dsh-plugin-subscriptions 0.5.2 → 0.6.0

package/lib/providers/claude.js

@@ -4,11 +4,13 @@
  * the Anthropic Messages API with the Claude Code identity headers.
  */
 import { execFileSync } from 'node:child_process';
-import { EMPTY_RESPONSE_CODE, errorChain, LlmAdapter, LlmError, ReasoningEffortId, resolveRetryPolicy } from '@deepseek-ai/dsh-llm';
+import { EMPTY_RESPONSE_CODE, errorChain, LlmAdapter, LlmError, ReasoningEffortId } from '@deepseek-ai/dsh-llm';
 import { resolveImages } from '../translate/resolved.js';
 import { markMessageCache, streamAnthropic, toAnthropicMessages, toAnthropicSystem, toAnthropicTools, } from '../translate/anthropic.js';
-import { httpLlmError, idleWatchdog, mapFetchFailure, ModelCatalogCache, discoverOrRetryAuth, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, TokenManager, } from './common.js';
+import { httpLlmError, idleWatchdog, mapFetchFailure, mergeReasoning, ModelCatalogCache, discoverAcrossAccounts, discoverOrRetryAuth, isDiscoveryAborted, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, } from './common.js';
+import { AccountTokenManager, DISCOVERY_TIMEOUT_MS, unionAccountCatalogs } from './accounts.js';
 import { proxiedFetch } from '../http.js';
+import { DEFAULT_RATE_LIMIT_WAIT, DEFAULT_RETRY, earliestReset, jsonBody, resetFromFields, resetInstantFromHeader, subscriptionRetryPolicy, } from './rate-limit.js';
 export const CLAUDE_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
 export const CLAUDE_AUTHORIZE_URL = 'https://claude.ai/oauth/authorize';
 export const CLAUDE_TOKEN_URL = 'https://claude.ai/v1/oauth/token';
@@ -21,6 +23,30 @@ const CLAUDE_CONTEXT_WINDOW = 200_000;
 const CLAUDE_DEFAULT_MAX_TOKENS = 32_000;
 /** Refresh when the access token has less than this much life left. */
 export const CLAUDE_PREEMPT_MS = 5 * 60_000;
+/**
+ * Body fields Anthropic uses to name a reset instant, read when the unified
+ * headers are absent.
+ */
+const CLAUDE_RESET_FIELDS = ['resets_at', 'resetsAt', 'reset_at', 'retry_after'];
+/**
+ * Reads the reset instant of the Anthropic window that rejected a request.
+ *
+ * `anthropic-ratelimit-unified-*` is the subscription-plan family — the one
+ * Claude Code renders as "resets 3pm" — and is the only header that names the
+ * window which actually rejected this request. The per-bucket
+ * `anthropic-ratelimit-{requests,tokens,input-tokens,output-tokens}-reset`
+ * headers are deliberately not read: they are rollover snapshots attached to
+ * every response, so on a 429 they cannot say which bucket refused, and the
+ * earliest of them is typically the bucket that still had room — a wait that
+ * lands straight back in the closed window. They reach the operator through
+ * `rateLimitDiagnostics` instead.
+ */
+export const claudeRateLimitReset = (response, body, now) => {
+    const unified = earliestReset(resetInstantFromHeader(response, 'anthropic-ratelimit-unified-reset', now), resetInstantFromHeader(response, 'anthropic-ratelimit-unified-fallback-reset', now));
+    if (unified !== undefined)
+        return unified;
+    return resetFromFields(jsonBody(body), CLAUDE_RESET_FIELDS, now);
+};
 /**
  * The subscription endpoint only serves requests presenting as Claude Code,
  * so these headers impersonate the CLI; the harness attribution user-agent
@@ -288,8 +314,8 @@ function claudeReasoning(capabilities) {
         .map(level => ({ id: ReasoningEffortId(level), name: level[0].toUpperCase() + level.slice(1) }));
     return efforts.length > 0 ? { efforts } : undefined;
 }
-/** Fetch the live model catalog from the subscription endpoint. */
-export async function fetchClaudeModels(session, fetchFn = proxiedFetch) {
+/** Fetch the live model catalog from the subscription endpoint. `signal` cancels the request. */
+export async function fetchClaudeModels(session, fetchFn = proxiedFetch, signal) {
     const response = await fetchFn(CLAUDE_MODELS_URL, {
         headers: {
             'authorization': `Bearer ${session.accessToken}`,
@@ -298,6 +324,7 @@ export async function fetchClaudeModels(session, fetchFn = proxiedFetch) {
             'anthropic-dangerous-direct-browser-access': 'true',
             'accept': 'application/json',
         },
+        ...signal === undefined ? {} : { signal },
     });
     if (!response.ok)
         throw await httpLlmError(response, 'claude models API');
@@ -322,14 +349,6 @@ export async function fetchClaudeModels(session, fetchFn = proxiedFetch) {
     }
     return models;
 }
-/**
- * Claude Code's own SDK retry shape: exponential backoff starting at 1s,
- * doubling per attempt, capped at 60s, plus jitter. `maxRetries` is the
- * count of retries after the first attempt (Claude Code defaults to 10).
- */
-const CLAUDE_RETRY_INITIAL_DELAY_MS = 1_000;
-const CLAUDE_RETRY_MAX_DELAY_MS = 60_000;
-const CLAUDE_RETRY_JITTER_RATIO = 0.2;
 /** The Claude 4.5 family accepts image input. */
 const CLAUDE_MODALITIES = ['text', 'image'];
 /**
@@ -368,19 +387,56 @@ export function claudeRequestBody(options, messages, maxTokens, thinking, effort
 export class ClaudeAdapter extends LlmAdapter {
     options;
     catalog;
+    /** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+    accountCatalogs = new Map();
+    /** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+    catalogOwner;
     constructor(options) {
         super();
         this.options = options;
         this.catalog = new ModelCatalogCache(options.catalogStore);
     }
-    async fetchCatalog() {
-        return fetchClaudeModels(await this.options.tokens.session(), this.options.fetchFn);
+    async fetchCatalog(account, signal) {
+        return fetchClaudeModels(await this.options.tokens.session(account), this.options.fetchFn, signal);
+    }
+    /** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+    clearAccountCatalog(account) {
+        if (account === undefined)
+            this.accountCatalogs.clear();
+        else
+            this.accountCatalogs.delete(account);
+        if (account === undefined || this.catalogOwner === account || this.catalogOwner === undefined) {
+            this.catalogOwner = undefined;
+            this.catalog.invalidate();
+        }
+    }
+    /** Persisted cache for the default account; a throwaway cache for any other. */
+    async catalogFor(account) {
+        const defaultKey = await this.options.tokens.defaultAccount();
+        const key = account ?? defaultKey;
+        if (key === undefined || key === defaultKey) {
+            if (this.catalogOwner !== undefined && this.catalogOwner !== defaultKey) {
+                this.catalog.invalidate();
+            }
+            this.catalogOwner = defaultKey;
+            return this.catalog;
+        }
+        let cache = this.accountCatalogs.get(key);
+        if (cache === undefined) {
+            cache = new ModelCatalogCache();
+            this.accountCatalogs.set(key, cache);
+        }
+        return cache;
     }
     async discovered(model) {
         if (!this.options.discovery)
             return undefined;
-        const models = await this.catalog.resolve(() => this.fetchCatalog());
-        return models?.find(entry => entry.id === model);
+        const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+        return discoverAcrossAccounts(accounts, async (account) => {
+            const catalog = await this.catalogFor(account);
+            const models = await catalog.resolve(() => this.fetchCatalog(account));
+            return models?.find(entry => entry.id === model);
+        });
     }
     staticModels(provider) {
         return this.options.models.map(model => ({
@@ -394,25 +450,34 @@ export class ClaudeAdapter extends LlmAdapter {
         return { id: provider, name: 'Claude (Subscription)' };
     }
     providerRetryPolicy(provider) {
-        if (this.options.maxRetries === undefined)
-            return undefined;
-        return resolveRetryPolicy({
-            mode: 'normal',
-            maxRetries: this.options.maxRetries,
-            backoff: {
-                initialDelayMs: CLAUDE_RETRY_INITIAL_DELAY_MS,
-                maxDelayMs: CLAUDE_RETRY_MAX_DELAY_MS,
-                jitterRatio: CLAUDE_RETRY_JITTER_RATIO,
-            },
-        }, `claude: provider "${provider}" retryPolicy`);
+        return subscriptionRetryPolicy(DEFAULT_RETRY, this.options.rateLimit ?? DEFAULT_RATE_LIMIT_WAIT, `claude: provider "${provider}" retryPolicy`);
     }
     async listModels(provider) {
-        if (await this.options.tokens.peek() === undefined)
+        const own = await this.listOwnModels(provider);
+        const pool = this.options.pool?.();
+        if (pool === undefined)
+            return own;
+        const extra = await pool.modelsForProvider(provider);
+        const seen = new Set(own.map(model => model.id));
+        // Account pools reuse the catalog row; only configured tiers are extra.
+        return [...own, ...extra.filter(model => !seen.has(model.id))];
+    }
+    /** The provider's own catalog: union of every account, or one account when named. */
+    async listOwnModels(provider, account, signal) {
+        if (account === undefined) {
+            const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+            if (accounts.length === 0)
+                return [];
+            return unionAccountCatalogs(accounts, (key, accountSignal) => this.listOwnModels(provider, key, accountSignal), { timeoutMs: DISCOVERY_TIMEOUT_MS, ...signal === undefined ? {} : { signal } });
+        }
+        if (!await this.options.tokens.hasSession(account)) {
             return [];
+        }
         if (!this.options.discovery)
             return this.staticModels(provider);
+        const catalog = await this.catalogFor(account);
         try {
-            const models = await discoverOrRetryAuth(force => this.options.tokens.session(force), this.catalog, () => this.catalog.get(() => this.fetchCatalog()));
+            const models = await discoverOrRetryAuth(force => this.options.tokens.session(account, force), catalog, () => catalog.get(() => this.fetchCatalog(account, signal)));
             return models.map(model => ({
                 provider,
                 id: model.id,
@@ -421,6 +486,8 @@ export class ClaudeAdapter extends LlmAdapter {
             }));
         }
         catch (error) {
+            if (isDiscoveryAborted(error, signal))
+                throw error;
             if (isMissingOrInvalidCredential(error))
                 return [];
             this.options.onWarn?.(`claude model discovery failed; using the built-in catalog (${errorChain(error)})`);
@@ -428,9 +495,17 @@ export class ClaudeAdapter extends LlmAdapter {
         }
     }
     async resolveModel(provider, model) {
+        const pool = this.options.pool?.();
+        if (pool !== undefined && await pool.owns(provider, model)) {
+            return pool.resolveModel(provider, model);
+        }
+        return this.resolveOwnModel(provider, model);
+    }
+    /** Capability resolution of the provider's own models (the pool resolves members here). */
+    async resolveOwnModel(provider, model) {
         const disc = await this.discovered(model);
         const configured = this.options.models.find(entry => entry.id === model);
-        const reasoning = disc?.reasoning;
+        const reasoning = mergeReasoning(this.options.defaultEffortOf?.(model), disc?.reasoning);
         return {
             provider,
             id: model,
@@ -444,16 +519,32 @@ export class ClaudeAdapter extends LlmAdapter {
         };
     }
     async *stream(options) {
+        const pool = this.options.pool?.();
+        if (pool !== undefined && await pool.owns(options.provider, options.model)) {
+            yield* pool.stream(options);
+            return;
+        }
+        yield* this.streamCore(options);
+    }
+    /** Pool seam: stream through one specific account instead of the default. */
+    streamAccount(options, account) {
+        return this.streamCore(options, account);
+    }
+    async *streamCore(options, account) {
         const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
         try {
-            let session = await this.options.tokens.session();
+            let session = await this.options.tokens.session(account);
             let response = await this.request(options, session, watchdog.signal);
             if (response.status === 401) {
-                session = await this.options.tokens.session(true);
+                session = await this.options.tokens.session(account, true);
                 response = await this.request(options, session, watchdog.signal);
             }
-            if (!response.ok)
-                throw await httpLlmError(response, 'claude API');
+            if (!response.ok) {
+                throw await httpLlmError(response, 'claude API', {
+                    rateLimitReset: claudeRateLimitReset,
+                    ...this.options.onWarn === undefined ? {} : { onWarn: this.options.onWarn },
+                });
+            }
             if (response.body === null) {
                 throw new LlmError('claude API returned no response body', EMPTY_RESPONSE_CODE);
             }

package/lib/providers/codex.d.ts

@@ -7,16 +7,29 @@ import { LlmAdapter } from '@deepseek-ai/dsh-llm';
 import type { GenerateOptions, LlmModelInfo, LlmProviderInfo, LlmResolvedModelInfo, StreamChunk } from '@deepseek-ai/dsh-llm';
 import type { FlowSpec } from '../auth/oauth-flow.js';
 import type { CodexSession } from '../auth/store.js';
+import type { PoolAdapter } from './pool.js';
 import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
 import type { ResponsesRequestInput } from '../translate/responses.js';
-import { TokenManager } from './common.js';
+import { AccountTokenManager } from './accounts.js';
 import type { CatalogPersistence, DiscoveredModel, FetchFn, ModelEntry, ProviderUsage } from './common.js';
+import type { RateLimitResetReader, RateLimitWait } from './rate-limit.js';
 export declare const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 export declare const CODEX_AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
 export declare const CODEX_TOKEN_URL = "https://auth.openai.com/oauth/token";
 export declare const CODEX_API_URL = "https://chatgpt.com/backend-api/codex/responses";
 /** Refresh when the access token has less than this much life left. */
 export declare const CODEX_PREEMPT_MS: number;
+/**
+ * Reads the reset instant of the Codex window that rejected a request.
+ *
+ * Body only. The `x-codex-{primary,secondary}-reset-after-seconds` headers are
+ * rollover snapshots the backend attaches to every response, one per window,
+ * so they say nothing about which window refused: a burst 429 that would clear
+ * in seconds still carries a primary rollover hours out, and reading it would
+ * park the turn for those hours. They reach the operator through
+ * `rateLimitDiagnostics` instead.
+ */
+export declare const codexRateLimitReset: RateLimitResetReader;
 /**
  * Fast tier (the codex CLI's "fast mode"): the Responses `service_tier` wire
  * value for priority processing, mirroring codex-rs
@@ -90,14 +103,17 @@ export declare const CODEX_CLIENT_VERSION = "0.147.0";
  * Fetch the live codex model catalog with the session's auth headers.
  * @param session - the stored session (used as-is; never refreshed here).
  * @param fetchFn - fetch implementation (injectable for tests).
+ * @param signal - caller cancellation (pool-assembly timeout).
  * @returns discovered models: hidden entries dropped, sorted by priority.
  */
-export declare function fetchCodexModels(session: CodexSession, fetchFn?: FetchFn): Promise<DiscoveredModel[]>;
+export declare function fetchCodexModels(session: CodexSession, fetchFn?: FetchFn, signal?: AbortSignal): Promise<DiscoveredModel[]>;
 /** Constructor dependencies for {@link CodexAdapter}. */
 export interface CodexAdapterOptions {
     models: readonly ModelEntry[];
     streamIdleTimeoutMs: number;
-    tokens: TokenManager<CodexSession>;
+    tokens: AccountTokenManager<CodexSession>;
+    /** Late-bound pool facade (wired after adapter construction); pools list under their first member's provider. */
+    pool?: () => PoolAdapter | undefined;
     /** Whether to fetch the live catalog when logged in (false when config `models` overrides). */
     discovery: boolean;
     /** Warning sink for discovery failures that fall back to the static catalog. */
@@ -108,6 +124,16 @@ export interface CodexAdapterOptions {
     resolveAttachments?: () => AttachmentStore | undefined;
     /** Durable catalog store seeding capability metadata across restarts. */
     catalogStore?: CatalogPersistence;
+    /** Per-account catalog bound for the picker union (defaults to {@link DISCOVERY_TIMEOUT_MS}). */
+    discoveryTimeoutMs?: number;
+    /** How long this route may hold a turn open waiting for a rate-limit window; defaults to waiting on, six-hour ceiling. */
+    rateLimit?: RateLimitWait;
+    /**
+     * Per-model default reasoning effort override (the Settings page's picker).
+     * Returns the user-configured default for one model, or undefined to follow
+     * the provider's own default.
+     */
+    defaultEffortOf?: (model: string) => string | undefined;
     /**
      * Per-request speed lookup (the composer Speed toggle's host half). Returns
      * whether this session's current choice sends the model on the fast tier;
@@ -126,12 +152,23 @@ export declare function codexRequestBody(options: GenerateOptions, resolved: Res
 export declare class CodexAdapter extends LlmAdapter {
     private readonly options;
     private readonly catalog;
+    /** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+    private readonly accountCatalogs;
+    /** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+    private catalogOwner;
     constructor(options: CodexAdapterOptions);
     /** Discovery fetcher: resolves the session through the refresh-aware path. */
     private fetchCatalog;
+    /** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+    clearAccountCatalog(account?: string): void;
+    /** Persisted cache for the default account; a throwaway cache for any other. */
+    private catalogFor;
     providerInfo(provider: string): LlmProviderInfo;
+    providerRetryPolicy(provider: string): import("@deepseek-ai/dsh-llm").ResolvedRetryPolicy;
     private staticModels;
     listModels(provider: string): Promise<readonly LlmModelInfo[]>;
+    /** The provider's own catalog: union of every account, or one account when named. */
+    listOwnModels(provider: string, account?: string, signal?: AbortSignal): Promise<readonly LlmModelInfo[]>;
     /**
      * The discovered entry for one model. Resolved through the cache's
      * stale-while-revalidate path so capability metadata stays stable across a
@@ -145,6 +182,11 @@ export declare class CodexAdapter extends LlmAdapter {
     /** Ids of every discovered model with a fast tier (the Speed toggle's visibility list). */
     fastCapableModels(): Promise<string[]>;
     resolveModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
+    /** Capability resolution of the provider's own models (the pool resolves members here). */
+    resolveOwnModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
     stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+    /** Pool seam: stream through one specific account instead of the default. */
+    streamAccount(options: GenerateOptions, account: string): AsyncIterable<StreamChunk>;
+    private streamCore;
     private request;
 }

package/lib/providers/codex.js

@@ -8,8 +8,10 @@ import { attributionHeaders, EMPTY_RESPONSE_CODE, errorChain, LlmAdapter, LlmErr
 import { decodeJwtPayload } from '../auth/jwt.js';
 import { resolveImages } from '../translate/resolved.js';
 import { streamResponses, toResponsesInput, toResponsesTools } from '../translate/responses.js';
-import { httpLlmError, idleWatchdog, mapFetchFailure, ModelCatalogCache, discoverOrRetryAuth, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, TokenManager, } from './common.js';
+import { effortDisplayName, httpLlmError, idleWatchdog, mapFetchFailure, mergeReasoning, ModelCatalogCache, discoverAcrossAccounts, discoverOrRetryAuth, isDiscoveryAborted, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, } from './common.js';
+import { AccountTokenManager, DISCOVERY_TIMEOUT_MS, unionAccountCatalogs } from './accounts.js';
 import { proxiedFetch } from '../http.js';
+import { DEFAULT_RATE_LIMIT_WAIT, DEFAULT_RETRY, jsonBody, resetFromFields, subscriptionRetryPolicy, } from './rate-limit.js';
 export const CODEX_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
 export const CODEX_AUTHORIZE_URL = 'https://auth.openai.com/oauth/authorize';
 export const CODEX_TOKEN_URL = 'https://auth.openai.com/oauth/token';
@@ -20,6 +22,23 @@ const CODEX_CONTEXT_WINDOW = 400_000;
 const CODEX_DEFAULT_MAX_TOKENS = 128_000;
 /** Refresh when the access token has less than this much life left. */
 export const CODEX_PREEMPT_MS = 5 * 60_000;
+/**
+ * Body fields the backend uses to name a reset. A window-exhaustion rejection
+ * carries `usage_limit_reached` with the seconds left on the window — the case
+ * that used to classify as a terminal quota and never be retried at all.
+ */
+const CODEX_RESET_FIELDS = ['resets_in_seconds', 'reset_after_seconds', 'resets_at', 'reset_at'];
+/**
+ * Reads the reset instant of the Codex window that rejected a request.
+ *
+ * Body only. The `x-codex-{primary,secondary}-reset-after-seconds` headers are
+ * rollover snapshots the backend attaches to every response, one per window,
+ * so they say nothing about which window refused: a burst 429 that would clear
+ * in seconds still carries a primary rollover hours out, and reading it would
+ * park the turn for those hours. They reach the operator through
+ * `rateLimitDiagnostics` instead.
+ */
+export const codexRateLimitReset = (_response, body, now) => resetFromFields(jsonBody(body), CODEX_RESET_FIELDS, now);
 /** Default instruction when the request carries no system prompt. */
 const DEFAULT_CODEX_INSTRUCTIONS = 'You are Codex, a coding agent based on GPT-5. '
     + 'Help the user with their software engineering tasks.';
@@ -291,10 +310,6 @@ export const CODEX_MODELS_URL = 'https://chatgpt.com/backend-api/codex/models';
  * the range of current codex CLI releases.
  */
 export const CODEX_CLIENT_VERSION = '0.147.0';
-/** Display name for a wire reasoning-effort value. */
-function effortName(effort) {
-    return effort === 'xhigh' ? 'Extra High' : effort.charAt(0).toUpperCase() + effort.slice(1);
-}
 /**
  * Whether a catalog entry advertises the fast tier. Mirrors codex-rs
  * `ModelPreset::supports_fast_mode`: a `service_tiers` id matching the fast
@@ -308,9 +323,10 @@ function supportsFastTier(entry) {
  * Fetch the live codex model catalog with the session's auth headers.
  * @param session - the stored session (used as-is; never refreshed here).
  * @param fetchFn - fetch implementation (injectable for tests).
+ * @param signal - caller cancellation (pool-assembly timeout).
  * @returns discovered models: hidden entries dropped, sorted by priority.
  */
-export async function fetchCodexModels(session, fetchFn = proxiedFetch) {
+export async function fetchCodexModels(session, fetchFn = proxiedFetch, signal) {
     const url = `${CODEX_MODELS_URL}?client_version=${CODEX_CLIENT_VERSION}`;
     const response = await fetchFn(url, {
         headers: {
@@ -320,6 +336,7 @@ export async function fetchCodexModels(session, fetchFn = proxiedFetch) {
             'accept': 'application/json',
             ...attributionHeaders(),
         },
+        ...signal === undefined ? {} : { signal },
     });
     if (!response.ok)
         throw await oauthEndpointError(response, 'codex models');
@@ -338,7 +355,7 @@ export async function fetchCodexModels(session, fetchFn = proxiedFetch) {
             .filter(level => typeof level.effort === 'string' && level.effort.length > 0)
             .map(level => ({
             id: ReasoningEffortId(level.effort),
-            name: effortName(level.effort),
+            name: effortDisplayName(level.effort),
             ...level.description === undefined ? {} : { description: level.description },
         }));
         const defaultEffort = typeof entry.default_reasoning_level === 'string'
@@ -451,18 +468,54 @@ export function codexRequestBody(options, resolved, fast) {
 export class CodexAdapter extends LlmAdapter {
     options;
     catalog;
+    /** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+    accountCatalogs = new Map();
+    /** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+    catalogOwner;
     constructor(options) {
         super();
         this.options = options;
         this.catalog = new ModelCatalogCache(options.catalogStore);
     }
     /** Discovery fetcher: resolves the session through the refresh-aware path. */
-    async fetchCatalog() {
-        return fetchCodexModels(await this.options.tokens.session(), this.options.fetchFn);
+    async fetchCatalog(account, signal) {
+        return fetchCodexModels(await this.options.tokens.session(account), this.options.fetchFn, signal);
+    }
+    /** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+    clearAccountCatalog(account) {
+        if (account === undefined)
+            this.accountCatalogs.clear();
+        else
+            this.accountCatalogs.delete(account);
+        if (account === undefined || this.catalogOwner === account || this.catalogOwner === undefined) {
+            this.catalogOwner = undefined;
+            this.catalog.invalidate();
+        }
+    }
+    /** Persisted cache for the default account; a throwaway cache for any other. */
+    async catalogFor(account) {
+        const defaultKey = await this.options.tokens.defaultAccount();
+        const key = account ?? defaultKey;
+        if (key === undefined || key === defaultKey) {
+            if (this.catalogOwner !== undefined && this.catalogOwner !== defaultKey) {
+                this.catalog.invalidate();
+            }
+            this.catalogOwner = defaultKey;
+            return this.catalog;
+        }
+        let cache = this.accountCatalogs.get(key);
+        if (cache === undefined) {
+            cache = new ModelCatalogCache();
+            this.accountCatalogs.set(key, cache);
+        }
+        return cache;
     }
     providerInfo(provider) {
         return { id: provider, name: 'ChatGPT (Codex)' };
     }
+    providerRetryPolicy(provider) {
+        return subscriptionRetryPolicy(DEFAULT_RETRY, this.options.rateLimit ?? DEFAULT_RATE_LIMIT_WAIT, `codex: provider "${provider}" retryPolicy`);
+    }
     staticModels(provider) {
         return this.options.models.map(model => ({
             provider,
@@ -472,26 +525,48 @@ export class CodexAdapter extends LlmAdapter {
         }));
     }
     async listModels(provider) {
-        // Not logged in → empty catalog, so the web picker drops the provider.
-        const session = await this.options.tokens.peek();
-        if (session === undefined)
+        const own = await this.listOwnModels(provider);
+        const pool = this.options.pool?.();
+        if (pool === undefined)
+            return own;
+        const extra = await pool.modelsForProvider(provider);
+        const seen = new Set(own.map(model => model.id));
+        // Account pools reuse the catalog row; only configured tiers are extra.
+        return [...own, ...extra.filter(model => !seen.has(model.id))];
+    }
+    /** The provider's own catalog: union of every account, or one account when named. */
+    async listOwnModels(provider, account, signal) {
+        if (account === undefined) {
+            const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+            if (accounts.length === 0)
+                return [];
+            return unionAccountCatalogs(accounts, (key, accountSignal) => this.listOwnModels(provider, key, accountSignal), { timeoutMs: this.options.discoveryTimeoutMs ?? DISCOVERY_TIMEOUT_MS, ...signal === undefined ? {} : { signal } });
+        }
+        if (!await this.options.tokens.hasSession(account)) {
             return [];
+        }
         if (!this.options.discovery)
             return this.staticModels(provider);
+        const catalog = await this.catalogFor(account);
         try {
             // The fetcher runs only on a cache miss, and resolves the session
             // through the refresh-aware path so an expired access token renews here
             // instead of failing discovery into the static fallback.
-            const discovered = await discoverOrRetryAuth(force => this.options.tokens.session(force), this.catalog, () => this.catalog.get(() => this.fetchCatalog()));
+            const discovered = await discoverOrRetryAuth(force => this.options.tokens.session(account, force), catalog, () => catalog.get(() => this.fetchCatalog(account, signal)));
             return discovered.map(model => ({
                 provider,
                 id: model.id,
                 name: model.name,
                 ...model.description === undefined ? {} : { description: model.description },
                 inputModalities: CODEX_MODALITIES,
+                ...model.priority === undefined ? {} : { priority: model.priority },
             }));
         }
         catch (error) {
+            // A cancelled discovery must not fall back to the static catalog — the
+            // caller (pool assembly) treats abort as "this account sits out".
+            if (isDiscoveryAborted(error, signal))
+                throw error;
             // A permanent refresh failure deletes the stored session: the provider
             // is logged out, so hide it instead of showing a stale static catalog.
             if (isMissingOrInvalidCredential(error))
@@ -510,8 +585,12 @@ export class CodexAdapter extends LlmAdapter {
     async discovered(model) {
         if (!this.options.discovery)
             return undefined;
-        const models = await this.catalog.resolve(() => this.fetchCatalog());
-        return models?.find(entry => entry.id === model);
+        const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+        return discoverAcrossAccounts(accounts, async (account) => {
+            const catalog = await this.catalogFor(account);
+            const models = await catalog.resolve(() => this.fetchCatalog(account));
+            return models?.find(entry => entry.id === model);
+        });
     }
     /** Whether the discovered catalog advertises a fast tier for this model. */
     async supportsFastTier(model) {
@@ -522,18 +601,49 @@ export class CodexAdapter extends LlmAdapter {
         if (!this.options.discovery)
             return [];
         // Not logged in → no fast models, so the Speed toggle hides after logout
-        // (mirrors the listModels guard above).
-        const session = await this.options.tokens.peek();
-        if (session === undefined)
+        // (mirrors the listModels guard above). Union every account: a fast-capable
+        // model only the non-default lists (e.g. gpt-5.6-sol) must still show Speed.
+        const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+        if (accounts.length === 0)
             return [];
-        const models = await this.catalog.resolve(() => this.fetchCatalog());
-        return (models ?? []).filter(model => model.fastTier === true).map(model => model.id);
+        const seen = new Set();
+        const ids = [];
+        for (const account of accounts) {
+            try {
+                const catalog = await this.catalogFor(account);
+                const models = await catalog.resolve(() => this.fetchCatalog(account));
+                for (const model of models ?? []) {
+                    if (model.fastTier !== true || seen.has(model.id))
+                        continue;
+                    seen.add(model.id);
+                    ids.push(model.id);
+                }
+            }
+            catch {
+                // sit out
+            }
+        }
+        return ids;
     }
     async resolveModel(provider, model) {
+        const pool = this.options.pool?.();
+        if (pool !== undefined && await pool.owns(provider, model)) {
+            return pool.resolveModel(provider, model);
+        }
+        return this.resolveOwnModel(provider, model);
+    }
+    /** Capability resolution of the provider's own models (the pool resolves members here). */
+    async resolveOwnModel(provider, model) {
         // Discovered metadata (when discovery is on) wins over the static entry;
-        // the static entry wins over the built-in defaults.
+        // the static entry wins over the built-in defaults. A configured default
+        // effort merges over both.
         const discovered = await this.discovered(model);
         const configured = this.options.models.find(entry => entry.id === model);
+        // `extendable` only while falling back to the built-in list: that one is
+        // known to trail the backend, so a configured level it omits still has to
+        // be selectable. A discovered catalog is the truth about what the model
+        // accepts, and a stale override must not be forced onto every request.
+        const reasoning = mergeReasoning(this.options.defaultEffortOf?.(model), discovered?.reasoning ?? { efforts: CODEX_EFFORTS, defaultEffort: CODEX_DEFAULT_EFFORT }, { extendable: discovered?.reasoning === undefined });
         return {
             provider,
             id: model,
@@ -542,21 +652,37 @@ export class CodexAdapter extends LlmAdapter {
             inputModalities: configured?.inputModalities ?? CODEX_MODALITIES,
             context: { contextWindow: discovered?.contextWindow ?? configured?.contextWindow ?? CODEX_CONTEXT_WINDOW },
             defaultMaxTokens: configured?.maxTokens ?? CODEX_DEFAULT_MAX_TOKENS,
-            reasoning: discovered?.reasoning ?? { efforts: CODEX_EFFORTS, defaultEffort: CODEX_DEFAULT_EFFORT },
+            ...(reasoning === undefined ? {} : { reasoning }),
         };
     }
     async *stream(options) {
+        const pool = this.options.pool?.();
+        if (pool !== undefined && await pool.owns(options.provider, options.model)) {
+            yield* pool.stream(options);
+            return;
+        }
+        yield* this.streamCore(options);
+    }
+    /** Pool seam: stream through one specific account instead of the default. */
+    streamAccount(options, account) {
+        return this.streamCore(options, account);
+    }
+    async *streamCore(options, account) {
         const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
         try {
-            let session = await this.options.tokens.session();
+            let session = await this.options.tokens.session(account);
             let response = await this.request(options, session, watchdog.signal);
             if (response.status === 401) {
                 // One forced refresh + retry on an unexpired-but-rejected token.
-                session = await this.options.tokens.session(true);
+                session = await this.options.tokens.session(account, true);
                 response = await this.request(options, session, watchdog.signal);
             }
-            if (!response.ok)
-                throw await httpLlmError(response, 'codex API');
+            if (!response.ok) {
+                throw await httpLlmError(response, 'codex API', {
+                    rateLimitReset: codexRateLimitReset,
+                    ...this.options.onWarn === undefined ? {} : { onWarn: this.options.onWarn },
+                });
+            }
             if (response.body === null) {
                 throw new LlmError('codex API returned no response body', EMPTY_RESPONSE_CODE);
             }