) {
 	return error instanceof LlmError && (error.code === "MISSING_CREDENTIAL" || error.code === "INVALID_CREDENTIAL");
 }
+/** Whether discovery stopped because the caller cancelled or the timeout fired. */
+function isDiscoveryAborted(error, signal) {
+	if (signal?.aborted === true) return true;
+	return signal !== void 0 && error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
+}
 /** Whether discovery failed because the access token was rejected. */
 function isDiscoveryAuthFailure(error) {
 	return error instanceof OAuthEndpointError && error.status === 401 || error instanceof LlmError && error.code === "AUTH";
@@ -1216,6 +1791,109 @@ async function discoverOrRetryAuth(session, catalog, run) {
 	}
 }
 
+//#endregion
+//#region src/providers/accounts.ts
+/** Catalog sort hint when the provider advertised one (Codex `priority`). */
+function catalogPriority(model) {
+	const ranked = model;
+	return typeof ranked.priority === "number" ? ranked.priority : Number.MAX_SAFE_INTEGER;
+}
+/**
+* Merge per-account catalogs, keeping the first occurrence of each model id.
+* Rows that carry a numeric `priority` (Codex discovery) are then ordered by
+* it so a model only the second account lists — e.g. `gpt-5.6-sol` — still
+* sits with its generation instead of being appended after the default
+* account's older ids.
+*/
+async function unionAccountCatalogs(accounts, listOne, options) {
+	const timeoutMs = options?.timeoutMs;
+	const caller = options?.signal;
+	const catalogs = await Promise.all(accounts.map(async (account) => {
+		try {
+			if (timeoutMs === void 0) return await listOne(account, caller);
+			return await withTimeout((timeoutSignal) => listOne(account, caller === void 0 ? timeoutSignal : AbortSignal.any([timeoutSignal, caller])), timeoutMs) ?? [];
+		} catch (error) {
+			if (caller?.aborted === true) throw error;
+			return [];
+		}
+	}));
+	const seen = /* @__PURE__ */ new Set();
+	const models = [];
+	for (const catalog of catalogs) for (const model of catalog) {
+		if (seen.has(model.id)) continue;
+		seen.add(model.id);
+		models.push(model);
+	}
+	models.sort((left, right) => catalogPriority(left) - catalogPriority(right));
+	return models;
+}
+var AccountTokenManager = class {
+	managers = /* @__PURE__ */ new Map();
+	io;
+	constructor(options) {
+		this.options = options;
+		const provider = options.provider;
+		this.io = options.io ?? {
+			list: () => listAccounts(provider),
+			get: (account) => getAccountSession(provider, account),
+			save: (account, session) => saveAccountSession(provider, account, session),
+			remove: (account) => deleteAccountSession(provider, account)
+		};
+	}
+	/** The provider's accounts, default first (straight from the store). */
+	list() {
+		return this.io.list();
+	}
+	/** The default account's key, or undefined when logged out. */
+	async defaultAccount() {
+		return (await this.list())[0]?.key;
+	}
+	/**
+	* Resolve a usable session for one account (default when omitted),
+	* refreshing proactively or on demand.
+	* @param account - the account key; the default account when undefined.
+	* @param forceRefresh - refresh regardless of expiry (used after a 401).
+	* @returns the persisted session to send.
+	* @throws LlmError MISSING_CREDENTIAL when the account is not logged in.
+	*/
+	async session(account, forceRefresh = false) {
+		const key = account ?? await this.defaultAccount();
+		if (key === void 0) throw this.missingCredential();
+		return this.tokensFor(key).session(forceRefresh);
+	}
+	/** Read an account's stored session without any refresh side effect. */
+	peek(account) {
+		return this.io.get(account);
+	}
+	/** Whether a session is stored for the account (cheap; never refreshes). */
+	async hasSession(account) {
+		return await this.peek(account) !== void 0;
+	}
+	/** The TokenManager bound to one account (created lazily, then cached). */
+	tokensFor(account) {
+		let manager = this.managers.get(account);
+		if (manager === void 0) {
+			const io = this.io;
+			manager = new TokenManager({
+				displayName: this.options.displayName,
+				...this.options.makeOptions(account),
+				load: () => io.get(account),
+				save: (session) => io.save(account, session),
+				remove: () => io.remove(account),
+				onRemoved: () => {
+					this.options.onAccountRemoved?.(account);
+				}
+			});
+			this.managers.set(account, manager);
+		}
+		return manager;
+	}
+	/** The logged-out error, mirroring TokenManager's own message. */
+	missingCredential() {
+		return new LlmError(`dsh-plugin-subscriptions: not logged in to ${this.options.displayName}; log in via Settings → Subscriptions in the dsh web app`, "MISSING_CREDENTIAL");
+	}
+};
+
 //#endregion
 //#region src/providers/catalog-store.ts
 /**
@@ -1360,6 +2038,616 @@ function catalogStore(provider, path = modelsFilePath()) {
 	};
 }
 
+//#endregion
+//#region src/providers/pool-family.ts
+/** Map key for one provider's pool of one model (ids collide across providers). */
+function poolKey(provider, model) {
+	return `${provider}/${model}`;
+}
+/**
+* Build per-provider account routes. Each model id becomes a definition of
+* the accounts that list it: two or more fail over; one is pinned to that
+* account (so a Max-only model is never sent to a Plus login). The picker
+* unions these catalogs; a logout that drops a model to one account keeps
+* the same id and pins it to whoever remains.
+* @param sources - per-account catalogs (providers with no accounts list
+*   nothing and simply never join a pool).
+* @returns `provider/model` → pool definition (not listed as an extra entry).
+*/
+function buildAccountPools(sources) {
+	const pools = /* @__PURE__ */ new Map();
+	for (const [provider, source] of Object.entries(sources)) {
+		const byModel = /* @__PURE__ */ new Map();
+		for (const catalog of source.catalogs) for (const model of catalog.models) {
+			let entry = byModel.get(model.id);
+			if (entry === void 0) {
+				entry = {
+					members: [],
+					info: model
+				};
+				byModel.set(model.id, entry);
+			}
+			entry.members.push({
+				provider,
+				account: catalog.account,
+				model: model.id
+			});
+		}
+		for (const [id, { members, info }] of byModel) pools.set(poolKey(provider, id), {
+			members,
+			...info.name === void 0 || info.name === id ? {} : { name: info.name },
+			...info.description === void 0 ? {} : { description: info.description }
+		});
+	}
+	return pools;
+}
+
+//#endregion
+//#region src/providers/pool-health.ts
+/** Registry key for one pool member. */
+function memberKey(provider, account, model) {
+	return `${provider}/${account}/${model}`;
+}
+/** Registry key parking EVERY member of one account (account-level failures). */
+function accountKey(provider, account) {
+	return `${provider}/${account}/*`;
+}
+/** Default cooldown when a quota/rate failure carries no `retry-after`. */
+const DEFAULT_QUOTA_COOLDOWN_MS = 5 * 6e4;
+/** Auth failures recheck after a day; a re-login clears the record immediately. */
+const AUTH_COOLDOWN_MS = 1440 * 6e4;
+/** Transient server-side failures cool down briefly. */
+const TRANSIENT_COOLDOWN_MS = 6e4;
+/**
+* Providers whose quota windows are model-scoped, so a quota failure on one
+* model says nothing about its siblings (Claude's Opus/Sonnet lanes). Every
+* other provider meters the account as a whole: one member hitting the wall
+* means its siblings on the SAME account would too, so the cooldown parks
+* the account (other accounts of the provider are unaffected).
+*/
+const MODEL_SCOPED_QUOTA_PROVIDERS = new Set(["claude"]);
+/** The `retry-after` an adapter propagated through `httpLlmError`, when any. */
+function retryAfterMs(error) {
+	return error.failure.providerRetryAfterMs;
+}
+/**
+* Classify a member failure. Quota and rate-limit failures cool down (using
+* the provider's own `retry-after` when sent, which is more accurate than
+* any fixed guess) — account-wide for account-metered providers, per-member
+* for model-scoped ones; auth failures park the account until re-login
+* (credentials are account-level); server/timeout failures get a short
+* per-member cooldown; transport failures switch without a record;
+* everything else — most importantly CONTEXT_WINDOW_EXCEEDED and ABORTED —
+* is the request's own fault and is rethrown untouched.
+* @param error - the failure thrown by a member adapter's stream.
+* @param provider - the failing member's provider (decides the quota scope).
+* @returns the action the pool should take.
+*/
+function classifyPoolFailure(error, provider) {
+	if (!(error instanceof LlmError)) return { action: "throw" };
+	switch (error.code) {
+		case QUOTA_EXCEEDED_CODE:
+		case "RATE_LIMIT": return {
+			action: "switch",
+			cooldownMs: retryAfterMs(error) ?? DEFAULT_QUOTA_COOLDOWN_MS,
+			reason: error.code,
+			scope: MODEL_SCOPED_QUOTA_PROVIDERS.has(provider) ? "member" : "account"
+		};
+		case "AUTH":
+		case "INVALID_CREDENTIAL":
+		case "MISSING_CREDENTIAL": return {
+			action: "switch",
+			cooldownMs: AUTH_COOLDOWN_MS,
+			reason: error.code,
+			scope: "account"
+		};
+		case "SERVER":
+		case "TIMEOUT":
+		case "EMPTY_RESPONSE": return {
+			action: "switch",
+			cooldownMs: TRANSIENT_COOLDOWN_MS,
+			reason: error.code,
+			scope: "member"
+		};
+		case "TRANSPORT": return { action: "switch" };
+		case "HTTP_402":
+		case "HTTP_404": return {
+			action: "switch",
+			cooldownMs: TRANSIENT_COOLDOWN_MS,
+			reason: error.code,
+			scope: "member"
+		};
+		case CONTEXT_WINDOW_EXCEEDED_CODE:
+		case "ABORTED":
+		default: return { action: "throw" };
+	}
+}
+/**
+* Cooldown registry keyed by {@link memberKey}. A member whose cooldown has
+* expired is simply available again — recovery is proven by the next real
+* request, not by a background probe.
+*/
+var PoolHealthRegistry = class {
+	records = /* @__PURE__ */ new Map();
+	/** Whether a member may serve: neither it nor its whole account is cooling. */
+	isMemberAvailable(provider, account, model, now = Date.now()) {
+		return this.isAvailable(accountKey(provider, account), now) && this.isAvailable(memberKey(provider, account, model), now);
+	}
+	/** Whether one registry key is clear right now. */
+	isAvailable(key, now = Date.now()) {
+		const record = this.records.get(key);
+		if (record === void 0) return true;
+		if (record.unavailableUntil <= now) {
+			this.records.delete(key);
+			return true;
+		}
+		return false;
+	}
+	/** Park a member for `cooldownMs`; a longer existing cooldown wins. */
+	markUnavailable(key, cooldownMs, reason, now = Date.now()) {
+		const until = now + cooldownMs;
+		const existing = this.records.get(key);
+		if (existing !== void 0 && existing.unavailableUntil > until) return;
+		this.records.set(key, {
+			unavailableUntil: until,
+			reason
+		});
+	}
+	/**
+	* Epoch ms at which the earliest cooling record among `keys` recovers;
+	* `undefined` when none of them is cooling. The registry is shared by
+	* every pool, so the caller passes the keys of ITS members (member and
+	* account keys alike) — an unrelated pool's cooldown must not shape this
+	* pool's retry hint. Feeds the pool-exhausted error's
+	* `providerRetryAfterMs`.
+	*/
+	earliestRecovery(keys, now = Date.now()) {
+		let earliest;
+		for (const [key, record] of this.records) {
+			if (record.unavailableUntil <= now) {
+				this.records.delete(key);
+				continue;
+			}
+			if (!keys.has(key)) continue;
+			if (earliest === void 0 || record.unavailableUntil < earliest) earliest = record.unavailableUntil;
+		}
+		return earliest;
+	}
+	/** Drop records of one provider, or of a single account when given (auth changes). */
+	clear(provider, account) {
+		const prefix = account === void 0 ? `${provider}/` : `${provider}/${account}/`;
+		for (const key of [...this.records.keys()]) if (key.startsWith(prefix)) this.records.delete(key);
+	}
+};
+
+//#endregion
+//#region src/providers/pool.ts
+/** Bound on sticky-session memory; oldest entries evict past it. */
+const STICKY_SESSION_LIMIT = 1e3;
+/** Display form of one member (account shown when pinned). */
+function memberLabel(member) {
+	return member.account === void 0 ? `${member.provider}/${member.model}` : `${member.provider}/${member.account}/${member.model}`;
+}
+/** How long a pools snapshot is trusted (auth changes invalidate immediately). */
+const POOLS_CACHE_TTL_MS = 5e3;
+var PoolAdapter = class extends LlmAdapter {
+	/** sessionId|poolId → member key of the last member that served a chunk. */
+	sticky = /* @__PURE__ */ new Map();
+	/** Messages already warned about — configuration diagnostics repeat every request otherwise. */
+	warned = /* @__PURE__ */ new Set();
+	/**
+	* Short-lived pools snapshot. `owns()` runs on every resolveModel — the
+	* model picker issues one per entry — and pool assembly touches every
+	* provider's catalog and account store, so recompute at most this often.
+	* Auth changes bump {@link generation} so a stale snapshot cannot land.
+	*/
+	poolsCache;
+	poolsInflight;
+	generation = 0;
+	constructor(options) {
+		super();
+		this.options = options;
+	}
+	/** Drop the pools snapshot so the next read reflects the current accounts. */
+	invalidate() {
+		this.generation += 1;
+		this.poolsCache = void 0;
+		this.poolsInflight = void 0;
+	}
+	/** Warn once per distinct message (pools() runs on every request). */
+	warnOnce(message) {
+		if (this.warned.has(message)) return;
+		this.warned.add(message);
+		this.options.onWarn(message);
+	}
+	/** Drop members whose adapter is not registered (copy — caller state is shared). */
+	usable(pools) {
+		const result = new Map(pools);
+		for (const [id, definition] of [...result]) {
+			const kept = definition.members.filter((member) => this.options.adapters[member.provider] !== void 0);
+			if (kept.length === 0) result.delete(id);
+			else if (kept.length < definition.members.length) result.set(id, {
+				...definition,
+				members: kept
+			});
+		}
+		return result;
+	}
+	/** Account pools (auto-aggregated plus config overrides) with usable members. */
+	async familyPools() {
+		return this.usable(new Map(await this.options.families()));
+	}
+	/** All pools (account pools merged with extra tiers) with usable members. */
+	async pools() {
+		const cached = this.poolsCache;
+		if (cached !== void 0 && Date.now() - cached.at < POOLS_CACHE_TTL_MS) return cached.pools;
+		const gen = this.generation;
+		this.poolsInflight ??= this.assemblePools().then((pools) => {
+			if (this.generation === gen) this.poolsCache = {
+				at: Date.now(),
+				pools
+			};
+			return pools;
+		}).finally(() => {
+			this.poolsInflight = void 0;
+		});
+		return this.poolsInflight;
+	}
+	/** Recompute the pools snapshot (account pools merged with extra tiers). */
+	async assemblePools() {
+		const pools = await this.familyPools();
+		for (const [id, members] of Object.entries(this.options.tiers)) {
+			if (members.length === 0) continue;
+			const owner = members[0].provider;
+			const key = poolKey(owner, id);
+			if (pools.has(key)) this.warnOnce(`tier pool "${id}" overrides the account pool of the same id under ${owner}`);
+			pools.set(key, {
+				members,
+				extra: true
+			});
+		}
+		return this.usable(pools);
+	}
+	/**
+	* Extra picker rows one provider lists (configured tiers). Account pools
+	* reuse the catalog entry of the same wire id, so they are not listed
+	* again — the picker stays one row per model in ChatGPT / Claude / ….
+	*/
+	async modelsForProvider(provider) {
+		const pools = await this.pools();
+		const models = [];
+		for (const [key, definition] of pools) {
+			if (definition.extra !== true) continue;
+			if (!key.startsWith(`${provider}/`)) continue;
+			const id = key.slice(provider.length + 1);
+			models.push({
+				provider,
+				id,
+				name: definition.name ?? id,
+				...definition.description === void 0 ? {} : { description: definition.description }
+			});
+		}
+		return models;
+	}
+	/**
+	* Whether `model` on `provider`'s route is served here (several accounts
+	* fail over, one account is pinned, or a configured tier).
+	*/
+	async owns(provider, model) {
+		return (await this.pools()).has(poolKey(provider, model));
+	}
+	/**
+	* Resolve every member's account (config members may omit it to mean "the
+	* default account") and drop members with no resolvable login. Duplicates
+	* collapse — an explicitly pinned account and the default may coincide.
+	*/
+	async concrete(members) {
+		const seen = /* @__PURE__ */ new Set();
+		const resolved = [];
+		for (const member of members) {
+			const account = member.account ?? await this.options.defaultAccount(member.provider);
+			if (account === void 0) continue;
+			const key = memberKey(member.provider, account, member.model);
+			if (seen.has(key)) continue;
+			seen.add(key);
+			resolved.push({
+				provider: member.provider,
+				account,
+				model: member.model
+			});
+		}
+		return resolved;
+	}
+	/**
+	* Resolve a pool model to the conservative INTERSECTION of its members'
+	* capabilities: the smallest context window and output cap, the reasoning
+	* efforts every member supports, and the modalities all of them accept —
+	* so a request valid for the pool stays valid after a failover. Capability
+	* metadata is provider-level, so each provider resolves once regardless of
+	* how many accounts it pools.
+	*/
+	async resolveModel(provider, model) {
+		const definition = (await this.pools()).get(poolKey(provider, model));
+		if (definition === void 0) throw new LlmError(`unknown pool model "${model}"`, "NO_ADAPTER");
+		const resolved = [];
+		let lastFailure;
+		const seenProviders = /* @__PURE__ */ new Set();
+		for (const member of definition.members) {
+			if (seenProviders.has(member.provider)) continue;
+			seenProviders.add(member.provider);
+			const adapter = this.options.adapters[member.provider];
+			if (adapter === void 0) continue;
+			try {
+				resolved.push(await adapter.resolveOwnModel(member.provider, member.model));
+			} catch (error) {
+				lastFailure = error;
+				this.warnOnce(`pool "${model}": member ${memberLabel(member)} failed to resolve (${error instanceof Error ? error.message : String(error)}); excluding it`);
+			}
+		}
+		if (resolved.length === 0) throw new LlmError(`pool "${model}" has no usable member`, "NO_ADAPTER", { ...lastFailure === void 0 ? {} : { cause: lastFailure } });
+		const contextWindows = resolved.map((info) => info.context?.contextWindow).filter(isNumber);
+		const maxTokens = resolved.map((info) => info.defaultMaxTokens).filter(isNumber);
+		const reasoning = intersectReasoning(resolved);
+		const modalities = intersectModalities(resolved);
+		return {
+			provider,
+			id: model,
+			name: definition.name ?? model,
+			...definition.description === void 0 ? {} : { description: definition.description },
+			...contextWindows.length > 0 ? { context: { contextWindow: Math.min(...contextWindows) } } : {},
+			...maxTokens.length > 0 ? { defaultMaxTokens: Math.min(...maxTokens) } : {},
+			...reasoning === void 0 ? {} : { reasoning },
+			...modalities === void 0 ? {} : { inputModalities: modalities }
+		};
+	}
+	async *stream(options) {
+		const definition = (await this.pools()).get(poolKey(options.provider, options.model));
+		if (definition === void 0) throw new LlmError(`unknown pool model "${options.model}"`, "NO_ADAPTER");
+		const members = await this.concrete(definition.members);
+		const candidates = await this.select(options.model, members, options.sessionId);
+		if (candidates.length === 0) throw this.exhausted(options.model, members);
+		let lastError;
+		for (const member of candidates) {
+			const adapter = this.options.adapters[member.provider];
+			if (adapter === void 0) continue;
+			const iterator = adapter.streamAccount({
+				...options,
+				provider: member.provider,
+				model: member.model
+			}, member.account)[Symbol.asyncIterator]();
+			let first;
+			try {
+				first = await iterator.next();
+				if (first.done === true) throw new LlmError(`${memberLabel(member)} returned an empty stream`, EMPTY_RESPONSE_CODE);
+			} catch (error) {
+				const classification = classifyPoolFailure(error, member.provider);
+				if (classification.action === "throw") throw error;
+				if ("cooldownMs" in classification) {
+					this.options.health.markUnavailable(classification.scope === "account" ? accountKey(member.provider, member.account) : memberKey(member.provider, member.account, member.model), classification.cooldownMs, classification.reason);
+					if (classification.reason === QUOTA_EXCEEDED_CODE || classification.reason === "RATE_LIMIT") this.options.usage.invalidate(member.provider, member.account);
+				}
+				this.options.onWarn(`pool "${options.model}": ${memberLabel(member)} failed before any output (${error instanceof Error ? error.message : String(error)}); trying the next member`);
+				lastError = error;
+				continue;
+			}
+			this.remember(options.model, options.sessionId, member);
+			try {
+				yield first.value;
+				for (let next = await iterator.next(); next.done !== true; next = await iterator.next()) yield next.value;
+			} finally {
+				try {
+					await iterator.return?.();
+				} catch {}
+			}
+			return;
+		}
+		throw this.exhausted(options.model, members, lastError);
+	}
+	/**
+	* Order the candidates for one request. Health filters both strategies;
+	* `quota_aware` then ranks by urgency (members without telemetry, e.g.
+	* copilot, score zero and sink to the bottom of their class), while
+	* quota-exhausted members stay as a last-resort tail in pool order. The
+	* sticky member keeps its lead unless a challenger out-scores it by
+	* `switchMargin`.
+	*/
+	async select(poolId, members, sessionId) {
+		const usable = members.filter((member) => this.options.adapters[member.provider] !== void 0 && this.options.health.isMemberAvailable(member.provider, member.account, member.model));
+		if (usable.length === 0) return [];
+		const stickyMember = sessionId === void 0 ? void 0 : usable.find((member) => memberKey(member.provider, member.account, member.model) === this.sticky.get(stickyKey(poolId, sessionId)));
+		if (this.options.strategy === "priority") return stickyMember === void 0 ? usable : [stickyMember, ...usable.filter((member) => member !== stickyMember)];
+		const quotas = new Map(await Promise.all(usable.map(async (member) => [member, await this.options.usage.quotaFor(member)])));
+		const scored = usable.filter((member) => quotas.get(member)?.available === true);
+		const quotaFull = usable.filter((member) => quotas.get(member)?.available === false);
+		scored.sort((a, b) => (quotas.get(b)?.urgency ?? 0) - (quotas.get(a)?.urgency ?? 0));
+		if (stickyMember !== void 0 && scored.includes(stickyMember)) {
+			const best = scored[0];
+			const stickyUrgency = quotas.get(stickyMember)?.urgency ?? 0;
+			const bestUrgency = quotas.get(best)?.urgency ?? 0;
+			if (best === stickyMember || bestUrgency <= stickyUrgency * this.options.switchMargin) {
+				scored.splice(scored.indexOf(stickyMember), 1);
+				scored.unshift(stickyMember);
+			}
+		}
+		return [...scored, ...quotaFull];
+	}
+	/** Pin the serving member to the session (with bounded memory). */
+	remember(poolId, sessionId, member) {
+		if (sessionId === void 0) return;
+		const key = stickyKey(poolId, sessionId);
+		this.sticky.delete(key);
+		if (this.sticky.size >= STICKY_SESSION_LIMIT) {
+			const oldest = this.sticky.keys().next();
+			if (oldest.done !== true) this.sticky.delete(oldest.value);
+		}
+		this.sticky.set(key, memberKey(member.provider, member.account, member.model));
+	}
+	/**
+	* The error for an exhausted pool, carrying the earliest recovery hint of
+	* THIS pool's members (the health registry is shared across pools, so the
+	* hint is scoped to the keys this pool can actually recover through).
+	*/
+	exhausted(model, pool, cause) {
+		const keys = /* @__PURE__ */ new Set();
+		for (const member of pool) {
+			keys.add(memberKey(member.provider, member.account, member.model));
+			keys.add(accountKey(member.provider, member.account));
+		}
+		const recovery = this.options.health.earliestRecovery(keys);
+		const retryAfterMs$1 = recovery === void 0 ? void 0 : Math.max(recovery - Date.now(), 1);
+		return new LlmError(`pool "${model}" exhausted: every member is unavailable or failed`, "RATE_LIMIT", {
+			...retryAfterMs$1 === void 0 ? {} : { providerRetryAfterMs: retryAfterMs$1 },
+			...cause === void 0 ? {} : { cause }
+		});
+	}
+};
+function stickyKey(poolId, sessionId) {
+	return `${String(sessionId)}|${poolId}`;
+}
+function isNumber(value) {
+	return value !== void 0;
+}
+/** Reasoning efforts every member supports (id intersection, first member's order). */
+function intersectReasoning(resolved) {
+	const [first, ...rest] = resolved;
+	if (first?.reasoning === void 0) return void 0;
+	const efforts = first.reasoning.efforts.filter((effort) => rest.every((info) => info.reasoning?.efforts.some((other) => other.id === effort.id) === true));
+	if (efforts.length === 0) return void 0;
+	const defaultEffort = first.reasoning.defaultEffort !== void 0 && efforts.some((effort) => effort.id === first.reasoning?.defaultEffort) ? first.reasoning.defaultEffort : void 0;
+	return {
+		efforts,
+		...defaultEffort === void 0 ? {} : { defaultEffort }
+	};
+}
+/** Modalities all members accept; undefined when any member leaves it unknown. */
+function intersectModalities(resolved) {
+	const [first, ...rest] = resolved;
+	if (first?.inputModalities === void 0) return void 0;
+	const modalities = first.inputModalities.filter((modality) => rest.every((info) => info.inputModalities?.includes(modality) === true));
+	return modalities.length === 0 ? void 0 : modalities;
+}
+
+//#endregion
+//#region src/providers/pool-usage.ts
+/** A member is taken out of rotation once any window crosses this fill level. */
+const QUOTA_FULL_PERCENT = 95;
+/** How long a usage snapshot is trusted before a background refresh. */
+const USAGE_TTL_MS = 5 * 6e4;
+/** Assumed window length when the provider discloses no `resetsAt`. */
+const FALLBACK_HORIZON_MS = {
+	session: 300 * 6e4,
+	weekly: 10080 * 6e4,
+	other: 720 * 60 * 6e4
+};
+/**
+* Per-ACCOUNT usage snapshots with in-flight dedupe and
+* stale-while-revalidate refresh. Providers without a usage endpoint
+* (copilot) resolve no fetcher and score a constant zero urgency — which
+* naturally ranks them behind every measured member. Fetchers are resolved
+* lazily per (provider, account) so accounts added after startup join
+* tracking on their first score.
+*/
+var PoolUsageTracker = class {
+	entries = /* @__PURE__ */ new Map();
+	inflight = /* @__PURE__ */ new Map();
+	constructor(fetcherFor, ttlMs = USAGE_TTL_MS) {
+		this.fetcherFor = fetcherFor;
+		this.ttlMs = ttlMs;
+	}
+	/**
+	* The quota view of one member. A cold cache awaits the first fetch; a
+	* stale one answers immediately while the refresh serves the NEXT call
+	* (member selection must never block on the network mid-conversation).
+	* @param member - the pool member to score (account resolved).
+	* @returns availability plus the urgency score.
+	*/
+	async quotaFor(member) {
+		const key = `${member.provider}/${member.account}`;
+		const fetcher = this.fetcherFor(member.provider, member.account);
+		if (fetcher === void 0) return {
+			available: true,
+			urgency: 0,
+			fetchedAt: 0
+		};
+		const entry = this.entries.get(key);
+		if (entry !== void 0 && Date.now() - entry.at < this.ttlMs) return this.score(member, entry);
+		if (entry !== void 0) {
+			this.refresh(key, fetcher).catch(() => void 0);
+			return this.score(member, entry);
+		}
+		try {
+			const snapshot = await this.refresh(key, fetcher);
+			return this.score(member, {
+				snapshot,
+				at: Date.now()
+			});
+		} catch (error) {
+			return isMissingOrInvalidCredential(error) ? {
+				available: false,
+				urgency: 0,
+				fetchedAt: 0
+			} : {
+				available: true,
+				urgency: 0,
+				fetchedAt: 0
+			};
+		}
+	}
+	/** Drop cached snapshots: one account, or a whole provider when `account` is omitted. */
+	invalidate(provider, account) {
+		if (account !== void 0) {
+			this.entries.delete(`${provider}/${account}`);
+			return;
+		}
+		for (const key of [...this.entries.keys()]) if (key.startsWith(`${provider}/`)) this.entries.delete(key);
+	}
+	/** Run (or join) the single in-flight fetch for one account key. */
+	refresh(key, fetcher) {
+		let pending = this.inflight.get(key);
+		if (pending === void 0) {
+			pending = fetcher().then((snapshot) => {
+				this.entries.set(key, {
+					snapshot,
+					at: Date.now()
+				});
+				return snapshot;
+			}).finally(() => {
+				this.inflight.delete(key);
+			});
+			this.inflight.set(key, pending);
+		}
+		return pending;
+	}
+	/** Score one member against a snapshot's windows. */
+	score(member, entry) {
+		const windows = (entry.snapshot.windows ?? []).filter((window) => windowApplies(window, member.model));
+		let available = true;
+		let urgency = 0;
+		for (const window of windows) {
+			if (window.usedPercent >= QUOTA_FULL_PERCENT) available = false;
+			urgency = Math.max(urgency, windowUrgency(window));
+		}
+		return {
+			available,
+			urgency,
+			fetchedAt: entry.at
+		};
+	}
+};
+/**
+* Whether a window constrains this model: unscoped windows always do; a
+* model-scoped window (Claude's Opus/Sonnet lanes) applies when its scope
+* names the model family.
+*/
+function windowApplies(window, model) {
+	if (window.scope === void 0) return true;
+	return model.toLowerCase().includes(window.scope.toLowerCase());
+}
+/** The required burn rate of one window (fraction per ms). */
+function windowUrgency(window, now = Date.now()) {
+	return Math.max(0, 1 - window.usedPercent / 100) / (window.resetsAt !== void 0 ? Math.max(window.resetsAt - now, 1) : FALLBACK_HORIZON_MS[window.kind]);
+}
+
 //#endregion
 //#region src/auth/jwt.ts
 /** Minimal JWT payload decoding for claims extraction (no signature verification). */
@@ -1960,7 +3248,7 @@ function codexSession(tokens, fallback) {
 * @returns the session to store.
 */
 async function exchangeCodexCode(code, verifier, redirectUri) {
-	const response = await fetch(CODEX_TOKEN_URL, {
+	const response = await proxiedFetch(CODEX_TOKEN_URL, {
 		method: "POST",
 		headers: { "content-type": "application/x-www-form-urlencoded" },
 		body: new URLSearchParams({
@@ -1980,7 +3268,7 @@ async function exchangeCodexCode(code, verifier, redirectUri) {
 * @returns the fresh session to store.
 */
 async function refreshCodex(session) {
-	const response = await fetch(CODEX_TOKEN_URL, {
+	const response = await proxiedFetch(CODEX_TOKEN_URL, {
 		method: "POST",
 		headers: { "content-type": "application/json" },
 		body: JSON.stringify({
@@ -2048,7 +3336,7 @@ function codexUsageWindow(value, fallbackKind) {
 * @param signal - caller cancellation from the RPC transport.
 * @returns the mapped usage snapshot.
 */
-async function fetchCodexUsage(session, fetchFn = fetch, signal) {
+async function fetchCodexUsage(session, fetchFn = proxiedFetch, signal) {
 	const response = await fetchFn(CODEX_USAGE_URL, {
 		headers: {
 			"authorization": `Bearer ${session.accessToken}`,
@@ -2096,16 +3384,20 @@ function supportsFastTier(entry) {
 * Fetch the live codex model catalog with the session's auth headers.
 * @param session - the stored session (used as-is; never refreshed here).
 * @param fetchFn - fetch implementation (injectable for tests).
+* @param signal - caller cancellation (pool-assembly timeout).
 * @returns discovered models: hidden entries dropped, sorted by priority.
 */
-async function fetchCodexModels(session, fetchFn = fetch) {
-	const response = await fetchFn(`${CODEX_MODELS_URL}?client_version=${CODEX_CLIENT_VERSION}`, { headers: {
-		"authorization": `Bearer ${session.accessToken}`,
-		"chatgpt-account-id": session.accountId,
-		"originator": "codex_cli_rs",
-		"accept": "application/json",
-		...attributionHeaders()
-	} });
+async function fetchCodexModels(session, fetchFn = proxiedFetch, signal) {
+	const response = await fetchFn(`${CODEX_MODELS_URL}?client_version=${CODEX_CLIENT_VERSION}`, {
+		headers: {
+			"authorization": `Bearer ${session.accessToken}`,
+			"chatgpt-account-id": session.accountId,
+			"originator": "codex_cli_rs",
+			"accept": "application/json",
+			...attributionHeaders()
+		},
+		...signal === void 0 ? {} : { signal }
+	});
 	if (!response.ok) throw await oauthEndpointError(response, "codex models");
 	const payload = await response.json();
 	if (!Array.isArray(payload.models)) throw new Error("codex models endpoint returned no models array");
@@ -2209,14 +3501,43 @@ function codexRequestBody(options, resolved, fast) {
 /** Codex wire adapter: one instance serves the `codex` provider route. */
 var CodexAdapter = class extends LlmAdapter {
 	catalog;
+	/** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+	accountCatalogs = /* @__PURE__ */ new Map();
+	/** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+	catalogOwner;
 	constructor(options) {
 		super();
 		this.options = options;
 		this.catalog = new ModelCatalogCache(options.catalogStore);
 	}
 	/** Discovery fetcher: resolves the session through the refresh-aware path. */
-	async fetchCatalog() {
-		return fetchCodexModels(await this.options.tokens.session(), this.options.fetchFn);
+	async fetchCatalog(account, signal) {
+		return fetchCodexModels(await this.options.tokens.session(account), this.options.fetchFn, signal);
+	}
+	/** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+	clearAccountCatalog(account) {
+		if (account === void 0) this.accountCatalogs.clear();
+		else this.accountCatalogs.delete(account);
+		if (account === void 0 || this.catalogOwner === account || this.catalogOwner === void 0) {
+			this.catalogOwner = void 0;
+			this.catalog.invalidate();
+		}
+	}
+	/** Persisted cache for the default account; a throwaway cache for any other. */
+	async catalogFor(account) {
+		const defaultKey = await this.options.tokens.defaultAccount();
+		const key = account ?? defaultKey;
+		if (key === void 0 || key === defaultKey) {
+			if (this.catalogOwner !== void 0 && this.catalogOwner !== defaultKey) this.catalog.invalidate();
+			this.catalogOwner = defaultKey;
+			return this.catalog;
+		}
+		let cache = this.accountCatalogs.get(key);
+		if (cache === void 0) {
+			cache = new ModelCatalogCache();
+			this.accountCatalogs.set(key, cache);
+		}
+		return cache;
 	}
 	providerInfo(provider) {
 		return {
@@ -2233,17 +3554,37 @@ var CodexAdapter = class extends LlmAdapter {
 		}));
 	}
 	async listModels(provider) {
-		if (await this.options.tokens.peek() === void 0) return [];
+		const own = await this.listOwnModels(provider);
+		const pool = this.options.pool?.();
+		if (pool === void 0) return own;
+		const extra = await pool.modelsForProvider(provider);
+		const seen = new Set(own.map((model) => model.id));
+		return [...own, ...extra.filter((model) => !seen.has(model.id))];
+	}
+	/** The provider's own catalog: union of every account, or one account when named. */
+	async listOwnModels(provider, account, signal) {
+		if (account === void 0) {
+			const accounts = (await this.options.tokens.list()).map((entry) => entry.key);
+			if (accounts.length === 0) return [];
+			return unionAccountCatalogs(accounts, (key, accountSignal) => this.listOwnModels(provider, key, accountSignal), {
+				timeoutMs: this.options.discoveryTimeoutMs ?? DISCOVERY_TIMEOUT_MS,
+				...signal === void 0 ? {} : { signal }
+			});
+		}
+		if (!await this.options.tokens.hasSession(account)) return [];
 		if (!this.options.discovery) return this.staticModels(provider);
+		const catalog = await this.catalogFor(account);
 		try {
-			return (await discoverOrRetryAuth((force) => this.options.tokens.session(force), this.catalog, () => this.catalog.get(() => this.fetchCatalog()))).map((model) => ({
+			return (await discoverOrRetryAuth((force) => this.options.tokens.session(account, force), catalog, () => catalog.get(() => this.fetchCatalog(account, signal)))).map((model) => ({
 				provider,
 				id: model.id,
 				name: model.name,
 				...model.description === void 0 ? {} : { description: model.description },
-				inputModalities: CODEX_MODALITIES
+				inputModalities: CODEX_MODALITIES,
+				...model.priority === void 0 ? {} : { priority: model.priority }
 			}));
 		} catch (error) {
+			if (isDiscoveryAborted(error, signal)) throw error;
 			if (isMissingOrInvalidCredential(error)) return [];
 			this.options.onWarn?.(`codex model discovery failed; using the built-in catalog (${errorChain(error)})`);
 			return this.staticModels(provider);
@@ -2258,7 +3599,9 @@ var CodexAdapter = class extends LlmAdapter {
 	*/
 	async discovered(model) {
 		if (!this.options.discovery) return void 0;
-		return (await this.catalog.resolve(() => this.fetchCatalog()))?.find((entry) => entry.id === model);
+		return discoverAcrossAccounts((await this.options.tokens.list()).map((entry) => entry.key), async (account) => {
+			return (await (await this.catalogFor(account)).resolve(() => this.fetchCatalog(account)))?.find((entry) => entry.id === model);
+		});
 	}
 	/** Whether the discovered catalog advertises a fast tier for this model. */
 	async supportsFastTier(model) {
@@ -2267,10 +3610,27 @@ var CodexAdapter = class extends LlmAdapter {
 	/** Ids of every discovered model with a fast tier (the Speed toggle's visibility list). */
 	async fastCapableModels() {
 		if (!this.options.discovery) return [];
-		if (await this.options.tokens.peek() === void 0) return [];
-		return (await this.catalog.resolve(() => this.fetchCatalog()) ?? []).filter((model) => model.fastTier === true).map((model) => model.id);
+		const accounts = (await this.options.tokens.list()).map((entry) => entry.key);
+		if (accounts.length === 0) return [];
+		const seen = /* @__PURE__ */ new Set();
+		const ids = [];
+		for (const account of accounts) try {
+			const models = await (await this.catalogFor(account)).resolve(() => this.fetchCatalog(account));
+			for (const model of models ?? []) {
+				if (model.fastTier !== true || seen.has(model.id)) continue;
+				seen.add(model.id);
+				ids.push(model.id);
+			}
+		} catch {}
+		return ids;
 	}
 	async resolveModel(provider, model) {
+		const pool = this.options.pool?.();
+		if (pool !== void 0 && await pool.owns(provider, model)) return pool.resolveModel(provider, model);
+		return this.resolveOwnModel(provider, model);
+	}
+	/** Capability resolution of the provider's own models (the pool resolves members here). */
+	async resolveOwnModel(provider, model) {
 		const discovered = await this.discovered(model);
 		const configured = this.options.models.find((entry) => entry.id === model);
 		return {
@@ -2288,12 +3648,24 @@ var CodexAdapter = class extends LlmAdapter {
 		};
 	}
 	async *stream(options) {
+		const pool = this.options.pool?.();
+		if (pool !== void 0 && await pool.owns(options.provider, options.model)) {
+			yield* pool.stream(options);
+			return;
+		}
+		yield* this.streamCore(options);
+	}
+	/** Pool seam: stream through one specific account instead of the default. */
+	streamAccount(options, account) {
+		return this.streamCore(options, account);
+	}
+	async *streamCore(options, account) {
 		const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
 		try {
-			let session = await this.options.tokens.session();
+			let session = await this.options.tokens.session(account);
 			let response = await this.request(options, session, watchdog.signal);
 			if (response.status === 401) {
-				session = await this.options.tokens.session(true);
+				session = await this.options.tokens.session(account, true);
 				response = await this.request(options, session, watchdog.signal);
 			}
 			if (!response.ok) throw await httpLlmError(response, "codex API");
@@ -2311,7 +3683,7 @@ var CodexAdapter = class extends LlmAdapter {
 		const messages = await resolveImages(options.messages, this.options.resolveAttachments?.(), signal);
 		const fast = this.options.speedFor !== void 0 && await this.options.speedFor(options.sessionId, options.model);
 		const body = codexRequestBody(options, toResponsesInput(messages, options.system), fast);
-		return fetch(CODEX_API_URL, {
+		return proxiedFetch(CODEX_API_URL, {
 			method: "POST",
 			headers: {
 				"authorization": `Bearer ${session.accessToken}`,
@@ -2846,7 +4218,7 @@ const claudeFlow = {
 /** Best-effort account profile; login must not fail when this does. */
 async function fetchClaudeProfile(accessToken) {
 	try {
-		const response = await fetch(CLAUDE_PROFILE_URL, { headers: { authorization: `Bearer ${accessToken}` } });
+		const response = await proxiedFetch(CLAUDE_PROFILE_URL, { headers: { authorization: `Bearer ${accessToken}` } });
 		if (!response.ok) return {};
 		const profile = await response.json();
 		const account = typeof profile.account === "object" && profile.account !== null ? profile.account : {};
@@ -2884,7 +4256,7 @@ async function claudeSession(tokens, fallbackRefreshToken, withProfile) {
 * @returns the session to store.
 */
 async function exchangeClaudeCode(code, verifier, redirectUri, state) {
-	const response = await fetch(CLAUDE_TOKEN_URL, {
+	const response = await proxiedFetch(CLAUDE_TOKEN_URL, {
 		method: "POST",
 		headers: { "content-type": "application/json" },
 		body: JSON.stringify({
@@ -2905,7 +4277,7 @@ async function exchangeClaudeCode(code, verifier, redirectUri, state) {
 * @returns the fresh session to store.
 */
 async function refreshClaude(session) {
-	const response = await fetch(CLAUDE_TOKEN_URL, {
+	const response = await proxiedFetch(CLAUDE_TOKEN_URL, {
 		method: "POST",
 		headers: { "content-type": "application/json" },
 		body: JSON.stringify({
@@ -2980,7 +4352,7 @@ function claudeLimitsWindows(value) {
 * @param signal - caller cancellation from the RPC transport.
 * @returns the mapped usage snapshot.
 */
-async function fetchClaudeUsage(session, fetchFn = fetch, signal) {
+async function fetchClaudeUsage(session, fetchFn = proxiedFetch, signal) {
 	const response = await fetchFn(CLAUDE_USAGE_URL, {
 		headers: {
 			"authorization": `Bearer ${session.accessToken}`,
@@ -3032,15 +4404,18 @@ function claudeReasoning(capabilities) {
 	}));
 	return efforts.length > 0 ? { efforts } : void 0;
 }
-/** Fetch the live model catalog from the subscription endpoint. */
-async function fetchClaudeModels(session, fetchFn = fetch) {
-	const response = await fetchFn(CLAUDE_MODELS_URL, { headers: {
-		"authorization": `Bearer ${session.accessToken}`,
-		"anthropic-version": "2023-06-01",
-		"user-agent": getClaudeCliUserAgent(),
-		"anthropic-dangerous-direct-browser-access": "true",
-		"accept": "application/json"
-	} });
+/** Fetch the live model catalog from the subscription endpoint. `signal` cancels the request. */
+async function fetchClaudeModels(session, fetchFn = proxiedFetch, signal) {
+	const response = await fetchFn(CLAUDE_MODELS_URL, {
+		headers: {
+			"authorization": `Bearer ${session.accessToken}`,
+			"anthropic-version": "2023-06-01",
+			"user-agent": getClaudeCliUserAgent(),
+			"anthropic-dangerous-direct-browser-access": "true",
+			"accept": "application/json"
+		},
+		...signal === void 0 ? {} : { signal }
+	});
 	if (!response.ok) throw await httpLlmError(response, "claude models API");
 	const payload = await response.json();
 	if (!Array.isArray(payload.data)) throw new Error("claude models API returned an invalid catalog");
@@ -3100,17 +4475,48 @@ function claudeRequestBody(options, messages, maxTokens, thinking, effort) {
 /** Claude wire adapter: one instance serves the `claude` provider route. */
 var ClaudeAdapter = class extends LlmAdapter {
 	catalog;
+	/** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+	accountCatalogs = /* @__PURE__ */ new Map();
+	/** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+	catalogOwner;
 	constructor(options) {
 		super();
 		this.options = options;
 		this.catalog = new ModelCatalogCache(options.catalogStore);
 	}
-	async fetchCatalog() {
-		return fetchClaudeModels(await this.options.tokens.session(), this.options.fetchFn);
+	async fetchCatalog(account, signal) {
+		return fetchClaudeModels(await this.options.tokens.session(account), this.options.fetchFn, signal);
+	}
+	/** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+	clearAccountCatalog(account) {
+		if (account === void 0) this.accountCatalogs.clear();
+		else this.accountCatalogs.delete(account);
+		if (account === void 0 || this.catalogOwner === account || this.catalogOwner === void 0) {
+			this.catalogOwner = void 0;
+			this.catalog.invalidate();
+		}
+	}
+	/** Persisted cache for the default account; a throwaway cache for any other. */
+	async catalogFor(account) {
+		const defaultKey = await this.options.tokens.defaultAccount();
+		const key = account ?? defaultKey;
+		if (key === void 0 || key === defaultKey) {
+			if (this.catalogOwner !== void 0 && this.catalogOwner !== defaultKey) this.catalog.invalidate();
+			this.catalogOwner = defaultKey;
+			return this.catalog;
+		}
+		let cache = this.accountCatalogs.get(key);
+		if (cache === void 0) {
+			cache = new ModelCatalogCache();
+			this.accountCatalogs.set(key, cache);
+		}
+		return cache;
 	}
 	async discovered(model) {
 		if (!this.options.discovery) return void 0;
-		return (await this.catalog.resolve(() => this.fetchCatalog()))?.find((entry) => entry.id === model);
+		return discoverAcrossAccounts((await this.options.tokens.list()).map((entry) => entry.key), async (account) => {
+			return (await (await this.catalogFor(account)).resolve(() => this.fetchCatalog(account)))?.find((entry) => entry.id === model);
+		});
 	}
 	staticModels(provider) {
 		return this.options.models.map((model) => ({
@@ -3139,22 +4545,47 @@ var ClaudeAdapter = class extends LlmAdapter {
 		}, `claude: provider "${provider}" retryPolicy`);
 	}
 	async listModels(provider) {
-		if (await this.options.tokens.peek() === void 0) return [];
+		const own = await this.listOwnModels(provider);
+		const pool = this.options.pool?.();
+		if (pool === void 0) return own;
+		const extra = await pool.modelsForProvider(provider);
+		const seen = new Set(own.map((model) => model.id));
+		return [...own, ...extra.filter((model) => !seen.has(model.id))];
+	}
+	/** The provider's own catalog: union of every account, or one account when named. */
+	async listOwnModels(provider, account, signal) {
+		if (account === void 0) {
+			const accounts = (await this.options.tokens.list()).map((entry) => entry.key);
+			if (accounts.length === 0) return [];
+			return unionAccountCatalogs(accounts, (key, accountSignal) => this.listOwnModels(provider, key, accountSignal), {
+				timeoutMs: DISCOVERY_TIMEOUT_MS,
+				...signal === void 0 ? {} : { signal }
+			});
+		}
+		if (!await this.options.tokens.hasSession(account)) return [];
 		if (!this.options.discovery) return this.staticModels(provider);
+		const catalog = await this.catalogFor(account);
 		try {
-			return (await discoverOrRetryAuth((force) => this.options.tokens.session(force), this.catalog, () => this.catalog.get(() => this.fetchCatalog()))).map((model) => ({
+			return (await discoverOrRetryAuth((force) => this.options.tokens.session(account, force), catalog, () => catalog.get(() => this.fetchCatalog(account, signal)))).map((model) => ({
 				provider,
 				id: model.id,
 				name: model.name,
 				inputModalities: CLAUDE_MODALITIES
 			}));
 		} catch (error) {
+			if (isDiscoveryAborted(error, signal)) throw error;
 			if (isMissingOrInvalidCredential(error)) return [];
 			this.options.onWarn?.(`claude model discovery failed; using the built-in catalog (${errorChain(error)})`);
 			return this.staticModels(provider);
 		}
 	}
 	async resolveModel(provider, model) {
+		const pool = this.options.pool?.();
+		if (pool !== void 0 && await pool.owns(provider, model)) return pool.resolveModel(provider, model);
+		return this.resolveOwnModel(provider, model);
+	}
+	/** Capability resolution of the provider's own models (the pool resolves members here). */
+	async resolveOwnModel(provider, model) {
 		const disc = await this.discovered(model);
 		const configured = this.options.models.find((entry) => entry.id === model);
 		const reasoning = disc?.reasoning;
@@ -3169,12 +4600,24 @@ var ClaudeAdapter = class extends LlmAdapter {
 		};
 	}
 	async *stream(options) {
+		const pool = this.options.pool?.();
+		if (pool !== void 0 && await pool.owns(options.provider, options.model)) {
+			yield* pool.stream(options);
+			return;
+		}
+		yield* this.streamCore(options);
+	}
+	/** Pool seam: stream through one specific account instead of the default. */
+	streamAccount(options, account) {
+		return this.streamCore(options, account);
+	}
+	async *streamCore(options, account) {
 		const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
 		try {
-			let session = await this.options.tokens.session();
+			let session = await this.options.tokens.session(account);
 			let response = await this.request(options, session, watchdog.signal);
 			if (response.status === 401) {
-				session = await this.options.tokens.session(true);
+				session = await this.options.tokens.session(account, true);
 				response = await this.request(options, session, watchdog.signal);
 			}
 			if (!response.ok) throw await httpLlmError(response, "claude API");
@@ -3215,7 +4658,7 @@ var ClaudeAdapter = class extends LlmAdapter {
 		const maxTokens = options.maxTokens ?? this.options.models.find((entry) => entry.id === options.model)?.maxTokens ?? CLAUDE_DEFAULT_MAX_TOKENS;
 		const disc = await this.discovered(options.model);
 		const body = claudeRequestBody(options, messages, maxTokens, this.thinkingParam(disc?.thinkingType, maxTokens), options.reasoningEffort !== void 0 && disc?.reasoning !== void 0 ? String(options.reasoningEffort) : void 0);
-		return fetch(CLAUDE_API_URL, {
+		return proxiedFetch(CLAUDE_API_URL, {
 			method: "POST",
 			headers: {
 				"authorization": `Bearer ${session.accessToken}`,
@@ -3262,7 +4705,7 @@ let discoveryCache;
 */
 async function grokDiscovery() {
 	if (discoveryCache !== void 0) return discoveryCache;
-	const response = await fetch(GROK_DISCOVERY_URL);
+	const response = await proxiedFetch(GROK_DISCOVERY_URL);
 	if (!response.ok) throw await oauthEndpointError(response, "grok OIDC discovery");
 	const document = await response.json();
 	if (typeof document.authorization_endpoint !== "string" || typeof document.token_endpoint !== "string") throw new Error("grok OIDC discovery document is missing endpoints");
@@ -3363,7 +4806,7 @@ function grokSession(tokens, tokenEndpoint, fallbackRefreshToken) {
 */
 async function exchangeGrokCode(code, verifier, redirectUri, challenge) {
 	const discovery = await grokDiscovery();
-	const response = await fetch(discovery.tokenEndpoint, {
+	const response = await proxiedFetch(discovery.tokenEndpoint, {
 		method: "POST",
 		headers: { "content-type": "application/x-www-form-urlencoded" },
 		body: new URLSearchParams({
@@ -3386,7 +4829,7 @@ async function exchangeGrokCode(code, verifier, redirectUri, challenge) {
 * @returns the fresh session to store.
 */
 async function refreshGrok(session) {
-	const response = await fetch(session.tokenEndpoint, {
+	const response = await proxiedFetch(session.tokenEndpoint, {
 		method: "POST",
 		headers: { "content-type": "application/x-www-form-urlencoded" },
 		body: new URLSearchParams({
@@ -3433,7 +4876,7 @@ function grokResetsAt(value) {
 * @param signal - caller cancellation from the RPC transport.
 * @returns the mapped usage snapshot.
 */
-async function fetchGrokUsage(session, fetchFn = fetch, signal) {
+async function fetchGrokUsage(session, fetchFn = proxiedFetch, signal) {
 	const response = await fetchFn(GROK_BILLING_URL, {
 		headers: {
 			"authorization": `Bearer ${session.accessToken}`,
@@ -3506,15 +4949,19 @@ function grokCliReasoning(entry) {
 * Fetch the CLI catalog and index its per-model metadata by model id.
 * @param session - the stored session (used as-is; never refreshed here).
 * @param fetchFn - fetch implementation (injectable for tests).
+* @param signal - caller cancellation (pool-assembly timeout).
 * @returns model id → contributed metadata.
 */
-async function fetchGrokCliCatalog(session, fetchFn = fetch) {
-	const response = await fetchFn(GROK_CLI_MODELS_URL, { headers: {
-		"authorization": `Bearer ${session.accessToken}`,
-		"x-xai-token-auth": "xai-grok-cli",
-		"accept": "application/json",
-		...attributionHeaders()
-	} });
+async function fetchGrokCliCatalog(session, fetchFn = proxiedFetch, signal) {
+	const response = await fetchFn(GROK_CLI_MODELS_URL, {
+		headers: {
+			"authorization": `Bearer ${session.accessToken}`,
+			"x-xai-token-auth": "xai-grok-cli",
+			"accept": "application/json",
+			...attributionHeaders()
+		},
+		...signal === void 0 ? {} : { signal }
+	});
 	if (!response.ok) throw await oauthEndpointError(response, "grok CLI catalog");
 	const payload = await response.json();
 	if (!Array.isArray(payload.data)) throw new Error("grok CLI catalog returned no data array");
@@ -3567,15 +5014,20 @@ function grokPriorMeta(prior) {
 * @param onWarn - warning sink for a failed CLI catalog fetch.
 * @param previous - last-known catalog used to keep enrichment when the CLI
 *   catalog is down or omits a model.
+* @param signal - caller cancellation (pool-assembly timeout).
 * @returns discovered chat models in endpoint order.
 */
-async function fetchGrokModels(session, fetchFn = fetch, onWarn, previous) {
+async function fetchGrokModels(session, fetchFn = proxiedFetch, onWarn, previous, signal) {
 	const previousById = previous === void 0 || previous.length === 0 ? void 0 : new Map(previous.map((model) => [model.id, model]));
-	const [response, cliCatalog] = await Promise.all([fetchFn(GROK_MODELS_URL, { headers: {
-		"authorization": `Bearer ${session.accessToken}`,
-		"accept": "application/json",
-		...attributionHeaders()
-	} }), fetchGrokCliCatalog(session, fetchFn).catch((error) => {
+	const [response, cliCatalog] = await Promise.all([fetchFn(GROK_MODELS_URL, {
+		headers: {
+			"authorization": `Bearer ${session.accessToken}`,
+			"accept": "application/json",
+			...attributionHeaders()
+		},
+		...signal === void 0 ? {} : { signal }
+	}), fetchGrokCliCatalog(session, fetchFn, signal).catch((error) => {
+		if (isDiscoveryAborted(error, signal)) throw error;
 		onWarn?.(previousById === void 0 ? `grok CLI catalog fetch failed; reasoning efforts are unavailable (${errorChain(error)})` : `grok CLI catalog fetch failed; keeping last-known reasoning efforts (${errorChain(error)})`);
 	})]);
 	if (!response.ok) throw await oauthEndpointError(response, "grok models");
@@ -3600,14 +5052,44 @@ async function fetchGrokModels(session, fetchFn = fetch, onWarn, previous) {
 /** Grok wire adapter: one instance serves the `grok` provider route. */
 var GrokAdapter = class extends LlmAdapter {
 	catalog;
+	/** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+	accountCatalogs = /* @__PURE__ */ new Map();
+	/** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+	catalogOwner;
 	constructor(options) {
 		super();
 		this.options = options;
 		this.catalog = new ModelCatalogCache(options.catalogStore);
 	}
 	/** Discovery fetcher: resolves the session through the refresh-aware path. */
-	async fetchCatalog() {
-		return fetchGrokModels(await this.options.tokens.session(), this.options.fetchFn, this.options.onWarn, this.catalog.lastKnown());
+	async fetchCatalog(account, signal) {
+		const lastKnown = account === void 0 || account === await this.options.tokens.defaultAccount() ? this.catalog.lastKnown() : this.accountCatalogs.get(account)?.lastKnown();
+		return fetchGrokModels(await this.options.tokens.session(account), this.options.fetchFn, this.options.onWarn, lastKnown, signal);
+	}
+	/** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+	clearAccountCatalog(account) {
+		if (account === void 0) this.accountCatalogs.clear();
+		else this.accountCatalogs.delete(account);
+		if (account === void 0 || this.catalogOwner === account || this.catalogOwner === void 0) {
+			this.catalogOwner = void 0;
+			this.catalog.invalidate();
+		}
+	}
+	/** Persisted cache for the default account; a throwaway cache for any other. */
+	async catalogFor(account) {
+		const defaultKey = await this.options.tokens.defaultAccount();
+		const key = account ?? defaultKey;
+		if (key === void 0 || key === defaultKey) {
+			if (this.catalogOwner !== void 0 && this.catalogOwner !== defaultKey) this.catalog.invalidate();
+			this.catalogOwner = defaultKey;
+			return this.catalog;
+		}
+		let cache = this.accountCatalogs.get(key);
+		if (cache === void 0) {
+			cache = new ModelCatalogCache();
+			this.accountCatalogs.set(key, cache);
+		}
+		return cache;
 	}
 	listed(provider, discovered) {
 		return discovered.map((model) => ({
@@ -3633,11 +5115,30 @@ var GrokAdapter = class extends LlmAdapter {
 		}));
 	}
 	async listModels(provider) {
-		if (await this.options.tokens.peek() === void 0) return [];
+		const own = await this.listOwnModels(provider);
+		const pool = this.options.pool?.();
+		if (pool === void 0) return own;
+		const extra = await pool.modelsForProvider(provider);
+		const seen = new Set(own.map((model) => model.id));
+		return [...own, ...extra.filter((model) => !seen.has(model.id))];
+	}
+	/** The provider's own catalog: union of every account, or one account when named. */
+	async listOwnModels(provider, account, signal) {
+		if (account === void 0) {
+			const accounts = (await this.options.tokens.list()).map((entry) => entry.key);
+			if (accounts.length === 0) return [];
+			return unionAccountCatalogs(accounts, (key, accountSignal) => this.listOwnModels(provider, key, accountSignal), {
+				timeoutMs: DISCOVERY_TIMEOUT_MS,
+				...signal === void 0 ? {} : { signal }
+			});
+		}
+		if (!await this.options.tokens.hasSession(account)) return [];
 		if (!this.options.discovery) return this.staticModels(provider);
+		const catalog = await this.catalogFor(account);
 		try {
-			return this.listed(provider, await discoverOrRetryAuth((force) => this.options.tokens.session(force), this.catalog, () => this.catalog.get(() => this.fetchCatalog())));
+			return this.listed(provider, await discoverOrRetryAuth((force) => this.options.tokens.session(account, force), catalog, () => catalog.get(() => this.fetchCatalog(account, signal))));
 		} catch (error) {
+			if (isDiscoveryAborted(error, signal)) throw error;
 			if (isMissingOrInvalidCredential(error)) return [];
 			this.options.onWarn?.(`grok model discovery failed; using the built-in catalog (${errorChain(error)})`);
 			return this.staticModels(provider);
@@ -3653,9 +5154,17 @@ var GrokAdapter = class extends LlmAdapter {
 	*/
 	async discovered(model) {
 		if (!this.options.discovery) return void 0;
-		return (await this.catalog.resolve(() => this.fetchCatalog()))?.find((entry) => entry.id === model);
+		return discoverAcrossAccounts((await this.options.tokens.list()).map((entry) => entry.key), async (account) => {
+			return (await (await this.catalogFor(account)).resolve(() => this.fetchCatalog(account)))?.find((entry) => entry.id === model);
+		});
 	}
 	async resolveModel(provider, model) {
+		const pool = this.options.pool?.();
+		if (pool !== void 0 && await pool.owns(provider, model)) return pool.resolveModel(provider, model);
+		return this.resolveOwnModel(provider, model);
+	}
+	/** Capability resolution of the provider's own models (the pool resolves members here). */
+	async resolveOwnModel(provider, model) {
 		const discovered = await this.discovered(model);
 		const configured = this.options.models.find((entry) => entry.id === model);
 		return {
@@ -3670,12 +5179,24 @@ var GrokAdapter = class extends LlmAdapter {
 		};
 	}
 	async *stream(options) {
+		const pool = this.options.pool?.();
+		if (pool !== void 0 && await pool.owns(options.provider, options.model)) {
+			yield* pool.stream(options);
+			return;
+		}
+		yield* this.streamCore(options);
+	}
+	/** Pool seam: stream through one specific account instead of the default. */
+	streamAccount(options, account) {
+		return this.streamCore(options, account);
+	}
+	async *streamCore(options, account) {
 		const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
 		try {
-			let session = await this.options.tokens.session();
+			let session = await this.options.tokens.session(account);
 			let response = await this.request(options, session, watchdog.signal);
 			if (response.status === 401) {
-				session = await this.options.tokens.session(true);
+				session = await this.options.tokens.session(account, true);
 				response = await this.request(options, session, watchdog.signal);
 			}
 			if (!response.ok) throw await httpLlmError(response, "grok API");
@@ -3703,7 +5224,7 @@ var GrokAdapter = class extends LlmAdapter {
 			store: false,
 			stream: true
 		};
-		return fetch(GROK_API_URL, {
+		return proxiedFetch(GROK_API_URL, {
 			method: "POST",
 			headers: {
 				"authorization": `Bearer ${session.accessToken}`,
@@ -4117,7 +5638,7 @@ let vscodeVersionInflight;
 * @param forceRefresh - bypass the cache (a 401 `IDE token expired` retry).
 * @returns a `major.minor.patch` version string.
 */
-async function latestVsCodeVersion(fetchFn = fetch, forceRefresh = false) {
+async function latestVsCodeVersion(fetchFn = proxiedFetch, forceRefresh = false) {
 	if (!forceRefresh && vscodeVersionCache !== void 0 && Date.now() - vscodeVersionCache.at < VSCODE_VERSION_TTL_MS) return vscodeVersionCache.version;
 	vscodeVersionInflight ??= (async () => {
 		try {
@@ -4177,7 +5698,7 @@ function copilotHeaders(hasVision = false, vscodeVersion = FALLBACK_VSCODE_VERSI
 * @param fetchFn - fetch implementation (injectable for tests).
 * @returns the Copilot API token and its expiry.
 */
-async function exchangeCopilotToken(githubToken, fetchFn = fetch) {
+async function exchangeCopilotToken(githubToken, fetchFn = proxiedFetch) {
 	const response = await fetchFn(COPILOT_TOKEN_URL, { headers: {
 		"authorization": `Bearer ${githubToken}`,
 		"accept": "application/json",
@@ -4198,7 +5719,7 @@ async function exchangeCopilotToken(githubToken, fetchFn = fetch) {
 * @param fetchFn - fetch implementation (injectable for tests).
 * @returns the session to store.
 */
-async function completeCopilotLogin(githubToken, fetchFn = fetch) {
+async function completeCopilotLogin(githubToken, fetchFn = proxiedFetch) {
 	const pair = await exchangeCopilotToken(githubToken, fetchFn);
 	let account;
 	try {
@@ -4226,7 +5747,7 @@ async function completeCopilotLogin(githubToken, fetchFn = fetch) {
 * @param fetchFn - fetch implementation (injectable for tests).
 * @returns the fresh session to store.
 */
-async function refreshCopilot(session, fetchFn = fetch) {
+async function refreshCopilot(session, fetchFn = proxiedFetch) {
 	const pair = await exchangeCopilotToken(session.refreshToken, fetchFn);
 	return {
 		accessToken: pair.accessToken,
@@ -4282,14 +5803,18 @@ function copilotReasoning(entry) {
 * reasoning efforts (the endpoint discloses no default, so none is claimed).
 * @param session - the stored session (used as-is; never refreshed here).
 * @param fetchFn - fetch implementation (injectable for tests).
+* @param signal - caller cancellation (pool-assembly timeout).
 * @returns discovered chat models in endpoint order.
 */
-async function fetchCopilotModels(session, fetchFn = fetch) {
-	const response = await fetchFn(COPILOT_MODELS_URL, { headers: {
-		"authorization": `Bearer ${session.accessToken}`,
-		"accept": "application/json",
-		...copilotHeaders(false, await latestVsCodeVersion(fetchFn))
-	} });
+async function fetchCopilotModels(session, fetchFn = proxiedFetch, signal) {
+	const response = await fetchFn(COPILOT_MODELS_URL, {
+		headers: {
+			"authorization": `Bearer ${session.accessToken}`,
+			"accept": "application/json",
+			...copilotHeaders(false, await latestVsCodeVersion(fetchFn))
+		},
+		...signal === void 0 ? {} : { signal }
+	});
 	if (!response.ok) throw await oauthEndpointError(response, "copilot models");
 	const payload = await response.json();
 	if (!Array.isArray(payload.data)) throw new Error("copilot models endpoint returned no data array");
@@ -4511,6 +6036,10 @@ var CopilotResponsesItemNormalizer = class {
 /** Copilot wire adapter: one instance serves the `copilot` provider route. */
 var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 	catalog;
+	/** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+	accountCatalogs = /* @__PURE__ */ new Map();
+	/** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+	catalogOwner;
 	/**
 	* [2026-08-23]-[a reasoning model continuing a tool chain must get its
 	* reasoning back or it restarts from scratch every tool round trip; the
@@ -4533,8 +6062,33 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 		this.catalog = new ModelCatalogCache(options.catalogStore);
 	}
 	/** Discovery fetcher: resolves the session through the refresh-aware path. */
-	async fetchCatalog() {
-		return fetchCopilotModels(await this.options.tokens.session(), this.options.fetchFn);
+	async fetchCatalog(account, signal) {
+		return fetchCopilotModels(await this.options.tokens.session(account), this.options.fetchFn, signal);
+	}
+	/** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+	clearAccountCatalog(account) {
+		if (account === void 0) this.accountCatalogs.clear();
+		else this.accountCatalogs.delete(account);
+		if (account === void 0 || this.catalogOwner === account || this.catalogOwner === void 0) {
+			this.catalogOwner = void 0;
+			this.catalog.invalidate();
+		}
+	}
+	/** Persisted cache for the default account; a throwaway cache for any other. */
+	async catalogFor(account) {
+		const defaultKey = await this.options.tokens.defaultAccount();
+		const key = account ?? defaultKey;
+		if (key === void 0 || key === defaultKey) {
+			if (this.catalogOwner !== void 0 && this.catalogOwner !== defaultKey) this.catalog.invalidate();
+			this.catalogOwner = defaultKey;
+			return this.catalog;
+		}
+		let cache = this.accountCatalogs.get(key);
+		if (cache === void 0) {
+			cache = new ModelCatalogCache();
+			this.accountCatalogs.set(key, cache);
+		}
+		return cache;
 	}
 	providerInfo(provider) {
 		return {
@@ -4551,10 +6105,28 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 		}));
 	}
 	async listModels(provider) {
-		if (await this.options.tokens.peek() === void 0) return [];
+		const own = await this.listOwnModels(provider);
+		const pool = this.options.pool?.();
+		if (pool === void 0) return own;
+		const extra = await pool.modelsForProvider(provider);
+		const seen = new Set(own.map((model) => model.id));
+		return [...own, ...extra.filter((model) => !seen.has(model.id))];
+	}
+	/** The provider's own catalog: union of every account, or one account when named. */
+	async listOwnModels(provider, account, signal) {
+		if (account === void 0) {
+			const accounts = (await this.options.tokens.list()).map((entry) => entry.key);
+			if (accounts.length === 0) return [];
+			return unionAccountCatalogs(accounts, (key, accountSignal) => this.listOwnModels(provider, key, accountSignal), {
+				timeoutMs: DISCOVERY_TIMEOUT_MS,
+				...signal === void 0 ? {} : { signal }
+			});
+		}
+		if (!await this.options.tokens.hasSession(account)) return [];
 		if (!this.options.discovery) return this.staticModels(provider);
+		const catalog = await this.catalogFor(account);
 		try {
-			return (await discoverOrRetryAuth((force) => this.options.tokens.session(force), this.catalog, () => this.catalog.get(() => this.fetchCatalog()))).map((model) => ({
+			return (await discoverOrRetryAuth((force) => this.options.tokens.session(account, force), catalog, () => catalog.get(() => this.fetchCatalog(account, signal)))).map((model) => ({
 				provider,
 				id: model.id,
 				name: model.name,
@@ -4562,6 +6134,7 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 				...model.inputModalities === void 0 ? {} : { inputModalities: model.inputModalities }
 			}));
 		} catch (error) {
+			if (isDiscoveryAborted(error, signal)) throw error;
 			if (isMissingOrInvalidCredential(error)) return [];
 			this.options.onWarn?.(`copilot model discovery failed; using the built-in catalog (${errorChain(error)})`);
 			return this.staticModels(provider);
@@ -4575,7 +6148,9 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 	*/
 	async discovered(model) {
 		if (!this.options.discovery) return void 0;
-		return (await this.catalog.resolve(() => this.fetchCatalog()))?.find((entry) => entry.id === model);
+		return discoverAcrossAccounts((await this.options.tokens.list()).map((entry) => entry.key), async (account) => {
+			return (await (await this.catalogFor(account)).resolve(() => this.fetchCatalog(account)))?.find((entry) => entry.id === model);
+		});
 	}
 	/**
 	* [2026-08-23]-[a manually configured responses-only model combined with
@@ -4675,6 +6250,12 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 		this.replayByScope.clear();
 	}
 	async resolveModel(provider, model) {
+		const pool = this.options.pool?.();
+		if (pool !== void 0 && await pool.owns(provider, model)) return pool.resolveModel(provider, model);
+		return this.resolveOwnModel(provider, model);
+	}
+	/** Capability resolution of the provider's own models (the pool resolves members here). */
+	async resolveOwnModel(provider, model) {
 		const discovered = await this.discovered(model);
 		const configured = this.options.models.find((entry) => entry.id === model);
 		return {
@@ -4689,15 +6270,27 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 		};
 	}
 	async *stream(options) {
+		const pool = this.options.pool?.();
+		if (pool !== void 0 && await pool.owns(options.provider, options.model)) {
+			yield* pool.stream(options);
+			return;
+		}
+		yield* this.streamCore(options);
+	}
+	/** Pool seam: stream through one specific account instead of the default. */
+	streamAccount(options, account) {
+		return this.streamCore(options, account);
+	}
+	async *streamCore(options, account) {
 		const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
 		try {
 			const wire = copilotRequestWire(this.configuredWireEntry(options.model) ?? await this.discovered(options.model), options);
-			let session = await this.options.tokens.session();
+			let session = await this.options.tokens.session(account);
 			const scope = this.replayScope(session.refreshToken, options);
 			let response = await this.request(options, session, watchdog.signal, wire, scope);
 			if (response.status === 401) {
-				await latestVsCodeVersion(this.options.fetchFn ?? fetch, true);
-				session = await this.options.tokens.session(true);
+				await latestVsCodeVersion(this.options.fetchFn ?? proxiedFetch, true);
+				session = await this.options.tokens.session(account, true);
 				response = await this.request(options, session, watchdog.signal, wire, scope);
 			}
 			if (!response.ok) throw await httpLlmError(response, "copilot API");
@@ -4721,13 +6314,13 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 		const messages = await resolveImages(options.messages, this.options.resolveAttachments?.(), signal);
 		const hasVision = messages.some((message) => message.content.some((block) => block.type === "image"));
 		const body = wire === "responses" ? copilotResponsesRequestBody(options, toResponsesInput(messages, options.system, (callId) => this.replayFor(replayScopeKey, callId))) : copilotChatRequestBody(options, toChatMessages(messages, options.system));
-		return fetch(wire === "responses" ? COPILOT_RESPONSES_URL : COPILOT_API_URL, {
+		return proxiedFetch(wire === "responses" ? COPILOT_RESPONSES_URL : COPILOT_API_URL, {
 			method: "POST",
 			headers: {
 				"authorization": `Bearer ${session.accessToken}`,
 				"accept": "text/event-stream",
 				"content-type": "application/json",
-				...copilotHeaders(hasVision, await latestVsCodeVersion(this.options.fetchFn ?? fetch))
+				...copilotHeaders(hasVision, await latestVsCodeVersion(this.options.fetchFn ?? proxiedFetch))
 			},
 			body: JSON.stringify(body),
 			signal
@@ -4895,7 +6488,7 @@ function createXSearchTool(options) {
 		async execute(args, exec) {
 			const request = buildXSearchRequest(args);
 			const session = await options.tokens.session();
-			const response = await (options.fetchFn ?? fetch)(X_SEARCH_URL, {
+			const response = await (options.fetchFn ?? proxiedFetch)(X_SEARCH_URL, {
 				method: "POST",
 				headers: {
 					"authorization": `Bearer ${session.accessToken}`,
@@ -5160,7 +6753,7 @@ function createImageGenerateTool(options) {
 			content: result.content.filter((block) => block.type === "text")
 		}),
 		async execute(args, exec) {
-			const fetchFn = options.fetchFn ?? fetch;
+			const fetchFn = options.fetchFn ?? proxiedFetch;
 			const preferGrok = args.provider === "grok";
 			const codexReady = options.codexTokens !== void 0 && await options.codexTokens.hasSession();
 			const grokReady = options.grokTokens !== void 0 && await options.grokTokens.hasSession();
@@ -5430,7 +7023,7 @@ function createVideoGenerateTool(options) {
 		async execute(args, exec) {
 			const body = buildVideoGenerateBody(args);
 			const session = await options.tokens.session();
-			const fetchFn = options.fetchFn ?? fetch;
+			const fetchFn = options.fetchFn ?? proxiedFetch;
 			const headers = {
 				"authorization": `Bearer ${session.accessToken}`,
 				"accept": "application/json"
@@ -5489,6 +7082,8 @@ const name = "dsh-plugin-subscriptions";
 const inject = ["llm"];
 /** Default maximum provider idle time while one stream read is outstanding. */
 const DEFAULT_STREAM_IDLE_TIMEOUT_MS = 3e5;
+/** Bound on one pool quota poll — member selection must not hang on a usage endpoint. */
+const POOL_USAGE_TIMEOUT_MS = DISCOVERY_TIMEOUT_MS;
 const providerIdSchema = z.union([
 	"codex",
 	"claude",
@@ -5503,6 +7098,11 @@ const modelEntrySchema = z.object({
 	inputModalities: z.array(z.union(["text", "image"])),
 	wire: z.union(["chat-completions", "responses"])
 });
+const poolMemberSchema = z.object({
+	provider: providerIdSchema.required(),
+	account: z.string(),
+	model: z.string().required()
+});
 const Config = z.object({
 	providers: z.array(providerIdSchema).default([
 		"codex",
@@ -5516,6 +7116,15 @@ const Config = z.object({
 		claude: z.array(modelEntrySchema),
 		grok: z.array(modelEntrySchema),
 		copilot: z.array(modelEntrySchema)
+	}),
+	pool: z.object({
+		enabled: z.boolean().default(true),
+		strategy: z.union(["priority", "quota_aware"]).default("quota_aware"),
+		switchMargin: z.number().min(1).default(2),
+		autoAccounts: z.boolean().default(true),
+		autoFamilies: z.boolean(),
+		families: z.dict(z.array(poolMemberSchema)),
+		tiers: z.dict(z.array(poolMemberSchema))
 	})
 });
 /** Built-in catalogs used when the config does not override a provider's models. */
@@ -5622,6 +7231,15 @@ function accountOf(provider, session) {
 		case "copilot": return session.account;
 	}
 }
+/** The plan name a stored session carries, when the provider told us. */
+function planOf(provider, session) {
+	switch (provider) {
+		case "codex": return session.planType;
+		case "claude": return session.subscriptionType;
+		case "grok": return;
+		case "copilot": return;
+	}
+}
 /**
 * Auth operations behind the `/subscriptions-auth` RPC channel: start/complete
 * OAuth attempts in the background, feed pasted codes, cancel, log out, and
@@ -5663,10 +7281,10 @@ var SubscriptionsAuthController = class {
 		this.usageFetchers = usageFetchers;
 		this.readClaudeCreds = readClaudeCreds;
 	}
-	usage(provider, signal) {
+	usage(provider, account, signal) {
 		const fetcher = this.usageFetchers[provider];
 		if (fetcher === void 0) return Promise.resolve({ supported: false });
-		return fetcher(signal);
+		return fetcher(account, signal);
 	}
 	async readImage(ref, signal) {
 		const attachments = this.resolveAttachments();
@@ -5684,28 +7302,45 @@ var SubscriptionsAuthController = class {
 		};
 	}
 	async status(provider) {
-		const session = await getSession(provider);
-		const account = accountOf(provider, session);
+		const entries = await listAccounts(provider);
 		const detail = this.lastError.get(provider);
 		return {
-			loggedIn: session !== void 0,
 			busy: this.flows.isBusy(provider) || this.deviceFlows.isBusy(provider) || this.finalizing.has(provider),
-			...session === void 0 ? {} : { expiresAt: session.expiresAt },
-			...account === void 0 ? {} : { account },
+			accounts: entries.map(({ key, session }, index) => {
+				const account = accountOf(provider, session);
+				const plan = planOf(provider, session);
+				return {
+					key,
+					isDefault: index === 0,
+					expiresAt: session.expiresAt,
+					...account === void 0 ? {} : { account },
+					...plan === void 0 ? {} : { plan }
+				};
+			}),
 			...detail === void 0 ? {} : { detail }
 		};
 	}
-	async login(provider) {
-		if (provider === "claude") {
+	async login(provider, method) {
+		if (provider === "claude" && method !== "oauth") {
 			const imported = this.readClaudeCreds();
 			if (imported !== void 0) {
 				this.claim("claude");
 				this.flows.pending("claude")?.cancel();
-				await this.persist("claude", imported);
+				const session = {
+					...imported,
+					keychainBound: true
+				};
+				await this.persist("claude", session);
 				this.lastError.delete("claude");
-				this.onAuthChanged("claude");
+				this.onAuthChanged("claude", accountKeyOf("claude", session));
 				return { authorizeUrl: "" };
 			}
+			if (method === "keychain") throw new Error("no Claude Code credentials found; run `claude` and log in first, or choose the browser flow");
+			const attempt$1 = await this.flows.start("claude", claudeFlow);
+			this.completions.set("claude", this.complete("claude", attempt$1, this.claim("claude")));
+			return { authorizeUrl: attempt$1.authorizeUrl };
+		}
+		if (provider === "claude") {
 			const attempt$1 = await this.flows.start("claude", claudeFlow);
 			this.completions.set("claude", this.complete("claude", attempt$1, this.claim("claude")));
 			return { authorizeUrl: attempt$1.authorizeUrl };
@@ -5747,7 +7382,7 @@ var SubscriptionsAuthController = class {
 			if (this.claims.get(provider) !== claim) return;
 			await this.persist(provider, session);
 			this.lastError.delete(provider);
-			this.onAuthChanged(provider);
+			this.onAuthChanged(provider, accountKeyOf(provider, session));
 		} catch (error) {
 			if (this.claims.get(provider) !== claim) return;
 			if (!(error instanceof Error && error.message === "login cancelled")) this.lastError.set(provider, errorChain(error));
@@ -5759,7 +7394,7 @@ var SubscriptionsAuthController = class {
 			const session = await completeCopilotLogin(await attempt.waitToken());
 			await this.persist(provider, session);
 			this.lastError.delete(provider);
-			this.onAuthChanged(provider);
+			this.onAuthChanged(provider, accountKeyOf(provider, session));
 		} catch (error) {
 			if (!(error instanceof Error && error.message === "login cancelled")) this.lastError.set(provider, errorChain(error));
 		} finally {
@@ -5775,12 +7410,7 @@ var SubscriptionsAuthController = class {
 		}
 	}
 	persist(provider, session) {
-		switch (provider) {
-			case "codex": return saveSession("codex", session);
-			case "claude": return saveSession("claude", session);
-			case "grok": return saveSession("grok", session);
-			case "copilot": return saveSession("copilot", session);
-		}
+		return saveAccountSession(provider, accountKeyOf(provider, session), session);
 	}
 	/**
 	* Settle once no OAuth completion is running for a provider.
@@ -5804,13 +7434,17 @@ var SubscriptionsAuthController = class {
 		this.deviceFlows.pending(provider)?.cancel();
 		return Promise.resolve();
 	}
-	async logout(provider) {
+	async logout(provider, account) {
 		this.claim(provider);
 		this.flows.pending(provider)?.cancel();
 		this.deviceFlows.pending(provider)?.cancel();
-		await deleteSession(provider);
+		await deleteAccountSession(provider, account);
 		this.lastError.delete(provider);
-		this.onAuthChanged(provider);
+		this.onAuthChanged(provider, account);
+	}
+	async setDefault(provider, account) {
+		await setDefaultAccount(provider, account);
+		this.onAuthChanged(provider, account);
 	}
 };
 function apply(ctx, config) {
@@ -5826,9 +7460,18 @@ function apply(ctx, config) {
 	};
 	const resolveAttachments = () => ctx.get("attachments");
 	const handles = /* @__PURE__ */ new Map();
-	const authChanged = (provider) => {
+	const adapters = /* @__PURE__ */ new Map();
+	const accountTokens = /* @__PURE__ */ new Map();
+	let poolHealth;
+	let poolUsage;
+	let poolAdapter;
+	const authChanged = (provider, account) => {
 		if (provider === "copilot") copilotAdapter?.clearReplayState();
-		handles.get(provider)?.replace([provider]);
+		adapters.get(provider)?.clearAccountCatalog(account);
+		poolHealth?.clear(provider, account);
+		poolUsage?.invalidate(provider, account);
+		poolAdapter?.invalidate();
+		for (const [route, handle] of handles) handle.replace([route]);
 	};
 	let codexTokens;
 	let claudeTokens;
@@ -5839,20 +7482,21 @@ function apply(ctx, config) {
 	let copilotAdapter;
 	for (const provider of providers) switch (provider) {
 		case "codex": {
-			const tokens = new TokenManager({
+			const tokens = new AccountTokenManager({
+				provider: "codex",
 				displayName: "ChatGPT (Codex)",
-				preemptMs: CODEX_PREEMPT_MS,
-				load: () => getSession("codex"),
-				save: (session) => saveSession("codex", session),
-				remove: () => deleteSession("codex"),
-				refresh: refreshCodex,
-				isPermanent: isCodexPermanentRefreshError,
-				onRemoved: () => {
-					authChanged("codex");
+				makeOptions: () => ({
+					preemptMs: CODEX_PREEMPT_MS,
+					refresh: refreshCodex,
+					isPermanent: isCodexPermanentRefreshError
+				}),
+				onAccountRemoved: (account) => {
+					authChanged("codex", account);
 				}
 			});
 			codexTokens = tokens;
-			usageFetchers.codex = async (signal) => fetchCodexUsage(await tokens.session(), fetch, signal);
+			accountTokens.set("codex", tokens);
+			usageFetchers.codex = async (account, signal) => fetchCodexUsage(await tokens.session(account), proxiedFetch, signal);
 			let adapter;
 			adapter = new CodexAdapter({
 				models: catalog.codex,
@@ -5862,28 +7506,31 @@ function apply(ctx, config) {
 				onWarn,
 				resolveAttachments,
 				catalogStore: catalogStore("codex"),
+				pool: () => poolAdapter,
 				speedFor: (sessionId, model) => sessionId !== void 0 && speedBySession.get(sessionId) === "fast" && adapter.supportsFastTier(model)
 			});
 			codexAdapter = adapter;
+			adapters.set("codex", adapter);
 			handles.set("codex", ctx.llm.registerAdapter(["codex"], adapter));
 			break;
 		}
 		case "claude": {
-			const tokens = new TokenManager({
+			const tokens = new AccountTokenManager({
+				provider: "claude",
 				displayName: "Claude (Subscription)",
-				preemptMs: CLAUDE_PREEMPT_MS,
-				load: () => getSession("claude"),
-				save: (session) => saveSession("claude", session),
-				remove: () => deleteSession("claude"),
-				refresh: (session) => refreshClaudeSynced(session, refreshClaude),
-				isPermanent: isClaudePermanentRefreshError,
-				onRemoved: () => {
-					authChanged("claude");
+				makeOptions: () => ({
+					preemptMs: CLAUDE_PREEMPT_MS,
+					refresh: (session) => session.keychainBound === true ? refreshClaudeSynced(session, refreshClaude) : refreshClaude(session),
+					isPermanent: isClaudePermanentRefreshError
+				}),
+				onAccountRemoved: (account) => {
+					authChanged("claude", account);
 				}
 			});
 			claudeTokens = tokens;
-			usageFetchers.claude = async (signal) => fetchClaudeUsage(await tokens.session(), fetch, signal);
-			handles.set("claude", ctx.llm.registerAdapter(["claude"], new ClaudeAdapter({
+			accountTokens.set("claude", tokens);
+			usageFetchers.claude = async (account, signal) => fetchClaudeUsage(await tokens.session(account), proxiedFetch, signal);
+			const adapter = new ClaudeAdapter({
 				models: catalog.claude,
 				streamIdleTimeoutMs,
 				tokens,
@@ -5891,49 +7538,57 @@ function apply(ctx, config) {
 				onWarn,
 				maxRetries: 10,
 				resolveAttachments,
-				catalogStore: catalogStore("claude")
-			})));
+				catalogStore: catalogStore("claude"),
+				pool: () => poolAdapter
+			});
+			adapters.set("claude", adapter);
+			handles.set("claude", ctx.llm.registerAdapter(["claude"], adapter));
 			break;
 		}
 		case "grok": {
-			const tokens = new TokenManager({
+			const tokens = new AccountTokenManager({
+				provider: "grok",
 				displayName: "Grok (Subscription)",
-				preemptMs: GROK_PREEMPT_MS,
-				load: () => getSession("grok"),
-				save: (session) => saveSession("grok", session),
-				remove: () => deleteSession("grok"),
-				refresh: refreshGrok,
-				isPermanent: isGrokPermanentRefreshError,
-				onRemoved: () => {
-					authChanged("grok");
+				makeOptions: () => ({
+					preemptMs: GROK_PREEMPT_MS,
+					refresh: refreshGrok,
+					isPermanent: isGrokPermanentRefreshError
+				}),
+				onAccountRemoved: (account) => {
+					authChanged("grok", account);
 				}
 			});
 			grokTokens = tokens;
-			usageFetchers.grok = async (signal) => fetchGrokUsage(await tokens.session(), fetch, signal);
-			handles.set("grok", ctx.llm.registerAdapter(["grok"], new GrokAdapter({
+			accountTokens.set("grok", tokens);
+			usageFetchers.grok = async (account, signal) => fetchGrokUsage(await tokens.session(account), proxiedFetch, signal);
+			const adapter = new GrokAdapter({
 				models: catalog.grok,
 				streamIdleTimeoutMs,
 				tokens,
 				discovery: !overridden.has("grok"),
 				onWarn,
 				resolveAttachments,
-				catalogStore: catalogStore("grok")
-			})));
+				catalogStore: catalogStore("grok"),
+				pool: () => poolAdapter
+			});
+			adapters.set("grok", adapter);
+			handles.set("grok", ctx.llm.registerAdapter(["grok"], adapter));
 			break;
 		}
 		case "copilot": {
-			const tokens = new TokenManager({
+			const tokens = new AccountTokenManager({
+				provider: "copilot",
 				displayName: "GitHub Copilot",
-				preemptMs: COPILOT_PREEMPT_MS,
-				load: () => getSession("copilot"),
-				save: (session) => saveSession("copilot", session),
-				remove: () => deleteSession("copilot"),
-				refresh: refreshCopilot,
-				isPermanent: isCopilotPermanentRefreshError,
-				onRemoved: () => {
-					authChanged("copilot");
+				makeOptions: () => ({
+					preemptMs: COPILOT_PREEMPT_MS,
+					refresh: refreshCopilot,
+					isPermanent: isCopilotPermanentRefreshError
+				}),
+				onAccountRemoved: (account) => {
+					authChanged("copilot", account);
 				}
 			});
+			accountTokens.set("copilot", tokens);
 			copilotAdapter = new CopilotAdapter({
 				models: catalog.copilot,
 				streamIdleTimeoutMs,
@@ -5941,12 +7596,77 @@ function apply(ctx, config) {
 				discovery: !overridden.has("copilot"),
 				onWarn,
 				resolveAttachments,
-				catalogStore: catalogStore("copilot")
+				catalogStore: catalogStore("copilot"),
+				pool: () => poolAdapter
 			});
+			adapters.set("copilot", copilotAdapter);
 			handles.set("copilot", ctx.llm.registerAdapter(["copilot"], copilotAdapter));
 			break;
 		}
 	}
+	const poolConfig = config.pool;
+	const autoAccounts = poolConfig?.autoAccounts ?? poolConfig?.autoFamilies ?? true;
+	if (poolConfig?.enabled !== false && adapters.size >= 1) {
+		const fetcherFor = (provider, account) => {
+			switch (provider) {
+				case "codex": {
+					const tokens = codexTokens;
+					return tokens === void 0 ? void 0 : async () => fetchCodexUsage(await tokens.session(account), proxiedFetch, AbortSignal.timeout(POOL_USAGE_TIMEOUT_MS));
+				}
+				case "claude": {
+					const tokens = claudeTokens;
+					return tokens === void 0 ? void 0 : async () => fetchClaudeUsage(await tokens.session(account), proxiedFetch, AbortSignal.timeout(POOL_USAGE_TIMEOUT_MS));
+				}
+				case "grok": {
+					const tokens = grokTokens;
+					return tokens === void 0 ? void 0 : async () => fetchGrokUsage(await tokens.session(account), proxiedFetch, AbortSignal.timeout(POOL_USAGE_TIMEOUT_MS));
+				}
+				case "copilot": return;
+			}
+		};
+		poolHealth = new PoolHealthRegistry();
+		poolUsage = new PoolUsageTracker(fetcherFor);
+		const families = async () => {
+			const pools = /* @__PURE__ */ new Map();
+			if (autoAccounts) {
+				const sources = {};
+				await Promise.all([...adapters].map(async ([provider, adapter]) => {
+					try {
+						const accounts = (await accountTokens.get(provider)?.list() ?? []).map((entry) => entry.key);
+						if (accounts.length < 2) return;
+						const catalogs = (await Promise.all(accounts.map(async (account) => {
+							const models = await withTimeout((signal) => adapter.listOwnModels(provider, account, signal), POOL_USAGE_TIMEOUT_MS);
+							return models === void 0 ? void 0 : {
+								account,
+								models
+							};
+						}))).filter((entry) => entry !== void 0);
+						if (catalogs.length >= 2) sources[provider] = { catalogs };
+					} catch {}
+				}));
+				for (const [key, definition] of buildAccountPools(sources)) pools.set(key, definition);
+			}
+			for (const [id, members] of Object.entries(poolConfig?.families ?? {})) {
+				if (members.length === 0) continue;
+				const owner = members[0].provider;
+				const kept = members.filter((member) => member.provider === owner);
+				if (kept.length < members.length) onWarn(`pool "${id}": cross-provider members are ignored; only ${owner} accounts are pooled`);
+				pools.set(poolKey(owner, id), { members: kept });
+			}
+			return pools;
+		};
+		poolAdapter = new PoolAdapter({
+			adapters: Object.fromEntries(adapters),
+			health: poolHealth,
+			usage: poolUsage,
+			strategy: poolConfig?.strategy ?? "quota_aware",
+			switchMargin: poolConfig?.switchMargin ?? 2,
+			defaultAccount: (provider) => accountTokens.get(provider)?.defaultAccount() ?? Promise.resolve(void 0),
+			families,
+			tiers: poolConfig?.tiers ?? {},
+			onWarn
+		});
+	}
 	registerAuthRpc(ctx, new SubscriptionsAuthController(flows, deviceFlows, authChanged, resolveAttachments, usageFetchers), {
 		async speed(sessionId) {
 			return {
@@ -5958,10 +7678,20 @@ function apply(ctx, config) {
 			if (tier === "standard") speedBySession.delete(sessionId);
 			else speedBySession.set(sessionId, tier);
 		}
+	}, {
+		get: () => proxyGetConfig(),
+		set: (input) => proxySetConfig(input),
+		test: (payload) => proxyTestConnection(payload.url, payload.proxy)
 	});
 	if (claudeTokens !== void 0) {
+		const tokens = claudeTokens;
 		const syncTimer = setInterval(() => {
-			claudeTokens?.session().catch(() => {});
+			tokens.list().then((accounts) => {
+				for (const { key, session } of accounts) {
+					if (session.keychainBound !== true) continue;
+					tokens.session(key).catch(() => {});
+				}
+			}, () => void 0);
 		}, 5 * 6e4);
 		ctx.effect(() => () => {
 			clearInterval(syncTimer);
@@ -5982,4 +7712,4 @@ function apply(ctx, config) {
 }
 
 //#endregion
-export { Config, DEFAULT_STREAM_IDLE_TIMEOUT_MS, SubscriptionsAuthController, apply, inject, name };
+export { Config, DEFAULT_STREAM_IDLE_TIMEOUT_MS, POOL_USAGE_TIMEOUT_MS, SubscriptionsAuthController, apply, inject, name, withTimeout };