@event4u/agent-switch 2.3.1 → 2.3.2

package/dist/daemon.js

@@ -24,11 +24,12 @@
  * freshness, suggestion decision in `usage.ts`) are exported for unit testing;
  * `runDaemon` is the loop.
  */
+import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { ROOT, activeFor, configDir, isDisabled, labelFor, listProfiles, readAutoSwitch, readBinaryPath, sharesDefaultLogin } from "./profiles.js";
 import { profileDir } from "./profiles.js";
-import { fetchUsage, liveSessionPids } from "./api.js";
+import { fetchUsage, liveSessionPids, readProfileCredential } from "./api.js";
 import { defaultFreshenDeps, usageToken } from "./token-freshen.js";
 import { parseUsage, detectCrossings, pickSwitchTarget, maxUtilization } from "./usage.js";
 import { readCodexUsage } from "./codex-usage.js";
@@ -89,14 +90,6 @@ export function writeDaemonState(state, file = STATE_FILE) {
     fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
     fs.writeFileSync(file, JSON.stringify(state, null, 2) + "\n", { mode: 0o600 });
 }
-/** True when the state's lastPoll is within maxAgeMs of `now` — the CLI/GUI use
- *  this to decide whether to trust the cache instead of hitting the API. */
-export function isFresh(state, maxAgeMs, now = Date.now()) {
-    if (!state?.lastPoll)
-        return false;
-    const t = Date.parse(state.lastPoll);
-    return !isNaN(t) && now - t <= maxAgeMs;
-}
 // ---------- single instance (pidfile) ----------
 export function processAlive(pid) {
     try {
@@ -182,6 +175,54 @@ export function nextIntervalMs(baseMs, consecutiveFailures, capMs = MAX_BACKOFF_
         return base;
     return Math.min(base * 2 ** consecutiveFailures, capMs);
 }
+/** The profile's backoff after a read — undefined once a read succeeds. */
+export function nextProfileBackoff(prev, ok, baseMs, now, stamp) {
+    if (ok)
+        return undefined;
+    const failures = (prev?.failures ?? 0) + 1;
+    return { failures, nextAt: now + nextIntervalMs(baseMs, failures), ...(stamp !== undefined ? { stamp } : {}) };
+}
+export function backoffBlocks(b, now, stamp) {
+    if (b === undefined)
+        return false;
+    if (b.stamp !== undefined && stamp !== b.stamp)
+        return false;
+    return now < b.nextAt;
+}
+/** A fingerprint of a stored login, so a change can be noticed without the
+ *  service holding on to the credential. */
+export function loginStamp(raw) {
+    return raw === null ? null : crypto.createHash("sha256").update(raw, "utf8").digest("hex").slice(0, 16);
+}
+/** The targets a cycle reads: those not held back by their own backoff. The
+ *  login is read only for a profile that has a backoff entry. */
+export function dueTargets(provider, targets, backoff, now, stampOf) {
+    return targets.filter((n) => {
+        const b = backoff.get(`${provider}/${n}`);
+        return !b || !backoffBlocks(b, now, b.stamp !== undefined ? stampOf(n) : undefined);
+    });
+}
+/** The loop-wide failure count after a cycle: it grows only when every read
+ *  failed (offline, API down) — single failures are handled by
+ *  {@link nextProfileBackoff}. A cycle that read nothing leaves it unchanged. */
+export function nextConsecutiveFailures(prev, failures, attempted) {
+    if (attempted === 0)
+        return prev;
+    return failures >= attempted ? prev + 1 : 0;
+}
+/** How old a cached snapshot may be and still be served instead of a live read:
+ *  the daemon's slowest cadence (an idle account, or its current interval when
+ *  that is longer) plus one loop wake. A healthy daemon answers from cache; a
+ *  profile whose reads keep failing ages out and is read live. */
+export function cacheMaxAgeMs(pollIntervalMs) {
+    return Math.max(POOL_POLL_INTERVAL_MS, pollIntervalMs ?? 0) + MIN_INTERVAL_MS;
+}
+export function snapshotFresh(snap, now = Date.now(), maxAgeMs = cacheMaxAgeMs(undefined)) {
+    if (!snap)
+        return false;
+    const t = Date.parse(snap.capturedAt);
+    return !isNaN(t) && now - t <= maxAgeMs;
+}
 /**
  * Compliance-locked threshold decision (Council follow-up). Given the active
  * profile and the same-provider candidates polled this cycle, decide whether to
@@ -307,20 +348,38 @@ export function monitorContext(provider, name, state, log) {
  *  the number of failures this cycle (for backoff). */
 /** One profile's own usage snapshot: Claude via its OAuth endpoint, Codex via
  *  the live `wham/usage` read. null when unreadable (counts as a poll failure). */
-async function snapshotFor(provider, name) {
+async function snapshotFor(provider, name, log) {
     if (provider === "codex")
         return readCodexUsage(configDir("codex", name));
     // An expired access token is the daemon's most common "usage stopped moving"
     // cause — a profile nobody is running never refreshes itself. Let Claude Code
     // refresh it first (cooldown-guarded, no-op while the token is still good) —
     // never for a profile sharing the default install's login.
-    const token = usageToken(configDir("claude", name), defaultFreshenDeps(readBinaryPath("claude")), sharesDefaultLogin("claude", name));
+    const token = usageToken(configDir("claude", name), defaultFreshenDeps(readBinaryPath("claude")), sharesDefaultLogin("claude", name), (outcome) => {
+        if (outcome === "unavailable")
+            log(`freshen: claude/${name} — could not start \`claude doctor\` (not found on this service's PATH; link it in the app)`);
+        else if (outcome === "still-expired")
+            log(`freshen: claude/${name} — Claude Code could not refresh the login (sign in again)`);
+    });
     if (!token)
         return null;
     const raw = await fetchUsage(token);
     return raw ? parseUsage(raw) : null;
 }
-async function pollProvider(provider, state, thresholds, notifiedReset, log) {
+/** The stored login behind a profile, fingerprinted: Claude's credential
+ *  store, Codex's auth.json. Read after a failure, so a refresh the failed
+ *  read already triggered counts as the baseline, not as a change. */
+function loginStampFor(provider, name) {
+    if (provider === "claude")
+        return loginStamp(readProfileCredential(configDir("claude", name)));
+    try {
+        return loginStamp(fs.readFileSync(path.join(configDir(provider, name), "auth.json"), "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+async function pollProvider(provider, state, thresholds, notifiedReset, backoff, baseMs, log) {
     const names = listProfiles(provider).filter((n) => !isDisabled(provider, n));
     const active = activeFor(provider);
     const autoSwitch = readAutoSwitch(provider);
@@ -332,14 +391,19 @@ async function pollProvider(provider, state, thresholds, notifiedReset, log) {
         const t = Date.parse(state.profiles[`${provider}/${n}`]?.capturedAt ?? "");
         return isNaN(t) ? null : t;
     };
-    const targets = selectPollTargets(names, active, isLive, autoSwitch.enabled, pooled, lastCaptured);
+    const targets = dueTargets(provider, selectPollTargets(names, active, isLive, autoSwitch.enabled, pooled, lastCaptured), backoff, Date.now(), (n) => loginStampFor(provider, n));
     let failures = 0;
     const polled = [];
     state.notifiedFetchFail = state.notifiedFetchFail ?? {};
     state.fetchFailingSince = state.fetchFailingSince ?? {};
     for (const name of targets) {
         const key = `${provider}/${name}`;
-        const snapshot = await snapshotFor(provider, name);
+        const snapshot = await snapshotFor(provider, name, log);
+        const nextBackoff = snapshot ? undefined : nextProfileBackoff(backoff.get(key), false, baseMs, Date.now(), loginStampFor(provider, name));
+        if (nextBackoff)
+            backoff.set(key, nextBackoff);
+        else
+            backoff.delete(key);
         if (!snapshot) {
             failures++;
             // Fail-safe: the last-known snapshot in state.profiles[key] is left intact
@@ -388,12 +452,13 @@ async function pollProvider(provider, state, thresholds, notifiedReset, log) {
     // profile even when the usage API poll failed (expired token, offline).
     if (active)
         monitorContext(provider, active, state, log);
+    const result = { failures, attempted: targets.length };
     if (!autoSwitch.enabled || !active)
-        return failures;
+        return result;
     const activeSnap = polled.find((p) => p.name === active)?.snapshot;
     const activeMax = activeSnap ? maxUtilization(activeSnap) : null;
     if (activeMax === null || activeMax < autoSwitch.threshold)
-        return failures; // still has headroom
+        return result; // still has headroom
     // Codex only (banked resets are a Codex feature): a reset credit is scarce and
     // redeeming it is the user's call (D3) — the daemon only says one is there,
     // once per reset cycle, and never calls the redeem endpoint itself.
@@ -429,16 +494,18 @@ async function pollProvider(provider, state, thresholds, notifiedReset, log) {
             message: `${provider}/${active} hit ≥${autoSwitch.threshold}% — suggested profile: ${provider}/${target}. ${how}`,
         });
     }
-    return failures;
+    return result;
 }
-async function pollOnce(state, thresholds, notifiedReset, log) {
-    let failures = 0;
+async function pollOnce(state, thresholds, notifiedReset, backoff, baseMs, log) {
+    const total = { failures: 0, attempted: 0 };
     for (const provider of AUTO_PROVIDERS) {
-        failures += await pollProvider(provider, state, thresholds, notifiedReset, log);
+        const r = await pollProvider(provider, state, thresholds, notifiedReset, backoff, baseMs, log);
+        total.failures += r.failures;
+        total.attempted += r.attempted;
     }
     state.lastPoll = new Date().toISOString();
-    state.lastError = failures > 0 ? `${failures} profile(s) failed to poll` : null;
-    return failures;
+    state.lastError = total.failures > 0 ? `${total.failures} profile(s) failed to poll` : null;
+    return total;
 }
 /** Run the daemon loop. Single-instance; SIGTERM-clean. */
 export async function runDaemon(opts = {}) {
@@ -469,13 +536,14 @@ export async function runDaemon(opts = {}) {
     // `<provider>/<name>` → the window resets_at we last announced a banked reset
     // for, so the "reset available" notice fires once per cycle, not every poll.
     const notifiedReset = new Map();
+    const backoff = new Map();
     let consecutiveFailures = 0;
     let cycles = 0;
     log(`started (pid ${process.pid}, base interval ${baseInterval}ms).`);
     while (running) {
         try {
-            const failures = await pollOnce(state, thresholds, notifiedReset, log);
-            consecutiveFailures = failures > 0 ? consecutiveFailures + 1 : 0;
+            const { failures, attempted } = await pollOnce(state, thresholds, notifiedReset, backoff, baseInterval, log);
+            consecutiveFailures = nextConsecutiveFailures(consecutiveFailures, failures, attempted);
         }
         catch (err) {
             consecutiveFailures++;

package/dist/index.js

@@ -47,7 +47,7 @@ import { formatSnapshot, parseUsage } from "./usage.js";
 import { readCodexUsage } from "./codex-usage.js";
 import { redeemResetCredit } from "./codex-reset.js";
 import { assertValidSessionId, cleanupForkVehicle, codexSessionCommand, deleteSession, detectRunningClaudeProfile, listSessions, listCodexSessions, locateSession, locateCodexSession, markLive, openQuestion, restoreSession, sharedHistory, sweepTrash, transferSession, transferCodexSession, trashedSessionExists, } from "./sessions.js";
-import { isFresh, readDaemonState, readPid, PIDFILE, processAlive } from "./daemon.js";
+import { cacheMaxAgeMs, snapshotFresh, readDaemonState, readPid, PIDFILE, processAlive } from "./daemon.js";
 import { cmdService, serviceAfterUpdate, serviceInstall, serviceInstallFromDisk, serviceTarget, serviceUninstall } from "./service.js";
 import { fileURLToPath } from "node:url";
 import { readContext, turnInFlight } from "./telemetry.js";
@@ -456,14 +456,13 @@ function cmdWhoami(providerId, name) {
  *  credential is unreadable or the API shape is unknown. Codex/Antigravity have no
  *  usage readout (verified), so this is Claude-only. */
 async function claudeSnapshot(name) {
-    // Prefer the daemon's cache when it's fresh (< its own poll interval) — the
-    // daemon is a cache, and the CLI works with or without it.
+    // Prefer the daemon's cache while THIS profile's snapshot is fresh — the
+    // daemon is a cache, and the CLI works with or without it. The age of the
+    // last poll says nothing about a profile whose reads have been failing.
     const state = readDaemonState();
-    if (state && isFresh(state, state.pollIntervalMs)) {
-        const cached = state.profiles[`claude/${name}`];
-        if (cached)
-            return cached;
-    }
+    const cached = state?.profiles?.[`claude/${name}`];
+    if (snapshotFresh(cached, Date.now(), cacheMaxAgeMs(state?.pollIntervalMs)))
+        return cached;
     const token = usageToken(configDir("claude", name), defaultFreshenDeps(readBinaryPath("claude")), sharesDefaultLogin("claude", name));
     if (!token)
         return null;

package/dist/providers.js

@@ -139,18 +139,30 @@ export function provider(id) {
 export function allProviders() {
     return PROVIDER_IDS.map((id) => PROVIDERS[id]);
 }
-/** Where an installer may drop a binary off the default PATH. Some CLIs (e.g.
- *  agy, installed via `curl … | bash`) land in ~/.local/bin, which a GUI app's
- *  minimal PATH frequently omits. */
-function localBinary(binary) {
-    return path.join(os.homedir(), ".local", "bin", binary);
+/**
+ * Where an installer may drop a binary off the minimal PATH a GUI app (and the
+ * service it starts) runs with on macOS — `/usr/bin:/bin:/usr/sbin:/sbin`.
+ * ~/.local/bin (e.g. agy via `curl … | bash`) first, then Homebrew on Apple
+ * silicon and Intel. The first existing path, or null.
+ */
+export function offPathBinary(binary, home = os.homedir(), exists = fs.existsSync, platform = process.platform) {
+    const p = platform === "win32" ? path.win32 : path.posix;
+    const dirs = [p.join(home, ".local", "bin")];
+    if (platform !== "win32")
+        dirs.push("/opt/homebrew/bin", "/usr/local/bin");
+    for (const dir of dirs) {
+        const file = p.join(dir, binary);
+        if (exists(file))
+            return file;
+    }
+    return null;
 }
 /**
  * Resolve a CLI binary to an invocable command: a user-linked path when set and
  * present (the CLI is not on PATH but the user pointed us at it), otherwise its
- * bare name when it is on PATH, otherwise its ~/.local/bin path when the binary
- * lives there (GUI apps often run with a minimal PATH that omits it), otherwise
- * the bare name so the caller surfaces a clean "not found" error.
+ * bare name when it is on PATH, otherwise its path in one of the
+ * {@link offPathBinary} dirs, otherwise the bare name so the caller surfaces a
+ * clean "not found" error.
  */
 export function resolveBinary(binary, linked) {
     if (linked && fs.existsSync(linked))
@@ -158,14 +170,13 @@ export function resolveBinary(binary, linked) {
     const probe = spawnSync(binary, ["--version"], { stdio: "ignore", timeout: 5000 });
     if (probe.error?.code !== "ENOENT")
         return binary;
-    const local = localBinary(binary);
-    return fs.existsSync(local) ? local : binary;
+    return offPathBinary(binary) ?? binary;
 }
 /**
  * Best-effort: is this provider's CLI binary usable? True when a user-linked
  * path is set and present, else when `<binary> --version` resolves on PATH
  * (only ENOENT counts as not-installed — a non-zero exit or a timeout still
- * means the binary exists), else when it lives in ~/.local/bin. Used to gate
+ * means the binary exists), else when it lives in an {@link offPathBinary} dir. Used to gate
  * enabling a provider the user hasn't installed (or hasn't linked).
  */
 export function isProviderInstalled(id, linked) {
@@ -175,5 +186,5 @@ export function isProviderInstalled(id, linked) {
     const probe = spawnSync(bin, ["--version"], { stdio: "ignore", timeout: 5000 });
     if (probe.error?.code !== "ENOENT")
         return true;
-    return fs.existsSync(localBinary(bin));
+    return offPathBinary(bin) !== null;
 }

package/dist/telemetry.js

@@ -43,6 +43,10 @@ export const SUPPORTED_CLAUDE = ["2.1"];
  *  tokens, never guess a percentage). User overrides via state.json merge on
  *  top. Codex needs no table — its rollout carries model_context_window. */
 export const CONTEXT_WINDOWS = {
+    "claude-fable-5-1": 1_000_000,
+    "claude-opus-5-5": 1_000_000,
+    "claude-sonnet-5-5": 1_000_000,
+    "claude-haiku-5-5": 200_000,
     "claude-fable-5": 1_000_000,
     "claude-opus-4-8": 1_000_000,
     "claude-opus-4-7": 1_000_000,

package/dist/token-freshen.js

@@ -96,14 +96,24 @@ function recordAttemptFile(configDir, at) {
         /* best-effort: a missing stamp only costs an extra attempt */
     }
 }
+/**
+ * The PATH `claude doctor` runs with: the resolved binary's dir and this node's
+ * dir ahead of the inherited PATH. An npm-installed `claude` is a
+ * `#!/usr/bin/env node` script, and the service's minimal PATH has no node.
+ */
+export function doctorPath(bin, execPath, inherited) {
+    const dirs = [path.isAbsolute(bin) ? path.dirname(bin) : null, path.dirname(execPath), ...(inherited ?? "").split(path.delimiter)];
+    return [...new Set(dirs.filter((d) => !!d))].join(path.delimiter);
+}
 /**
  * `claude doctor` against one profile's config dir. stdout/stderr are dropped —
  * this is a side-effect call, not a readout. Any completed run returns true;
  * whether the token actually got refreshed is decided by re-reading the store.
  */
 function runClaudeDoctor(configDir, linkedBinary) {
-    const res = spawnSync(resolveBinary("claude", linkedBinary), ["doctor"], {
-        env: { ...process.env, CLAUDE_CONFIG_DIR: configDir },
+    const bin = resolveBinary("claude", linkedBinary);
+    const res = spawnSync(bin, ["doctor"], {
+        env: { ...process.env, CLAUDE_CONFIG_DIR: configDir, PATH: doctorPath(bin, process.execPath, process.env.PATH) },
         // Claude Code reads settings from the CWD; run it somewhere neutral so a
         // project's config can never influence a background health check.
         cwd: os.tmpdir(),
@@ -147,8 +157,9 @@ export function freshenToken(configDir, deps = defaultFreshenDeps()) {
  * no readable credential at all); a freshen that could not heal the login just
  * means the caller's read fails as it did before.
  */
-export function freshAccessToken(configDir, deps = defaultFreshenDeps()) {
-    freshenToken(configDir, deps);
+export function freshAccessToken(configDir, deps = defaultFreshenDeps(), onOutcome) {
+    const outcome = freshenToken(configDir, deps);
+    onOutcome?.(outcome);
     const creds = deps.readCredential(configDir);
     return creds ? accessTokenOf(creds) : null;
 }
@@ -157,9 +168,9 @@ export function freshAccessToken(configDir, deps = defaultFreshenDeps()) {
  * install (seeded by `import`) is never refreshed: whichever side refreshes
  * first invalidates the other, so its stored token is used only while valid.
  */
-export function usageToken(configDir, deps, sharesDefaultLogin) {
+export function usageToken(configDir, deps, sharesDefaultLogin, onOutcome) {
     if (!sharesDefaultLogin)
-        return freshAccessToken(configDir, deps);
+        return freshAccessToken(configDir, deps, onOutcome);
     const creds = deps.readCredential(configDir);
     return creds && !needsFreshen(creds, deps.now(), deps.bufferMs) ? accessTokenOf(creds) : null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@event4u/agent-switch",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "description": "Switch between multiple Claude Code accounts on macOS, Linux, and Windows via isolated CLAUDE_CONFIG_DIR profiles",
   "repository": {
     "type": "git",