dsh-subusage 0.10.11 → 0.11.1

package/lib/index.js

@@ -11,6 +11,7 @@ import { MimoLogin } from "./mimo-login.js";
 import { parseVolcAgentPlan, parseVolcCodingPlan, parseVolcSeatAfp, parseVolcSeatCoding, parseVolcSeatIds, volcError, volcSignature } from "./volcengine.js";
 
 const name = "dsh-subusage";
+const VERSION = "0.11.1";
 const inject = ["llm"];
 const PROVIDERS = {
  "zai-coding-cn": { label: "Z.ai", envName: "ZAI_CODING_CN_API_KEY" },
@@ -41,7 +42,7 @@ const PROVIDERS = {
  // 否则选中方舟模型时药丸不会出现。额度读取走管控面 OpenAPI，凭据是 IAM 的 AK/SK 配对
  // （HMAC-SHA256 签名），与这些路由的推理 API Key 是两套：拿推理 Key 去查额度会被上游拒绝
  // （"GetAFPUsage requires Volcengine Ark SSO STS"）。
- // 7 条 volc 路由共用一组 AK/SK（settings.volc）：个人版各自固定一个 Action，
+ // 4 条 volc 路由共用一组 AK/SK（settings.volc）：个人版各自固定一个 Action，
  // 企业版/团队版走 ListSeatInfos → GetSeatAFPUsage / GetSeatInfoUsage 两步。
  // ── arkcli（官方 CLI）安装的路由 ──────────────────────────────────────────
  // 官方 CLI 的 `arkcli helper configure deepseek-harness` 把 provider 写成
@@ -87,7 +88,7 @@ const IDS = Object.keys(PROVIDERS);
 const ARK_IDS = IDS.filter(id => PROVIDERS[id].credentialKind === "volc");
 const ARK_DEFAULT_ON = ARK_IDS.some(id => PROVIDERS[id].defaultEnabled !== false);
 /**
- * 某条路由当前是否启用。Ark 以**组开关为唯一真源**——7 条路由共用一组 IAM AK/SK、一般用户只
+ * 某条路由当前是否启用。Ark 以**组开关为唯一真源**——4 条路由共用一组 IAM AK/SK、一般用户只
  * 持有一个套餐，所以设置页只给一个开关。这里必须与 Client 的 `providerEnabled` 同语义：
  * 两端口径一旦分叉，界面按组开关显示这条路由，Host 却按逐条值回 `disabled`，
  * 用户拿到的就是一张写着「检测已关闭」的空卡片（这正是 Coding Plan 查不到用量的原因）。
@@ -118,7 +119,7 @@ const PROVIDER_ALIASES = {
 function normalizeProviderKey(value) { return String(value ?? "").trim().toLowerCase().replace(/[\s._-]+/g, ""); }
 /**
  * 归一化索引：id 与别名都进同一张表，因此「精确 id」只是这张表的一个特例。
- * 一个键可以指向多条路由（`zai` → 中国版 + 国际版，`ark` → 7 条）。
+ * 一个键可以指向多条路由（`zai` → 中国版 + 国际版，`ark` → 4 条）。
  */
 const PROVIDER_LOOKUP = (() => {
 	const map = new Map();
@@ -139,7 +140,7 @@ const PROVIDER_LOOKUP = (() => {
  * 1. 认不出的原串**原样返回**而不是丢掉——调用方要能拿到「这个名字不认识，可用的是……」才能
  *    自我纠正；静默过滤只会让它以为本机没有额度。
  * 2. 一个名字命中多条路由时**全部返回**，各自带着真实状态（没启用的会如实标 disabled）。
- *    例如 `zai` 同时是中国版与国际版、`ark` 是 7 条路由：宁可多给几条数据让调用方自己判断，
+ *    例如 `zai` 同时是中国版与国际版、`ark` 是 4 条路由：宁可多给几条数据让调用方自己判断，
  *    也不替它猜一条，更不能返回空。
  * @param requested 调用方给的原始名字列表。
  */
@@ -162,6 +163,9 @@ const VOLC_SECRET_KEY_ENV = "VOLC_SECRETKEY";
 // 与 @mars-sea/dsh-commandcode-provider 一致的 CLI 版本标识（其常量 COMMAND_CODE_CLI_VERSION）。
 const COMMAND_CODE_CLI_VERSION = "1.73.0";
 const COMMAND_CODE_API_BASE = "https://api.commandcode.ai";
+// 提供方插件（@mars-sea/dsh-commandcode-provider）注册的 settings namespace：账户列表、当前固定账户
+// 与登记任务都在这里。Host 端只读它，不写（切换动作由 Client 走 settings remote）。
+const COMMAND_CODE_SETTINGS_NS = "llm-commandcode";
 const COMMAND_CODE_AUTH_FILE = join(homedir(), ".commandcode", "auth.json");
 // 月总额快照与提供方插件 KNOWN_SUBSCRIPTION_PLANS 对齐（而非月剩余余额）。
 // 来源：https://github.com/Mars-Sea/dsh-commandcode-provider/blob/main/src/capabilities.ts
@@ -189,7 +193,8 @@ function commandCodeAuthFileKey(io) {
 }
 // SuperGrok / X Premium 订阅（dsh-grok-kit 的 xai-oauth 路由）：用量走官方 Grok CLI 的计费
 // 代理（转发后端 GetGrokCreditsConfig）。凭据是 dsh-grok-kit / Grok CLI 共享登录文件里的
-// OAuth Bearer（短命轮换），只读不写、不自行刷新，避免与两端的 refresh-token 轮换互相顶掉。
+// OAuth Bearer（短命轮换）：平时只读；token 过期时借 dsh-grok-kit 的官方会话链（getAuth）经同一
+// 把写锁续约并写回同一文件，绝不自行裸 POST 刷新——后者才会顶掉两端的 refresh-token 轮换。
 const GROK_API_BASE = "https://cli-chat-proxy.grok.com/v1";
 // 官方 GrokComConfig.token_header 默认值：必须是该字符串，nginx 鉴权子请求才路由到 OAuth。
 const GROK_TOKEN_AUTH = "xai-grok-cli";
@@ -197,6 +202,21 @@ const GROK_CLIENT_VERSION = "1.0.13";
 const GROK_AUTH_FILE = join(homedir(), ".grok", "auth.json");
 // dsh-grok-kit 旧版私存路径（其 resolveXaiOAuthStorePath 的回退分支）。
 const XAI_OAUTH_AUTH_FILE = join(homedir(), ".dsh", ".xai-oauth-auth.json");
+// dsh-grok-kit 是兄弟插件而非本插件依赖：动态加载，解析不到（未安装 / 开发期 link 布局）即降级。
+// 0.2.0 起导出 XaiOAuthSession；其 models.getAuth("xai") 与 grok-kit 聊天/搜索走同一条官方 OAuth
+// 刷新链——共享文件 store、写锁内二次检查与 compare-and-write，多个消费者并发也只刷新一次，
+// 借它刷新不会顶掉 refresh-token 轮换（自己裸 POST 才会）。只缓存成功解析：失败（未安装、
+// 旧版本）下次过期时重试，用户中途安装/升级 grok-kit 后无需重启 DSH。
+let grokKitModule;
+function loadGrokKit() {
+ if (grokKitModule) return Promise.resolve(grokKitModule);
+ return import("dsh-grok-kit")
+  .then(mod => {
+   if (mod && typeof mod.XaiOAuthSession === "function") grokKitModule = mod;
+   return grokKitModule;
+  })
+  .catch(() => undefined);
+}
 // Bearer 的 JWT payload 里有 sub（= user_id）；登录文件缺 user_id 时兜底取它。
 function bearerSubject(key) {
  try {
@@ -411,9 +431,12 @@ function volcFailure(action, error) {
 }
 async function fetchJson(fetcher, url, headers, lifetimeSignal, init = {}) {
  let response;
- try { response = await fetcher(url, { method: init.method ?? "GET", ...(init.body !== undefined ? { body: init.body } : {}), headers: { accept: "application/json", "user-agent": "dsh-subusage/0.10.10", ...headers }, signal: lifetimeSignal ? AbortSignal.any([AbortSignal.timeout(10000), lifetimeSignal]) : AbortSignal.timeout(10000), redirect: "manual" }); }
+ try { response = await fetcher(url, { method: init.method ?? "GET", ...(init.body !== undefined ? { body: init.body } : {}), headers: { accept: "application/json", "user-agent": `dsh-subusage/${VERSION}`, ...headers }, signal: lifetimeSignal ? AbortSignal.any([AbortSignal.timeout(10000), lifetimeSignal]) : AbortSignal.timeout(10000), redirect: "manual" }); }
  catch { throw failure("subusage/network", "网络请求失败或超时", true); }
- if (response.status >= 300 && response.status < 400 || response.status === 401 || response.status === 403) throw failure("subusage/auth", "登录或凭据已失效");
+ // 3xx（redirect: "manual" 下的域名迁移/跳转）不是鉴权失败，与 401/403 分开映射，
+ // 避免用户被误导去重登录；两个条件都加显式括号，不依赖 &&/|| 优先级。
+ if ((response.status >= 300 && response.status < 400)) throw failure("subusage/response", "服务端返回了意外的重定向响应（HTTP 3xx）");
+ if ((response.status === 401 || response.status === 403)) throw failure("subusage/auth", "登录或凭据已失效");
  if (!response.ok) {
   const retry = response.status === 408 || response.status === 429 || response.status >= 500;
   const raw = response.headers?.get?.("retry-after");
@@ -880,6 +903,23 @@ export const subUsageRemote = {
  ]
 };
 
+/**
+ * 某条 provider 的缓存键。Command Code 是多账户的：额外账户（凭据引用名）各占一份缓存，
+ * 否则账户 A 的结果会被账户 B 顶掉——每读一次全部账户就把前面几家的缓存驱逐一遍，
+ * 60 秒 TTL 形同虚设。默认账户（""/"default"）与其它 provider 仍按 id 单键。
+ */
+function providerCacheKey(id, account = "") {
+	return id === "commandcode" && account !== "" && account !== "default" ? `${id}@${account}` : id;
+}
+/**
+ * 把 no-key 文案里的**凭据引用名**（`apiKeyEnv`）换成账户标签。
+ * 对外额度视图承诺不返回继承变量名/凭据引用，而错误文案里嵌了引用名（「...无引用 COMMANDCODE_ACCOUNT_WORK」）；
+ * Client 通道（read/refresh）**保留**引用名——那是本机界面，用户要靠它定位该往哪个 ref 里写凭据。
+ */
+function redactAccountRef(message, ref, label) {
+	if (typeof message !== "string" || typeof ref !== "string" || ref === "" || !message.includes(ref)) return message;
+	return message.split(ref).join(label);
+}
 // 可注入仅供隔离测试；生产仍由当前 manifest 的 Cordis ctx.plugin 注册。
 export class SubUsageService extends TypertRemoteService {
  constructor(ctx, options = {}) {
@@ -899,9 +939,16 @@ export class SubUsageService extends TypertRemoteService {
   // 默认账户仍走上面的 envName 链（凭据服务 → 启动环境 → ~/.commandcode/auth.json）。
   this.accountCredentials = options.resolveAccountCredentials ?? (async ref => await ctx.get("credentials")?.resolve(credentialRef(ref)));
   this.accountEnvironment = options.resolveAccountEnvironment ?? (ref => launchEnvironmentOf(ctx).get(ref));
-  this.authFile = options.resolveAuthFile ?? (async () => commandCodeAuthFileKey(this.io));
+  // Command Code 多账户：账户列表与当前固定账户由提供方插件写在它自己的 settings namespace
+ // （llm-commandcode）里，Host 端经 settings 服务读取。服务未挂载（提供方插件未运行）时读不到，
+ // 工具退回单账户模式；options.settingsService 供隔离测试注入。
+ this.settingsService = options.settingsService;
+ try { ctx.inject?.(["settings"], (scope) => { if (scope.settings !== undefined) this.settingsService = scope.settings; }); } catch { /* settings 服务不可用：保持单账户模式 */ }
+ this.authFile = options.resolveAuthFile ?? (async () => commandCodeAuthFileKey(this.io));
   // SuperGrok 只读共享登录文件（~/.grok/auth.json 等）取 OAuth Bearer；可注入仅供隔离测试。
   this.grokAuth = options.resolveGrokAuth ?? (async () => grokAuthFileCredentials(this.io));
+  // 过期时借 dsh-grok-kit 的官方会话链刷新同一登录文件；解析不到兄弟插件时返回 undefined 并降级。
+  this.resolveGrokKit = options.resolveGrokKit ?? loadGrokKit;
   // Codex 只读共享登录文件（$CODEX_HOME/auth.json 或 ~/.codex/auth.json）取 OAuth access token。
   this.codexAuth = options.resolveCodexAuth ?? (async () => codexAuthFileCredentials(this.io, { CODEX_HOME: (await this.environmentByName("CODEX_HOME"))?.value }));
   this.cache = new Map(); this.inflight = new Map(); this.generations = new Map(); this.fingerprints = new Map(); this.disposed = false; this.controller = new AbortController();
@@ -973,6 +1020,33 @@ export class SubUsageService extends TypertRemoteService {
   if (typeof envAk?.value === "string" && envAk.value.trim() && typeof envSk?.value === "string" && envSk.value.trim()) return { key: envAk.value.trim(), secret: envSk.value.trim(), source: "env" };
   return ak && sk ? { key: ak, secret: sk, source: "manual" } : { key: undefined, secret: undefined, source: "none" };
  }
+ /**
+  * Grok 登录文件的 access token 过期时，借 dsh-grok-kit 的官方会话链续约：getAuth("xai")
+  * 在共享凭据 store 的写锁内二次检查并刷新，新 token 由官方链写回同一个 ~/.grok/auth.json，
+  * 与 grok-kit 聊天/搜索/Grok CLI 是同一套锁协议，不会顶掉 refresh-token 轮换。
+  * 不直接信任 getAuth 返回值：无论刷新由本进程还是并发的另一进程完成，一律重读登录文件拿新 token 与新过期时间。
+  * 回到 { renewed:true, identity }；兄弟插件不可用时 unavailable:true；刷新尝试失败时带 refreshError。
+  */
+ async renewGrokIdentity(identity, signal) {
+  if (!identity.expiresAt || Date.parse(identity.expiresAt) > this.now()) return { renewed: false, unavailable: true, identity };
+  let kit;
+  try { kit = await this.resolveGrokKit(); } catch { kit = undefined; }
+  if (!kit?.XaiOAuthSession) return { renewed: false, unavailable: true, identity };
+  let session;
+  let refreshError;
+  try {
+   session = new kit.XaiOAuthSession();
+   // pi-ai 内部有 15s 刷新超时与 2s 文件锁预算；外层再兜 20s 总预算，避免挂死药丸/工具刷新。
+   const deadline = AbortSignal.timeout(20000);
+   await session.models.getAuth("xai", { signal: signal ? AbortSignal.any([signal, deadline]) : deadline });
+  } catch (error) { refreshError = error; }
+  finally { try { session?.dispose?.(); } catch { /* 会话只持有进程内模型缓存，dispose 失败无后果 */ } }
+  const cred = await this.grokAuth();
+  if (cred?.key && cred.key !== identity.key && (!cred.expiresAt || Date.parse(cred.expiresAt) > this.now())) {
+   return { renewed: true, identity: { key: cred.key, source: "auth-file", ...(cred.userId ? { userId: cred.userId } : {}), ...(cred.expiresAt ? { expiresAt: cred.expiresAt } : {}) } };
+  }
+  return { renewed: false, unavailable: false, refreshError, identity };
+ }
  async fetchProvider(id, identity, settings, signal = this.controller.signal) {
   const get = (url, headers, init) => fetchJson(this.fetcher, url, headers, signal, init);
   // 火山方舟额度走管控面 OpenAPI：POST 根路径 + Action/Version 在 query，鉴权是 AK/SK 签名。
@@ -1026,7 +1100,7 @@ export class SubUsageService extends TypertRemoteService {
    // HTTP 200 但窗口为空是「未订阅」，不是 0% 用量：显式说明，不画零额度的假象。
    else if (!windows.length) extras.push({ kind: "plan", value: parsed.subscribed ? "本周期暂无窗口数据" : "未检测到该套餐订阅" });
    // 订阅状态要**结构化**带出去，不能只写进 extras 文案：同一组 AK/SK 能查到名下所有套餐，
-   // 界面上若把 7 条路由一律列出来，用户根本分不清哪个是哪个。前端据此收起没订阅的那些。
+   // 界面上若把 4 条路由一律列出来，用户根本分不清哪个是哪个。前端据此收起没订阅的那些。
    return { windows, extras, coverage: windows.length ? "complete" : "partial", subscribed: parsed.subscribed === true };
   }
   const headers = { authorization: `Bearer ${identity.key}` };
@@ -1099,17 +1173,25 @@ export class SubUsageService extends TypertRemoteService {
    return normalizeCommandCode(credits, subscription);
   }
   if (id === "xai-oauth") {
-   // 登录文件里的 access token 短命（实测 ~24 小时）。本插件**刻意不代刷**——refresh-token 轮换由
-   // Grok CLI / dsh-grok-kit 各自的锁协议管理，第三端刷新会把它们的轮换顶掉。但「过期」这件事必须
-   // 说清楚：不发这一枪的话，用户看到的是上游 401 转成的「登录或凭据已失效」，而他那边的 Grok Kit
-   // 明明写着「已登录」——两边对不上，只会让人以为插件坏了。
-   if (identity.expiresAt && Date.parse(identity.expiresAt) <= this.now()) {
-    throw failure("subusage/auth", `Grok 登录文件的 access token 已于 ${new Date(identity.expiresAt).toLocaleString("zh-CN", { timeZone: "Asia/Shanghai" })} 过期。用一次 Grok CLI，或在 设置 → xAI Grok 里重新登录，都会刷新同一个文件（${GROK_AUTH_FILE}）；本插件不代刷，以免与它们的 refresh-token 轮换互相顶掉。`);
+   // 登录文件里的 access token 短命（实测 6 小时量级），而 grok-kit 的自动刷新是懒触发：
+   // 只有它自己聊天/搜索遇到过期才刷，没有后台定时器。本插件每分钟读一次用量，是最常发现
+   // 过期的一方——若只读不刷，就会出现「Grok Kit 显示已登录、用量卡片显示已过期」的割裂。
+   // 过期时借 grok-kit 的官方会话链续约（同一文件、同一把写锁、compare-and-write，不顶轮换）；
+   // 兄弟插件不可用或刷新失败时，才退回可行动的手动提示。
+   let grok = identity;
+   if (grok.expiresAt && Date.parse(grok.expiresAt) <= this.now()) {
+    const outcome = await this.renewGrokIdentity(grok, signal);
+    if (outcome.renewed) grok = outcome.identity;
+    else if (outcome.unavailable) throw failure("subusage/auth", `Grok 登录文件的 access token 已于 ${new Date(identity.expiresAt).toLocaleString("zh-CN")} 过期，但本机未能加载 dsh-grok-kit（≥0.2.0）的自动刷新链。用一次 Grok CLI（登录后发一条消息），或在 设置 → xAI Grok 里重新登录，都会刷新同一个文件（${GROK_AUTH_FILE}）。`);
+    else {
+     const reason = outcome.refreshError?.message ? String(outcome.refreshError.message).slice(0, 200) : "登录刷新链未返回新凭据";
+     throw failure("subusage/auth", `Grok 登录已于 ${new Date(identity.expiresAt).toLocaleString("zh-CN")} 过期，尝试经 dsh-grok-kit 自动刷新失败：${reason}。通常需要重新登录：在 设置 → xAI Grok 重新登录，或运行 grok login（同一登录文件 ${GROK_AUTH_FILE}）。`);
+    }
    }
    // 直连官方 Grok CLI 计费代理；X-XAI-Token-Auth 的取值是 token_header 字符串（xai-grok-cli）
    // 而非布尔，x-userid 取登录文件。套餐名走 /v1/settings（subscription_tier_display），
    // 失败不阻塞用量（回退 billing 响应里的 subscription_tier）。
-   const grokHeaders = { ...headers, "x-xai-token-auth": GROK_TOKEN_AUTH, "x-grok-client-version": GROK_CLIENT_VERSION, ...(identity.userId ? { "x-userid": identity.userId } : {}) };
+   const grokHeaders = { authorization: `Bearer ${grok.key}`, "x-xai-token-auth": GROK_TOKEN_AUTH, "x-grok-client-version": GROK_CLIENT_VERSION, ...(grok.userId ? { "x-userid": grok.userId } : {}) };
    const [billing, settings] = await Promise.all([
     get(`${GROK_API_BASE}/billing?format=credits`, grokHeaders),
     get(`${GROK_API_BASE}/settings`, grokHeaders).catch(() => undefined)
@@ -1129,6 +1211,93 @@ export class SubUsageService extends TypertRemoteService {
   if (usageError) data.usageError = usageError;
   return data;
  }
+ /**
+  * Command Code 的多账户清单与当前激活项，读自提供方插件的 settings namespace（llm-commandcode）。
+  * id/label 规则与 Client 的 commandCodeAccountList 完全一致：默认账户固定 id "default"（label 用人读
+  * 文案），额外账户 id 取其凭据引用名（apiKeyEnv）、label 空白回退 `Account N`；无凭据引用与登记未完成
+  * （phase 非 naming）的账户不列。
+  * 与提供方插件 slots() 的**唯一差异**：它额外支持 `accounts[].apiKey` 字面 Key 账户（id `account-N`），
+  * 本插件**不支持**——那种 Key 只存在提供方自己的配置里，按引用名解析不到（identity() 也没有字面 Key
+  * 分支），列出来只会选中即 no-key。Client 侧同样跳过，两端口径因此保持一致。
+  * activeAccount 为空、为 "auto" 或指向已消失的账户时都按**自动轮换**处理（与其 preferredId 同义）。
+  * 读不到（settings 服务未挂载 / namespace 不存在）返回 null，调用方退回单账户模式。
+  */
+ commandCodeAccountPlan() {
+  try {
+   // redactSecrets：本插件只读这几个非秘密字段，但提供方配置里可能存在手写的字面 apiKey
+   // （role "secret"）；带上它就只剥离秘密字段（apiKeyEnv 是 credential-ref，不受影响），
+   // 字面 Key 不会进到本插件的内存里。
+   const rows = this.settingsService?.describe?.({ redactSecrets: true });
+   const row = Array.isArray(rows) ? rows.find(item => item?.ns === COMMAND_CODE_SETTINGS_NS) : undefined;
+   if (!row) return null;
+   const value = row.value && typeof row.value === "object" ? row.value : {};
+   const tasks = Array.isArray(value.accountEnrollmentTasks) ? value.accountEnrollmentTasks : [];
+   const accounts = [{ id: "default", label: "默认账户" }];
+   const seen = new Set(["default"]);
+   for (const [index, account] of (Array.isArray(value.accounts) ? value.accounts : []).entries()) {
+    const ref = typeof account?.apiKeyEnv === "string" && account.apiKeyEnv.trim() !== "" ? account.apiKeyEnv.trim() : void 0;
+    if (ref === void 0) continue;
+    // 同一个引用名出现两次（配置被手改过）时只列一次：否则同账户会出两行、还会多打一份计费请求。
+    if (seen.has(ref)) continue;
+    if (tasks.some(task => task?.ref === ref && task.phase !== "naming")) continue;
+    seen.add(ref);
+    accounts.push({ id: ref, label: typeof account.label === "string" && account.label.trim() !== "" ? account.label.trim() : `Account ${index + 2}` });
+   }
+   const raw = typeof value.activeAccount === "string" ? value.activeAccount.trim() : "";
+   const activeId = raw !== "" && accounts.some(account => account.id === raw) ? raw : "";
+   return { mode: activeId === "" ? "auto" : "fixed", activeId, accounts: accounts.map(account => ({ ...account, active: account.id === activeId })) };
+  } catch { return null; }
+ }
+ /**
+  * 自动轮换模式下的**轮换池健康摘要**：UI 通道（read/refresh）默认只回顶层 Key 单账户，
+  * 用户看到的是乐观数字，但实际请求会落到池中任意账户——默认账户健康不代表池健康
+  * （其余账户可能已全部 5h 限额）。这里复用各账户自己的缓存并行读一遍，把摘要挂到默认
+  * 账户 entry 上，Client 仅在 auto 模式渲染。固定模式（activeId 非空）返回 null。
+  *
+  * 业务口径（不能简单取「池中最紧张账户」）：各账户是**独立配额**，轮换器会避开已限额的
+  * 账户，所以单账户限额不是立即失败信号。只有「所有有凭据的账户都限额」才是池耗尽：
+  *   healthy  = ok 且没有 rate-limited 窗口
+  *   blocked  = ok 但至少一个窗口 rate-limited（容量降级，仍可能成功）
+  *   unusable = no-key/no-cookie/disabled/error（读不到或没凭据，不计入有效容量）
+  * 池里没有任何有凭据的账户时 exhausted=false（那是「未配置」，由默认 entry 的 no-key 表达）。
+  */
+ async commandCodePool(settings, force, defaultEntry) {
+  const plan = this.commandCodeAccountPlan();
+  if (!plan || plan.mode !== "auto") return null;
+  // 默认账户那条 entry 已由调用方读过（避免重复一发），其余账户各自命中 provider() 的 TTL/
+  // inflight 缓存，因此每分钟的自动刷新不会真的打 N 次计费接口。
+  const readOne = async (account) => {
+   if (account.id === "default") return defaultEntry;
+   try { return await this.provider("commandcode", settings, force, account.id); }
+   catch { return { ...this.base("commandcode", "none", settings, account.id), state: "error", errorCode: "subusage/internal", error: "读取用量失败", windows: [], extras: [] }; }
+  };
+  const entries = await Promise.all(plan.accounts.map(account => readOne(account)));
+  const accounts = plan.accounts.map((account, index) => {
+   const entry = entries[index];
+   const windows = Array.isArray(entry?.windows) ? entry.windows : [];
+   const ok = entry?.state === "ok";
+   return {
+    id: account.id, label: account.label, active: account.active === true,
+    state: entry?.state ?? "error", errorCode: entry?.errorCode, windows,
+    // usable：读到了且没有任何限额窗口；blocked：读到了但有窗口限额（容量降级，仍可能成功）。
+    usable: ok && !windows.some(w => w.status === "rate-limited"),
+    blocked: ok && windows.some(w => w.status === "rate-limited")
+   };
+  });
+  // 「有效容量」= usable + blocked（真的有凭据且读到了额度的账户）；no-key/error/disabled 不算。
+  const capable = accounts.filter(a => a.usable || a.blocked);
+  const available = accounts.filter(a => a.usable).length;
+  const blockedCount = accounts.filter(a => a.blocked).length;
+  const unusableCount = accounts.length - available - blockedCount;
+  const exhausted = capable.length > 0 && capable.every(a => a.blocked);
+  return { mode: "auto", total: accounts.length, available, blockedCount, unusableCount, exhausted, accounts };
+ }
+ /** 按 id 失效一家 provider 的**全部账户**缓存：凭据/开关变化不能只影响默认账户那一条。 */
+ invalidateProvider(id) {
+  const keys = new Set([id]);
+  for (const map of [this.cache, this.inflight, this.fingerprints, this.generations]) for (const key of map.keys()) if (key.startsWith(`${id}@`)) keys.add(key);
+  for (const key of keys) { this.generations.set(key, (this.generations.get(key) ?? 0) + 1); this.cache.delete(key); this.inflight.delete(key); }
+ }
  base(id, source, settings, account = "") {
   // MiMo 会话 Cookie 自签发起 24 小时有效；到期时间随每条 entry 下发，供药丸与设置页倒计时。
   const expiresAt = id === "xiaomi-token-plan-cn" ? isoStamp(settings?.xiaomi?.expiresAt) : null;
@@ -1137,7 +1306,10 @@ export class SubUsageService extends TypertRemoteService {
   return { providerId: id, label: PROVIDERS[id].label, envName: PROVIDERS[id].envName, keySource: source, apiDetected: source === "none" ? null : true, coverage: "partial", freshness: "unknown", lastSuccessAt: null, lastAttemptAt: new Date(this.now()).toISOString(), retryable: false, retainPrevious: false, ...shown, ...(expiresAt ? { cookieExpiresAt: expiresAt } : {}) };
  }
  async provider(id, settings, force, account = "") {
-  const startedGeneration = this.generations.get(id) ?? 0;
+  // 缓存/inflight/fingerprint 都按**账户**分键：Command Code 的多账户各占一份，
+  // 读取全部账户时不会互相驱逐缓存（见 providerCacheKey）。
+  const cacheKey = providerCacheKey(id, account);
+  const startedGeneration = this.generations.get(cacheKey) ?? 0;
   let identity;
   // identity 解析依赖凭据服务/登录文件读取，可能像 HTTP 一样永久挂起：套上与 fetchJson 同量级
   // 的超时。超时不等于凭据失效——不清 Cookie、不用 subusage/credentials（client 的
@@ -1147,25 +1319,25 @@ export class SubUsageService extends TypertRemoteService {
   try { identity = await withTimeout(this.identity(id, settings, account), this.identityTimeoutMs, () => failure("subusage/identity-timeout", `凭据解析超时（${Math.round(this.identityTimeoutMs / 1000)} 秒无响应）：凭据服务或登录文件读取未返回，请稍后重试`)); }
   catch (e) {
    const timedOut = e?.code === "subusage/identity-timeout";
-   this.cache.delete(id);
+   this.cache.delete(cacheKey);
    return { ...this.base(id, "none", settings, account), state: "error", errorCode: timedOut ? "subusage/identity-timeout" : "subusage/credentials", error: timedOut ? e.message : "无法解析凭据" };
   }
   if (this.disposed) throw failure("subusage/disposed", "服务已卸载");
-  if (startedGeneration !== (this.generations.get(id) ?? 0)) return this.provider(id, this.load(), force, account);
+  if (startedGeneration !== (this.generations.get(cacheKey) ?? 0)) return this.provider(id, this.load(), force, account);
   if (!providerEnabled(settings, id)) {
-   this.cache.delete(id); this.inflight.delete(id);
+   this.cache.delete(cacheKey); this.inflight.delete(cacheKey);
    return { ...this.base(id, identity.source, settings, account), state: "disabled", apiDetected: !!identity.key, windows: [], extras: [] };
   }
   // fingerprint 计入账户选择：切换账户后同 id 缓存/inflight 不串账（不同账户 key 必不同）；
   // 空串与 "default" 同为默认账户，归一后共享缓存。
   const fingerprint = hash([identity.key ?? "", identity.secret ?? "", identity.source, settings.keyModes[id], id === "zai-coding-cn" ? settings.zai : null, id === "commandcode" ? (account && account !== "default" ? account : "default") : null]);
-  if (this.fingerprints.has(id) && this.fingerprints.get(id) !== fingerprint) this.generations.set(id, (this.generations.get(id) ?? 0) + 1);
-  this.fingerprints.set(id, fingerprint);
-  const generation = this.generations.get(id) ?? 0;
-  const cached = this.cache.get(id);
-  if (cached && cached.fingerprint !== fingerprint) this.cache.delete(id);
+  if (this.fingerprints.has(cacheKey) && this.fingerprints.get(cacheKey) !== fingerprint) this.generations.set(cacheKey, (this.generations.get(cacheKey) ?? 0) + 1);
+  this.fingerprints.set(cacheKey, fingerprint);
+  const generation = this.generations.get(cacheKey) ?? 0;
+  const cached = this.cache.get(cacheKey);
+  if (cached && cached.fingerprint !== fingerprint) this.cache.delete(cacheKey);
   const previous = cached?.fingerprint === fingerprint ? cached : undefined;
-  const active = this.inflight.get(id);
+  const active = this.inflight.get(cacheKey);
   if (active?.fingerprint === fingerprint && active.generation === generation) return active.promise;
   const now = this.now();
   const resetDue = previous?.entry.windows?.some(w => Number.isFinite(Date.parse(w.resetsAt)) && Date.parse(w.resetsAt) > previous.at && Date.parse(w.resetsAt) <= now);
@@ -1187,12 +1359,12 @@ export class SubUsageService extends TypertRemoteService {
     failures++;
     if (temporary) retryAt = this.now() + Math.max(e.details?.retryAfterMs ?? 0, Math.min(300000, 1000 * 2 ** Math.min(failures, 8)));
    }
-   if (!this.disposed && generation === (this.generations.get(id) ?? 0)) this.cache.set(id, { fingerprint, entry, at: this.now(), retryAt, failures });
-   if (this.disposed || generation !== (this.generations.get(id) ?? 0)) return { ...this.base(id, "none", settings, account), state: "error", errorCode: "subusage/config-changed", error: "读取期间配置已改变，请刷新" };
+   if (!this.disposed && generation === (this.generations.get(cacheKey) ?? 0)) this.cache.set(cacheKey, { fingerprint, entry, at: this.now(), retryAt, failures });
+   if (this.disposed || generation !== (this.generations.get(cacheKey) ?? 0)) return { ...this.base(id, "none", settings, account), state: "error", errorCode: "subusage/config-changed", error: "读取期间配置已改变，请刷新" };
    return entry;
   })();
-  this.inflight.set(id, { fingerprint, generation, promise });
-  try { return await promise; } finally { if (this.inflight.get(id)?.promise === promise) this.inflight.delete(id); }
+  this.inflight.set(cacheKey, { fingerprint, generation, promise });
+  try { return await promise; } finally { if (this.inflight.get(cacheKey)?.promise === promise) this.inflight.delete(cacheKey); }
  }
  // 对外只读额度视图：供其他插件（ctx.get("subUsage").quota(...)）与 subusage_quota 工具使用。
  // **刻意不返回 settings，也不返回 keySource / apiDetected**：第三方消费者只需要额度，
@@ -1207,7 +1379,18 @@ export class SubUsageService extends TypertRemoteService {
   const wanted = matched.length || !unknown.length ? matched : [...IDS];
   const settings = this.load();
   const force = request?.force === true;
-  const entries = await withTimeout(Promise.all(wanted.map(id => this.provider(id, settings, force).catch(() => ({ providerId: id, label: PROVIDERS[id].label, state: "error", errorCode: "subusage/internal", error: "读取用量失败" })))), 30000, () => failure("subusage/timeout", "额度查询超过 30 秒仍未完成，请稍后重试或缩小 providers"));
+  // Command Code 是多账户的：一次把**每个账户**都读一遍，并标出当前激活的是哪一个（或自动轮换）。
+  // 账户清单来自提供方插件的 settings namespace（llm-commandcode）；读不到时退回单账户模式。
+  const plan = wanted.includes("commandcode") ? this.commandCodeAccountPlan() : null;
+  // 激活账户排最前：调用方第一眼要看的就是「现在实际在用的是哪一个」。
+  const planAccounts = plan ? (plan.mode === "fixed" ? [...plan.accounts].sort((a, b) => Number(b.active) - Number(a.active)) : plan.accounts) : null;
+  const read = (id, account = "") => this.provider(id, settings, force, account).catch(() => ({ ...this.base(id, "none", settings, account), state: "error", errorCode: "subusage/internal", error: "读取用量失败" }));
+  const tasks = [];
+  for (const id of wanted) {
+   if (planAccounts && id === "commandcode") tasks.push(...planAccounts.map(account => read(id, account.id)));
+   else tasks.push(read(id));
+  }
+  const entries = await withTimeout(Promise.all(tasks), 30000, () => failure("subusage/timeout", "额度查询超过 30 秒仍未完成，请稍后重试或缩小 providers"));
   // 认不出的名字要回一条**可读**条目而不是静默丢掉：调用方（尤其是模型）无从知道本插件用的是
   // 路由 id，丢掉之后它只看到空列表，会当成「本机没配任何额度」——真正的原因只是名字没对上。
   // 放在最前面，免得淹没在几十条数据后面。
@@ -1217,19 +1400,28 @@ export class SubUsageService extends TypertRemoteService {
   }));
   return {
    updatedAt: new Date(this.now()).toISOString(),
-   providers: [...unknownEntries, ...entries.map(entry => ({
-    providerId: entry.providerId,
-    label: entry.label,
-    state: entry.state,
-    windows: Array.isArray(entry.windows) ? entry.windows : [],
-    extras: Array.isArray(entry.extras) ? entry.extras : [],
-    // 只输出真正有值的字段：视图里带 `undefined` 的键会被调用方的 schema 校验判成型别错误
-    // （DSH 就会），而且「字段缺席」本来就该表示「这家没报告」，不是「报告了空」。
-    ...(typeof entry.coverage === "string" ? { coverage: entry.coverage } : {}),
-    ...(typeof entry.freshness === "string" ? { freshness: entry.freshness } : {}),
-    ...(typeof entry.lastSuccessAt === "string" ? { lastSuccessAt: entry.lastSuccessAt } : {}),
-    ...(entry.error ? { error: entry.error } : {})
-   }))]
+   providers: [...unknownEntries, ...entries.map(entry => {
+    const account = planAccounts && entry.providerId === "commandcode" ? planAccounts.find(item => item.id === (entry.account ?? "default")) : undefined;
+    const extras = Array.isArray(entry.extras) ? entry.extras : [];
+    return {
+     providerId: entry.providerId,
+     label: entry.label,
+     state: entry.state,
+     windows: Array.isArray(entry.windows) ? entry.windows : [],
+     // 账户标注进 extras：单独读 JSON 也能知道这条数字属于哪个账户（文本层把它并进标题行）。
+     extras: account ? [...extras.filter(item => item?.kind !== "account"), { kind: "account", value: account.label }] : extras,
+     // 激活状态是「现在实际用哪一个」的唯一答案：固定账户给 accountActive，自动轮换给 accountMode=auto。
+     ...(account ? { account: account.label, accountActive: account.active === true, accountMode: plan.mode } : {}),
+     // 只输出真正有值的字段：视图里带 `undefined` 的键会被调用方的 schema 校验判成型别错误
+     // （DSH 就会），而且「字段缺席」本来就该表示「这家没报告」，不是「报告了空」。
+     ...(typeof entry.coverage === "string" ? { coverage: entry.coverage } : {}),
+     ...(typeof entry.freshness === "string" ? { freshness: entry.freshness } : {}),
+     ...(typeof entry.lastSuccessAt === "string" ? { lastSuccessAt: entry.lastSuccessAt } : {}),
+      // 对外视图里不能出现内部凭据引用名：no-key 文案嵌了它，这里换成账户标签
+      // （client 通道仍保留引用名——那是本机排障要用的定位信息）。
+      ...(entry.error ? { error: account ? redactAccountRef(entry.error, account.id, account.label) : entry.error } : {})
+    };
+   })]
   };
  }
  async read(request) { return this.refresh(request && request.providerIds ? request : { providerIds: IDS, force: false }); }
@@ -1242,6 +1434,16 @@ export class SubUsageService extends TypertRemoteService {
   const unknownEntries = (query.unknown ?? []).map(id => ({ providerId: id, label: id, state: "error", errorCode: "subusage/unknown-provider", error: "本机运行中的 Host 版本较旧，不认识该提供商；重启 DSH 后生效", apiDetected: null, coverage: "partial", freshness: "unknown", keySource: "none", retryable: false, retainPrevious: false, windows: [], extras: [] }));
   const latest = this.load();
   if (hash(latest) !== hash(settings)) return this.result(latest, [...query.providerIds.map(id => ({ ...this.base(id, "none", latest, query.commandCodeAccount), state: "error", errorCode: "subusage/config-changed", error: "读取期间配置已改变，请刷新" })), ...unknownEntries]);
+  // Command Code 自动轮换：把轮换池健康摘要挂到默认账户（顶层 Key）entry 上。
+  // 仅当本次查询的就是默认账户（commandCodeAccount 为空）时——查某个额外账户时不挂，
+  // 那条 entry 代表的是被点名的账户本身。提供方插件未运行 / 固定账户时 pool 为 null，原样返回。
+  if (query.providerIds.includes("commandcode") && (!query.commandCodeAccount || query.commandCodeAccount === "default")) {
+   const ccIndex = entries.findIndex(e => e && e.providerId === "commandcode");
+   if (ccIndex >= 0) {
+    const pool = await this.commandCodePool(latest, query.force, entries[ccIndex]);
+    if (pool) entries[ccIndex] = { ...entries[ccIndex], accountPool: pool };
+   }
+  }
   return this.result(latest, [...entries, ...unknownEntries]);
  }
  startMimoLogin(request) { return this.login.start(parseLoginStart(request)); } getMimoLoginStatus() { return this.login.status(); }
@@ -1301,10 +1503,10 @@ export class SubUsageService extends TypertRemoteService {
   updateVolc("secretAccessKey", patch.secretKeyUpdate);
   try { this.io.mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 }); this.io.writeFileSync(`${this.path}.tmp`, JSON.stringify(stored, null, 2), { encoding: "utf8", mode: 0o600 }); this.io.chmodSync(`${this.path}.tmp`, 0o600); this.io.renameSync(`${this.path}.tmp`, this.path); }
   catch { throw failure("subusage/config", "无法保存订阅设置"); }
-  for (const key of affected) { this.generations.set(key, (this.generations.get(key) ?? 0) + 1); this.cache.delete(key); this.inflight.delete(key); }
+  for (const id of affected) this.invalidateProvider(id);
   return this.result(stored, []);
  }
- dispose() { this.login.dispose(); this.disposed = true; this.controller.abort(); this.cache.clear(); this.inflight.clear(); this.fingerprints.clear(); for (const id of IDS) this.generations.set(id, (this.generations.get(id) ?? 0) + 1); }
+ dispose() { this.login.dispose(); this.disposed = true; this.controller.abort(); this.cache.clear(); this.inflight.clear(); this.fingerprints.clear(); for (const key of [...this.generations.keys(), ...IDS]) this.generations.set(key, (this.generations.get(key) ?? 0) + 1); }
 }
 function registerRemotes(ctx) {
  ctx.inject(["typert"], scope => { scope.effect(() => scope.typert.register({ package: subUsageRemote.package, face: "host", schemas: [], model: { services: [], events: [], objects: [] }, invocations: subUsageRemote.descriptors })); });
@@ -1314,12 +1516,20 @@ function apply(ctx) { registerRemotes(ctx); ctx.plugin(SubUsageService, {}); reg
  * 工具结果的人读文本：一行一个 provider，先给窗口再给余额，异常与未配置直说。
  * 这段文本才是模型真正读到的东西，所以**任何情况下都不返回空**：读不到数据时也要给出
  * 「怎么才能读到」的下一步，否则模型只会回一句「没有额度」，而原因其实是个可以修的动作项。
+ * Command Code 有多个账户时按账户各给一行，标题里标出当前激活的是哪一个
+ * （`accountActive`）或处于自动轮换（`accountMode === "auto"`）——「还剩多少」与
+ * 「现在实际用哪个账户」本来就是同一个问题的两面。
  */
 function formatQuotaText(value) {
  const providers = Array.isArray(value?.providers) ? value.providers : [];
- if (!providers.length) return `没有读到任何提供商。请不带 providers 参数再调用一次以查询全部 ${IDS.length} 条；若仍为空，在设置页确认「检测」开关与凭据。`;
- const lines = providers.map(entry => {
-  const head = `${entry.label || entry.providerId} [${entry.state}]`;
+ const omitted = Number.isFinite(value?.omitted) && value.omitted > 0 ? value.omitted : 0;
+ const tail = omitted ? `\n（另有 ${omitted} 家未启用、未配置凭据或没有可读额度，已省略；需要时用 providers 点名查询某一家的状态。）` : "";
+ if (!providers.length) return omitted
+  ? `没有可显示的额度：${omitted} 家都未启用、未配置凭据或没有可读数据。用 providers 点名查询某一家的状态，或在 dsh-subusage 设置页确认「检测」开关与凭据。`
+  : `没有读到任何提供商。请不带 providers 参数再调用一次以查询全部 ${IDS.length} 条；若仍为空，在设置页确认「检测」开关与凭据。`;
+ const lines = providers.map((entry, index) => {
+  const repeat = providers[index - 1]?.providerId === entry.providerId;
+  const head = `${entry.label || entry.providerId} [${entry.state}]${accountSuffix(entry, repeat)}`;
   if (entry.state === "no-key" || entry.state === "no-cookie") return `${head}：未配置凭据`;
   if (entry.state === "disabled") return `${head}：检测已关闭`;
   if (entry.state !== "ok") return `${head}：${entry.error || "读取失败"}`;
@@ -1327,7 +1537,12 @@ function formatQuotaText(value) {
   for (const window of entry.windows || []) {
    parts.push(`${window.kind} ${window.status === "rate-limited" ? "已达限额" : `${Math.round(Math.max(0, 100 - window.percent) * 10) / 10}% 剩余`}${window.resetsAt ? `（重置 ${window.resetsAt}）` : ""}`);
   }
-  for (const extra of entry.extras || []) parts.push(`${extra.kind}: ${extra.value}`);
+  // 账户名已经在标题行里了；再打一遍只会把额度挤出视野。
+  // **只对多账户行跳过**（顶层 account 字段 = Command Code 的账户标注）：火山方舟的席位标注
+  // 同样用 kind "account"（`席位 seat-xxx（共 N 个席位）`），那是唯一能看出「读的是哪个席位」的
+  // 信息，跟着一起丢就等于把额度说成不属于任何席位。
+  const skipAccountExtra = typeof entry.account === "string" && entry.account !== "";
+  for (const extra of entry.extras || []) { if (skipAccountExtra && extra.kind === "account") continue; parts.push(`${extra.kind}: ${extra.value}`); }
   if (entry.freshness === "stale") parts.push("缓存数据");
   return `${head}：${parts.length ? parts.join("；") : "暂无额度数据"}`;
  });
@@ -1337,7 +1552,35 @@ function formatQuotaText(value) {
   const off = providers.filter(entry => entry.state === "disabled").length;
   lines.push(`（这 ${providers.length} 条都没读到额度：未配置凭据 ${missing} 条、检测已关闭 ${off} 条；其余为读取失败。凭据与开关都在 dsh-subusage 设置页，或参考 docs/credentials.md。）`);
  }
- return lines.join("\n");
+ return lines.join("\n") + tail;
+}
+/**
+ * 多账户 provider 的账户后缀：账户名 +（当前激活 | 自动轮换 | 轮换候选）。
+ * 同一家的后续行不重复模式词——三行都写一遍「自动轮换」只会白占宽度。
+ */
+function accountSuffix(entry, repeat = false) {
+ if (typeof entry?.account !== "string" || entry.account === "") return "";
+ if (repeat && entry.accountMode === "auto") return `（账户 ${entry.account}）`;
+ const state = entry.accountMode === "auto" ? "自动轮换" : entry.accountActive === true ? "当前激活" : "轮换候选";
+ return `（账户 ${entry.account} · ${state}）`;
+}
+/**
+ * 「这条值不值得占一行」（只在调用方**没有点名厂商**时用）。
+ * 省略的是「没启用」「没配凭据」与「成功了但确实没有可读额度」三类：本机登记着三十来条路由，
+ * 这三类只会把真正的数字淹掉。
+ * **读取失败（state=error）刻意保留**：那是一次「没读到」，不是「没配置」——把它一起省略，
+ * 一次网络抖动就会被说成「这家还没配凭据」，把排障方向带偏。
+ * `plan` 是套餐名、`account` 是账户标注，都不算额度数据——「本月没有可读额度」这种占位说明
+ * 正是用户不想看到的空行。但**顶层 account 才是账户标注行**：火山方舟的席位标注也用
+ * kind `account`（`席位 seat-xxx（共 N 个席位）`），那是身份信息而不是账户标注，照旧算数据。
+ */
+function hasQuotaData(entry) {
+ if (!entry) return false;
+ if (entry.state === "error") return true;
+ if (entry.state !== "ok") return false;
+ if (Array.isArray(entry.windows) && entry.windows.length) return true;
+ const metadata = typeof entry.account === "string" && entry.account !== "" ? ["account", "plan"] : ["plan"];
+ return (Array.isArray(entry.extras) ? entry.extras : []).some(item => !metadata.includes(item?.kind));
 }
 /**
  * 注册 subusage_quota 工具：模型可以直接问「额度还剩多少」，不必自己逐个厂商请求。
@@ -1347,7 +1590,7 @@ function registerQuotaTool(ctx) {
  ctx.inject(["tools"], toolCtx => {
   toolCtx.tools.register(defineTool({
    name: "subusage_quota",
-   description: "Read the remaining quota and balance of the AI subscriptions configured on this machine (DeepSeek, Z.ai, Kimi, MiMo, OpenCode Go, Command Code, Codex, SuperGrok, MiniMax, Volcengine Ark, OpenRouter, SiliconFlow, ...). Call it with no arguments to read every provider — that is the usual call. `providers` is an optional filter that accepts both this plugin's provider ids and plain vendor names (\"zai\", \"kimi\", \"mimo\", \"minimax\", \"commandcode\", \"grok\", \"codex\", \"ark\", \"deepseek\"); one name can match several routes and every match is returned with its own state, and a name that matches nothing still returns the full data plus an explanation instead of an empty result. Read-only: it never returns credentials and never changes settings. Each entry has state (ok | no-key | no-cookie | error | disabled), windows (percent is the USED percentage; absent resetsAt means the provider does not report one) and extras (plan name, balance). Results may come from a cache up to 60 seconds old; pass refresh=true only when the user explicitly needs up-to-date numbers.",
+   description: "Read the remaining quota and balance of the AI subscriptions configured on this machine (DeepSeek, Z.ai, Kimi, MiMo, OpenCode Go, Command Code, Codex, SuperGrok, MiniMax, Volcengine Ark, OpenRouter, SiliconFlow, ...). Call it with no arguments to read every provider — that is the usual call. `providers` is an optional filter that accepts both this plugin's provider ids and plain vendor names (\"zai\", \"kimi\", \"mimo\", \"minimax\", \"commandcode\", \"grok\", \"codex\", \"ark\", \"deepseek\"); one name can match several routes and every match is returned with its own state, and a name that matches nothing still returns the full data plus an explanation instead of an empty result. Read-only: it never returns credentials and never changes settings. Each entry has state (ok | no-key | no-cookie | error | disabled), windows (percent is the USED percentage; absent resetsAt means the provider does not report one) and extras (plan name, balance). When a known provider is named, its entries are returned as-is so its status is visible (including why it has no data). When nothing is named — or the names you pass are not recognized, in which case the full data set comes back as a fallback — entries whose detection is off, that have no credentials configured, or that succeed without reporting any quota data are left out and counted in `omitted`; entries that failed to fetch, and the explanation row for an unrecognized name, are kept. Command Code is multi-account: it is reported once per account, each entry carrying account (the account label), accountActive and accountMode (fixed = an account is pinned; auto = the provider rotates accounts). Results may come from a cache up to 60 seconds old; pass refresh=true only when the user explicitly needs up-to-date numbers.",
    parameters: {
     providers: { type: "array", items: { type: "string" }, description: "Optional filter. Either a provider id this tool reports back (\"deepseek\", \"zai-coding-cn\", \"kimi-coding\") or a plain vendor name (\"zai\", \"kimi\", \"mimo\", \"minimax\", \"commandcode\", \"grok\", \"codex\", \"ark\"). Case and separators do not matter; an unmatched name is reported with the full data rather than dropped." },
     refresh: { type: "boolean", description: "Force a fresh fetch instead of the up-to-60s cache. Use only when the user asks for the latest numbers." }
@@ -1402,10 +1645,14 @@ function registerQuotaTool(ctx) {
          coverage: { type: "string", description: "complete | partial" },
          freshness: { type: "string", description: "fresh | stale" },
          lastSuccessAt: { type: "string" },
+         account: { type: "string", description: "Account label this entry reports (Command Code only, when the provider has several accounts)." },
+         accountActive: { type: "boolean", description: "true when this account is the one currently pinned as active (Command Code only)." },
+         accountMode: { type: "string", description: "fixed | auto — whether an account is pinned or the provider rotates accounts (Command Code only)." },
          error: { type: "string", description: "Failure reason when state is error." }
         }
        }
-      }
+      },
+      omitted: { type: "number", description: "How many distinct providers were left out of `providers` (counted by provider id) because detection is off, no credentials are configured, or they reported no quota data. Entries that failed to fetch, and the explanation row for an unrecognized name, are never left out. Only set when nothing was named or no name was recognized." }
      }
     },
     render: (_args, value) => [{ type: "text", text: formatQuotaText(value) }]
@@ -1414,10 +1661,22 @@ function registerQuotaTool(ctx) {
     exec?.signal?.throwIfAborted?.();
     const service = toolCtx.get("subUsage");
     if (!service || typeof service.quota !== "function") throw new Error("dsh-subusage 服务尚未就绪：Host 端可能还在启动或刚更新完还没重启。请稍后重试；持续失败就重启 DSH。");
-    return await service.quota({ providerIds: args?.providers, force: args?.refresh === true });
+    const asked = Array.isArray(args?.providers) ? args.providers.filter(name => typeof name === "string" && name.trim() !== "") : [];
+    const value = await service.quota({ providerIds: args?.providers, force: args?.refresh === true });
+    if (!Array.isArray(value?.providers)) return value;
+    // 点名的家原样保留（用户问的正是它，包括「为什么没数据」）；但**一个名字都没认出来**时，quota()
+    // 会兜底把全量数据一并给出——那次全量仍然要过滤，否则模型拼错一个名字，换来的正是三十条
+    // 未启用条目（本工具最该避免的输出）。认不出的名字自己的说明行照旧保留。
+    const named = new Set(asked.length ? resolveProviderIds(asked).ids : []);
+    const kept = value.providers.filter(entry => named.has(entry.providerId) || !IDS.includes(entry.providerId) || hasQuotaData(entry));
+    // 省略计数按**家**（providerId）去重：多账户的 Command Code 有 N 个未配置账户时报「另有 N 家」是错的。
+    const omitted = new Set(value.providers.filter(entry => !kept.includes(entry)).map(entry => entry.providerId)).size;
+    return omitted ? { ...value, providers: kept, omitted } : { ...value, providers: kept };
    }
   }));
  });
 }
-export { apply, inject, name };
+// IDS / PROVIDERS 仅供双端契约测试（test-contract.mjs）核对 Client 的 PROVIDER_META/PROVIDER_ORDER，
+// 防止新增厂商只改一端：漏改 Host 药丸取不到数、漏改 Client 则设置页与药丸缺项，且都不会报错。
+export { apply, inject, name, IDS, PROVIDERS };
 export default { name, inject, apply };