@genee/omp-opsx-addon 0.5.0 → 0.7.0

package/lib/pipe-core.ts

@@ -11,8 +11,9 @@
 // The broker-id is the primary session id (`ctx.sessionManager.getSessionId()`).
 // This module implements the CORE only: directory layout, presence heartbeat,
 // roster mirroring, the file mbox protocol (with the single shared `consume()`
-// primitive), four LLM tools, and background GC. The `deliver` field is
-// defined, validated, and stored — NEVER injected (injection is the scope of
+// primitive), four LLM tools, and background GC. `to.broker: "all"` is reserved
+// for online-peer fanout (never a literal mbox/all/ slot). The `deliver` field
+// is defined, validated, and stored — NEVER injected (injection is the scope of
 // opsx-pipe-push).
 import { promises as fs } from 'fs';
 import { join } from 'path';
@@ -237,6 +238,13 @@ export interface SendInput {
 export async function sendMessage(root: string, input: SendInput): Promise<PipeMessage> {
     assertBrokerId(input.fromBroker, 'from.broker');
     assertBrokerId(input.toBroker, 'to.broker');
+    // "all" is reserved for broadcast fanout (see {@link broadcastMessage});
+    // never land a literal mbox/all/ dead-letter slot.
+    if (input.toBroker === 'all') {
+        throw new Error(
+            'to.broker "all" is reserved for broadcast fanout; refuse to write mbox/all/',
+        );
+    }
     assertBody(input.body);
     if (input.toSession !== undefined && typeof input.toSession !== 'string') {
         throw new Error('to.session must be a string when provided');
@@ -265,6 +273,38 @@ export async function sendMessage(root: string, input: SendInput): Promise<PipeM
     return msg;
 }
 
+/**
+ * Fan out one outbound body to every currently-online broker except the
+ * sender. Online = presence mtime within {@link PRESENCE_TTL_MS} (same filter
+ * as opsx_pipe_list). Each recipient gets its own msg-id / mbox file; nothing
+ * is written to a literal `mbox/all/` slot. `to.session` is rejected (a
+ * broadcast has no single last-mile session).
+ */
+export async function broadcastMessage(
+    root: string,
+    input: Omit<SendInput, 'toBroker' | 'toSession' | 'id'>,
+): Promise<PipeMessage[]> {
+    assertBrokerId(input.fromBroker, 'from.broker');
+    assertBody(input.body);
+    const online = await listBrokers(root);
+    const targets = online.map((b) => b.broker).filter((id) => id !== input.fromBroker);
+    const out: PipeMessage[] = [];
+    for (const toBroker of targets) {
+        out.push(
+            await sendMessage(root, {
+                fromBroker: input.fromBroker,
+                toBroker,
+                deliver: input.deliver,
+                type: input.type,
+                body: input.body,
+                replyTo: input.replyTo,
+                ts: input.ts,
+            }),
+        );
+    }
+    return out;
+}
+
 // Process-internal idempotency: consumed msg-ids per (root, broker). Cross-
 // process, the atomic rename guarantees a single consumer wins a given file;
 // worst case a redelivered id surfaces once per process (at-least-once).
@@ -659,11 +699,18 @@ export function registerPipeCore(pi: ExtensionAPI): void {
         name: 'opsx_pipe_send',
         label: 'Pipe: send message',
         description:
-            'Fire-and-forget a text message to another broker\'s mbox (same semantics as hub send). Validates the deliver field { mode: steer|followUp|nextTurn, triggerTurn } (defaults followUp/true); core stores but never injects it. body is capped at 32KB.',
+            'Fire-and-forget a text message to another broker\'s mbox (same semantics as hub send). `to.broker: "all"` fans out to every currently-online peer (excludes self; no mbox/all/ dead letter). Validates the deliver field { mode: steer|followUp|nextTurn, triggerTurn } (defaults followUp/true); core stores but never injects it. body is capped at 32KB.',
         parameters: z.object({
             to: z.object({
-                broker: z.string().describe('Target broker id (a primary session id; see opsx_pipe_list)'),
-                session: z.string().optional().describe('Optional target agent/session for hub relay'),
+                broker: z
+                    .string()
+                    .describe(
+                        'Target broker id (a primary session id; see opsx_pipe_list), or "all" to fan out to every other online broker',
+                    ),
+                session: z
+                    .string()
+                    .optional()
+                    .describe('Optional target agent/session for hub relay (not allowed with broker "all")'),
             }),
             deliver: z
                 .object({
@@ -685,6 +732,29 @@ export function registerPipeCore(pi: ExtensionAPI): void {
             // explicitly. normalizeDeliver re-validates deliver at runtime.
             const p = params as SendToolParams;
             const state = await ensureBrokerStarted(ctx);
+            if (p.to.broker === 'all') {
+                if (p.to.session !== undefined) {
+                    throw new Error('to.session is not supported with to.broker "all"');
+                }
+                const messages = await broadcastMessage(state.root, {
+                    fromBroker: state.brokerId,
+                    deliver: p.deliver,
+                    type: p.type,
+                    body: p.body,
+                    replyTo: p.replyTo,
+                });
+                const targets = messages.map((m) => m.to.broker);
+                return textResult(
+                    messages.length === 0
+                        ? 'Broadcast to all: no other online brokers.'
+                        : `Broadcast ${messages.length} message(s) to: ${targets.join(', ')}`,
+                    {
+                        broadcast: true,
+                        ids: messages.map((m) => m.id),
+                        to: targets,
+                    },
+                );
+            }
             const msg = await sendMessage(state.root, {
                 fromBroker: state.brokerId,
                 toBroker: p.to.broker,

package/lib/pipe-push.ts

@@ -15,6 +15,16 @@
 //
 // No self-built queue: steer/followUp/nextTurn ordering and idle wake-ups
 // are entirely the harness's native deliverAs/triggerTurn semantics.
+//
+// One deliberate deviation: while the session is mid-turn AND parked in an
+// interruptible wait (hub `wait`, or hub `logs` with follow — the only tool
+// calls the harness aborts on a steer, see the hub tool's interruptible
+// predicate), a followUp is upgraded to steer. A followUp otherwise drains
+// only at the turn's yield boundary (minutes away when the model is parked
+// waiting on peers); a steer aborts the in-flight wait and is fed to the
+// model before its next request. Every other busy state (model streaming,
+// bash, ask, extension tools) keeps native followUp semantics — a steer
+// there cannot preempt the running tool anyway.
 import { promises as fs, watch } from 'fs';
 import { join } from 'path';
 import type { ExtensionAPI, ExtensionContext } from '@oh-my-pi/pi-coding-agent';
@@ -103,6 +113,44 @@ function isPipeMessage(value: unknown): value is PipeMessage {
     return typeof from.broker === 'string' && typeof to.broker === 'string';
 }
 
+// ── busy-wait detection (followUp → steer upgrade) ───────────────────
+
+/** In-flight tool call tracked for upgrade purposes: the only predicate that
+ *  matters is whether a steer aborts it mid-flight. The harness's hub tool
+ *  declares exactly two such calls (its `interruptible` predicate):
+ *  `hub {op:"wait"}` and `hub {op:"logs", follow:true}`. */
+interface TrackedTool {
+    toolName: string;
+    args?: unknown;
+}
+
+/** Per-broker view of session liveness, fed by turn_start/turn_end and
+ *  tool_execution_start/end events. A broker is "busy-waiting" when a turn
+ *  is open AND at least one in-flight tool call is an interruptible wait. */
+export interface BusyState {
+    inTurn: boolean;
+    tools: Map<string, TrackedTool>;
+}
+
+function isInterruptibleWait(tool: TrackedTool): boolean {
+    if (tool.toolName !== 'hub') return false;
+    const args = (tool.args ?? {}) as { op?: unknown; follow?: unknown };
+    if (args.op === 'wait') return true;
+    return args.op === 'logs' && args.follow === true;
+}
+
+/** True while the session is mid-turn and parked in an interruptible wait:
+ *  the one busy state where delivering as steer (instead of followUp) makes
+ *  the message reach the model before the turn yields. */
+export function isBusyWaiting(state: BusyState): boolean {
+    if (!state.inTurn) return false;
+
+    for (const tool of state.tools.values()) {
+        if (isInterruptibleWait(tool)) return true;
+    }
+    return false;
+}
+
 // ── per-broker runtime state ─────────────────────────────────────────
 
 interface PushState {
@@ -110,6 +158,8 @@ interface PushState {
     root: string;
     /** Stop-injection flag; default false = injection enabled. */
     muted: boolean;
+    /** Session liveness for the followUp→steer upgrade (see isBusyWaiting). */
+    busy: BusyState;
     watcher?: WatchHandle;
     /** True once the watcher failed; the 30s tick then carries all scans. */
     degraded: boolean;
@@ -136,9 +186,18 @@ function setOwner(brokerId: string | undefined): void {
  * Inject one message via pi.sendMessage (custom entry, never spoofed as a
  * human). deliver.mode maps 1:1 to deliverAs; triggerTurn is passed through;
  * missing deliver defaults to followUp/true (core normalizeDeliver).
+ *
+ * Upgrade: a followUp landing while the session is busy-waiting (mid-turn,
+ * parked in an interruptible hub wait) is delivered as steer instead. The
+ * steer aborts the wait so the model sees this message at its next request
+ * rather than after the whole turn yields. steer/nextTurn pass through
+ * untouched — a sender that asked for steer wants it everywhere; nextTurn is
+ * explicitly deferred by the sender.
  */
-async function injectMessage(msg: PipeMessage, send: SendFn): Promise<void> {
+async function injectMessage(msg: PipeMessage, state: PushState, send: SendFn): Promise<void> {
     const deliver = normalizeDeliver(msg.deliver);
+    const upgraded = deliver.mode === 'followUp' && isBusyWaiting(state.busy);
+    const deliverAs: DeliverMode = upgraded ? 'steer' : deliver.mode;
     await Promise.resolve(
         send(
             {
@@ -153,9 +212,10 @@ async function injectMessage(msg: PipeMessage, send: SendFn): Promise<void> {
                     ts: msg.ts,
                     ...(msg.replyTo ? { replyTo: msg.replyTo } : {}),
                     deliver,
+                    ...(upgraded ? { upgradedToSteer: true } : {}),
                 },
             },
-            { deliverAs: deliver.mode, triggerTurn: deliver.triggerTurn },
+            { deliverAs, triggerTurn: deliver.triggerTurn },
         ),
     );
 }
@@ -196,7 +256,7 @@ export async function scanOnce(state: PushState, send: SendFn): Promise<{ scanne
         if (!msg) continue; // corrupt: removed by the claim step, never injected
         state.seen.add(id);
         try {
-            await injectMessage(msg, send);
+            await injectMessage(msg, state, send);
             injected += 1;
         } catch {
             // Injection failed: do NOT claim — the file stays for the next
@@ -227,7 +287,7 @@ export async function scanOnce(state: PushState, send: SendFn): Promise<{ scanne
                 // file is valid (consume parsed it) — deliver it now.
                 state.seen.add(m.id);
                 try {
-                    await injectMessage(m, send);
+                    await injectMessage(m, state, send);
                     injected += 1;
                 } catch {
                     state.seen.delete(m.id);
@@ -294,6 +354,7 @@ export async function startPipePush(
         brokerId,
         root,
         muted: false,
+        busy: { inTurn: false, tools: new Map() },
         degraded: false,
         seen: new Set(),
         scanChain: Promise.resolve(),
@@ -357,6 +418,14 @@ export function isMuted(brokerId: string): boolean {
     return states.get(brokerId)?.muted ?? false;
 }
 
+/** Resolve the push state for the ExtensionContext's session, if any.
+ *  Subagent sessions share the process but never own a PushState, so their
+ *  turn/tool events are ignored (no state → no-op). */
+function stateForCtx(ctx: ExtensionContext): PushState | undefined {
+    const brokerId = ctx.sessionManager?.getSessionId?.() ?? '';
+    return brokerId ? states.get(brokerId) : undefined;
+}
+
 // ── plugin wiring ────────────────────────────────────────────────────
 
 export function registerPipePush(pi: ExtensionAPI): void {
@@ -424,6 +493,36 @@ export function registerPipePush(pi: ExtensionAPI): void {
             /* best-effort */
         }
     });
+
+    // Busy-wait tracking: only the owning primary session has PushState, so
+    // subagent turn/tool events (different session id) are no-ops. turn_end
+    // clears the whole tools map in case a tool_execution_end was missed
+    // (e.g. abort mid-batch).
+    pi.on('turn_start', (_event, ctx) => {
+        const state = stateForCtx(ctx);
+        if (!state) return;
+        state.busy.inTurn = true;
+    });
+    pi.on('turn_end', (_event, ctx) => {
+        const state = stateForCtx(ctx);
+        if (!state) return;
+        state.busy.inTurn = false;
+        state.busy.tools.clear();
+    });
+    pi.on('tool_execution_start', (event, ctx) => {
+        const state = stateForCtx(ctx);
+        if (!state) return;
+        const e = event as { toolCallId?: string; toolName?: string; args?: unknown };
+        if (!e.toolCallId || !e.toolName) return;
+        state.busy.tools.set(e.toolCallId, { toolName: e.toolName, args: e.args });
+    });
+    pi.on('tool_execution_end', (event, ctx) => {
+        const state = stateForCtx(ctx);
+        if (!state) return;
+        const e = event as { toolCallId?: string };
+        if (!e.toolCallId) return;
+        state.busy.tools.delete(e.toolCallId);
+    });
 }
 
 // ── test-only reset ──────────────────────────────────────────────────
@@ -441,6 +540,20 @@ export function _getStateForTest(brokerId: string): PushState | undefined {
     return states.get(brokerId);
 }
 
+/** Test seam: overwrite busy-wait tracking for a broker (scanOnce upgrade tests). */
+export function _setBusyForTest(
+    brokerId: string,
+    busy: { inTurn: boolean; tools?: Array<{ toolCallId: string; toolName: string; args?: unknown }> },
+): void {
+    const state = states.get(brokerId);
+    if (!state) throw new Error(`_setBusyForTest: no state for ${brokerId}`);
+    state.busy.inTurn = busy.inTurn;
+    state.busy.tools.clear();
+    for (const t of busy.tools ?? []) {
+        state.busy.tools.set(t.toolCallId, { toolName: t.toolName, args: t.args });
+    }
+}
+
 /** Test seam: await the settled scan chain (doorbell/tick scans are async). */
 export async function _flushForTest(brokerId: string): Promise<void> {
     const state = states.get(brokerId);
@@ -457,6 +570,7 @@ export async function _makeStateForTest(brokerId: string, cwd: string): Promise<
         brokerId,
         root,
         muted: false,
+        busy: { inTurn: false, tools: new Map() },
         degraded: true, // no watcher in this harness
         seen: new Set(),
         scanChain: Promise.resolve(),

package/lib/usage-poller.ts

@@ -177,10 +177,29 @@ const unconfirmedProviders = new Set<string>();
  * reads would re-add the provider to {@link unconfirmedProviders} and hammer it.
  */
 const confirmedThisProcess = new Set<string>();
+/**
+ * Timestamp of the most recent fetch that actually delivered a report per
+ * provider (canonical id → epoch ms). This — NOT `lastFetchedByProvider`,
+ * which a successful-but-empty fetch also advances for TTL — is the local
+ * timestamp used by the locked fetch-file LWW merge, so a null fetch after a
+ * prior confirmation can never pair a stale in-memory report with a fresh
+ * attempt timestamp and clobber a newer report another broker just wrote.
+ */
+const confirmedAtByProvider = new Map<string, number>();
 /** Canonical ids of providers covered by a direct fetcher (the fresh source). */
 const directFetcherIds = new Set<string>();
 let cachedReports: UsageReport[] = [];
 let cachedHealth: Map<string, ProviderHealth> = new Map();
+/**
+ * Most recently computed logged-in provider universe (start sequence + every
+ * data tick). The 1s render path (`getSharedUsage`) has no auth context of its
+ * own, so it filters the on-disk union through THIS cached set: reports for
+ * providers this broker is not logged into never leak into the widget even
+ * though the shared fetch file retains them for other brokers. `null` = poller
+ * never started (tests / direct callers) → no filtering, matching the legacy
+ * unfiltered behavior.
+ */
+let lastLoggedInSet: ReadonlySet<string> | null = null;
 /** Single interval: renders every tick AND checks absolute elapsed time for the data refresh. */
 let renderTimer: NodeJS.Timeout | null = null;
 /**
@@ -653,16 +672,51 @@ function writeRealtimeDisk(deltas: Record<string, ProviderUsageTotals>): boolean
 }
 
 /**
- * Fetch write path: serializes the in-memory fetch mirror under the same lock
- * protocol. Never reads or rewrites the realtime aggregates.
+ * Fetch write path — a LOCKED read-modify-write (same lock protocol as
+ * {@link writeRealtimeDisk}): inside the lock we re-read the freshest on-disk
+ * fetch file and merge this process's contributions on top.
+ *
+ * Merge scope is ONLY the providers THIS process actually CONFIRMED with a
+ * fresh report (`confirmedThisProcess`). `lastFetchedByProvider` also holds
+ * entries for fetches that succeeded WITHOUT a report (TTL advancement only —
+ * those never land in `confirmedThisProcess`) and entries seeded from disk;
+ * iterating it would write phantom timestamp-only entries and overwrite
+ * possibly-newer disk reports with stale in-memory ones.
+ *
+ * Per confirmed provider, last-writer-wins by millisecond timestamp: this
+ * process's report replaces (or inserts) the disk entry only when its
+ * CONFIRMED timestamp (`confirmedAtByProvider` — the fetch that actually
+ * delivered THIS report; a later null fetch does not advance it) is `>=` the
+ * disk timestamp for that provider; the `fetchedByProvider` entry is written
+ * ONLY when the report is actually written. Providers present on disk but not
+ * written this cycle
+ * (other brokers' providers, unconfirmed fetches, seeded reports) are
+ * preserved verbatim — the shared file is the cross-broker UNION and is never
+ * pruned (see {@link pruneDisconnected}, in-memory only). `fetchedAt` is the
+ * max across disk and this process's timestamps. Never reads or rewrites the
+ * realtime aggregates.
  */
 function writeFetchDisk(): boolean {
-    const fetchedByProvider: Record<string, number> = {};
-    for (const [p, t] of lastFetchedByProvider) fetchedByProvider[p] = t;
-    return writeFetchPayload({
-        fetchedAt: globalFetchedAt(),
-        reports: cachedReports,
-        fetchedByProvider,
+    return writePayloadLocked(resolveFetchFile(), () => {
+        const disk = readFetchDisk() ?? { fetchedAt: 0, reports: [] as UsageReport[], fetchedByProvider: {} as Record<string, number> };
+        const fetchedByProvider: Record<string, number> = { ...(disk.fetchedByProvider ?? {}) };
+        // Base: disk reports keyed by CANONICAL provider id (readFetchDisk
+        // canonicalizes disk ids; normalize defensively for the map key).
+        const reportsById = new Map<string, UsageReport>();
+        for (const r of disk.reports) reportsById.set(canonicalizeProvider(r.provider), r);
+
+        let fetchedAt = disk.fetchedAt ?? 0;
+        for (const provider of confirmedThisProcess) {
+            const localTs = confirmedAtByProvider.get(provider) ?? 0;
+            const diskTs = fetchedByProvider[provider] ?? 0;
+            if (localTs < diskTs) continue; // disk is newer — keep its report/timestamp
+            const report = cachedReports.find((r) => r.provider === provider);
+            if (!report) continue; // confirmed but no in-memory report: defensive skip
+            reportsById.set(provider, report);
+            fetchedByProvider[provider] = localTs;
+            if (localTs > fetchedAt) fetchedAt = localTs;
+        }
+        return JSON.stringify({ fetchedAt, reports: [...reportsById.values()], fetchedByProvider }, null, 2);
     });
 }
 
@@ -825,30 +879,36 @@ function seedFromDisk(loggedInProviders?: ReadonlySet<string>): void {
         for (const r of reports) lastFetchedByProvider.set(r.provider, disk.fetchedAt);
     }
 }
-/** Remove stale in-memory AND on-disk cached data for any provider NOT in `loggedIn`. */
+/**
+ * Trim THIS process's in-memory caches to the logged-in universe:
+ * dirtyProviders / lastAttemptByProvider / lastFetchedByProvider /
+ * unconfirmedProviders / confirmedThisProcess(+confirmedAtByProvider) /
+ * cachedReports(+health) for any
+ * provider NOT in `loggedIn`. Memory/display semantics ONLY — the shared fetch
+ * file is the cross-broker UNION of provider reports, so this MUST NOT write
+ * back or delete any disk entry (another broker may own the pruned provider).
+ */
 function pruneDisconnected(loggedIn: ReadonlySet<string>): void {
-    let removed = false;
     for (const key of dirtyProviders) {
-        if (!loggedIn.has(key)) { dirtyProviders.delete(key); removed = true; }
+        if (!loggedIn.has(key)) dirtyProviders.delete(key);
     }
     for (const key of lastAttemptByProvider.keys()) {
-        if (!loggedIn.has(key)) { lastAttemptByProvider.delete(key); removed = true; }
+        if (!loggedIn.has(key)) lastAttemptByProvider.delete(key);
     }
     for (const key of lastFetchedByProvider.keys()) {
-        if (!loggedIn.has(key)) { lastFetchedByProvider.delete(key); removed = true; }
+        if (!loggedIn.has(key)) lastFetchedByProvider.delete(key);
     }
     for (const key of unconfirmedProviders) {
-        if (!loggedIn.has(key)) { unconfirmedProviders.delete(key); removed = true; }
+        if (!loggedIn.has(key)) unconfirmedProviders.delete(key);
     }
     for (const key of confirmedThisProcess) {
-        if (!loggedIn.has(key)) { confirmedThisProcess.delete(key); removed = true; }
+        if (!loggedIn.has(key)) {
+            confirmedThisProcess.delete(key);
+            confirmedAtByProvider.delete(key);
+        }
     }
-    const next = cachedReports.filter((r) => loggedIn.has(r.provider));
-    removed = removed || next.length !== cachedReports.length;
-    cachedReports = next;
+    cachedReports = cachedReports.filter((r) => loggedIn.has(r.provider));
     cachedHealth = buildHealthMap(cachedReports);
-    // Persist only when something was actually dropped — the 5s sync tick must
-    if (removed) writeFetchDisk();
 }
 /** Merge `incoming` into `existing` by canonical provider id (incoming wins). */
 function mergeReports(existing: UsageReport[], incoming: UsageReport[]): UsageReport[] {
@@ -914,6 +974,11 @@ async function fetchProvider(
             // Fresh report landed → the provider's health is CONFIRMED.
             unconfirmedProviders.delete(canonical);
             confirmedThisProcess.add(canonical);
+            // The timestamp bound to THIS report — the LWW clock for the
+            // locked fetch-file merge. NOT updated by the null-report branch
+            // below (which advances lastFetchedByProvider for TTL only), so a
+            // later empty fetch cannot overwrite a newer disk report.
+            confirmedAtByProvider.set(canonical, fetchedAt);
         } else {
             // Fetch produced nothing for this provider: any existing report is
             // UNCONFIRMED (possibly stale) — keep it for display, but flag it so
@@ -1061,12 +1126,26 @@ export async function startSharedPoller(
 
         // One-time migration from the legacy single cache file (idempotent).
         migrateLegacyCache();
-        const loggedInSet = new Set(getLoggedInProviders(authStorage, directFetchers));
         setDirectFetcherCoverage(directFetchers);
-        syncFromDisk(loggedInSet);
-        seedFromDisk(loggedInSet);
+        // Logged-in universe: recomputed at start AND on every data tick — it
+        // is a cheap local enumeration (authStorage.list + local credential
+        // probes, no network), so a provider whose credentials appear AFTER
+        // poller start (late authStorage, env credential, runtime login)
+        // enters the universe next tick instead of being pruned forever and
+        // oscillating against the broker that owns it. Each recompute also
+        // refreshes `lastLoggedInSet`, the cached filter the 1s render path
+        // (getSharedUsage) applies to the on-disk union.
+        const computeLoggedIn = (): Set<string> => {
+            const set = new Set(getLoggedInProviders(authStorage, directFetchers));
+            lastLoggedInSet = set;
+            return set;
+        };
+        const initialLoggedIn = computeLoggedIn();
+        syncFromDisk(initialLoggedIn);
+        seedFromDisk(initialLoggedIn);
 
         const tick = async (): Promise<void> => {
+            const loggedInSet = computeLoggedIn();
             syncFromDisk(loggedInSet);
             evaluateDirty(loggedInSet);
             await fetchDue(authStorage, directFetchers, getApiKey);
@@ -1145,7 +1224,7 @@ export async function startSharedPoller(
         const fresh = [...lastFetchedByProvider.values()].some((t) => Date.now() - t < idleDirtyMs);
         if (fresh) return;
 
-        evaluateDirty(loggedInSet);
+        evaluateDirty(computeLoggedIn());
         await fetchDue(authStorage, directFetchers, getApiKey);
     })();
     try {
@@ -1156,7 +1235,11 @@ export async function startSharedPoller(
 }
 
 export function getSharedUsage(): SharedUsageState | null {
-    syncFromDisk();
+    // Filter the on-disk union through THIS broker's most recently computed
+    // logged-in set so providers owned by other brokers never surface as
+    // columns/placeholders here (their reports stay on disk). Null (poller
+    // never started / direct test calls) → unfiltered, legacy behavior.
+    syncFromDisk(lastLoggedInSet ?? undefined);
     // Return state once we have data OR an in-flight fetch (so the UI can show
     // a loading hint even before the first report lands).
     if (cachedReports.length === 0 && lastFetchedByProvider.size === 0 && pendingProviders.size === 0) return null;
@@ -1360,9 +1443,11 @@ export function _resetForTest(): void {
     pendingProviders.clear();
     unconfirmedProviders.clear();
     confirmedThisProcess.clear();
+    confirmedAtByProvider.clear();
     directFetcherIds.clear();
     cachedReports = [];
     cachedHealth = new Map();
+    lastLoggedInSet = null;
     lastFlushedBySession.clear();
     lastSyncedTotals = new Map();
     perSecondReadCache = null;

package/lib/usage-render.ts

@@ -1,5 +1,5 @@
-import { visibleWidth, truncateToWidth } from '@oh-my-pi/pi-tui';
 import { resolveUsedFraction, getProviderDefinition, type UsageLimit, type UsageReport } from '@oh-my-pi/pi-ai';
+import { visibleWidth } from '@oh-my-pi/pi-tui';
 import { summarizeReport, quotaPolicyFor } from './usage-resolver.js';
 
 // Hardcoded ANSI retained for `ansiPainter` — the RPC/print fallback path and
@@ -29,8 +29,8 @@ export interface PainterTheme {
 }
 
 /**
- * Decouples "which ANSI/theme color wraps a span" from the validated flex-wrap
- * layout brain. `ansiPainter` reproduces the pre-refactor hardcoded ANSI; a
+ * Decouples "which ANSI/theme color wraps a span" from the validated single-row
+ * natural-width layout kernel. `ansiPainter` reproduces the pre-refactor hardcoded ANSI; a
  * `themePainter(theme)` routes every status color through the host theme so the
  * widget follows the active palette. Provider brand identity colors stay raw
  * ANSI under both painters (the host theme exposes no arbitrary-hue token — see
@@ -48,13 +48,46 @@ export interface Painter {
     header(label: string, brandAnsi: string): string;
     /** Numeric balance text (e.g. "余额 ¥18.06"), text-colored. */
     balance(text: string): string;
-    /** Foreground-color an arbitrary span with a named color (waveform cells). */
-    fg(color: PainterColor, text: string): string;
+    /**
+     * Waveform layer paint — btop row gradient over the provider's brand hue.
+     * `brandAnsi` is the raw brand SGR ('' → accent fallback, like header).
+     * Both rows share the hue family with a fixed, theme-independent step:
+     * 'bottom' a curated 256-color bright shade of the hue (aixterm bright /
+     * bold when the code isn't a mapped 16-color SGR), 'top' the plain brand.
+     */
+    wave(brandAnsi: string, layer: 'top' | 'bottom', text: string): string;
 }
 
 const pctValue = (p: number): string => `${Math.round(p * 100)}%`;
 const pctColor = (p: number): PainterColor => (p >= 0.85 ? 'error' : p >= 0.6 ? 'warning' : 'success');
 
+/**
+ * Curated 256-color bottom-row shade per 16-color brand hue (chart only —
+ * headers keep the raw brand SGR). The 256 palette's 16–255 range renders as
+ * FIXED rgb in every terminal, so the bottom/top step is guaranteed visible
+ * regardless of the active 16-color theme. Each shade is anchored on the
+ * de-facto standard dark-theme value of that hue (TokyoNight family) and is
+ * the SAME ink one purity/brightness step up — same hue direction, no hot
+ * magenta/red jumps that would break the "one color" read.
+ */
+const WAVE_SHADES: Record<string, string> = {
+    [X]: '38;5;204', // red    #ff5f87 (TN #f7768e, denser)
+    [G]: '38;5;114', //  green  #87d787 (TN #9ece6a, denser)
+    [BLUE]: '38;5;75', // blue #5fafff (TN #7aa2f7, denser)
+    [PURPLE]: '38;5;177', // purple #d787ff (TN #bb9af7, denser)
+    [CYAN]: '38;5;81', // cyan  #5fd7ff (TN #7dcfff, denser)
+};
+
+/** Aixterm bright variant of a 16-color brand code (`\x1b[3Nm` → `\x1b[9Nm`); undefined when not derivable. */
+const brightVariant = (code: string): string | undefined => {
+    const m = code.match(/^\x1b\[3([0-7])m$/);
+    return m ? `\x1b[9${m[1]}m` : undefined;
+};
+
+/** Bottom-row shade of a raw hue: curated 256 bright shade, aixterm bright, bold as the last step. */
+const bottomShade = (hue: string): string =>
+    WAVE_SHADES[hue] ? `\x1b[${WAVE_SHADES[hue]}m` : brightVariant(hue) ?? BOLD + hue;
+
 /** Pre-refactor hardcoded ANSI — the RPC/print fallback and the test baseline. */
 export const ansiPainter: Painter = {
     pct: (p) => {
@@ -65,21 +98,7 @@ export const ansiPainter: Painter = {
     sep: ` ${D}│${R} `,
     header: (label, brandAnsi) => c(brandAnsi ? BOLD + brandAnsi : BOLD, label),
     balance: (text) => c(WHITE, text),
-    fg: (color, text) =>
-        c(
-            color === 'error'
-                ? X
-                : color === 'warning'
-                  ? Y
-                  : color === 'success'
-                    ? G
-                    : color === 'dim'
-                      ? D
-                      : color === 'accent'
-                        ? CYAN
-                        : WHITE,
-            text,
-        ),
+    wave: (brandAnsi, layer, text) => c(layer === 'bottom' ? bottomShade(brandAnsi || CYAN) : brandAnsi || CYAN, text),
 };
 
 /** Status colors via the active host theme; brand headers keep raw ANSI. */
@@ -90,7 +109,12 @@ export function themePainter(theme: PainterTheme): Painter {
         sep: ` ${theme.fg('dim', '│')} `,
         header: (label, brandAnsi) => (brandAnsi ? c(brandAnsi, label) : theme.fg('accent', label)),
         balance: (text) => theme.fg('text', text),
-        fg: (color, text) => theme.fg(color, text),
+        wave: (brandAnsi, layer, text) =>
+            brandAnsi
+                ? c(layer === 'bottom' ? bottomShade(brandAnsi) : brandAnsi, text)
+                : layer === 'bottom'
+                  ? BOLD + theme.fg('accent', text)
+                  : theme.fg('accent', text),
     };
 }
 
@@ -243,13 +267,6 @@ const windowSortKey = (l: UsageLimit): number => {
     return 50;
 };
 
-/** Right-align a cell: pad short lines; leave ≥-width lines intact (colWidth = max). */
-const padRight = (s: string, width: number): string => {
-    const v = visibleWidth(s);
-    if (v >= width) return s;
-    return s + ' '.repeat(width - v);
-};
-
 // ── column builder ───────────────────────────────────────────────────
 
 /**
@@ -266,9 +283,9 @@ const padRight = (s: string, width: number): string => {
  *     soonest reset countdown (any revived bucket unblocks).
  *   - balance (DeepSeek): remaining ≤ 0 → countdown / `耗尽`
  *
- * `undefined` when there is nothing to show. Natural widths only —
- * `renderUsageReports` owns multi-column alignment, `ProviderCard` owns
- * per-card truncation.
+ * `undefined` when there is nothing to show. Emits natural-width lines only —
+ * `renderUsageReports` joins blocks into the single-row layout, `ProviderCard`
+ * owns per-card truncation.
  */
 export const buildColumn = (r: UsageReport, painter: Painter = ansiPainter, loading = false): string[] | undefined => {
     if (r.limits.length === 0) return;
@@ -360,9 +377,13 @@ export const buildPlaceholderColumn = (
     ];
 };
 
-// ── flex-wrap table layout ───────────────────────────────────────────
+// ── single-row table layout ───────────────────────────────────────────
 
-const SEP_VISUAL = 3;
+/** Right-pad a painted line to `width` visible cells (ANSI-safe via visibleWidth). */
+const padRight = (s: string, width: number): string => {
+    const v = visibleWidth(s);
+    return v >= width ? s : s + ' '.repeat(width - v);
+};
 
 export function renderUsageReports(
     reports: UsageReport[],
@@ -382,62 +403,70 @@ export function renderUsageReports(
     if (!reports?.length && placeholders.length === 0) return [];
     const loading = loadingProviders ?? new Set<string>();
 
-    // Build each provider column (header + usage / placeholder). Waveforms are
-    // appended AFTER the uniform block width is known so every provider's
-    // mini chart is the same width.
+    // Build each provider column (header + usage / placeholder). Each block
+    // aligns its OWN lines to its own natural width (header/body/waveform
+    // share that block's width so the separators stack vertically) — blocks
+    // are never padded to a cross-block shared width, so one block's content
+    // changes never resize the others.
     interface ProviderColumn {
         provider: string;
         col: string[];
+        width: number;
     }
     const cols: ProviderColumn[] = (reports ?? []).map((r) => {
         const col =
             r.limits.length === 0
                 ? buildEmptyReportColumn(r.provider, painter, loading.has(r.provider))
                 : buildColumn(r, painter, loading.has(r.provider));
-        if (!col) return { provider: r.provider, col: [] };
+        if (!col) return { provider: r.provider, col: [], width: 0 };
         // Second-level estimate override replaces the usage line (balance style).
         const est = usageEstimates?.get(r.provider);
         if (est && col.length >= 2) col[1] = painter.balance(est);
-        return { provider: r.provider, col };
+        return { provider: r.provider, col, width: 0 };
     });
     for (const id of placeholders) {
         cols.push({
             provider: id,
             col: buildPlaceholderColumn(id, painter, loading.has(id), exhaustedProviders?.has(id)),
+            width: 0,
         });
     }
     const valid = cols.filter((c) => c.col.length > 0);
     if (valid.length === 0) return [];
 
-    // Uniform block width: every provider block is padded to the widest column,
-    // so usage columns align in a clean grid (no ragged per-provider widths).
-    const natural = valid.map((c) => Math.max(...c.col.map((l) => visibleWidth(l))));
-    const blockWidth = Math.max(...natural);
-    const waveCols = Math.min(WAVEFORM_COLS, blockWidth);
-
-    // Multiple providers: pad every row to the uniform block width so the grid
-    // aligns (a lone provider keeps its natural width — nothing to align with).
-    const pad = valid.length > 1;
     for (const c of valid) {
-        // Equal-width per-provider consumption waveform (same char count for
-        // all). A track that exists but has no samples renders as a blank
-        // placeholder strip, keeping the column height stable.
+        // Per-provider consumption waveform at the FIXED WAVEFORM_COLS width:
+        // every chart renders 20 Braille columns regardless of the block's
+        // text width (no cross-block alignment). A track that exists but
+        // has no samples renders as a blank placeholder strip, keeping the
+        // block height stable.
         if (consumptionTracks) {
             const track = consumptionTracks.get(c.provider);
-            if (track) c.col.push(...renderConsumptionLines(track.samples, painter, waveCols));
+            if (track) c.col.push(...renderConsumptionLines(track.samples, painter, WAVEFORM_COLS, providerLabel(c.provider).color));
         }
-        if (pad) c.col = c.col.map((l) => padRight(l, blockWidth));
+        // Per-block alignment: with multiple blocks, pad every line of THIS
+        // block to its own widest line (text or the fixed-width waveform) so
+        // the block's separators stack vertically across header/body/waveform
+        // rows. Blocks are NOT padded to each other — each keeps its own
+        // natural width, so one block's content changes never resize others.
+        // A single block has no separators to align, so it stays byte-exact
+        // (RPC/print baseline).
+        c.width = Math.max(...c.col.map((l) => visibleWidth(l)));
+        if (valid.length > 1) c.col = c.col.map((l) => padRight(l, c.width));
     }
     // Single row, never wrapped: every provider block sits on one line at its
-    // natural uniform width — the row extends beyond `maxWidth` rather than
-    // squeezing content or breaking to a second line (user preference:
-    // roomy over compact).
+    // own natural width, joined by the fixed `painter.sep` — the row extends
+    // beyond `maxWidth` rather than squeezing content or breaking to a second
+    // line (user preference: roomy over compact). Blocks shorter than the
+    // tallest contribute a cell padded to that block's own width on missing
+    // rows, so every separator keeps its column.
+    const multi = valid.length > 1;
     const n = Math.max(...valid.map((c) => c.col.length));
     const out: string[] = [];
     for (let line = 0; line < n; line++) {
         const cells = valid.map((c) => {
-            const t = line < c.col.length ? c.col[line] : '';
-            return pad ? padRight(t, blockWidth) : t;
+            if (line < c.col.length) return c.col[line];
+            return multi ? ' '.repeat(c.width) : '';
         });
         out.push(cells.join(painter.sep));
     }
@@ -469,13 +498,6 @@ export function composeChar(leftRows: number, rightRows: number): string {
     return String.fromCharCode(code);
 }
 
-/** Named-color band for a stock consumption level (`1 - remaining`): remaining ≥ 50% → success, ≥ 20% → warning, else error. */
-export function consumptionColor(c: number): PainterColor {
-    if (c <= 0.5) return 'success';
-    if (c <= 0.8) return 'warning';
-    return 'error';
-}
-
 /** One provider's consumption track feeding its embedded mini chart. */
 export interface ConsumptionTrack {
     /** Per-interval consumption increments (raw values), newest last. */
@@ -498,12 +520,17 @@ export interface ConsumptionTrack {
  * window yields a blank placeholder strip, never `undefined`, so every
  * provider column keeps a stable chart area and the layout never jumps.
  *
- * Color is bound to RATE INTENSITY (image-scaling blend, not quota severity —
- * quota urgency already reads in the usage text, e.g. "5h 0%", balance). Each
- * Braille character takes the MEAN of its two half-column interpolated
- * intensities, mapped via consumptionColor (low→green, mid→yellow, high→red),
- * so consecutive chars blend smoothly and never hard-switch. The newest column
- * keeps accent.
+ * Color is a btop-style ROW gradient bound to the vertical position only —
+ * never to the data. The chart paints the provider's brand hue in two layers
+ * with a fixed step: the bottom line takes a curated 256-color bright shade
+ * of the hue (fixed rgb — visible under any 16-color theme; aixterm bright /
+ * bold when the code isn't mapped), the top line the plain brand — visibly
+ * stronger at the base, never washed out. Sliding samples reshape the
+ * envelope while every
+ * pixel's color stays put — the per-column intensity heat bands this
+ * replaces flipped green/yellow/red as the window moved, reading as flicker.
+ * Providers without a curated brand hue fall back to the theme accent.
+ * Quota urgency still reads in the usage text ("5h 0%", balance).
  *
  * Geometry unchanged: 1px per sample (half-char step), right-aligned; each
  * character merges its two half-column samples with max and renders both
@@ -514,6 +541,7 @@ export function renderConsumptionLines(
     samples: readonly number[],
     painter: Painter = ansiPainter,
     cols: number = WAVEFORM_COLS,
+    brandAnsi = '',
 ): string[] {
     const n = samples.length;
     const totalPx = cols * 2;
@@ -564,14 +592,10 @@ export function renderConsumptionLines(
         return plot[m - 1] / max;
     };
 
-    // Each half-column keeps its OWN interpolated height (two samples share one
-    // char, possibly at different heights — the pair-into-one-char geometry);
-    // only COLOR is blended (terminals can't half-tint a char, so the char
-    // takes the mean intensity of its two half-columns).
-    const accentChar = Math.floor((totalPx - 1) / 2);
     // Two-line strip: full scale = 8px (2 Braille rows × 4 dot rows). Each
-    // half-column keeps its OWN interpolated height; only COLOR is blended
-    // (terminals can't half-tint a char, so the char takes the mean intensity).
+    // half-column keeps its OWN interpolated height; COLOR is ROW-bound only
+    // (bottom = 256 bright shade of the brand hue, top = plain brand) and
+    // never varies per column.
     const rows = 2;
     const lines = new Array<string>(rows).fill('');
     for (let c = 0; c < cols; c++) {
@@ -587,10 +611,9 @@ export function renderConsumptionLines(
         // never vanish under the dynamic scale.
         const hL = l > 0 ? Math.max(1, Math.round(8 * l)) : 0;
         const hR = r > 0 ? Math.max(1, Math.round(8 * r)) : 0;
-        const color = c === accentChar ? 'accent' : consumptionColor((l + r) / 2);
         // Row 0 = top (px 4..8), row 1 = bottom (px 0..4) of each column.
-        lines[0] += painter.fg(color, composeChar(Math.max(0, hL - 4), Math.max(0, hR - 4)));
-        lines[1] += painter.fg(color, composeChar(Math.min(4, hL), Math.min(4, hR)));
+        lines[0] += painter.wave(brandAnsi, 'top', composeChar(Math.max(0, hL - 4), Math.max(0, hR - 4)));
+        lines[1] += painter.wave(brandAnsi, 'bottom', composeChar(Math.min(4, hL), Math.min(4, hR)));
     }
     return lines;
 }

package/lib/usage-widget.ts

@@ -9,10 +9,11 @@ import { buildColumn, renderUsageReports, themePainter, type Painter, type Consu
  * `render(width)` returns the compact 2-line column (header + horizontal
  * window chips / reset countdown), each clamped to ≤ `width` via
  * `truncateToWidth`. Today the host drives the whole status strip through
- * `UsageTable`, which reuses the shared `renderUsageReports` flex-wrap kernel
- * rather than assembling cards directly — but this seam lets a future
- * per-provider overlay (expand / detail / quick action) build on a unit that
- * already renders in isolation, without reweaving the render tree.
+ * `UsageTable`, which reuses the shared `renderUsageReports` single-row
+ * natural-width layout kernel rather than assembling cards directly — but
+ * this seam lets a future per-provider overlay (expand / detail / quick
+ * action) build on a unit that already renders in isolation, without
+ * reweaving the render tree.
  *
  * No keyboard interaction is implemented this round: `handleInput` / `dispose`
  * are kept as empty extension points per the design non-goal.
@@ -44,9 +45,10 @@ export class ProviderCard implements Component {
  * Root pi-tui `Component` the host mounts in its hook-widget tree. A single
  * `UsageTable` owns the whole multi-provider layout (header + window rows for
  * every report): the host only vertically stacks hook widgets, so per-provider
- * widgets would collapse into a vertical list and lose the compact flex-wrap
- * columns. The layout brain is the validated `renderUsageReports` kernel — the
- * same code the RPC/print `string[]` fallback runs — only the `Painter` differs.
+ * widgets would collapse into a vertical list and lose the compact
+ * single-row natural-width columns. The layout brain is the validated
+ * `renderUsageReports` kernel — the same code the RPC/print `string[]`
+ * fallback runs — only the `Painter` differs.
  */
 export class UsageTable implements Component {
     readonly #reports: UsageReport[];
@@ -99,11 +101,13 @@ export class UsageTable implements Component {
  * resolved lazily against the theme the host passes at mount time, so the widget
  * follows the active palette; a later poll/resize re-runs `setWidget` with the
  * current reports (mirroring the dashboard precedent), which re-injects the then-
- * current theme. Returns a `Container`-free `UsageTable` directly: the validated
- * layout already yields per-line `visibleWidth ≤ width`, and wrapping each row in
- * `pi-tui`'s `Text` would both drop the flex-wrap blank separators (Text renders
- * empty input as `[]`) and repad every line to the full width — losing byte
- * parity with the RPC/print path for zero structural benefit.
+ * current theme. Returns a `Container`-free `UsageTable` directly: rows extend
+ * at their natural width (the kernel never wraps — a row can run past `width`),
+ * and `ProviderCard.render`'s `truncateToWidth` is the only truncation seam.
+ * Wrapping each row in `pi-tui`'s `Text` would both drop the single-row
+ * natural-width blank separators (Text renders empty input as `[]`) and repad
+ * every line to the full width — losing byte parity with the RPC/print path
+ * for zero structural benefit.
  */
 export function createUsageWidget(
     reports: UsageReport[],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@genee/omp-opsx-addon",
-  "version": "0.5.0",
+  	  "version": "0.7.0",
   "type": "module",
   "description": "Pi Extension: OpenSpec workflow orchestration - coder/reviewer/planner agents, session title & progress",
   "main": "./index.ts",