@hienlh/ppm 0.23.12 → 0.23.14

package/src/server/ws/extensions.ts

@@ -4,6 +4,9 @@
  */
 import { contributionRegistry } from "../../services/contribution-registry.ts";
 import type { ExtServerMsg, ExtClientMsg } from "../../types/extension-messages.ts";
+import { createLogger } from "../../services/logger.ts";
+
+const log = createLogger("ExtWS");
 
 type ExtWsSocket = {
   data: { type: string };
@@ -58,7 +61,7 @@ export function getExtClientCount(): number {
 
 function handleOpen(ws: ExtWsSocket): void {
   clients.add(ws);
-  console.log(`[ExtWS] Client connected (${clients.size} total)`);
+  log.debug(`Client connected (${clients.size} total)`);
 }
 
 async function handleMessage(ws: ExtWsSocket, raw: string | Buffer): Promise<void> {
@@ -86,12 +89,12 @@ async function handleMessage(ws: ExtWsSocket, raw: string | Buffer): Promise<voi
       try {
         const { extensionService } = await import("../../services/extension.service.ts");
         if (extensionService["rpc"]) {
-          console.log(`[ExtWS] command:execute "${msg.command}"`);
+          log.debug(`command:execute "${msg.command}"`);
           const result = await extensionService["rpc"].sendRequest<{ ok: boolean; error?: string }>(
             "ext:command:execute", msg.command, ...(msg.args ?? []),
           );
           if (!result?.ok) {
-            console.error(`[ExtWS] command:execute failed: ${result?.error ?? "unknown"}`);
+            log.error(`command:execute failed: ${result?.error ?? "unknown"}`);
             broadcastExtMsg({
               type: "notification",
               id: `cmd-error-${Date.now()}`,
@@ -100,7 +103,7 @@ async function handleMessage(ws: ExtWsSocket, raw: string | Buffer): Promise<voi
             });
           }
         } else {
-          console.error(`[ExtWS] command:execute: extension host not ready`);
+          log.error(`command:execute: extension host not ready`);
           broadcastExtMsg({
             type: "notification",
             id: `cmd-error-${Date.now()}`,
@@ -109,7 +112,7 @@ async function handleMessage(ws: ExtWsSocket, raw: string | Buffer): Promise<voi
           });
         }
       } catch (e) {
-        console.error(`[ExtWS] command:execute error:`, e);
+        log.error(`command:execute error:`, e);
         broadcastExtMsg({
           type: "notification",
           id: `cmd-error-${Date.now()}`,
@@ -128,7 +131,7 @@ async function handleMessage(ws: ExtWsSocket, raw: string | Buffer): Promise<voi
             await extensionService["rpc"].sendRequest("ext:command:execute", msg.command);
           }
         } catch (e) {
-          console.error(`[ExtWS] tree:click command error:`, e);
+          log.error(`tree:click command error:`, e);
         }
       }
       break;
@@ -168,7 +171,7 @@ async function handleMessage(ws: ExtWsSocket, raw: string | Buffer): Promise<voi
           await extensionService["rpc"].sendRequest("ext:webview:message", msg.panelId, msg.message);
         }
       } catch (e) {
-        console.error(`[ExtWS] webview:message error:`, e);
+        log.error(`webview:message error:`, e);
       }
       break;
     }
@@ -180,7 +183,7 @@ async function handleMessage(ws: ExtWsSocket, raw: string | Buffer): Promise<voi
           await extensionService["rpc"].sendRequest("ext:webview:close", msg.panelId);
         }
       } catch (e) {
-        console.error(`[ExtWS] webview:close error:`, e);
+        log.error(`webview:close error:`, e);
       }
       break;
     }
@@ -198,7 +201,7 @@ async function handleMessage(ws: ExtWsSocket, raw: string | Buffer): Promise<voi
           }
         }
       } catch (e) {
-        console.error(`[ExtWS] tree:expand error:`, e);
+        log.error(`tree:expand error:`, e);
       }
       break;
     }
@@ -207,7 +210,7 @@ async function handleMessage(ws: ExtWsSocket, raw: string | Buffer): Promise<voi
 
 function handleClose(ws: ExtWsSocket): void {
   clients.delete(ws);
-  console.log(`[ExtWS] Client disconnected (${clients.size} remaining)`);
+  log.debug(`Client disconnected (${clients.size} remaining)`);
 }
 
 export const extensionWebSocket = {

package/src/server/ws/global.ts

@@ -21,6 +21,11 @@ import { startWatching, stopWatching, onFileChange } from "../../services/file-w
 import { onIndexRebuilt, warmIndex } from "../../services/file-list-index.service.ts";
 import { configService } from "../../services/config.service.ts";
 import { onDesignEvent } from "../../services/design/design-events.ts";
+import { onGitEvent } from "../../services/git-changes/git-events.ts";
+import { subscribeLogs, unsubscribeLogs } from "../../services/logs/log-live.ts";
+import { tokenStillValid } from "../../services/agent-transcript/agent-transcript-hub-registry.ts";
+import { onIssuesChanged } from "../../services/logs/log-issues.ts";
+import { LOGS_ISSUES_CHANGED, LOGS_SUBSCRIBE, LOGS_UNSUBSCRIBE } from "../../shared/logs-api.ts";
 import { resolve } from "node:path";
 import {
   handleAgentActivitySubscribe, handleAgentActivityUnsubscribe,
@@ -101,6 +106,11 @@ onIndexRebuilt((projectPath, changed) => {
 // Design history/comment changes: `.design/` is not watched, so these are the only signal.
 // Services know the project path; browsers address projects by name, and a path no
 // registered project owns is dropped rather than broadcast.
+onGitEvent((event) => broadcastGlobalEvent(event));
+
+// The Logs window and the rail button's badge refetch the issues when this arrives.
+onIssuesChanged(() => broadcastGlobalEvent({ type: LOGS_ISSUES_CHANGED }));
+
 onDesignEvent((type, { projectPath, slug, requestId, screenshot }) => {
   const projectName = projectNameForPath(projectPath);
   if (!projectName) return;
@@ -130,11 +140,15 @@ export const globalWebSocket = {
     if (msg.type === "agent-activity:subscribe") return handleAgentActivitySubscribe(ws, msg as AgentActivitySubscribeMsg);
     if (msg.type === "agent-activity:unsubscribe") return handleAgentActivityUnsubscribe(ws, msg as AgentActivityUnsubscribeMsg);
     if (msg.type === "ping") return handleAgentTranscriptPing(ws);
+    // A Logs view that is open and following: new records are pushed while it is subscribed.
+    if (msg.type === LOGS_SUBSCRIBE) return subscribeLogs(ws, () => tokenStillValid(ws));
+    if (msg.type === LOGS_UNSUBSCRIBE) return unsubscribeLogs(ws);
   },
 
   close(ws: GlobalWsSocket) {
     releaseWatch(ws);
     handleAgentTranscriptClientClosed(ws);
+    unsubscribeLogs(ws);
     clients.delete(ws);
   },
 };

package/src/server/ws/group-chat.ts

@@ -1,5 +1,8 @@
 import { groupChatService } from "../../services/group-chat/group-chat.service.ts";
 import type { GroupChatClientMessage } from "../../types/group-chat-ws.ts";
+import { createLogger } from "../../services/logger.ts";
+
+const log = createLogger("group-chat");
 
 type GroupWsSocket = {
   data: { type: string; groupId: string; projectName?: string };
@@ -32,9 +35,11 @@ export const groupChatWebSocket = {
       if (!content) { ws.send(JSON.stringify({ type: "error", message: "empty message" })); return; }
       // Detached: FE disconnect does not abort the loop.
       groupChatService.start(groupId, content).catch((e) => {
+        log.error(`group=${groupId} start failed: ${(e as Error)?.message ?? e}`);
         ws.send(JSON.stringify({ type: "error", message: (e as Error).message }));
       });
     } else if (msg.type === "stop") {
+      log.info(`group=${groupId} stopped by client`);
       groupChatService.stop(groupId);
     }
     // "ready" is a no-op ack.

package/src/server/ws/lsp.ts

@@ -20,8 +20,11 @@
 import nodePath from "node:path";
 import { resolveProjectPath } from "../helpers/resolve-project.ts";
 import { isUnavailable, lspManager } from "../../services/lsp/lsp-manager.ts";
+import { createLogger } from "../../services/logger.ts";
 import { pathToFileUri, uriKey } from "../../shared/lsp-uri.ts";
 
+const log = createLogger("lsp");
+
 interface OpenDoc {
   /** Session key, for releasing the hold when the document closes. */
   key: string;
@@ -167,6 +170,8 @@ async function handleMessage(ws: WsLike, raw: string | Buffer): Promise<void> {
     }
   } catch (e) {
     const message = e instanceof Error ? e.message : String(e);
+    // Per request, so per keystroke while completing: a server that keeps failing would bury the log.
+    log.debug(`${String(msg.t)}${msg.method ? ` ${String(msg.method)}` : ""} failed: ${message}`);
     if (typeof msg.id === "number") send(client, { t: "error", id: msg.id, message });
     else send(client, { t: "notice", message });
   }
@@ -176,10 +181,20 @@ async function openDocument(client: Client, msg: Record<string, unknown>): Promi
   const path = String(msg.path ?? "");
   const text = String(msg.text ?? "");
   const version = Number(msg.version ?? 1);
-  const absolute = resolveDocumentPath(client.projectPath, path);
+  let absolute: string;
+  try {
+    absolute = resolveDocumentPath(client.projectPath, path);
+  } catch (e) {
+    // The editor never sends a file outside the project, so this is a bug or a crafted message.
+    log.warn(`project=${client.ws.data.projectName} rejected document path: ${(e as Error).message.slice(0, 300)}`);
+    throw e;
+  }
 
   const result = await lspManager.acquire(client.projectPath, absolute, client.id);
   if (isUnavailable(result)) {
+    // A failed start is logged once by the manager; the other two are the ordinary answer for a
+    // file nothing serves or a server nobody installed.
+    log.debug(`project=${client.ws.data.projectName} ${path}: ${result.reason}${result.server ? ` (${result.server.id})` : ""}`);
     send(client, {
       t: "unavailable",
       path,
@@ -290,8 +305,11 @@ async function forwardRequest(client: Client, msg: Record<string, unknown>): Pro
   }
 
   // The browser addressed the document by its Monaco URI; the server only
-  // knows the `file:` one.
-  const params = withDocumentUri(msg.params, doc.uri);
+  // knows the `file:` one. The same goes for anything the server said earlier and
+  // the browser now hands back — a code action's diagnostics carry their related
+  // locations — which went out renamed to the model's URI and returns under the
+  // server's own name.
+  const params = withDocumentUri(rewriteUris(msg.params, fileUriMapFor(client)), doc.uri);
   const controller = new AbortController();
   client.inflight.set(id, controller);
   let result: unknown;
@@ -340,9 +358,16 @@ function uriMapFor(client: Client): Map<string, string> {
   return map;
 }
 
+/** And back: the browser's model URI to the file: URI the server knows. */
+function fileUriMapFor(client: Client): Map<string, string> {
+  const map = new Map<string, string>();
+  for (const doc of client.docs.values()) map.set(uriKey(doc.clientUri), doc.uri);
+  return map;
+}
+
 /**
  * Rewrite every URI in a server response that names a document this socket has
- * open.
+ * open (and, given the reverse map, every model URI in what the browser sends back).
  *
  * Walks the whole value because `uri` turns up in a dozen shapes — a location,
  * a location link's `targetUri`, each key of a workspace edit's `changes`, a

package/src/server/ws/remote-desktop.ts

@@ -28,6 +28,9 @@ import {
   type RemoteDesktopSession,
   type RemoteDesktopSocket,
 } from "../../services/remote-desktop/remote-desktop-session.ts";
+import { createLogger } from "../../services/logger.ts";
+
+const log = createLogger("remote-desktop");
 
 registerRemoteDesktopExitSweep();
 
@@ -49,9 +52,15 @@ function guardOrClose(ws: RemoteDesktopWs): boolean {
 
 async function authenticateFirstMessage(ws: RemoteDesktopWs, text: string): Promise<void> {
   let parsed: Record<string, unknown>;
-  try { parsed = JSON.parse(text); } catch { ws.close(1008, "expected auth message"); return; }
+  try { parsed = JSON.parse(text); } catch {
+    log.warn("auth rejected: first message is not JSON");
+    ws.close(1008, "expected auth message");
+    return;
+  }
   const nonce = parsed.type === "auth" ? parsed.nonce : undefined;
   if (typeof nonce !== "string" || !consumeRemoteDesktopNonce(nonce)) {
+    // Never the nonce itself: a refusal on a channel that hands over the host's screen and input.
+    log.warn("auth rejected: invalid or expired nonce");
     ws.close(1008, "invalid or expired session nonce");
     return;
   }
@@ -73,7 +82,7 @@ async function authenticateFirstMessage(ws: RemoteDesktopWs, text: string): Prom
       webrtc: parsed.webrtc === true,
     });
   } catch (e) {
-    console.error(`[remote-desktop] failed to start capture: ${(e as Error).message}`);
+    log.error("failed to start capture:", e);
     ws.send(JSON.stringify({ type: "error", message: (e as Error).message }));
     ws.close(1011, "capture failed to start");
   }
@@ -85,16 +94,23 @@ export const remoteDesktopWebSocket = {
   },
 
   async message(ws: RemoteDesktopWs, msg: string | ArrayBuffer | Uint8Array) {
-    if (!guardOrClose(ws)) return;
-    const text = typeof msg === "string" ? msg : new TextDecoder().decode(msg as ArrayBuffer);
-    if (!ws.data.authenticated) {
-      await authenticateFirstMessage(ws, text);
-      return;
+    // The server drops this promise, so anything that escapes is an unhandled rejection — and
+    // three of those in a minute exit the whole server. The session catches its own messages;
+    // this is for the rest (a first message of `null` fails reading `.type`, for one).
+    try {
+      if (!guardOrClose(ws)) return;
+      const text = typeof msg === "string" ? msg : new TextDecoder().decode(msg as ArrayBuffer);
+      if (!ws.data.authenticated) {
+        await authenticateFirstMessage(ws, text);
+        return;
+      }
+      await ws.data.session?.handleClientMessage(text);
+    } catch (e) {
+      log.warn(`message handling failed: ${(e as Error)?.message ?? e}`);
     }
-    await ws.data.session?.handleClientMessage(text);
   },
 
   close(ws: RemoteDesktopWs) {
-    ws.data.session?.close();
+    ws.data.session?.close("socket-closed");
   },
 };

package/src/server/ws/terminal.ts

@@ -3,6 +3,9 @@ import { homedir } from "node:os";
 import { terminalService } from "../../services/terminal.service.ts";
 import { resolveProjectPath } from "../helpers/resolve-project.ts";
 import { assertAllowed, resolvePath } from "../../services/fs-path-guard.service.ts";
+import { createLogger } from "../../services/logger.ts";
+
+const log = createLogger("terminal");
 
 /**
  * Where a new shell starts. An explicit `cwd` (explorer "Open in Terminal") wins
@@ -44,8 +47,9 @@ export const terminalWebSocket = {
     // so does a stale id that still knows its project/cwd (tab reopened after a restart).
     // Only a stale id with no context left is "Session not found".
     if (!session && (id === "new" || projectName || cwd)) {
+      let startDir: string | undefined;
       try {
-        const startDir = resolveStartDir(projectName, cwd);
+        startDir = resolveStartDir(projectName, cwd);
         // Create session with the requested ID — but TerminalService generates its own ID.
         // Instead, create and return the new session ID to client.
         const newId = terminalService.create(startDir);
@@ -55,6 +59,9 @@ export const terminalWebSocket = {
           ws.data.id = newId;
         }
       } catch (e) {
+        // No start dir yet: the project or the cwd was refused. Otherwise the shell did not start.
+        if (startDir === undefined) log.warn(`spawn refused project=${projectName ?? "-"} cwd=${cwd ?? "-"}: ${(e as Error).message}`);
+        else log.error(`spawn failed project=${projectName ?? "-"} cwd=${startDir}:`, e);
         ws.send(JSON.stringify({ type: "error", message: (e as Error).message }));
         return;
       }

package/src/services/account-pick.service.ts

@@ -38,7 +38,7 @@ export interface CodexPickOptions {
 export async function pickCodexAccount(opts: CodexPickOptions = {}): Promise<PickedAccount | null | "timeout"> {
   if (listCodexAccounts().length === 0) return null;
   const usages = opts.usageBudgetMs != null
-    ? await settleWithinBudget(getAllCodexUsages(), opts.usageBudgetMs, null)
+    ? await settleWithinBudget(getAllCodexUsages(), opts.usageBudgetMs, null, "codex usage")
     : await getAllCodexUsages();
   if (usages === null) return "timeout";
   // A failed usage fetch yields {} → +Infinity, which the selector reads as "unknown", not

package/src/services/account-selector.service.ts

@@ -5,13 +5,19 @@ import {
   getLatestSnapshotForAccount,
   getSessionAccount,
   setSessionAccount,
+  getLastTurnCacheState,
 } from "./db.service.ts";
+import { createLogger } from "./logger.ts";
+
+const log = createLogger("accounts");
 
 export type AccountStrategy = "round-robin" | "fill-first" | "lowest-usage";
 
 const STRATEGY_CONFIG_KEY = "account_strategy";
 const MAX_RETRY_CONFIG_KEY = "account_max_retry";
 const COOLDOWN_ENABLED_KEY = "account_cooldown_enabled";
+/** The account round-robin handed out last — stored, so a restart carries on after it. */
+const ROUND_ROBIN_LAST_KEY = "account_round_robin_last";
 
 const BACKOFF_BASE_MS = 1_000;
 const BACKOFF_MAX_MS = 30 * 60_000;
@@ -33,8 +39,7 @@ function atCap(util: number | null | undefined): boolean {
   return Math.round((util ?? 0) * 100) >= 100;
 }
 
-class AccountSelectorService {
-  private cursor = 0;
+export class AccountSelectorService {
   private retryCounts = new Map<string, number>();
   private _lastPickedId: string | null = null;
 
@@ -238,11 +243,19 @@ class AccountSelectorService {
    * Rotation is not abandoned, only relocated: a session with no binding yet still goes
    * through the configured strategy, so load still spreads — just per session rather than
    * per turn. `bindSession` moves a session when an account genuinely cannot serve it.
+   *
+   * The binding is worth exactly what the cache behind it is worth, so it lapses with that
+   * cache. A session idle past its window re-sends its transcript as a cache write on
+   * whichever account serves it next, and is routed like a new one. Holding it regardless
+   * is what kept chats started days earlier landing on the account they happened to start
+   * on — five of them resumed on one account in a single morning while another sat at 3%.
+   * `cacheTtlMs` is the window to assume when the last turn did not report one.
    */
-  forSession(sessionId: string, excludeIds?: Set<string>): AccountWithTokens | null {
+  forSession(sessionId: string, excludeIds?: Set<string>, opts?: { cacheTtlMs?: number }): AccountWithTokens | null {
     this.clearExpiredCooldowns();
     const boundId = getSessionAccount(sessionId);
-    if (boundId && !excludeIds?.has(boundId) && this.isUsable(boundId)) {
+    const lapsed = !!boundId && this.bindingOutlivedCache(sessionId, boundId, opts?.cacheTtlMs);
+    if (boundId && !lapsed && !excludeIds?.has(boundId) && this.isUsable(boundId)) {
       // Hold the binding while it has room, and also when nothing else does. In that second
       // case next() falls back to returning a near-capped account anyway, and round-robin
       // would hand back a different one each turn — paying a full cache write per turn to
@@ -258,14 +271,44 @@ class AccountSelectorService {
     }
     const picked = this.next(excludeIds);
     if (picked) this.bindSession(sessionId, picked.id);
+    if (lapsed && picked && picked.id !== boundId) {
+      log.info(`session=${sessionId} prompt cache lapsed on ${boundId} — routed to ${picked.id}`);
+    } else if (picked && picked.id !== boundId) {
+      // Why the binding above was not held (the cache lapse has its own line).
+      const reason = !boundId ? "unbound"
+        : excludeIds?.has(boundId) ? "excluded"
+        : !this.isUsable(boundId) ? "unusable"
+        : "no_quota";
+      log.info(`session=${sessionId} bound to ${picked.id} strategy=${this.getStrategy()} reason=${reason}`);
+    }
     return picked;
   }
 
+  /**
+   * Whether a session's binding has outlived the prompt cache it exists to protect.
+   *
+   * Two bindings hold whatever the clock says. One with no completed turn behind it has
+   * cached nothing yet: it is the account the tab showed before the first message. And one
+   * that differs from the account the last turn ran on was set since — picked in the usage
+   * panel, or forced by a switch — and the next turn is the one it was set for.
+   */
+  private bindingOutlivedCache(sessionId: string, boundId: string, fallbackTtlMs?: number): boolean {
+    const last = getLastTurnCacheState(sessionId);
+    if (!last) return false;
+    if (last.accountId && last.accountId !== boundId) return false;
+    const ttlMs = last.cacheTtlMs ?? fallbackTtlMs;
+    if (ttlMs == null) return false;
+    return Date.now() - last.endedAtMs >= ttlMs;
+  }
+
   /** Move a session onto an account — used when a switch is forced (rate/usage limit, auth). */
   bindSession(sessionId: string, accountId: string): void {
     setSessionAccount(sessionId, accountId);
   }
 
+  /** Whether the last next() found every candidate near its cap — logged once per change, not per turn. */
+  private allNearCap = false;
+
   /**
    * Pick next available account (skips cooldown/disabled).
    * Returns null if no active accounts available.
@@ -298,12 +341,15 @@ class AccountSelectorService {
       const sorted = [...candidates].sort((a, b) => b.priority - a.priority || a.createdAt - b.createdAt);
       pickedId = sorted[0]!.id;
     } else {
-      // Round-robin
-      this.cursor = this.cursor % candidates.length;
-      pickedId = candidates[this.cursor]!.id;
-      this.cursor = (this.cursor + 1) % candidates.length;
+      pickedId = this.pickRoundRobin(candidates);
+      setConfigValue(ROUND_ROBIN_LAST_KEY, pickedId);
     }
     this._lastPickedId = pickedId;
+    if ((withRoom.length === 0) !== this.allNearCap) {
+      this.allNearCap = withRoom.length === 0;
+      if (this.allNearCap) log.warn(`all ${notExcluded.length} accounts near quota cap — picking ${pickedId} anyway`);
+      else log.info(`accounts have quota room again — picked ${pickedId}`);
+    }
     const result = accountService.getWithTokens(pickedId);
     if (!result) {
       this._lastFailReason = "all_decrypt_failed";
@@ -339,12 +385,28 @@ class AccountSelectorService {
       const sorted = [...candidates].sort((a, b) => b.priority - a.priority || a.createdAt - b.createdAt);
       pickedId = sorted[0]!.id;
     } else {
-      const idx = this.cursor % candidates.length;
-      pickedId = candidates[idx]!.id;
+      pickedId = this.pickRoundRobin(candidates);
     }
     return accountService.getWithTokens(pickedId);
   }
 
+  /**
+   * The round-robin pick: the first candidate after the account handed out last.
+   *
+   * The position used to be an index held in memory, which failed in two ways. A restart —
+   * several a day on an install that is also being developed — set it back to zero, so the
+   * first account served the first chat after every one. And it indexed `candidates`, a
+   * list that shrinks whenever an account crosses the 5-hour skip or is excluded, so the
+   * index then pointed past the account whose turn it was. Keyed on an account id in the
+   * full account order and stored in the config table, it survives both.
+   */
+  private pickRoundRobin(candidates: { id: string }[]): string {
+    const order = accountService.list().map((a) => a.id);
+    const last = getConfigValue(ROUND_ROBIN_LAST_KEY);
+    const lastIdx = last ? order.indexOf(last) : -1;
+    return (candidates.find((a) => order.indexOf(a.id) > lastIdx) ?? candidates[0]!).id;
+  }
+
   /**
    * Weighted sustainability score.
    * Considers 5-hour utilization, weekly utilization, and time until weekly reset.
@@ -400,7 +462,7 @@ class AccountSelectorService {
     const backoffMs = Math.min(BACKOFF_BASE_MS * Math.pow(2, retries - 1), BACKOFF_MAX_MS);
     const cooldownUntilMs = Date.now() + backoffMs;
     accountService.setCooldown(accountId, cooldownUntilMs);
-    console.log(`[accounts] ${accountId} rate limited — cooldown ${Math.round(backoffMs / 1000)}s (retry #${retries})`);
+    log.warn(`account ${accountId} cooldown reason=rate_limit for=${Math.round(backoffMs / 1000)}s until=${new Date(cooldownUntilMs).toISOString()} retry=#${retries}`);
   }
 
   /** Called when account hits a hard usage/session limit (5h/weekly cap).
@@ -413,7 +475,7 @@ class AccountSelectorService {
       resetAtMs && resetAtMs > Date.now() ? resetAtMs : Date.now() + FALLBACK_MS;
     accountService.setCooldown(accountId, cooldownUntilMs);
     const mins = Math.round((cooldownUntilMs - Date.now()) / 60_000);
-    console.log(`[accounts] ${accountId} usage limit — cooldown ${mins}m (until reset)`);
+    log.warn(`account ${accountId} cooldown reason=usage_limit for=${mins}m until=${new Date(cooldownUntilMs).toISOString()}${resetAtMs && resetAtMs > Date.now() ? "" : " (no reset time — 1h fallback)"}`);
   }
 
   /** Called when auth error (401 / authentication_failed) — cooldown with longer backoff */
@@ -423,7 +485,7 @@ class AccountSelectorService {
     if (!this.isCooldownEnabled()) return;
     const backoffMs = Math.min(AUTH_BACKOFF_BASE_MS * Math.pow(2, retries - 1), BACKOFF_MAX_MS);
     accountService.setCooldown(accountId, Date.now() + backoffMs);
-    console.log(`[accounts] ${accountId} auth error — cooldown ${Math.round(backoffMs / 1000)}s (retry #${retries})`);
+    log.warn(`account ${accountId} cooldown reason=auth_error for=${Math.round(backoffMs / 1000)}s until=${new Date(Date.now() + backoffMs).toISOString()} retry=#${retries}`);
   }
 
   private static readonly PREFLIGHT_BACKOFF_BASE_MS = 60_000; // 1 minute
@@ -440,7 +502,7 @@ class AccountSelectorService {
       AccountSelectorService.PREFLIGHT_BACKOFF_MAX_MS,
     );
     accountService.setCooldown(accountId, Date.now() + backoffMs);
-    console.log(`[accounts] ${accountId} preflight refresh failed — cooldown ${Math.round(backoffMs / 1000)}s (retry #${retries})`);
+    log.warn(`account ${accountId} cooldown reason=preflight_refresh_failed for=${Math.round(backoffMs / 1000)}s until=${new Date(Date.now() + backoffMs).toISOString()} retry=#${retries}`);
   }
 
   /** Called on successful request — reset retry count + track usage */