dsh-plugin-subscriptions 0.5.2 → 0.6.0

package/lib/providers/copilot.js

@@ -17,8 +17,10 @@ import { EMPTY_RESPONSE_CODE, errorChain, LlmAdapter, LlmError, ReasoningEffortI
 import { resolveImages } from '../translate/resolved.js';
 import { streamChatCompletions, toChatMessages, toChatTools, } from '../translate/chat-completions.js';
 import { streamResponses, toResponsesInput, toResponsesTools } from '../translate/responses.js';
-import { httpLlmError, idleWatchdog, mapFetchFailure, ModelCatalogCache, discoverOrRetryAuth, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, TokenManager, } from './common.js';
+import { httpLlmError, idleWatchdog, mapFetchFailure, mergeReasoning, ModelCatalogCache, discoverAcrossAccounts, discoverOrRetryAuth, isDiscoveryAborted, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, } from './common.js';
+import { AccountTokenManager, DISCOVERY_TIMEOUT_MS, unionAccountCatalogs } from './accounts.js';
 import { proxiedFetch } from '../http.js';
+import { DEFAULT_RATE_LIMIT_WAIT, DEFAULT_RETRY, subscriptionRetryPolicy, } from './rate-limit.js';
 /**
  * Client id of the VS Code Copilot Chat GitHub App (pi-mono and
  * copilot2api-go use the same value): the app is pre-authorized for the
@@ -243,15 +245,17 @@ function copilotReasoning(entry) {
  * reasoning efforts (the endpoint discloses no default, so none is claimed).
  * @param session - the stored session (used as-is; never refreshed here).
  * @param fetchFn - fetch implementation (injectable for tests).
+ * @param signal - caller cancellation (pool-assembly timeout).
  * @returns discovered chat models in endpoint order.
  */
-export async function fetchCopilotModels(session, fetchFn = proxiedFetch) {
+export async function fetchCopilotModels(session, fetchFn = proxiedFetch, signal) {
     const response = await fetchFn(COPILOT_MODELS_URL, {
         headers: {
             'authorization': `Bearer ${session.accessToken}`,
             'accept': 'application/json',
             ...copilotHeaders(false, await latestVsCodeVersion(fetchFn)),
         },
+        ...signal === undefined ? {} : { signal },
     });
     if (!response.ok)
         throw await oauthEndpointError(response, 'copilot models');
@@ -510,6 +514,10 @@ export class CopilotResponsesItemNormalizer {
 export class CopilotAdapter extends LlmAdapter {
     options;
     catalog;
+    /** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+    accountCatalogs = new Map();
+    /** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+    catalogOwner;
     /**
      * [2026-08-23]-[a reasoning model continuing a tool chain must get its
      * reasoning back or it restarts from scratch every tool round trip; the
@@ -532,12 +540,44 @@ export class CopilotAdapter extends LlmAdapter {
         this.catalog = new ModelCatalogCache(options.catalogStore);
     }
     /** Discovery fetcher: resolves the session through the refresh-aware path. */
-    async fetchCatalog() {
-        return fetchCopilotModels(await this.options.tokens.session(), this.options.fetchFn);
+    async fetchCatalog(account, signal) {
+        return fetchCopilotModels(await this.options.tokens.session(account), this.options.fetchFn, signal);
+    }
+    /** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+    clearAccountCatalog(account) {
+        if (account === undefined)
+            this.accountCatalogs.clear();
+        else
+            this.accountCatalogs.delete(account);
+        if (account === undefined || this.catalogOwner === account || this.catalogOwner === undefined) {
+            this.catalogOwner = undefined;
+            this.catalog.invalidate();
+        }
+    }
+    /** Persisted cache for the default account; a throwaway cache for any other. */
+    async catalogFor(account) {
+        const defaultKey = await this.options.tokens.defaultAccount();
+        const key = account ?? defaultKey;
+        if (key === undefined || key === defaultKey) {
+            if (this.catalogOwner !== undefined && this.catalogOwner !== defaultKey) {
+                this.catalog.invalidate();
+            }
+            this.catalogOwner = defaultKey;
+            return this.catalog;
+        }
+        let cache = this.accountCatalogs.get(key);
+        if (cache === undefined) {
+            cache = new ModelCatalogCache();
+            this.accountCatalogs.set(key, cache);
+        }
+        return cache;
     }
     providerInfo(provider) {
         return { id: provider, name: 'GitHub Copilot' };
     }
+    providerRetryPolicy(provider) {
+        return subscriptionRetryPolicy(DEFAULT_RETRY, this.options.rateLimit ?? DEFAULT_RATE_LIMIT_WAIT, `copilot: provider "${provider}" retryPolicy`);
+    }
     staticModels(provider) {
         return this.options.models.map(model => ({
             provider,
@@ -547,17 +587,34 @@ export class CopilotAdapter extends LlmAdapter {
         }));
     }
     async listModels(provider) {
-        // Not logged in → empty catalog, so the web picker drops the provider.
-        const session = await this.options.tokens.peek();
-        if (session === undefined)
+        const own = await this.listOwnModels(provider);
+        const pool = this.options.pool?.();
+        if (pool === undefined)
+            return own;
+        const extra = await pool.modelsForProvider(provider);
+        const seen = new Set(own.map(model => model.id));
+        // Account pools reuse the catalog row; only configured tiers are extra.
+        return [...own, ...extra.filter(model => !seen.has(model.id))];
+    }
+    /** The provider's own catalog: union of every account, or one account when named. */
+    async listOwnModels(provider, account, signal) {
+        if (account === undefined) {
+            const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+            if (accounts.length === 0)
+                return [];
+            return unionAccountCatalogs(accounts, (key, accountSignal) => this.listOwnModels(provider, key, accountSignal), { timeoutMs: DISCOVERY_TIMEOUT_MS, ...signal === undefined ? {} : { signal } });
+        }
+        if (!await this.options.tokens.hasSession(account)) {
             return [];
+        }
         if (!this.options.discovery)
             return this.staticModels(provider);
+        const catalog = await this.catalogFor(account);
         try {
             // The fetcher runs only on a cache miss, and resolves the session
             // through the refresh-aware path so an expired access token renews here
             // instead of failing discovery into the static fallback.
-            const discovered = await discoverOrRetryAuth(force => this.options.tokens.session(force), this.catalog, () => this.catalog.get(() => this.fetchCatalog()));
+            const discovered = await discoverOrRetryAuth(force => this.options.tokens.session(account, force), catalog, () => catalog.get(() => this.fetchCatalog(account, signal)));
             return discovered.map(model => ({
                 provider,
                 id: model.id,
@@ -567,6 +624,8 @@ export class CopilotAdapter extends LlmAdapter {
             }));
         }
         catch (error) {
+            if (isDiscoveryAborted(error, signal))
+                throw error;
             // A permanent refresh failure deletes the stored session: the provider
             // is logged out, so hide it instead of showing a stale static catalog.
             if (isMissingOrInvalidCredential(error))
@@ -584,8 +643,12 @@ export class CopilotAdapter extends LlmAdapter {
     async discovered(model) {
         if (!this.options.discovery)
             return undefined;
-        const models = await this.catalog.resolve(() => this.fetchCatalog());
-        return models?.find(entry => entry.id === model);
+        const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+        return discoverAcrossAccounts(accounts, async (account) => {
+            const catalog = await this.catalogFor(account);
+            const models = await catalog.resolve(() => this.fetchCatalog(account));
+            return models?.find(entry => entry.id === model);
+        });
     }
     /**
      * [2026-08-23]-[a manually configured responses-only model combined with
@@ -699,8 +762,23 @@ export class CopilotAdapter extends LlmAdapter {
         this.replayByScope.clear();
     }
     async resolveModel(provider, model) {
+        const pool = this.options.pool?.();
+        if (pool !== undefined && await pool.owns(provider, model)) {
+            return pool.resolveModel(provider, model);
+        }
+        return this.resolveOwnModel(provider, model);
+    }
+    /** Capability resolution of the provider's own models (the pool resolves members here). */
+    async resolveOwnModel(provider, model) {
         const discovered = await this.discovered(model);
         const configured = this.options.models.find(entry => entry.id === model);
+        // Efforts come from the discovered catalog's reasoning_effort array; a
+        // model that did not advertise one exposes none, so the harness rejects
+        // an explicit effort before provider I/O instead of the API 400ing
+        // (Copilot returns invalid_request_body for models that cannot reason).
+        // A configured default effort still merges in: the picker then
+        // preselects it even for models the catalog does not cover.
+        const reasoning = mergeReasoning(this.options.defaultEffortOf?.(model), discovered?.reasoning);
         return {
             provider,
             id: model,
@@ -709,14 +787,22 @@ export class CopilotAdapter extends LlmAdapter {
             inputModalities: discovered?.inputModalities ?? configured?.inputModalities ?? ['text'],
             context: { contextWindow: discovered?.contextWindow ?? configured?.contextWindow ?? COPILOT_CONTEXT_WINDOW },
             defaultMaxTokens: configured?.maxTokens ?? COPILOT_DEFAULT_MAX_TOKENS,
-            // Efforts come from the discovered catalog's reasoning_effort array; a
-            // model that did not advertise one exposes none, so the harness rejects
-            // an explicit effort before provider I/O instead of the API 400ing
-            // (Copilot returns invalid_request_body for models that cannot reason).
-            ...discovered?.reasoning === undefined ? {} : { reasoning: discovered.reasoning },
+            ...reasoning === undefined ? {} : { reasoning },
         };
     }
     async *stream(options) {
+        const pool = this.options.pool?.();
+        if (pool !== undefined && await pool.owns(options.provider, options.model)) {
+            yield* pool.stream(options);
+            return;
+        }
+        yield* this.streamCore(options);
+    }
+    /** Pool seam: stream through one specific account instead of the default. */
+    streamAccount(options, account) {
+        return this.streamCore(options, account);
+    }
+    async *streamCore(options, account) {
         const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
         try {
             // The discovered catalog decides the protocol: `/responses`-only model
@@ -725,7 +811,7 @@ export class CopilotAdapter extends LlmAdapter {
             // tools with a reasoning effort (gpt-5.4 400s on the chat wire then).
             // A configured `wire` outranks the catalog (see configuredWireEntry).
             const wire = copilotRequestWire(this.configuredWireEntry(options.model) ?? await this.discovered(options.model), options);
-            let session = await this.options.tokens.session();
+            let session = await this.options.tokens.session(account);
             // Replay scope: account identity × conversation × model (see
             // replayScope); a Copilot-token refresh preserves the GitHub token, so
             // the 401 retry below reuses it too.
@@ -737,11 +823,17 @@ export class CopilotAdapter extends LlmAdapter {
                 // means GitHub raised its minimum VS Code version, and only a fresh
                 // Editor-Version header fixes that (a new token does not).
                 await latestVsCodeVersion(this.options.fetchFn ?? proxiedFetch, true);
-                session = await this.options.tokens.session(true);
+                session = await this.options.tokens.session(account, true);
                 response = await this.request(options, session, watchdog.signal, wire, scope);
             }
-            if (!response.ok)
-                throw await httpLlmError(response, 'copilot API');
+            if (!response.ok) {
+                throw await httpLlmError(response, 'copilot API', {
+                    // Copilot has no provider-specific reset reader yet. The shared
+                    // mapper still honors its generic retry-after header and warns with
+                    // rate-limit-shaped headers/body when GitHub sends another signal.
+                    ...this.options.onWarn === undefined ? {} : { onWarn: this.options.onWarn },
+                });
+            }
             if (response.body === null) {
                 throw new LlmError('copilot API returned no response body', EMPTY_RESPONSE_CODE);
             }

package/lib/providers/grok.d.ts

@@ -7,14 +7,27 @@ import { LlmAdapter } from '@deepseek-ai/dsh-llm';
 import type { GenerateOptions, LlmModelInfo, LlmProviderInfo, LlmResolvedModelInfo, StreamChunk } from '@deepseek-ai/dsh-llm';
 import type { FlowSpec } from '../auth/oauth-flow.js';
 import type { GrokSession } from '../auth/store.js';
+import type { PoolAdapter } from './pool.js';
 import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
-import { TokenManager } from './common.js';
+import { AccountTokenManager } from './accounts.js';
 import type { CatalogPersistence, DiscoveredModel, FetchFn, ModelEntry, ProviderUsage } from './common.js';
+import type { RateLimitResetReader, RateLimitWait } from './rate-limit.js';
 export declare const GROK_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
 export declare const GROK_DISCOVERY_URL = "https://auth.x.ai/.well-known/openid-configuration";
 export declare const GROK_API_URL = "https://api.x.ai/v1/responses";
 /** Refresh when the access token has less than this much life left. */
 export declare const GROK_PREEMPT_MS: number;
+/**
+ * Reads the reset instant of the xAI window that rejected a request.
+ *
+ * Body only. xAI serves the OpenAI-compatible `x-ratelimit-reset-*` family,
+ * whose values are rollover durations (`6m0s`) present on every response, one
+ * per bucket — on a 429 the earliest of them is usually a bucket with room
+ * (`0s` for the request bucket while the token bucket is the one exhausted),
+ * which would burn the whole retry budget in seconds. They reach the operator
+ * through `rateLimitDiagnostics` instead.
+ */
+export declare const grokRateLimitReset: RateLimitResetReader;
 /** Discovered OIDC endpoints for the xAI authorization server. */
 export interface GrokDiscovery {
     authorizationEndpoint: string;
@@ -93,9 +106,10 @@ type GrokCliModelMeta = Partial<Pick<DiscoveredModel, 'name' | 'description' | '
  * Fetch the CLI catalog and index its per-model metadata by model id.
  * @param session - the stored session (used as-is; never refreshed here).
  * @param fetchFn - fetch implementation (injectable for tests).
+ * @param signal - caller cancellation (pool-assembly timeout).
  * @returns model id → contributed metadata.
  */
-export declare function fetchGrokCliCatalog(session: GrokSession, fetchFn?: FetchFn): Promise<Map<string, GrokCliModelMeta>>;
+export declare function fetchGrokCliCatalog(session: GrokSession, fetchFn?: FetchFn, signal?: AbortSignal): Promise<Map<string, GrokCliModelMeta>>;
 /**
  * Fetch the live grok model list, enriched with the CLI catalog's per-model
  * metadata (display name, context window, reasoning efforts). The api.x.ai
@@ -109,14 +123,17 @@ export declare function fetchGrokCliCatalog(session: GrokSession, fetchFn?: Fetc
  * @param onWarn - warning sink for a failed CLI catalog fetch.
  * @param previous - last-known catalog used to keep enrichment when the CLI
  *   catalog is down or omits a model.
+ * @param signal - caller cancellation (pool-assembly timeout).
  * @returns discovered chat models in endpoint order.
  */
-export declare function fetchGrokModels(session: GrokSession, fetchFn?: FetchFn, onWarn?: (message: string) => void, previous?: readonly DiscoveredModel[]): Promise<DiscoveredModel[]>;
+export declare function fetchGrokModels(session: GrokSession, fetchFn?: FetchFn, onWarn?: (message: string) => void, previous?: readonly DiscoveredModel[], signal?: AbortSignal): Promise<DiscoveredModel[]>;
 /** Constructor dependencies for {@link GrokAdapter}. */
 export interface GrokAdapterOptions {
     models: readonly ModelEntry[];
     streamIdleTimeoutMs: number;
-    tokens: TokenManager<GrokSession>;
+    tokens: AccountTokenManager<GrokSession>;
+    /** Late-bound pool facade (wired after adapter construction); pools list under their first member's provider. */
+    pool?: () => PoolAdapter | undefined;
     /** Whether to fetch the live catalog when logged in (false when config `models` overrides). */
     discovery: boolean;
     /** Warning sink for discovery failures that fall back to the static catalog. */
@@ -127,18 +144,37 @@ export interface GrokAdapterOptions {
     resolveAttachments?: () => AttachmentStore | undefined;
     /** Durable catalog store seeding capability metadata across restarts. */
     catalogStore?: CatalogPersistence;
+    /**
+     * Per-model default reasoning effort override (the Settings page's picker).
+     * Returns the user-configured default for one model, or undefined to follow
+     * the provider's own default.
+     */
+    defaultEffortOf?: (model: string) => string | undefined;
+    /** How long this route may hold a turn open waiting for a rate-limit window; defaults to waiting on, six-hour ceiling. */
+    rateLimit?: RateLimitWait;
 }
 /** Grok wire adapter: one instance serves the `grok` provider route. */
 export declare class GrokAdapter extends LlmAdapter {
     private readonly options;
     private readonly catalog;
+    /** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+    private readonly accountCatalogs;
+    /** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+    private catalogOwner;
     constructor(options: GrokAdapterOptions);
     /** Discovery fetcher: resolves the session through the refresh-aware path. */
     private fetchCatalog;
+    /** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+    clearAccountCatalog(account?: string): void;
+    /** Persisted cache for the default account; a throwaway cache for any other. */
+    private catalogFor;
     private listed;
     providerInfo(provider: string): LlmProviderInfo;
+    providerRetryPolicy(provider: string): import("@deepseek-ai/dsh-llm").ResolvedRetryPolicy;
     private staticModels;
     listModels(provider: string): Promise<readonly LlmModelInfo[]>;
+    /** The provider's own catalog: union of every account, or one account when named. */
+    listOwnModels(provider: string, account?: string, signal?: AbortSignal): Promise<readonly LlmModelInfo[]>;
     /**
      * The discovered entry for one model. Resolved through the cache's
      * stale-while-revalidate path: capability metadata must stay stable across
@@ -149,7 +185,12 @@ export declare class GrokAdapter extends LlmAdapter {
      */
     private discovered;
     resolveModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
+    /** Capability resolution of the provider's own models (the pool resolves members here). */
+    resolveOwnModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
     stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+    /** Pool seam: stream through one specific account instead of the default. */
+    streamAccount(options: GenerateOptions, account: string): AsyncIterable<StreamChunk>;
+    private streamCore;
     private request;
 }
 export {};

package/lib/providers/grok.js

@@ -7,8 +7,10 @@ import { attributionHeaders, EMPTY_RESPONSE_CODE, errorChain, LlmAdapter, LlmErr
 import { decodeJwtPayload } from '../auth/jwt.js';
 import { resolveImages } from '../translate/resolved.js';
 import { streamResponses, toResponsesInput, toResponsesTools } from '../translate/responses.js';
-import { httpLlmError, idleWatchdog, mapFetchFailure, ModelCatalogCache, discoverOrRetryAuth, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, TokenManager, } from './common.js';
+import { httpLlmError, idleWatchdog, mapFetchFailure, mergeReasoning, ModelCatalogCache, discoverAcrossAccounts, discoverOrRetryAuth, isDiscoveryAborted, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, } from './common.js';
+import { AccountTokenManager, DISCOVERY_TIMEOUT_MS, unionAccountCatalogs } from './accounts.js';
 import { proxiedFetch } from '../http.js';
+import { DEFAULT_RATE_LIMIT_WAIT, DEFAULT_RETRY, jsonBody, resetFromFields, subscriptionRetryPolicy, } from './rate-limit.js';
 export const GROK_CLIENT_ID = 'b1a00492-073a-47ea-816f-4c329264a828';
 export const GROK_DISCOVERY_URL = 'https://auth.x.ai/.well-known/openid-configuration';
 export const GROK_API_URL = 'https://api.x.ai/v1/responses';
@@ -18,6 +20,19 @@ const GROK_CONTEXT_WINDOW = 256_000;
 const GROK_DEFAULT_MAX_TOKENS = 32_000;
 /** Refresh when the access token has less than this much life left. */
 export const GROK_PREEMPT_MS = 2 * 60_000;
+/** Body fields xAI uses to name a delay or reset. */
+const GROK_RESET_FIELDS = ['retry_after', 'retry_after_seconds', 'resets_at', 'reset_at'];
+/**
+ * Reads the reset instant of the xAI window that rejected a request.
+ *
+ * Body only. xAI serves the OpenAI-compatible `x-ratelimit-reset-*` family,
+ * whose values are rollover durations (`6m0s`) present on every response, one
+ * per bucket — on a 429 the earliest of them is usually a bucket with room
+ * (`0s` for the request bucket while the token bucket is the one exhausted),
+ * which would burn the whole retry budget in seconds. They reach the operator
+ * through `rateLimitDiagnostics` instead.
+ */
+export const grokRateLimitReset = (_response, body, now) => resetFromFields(jsonBody(body), GROK_RESET_FIELDS, now);
 /** A discovered URL must be https on x.ai or a subdomain; anything else is a hostile document. */
 function assertXaiEndpoint(url, field) {
     let parsed;
@@ -312,9 +327,10 @@ function grokCliReasoning(entry) {
  * Fetch the CLI catalog and index its per-model metadata by model id.
  * @param session - the stored session (used as-is; never refreshed here).
  * @param fetchFn - fetch implementation (injectable for tests).
+ * @param signal - caller cancellation (pool-assembly timeout).
  * @returns model id → contributed metadata.
  */
-export async function fetchGrokCliCatalog(session, fetchFn = proxiedFetch) {
+export async function fetchGrokCliCatalog(session, fetchFn = proxiedFetch, signal) {
     const response = await fetchFn(GROK_CLI_MODELS_URL, {
         headers: {
             'authorization': `Bearer ${session.accessToken}`,
@@ -323,6 +339,7 @@ export async function fetchGrokCliCatalog(session, fetchFn = proxiedFetch) {
             'accept': 'application/json',
             ...attributionHeaders(),
         },
+        ...signal === undefined ? {} : { signal },
     });
     if (!response.ok)
         throw await oauthEndpointError(response, 'grok CLI catalog');
@@ -384,9 +401,10 @@ function grokPriorMeta(prior) {
  * @param onWarn - warning sink for a failed CLI catalog fetch.
  * @param previous - last-known catalog used to keep enrichment when the CLI
  *   catalog is down or omits a model.
+ * @param signal - caller cancellation (pool-assembly timeout).
  * @returns discovered chat models in endpoint order.
  */
-export async function fetchGrokModels(session, fetchFn = proxiedFetch, onWarn, previous) {
+export async function fetchGrokModels(session, fetchFn = proxiedFetch, onWarn, previous, signal) {
     const previousById = previous === undefined || previous.length === 0
         ? undefined
         : new Map(previous.map(model => [model.id, model]));
@@ -397,8 +415,11 @@ export async function fetchGrokModels(session, fetchFn = proxiedFetch, onWarn, p
                 'accept': 'application/json',
                 ...attributionHeaders(),
             },
+            ...signal === undefined ? {} : { signal },
         }),
-        fetchGrokCliCatalog(session, fetchFn).catch((error) => {
+        fetchGrokCliCatalog(session, fetchFn, signal).catch((error) => {
+            if (isDiscoveryAborted(error, signal))
+                throw error;
             onWarn?.(previousById === undefined
                 ? `grok CLI catalog fetch failed; reasoning efforts are unavailable (${errorChain(error)})`
                 : `grok CLI catalog fetch failed; keeping last-known reasoning efforts (${errorChain(error)})`);
@@ -436,14 +457,50 @@ export async function fetchGrokModels(session, fetchFn = proxiedFetch, onWarn, p
 export class GrokAdapter extends LlmAdapter {
     options;
     catalog;
+    /** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+    accountCatalogs = new Map();
+    /** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+    catalogOwner;
     constructor(options) {
         super();
         this.options = options;
         this.catalog = new ModelCatalogCache(options.catalogStore);
     }
     /** Discovery fetcher: resolves the session through the refresh-aware path. */
-    async fetchCatalog() {
-        return fetchGrokModels(await this.options.tokens.session(), this.options.fetchFn, this.options.onWarn, this.catalog.lastKnown());
+    async fetchCatalog(account, signal) {
+        const lastKnown = account === undefined || account === await this.options.tokens.defaultAccount()
+            ? this.catalog.lastKnown()
+            : this.accountCatalogs.get(account)?.lastKnown();
+        return fetchGrokModels(await this.options.tokens.session(account), this.options.fetchFn, this.options.onWarn, lastKnown, signal);
+    }
+    /** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+    clearAccountCatalog(account) {
+        if (account === undefined)
+            this.accountCatalogs.clear();
+        else
+            this.accountCatalogs.delete(account);
+        if (account === undefined || this.catalogOwner === account || this.catalogOwner === undefined) {
+            this.catalogOwner = undefined;
+            this.catalog.invalidate();
+        }
+    }
+    /** Persisted cache for the default account; a throwaway cache for any other. */
+    async catalogFor(account) {
+        const defaultKey = await this.options.tokens.defaultAccount();
+        const key = account ?? defaultKey;
+        if (key === undefined || key === defaultKey) {
+            if (this.catalogOwner !== undefined && this.catalogOwner !== defaultKey) {
+                this.catalog.invalidate();
+            }
+            this.catalogOwner = defaultKey;
+            return this.catalog;
+        }
+        let cache = this.accountCatalogs.get(key);
+        if (cache === undefined) {
+            cache = new ModelCatalogCache();
+            this.accountCatalogs.set(key, cache);
+        }
+        return cache;
     }
     listed(provider, discovered) {
         return discovered.map(model => ({
@@ -457,6 +514,9 @@ export class GrokAdapter extends LlmAdapter {
     providerInfo(provider) {
         return { id: provider, name: 'Grok (Subscription)' };
     }
+    providerRetryPolicy(provider) {
+        return subscriptionRetryPolicy(DEFAULT_RETRY, this.options.rateLimit ?? DEFAULT_RATE_LIMIT_WAIT, `grok: provider "${provider}" retryPolicy`);
+    }
     staticModels(provider) {
         return this.options.models.map(model => ({
             provider,
@@ -466,19 +526,38 @@ export class GrokAdapter extends LlmAdapter {
         }));
     }
     async listModels(provider) {
-        // Not logged in → empty catalog, so the web picker drops the provider.
-        const session = await this.options.tokens.peek();
-        if (session === undefined)
+        const own = await this.listOwnModels(provider);
+        const pool = this.options.pool?.();
+        if (pool === undefined)
+            return own;
+        const extra = await pool.modelsForProvider(provider);
+        const seen = new Set(own.map(model => model.id));
+        // Account pools reuse the catalog row; only configured tiers are extra.
+        return [...own, ...extra.filter(model => !seen.has(model.id))];
+    }
+    /** The provider's own catalog: union of every account, or one account when named. */
+    async listOwnModels(provider, account, signal) {
+        if (account === undefined) {
+            const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+            if (accounts.length === 0)
+                return [];
+            return unionAccountCatalogs(accounts, (key, accountSignal) => this.listOwnModels(provider, key, accountSignal), { timeoutMs: DISCOVERY_TIMEOUT_MS, ...signal === undefined ? {} : { signal } });
+        }
+        if (!await this.options.tokens.hasSession(account)) {
             return [];
+        }
         if (!this.options.discovery)
             return this.staticModels(provider);
+        const catalog = await this.catalogFor(account);
         try {
             // The fetcher runs only on a cache miss, and resolves the session
             // through the refresh-aware path so an expired access token renews here
             // instead of failing discovery into the static fallback.
-            return this.listed(provider, await discoverOrRetryAuth(force => this.options.tokens.session(force), this.catalog, () => this.catalog.get(() => this.fetchCatalog())));
+            return this.listed(provider, await discoverOrRetryAuth(force => this.options.tokens.session(account, force), catalog, () => catalog.get(() => this.fetchCatalog(account, signal))));
         }
         catch (error) {
+            if (isDiscoveryAborted(error, signal))
+                throw error;
             // A permanent refresh failure deletes the stored session: the provider
             // is logged out, so hide it instead of showing a stale static catalog.
             if (isMissingOrInvalidCredential(error))
@@ -498,12 +577,30 @@ export class GrokAdapter extends LlmAdapter {
     async discovered(model) {
         if (!this.options.discovery)
             return undefined;
-        const models = await this.catalog.resolve(() => this.fetchCatalog());
-        return models?.find(entry => entry.id === model);
+        const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+        return discoverAcrossAccounts(accounts, async (account) => {
+            const catalog = await this.catalogFor(account);
+            const models = await catalog.resolve(() => this.fetchCatalog(account));
+            return models?.find(entry => entry.id === model);
+        });
     }
     async resolveModel(provider, model) {
+        const pool = this.options.pool?.();
+        if (pool !== undefined && await pool.owns(provider, model)) {
+            return pool.resolveModel(provider, model);
+        }
+        return this.resolveOwnModel(provider, model);
+    }
+    /** Capability resolution of the provider's own models (the pool resolves members here). */
+    async resolveOwnModel(provider, model) {
         const discovered = await this.discovered(model);
         const configured = this.options.models.find(entry => entry.id === model);
+        // Efforts come from the discovered CLI catalog; models it does not
+        // cover expose none, so the harness rejects explicit efforts before
+        // provider I/O instead of the API 400ing. A configured default effort
+        // still merges in: the picker then preselects it even for models the
+        // CLI catalog does not cover.
+        const reasoning = mergeReasoning(this.options.defaultEffortOf?.(model), discovered?.reasoning);
         return {
             provider,
             id: model,
@@ -512,24 +609,37 @@ export class GrokAdapter extends LlmAdapter {
             inputModalities: configured?.inputModalities ?? grokModalities(model),
             context: { contextWindow: discovered?.contextWindow ?? configured?.contextWindow ?? GROK_CONTEXT_WINDOW },
             defaultMaxTokens: configured?.maxTokens ?? GROK_DEFAULT_MAX_TOKENS,
-            // Efforts come from the discovered CLI catalog; models it does not
-            // cover expose none, so the harness rejects explicit efforts before
-            // provider I/O instead of the API 400ing.
-            ...discovered?.reasoning === undefined ? {} : { reasoning: discovered.reasoning },
+            ...reasoning === undefined ? {} : { reasoning },
         };
     }
     async *stream(options) {
+        const pool = this.options.pool?.();
+        if (pool !== undefined && await pool.owns(options.provider, options.model)) {
+            yield* pool.stream(options);
+            return;
+        }
+        yield* this.streamCore(options);
+    }
+    /** Pool seam: stream through one specific account instead of the default. */
+    streamAccount(options, account) {
+        return this.streamCore(options, account);
+    }
+    async *streamCore(options, account) {
         const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
         try {
-            let session = await this.options.tokens.session();
+            let session = await this.options.tokens.session(account);
             let response = await this.request(options, session, watchdog.signal);
             if (response.status === 401) {
                 // One forced refresh + retry on an unexpired-but-rejected token.
-                session = await this.options.tokens.session(true);
+                session = await this.options.tokens.session(account, true);
                 response = await this.request(options, session, watchdog.signal);
             }
-            if (!response.ok)
-                throw await httpLlmError(response, 'grok API');
+            if (!response.ok) {
+                throw await httpLlmError(response, 'grok API', {
+                    rateLimitReset: grokRateLimitReset,
+                    ...this.options.onWarn === undefined ? {} : { onWarn: this.options.onWarn },
+                });
+            }
             if (response.body === null) {
                 throw new LlmError('grok API returned no response body', EMPTY_RESPONSE_CODE);
             }
@@ -560,6 +670,12 @@ export class GrokAdapter extends LlmAdapter {
             ...options.reasoningEffort !== undefined
                 ? { reasoning: { effort: String(options.reasoningEffort) } }
                 : {},
+            // Cache-affinity hint (mirrors codex): xAI caches prompts per server,
+            // and `prompt_cache_key` is the Responses-API signal that routes repeat
+            // requests back to the cache-holding shard — without it every turn's
+            // cache hit is shard-routing luck. The session id is the stable key
+            // xAI's own docs recommend.
+            ...options.sessionId !== undefined ? { prompt_cache_key: String(options.sessionId) } : {},
             store: false,
             stream: true,
         };