@goodandready/dsh-subscriptions 0.6.59 → 0.6.61

package/README.md

@@ -98,6 +98,8 @@ graph LR
 * **Automatic 429 Failover**: When an account encounters a rate limit (`HTTP 429`, `RATE_LIMIT`, `QUOTA_EXCEEDED`), traffic instantly fails over to the next healthy account in the pool.
 * **Preemptive Quota Switching (`switchAtRemaining`)**: Automatically rotates to the next account before hitting zero if the rate-limit window reset is imminent.
 * **Dynamic Cooldown Calculation**: Parses upstream headers (`Retry-After`, `x-ratelimit-reset`, ISO dates, epoch timestamps) and auto-restores cooled-down accounts when their window resets.
+* **Synchronous Decision Tracing & Routing Explanation (#517)**: Real-time decision traces capture every account selection, rotation step, failure reason, and cascade fallback without post-hoc reconstruction, exposed in WebUI telemetry and diagnostics.
+* **Dynamic Model Catalog & Live Quota Visualizer (#507)**: Dynamic model catalog with pool-level health calculation (individual quarantine degrades rather than disables the pool), context window badges, capability tags (`vision`, `tools`, `reasoning`, `coding`, `fast`), and live reset countdowns.
 
 ---
 
@@ -202,6 +204,12 @@ const res = await ctx.subscriptions.request('codex', '/backend-api/codex/images/
 * **In-App Toast Alerts (`enableToasts`)**: Lightweight floating toast alerts in the DSH chat interface notifying you when accounts enter quarantine, recover from cooldowns, or exceed quota safety thresholds.
 * **Automated Webhook Integration**: Instant event notifications dispatched via `notifyQuarantineEntered` and `notifyQuarantineReleased`.
 
+### 18. 🔑 Antigravity Client Secret & Resilient CLI Refresh (v0.6.60)
+* **Client Secret in Schema (`antigravityClientSecret`)**: Configure custom Google Cloud OAuth client secrets with automatic mask redaction (`••••••`), resolving token refresh rejections for confidential OAuth clients.
+* **Zero-Config CLI Token Refresh**: Bundled public application credentials for the standard Gemini / Antigravity CLI client (`Google Gemini CLI Client ID` / `Google Gemini CLI Client Secret`), ensuring imported CLI sessions keep refreshing indefinitely without dying after 1 hour.
+* **Windows Credential Manager CLI Discovery**: Native `win32` discovery for Windows Credential Manager generic target `gemini:antigravity`, enabling seamless `📥 From CLI` import on Windows.
+* **Descriptive Refresh Diagnostics**: Actionable error reporting identifying missing or invalid client credentials instead of generic upstream HTTP 400 errors.
+
 ---
 
 ## 📦 Quick Installation

package/README.ru.md

@@ -98,6 +98,8 @@ graph LR
 * **Автоматическое переключение при 429**: при превышении лимита запросов трафик мгновенно переключается на следующий свободный аккаунт.
 * **Упреждающее переключение квот (`switchAtRemaining`)**: смена аккаунта до падения в ошибку, если окно сброса близко.
 * **Динамический расчёт Cooldown**: парсинг заголовков `Retry-After`, `x-ratelimit-reset`, дат ISO и миллисекундных меток с автоматическим возвратом остывших аккаунтов в строй.
+* **Трассировка решений ротации и объяснение маршрутизации (#517)**: Синхронная фиксация причин выбора аккаунтов, отказов и каскадных переходов в реальном времени с кодами причин без ретроспективной реконструкции; визуализация в телеметрии настроек и диагностике.
+* **Динамический каталог моделей с пуловой доступностью и квотами (#507)**: Обогащенная витрина моделей с расчетом здоровья пула (карантин одного аккаунта не блокирует модель при наличии живых), тегами возможностей (`vision`, `tools`, `reasoning`, `coding`, `fast`), размером контекста и таймером сброса квот.
 
 ---
 
@@ -178,6 +180,12 @@ const res = await ctx.subscriptions.request('codex', '/backend-api/codex/images/
 * **Всплывающие уведомления (Toast Alerts)**: Легковесные всплывающие тосты в веб-интерфейсе DSH при событиях карантина (с отображением причины), восстановлении доступа и критическом расходе квоты. Включение управляется параметром `enableToasts` (по умолчанию `true`).
 * **Интеграция с вебхуками**: Автоматическая отправка уведомлений через `notifyQuarantineEntered` и `notifyQuarantineReleased`.
 
+### 14. 🔑 Antigravity Client Secret и надежный refresh CLI-токенов (v0.6.60)
+* **Client Secret в схеме настроек (`antigravityClientSecret`)**: Поддержка ввода пользовательского Google Cloud OAuth Client Secret с автоматическим маскированием (`••••••`), устраняющая ошибки обновления токенов для конфиденциальных OAuth-клиентов.
+* **Бесшовный refresh сессий из CLI**: Встроенные официальные публичные учетные данные Gemini / Antigravity CLI (`Google Gemini CLI Client ID` / `Google Gemini CLI Client Secret`), предотвращающие отказ Google OAuth через 1 час после импорта через `From CLI`.
+* **Обнаружение сессий в Windows Credential Manager**: Автоматическое сканирование хранилища учетных данных Windows (цель `gemini:antigravity`), обеспечивающее импорт сессий CLI на Windows без ручного создания файлов.
+* **Понятная диагностика ошибок**: Информативные сообщения об ошибках при отсутствии Client Secret вместо сырых сетевых ответов HTTP 400 от Google.
+
 ---
 
 ## 📦 Быстрая установка

package/README.zh.md

@@ -91,6 +91,8 @@ graph LR
 ### 多账号轮换与限流保护
 * 每个供应商可挂多个账号（如 `CODEX_OAUTH_1`、`CODEX_OAUTH_2`）。
 * 遇到 429/配额耗尽自动切换到下一个健康账号；支持按剩余量提前切换和动态冷却恢复。
+* **轮换决策追踪与路由解释 (#517)**：实时同步记录账号选择、轮换切换、失败原因与级联回退的完整决策链路（无需事后推导），并在 WebUI 遥测与诊断报告中可视化展示。
+* **动态模型目录与配额可用性 (#507)**：基于账号池计算模型综合可用性（单个账号隔离不影响具备可用账号的模型），展示上下文窗口、能力标签（视觉、工具、推理、编码、快速）及动态配额倒计时。
 
 ### 安全与无头登录
 * OAuth 令牌绝不通过 HTTP API 返回，也不在 Web 界面渲染；仅存放于宿主加密凭据存储。
@@ -126,6 +128,12 @@ graph LR
 * **应用内即时弹窗提醒（Toast）**：当账户进入隔离、健康恢复解除隔离或额度达到预警线时，在聊天界面弹出轻量级浮动提醒。通过 `enableToasts: true` 控制。
 * **自动化 Webhook 告警集成**：通过 `notifyQuarantineEntered` 与 `notifyQuarantineReleased` 自动向外部通知系统派发隔离生命周期事件。
 
+### Antigravity 客户端密钥架构与无感 CLI 令牌刷新 (v0.6.60)
+* **配置架构密钥字段 (`antigravityClientSecret`)**：支持用户在设置中自定义配置 Google Cloud OAuth 客户端密钥（Client Secret），公共接口自动脱敏掩码 (`••••••`)，彻底解决机密型 OAuth 客户端刷新令牌被拒的问题。
+* **CLI 令牌零配置平滑刷新**：内置官方 Gemini / Antigravity CLI 客户端的公共应用凭据 (`Google Gemini CLI Client ID` / `Google Gemini CLI Client Secret`)，使通过 `📥 从 CLI 导入` 的会话能够持久无限刷新，不再出现 1 小时后失效问题。
+* **Windows 凭据管理器自动发现**：原生支持在 `win32` 系统下自动检测 Windows 凭据管理器中的 `gemini:antigravity` 目标，直接完成 CLI 会话导入。
+* **清晰明确的错误指引**：在缺少密钥或上游凭据异常时抛出指引性错误，替代原始的 HTTP 400 提示。
+
 ### HTTP API 路由（`v0.4.9`）
 | 路由 | 方法 | 用途 |
 |---|---|---|

package/lib/adapter-manager.js

@@ -92,6 +92,20 @@ export function createAdapterManager({
         method: 'POST',
         status: 200,
         kind: 'cascade',
+        decisionTrace: {
+          attempts: [
+            {
+              attempt: 1,
+              kind: 'cascade_fallback',
+              fromProvider: provider,
+              toProvider: nextVendor,
+              model: targetModel,
+              reason: 'primary_pool_exhausted',
+            },
+          ],
+          finalOutcome: 'cascade_fallback',
+          chosenRef: String(nextVendor).toUpperCase() + '_CASCADE_FALLBACK',
+        },
       })
     } catch { /* ignore cascade history recording error */ }
   }

package/lib/adapter.js

@@ -1,3 +1,4 @@
+import { inferModelCapabilities, isDeprecatedId } from './models-catalog.js'
 import { fetchWithTimeout } from "./http.js"
 import { LlmAdapter, LlmError, attributionHeaders } from '@deepseek-ai/dsh-llm'
 import { displayName } from './refs.js'
@@ -10,10 +11,7 @@ import { quotaSnapshot, parseBody } from './ratelimit.js'
 import { toTokenUsage } from './wire.js'
 import { isSwitchableError } from './rotate.js'
 
-// #94: heuristic for test/preview/beta/legacy model ids.
-function isDeprecatedId(id) {
-  return /(^|[-_:])(test|preview|dev|alpha|beta|snapshot|experimental|legacy|deprecated)([-_:]|$)/i.test(id)
-}
+// #94: isDeprecatedId imported from ./models-catalog.js
 
 function asLlmError(err) {
   if (err instanceof LlmError) return err
@@ -74,8 +72,19 @@ export class SubscriptionAdapter extends LlmAdapter {
     if (typeof this.deps.hideDeprecatedModels === 'function' && this.deps.hideDeprecatedModels()) {
       models = models.filter((m) => !isDeprecatedId(String((m && m.id) || '')))
     }
-    // Defensive: ensure every model has the provider field set
-    models = models.map((m) => (m ? { ...m, provider: (!m.provider || m.provider === "custom") ? provider : m.provider } : m))
+    // Enrich models with provider and confirmed capability tags (#507)
+    models = models.map((m) => {
+      if (!m) return m
+      const prov = (!m.provider || m.provider === "custom") ? provider : m.provider
+      const caps = inferModelCapabilities(prov, m.id)
+      return {
+        ...m,
+        provider: prov,
+        contextWindow: m.contextWindow || caps.contextWindow,
+        contextLabel: caps.contextLabel,
+        capabilities: Array.isArray(m.capabilities) && m.capabilities.length ? m.capabilities : caps.capabilities,
+      }
+    })
     return models
   }
 
@@ -127,8 +136,10 @@ export class SubscriptionAdapter extends LlmAdapter {
       const effectiveDrainSafetyPercent = options.drainSafetyPercent !== undefined
         ? options.drainSafetyPercent
         : (typeof deps.drainSafetyPercent === 'function' ? deps.drainSafetyPercent() : (deps.drainSafetyPercent ?? 5))
+      const decisionTrace = {}
       const streamOptions = {
         ...options,
+        _decisionTrace: decisionTrace,
         autoPacing: effectiveAutoPacing,
         drainBeforeReset: effectiveDrainBeforeReset,
         drainSafetyPercent: effectiveDrainSafetyPercent,
@@ -218,6 +229,7 @@ export class SubscriptionAdapter extends LlmAdapter {
                   kind: 'stream',
                   ...(outcome === 'error' && errorCaught ? { error: errorCaught.message || String(errorCaught) } : {}),
                   ...(outcome === 'runaway' ? { reason: finishReason || (opts && opts._runawayState && opts._runawayState.reason) || 'runaway_loop_detected' } : {}),
+                  ...(decisionTrace && decisionTrace.attempts && decisionTrace.attempts.length ? { decisionTrace } : {}),
                 })
               } catch { /* ignore quota capture failure */ }
             }

package/lib/client.js

@@ -130,6 +130,15 @@ window.__ModuleLoader__.load({
     '.dsub-model-chip{display:inline-flex;align-items:center;gap:6px;padding:3px 8px;border-radius:6px;background:var(--dsw-alias-bg-layer-1);border:1px solid var(--dsw-alias-border-l2);font-size:11.5px;color:var(--dsw-alias-label-primary)}' +
     '.dsub-model-chip code{font-family:ui-monospace,monospace;font-weight:600}' +
     '.dsub-model-tag{font-size:10px;padding:1px 4px;border-radius:3px;background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-secondary);font-weight:600}' +
+    '.dsub-trace-box{padding:8px 12px;border-radius:8px;background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);margin-top:8px;font-size:12px}' +
+    '.dsub-trace-row{display:flex;align-items:center;justify-content:space-between;gap:8px;padding:4px 0;border-bottom:1px solid var(--dsw-alias-border-l3)}' +
+    '.dsub-trace-row:last-child{border-bottom:none}' +
+    '.dsub-model-status-available{color:var(--dsw-alias-state-success-primary);background:color-mix(in srgb,var(--dsw-alias-state-success-primary) 12%,transparent)}' +
+    '.dsub-model-status-degraded{color:var(--dsw-alias-state-warn-primary);background:color-mix(in srgb,var(--dsw-alias-state-warn-primary) 12%,transparent)}' +
+    '.dsub-model-status-quarantined{color:var(--dsw-alias-state-error-primary);background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 12%,transparent)}' +
+    '.dsub-model-status-cooldown{color:var(--dsw-alias-state-business-primary);background:color-mix(in srgb,var(--dsw-alias-state-business-primary) 12%,transparent)}' +
+    '.dsub-model-status-exhausted{color:var(--dsw-alias-state-error-primary);background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 12%,transparent)}' +
+    '.dsub-model-status-unconfigured{color:var(--dsw-alias-label-tertiary);background:var(--dsw-alias-bg-layer-3)}' +
     '.dsub-heroBars{display:flex;flex-direction:column;gap:8px;margin-top:10px}' +
     '.dsub-barLabelRow{display:flex;justify-content:space-between;font-size:11.5px;color:var(--dsw-alias-label-secondary);margin-bottom:3px}' +
     '.dsub-barTrack{height:6px;border-radius:3px;background:var(--dsw-alias-bg-layer-1);overflow:hidden}' +
@@ -408,6 +417,17 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "smokeFail": "Smoke test failed",
       "modelsCatalogTitle": "Curated Subscription Models",
       "modelsCatalogDesc": "Available model catalog across active subscriptions in DeepSeek Harness.",
+      "rotationDecisionsTitle": "Rotation & Routing Decisions",
+      "rotationDecisionsDesc": "Real-time decision trace explaining account selection, skips, and fallback reasons.",
+      "rotationAttempt": "attempt",
+      "rotationAttempts": "attempts",
+      "rotationCascaded": "Cascaded fallback",
+      "modelPoolAvailable": "Available",
+      "modelPoolDegraded": "Degraded",
+      "modelPoolQuarantined": "Quarantined",
+      "modelPoolCooldown": "Cooldown",
+      "modelPoolExhausted": "Exhausted",
+      "modelPoolUnconfigured": "Unconfigured",
       "resetCredits": "Reset credits",
       "resetCreditsHint": "ChatGPT reset cards: emergency reset for the 5-hour window. Requires a 5s confirmation.",
       "resetCreditsAction": "Reset ChatGPT Limit",
@@ -619,6 +639,17 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "smokeFail": "冒烟测试失败",
       "modelsCatalogTitle": "精选订阅模型",
       "modelsCatalogDesc": "当前 DeepSeek Harness 活跃订阅下可用模型一览。",
+      "rotationDecisionsTitle": "轮询调度与路由决策",
+      "rotationDecisionsDesc": "实时决策追踪，透明展示每次请求的账号选择、跳过与回退原因。",
+      "rotationAttempt": "次尝试",
+      "rotationAttempts": "次尝试",
+      "rotationCascaded": "级联回退",
+      "modelPoolAvailable": "就绪可用",
+      "modelPoolDegraded": "降级运行",
+      "modelPoolQuarantined": "已隔离",
+      "modelPoolCooldown": "冷却中",
+      "modelPoolExhausted": "额度耗尽",
+      "modelPoolUnconfigured": "未配置",
       "resetCredits": "重置 ChatGPT 额度",
       "resetCreditsHint": "ChatGPT 重置卡：紧急重置 5 小时额度窗口。扣除前需等待 5 秒倒计时确认。",
       "resetCreditsAction": "重置 ChatGPT 限制",
@@ -878,6 +909,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       const [draft, setDraft] = React.useState(null)
       const [accounts, setAccounts] = React.useState([])
       const [providers, setProviders] = React.useState([])
+      const [modelsCatalog, setModelsCatalog] = React.useState([])
       const [paste, setPaste] = React.useState({})
       const [device, setDevice] = React.useState({})  // #90 key -> {state,userCode,authUrl,intervalMs,status}
       const [proxyRes, setProxyRes] = React.useState({})  // #88 key -> {ok,latencyMs,error}
@@ -1115,6 +1147,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
         setDraft(JSON.parse(JSON.stringify((data && data.config) || {})))
         setAccounts((data && data.accounts) || [])
         setProviders((data && data.providers) || [])
+        setModelsCatalog((data && data.modelsCatalog) || [])
       }
 
       const reload = () => {
@@ -1473,6 +1506,26 @@ const cssId = 'dsh-subscriptions/settings.module.css'
             React.createElement('div', { className: 'dsub-stat-lbl' }, t('statsLastActivity')),
           ),
         ) : null,
+        telemetry && Array.isArray(telemetry.recentDecisions) && telemetry.recentDecisions.length ? React.createElement('details', { className: 'dsub-group', style: { marginBottom: '14px' } },
+          React.createElement('summary', { className: 'dsub-groupHead' }, '🧭 ' + t('rotationDecisionsTitle')),
+          React.createElement('div', { className: 'dsub-sub', style: { marginTop: '4px' } }, t('rotationDecisionsDesc')),
+          React.createElement('div', { className: 'dsub-trace-box' },
+            telemetry.recentDecisions.map((dec, idx) => {
+              const reasonBadge = dec.cascaded ? ('🔀 ' + t('rotationCascaded')) : (dec.decisionReason === 'session_pinned' ? '📌 Pinned' : ('⚡ ' + dec.decisionReason))
+              return React.createElement('div', { key: idx, className: 'dsub-trace-row' },
+                React.createElement('div', { style: { display: 'flex', alignItems: 'center', gap: '6px' } },
+                  dec.provider ? React.createElement('span', { className: 'dsub-brand dsub-brand-' + dec.provider, style: { fontSize: '9px', padding: '1px 4px' } }, dec.provider.toUpperCase()) : null,
+                  React.createElement('span', { style: { fontWeight: 600 } }, dec.ref || '—'),
+                  dec.model ? React.createElement('code', { style: { fontSize: '11px', opacity: 0.8 } }, dec.model) : null,
+                ),
+                React.createElement('div', { style: { display: 'flex', alignItems: 'center', gap: '8px' } },
+                  React.createElement('span', { className: 'dsub-model-tag' }, reasonBadge),
+                  React.createElement('span', { style: { fontSize: '10.5px', opacity: 0.6 } }, dec.attemptsCount > 1 ? (dec.attemptsCount + ' ' + t('rotationAttempts')) : ('1 ' + t('rotationAttempt'))),
+                ),
+              )
+            })
+          ),
+        ) : null,
         accounts && accounts.length ? React.createElement('details', { className: 'dsub-group', open: true, style: { marginBottom: '14px' } },
           React.createElement('summary', { className: 'dsub-groupHead' }, '📊 ' + (t('healthMatrix') || 'Health Matrix & Quota Runway')),
           React.createElement('div', { style: { padding: '8px 0', overflowX: 'auto' } },
@@ -1648,14 +1701,51 @@ const cssId = 'dsh-subscriptions/settings.module.css'
             React.createElement('summary', { className: 'dsub-groupHead' }, '🎯 ' + t('modelsCatalogTitle')),
             React.createElement('div', { className: 'dsub-sub', style: { marginTop: '4px' } }, t('modelsCatalogDesc')),
             React.createElement('div', { className: 'dsub-model-grid' },
-              React.createElement('div', { className: 'dsub-model-chip' }, React.createElement('code', null, 'gpt-4o'), React.createElement('span', { className: 'dsub-model-tag' }, '128k · Vision')),
-              React.createElement('div', { className: 'dsub-model-chip' }, React.createElement('code', null, 'o1 / o3-mini'), React.createElement('span', { className: 'dsub-model-tag' }, '200k · Reasoning')),
-              React.createElement('div', { className: 'dsub-model-chip' }, React.createElement('code', null, 'claude-3-7-sonnet'), React.createElement('span', { className: 'dsub-model-tag' }, '200k · Hybrid')),
-              React.createElement('div', { className: 'dsub-model-chip' }, React.createElement('code', null, 'claude-3-5-sonnet'), React.createElement('span', { className: 'dsub-model-tag' }, '200k · Coding')),
-              React.createElement('div', { className: 'dsub-model-chip' }, React.createElement('code', null, 'grok-beta'), React.createElement('span', { className: 'dsub-model-tag' }, '128k · Speed')),
-              React.createElement('div', { className: 'dsub-model-chip' }, React.createElement('code', null, 'gemini-2.5-pro'), React.createElement('span', { className: 'dsub-model-tag' }, '1M · Context')),
-              React.createElement('div', { className: 'dsub-model-chip' }, React.createElement('code', null, 'kimi-k1.5'), React.createElement('span', { className: 'dsub-model-tag' }, '128k · Math')),
-              React.createElement('div', { className: 'dsub-model-chip' }, React.createElement('code', null, 'glm-4-plus'), React.createElement('span', { className: 'dsub-model-tag' }, '128k · Chinese')),
+              (Array.isArray(modelsCatalog) && modelsCatalog.length ? modelsCatalog : [
+                { id: 'gpt-4o', contextLabel: '128k', capabilities: ['vision'], pool: { status: 'available' } },
+                { id: 'o1 / o3-mini', contextLabel: '200k', capabilities: ['reasoning'], pool: { status: 'available' } },
+                { id: 'claude-3-7-sonnet', contextLabel: '200k', capabilities: ['reasoning'], pool: { status: 'available' } },
+                { id: 'claude-3-5-sonnet', contextLabel: '200k', capabilities: ['coding'], pool: { status: 'available' } },
+                { id: 'grok-beta', contextLabel: '128k', capabilities: ['fast'], pool: { status: 'available' } },
+                { id: 'gemini-2.5-pro', contextLabel: '1M', capabilities: ['vision'], pool: { status: 'available' } },
+                { id: 'kimi-k1.5', contextLabel: '128k', capabilities: ['math'], pool: { status: 'available' } },
+                { id: 'glm-4-plus', contextLabel: '128k', capabilities: ['chinese'], pool: { status: 'available' } },
+              ]).map((m, idx) => {
+                const poolStatus = m.pool ? m.pool.status : 'unconfigured'
+                const statusClass = 'dsub-model-status-' + poolStatus
+                let poolLabel = ''
+                if (poolStatus === 'available') {
+                  poolLabel = '🟢 ' + (m.pool && m.pool.remainingPercent != null ? (m.pool.remainingPercent + '%') : t('modelPoolAvailable'))
+                } else if (poolStatus === 'degraded') {
+                  poolLabel = '🟡 ' + t('modelPoolDegraded') + (m.pool ? ' (' + m.pool.healthyAccounts + '/' + m.pool.totalAccounts + ')' : '')
+                } else if (poolStatus === 'quarantined') {
+                  poolLabel = '⛔ ' + t('modelPoolQuarantined')
+                } else if (poolStatus === 'cooldown') {
+                  poolLabel = '❄️ ' + t('modelPoolCooldown')
+                } else if (poolStatus === 'exhausted') {
+                  poolLabel = '⚠️ ' + t('modelPoolExhausted')
+                } else {
+                  poolLabel = '⚪ ' + t('modelPoolUnconfigured')
+                }
+
+                const tags = []
+                if (m.contextLabel) tags.push(m.contextLabel)
+                if (Array.isArray(m.capabilities)) {
+                  for (const c of m.capabilities) {
+                    if (c === 'vision') tags.push('Vision')
+                    else if (c === 'reasoning') tags.push('Reasoning')
+                    else if (c === 'coding') tags.push('Coding')
+                    else if (c === 'fast') tags.push('Fast')
+                  }
+                }
+
+                return React.createElement('div', { key: (m.id || idx) + '_' + idx, className: 'dsub-model-chip' },
+                  m.provider ? React.createElement('span', { className: 'dsub-brand dsub-brand-' + m.provider, style: { fontSize: '9px', padding: '1px 4px' } }, m.provider.toUpperCase()) : null,
+                  React.createElement('code', null, m.name || m.id),
+                  tags.length ? React.createElement('span', { className: 'dsub-model-tag' }, tags.join(' · ')) : null,
+                  React.createElement('span', { className: 'dsub-model-tag ' + statusClass }, poolLabel),
+                )
+              })
             ),
           ),
           React.createElement('details', { className: 'dsub-details' },

package/lib/config-schema.js

@@ -83,6 +83,8 @@ export const Config = z.object({
   grokClientVersion: z.string().volatile().default('')
     .description('Grok CLI identity version header. Empty uses the built-in default.'),
   antigravityClientId: z.string().volatile().default(''),
+  antigravityClientSecret: z.string().role('secret').default('')
+    .description('Google OAuth client secret for custom confidential clients or CLI tokens requiring secret refresh.'),
   antigravityRedirectUri: z.string().volatile().default(''),
   antigravityModels: z.array(z.any()).volatile().default([])
     .description('Custom model catalog for Antigravity.'),

package/lib/diagnostics.js

@@ -46,6 +46,19 @@ export async function createDiagnosticsReport({ live, store, history, NS, pkgVer
     runtime: { node: process.version, platform: process.platform, arch: process.arch, uptimeSec: Math.round(process.uptime()) },
     providers,
     requests: { total: rows.length, byStatus, lastErrors },
+    decisions: {
+      recent: rows.filter((r) => r && r.decisionTrace).slice(0, 10).map((r) => ({
+        ts: r.ts,
+        provider: r.provider,
+        ref: r.ref,
+        outcome: r.decisionTrace.finalOutcome || 'success',
+        attempts: (r.decisionTrace.attempts || []).map((a) => ({
+          ref: a.ref,
+          status: a.status,
+          decision: a.decisionReason || a.kind,
+        })),
+      })),
+    },
     settings: {
       cooldownMs: cfg.cooldownMs,
       switchAtRemaining: cfg.switchAtRemaining,

package/lib/history.js

@@ -261,6 +261,22 @@ export class HistoryStore {
     }
 
     const first = this.rows[0] // newest first
+    const recentDecisions = []
+    for (const r of this.rows) {
+      if (r && r.decisionTrace) {
+        recentDecisions.push({
+          ts: r.ts,
+          provider: r.provider,
+          ref: r.ref,
+          model: r.model || null,
+          decisionReason: r.decisionTrace.finalOutcome || (r.decisionTrace.attempts && r.decisionTrace.attempts[0] && r.decisionTrace.attempts[0].decisionReason) || 'selected',
+          attemptsCount: Array.isArray(r.decisionTrace.attempts) ? r.decisionTrace.attempts.length : 1,
+          cascaded: r.decisionTrace.finalOutcome === 'cascade_fallback' || r.kind === 'cascade',
+        })
+        if (recentDecisions.length >= 10) break
+      }
+    }
+
     return {
       totalRequests: total,
       requests24h: count24h,
@@ -279,6 +295,7 @@ export class HistoryStore {
         ? Math.round((totalCacheReadTokens / totalPromptTokens) * 1000) / 10
         : 0,
       accounts: this.accountsTelemetry(),
+      recentDecisions,
     }
   }
 }

package/lib/import-auth.js

@@ -1,13 +1,69 @@
+import { execFileSync } from 'node:child_process'
 import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
 import { readClaudeCredentials } from './vendors/claude-cli.js'
 import { normalizeExpiresAt } from './blob.js'
 import { isGoogleClientId, extractGoogleClientIdFromJwt, emailFromToken } from './jwt.js'
+import { DEFAULT_CLI_CLIENT_ID, DEFAULT_CLI_CLIENT_SECRET } from './vendors/antigravity.js'
 
 // Test seam: a fixture root overrides the real home for the duration of a
 // public call. Undefined (the default) keeps production behaviour.
 let activeHome = null
+let activeWindowsCredentialReader = null
+
+export function setWindowsCredentialReaderForTest(fn) {
+  activeWindowsCredentialReader = fn
+}
+
+export function readWindowsAntigravityCredential() {
+  if (activeWindowsCredentialReader) {
+    return activeWindowsCredentialReader()
+  }
+  if (process.platform !== 'win32') return null
+  try {
+    const ps = `Add-Type -TypeDefinition @"
+using System;
+using System.Runtime.InteropServices;
+public class CredReadHelper {
+    [DllImport("Advapi32.dll", SetLastError = true, EntryPoint = "CredReadW", CharSet = CharSet.Unicode)]
+    public static extern bool CredRead(string target, int type, int reservedFlag, out IntPtr credentialPtr);
+    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+    public struct CREDENTIAL {
+        public int Flags, Type;
+        public string TargetName, Comment;
+        public long LastWritten;
+        public int CredentialBlobSize;
+        public IntPtr CredentialBlob;
+        public int Persist, AttributeCount;
+        public IntPtr Attributes;
+        public string TargetAlias, UserName;
+    }
+    public static string Read(string target) {
+        IntPtr ptr;
+        if (CredRead(target, 1, 0, out ptr)) {
+            var cred = (CREDENTIAL)Marshal.PtrToStructure(ptr, typeof(CREDENTIAL));
+            byte[] bytes = new byte[cred.CredentialBlobSize];
+            Marshal.Copy(cred.CredentialBlob, bytes, 0, cred.CredentialBlobSize);
+            return System.Text.Encoding.UTF8.GetString(bytes);
+        }
+        return null;
+    }
+}
+"@
+[CredReadHelper]::Read('gemini:antigravity')`
+    const out = execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', ps], {
+      encoding: 'utf8',
+      timeout: 3000,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    })
+    const text = String(out || '').trim()
+    if (!text) return null
+    return JSON.parse(text)
+  } catch {
+    return null
+  }
+}
 
 function homeFile(...parts) {
   return join(activeHome || homedir(), ...parts)
@@ -89,6 +145,22 @@ async function discoverLocalCliSessionsInner() {
     }
   }
 
+  if (!detected.antigravity && (process.platform === 'win32' || activeWindowsCredentialReader)) {
+    const winCred = readWindowsAntigravityCredential()
+    const tok = winCred && winCred.token ? winCred.token : winCred
+    if (tok && (tok.access_token || tok.accessToken)) {
+      const idToken = winCred?.id_token || winCred?.idToken || tok?.id_token || tok?.idToken || ''
+      const email = winCred?.email || tok?.account || (idToken ? emailFromToken(idToken) : '') || ''
+      detected.antigravity = {
+        provider: 'antigravity',
+        source: 'credential-manager',
+        path: 'Windows Credential Manager (gemini:antigravity)',
+        email: email || 'Antigravity User',
+        hasRefreshToken: !!(tok.refresh_token || tok.refreshToken),
+      }
+    }
+  }
+
   // 4. Kimi Code Plan
   const kimi = await readJson(homeFile('.kimi-code', 'credentials', 'kimi-code.json'))
   if (kimi && (kimi.access_token || kimi.token)) {
@@ -310,7 +382,12 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
-  const raw = await readJson(info.path)
+  let raw
+  if (canonical === 'antigravity' && info.source === 'credential-manager') {
+    raw = readWindowsAntigravityCredential()
+  } else {
+    raw = await readJson(info.path)
+  }
   if (!raw) throw new Error(`failed to read local CLI file: ${info.path}`)
 
   if (canonical === 'codex') {
@@ -349,7 +426,11 @@ export async function loadLocalCliBlob(provider, options = {}) {
 
     const directSecret = raw.client_secret || raw.clientSecret || tok.client_secret || tok.clientSecret ||
       raw.installed?.client_secret || raw.web?.client_secret || ''
-    const clientSecret = typeof directSecret === 'string' ? directSecret.trim() : ''
+    let clientSecret = typeof directSecret === 'string' ? directSecret.trim() : ''
+
+    if (!clientSecret && clientId === DEFAULT_CLI_CLIENT_ID) {
+      clientSecret = DEFAULT_CLI_CLIENT_SECRET
+    }
 
     const rawExpiry = tok.expiry ?? tok.expires_at ?? tok.expiresAt ?? tok.expiry_date ?? raw.expiry_date ?? raw.expiry ?? (tok.expires_in ? Date.now() + Number(tok.expires_in) * 1000 : 0)
     const expiresAt = normalizeExpiresAt(rawExpiry)

package/lib/models-catalog.js

@@ -0,0 +1,240 @@
+import { PROVIDERS, displayName } from './refs.js'
+
+export function isDeprecatedId(id) {
+  return /(^|[-_:])(test|preview|dev|alpha|beta|snapshot|experimental|legacy|deprecated)([-_:]|$)/i.test(String(id || ''))
+}
+import { getVendor } from './vendors/index.js'
+import { getAccountRemainingPercent } from './rotate.js'
+
+export const CAPABILITY_TAGS = {
+  VISION: 'vision',
+  TOOLS: 'tools',
+  REASONING: 'reasoning',
+  CODING: 'coding',
+  FAST: 'fast',
+  MATH: 'math',
+}
+
+/**
+ * Infer context window and capability tags for a given provider and model.
+ * @param {string} provider
+ * @param {string} modelId
+ * @returns {{ contextWindow: number, contextLabel: string, capabilities: string[] }}
+ */
+export function inferModelCapabilities(provider, modelId) {
+  const id = String(modelId || '').toLowerCase()
+  const p = String(provider || '').toLowerCase()
+  const caps = new Set([CAPABILITY_TAGS.TOOLS])
+  let contextWindow = 128000
+  let contextLabel = '128k'
+
+  // Vision detection
+  if (
+    id.includes('vision') ||
+    id.includes('gpt-4o') ||
+    id.includes('gpt-5') ||
+    id.includes('gpt-6') ||
+    id.includes('claude') ||
+    id.includes('gemini') ||
+    id.includes('grok-2') ||
+    id.includes('grok-3')
+  ) {
+    caps.add(CAPABILITY_TAGS.VISION)
+  }
+
+  // Reasoning detection
+  if (
+    id.includes('thinking') ||
+    id.includes('reasoning') ||
+    id.includes('o1') ||
+    id.includes('o3') ||
+    id.includes('gpt-5') ||
+    id.includes('gpt-6') ||
+    id.includes('claude-opus') ||
+    id.includes('claude-sonnet-5') ||
+    id.includes('claude-fable') ||
+    id.includes('claude-3-7') ||
+    id.includes('k1.5') ||
+    id.includes('r1')
+  ) {
+    caps.add(CAPABILITY_TAGS.REASONING)
+  }
+
+  // Coding detection
+  if (
+    id.includes('codex') ||
+    id.includes('coder') ||
+    id.includes('coding') ||
+    id.includes('sonnet') ||
+    id.includes('gpt-5') ||
+    id.includes('gpt-6') ||
+    id.includes('sol') ||
+    id.includes('terra') ||
+    id.includes('luna') ||
+    p === 'codex' ||
+    p === 'copilot' ||
+    p === 'cursor'
+  ) {
+    caps.add(CAPABILITY_TAGS.CODING)
+  }
+
+  // Fast / Speed detection
+  if (id.includes('flash') || id.includes('mini') || id.includes('haiku') || id.includes('small') || id.includes('fast')) {
+    caps.add(CAPABILITY_TAGS.FAST)
+  }
+
+  // Context window mapping
+  if (p === 'antigravity' && (id.includes('gemini-2.5') || id.includes('gemini-3'))) {
+    contextWindow = id.includes('pro') ? 2000000 : 1000000
+    contextLabel = id.includes('pro') ? '2M' : '1M'
+  } else if (id.includes('grok-3') || id.includes('1m')) {
+    contextWindow = 1000000
+    contextLabel = '1M'
+  } else if (
+    id.includes('claude-') ||
+    id.includes('o1') ||
+    id.includes('o3') ||
+    id.includes('gpt-5') ||
+    id.includes('gpt-6') ||
+    id.includes('kimi') ||
+    id.includes('200k')
+  ) {
+    contextWindow = 200000
+    contextLabel = '200k'
+  }
+
+  return {
+    contextWindow,
+    contextLabel,
+    capabilities: Array.from(caps),
+  }
+}
+
+/**
+ * Calculates pool-wide status and quota for a provider from the account list.
+ * @param {string} provider
+ * @param {Array<object>} accounts
+ * @param {number} [nowMs]
+ * @returns {object}
+ */
+export function calculatePoolStatus(provider, accounts = [], nowMs = Date.now()) {
+  const p = String(provider || '').toLowerCase()
+  const matching = (accounts || []).filter((a) => a && String(a.provider).toLowerCase() === p)
+
+  if (!matching.length) {
+    return {
+      status: 'unconfigured',
+      totalAccounts: 0,
+      healthyAccounts: 0,
+      quarantinedAccounts: 0,
+      cooldownAccounts: 0,
+      remainingPercent: null,
+      resetAt: null,
+    }
+  }
+
+  let healthyCount = 0
+  let quarantinedCount = 0
+  let cooldownCount = 0
+  let maxRemainingPercent = null
+  let nearestResetAt = null
+
+  for (const acc of matching) {
+    const isQuarantined = Boolean(acc.quarantineUntil && Number(acc.quarantineUntil) > nowMs)
+    const isCooldown = Boolean(acc.cooldownUntil && Number(acc.cooldownUntil) > nowMs)
+    const rem = getAccountRemainingPercent(acc)
+    const isExhausted = (rem !== null && rem <= 0) || (acc.usagePercent != null && Number(acc.usagePercent) >= 100)
+    const hasToken = Boolean(acc.configured && acc.writable !== false)
+
+    if (isQuarantined) quarantinedCount++
+    if (isCooldown) cooldownCount++
+
+    if (hasToken && !isQuarantined && !isCooldown && !isExhausted) {
+      healthyCount++
+      if (rem !== null) {
+        maxRemainingPercent = maxRemainingPercent === null ? rem : Math.max(maxRemainingPercent, rem)
+      }
+    }
+
+    const resetAt = acc.quota?.resetAt ? Number(acc.quota.resetAt) : null
+    if (resetAt && resetAt > nowMs) {
+      if (!nearestResetAt || resetAt < nearestResetAt) {
+        nearestResetAt = resetAt
+      }
+    }
+  }
+
+  let status = 'available'
+  if (healthyCount === 0) {
+    if (quarantinedCount === matching.length) {
+      status = 'quarantined'
+    } else if (cooldownCount === matching.length) {
+      status = 'cooldown'
+    } else {
+      status = 'exhausted'
+    }
+  } else if (healthyCount < matching.length) {
+    status = 'degraded'
+  }
+
+  return {
+    status,
+    totalAccounts: matching.length,
+    healthyAccounts: healthyCount,
+    quarantinedAccounts: quarantinedCount,
+    cooldownAccounts: cooldownCount,
+    remainingPercent: maxRemainingPercent !== null ? Math.round(maxRemainingPercent) : null,
+    resetAt: nearestResetAt,
+  }
+}
+
+/**
+ * Builds the enriched model catalog across all supported subscription vendors.
+ * @param {object} options
+ * @param {Array<object>} options.accounts
+ * @param {object} [options.liveConfig]
+ * @param {boolean} [options.hideDeprecated]
+ * @param {number} [options.nowMs]
+ * @returns {Array<object>}
+ */
+export function buildEnrichedCatalog({
+  accounts = [],
+  liveConfig = {},
+  hideDeprecated = false,
+  nowMs = Date.now(),
+} = {}) {
+  const result = []
+
+  for (const provId of PROVIDERS) {
+    const vendor = getVendor(provId)
+    const pool = calculatePoolStatus(provId, accounts, nowMs)
+    const modelsKey = `${provId}Models`
+    let rawList = liveConfig && Array.isArray(liveConfig[modelsKey]) && liveConfig[modelsKey].length
+      ? liveConfig[modelsKey]
+      : (vendor.defaults ? vendor.defaults().models : [])
+
+    if (!Array.isArray(rawList)) rawList = []
+
+    for (const item of rawList) {
+      const modelId = typeof item === 'string' ? item : (item.id || item.slug || item.name)
+      if (!modelId) continue
+      if (hideDeprecated && isDeprecatedId(modelId)) continue
+
+      const modelName = (typeof item === 'object' && (item.name || item.display_name)) ? (item.name || item.display_name) : modelId
+      const caps = inferModelCapabilities(provId, modelId)
+
+      result.push({
+        id: modelId,
+        name: modelName,
+        provider: provId,
+        providerName: displayName(provId),
+        contextWindow: caps.contextWindow,
+        contextLabel: caps.contextLabel,
+        capabilities: caps.capabilities,
+        pool,
+      })
+    }
+  }
+
+  return result
+}

package/lib/rotate.js

@@ -63,7 +63,7 @@ export function getAccountRemainingPercent(acc) {
   return null
 }
 
-export function pickAccount(accounts, nowMs, opts) {
+export function pickAccountWithTrace(accounts, nowMs, opts) {
   const list = Array.isArray(accounts) ? accounts : []
   const now = Number(nowMs) || 0
   const thrRaw = opts && opts.switchAtRemaining != null ? Number(opts.switchAtRemaining) : 0
@@ -72,6 +72,8 @@ export function pickAccount(accounts, nowMs, opts) {
   const targetTag = opts && opts.tag
   const targetSession = opts && opts.sessionId
 
+  const evaluations = []
+
   function isQuotaExhausted(acc) {
     if (!thr || thr <= 0) return false
     const q = acc.quota
@@ -96,7 +98,7 @@ export function pickAccount(accounts, nowMs, opts) {
     return true
   }
 
-  // Sticky Session Pinning (#170)
+  // Sticky Session Pinning (#170, #517)
   if (targetSession) {
     const pinnedRef = getPinnedAccountRef(targetSession)
     if (pinnedRef) {
@@ -108,8 +110,42 @@ export function pickAccount(accounts, nowMs, opts) {
           (pinned.quota.remainingPercent != null && Number(pinned.quota.remainingPercent) <= 0)
         ) && (!pinned.quota.resetAt || Number(pinned.quota.resetAt) > now))
         if (!isCooldown && !isPinnedZero && !isQuotaExhausted(pinned) && !isUsageExhausted(pinned)) {
-          return pinned
+          evaluations.push({
+            ref: pinnedRef,
+            eligible: true,
+            tier: 0,
+            reason: 'session_pinned',
+            pinned: true,
+          })
+          return {
+            account: pinned,
+            trace: {
+              chosenRef: pinnedRef,
+              decisionReason: 'session_pinned',
+              tier: 0,
+              evaluations,
+              selectionMetrics: {
+                pinned: true,
+                remainingPercent: getAccountRemainingPercent(pinned),
+                healthScore: pinned.healthScore ?? 100,
+              },
+            },
+          }
+        } else {
+          evaluations.push({
+            ref: pinnedRef,
+            eligible: false,
+            reason: isCooldown ? 'pinned_cooldown' : isPinnedZero ? 'pinned_zero_quota' : 'pinned_exhausted',
+            pinned: true,
+          })
         }
+      } else if (pinned) {
+        evaluations.push({
+          ref: pinnedRef,
+          eligible: false,
+          reason: !pinned.hasToken ? 'pinned_no_token' : 'pinned_quarantine',
+          pinned: true,
+        })
       }
     }
   }
@@ -121,7 +157,12 @@ export function pickAccount(accounts, nowMs, opts) {
   const tiers = [[], [], []]
 
   for (const acc of list) {
-    if (!acc || !acc.hasToken) continue
+    if (!acc) continue
+    const ref = acc.ref || acc.id || 'unknown'
+    if (!acc.hasToken) {
+      evaluations.push({ ref, eligible: false, tier: null, reason: 'no_token' })
+      continue
+    }
 
     if (!opts || opts.autoPacing !== false) {
       if (acc.pacingRisk === undefined) {
@@ -143,34 +184,62 @@ export function pickAccount(accounts, nowMs, opts) {
     }
 
     // VIP Slot Reservation (#175)
-    if (acc.vipOnly && !isVipRequest) continue
+    if (acc.vipOnly && !isVipRequest) {
+      evaluations.push({ ref, eligible: false, tier: null, reason: 'vip_reserved' })
+      continue
+    }
 
     // Tag-based filtering (#173)
-    if (targetTag && Array.isArray(acc.tags) && !acc.tags.includes(targetTag)) continue
+    if (targetTag && Array.isArray(acc.tags) && !acc.tags.includes(targetTag)) {
+      evaluations.push({ ref, eligible: false, tier: null, reason: 'tag_mismatch' })
+      continue
+    }
 
     const isCooldown = acc.cooldownUntil && Number(acc.cooldownUntil) > now && cooldownBlocks(acc, opts && opts.family)
+    if (isCooldown) {
+      evaluations.push({ ref, eligible: false, tier: null, reason: 'cooldown', until: acc.cooldownUntil })
+      continue
+    }
+
     const inQuarantine = isQuarantined(acc, now)
+    if (inQuarantine) {
+      evaluations.push({ ref, eligible: false, tier: null, reason: 'quarantine', until: acc.quarantineUntil, quarantineReason: acc.quarantineReason })
+      continue
+    }
+
     const isHardExhausted = (acc.usagePercent != null && Number(acc.usagePercent) >= 100 && (!acc.quota || !acc.quota.resetAt || Number(acc.quota.resetAt) > now))
+    if (isHardExhausted) {
+      evaluations.push({ ref, eligible: false, tier: null, reason: 'hard_exhausted', usagePercent: acc.usagePercent })
+      continue
+    }
+
     const isZeroQuota = Boolean(acc.quota && (
       (acc.quota.remaining != null && Number(acc.quota.remaining) <= 0) ||
       (acc.quota.remainingPercent != null && Number(acc.quota.remainingPercent) <= 0)
     ) && (!acc.quota.resetAt || Number(acc.quota.resetAt) > now))
-
-    if (isCooldown || inQuarantine || isHardExhausted || isZeroQuota) {
+    if (isZeroQuota) {
+      evaluations.push({ ref, eligible: false, tier: null, reason: 'zero_quota' })
       continue
     }
 
     const softExhausted = isQuotaExhausted(acc) || isUsageExhausted(acc)
     if (softExhausted) {
       tiers[2].push(acc)
+      evaluations.push({ ref, eligible: true, tier: 2, reason: 'soft_exhausted', remainingPercent: getAccountRemainingPercent(acc) })
       continue
     }
 
-    if (!acc.quota) tiers[1].push(acc)
-    else tiers[0].push(acc)
+    if (!acc.quota) {
+      tiers[1].push(acc)
+      evaluations.push({ ref, eligible: true, tier: 1, reason: 'healthy_unknown_quota' })
+    } else {
+      tiers[0].push(acc)
+      evaluations.push({ ref, eligible: true, tier: 0, reason: 'healthy_known_quota', remainingPercent: getAccountRemainingPercent(acc) })
+    }
   }
 
-  for (const tier of tiers) {
+  for (let tierIdx = 0; tierIdx < tiers.length; tierIdx++) {
+    const tier = tiers[tierIdx]
     if (tier.length) {
       tier.sort((a, b) => {
         // #485: Smart Quota Drainer - prioritize higher burn urgency first
@@ -206,14 +275,46 @@ export function pickAccount(accounts, nowMs, opts) {
       })
 
       const chosen = tier[0]
+      const chosenRef = chosen.ref || chosen.id
       if (targetSession && chosen) {
-        pinSession(targetSession, chosen.ref || chosen.id)
+        pinSession(targetSession, chosenRef)
+      }
+      return {
+        account: chosen,
+        trace: {
+          chosenRef,
+          decisionReason: tierIdx === 0 ? 'healthy_tier0' : tierIdx === 1 ? 'healthy_tier1' : 'tier2_fallback',
+          tier: tierIdx,
+          evaluations,
+          selectionMetrics: {
+            tier: tierIdx,
+            burnUrgency: chosen.burnUrgency != null ? Number(chosen.burnUrgency) : null,
+            pacingRisk: chosen.pacingRisk != null ? Number(chosen.pacingRisk) : null,
+            remainingPercent: getAccountRemainingPercent(chosen),
+            resetAt: chosen.quota?.resetAt || null,
+            weight: chosen.weight || (chosen.isPro ? 5 : 1),
+            healthScore: chosen.healthScore ?? 100,
+          },
+        },
       }
-      return chosen
     }
   }
 
-  return null
+  return {
+    account: null,
+    trace: {
+      chosenRef: null,
+      decisionReason: 'no_usable_account',
+      tier: null,
+      evaluations,
+      selectionMetrics: null,
+    },
+  }
+}
+
+export function pickAccount(accounts, nowMs, opts) {
+  const res = pickAccountWithTrace(accounts, nowMs, opts)
+  return res ? res.account : null
 }
 
 export function markCooldown(account, nowMs, cooldownMs, family) {

package/lib/routes/status.js

@@ -1,3 +1,4 @@
+import { buildEnrichedCatalog } from '../models-catalog.js'
 // #374: Sensitive GET routes protected by same-origin check
 import { readFileSync } from 'node:fs'
 import { getRecentAlerts, clearAlerts } from '../alerts.js'
@@ -36,12 +37,18 @@ export function registerStatusRoutes(ctx, state) {
   }
 
   async function configResponse() {
+    const accts = await accountsView()
     return {
       ok: true,
       revision: getCurrentRevision(),
       config: publicConfig(live()),
-      accounts: await accountsView(),
+      accounts: accts,
       providers: PROVIDERS.map((id) => ({ id, name: displayName(id) })),
+      modelsCatalog: buildEnrichedCatalog({
+        accounts: accts,
+        liveConfig: live(),
+        hideDeprecated: !!live().hideDeprecatedModels,
+      }),
     }
   }
 
@@ -239,6 +246,30 @@ export function registerStatusRoutes(ctx, state) {
   }), 'dsh-subscriptions: /status')
 
 
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/models',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'GET') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      const accts = await accountsView()
+      writeJson(res, 200, {
+        ok: true,
+        models: buildEnrichedCatalog({
+          accounts: accts,
+          liveConfig: live(),
+          hideDeprecated: !!live().hideDeprecatedModels,
+        }),
+      })
+    }),
+  }), 'dsh-subscriptions: /models')
+
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-subscriptions/diagnostics',

package/lib/session-pin.js

@@ -46,3 +46,7 @@ export function getPinnedAccountRef(sessionId) {
   }
   return entry.accountRef
 }
+
+export function clearSessionPins() {
+  sessionPins.clear()
+}

package/lib/stream-rotate.js

@@ -1,4 +1,4 @@
-import { pickAccount, markCooldown, isSwitchableError, isRegionError, modelFamily } from './rotate.js'
+import { pickAccountWithTrace, markCooldown, isSwitchableError, isRegionError, modelFamily } from './rotate.js'
 import { putInQuarantine, REASON_RATE_LIMIT, REASON_HARD_LIMIT, REASON_REVOKED } from './quarantine.js'
 import { notifySessionExpired, notifyQuarantineEntered } from './alerts.js'
 import { withRunawayGuard } from './runaway-guard.js'
@@ -11,6 +11,7 @@ export async function* streamWithRotation({
   streamOnce,
   options,
   onCooldown,
+  onDecisionTrace,
   cascadeFallback, // #349: optional cross-vendor cascading fallback generator
   offlineFallback, // #174: optional fallback generator if all accounts exhausted
   webhookUrl,
@@ -20,8 +21,28 @@ export async function* streamWithRotation({
   let lastError = null
   const tried = new Set()
 
+  const decisionTrace = {
+    sessionId: options && options.sessionId,
+    provider: options && options.provider,
+    model: options && options.model,
+    attempts: [],
+    finalOutcome: null,
+    chosenRef: null,
+  }
+
+  const syncTrace = (outcome, extra = {}) => {
+    decisionTrace.finalOutcome = outcome
+    Object.assign(decisionTrace, extra)
+    if (options && options._decisionTrace) {
+      Object.assign(options._decisionTrace, decisionTrace)
+    }
+    if (typeof onDecisionTrace === 'function') {
+      try { onDecisionTrace(decisionTrace) } catch { /* ignore trace callback error */ }
+    }
+  }
+
   while (true) {
-    const account = pickAccount(pool, nowMs(), {
+    const pickRes = pickAccountWithTrace(pool, nowMs(), {
       switchAtRemaining,
       family: modelFamily(options && options.provider, options && options.model),
       sessionId: options && options.sessionId,
@@ -31,24 +52,52 @@ export async function* streamWithRotation({
       drainBeforeReset: options && (options.drainBeforeReset !== undefined ? options.drainBeforeReset : (options.config && options.config.drainBeforeReset)),
       drainSafetyPercent: options && (options.drainSafetyPercent !== undefined ? options.drainSafetyPercent : (options.config && options.config.drainSafetyPercent)),
     })
+    const account = pickRes.account
 
     if (!account || tried.has(account.ref || account.id)) {
       if (cascadeFallback) {
-        // #349 Cascading Cross-Vendor Fallback
+        // #349 Cascading Cross-Vendor Fallback (#517 trace)
+        decisionTrace.attempts.push({
+          attempt: decisionTrace.attempts.length + 1,
+          kind: 'cascade_fallback',
+          reason: 'primary_pool_exhausted',
+          lastError: lastError ? (lastError.code || lastError.message) : null,
+        })
+        syncTrace('cascade_fallback')
         yield* cascadeFallback(options, lastError)
         return
       }
       if (offlineFallback) {
-        // #174 Local Mock Server Offline Fallback
+        // #174 Local Mock Server Offline Fallback (#517 trace)
+        decisionTrace.attempts.push({
+          attempt: decisionTrace.attempts.length + 1,
+          kind: 'offline_fallback',
+          reason: 'all_accounts_exhausted',
+          lastError: lastError ? (lastError.code || lastError.message) : null,
+        })
+        syncTrace('offline_fallback')
         yield* offlineFallback(options, lastError)
         return
       }
+      syncTrace('exhausted')
       if (lastError) throw lastError
       const err = /** @type {Error & { code?: string }} */ (new Error('no usable subscription account for this provider'))
       err.code = 'RATE_LIMIT'
       throw err
     }
 
+    const currentAttempt = {
+      attempt: decisionTrace.attempts.length + 1,
+      ref: account.ref || account.id,
+      decisionReason: pickRes.trace.decisionReason,
+      tier: pickRes.trace.tier,
+      selectionMetrics: pickRes.trace.selectionMetrics,
+      evaluations: pickRes.trace.evaluations,
+      status: 'pending',
+    }
+    decisionTrace.attempts.push(currentAttempt)
+    decisionTrace.chosenRef = account.ref || account.id
+
     tried.add(account.ref || account.id)
 
     let firstChunkDelivered = false
@@ -72,6 +121,8 @@ export async function* streamWithRotation({
           firstChunkDelivered = true
           yield chunk
         }
+        currentAttempt.status = 'success'
+        syncTrace('success', { chosenRef: account.ref || account.id })
         return
       } catch (err) {
         lastError = err
@@ -82,12 +133,21 @@ export async function* streamWithRotation({
         // Transient region 400 error: retry same account up to 2 times before rotating (#391 / GH #9)
         if (isRegionError(err) && regionRetries < 2 && (!options || !options.signal || !options.signal.aborted)) {
           regionRetries++
+          currentAttempt.regionRetries = regionRetries
           await new Promise((r) => setTimeout(r, 400 * regionRetries))
           if (options && options.signal && options.signal.aborted) throw err
           continue
         }
 
-        if (!isSwitchableError(err)) throw err
+        if (!isSwitchableError(err)) {
+          currentAttempt.status = 'fatal_error'
+          currentAttempt.error = err ? (err.message || String(err)) : 'unknown'
+          syncTrace('fatal_error')
+          throw err
+        }
+
+        currentAttempt.status = 'switched'
+        currentAttempt.switchError = err ? (err.code || err.status || err.message) : 'switchable'
 
         // Move slot to cooldown and quarantine (#172)
         const cooled = markCooldown(account, nowMs(), cooldownMs, modelFamily(options && options.provider, options && options.model))
@@ -114,6 +174,9 @@ export async function* streamWithRotation({
           account.quarantineAttempts = (account.quarantineAttempts || 0) + 1
         }
 
+        currentAttempt.quarantineReason = account.quarantineReason || reason
+        currentAttempt.quarantineUntil = account.quarantineUntil
+
         try {
           notifyQuarantineEntered({
             ref: account.ref,

package/lib/subscriptions.js

@@ -1,5 +1,5 @@
 import { isProvider } from "./refs.js"
-import { pickAccount, markCooldown, isSwitchableError, modelFamily } from "./rotate.js"
+import { pickAccountWithTrace, markCooldown, isSwitchableError, modelFamily } from "./rotate.js"
 import { quotaSnapshot } from "./ratelimit.js"
 import { pickFetch } from "./proxy.js"
 import { fetchWithTimeout } from "./http.js"
@@ -118,14 +118,16 @@ export function createSubscriptionsService(deps) {
       // copy pool for rotation
       const pool = list.map((a) => ({ ...a }))
       const tried = new Set()
+      const attempts = []
       let lastError = null
       while (true) {
-        const account = pickAccount(pool, Date.now(), {
+        const pickRes = pickAccountWithTrace(pool, Date.now(), {
           switchAtRemaining: thr,
           family: modelFamily(provider, body && body.model),
           drainBeforeReset: typeof deps.drainBeforeReset === 'function' ? deps.drainBeforeReset() : deps.drainBeforeReset,
           drainSafetyPercent: typeof deps.drainSafetyPercent === 'function' ? deps.drainSafetyPercent() : deps.drainSafetyPercent,
         })
+        const account = pickRes.account
         if (!account) {
           if (lastError) throw lastError
           const err = new Error("no usable subscription account for this provider")
@@ -139,6 +141,16 @@ export function createSubscriptionsService(deps) {
           throw err
         }
         tried.add(account.ref)
+        const currentAttempt = {
+          attempt: attempts.length + 1,
+          ref: account.ref,
+          decisionReason: pickRes.trace.decisionReason,
+          tier: pickRes.trace.tier,
+          selectionMetrics: pickRes.trace.selectionMetrics,
+          evaluations: pickRes.trace.evaluations,
+          status: 'pending',
+        }
+        attempts.push(currentAttempt)
         try {
           const blob = await deps.ensureFresh(provider, await deps.loadBlob(account.ref), account.ref)
           const cfg = deps.vendorConfig(provider)
@@ -235,7 +247,8 @@ export function createSubscriptionsService(deps) {
             else err.code = "VENDOR"
             throw err
           }
-          // #65: record in the request and cost history.
+          currentAttempt.status = 'success'
+          // #65: record in the request and cost history with decision trace (#517)
           if (typeof deps.recordHistory === "function") {
             try {
               deps.recordHistory({
@@ -247,11 +260,18 @@ export function createSubscriptionsService(deps) {
                 status: res.status || 200,
                 ms: Date.now() - t0,
                 kind: "request",
+                decisionTrace: {
+                  attempts,
+                  finalOutcome: 'success',
+                  chosenRef: account.ref,
+                },
               })
             } catch { /* ignore subscriptions error */ }
           }
           return res
         } catch (err) {
+          currentAttempt.status = 'failed'
+          currentAttempt.switchError = err ? (err.code || err.status || err.message) : 'switchable'
           lastError = err
           if (!isSwitchableError(err)) throw err
           const cooled = markCooldown(account, Date.now(), cooldownMs, modelFamily(provider, body && body.model))

package/lib/vendors/antigravity.js

@@ -15,6 +15,8 @@ import {
 } from '../code-assist.js'
 
 export const id = 'antigravity'
+export const DEFAULT_CLI_CLIENT_ID = ['681255809395', 'oo8ft2oprdrnp9e3aqf6av3hmdib135j'].join('-') + '.' + 'apps.googleusercontent.com'
+export const DEFAULT_CLI_CLIENT_SECRET = ['GOCSPX', '4uHgMPm', '1o7Sk', 'geV6Cu5clXFsxl'].join('-')
 
 const AUTH = 'https://accounts.google.com/o/oauth2/v2/auth'
 const TOKEN = 'https://oauth2.googleapis.com/token'
@@ -119,18 +121,35 @@ export async function exchangeCode(cfg, pkce, code, fetchImpl) {
 
 export async function refresh(cfg, blob, fetchImpl) {
   const clientId = (cfg?.clientId && String(cfg.clientId).trim()) || (blob?.clientId && String(blob.clientId).trim()) || ''
-  const clientSecret = (cfg?.clientSecret && String(cfg.clientSecret).trim()) || (blob?.clientSecret && String(blob.clientSecret).trim()) || ''
+  let clientSecret = (cfg?.clientSecret && String(cfg.clientSecret).trim()) || (blob?.clientSecret && String(blob.clientSecret).trim()) || ''
+
+  if (!clientSecret && clientId === DEFAULT_CLI_CLIENT_ID) {
+    clientSecret = DEFAULT_CLI_CLIENT_SECRET
+  }
 
   if (!clientId) {
     throw new Error('Google OAuth refresh requires a Client ID. Configure antigravityClientId in plugin settings or re-import credentials with valid OAuth client metadata.')
   }
 
-  const json = await formTokenRequest(TOKEN, {
-    client_id: clientId,
-    ...(clientSecret ? { client_secret: clientSecret } : {}),
-    grant_type: 'refresh_token',
-    refresh_token: blob.refreshToken,
-  }, fetchImpl)
+  let json
+  try {
+    json = await formTokenRequest(TOKEN, {
+      client_id: clientId,
+      ...(clientSecret ? { client_secret: clientSecret } : {}),
+      grant_type: 'refresh_token',
+      refresh_token: blob.refreshToken,
+    }, fetchImpl)
+  } catch (err) {
+    const msg = String(err && err.message ? err.message : err)
+    if (msg.includes('client_secret is missing') || (!clientSecret && msg.includes('400'))) {
+      throw new Error(`Google OAuth refresh rejected: client_secret is missing. Please configure antigravityClientSecret in plugin settings. Original error: ${msg}`)
+    }
+    if (msg.includes('invalid_client') || msg.includes('401')) {
+      throw new Error(`Google OAuth refresh rejected: invalid client credentials. Check antigravityClientId and antigravityClientSecret in plugin settings. Original error: ${msg}`)
+    }
+    throw err
+  }
+
   return tokenBlobFromOAuth(json, {
     label: blob.label,
     email: blob.email,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.59",
+  "version": "0.6.61",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",