dsh-plugin-subscriptions 0.5.2 → 0.5.3

package/lib/providers/codex.js

@@ -8,7 +8,8 @@ import { attributionHeaders, EMPTY_RESPONSE_CODE, errorChain, LlmAdapter, LlmErr
 import { decodeJwtPayload } from '../auth/jwt.js';
 import { resolveImages } from '../translate/resolved.js';
 import { streamResponses, toResponsesInput, toResponsesTools } from '../translate/responses.js';
-import { httpLlmError, idleWatchdog, mapFetchFailure, ModelCatalogCache, discoverOrRetryAuth, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, TokenManager, } from './common.js';
+import { httpLlmError, idleWatchdog, mapFetchFailure, ModelCatalogCache, discoverAcrossAccounts, discoverOrRetryAuth, isDiscoveryAborted, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, } from './common.js';
+import { AccountTokenManager, DISCOVERY_TIMEOUT_MS, unionAccountCatalogs } from './accounts.js';
 import { proxiedFetch } from '../http.js';
 export const CODEX_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
 export const CODEX_AUTHORIZE_URL = 'https://auth.openai.com/oauth/authorize';
@@ -308,9 +309,10 @@ function supportsFastTier(entry) {
  * Fetch the live codex model catalog with the session's auth headers.
  * @param session - the stored session (used as-is; never refreshed here).
  * @param fetchFn - fetch implementation (injectable for tests).
+ * @param signal - caller cancellation (pool-assembly timeout).
  * @returns discovered models: hidden entries dropped, sorted by priority.
  */
-export async function fetchCodexModels(session, fetchFn = proxiedFetch) {
+export async function fetchCodexModels(session, fetchFn = proxiedFetch, signal) {
     const url = `${CODEX_MODELS_URL}?client_version=${CODEX_CLIENT_VERSION}`;
     const response = await fetchFn(url, {
         headers: {
@@ -320,6 +322,7 @@ export async function fetchCodexModels(session, fetchFn = proxiedFetch) {
             'accept': 'application/json',
             ...attributionHeaders(),
         },
+        ...signal === undefined ? {} : { signal },
     });
     if (!response.ok)
         throw await oauthEndpointError(response, 'codex models');
@@ -451,14 +454,47 @@ export function codexRequestBody(options, resolved, fast) {
 export class CodexAdapter extends LlmAdapter {
     options;
     catalog;
+    /** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+    accountCatalogs = new Map();
+    /** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+    catalogOwner;
     constructor(options) {
         super();
         this.options = options;
         this.catalog = new ModelCatalogCache(options.catalogStore);
     }
     /** Discovery fetcher: resolves the session through the refresh-aware path. */
-    async fetchCatalog() {
-        return fetchCodexModels(await this.options.tokens.session(), this.options.fetchFn);
+    async fetchCatalog(account, signal) {
+        return fetchCodexModels(await this.options.tokens.session(account), this.options.fetchFn, signal);
+    }
+    /** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+    clearAccountCatalog(account) {
+        if (account === undefined)
+            this.accountCatalogs.clear();
+        else
+            this.accountCatalogs.delete(account);
+        if (account === undefined || this.catalogOwner === account || this.catalogOwner === undefined) {
+            this.catalogOwner = undefined;
+            this.catalog.invalidate();
+        }
+    }
+    /** Persisted cache for the default account; a throwaway cache for any other. */
+    async catalogFor(account) {
+        const defaultKey = await this.options.tokens.defaultAccount();
+        const key = account ?? defaultKey;
+        if (key === undefined || key === defaultKey) {
+            if (this.catalogOwner !== undefined && this.catalogOwner !== defaultKey) {
+                this.catalog.invalidate();
+            }
+            this.catalogOwner = defaultKey;
+            return this.catalog;
+        }
+        let cache = this.accountCatalogs.get(key);
+        if (cache === undefined) {
+            cache = new ModelCatalogCache();
+            this.accountCatalogs.set(key, cache);
+        }
+        return cache;
     }
     providerInfo(provider) {
         return { id: provider, name: 'ChatGPT (Codex)' };
@@ -472,26 +508,48 @@ export class CodexAdapter extends LlmAdapter {
         }));
     }
     async listModels(provider) {
-        // Not logged in → empty catalog, so the web picker drops the provider.
-        const session = await this.options.tokens.peek();
-        if (session === undefined)
+        const own = await this.listOwnModels(provider);
+        const pool = this.options.pool?.();
+        if (pool === undefined)
+            return own;
+        const extra = await pool.modelsForProvider(provider);
+        const seen = new Set(own.map(model => model.id));
+        // Account pools reuse the catalog row; only configured tiers are extra.
+        return [...own, ...extra.filter(model => !seen.has(model.id))];
+    }
+    /** The provider's own catalog: union of every account, or one account when named. */
+    async listOwnModels(provider, account, signal) {
+        if (account === undefined) {
+            const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+            if (accounts.length === 0)
+                return [];
+            return unionAccountCatalogs(accounts, (key, accountSignal) => this.listOwnModels(provider, key, accountSignal), { timeoutMs: this.options.discoveryTimeoutMs ?? DISCOVERY_TIMEOUT_MS, ...signal === undefined ? {} : { signal } });
+        }
+        if (!await this.options.tokens.hasSession(account)) {
             return [];
+        }
         if (!this.options.discovery)
             return this.staticModels(provider);
+        const catalog = await this.catalogFor(account);
         try {
             // The fetcher runs only on a cache miss, and resolves the session
             // through the refresh-aware path so an expired access token renews here
             // instead of failing discovery into the static fallback.
-            const discovered = await discoverOrRetryAuth(force => this.options.tokens.session(force), this.catalog, () => this.catalog.get(() => this.fetchCatalog()));
+            const discovered = await discoverOrRetryAuth(force => this.options.tokens.session(account, force), catalog, () => catalog.get(() => this.fetchCatalog(account, signal)));
             return discovered.map(model => ({
                 provider,
                 id: model.id,
                 name: model.name,
                 ...model.description === undefined ? {} : { description: model.description },
                 inputModalities: CODEX_MODALITIES,
+                ...model.priority === undefined ? {} : { priority: model.priority },
             }));
         }
         catch (error) {
+            // A cancelled discovery must not fall back to the static catalog — the
+            // caller (pool assembly) treats abort as "this account sits out".
+            if (isDiscoveryAborted(error, signal))
+                throw error;
             // A permanent refresh failure deletes the stored session: the provider
             // is logged out, so hide it instead of showing a stale static catalog.
             if (isMissingOrInvalidCredential(error))
@@ -510,8 +568,12 @@ export class CodexAdapter extends LlmAdapter {
     async discovered(model) {
         if (!this.options.discovery)
             return undefined;
-        const models = await this.catalog.resolve(() => this.fetchCatalog());
-        return models?.find(entry => entry.id === model);
+        const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+        return discoverAcrossAccounts(accounts, async (account) => {
+            const catalog = await this.catalogFor(account);
+            const models = await catalog.resolve(() => this.fetchCatalog(account));
+            return models?.find(entry => entry.id === model);
+        });
     }
     /** Whether the discovered catalog advertises a fast tier for this model. */
     async supportsFastTier(model) {
@@ -522,14 +584,39 @@ export class CodexAdapter extends LlmAdapter {
         if (!this.options.discovery)
             return [];
         // Not logged in → no fast models, so the Speed toggle hides after logout
-        // (mirrors the listModels guard above).
-        const session = await this.options.tokens.peek();
-        if (session === undefined)
+        // (mirrors the listModels guard above). Union every account: a fast-capable
+        // model only the non-default lists (e.g. gpt-5.6-sol) must still show Speed.
+        const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+        if (accounts.length === 0)
             return [];
-        const models = await this.catalog.resolve(() => this.fetchCatalog());
-        return (models ?? []).filter(model => model.fastTier === true).map(model => model.id);
+        const seen = new Set();
+        const ids = [];
+        for (const account of accounts) {
+            try {
+                const catalog = await this.catalogFor(account);
+                const models = await catalog.resolve(() => this.fetchCatalog(account));
+                for (const model of models ?? []) {
+                    if (model.fastTier !== true || seen.has(model.id))
+                        continue;
+                    seen.add(model.id);
+                    ids.push(model.id);
+                }
+            }
+            catch {
+                // sit out
+            }
+        }
+        return ids;
     }
     async resolveModel(provider, model) {
+        const pool = this.options.pool?.();
+        if (pool !== undefined && await pool.owns(provider, model)) {
+            return pool.resolveModel(provider, model);
+        }
+        return this.resolveOwnModel(provider, model);
+    }
+    /** Capability resolution of the provider's own models (the pool resolves members here). */
+    async resolveOwnModel(provider, model) {
         // Discovered metadata (when discovery is on) wins over the static entry;
         // the static entry wins over the built-in defaults.
         const discovered = await this.discovered(model);
@@ -546,13 +633,25 @@ export class CodexAdapter extends LlmAdapter {
         };
     }
     async *stream(options) {
+        const pool = this.options.pool?.();
+        if (pool !== undefined && await pool.owns(options.provider, options.model)) {
+            yield* pool.stream(options);
+            return;
+        }
+        yield* this.streamCore(options);
+    }
+    /** Pool seam: stream through one specific account instead of the default. */
+    streamAccount(options, account) {
+        return this.streamCore(options, account);
+    }
+    async *streamCore(options, account) {
         const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
         try {
-            let session = await this.options.tokens.session();
+            let session = await this.options.tokens.session(account);
             let response = await this.request(options, session, watchdog.signal);
             if (response.status === 401) {
                 // One forced refresh + retry on an unexpired-but-rejected token.
-                session = await this.options.tokens.session(true);
+                session = await this.options.tokens.session(account, true);
                 response = await this.request(options, session, watchdog.signal);
             }
             if (!response.ok)

package/lib/providers/common.d.ts

@@ -141,6 +141,13 @@ export declare class TokenManager<S extends TimedSession> {
 }
 /** Fetch signature adapters accept for discovery calls (injectable for tests). */
 export type FetchFn = typeof fetch;
+/** Bound on one account catalog fetch or usage poll — a hang must not block the picker. */
+export declare const DISCOVERY_TIMEOUT_MS = 10000;
+/**
+ * Run `work` with an aborting signal. Resolves undefined when the timeout
+ * fires (the fetch is aborted); other failures propagate.
+ */
+export declare function withTimeout<T>(work: (signal: AbortSignal) => Promise<T>, timeoutMs: number): Promise<T | undefined>;
 /** One rate-limit window reported by a provider's usage endpoint. */
 export interface UsageWindow {
     /** Window kind: `session` for the short rolling window, `weekly` for the 7-day one. */
@@ -196,6 +203,12 @@ export interface DiscoveredModel {
      */
     copilotResponses?: boolean;
 }
+/**
+ * First account catalog that lists `model` (callers pass default-first).
+ * One failing lookup sits that account out so a sibling's metadata still
+ * resolves — the same isolation as the picker catalog union.
+ */
+export declare function discoverAcrossAccounts(accounts: readonly string[], lookup: (account: string) => Promise<DiscoveredModel | undefined>): Promise<DiscoveredModel | undefined>;
 /** How long a discovered catalog is trusted before re-fetching. */
 export declare const DISCOVERY_TTL_MS: number;
 /** A durable snapshot of one provider's discovered catalog. */
@@ -234,6 +247,8 @@ export declare class ModelCatalogCache {
     private seeded;
     /** Set by {@link invalidate} so an in-flight disk read cannot resurrect dropped state. */
     private seedDisabled;
+    /** Bumped by {@link invalidate} so a loser in-flight fetch cannot write back. */
+    private generation;
     constructor(persistence?: CatalogPersistence | undefined, ttlMs?: number);
     /**
      * The cached catalog when fresh, without fetching.
@@ -272,6 +287,8 @@ export declare class ModelCatalogCache {
 }
 /** Whether discovery failed because the stored login is gone. */
 export declare function isMissingOrInvalidCredential(error: unknown): boolean;
+/** Whether discovery stopped because the caller cancelled or the timeout fired. */
+export declare function isDiscoveryAborted(error: unknown, signal?: AbortSignal): boolean;
 /**
  * Run a catalog fetch, retrying once after a forced token refresh when the
  * first attempt is a 401/AUTH. Only {@link ModelCatalogCache.invalidate}s

package/lib/providers/common.js

@@ -263,6 +263,47 @@ export class TokenManager {
         return next;
     }
 }
+/** Bound on one account catalog fetch or usage poll — a hang must not block the picker. */
+export const DISCOVERY_TIMEOUT_MS = 10_000;
+/**
+ * Run `work` with an aborting signal. Resolves undefined when the timeout
+ * fires (the fetch is aborted); other failures propagate.
+ */
+export function withTimeout(work, timeoutMs) {
+    const signal = AbortSignal.timeout(timeoutMs);
+    const aborted = new Promise(resolve => {
+        if (signal.aborted)
+            resolve(undefined);
+        else
+            signal.addEventListener('abort', () => resolve(undefined), { once: true });
+    });
+    return Promise.race([
+        work(signal).then(value => (signal.aborted ? undefined : value), (error) => {
+            if (signal.aborted)
+                return undefined;
+            throw error;
+        }),
+        aborted,
+    ]);
+}
+/**
+ * First account catalog that lists `model` (callers pass default-first).
+ * One failing lookup sits that account out so a sibling's metadata still
+ * resolves — the same isolation as the picker catalog union.
+ */
+export async function discoverAcrossAccounts(accounts, lookup) {
+    for (const account of accounts) {
+        try {
+            const found = await lookup(account);
+            if (found !== undefined)
+                return found;
+        }
+        catch {
+            // sit out
+        }
+    }
+    return undefined;
+}
 /** How long a discovered catalog is trusted before re-fetching. */
 export const DISCOVERY_TTL_MS = 5 * 60_000;
 /**
@@ -286,6 +327,8 @@ export class ModelCatalogCache {
     seeded;
     /** Set by {@link invalidate} so an in-flight disk read cannot resurrect dropped state. */
     seedDisabled = false;
+    /** Bumped by {@link invalidate} so a loser in-flight fetch cannot write back. */
+    generation = 0;
     constructor(persistence, ttlMs = DISCOVERY_TTL_MS) {
         this.persistence = persistence;
         this.ttlMs = ttlMs;
@@ -320,16 +363,25 @@ export class ModelCatalogCache {
     }
     /** Run (or join) the single in-flight fetch, updating memory and disk on success. */
     refresh(fetcher) {
-        this.inflight ??= fetcher()
+        if (this.inflight !== undefined)
+            return this.inflight;
+        const gen = this.generation;
+        const pending = fetcher()
             .then((models) => {
+            if (this.generation !== gen)
+                return models;
             const snapshot = { at: Date.now(), models };
             this.entry = snapshot;
             // Write-through is fire-and-forget: a failed save only costs durability.
             void this.persistence?.save(snapshot).catch(() => undefined);
             return models;
         })
-            .finally(() => { this.inflight = undefined; });
-        return this.inflight;
+            .finally(() => {
+            if (this.generation === gen)
+                this.inflight = undefined;
+        });
+        this.inflight = pending;
+        return pending;
     }
     /**
      * Return the cached catalog when fresh, otherwise fetch and cache it.
@@ -370,7 +422,9 @@ export class ModelCatalogCache {
     }
     /** Drop the cached catalog (e.g. after a 401 proved the credential changed). */
     invalidate() {
+        this.generation += 1;
         this.entry = undefined;
+        this.inflight = undefined;
         this.seedDisabled = true;
         void this.persistence?.clear().catch(() => undefined);
     }
@@ -380,6 +434,16 @@ export function isMissingOrInvalidCredential(error) {
     return error instanceof LlmError
         && (error.code === 'MISSING_CREDENTIAL' || error.code === 'INVALID_CREDENTIAL');
 }
+/** Whether discovery stopped because the caller cancelled or the timeout fired. */
+export function isDiscoveryAborted(error, signal) {
+    if (signal?.aborted === true)
+        return true;
+    // Only treat abort-shaped errors as cancellation when this call had a signal;
+    // a refresh TimeoutError must not fail the whole picker union.
+    return signal !== undefined
+        && error instanceof Error
+        && (error.name === 'AbortError' || error.name === 'TimeoutError');
+}
 /** Whether discovery failed because the access token was rejected. */
 function isDiscoveryAuthFailure(error) {
     return (error instanceof OAuthEndpointError && error.status === 401)

package/lib/providers/copilot.d.ts

@@ -17,9 +17,10 @@ import { LlmAdapter } from '@deepseek-ai/dsh-llm';
 import type { GenerateOptions, LlmModelInfo, LlmProviderInfo, LlmResolvedModelInfo, StreamChunk } from '@deepseek-ai/dsh-llm';
 import type { DeviceFlowSpec } from '../auth/device-flow.js';
 import type { CopilotSession } from '../auth/store.js';
+import type { PoolAdapter } from './pool.js';
 import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
 import type { ReasoningReplayItem, ResponsesRequestInput, ResponsesStreamEvent } from '../translate/responses.js';
-import { TokenManager } from './common.js';
+import { AccountTokenManager } from './accounts.js';
 import type { CatalogPersistence, DiscoveredModel, FetchFn, ModelEntry } from './common.js';
 /**
  * Client id of the VS Code Copilot Chat GitHub App (pi-mono and
@@ -118,9 +119,10 @@ export declare function isCopilotPermanentRefreshError(error: unknown): boolean;
  * reasoning efforts (the endpoint discloses no default, so none is claimed).
  * @param session - the stored session (used as-is; never refreshed here).
  * @param fetchFn - fetch implementation (injectable for tests).
+ * @param signal - caller cancellation (pool-assembly timeout).
  * @returns discovered chat models in endpoint order.
  */
-export declare function fetchCopilotModels(session: CopilotSession, fetchFn?: FetchFn): Promise<DiscoveredModel[]>;
+export declare function fetchCopilotModels(session: CopilotSession, fetchFn?: FetchFn, signal?: AbortSignal): Promise<DiscoveredModel[]>;
 /** Which upstream protocol one Copilot model speaks. */
 export type CopilotWire = 'chat-completions' | 'responses';
 /**
@@ -215,7 +217,9 @@ export declare class CopilotResponsesItemNormalizer {
 export interface CopilotAdapterOptions {
     models: readonly ModelEntry[];
     streamIdleTimeoutMs: number;
-    tokens: TokenManager<CopilotSession>;
+    tokens: AccountTokenManager<CopilotSession>;
+    /** Late-bound pool facade (wired after adapter construction); pools list under their first member's provider. */
+    pool?: () => PoolAdapter | undefined;
     /** Whether to fetch the live catalog when logged in (false when config `models` overrides). */
     discovery: boolean;
     /** Warning sink for discovery failures that fall back to the static catalog. */
@@ -231,6 +235,10 @@ export interface CopilotAdapterOptions {
 export declare class CopilotAdapter extends LlmAdapter {
     private readonly options;
     private readonly catalog;
+    /** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+    private readonly accountCatalogs;
+    /** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+    private catalogOwner;
     /**
      * [2026-08-23]-[a reasoning model continuing a tool chain must get its
      * reasoning back or it restarts from scratch every tool round trip; the
@@ -250,9 +258,15 @@ export declare class CopilotAdapter extends LlmAdapter {
     constructor(options: CopilotAdapterOptions);
     /** Discovery fetcher: resolves the session through the refresh-aware path. */
     private fetchCatalog;
+    /** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+    clearAccountCatalog(account?: string): void;
+    /** Persisted cache for the default account; a throwaway cache for any other. */
+    private catalogFor;
     providerInfo(provider: string): LlmProviderInfo;
     private staticModels;
     listModels(provider: string): Promise<readonly LlmModelInfo[]>;
+    /** The provider's own catalog: union of every account, or one account when named. */
+    listOwnModels(provider: string, account?: string, signal?: AbortSignal): Promise<readonly LlmModelInfo[]>;
     /**
      * The discovered entry for one model. Resolved through the cache's
      * stale-while-revalidate path: capability metadata must stay stable across
@@ -309,7 +323,12 @@ export declare class CopilotAdapter extends LlmAdapter {
      */
     clearReplayState(): void;
     resolveModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
+    /** Capability resolution of the provider's own models (the pool resolves members here). */
+    resolveOwnModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
     stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+    /** Pool seam: stream through one specific account instead of the default. */
+    streamAccount(options: GenerateOptions, account: string): AsyncIterable<StreamChunk>;
+    private streamCore;
     private request;
 }
 export {};

package/lib/providers/copilot.js

@@ -17,7 +17,8 @@ import { EMPTY_RESPONSE_CODE, errorChain, LlmAdapter, LlmError, ReasoningEffortI
 import { resolveImages } from '../translate/resolved.js';
 import { streamChatCompletions, toChatMessages, toChatTools, } from '../translate/chat-completions.js';
 import { streamResponses, toResponsesInput, toResponsesTools } from '../translate/responses.js';
-import { httpLlmError, idleWatchdog, mapFetchFailure, ModelCatalogCache, discoverOrRetryAuth, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, TokenManager, } from './common.js';
+import { httpLlmError, idleWatchdog, mapFetchFailure, ModelCatalogCache, discoverAcrossAccounts, discoverOrRetryAuth, isDiscoveryAborted, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, } from './common.js';
+import { AccountTokenManager, DISCOVERY_TIMEOUT_MS, unionAccountCatalogs } from './accounts.js';
 import { proxiedFetch } from '../http.js';
 /**
  * Client id of the VS Code Copilot Chat GitHub App (pi-mono and
@@ -243,15 +244,17 @@ function copilotReasoning(entry) {
  * reasoning efforts (the endpoint discloses no default, so none is claimed).
  * @param session - the stored session (used as-is; never refreshed here).
  * @param fetchFn - fetch implementation (injectable for tests).
+ * @param signal - caller cancellation (pool-assembly timeout).
  * @returns discovered chat models in endpoint order.
  */
-export async function fetchCopilotModels(session, fetchFn = proxiedFetch) {
+export async function fetchCopilotModels(session, fetchFn = proxiedFetch, signal) {
     const response = await fetchFn(COPILOT_MODELS_URL, {
         headers: {
             'authorization': `Bearer ${session.accessToken}`,
             'accept': 'application/json',
             ...copilotHeaders(false, await latestVsCodeVersion(fetchFn)),
         },
+        ...signal === undefined ? {} : { signal },
     });
     if (!response.ok)
         throw await oauthEndpointError(response, 'copilot models');
@@ -510,6 +513,10 @@ export class CopilotResponsesItemNormalizer {
 export class CopilotAdapter extends LlmAdapter {
     options;
     catalog;
+    /** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+    accountCatalogs = new Map();
+    /** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+    catalogOwner;
     /**
      * [2026-08-23]-[a reasoning model continuing a tool chain must get its
      * reasoning back or it restarts from scratch every tool round trip; the
@@ -532,8 +539,37 @@ export class CopilotAdapter extends LlmAdapter {
         this.catalog = new ModelCatalogCache(options.catalogStore);
     }
     /** Discovery fetcher: resolves the session through the refresh-aware path. */
-    async fetchCatalog() {
-        return fetchCopilotModels(await this.options.tokens.session(), this.options.fetchFn);
+    async fetchCatalog(account, signal) {
+        return fetchCopilotModels(await this.options.tokens.session(account), this.options.fetchFn, signal);
+    }
+    /** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+    clearAccountCatalog(account) {
+        if (account === undefined)
+            this.accountCatalogs.clear();
+        else
+            this.accountCatalogs.delete(account);
+        if (account === undefined || this.catalogOwner === account || this.catalogOwner === undefined) {
+            this.catalogOwner = undefined;
+            this.catalog.invalidate();
+        }
+    }
+    /** Persisted cache for the default account; a throwaway cache for any other. */
+    async catalogFor(account) {
+        const defaultKey = await this.options.tokens.defaultAccount();
+        const key = account ?? defaultKey;
+        if (key === undefined || key === defaultKey) {
+            if (this.catalogOwner !== undefined && this.catalogOwner !== defaultKey) {
+                this.catalog.invalidate();
+            }
+            this.catalogOwner = defaultKey;
+            return this.catalog;
+        }
+        let cache = this.accountCatalogs.get(key);
+        if (cache === undefined) {
+            cache = new ModelCatalogCache();
+            this.accountCatalogs.set(key, cache);
+        }
+        return cache;
     }
     providerInfo(provider) {
         return { id: provider, name: 'GitHub Copilot' };
@@ -547,17 +583,34 @@ export class CopilotAdapter extends LlmAdapter {
         }));
     }
     async listModels(provider) {
-        // Not logged in → empty catalog, so the web picker drops the provider.
-        const session = await this.options.tokens.peek();
-        if (session === undefined)
+        const own = await this.listOwnModels(provider);
+        const pool = this.options.pool?.();
+        if (pool === undefined)
+            return own;
+        const extra = await pool.modelsForProvider(provider);
+        const seen = new Set(own.map(model => model.id));
+        // Account pools reuse the catalog row; only configured tiers are extra.
+        return [...own, ...extra.filter(model => !seen.has(model.id))];
+    }
+    /** The provider's own catalog: union of every account, or one account when named. */
+    async listOwnModels(provider, account, signal) {
+        if (account === undefined) {
+            const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+            if (accounts.length === 0)
+                return [];
+            return unionAccountCatalogs(accounts, (key, accountSignal) => this.listOwnModels(provider, key, accountSignal), { timeoutMs: DISCOVERY_TIMEOUT_MS, ...signal === undefined ? {} : { signal } });
+        }
+        if (!await this.options.tokens.hasSession(account)) {
             return [];
+        }
         if (!this.options.discovery)
             return this.staticModels(provider);
+        const catalog = await this.catalogFor(account);
         try {
             // The fetcher runs only on a cache miss, and resolves the session
             // through the refresh-aware path so an expired access token renews here
             // instead of failing discovery into the static fallback.
-            const discovered = await discoverOrRetryAuth(force => this.options.tokens.session(force), this.catalog, () => this.catalog.get(() => this.fetchCatalog()));
+            const discovered = await discoverOrRetryAuth(force => this.options.tokens.session(account, force), catalog, () => catalog.get(() => this.fetchCatalog(account, signal)));
             return discovered.map(model => ({
                 provider,
                 id: model.id,
@@ -567,6 +620,8 @@ export class CopilotAdapter extends LlmAdapter {
             }));
         }
         catch (error) {
+            if (isDiscoveryAborted(error, signal))
+                throw error;
             // A permanent refresh failure deletes the stored session: the provider
             // is logged out, so hide it instead of showing a stale static catalog.
             if (isMissingOrInvalidCredential(error))
@@ -584,8 +639,12 @@ export class CopilotAdapter extends LlmAdapter {
     async discovered(model) {
         if (!this.options.discovery)
             return undefined;
-        const models = await this.catalog.resolve(() => this.fetchCatalog());
-        return models?.find(entry => entry.id === model);
+        const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+        return discoverAcrossAccounts(accounts, async (account) => {
+            const catalog = await this.catalogFor(account);
+            const models = await catalog.resolve(() => this.fetchCatalog(account));
+            return models?.find(entry => entry.id === model);
+        });
     }
     /**
      * [2026-08-23]-[a manually configured responses-only model combined with
@@ -699,6 +758,14 @@ export class CopilotAdapter extends LlmAdapter {
         this.replayByScope.clear();
     }
     async resolveModel(provider, model) {
+        const pool = this.options.pool?.();
+        if (pool !== undefined && await pool.owns(provider, model)) {
+            return pool.resolveModel(provider, model);
+        }
+        return this.resolveOwnModel(provider, model);
+    }
+    /** Capability resolution of the provider's own models (the pool resolves members here). */
+    async resolveOwnModel(provider, model) {
         const discovered = await this.discovered(model);
         const configured = this.options.models.find(entry => entry.id === model);
         return {
@@ -717,6 +784,18 @@ export class CopilotAdapter extends LlmAdapter {
         };
     }
     async *stream(options) {
+        const pool = this.options.pool?.();
+        if (pool !== undefined && await pool.owns(options.provider, options.model)) {
+            yield* pool.stream(options);
+            return;
+        }
+        yield* this.streamCore(options);
+    }
+    /** Pool seam: stream through one specific account instead of the default. */
+    streamAccount(options, account) {
+        return this.streamCore(options, account);
+    }
+    async *streamCore(options, account) {
         const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
         try {
             // The discovered catalog decides the protocol: `/responses`-only model
@@ -725,7 +804,7 @@ export class CopilotAdapter extends LlmAdapter {
             // tools with a reasoning effort (gpt-5.4 400s on the chat wire then).
             // A configured `wire` outranks the catalog (see configuredWireEntry).
             const wire = copilotRequestWire(this.configuredWireEntry(options.model) ?? await this.discovered(options.model), options);
-            let session = await this.options.tokens.session();
+            let session = await this.options.tokens.session(account);
             // Replay scope: account identity × conversation × model (see
             // replayScope); a Copilot-token refresh preserves the GitHub token, so
             // the 401 retry below reuses it too.
@@ -737,7 +816,7 @@ export class CopilotAdapter extends LlmAdapter {
                 // means GitHub raised its minimum VS Code version, and only a fresh
                 // Editor-Version header fixes that (a new token does not).
                 await latestVsCodeVersion(this.options.fetchFn ?? proxiedFetch, true);
-                session = await this.options.tokens.session(true);
+                session = await this.options.tokens.session(account, true);
                 response = await this.request(options, session, watchdog.signal, wire, scope);
             }
             if (!response.ok)