@jameslovespancakes/pi-plus 1.0.21 → 1.0.23

package/src/core/gemini/oauth.ts

@@ -6,7 +6,9 @@ import type {
 } from "@earendil-works/pi-ai";
 import { startOAuthCallbackServer, type OAuthCallbackServer } from "../oauth/callback-server.ts";
 import { generatePkce, generateState, parseCallback } from "../oauth/pkce.ts";
-import { geminiEnv, discoverProjectId, fallbackProjectId, fetchUserEmail } from "./client.ts";
+import {
+  geminiEnv, discoverProjectId, fallbackProjectId, fetchUserEmail, fetchUserQuota, GeminiVerificationRequiredError,
+} from "./client.ts";
 import {
   credentialEmail,
   credentialProjectId,
@@ -140,6 +142,55 @@ async function awaitCode(
   return parsed.code;
 }
 
+/** OAuth alone does not clear Google's account-verification gate. No inference is sent. */
+export async function confirmGeminiAccess(
+  credential: OAuthCredential,
+  interaction: ProviderAuthInteraction,
+): Promise<OAuthCredential> {
+  let openedUrl: string | undefined;
+  // Every retry requires user input; no background polling or endless browser loop.
+  for (let attempt = 0; attempt < 4; attempt++) {
+    interaction.signal.throwIfAborted();
+    interaction.notify({ type: "progress", message: "Confirming Gemini account access…" });
+    const signal = AbortSignal.any([interaction.signal, AbortSignal.timeout(30_000)]);
+    if (credential.expires <= Date.now() + 60_000) credential = await refresh(credential, signal);
+    // Verification may also have blocked login-time project discovery.
+    if (attempt > 0 && !credentialProjectId(credential)) {
+      const projectId = await discoverProjectId(credential.access, signal);
+      if (projectId) credential = { ...credential, projectId } as GeminiCredential;
+    }
+    try {
+      await fetchUserQuota(credential.access, requestProjectId(credential), signal);
+      interaction.signal.throwIfAborted();
+      return credential;
+    } catch (error) {
+      interaction.signal.throwIfAborted();
+      if (!(error instanceof GeminiVerificationRequiredError)) throw error;
+      if (attempt === 3) throw new Error("Google verification is still required; Gemini sign-in was not completed. Finish verification and retry.", { cause: error });
+      if (error.verificationUrl && error.verificationUrl !== openedUrl) {
+        openedUrl = error.verificationUrl;
+        interaction.notify({
+          type: "auth_url", url: openedUrl,
+          instructions: "Complete Google's verification using the account you just signed into. Then return here to check access.",
+        });
+      } else {
+        interaction.notify({ type: "info", message: error.message });
+      }
+      const action = await interaction.prompt({
+        type: "select",
+        message: "Gemini sign-in is pending Google verification.",
+        options: [
+          { id: "check", label: "I've completed verification — check again" },
+          { id: "cancel", label: "Cancel sign-in" },
+        ],
+        signal: interaction.signal,
+      });
+      if (action !== "check") throw new Error("Gemini sign-in cancelled; account access was not confirmed.", { cause: error });
+    }
+  }
+  throw new Error("Gemini account access was not confirmed.");
+}
+
 async function login(interaction: ProviderAuthInteraction): Promise<OAuthCredential> {
   const { verifier, challenge } = await generatePkce();
   // Independent of the verifier: a leaked callback URL must not disclose it.
@@ -148,7 +199,7 @@ async function login(interaction: ProviderAuthInteraction): Promise<OAuthCredent
   const server = await startOAuthCallbackServer({
     port: CALLBACK_PORT,
     path: CALLBACK_PATH,
-    successMessage: "Gemini sign-in complete. You can close this window and return to pi.",
+    successMessage: "Google authorization received. Return to pi to confirm Gemini access and complete any required verification.",
   }).catch((error: unknown) => {
     throw new Error(
       `Could not listen on port ${CALLBACK_PORT} for the Google callback`
@@ -184,14 +235,14 @@ async function login(interaction: ProviderAuthInteraction): Promise<OAuthCredent
       discoverProjectId(token.access_token, interaction.signal),
     ]);
 
-    return {
+    return await confirmGeminiAccess({
       type: "oauth",
       access: token.access_token,
       refresh: token.refresh_token,
       expires: expiresAt(token),
       ...(projectId && { projectId }),
       ...(email && { email }),
-    } satisfies GeminiCredential;
+    } satisfies GeminiCredential, interaction);
   } finally {
     server.close();
   }

package/src/core/oauth/callback-server.ts

@@ -46,7 +46,7 @@ function page(title: string, message: string, details?: string): string {
 }
 
 export function oauthSuccessHtml(message: string): string {
-  return page("Signed in", message);
+  return page("Authorization received", message);
 }
 
 export function oauthErrorHtml(message: string, details?: string): string {

package/src/core/policy/openrouter.ts

@@ -0,0 +1,54 @@
+import type { Api, Model, StreamOptions } from "@earendil-works/pi-ai";
+
+function officialEndpoint(model: Model<Api>): boolean {
+  try {
+    const url = new URL(model.baseUrl);
+    const path = model.api === "anthropic-messages" ? "/api" : "/api/v1";
+    return url.origin === "https://openrouter.ai" && url.pathname.replace(/\/+$/, "") === path
+      && !url.username && !url.password && !url.search && !url.hash;
+  } catch { return false; }
+}
+
+/** Enforce through pi's own routing support, without replacing its provider or tools. */
+export function withOpenRouterZdr(model: Model<Api>, options?: StreamOptions) {
+  if (!["openai-completions", "anthropic-messages"].includes(model.api) || !officialEndpoint(model)) {
+    throw new Error("OpenRouter On (ZDR) cannot enforce this API or endpoint. Use pi's native OpenRouter Chat Completions or Messages route.");
+  }
+  const preferences = model.compat && "openRouterRouting" in model.compat ? model.compat.openRouterRouting : undefined;
+  return {
+    model: model.api === "openai-completions" ? {
+      ...model,
+      compat: {
+        ...model.compat,
+        openRouterRouting: { ...preferences, zdr: true },
+      },
+    } : model,
+    options: {
+      ...options,
+      // Run caller instrumentation first, then enforce the final request's
+      // privacy restriction. No retry without ZDR is allowed.
+      onPayload: async (payload: unknown, requestModel: Model<Api>) => {
+        const replacement = await options?.onPayload?.(payload, requestModel);
+        const body = replacement === undefined ? payload : replacement;
+        if (!body || typeof body !== "object" || !("messages" in body) || !Array.isArray(body.messages)
+          || "input" in body || "instructions" in body) {
+          throw new Error("OpenRouter On (ZDR) blocked an unsupported request payload.");
+        }
+        const routing = "provider" in body ? body.provider : undefined;
+        // Pi natively serializes openRouterRouting on Chat Completions. Its
+        // Anthropic adapter does not, although OpenRouter's Messages API accepts
+        // the same provider preferences. Add only that missing request field.
+        if (model.api === "anthropic-messages") {
+          if (routing !== undefined && (!routing || typeof routing !== "object" || Array.isArray(routing))) {
+            throw new Error("OpenRouter On (ZDR) blocked malformed provider preferences.");
+          }
+          return { ...body, provider: { ...preferences, ...routing, zdr: true } };
+        }
+        if (!routing || typeof routing !== "object" || !("zdr" in routing) || routing.zdr !== true) {
+          throw new Error("OpenRouter On (ZDR) blocked a request without provider.zdr=true.");
+        }
+        return body;
+      },
+    },
+  };
+}

package/src/core/policy/policy.ts

@@ -1,45 +1,29 @@
 import { readConfig, updateConfig } from "../config.ts";
 
-/**
- * Approval policy for model selection.
- *
- * Subscription providers are free to use. Metered providers (OpenRouter and
- * anything else that bills per token) require an explicit approval before a
- * request is allowed to leave the machine.
- */
-
 export interface PolicyFile {
   autoApprove: string[];
   requireApproval: string[];
   deny: string[];
 }
 
-const DEFAULT_POLICY: PolicyFile = {
-  // `google/*` is the metered Gemini API; `gemini/*` is the subscription,
-  // which the account's plan has already paid for.
-  autoApprove: ["anthropic/*", "openai-codex/*", "gemini/*"],
-  requireApproval: ["openrouter/*", "google/*", "openai/*", "xai/*"],
-  deny: [],
-};
-
 export type Decision =
   | { allowed: true; reason: "auto" | "approved" }
   | { allowed: false; reason: "denied" | "needs-approval"; message: string };
 
-const approvals = new Map<string, number>();
+export type ProviderState = "auto" | "approved" | "blocked" | "denied" | "zdr";
+
+export interface ProviderApproval {
+  provider: string;
+  approved: boolean;
+  until?: number;
+}
 
 export function loadPolicy(): PolicyFile {
   return readConfig().policy;
 }
 
 export function savePolicy(next: PolicyFile): void {
-  updateConfig((config) => {
-    config.policy = {
-      autoApprove: next.autoApprove ?? DEFAULT_POLICY.autoApprove,
-      requireApproval: next.requireApproval ?? DEFAULT_POLICY.requireApproval,
-      deny: next.deny ?? DEFAULT_POLICY.deny,
-    };
-  });
+  updateConfig((config) => { config.policy = next; });
 }
 
 function matches(pattern: string, value: string): boolean {
@@ -51,135 +35,130 @@ function matchesAny(patterns: string[], value: string): boolean {
   return patterns.some((pattern) => matches(pattern, value));
 }
 
-/**
- * Provider ids that require approval, derived from the policy patterns so the
- * toggle list always reflects the configured file rather than a hardcoded set.
- */
+/** Configured approval gates, independent of a session's live grants. */
 export function gatedProviders(): string[] {
-  const names = loadPolicy().requireApproval
-    .map((pattern) => pattern.split("/")[0])
+  const names = loadPolicy().requireApproval.map((pattern) => pattern.split("/")[0])
     .filter((name) => name && !name.includes("*"));
   return [...new Set(names)].sort();
 }
 
-export type ProviderState = "auto" | "approved" | "blocked" | "denied";
+/** Runtime grants belong to an extension session, never a shared module or config file. */
+export class ProviderPolicy {
+  private readonly approvals = new Map<string, number>();
+  private openRouterMode: "off" | "on" | "zdr" | undefined;
 
-/** How the policy currently treats a provider, for display and toggling. */
-export function providerState(provider: string): ProviderState {
-  const current = loadPolicy();
-  if (matchesAny(current.deny, `${provider}/*`) || matchesAny(current.deny, provider)) return "denied";
-  if (matchesAny(current.requireApproval, `${provider}/*`)) {
-    return isApproved(provider) ? "approved" : "blocked";
+  reset(): void {
+    this.approvals.clear();
+    this.openRouterMode = undefined;
   }
-  return "auto";
-}
 
-/**
- * Flips whether a provider may be used.
- *
- * Auto-approved providers are moved into `requireApproval` so the switch is
- * reversible; gated ones just gain or lose their session grant. Denied
- * providers are left alone; `deny` is an explicit, deliberate block.
- */
-export function toggleProvider(provider: string): ProviderState {
-  const state = providerState(provider);
-  if (state === "denied") return state;
-
-  if (state === "auto") {
-    const current = loadPolicy();
-    savePolicy({
-      ...current,
-      autoApprove: current.autoApprove.filter((pattern) => !matches(pattern, `${provider}/*`) && pattern !== `${provider}/*`),
-      requireApproval: [...new Set([...current.requireApproval, `${provider}/*`])],
-    });
-    revoke(provider);
-    return "blocked";
+  openRouterZdrRequired(): boolean {
+    return this.openRouterMode === "zdr";
   }
 
-  if (state === "approved") {
-    revoke(provider);
-    return "blocked";
+  approveOpenRouterZdr(): void {
+    this.approve("openrouter");
+    this.openRouterMode = "zdr";
   }
 
-  approve(provider);
-  return "approved";
-}
-
-/** Grant approval for a provider until `untilMs` (omitted means this session). */
-export function approve(provider: string, durationMs?: number): void {
-  approvals.set(provider, durationMs ? Date.now() + durationMs : Number.MAX_SAFE_INTEGER);
-}
-
-export function revoke(provider: string): void {
-  approvals.delete(provider);
-}
-
-export function isApproved(provider: string): boolean {
-  const until = approvals.get(provider);
-  return until !== undefined && Date.now() < until;
-}
+  /** No duration means a grant for this session only. */
+  approve(provider: string, durationMs?: number): void {
+    this.approvals.set(provider, durationMs ? Date.now() + durationMs : Number.MAX_SAFE_INTEGER);
+    if (provider === "openrouter") this.openRouterMode = "on";
+  }
 
-/** Flips a provider's approval and reports the resulting state. */
-export function toggleApproval(provider: string): boolean {
-  if (isApproved(provider)) {
-    revoke(provider);
-    return false;
+  revoke(provider: string): void {
+    this.approvals.delete(provider);
+    if (provider === "openrouter") this.openRouterMode = "off";
   }
-  approve(provider);
-  return true;
-}
 
-export interface ProviderApproval {
-  provider: string;
-  approved: boolean;
-  until?: number;
-}
+  isApproved(provider: string): boolean {
+    const until = this.approvals.get(provider);
+    return until !== undefined && Date.now() < until;
+  }
 
-/** Current approval state for every gated provider, for display. */
-export function approvalStates(): ProviderApproval[] {
-  return gatedProviders().map((provider) => {
-    const until = approvals.get(provider);
-    const approved = until !== undefined && Date.now() < until;
-    return { provider, approved, until: approved && until !== Number.MAX_SAFE_INTEGER ? until : undefined };
-  });
-}
+  providerState(provider: string): ProviderState {
+    const current = loadPolicy();
+    if (matchesAny(current.deny, `${provider}/*`) || matchesAny(current.deny, provider)) return "denied";
+    if (provider === "openrouter" && this.openRouterMode !== undefined) {
+      return this.isApproved(provider) ? (this.openRouterZdrRequired() ? "zdr" : "approved") : "blocked";
+    }
+    if (matchesAny(current.requireApproval, `${provider}/*`)) {
+      return this.isApproved(provider) ? "approved" : "blocked";
+    }
+    return "auto";
+  }
 
-export function checkModel(provider: string, modelId: string): Decision {
-  const current = loadPolicy();
-  const ref = `${provider}/${modelId}`;
+  /** Only OpenRouter cycles through a third (ZDR-only) state. */
+  toggleProvider(provider: string): ProviderState {
+    const state = this.providerState(provider);
+    if (state === "denied") return state;
+    if (provider === "openrouter") {
+      if (state === "auto" || state === "approved") this.approveOpenRouterZdr();
+      else if (state === "zdr") this.revoke(provider);
+      else this.approve(provider);
+      return this.providerState(provider);
+    }
+    if (state === "auto") {
+      const current = loadPolicy();
+      savePolicy({
+        ...current,
+        autoApprove: current.autoApprove.filter((pattern) => !matches(pattern, `${provider}/*`)),
+        requireApproval: [...new Set([...current.requireApproval, `${provider}/*`])],
+      });
+      this.revoke(provider);
+      return "blocked";
+    }
+    return this.toggleApproval(provider) ? "approved" : "blocked";
+  }
 
-  if (matchesAny(current.deny, ref) || matchesAny(current.deny, `${provider}/*`)) {
-    return { allowed: false, reason: "denied", message: `${ref} is denied by model policy.` };
+  toggleApproval(provider: string): boolean {
+    if (this.isApproved(provider)) { this.revoke(provider); return false; }
+    this.approve(provider);
+    return true;
   }
-  if (matchesAny(current.autoApprove, ref)) return { allowed: true, reason: "auto" };
-
-  const gated = matchesAny(current.requireApproval, ref);
-  if (!gated) return { allowed: true, reason: "auto" };
-
-  if (!isApproved(provider)) {
-    return {
-      allowed: false,
-      reason: "needs-approval",
-      message:
-        `${ref} is a metered (pay-per-token) model and is not approved in this session. `
-        + `Use a subscription model such as anthropic/* or openai-codex/*, or ask the user to run `
-        + `/provider approve ${provider}.`,
-    };
+
+  approvalStates(): ProviderApproval[] {
+    const ids = new Set([...gatedProviders(), ...this.approvals.keys()]);
+    return [...ids].sort().map((provider) => {
+      const until = this.approvals.get(provider);
+      const approved = this.isApproved(provider);
+      return { provider, approved, until: approved && until !== Number.MAX_SAFE_INTEGER ? until : undefined };
+    });
   }
 
-  return { allowed: true, reason: "approved" };
-}
+  checkModel(provider: string, modelId: string): Decision {
+    const current = loadPolicy();
+    const ref = `${provider}/${modelId}`;
+    if (matchesAny(current.deny, ref) || matchesAny(current.deny, `${provider}/*`) || matchesAny(current.deny, provider)) {
+      return { allowed: false, reason: "denied", message: `${ref} is denied by model policy.` };
+    }
+    // Explicit OpenRouter Off must override even an auto-approve wildcard.
+    const explicitOpenRouterMode = provider === "openrouter" && this.openRouterMode !== undefined;
+    if (!explicitOpenRouterMode && matchesAny(current.autoApprove, ref)) return { allowed: true, reason: "auto" };
+    if (!explicitOpenRouterMode && !matchesAny(current.requireApproval, ref)) return { allowed: true, reason: "auto" };
+    if (!this.isApproved(provider)) {
+      return {
+        allowed: false, reason: "needs-approval",
+        message: `${ref} is a metered (pay-per-token) model and is not approved in this session. `
+          + "Use a subscription model such as anthropic/* or openai-codex/*, or ask the user to run "
+          + `/provider approve ${provider}.`,
+      };
+    }
+    return { allowed: true, reason: "approved" };
+  }
 
-export function policySummary(): string {
-  const current = loadPolicy();
-  const active = approvalStates()
-    .filter((entry) => entry.approved)
-    .map((entry) => `${entry.provider}${entry.until ? ` (until ${new Date(entry.until).toLocaleTimeString()})` : " (session)"}`);
-  return [
-    "Model approval policy",
-    `  auto-approved:    ${current.autoApprove.join(", ") || "none"}`,
-    `  needs approval:   ${current.requireApproval.join(", ") || "none"}`,
-    `  denied:           ${current.deny.join(", ") || "none"}`,
-    `  approved now:     ${active.join(", ") || "none"}`,
-  ].join("\n");
+  policySummary(): string {
+    const current = loadPolicy();
+    const active = this.approvalStates().filter((entry) => entry.approved).map((entry) =>
+      `${entry.provider}${entry.provider === "openrouter" && this.openRouterZdrRequired() ? " (ZDR)" : ""}`
+      + (entry.until ? ` (until ${new Date(entry.until).toLocaleTimeString()})` : " (session)"));
+    return [
+      "Model approval policy",
+      `  auto-approved:    ${current.autoApprove.join(", ") || "none"}`,
+      `  needs approval:   ${current.requireApproval.join(", ") || "none"}`,
+      `  denied:           ${current.deny.join(", ") || "none"}`,
+      `  approved now:     ${active.join(", ") || "none"}`,
+    ].join("\n");
+  }
 }

package/src/core/quota/usage-source.ts

@@ -1,10 +1,11 @@
 import { loadOAuthPool, saveOAuthAccount, sharedOAuthPoolStore, type PooledOAuthAccount } from "../accounts/oauth-pool.ts";
 import { refreshAbortSignal, type AccountQuotaState } from "../accounts/routing.ts";
 import { anthropicAccountIdentity, cachedAnthropicAccountIdentity } from "../anthropic/identity.ts";
-import { loadAccounts, saveAccount, type Account as AnthropicAccount } from "../anthropic/store.ts";
-import { refreshToken } from "../anthropic/oauth.ts";
+import { loadAccounts, type Account as AnthropicAccount } from "../anthropic/store.ts";
+import { ensureAccessToken } from "../anthropic/quota.ts";
+import { readClaudeQuota } from "../anthropic/usage-cache.ts";
 import { claimsOf } from "../codex/store.ts";
-import { fetchUserQuota } from "../gemini/client.ts";
+import { fetchUserQuota, GeminiVerificationRequiredError } from "../gemini/client.ts";
 import { credentialEmail } from "../gemini/credentials.ts";
 import { geminiOAuth, requestProjectId } from "../gemini/oauth.ts";
 import { summarizeGeminiQuota } from "../gemini/quota.ts";
@@ -15,9 +16,8 @@ import { CLAUDE_FRESH_MS, OBSERVED_PROVIDERS, type UsageRow } from "./pool.ts";
  * Fetches subscription quota from the Claude, Codex and Gemini endpoints, and
  * reports what response headers showed for providers with no usage endpoint.
  *
- * Pure data access: no pi imports, no module-level mutable state, no rendering.
- * Everything here returns values so it can be tested without a live agent.
- * Scheduling, caching and retention belong to services/usage-service.ts.
+ * No pi imports or rendering. Claude quota/cooldown is shared in usage-cache.ts;
+ * display scheduling and retention belong to services/usage-service.ts.
  */
 
 const TIMEOUT_MS = 10_000;
@@ -101,72 +101,6 @@ function resetToMs(value: unknown): number | undefined {
   return undefined;
 }
 
-async function claudeUsage(group: string, token: string): Promise<{ rows: UsageRow[]; error?: string }> {
-  const response = await fetch("https://api.anthropic.com/api/oauth/usage", {
-    headers: { Authorization: `Bearer ${token}`, "anthropic-beta": "oauth-2025-04-20", Accept: "application/json" },
-    signal: AbortSignal.timeout(TIMEOUT_MS),
-  });
-  if (!response.ok) return { rows: [], error: `${group}: HTTP ${response.status}` };
-  const body = await response.json() as any;
-
-  const rows: UsageRow[] = [];
-  const push = (label: string, window: any) => {
-    const used = pct(window?.utilization);
-    if (used === undefined) return;
-    rows.push({
-      group,
-      label,
-      remaining: 100 - used,
-      resetAt: resetToMs(window?.resets_at),
-      capacity: typeof window?.limit_dollars === "number" && window.limit_dollars > 0 ? window.limit_dollars : undefined,
-    });
-  };
-  push("5h", body.five_hour);
-  push("7d", body.seven_day);
-  // Scoped labels are lower case in every source (the stored snapshot keeps
-  // lower-cased ids), or one limit pools as two half-reported windows.
-  push("7d opus", body.seven_day_opus ?? body.seven_day_omelette);
-  push("7d sonnet", body.seven_day_sonnet);
-
-  for (const limit of Array.isArray(body.limits) ? body.limits : []) {
-    const scoped = limit?.scope?.model?.display_name;
-    const used = pct(limit?.percent);
-    if (typeof scoped !== "string" || !scoped || used === undefined) continue;
-    const label = `7d ${scoped.toLowerCase()}`;
-    if (rows.some((row) => row.label === label)) continue;
-    rows.push({ group, label, remaining: 100 - used, resetAt: resetToMs(limit?.resets_at) });
-  }
-
-  const extra = body.extra_usage;
-  if (extra?.is_enabled && pct(extra?.utilization) !== undefined) {
-    rows.push({ group, label: "Extra", remaining: 100 - pct(extra.utilization)! });
-  }
-
-  return rows.length
-    ? { rows: rows.map((row) => ({ ...row, checkedAt: Date.now() })) }
-    : { rows: [], error: `${group}: usage windows unavailable` };
-}
-
-/**
- * HUD polling must never wait indefinitely on OAuth refresh or retry it behind
- * a live agent turn. The provider owns request-time refresh/retry policy.
- */
-async function fallbackAccountToken(account: AnthropicAccount): Promise<string | undefined> {
-  const valid = typeof account.expires === "number" && Date.now() + 60_000 < account.expires;
-  if (valid && account.access) return account.access;
-  if (!account.refresh) return account.access;
-
-  const refreshed = await refreshToken({ refreshToken: account.refresh, maxRetries: 0 });
-  saveAccount({
-    ...account,
-    access: refreshed.access,
-    refresh: refreshed.refresh,
-    expires: refreshed.expires,
-    lastRefreshedAt: Date.now(),
-  });
-  return refreshed.access;
-}
-
 
 /**
  * Builds usage rows from a stored quota snapshot.
@@ -190,11 +124,14 @@ function rowsFromSnapshot(group: string, quota: any): UsageRow[] | undefined {
       resetAt: resetToMs(window.resetsAt),
       // Required: pool.isFresh discards any row without it, which would make
       // every cached row pool as "n/a".
-      checkedAt: window.checkedAt ?? quota.checkedAt ?? Date.now(),
+      checkedAt: window.checkedAt ?? quota.checkedAt,
+      capacity: window.capacity,
+      stale: Date.now() - (window.checkedAt ?? quota.checkedAt ?? 0) >= CLAUDE_FRESH_MS,
     });
   };
   push("5h", quota.five_hour);
   push("7d", quota.seven_day);
+  push("Extra", quota.extra);
   for (const scoped of Array.isArray(quota.scoped) ? quota.scoped : []) {
     if (typeof scoped?.remainingPercent !== "number" || typeof scoped?.id !== "string" || !scoped.id) continue;
     // Snapshots written before the fix restate the 5h/7d windows as "scoped".
@@ -213,7 +150,7 @@ export async function fetchClaudeRows(
   const read = options.readCredential ?? readAuthFile;
   const rows: UsageRow[] = [];
   const errors: string[] = [];
-  const accounts: Array<{ group: string; token?: string; account?: AnthropicAccount }> = [];
+  const accounts: Array<{ group: string; token?: string; identity?: string; account?: AnthropicAccount }> = [];
   const groups = new Set<string>();
 
   let sidecars: AnthropicAccount[] = [];
@@ -234,9 +171,9 @@ export async function fetchClaudeRows(
       // Counting it twice filed every window twice and marked the pool partial.
       const identity = cachedAnthropicAccountIdentity(primary.access)
         ?? await anthropicAccountIdentity(primary.access).catch(() => undefined);
-      const twin = identity ? sidecars.find((account) => account.identity === identity) : undefined;
+      const twin = sidecars.find((account) => account.access === primary.access || (identity && account.identity === identity));
       if (!twin) {
-        accounts.push({ group: primaryGroup, token: primary.access });
+        accounts.push({ group: primaryGroup, token: primary.access, identity });
         groups.add(primaryGroup);
       }
     }
@@ -246,28 +183,28 @@ export async function fetchClaudeRows(
     errors.push(`${primaryGroup}: ${errorText(error)}`);
   }
 
+  const seen = new Set<string>();
   for (const account of sidecars) {
+    const key = account.identity ?? account.access ?? account.id;
+    if (seen.has(key)) continue;
+    seen.add(key);
     accounts.push({ group: claudeGroup(account), account });
     groups.add(claudeGroup(account));
   }
 
   for (const entry of accounts) {
     try {
-      // Cached snapshot first: it is free, current, and cannot be throttled.
-      const cached = rowsFromSnapshot(entry.group, entry.account?.quota);
-      if (cached) {
-        rows.push(...cached);
-        continue;
-      }
-
-      const token = entry.token ?? (entry.account ? await fallbackAccountToken(entry.account) : undefined);
+      const token = entry.token ?? (entry.account ? await ensureAccessToken(entry.account) : undefined);
       if (!token) {
         errors.push(`${entry.group}: no token`);
         continue;
       }
-      const result = await claudeUsage(entry.group, token);
-      rows.push(...result.rows);
-      if (result.error) errors.push(result.error);
+      const result = await readClaudeQuota({
+        access: token, identity: entry.identity ?? entry.account?.identity,
+        id: entry.account?.id, quota: entry.account?.quota,
+      });
+      rows.push(...(rowsFromSnapshot(entry.group, result.quota) ?? []));
+      if (result.error) errors.push(`${entry.group}: ${result.error}`);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       errors.push(/invalid_grant/i.test(message)
@@ -436,13 +373,14 @@ export async function fetchGeminiRows(
       return rows.length ? { rows } : { rows, error: `${entry.group}: quota unavailable` };
     } catch (error) {
       const message = errorText(error);
+      const reauth = entry.account ? `/accounts reauth gemini ${entry.account.label || entry.account.id}` : "/login gemini";
       return {
         rows: [],
-        error: /invalid_grant/i.test(message)
-          ? `${entry.group}: login expired, run ${entry.account
-            ? `/accounts reauth gemini ${entry.account.label || entry.account.id}`
-            : "/login gemini"}`
-          : `${entry.group}: ${message}`,
+        error: error instanceof GeminiVerificationRequiredError
+          ? `${entry.group}: Google account verification required; run ${reauth} to complete verification.`
+          : /invalid_grant/i.test(message)
+            ? `${entry.group}: login expired, run ${reauth}`
+            : `${entry.group}: ${message}`,
       };
     }
   }));