@phnx-labs/agents-cli 1.22.120 → 1.22.121

package/dist/lib/accounting/usage.js

@@ -1,14 +1,3 @@
-/**
- * Usage and rate-limit tracking for Claude, Codex, Kimi, Droid, Grok, Cursor,
- * and Antigravity agents.
- *
- * Fetches live usage data from each agent's usage API (Anthropic OAuth for
- * Claude, Kimi Code /usages, Factory billing limits for Droid, Google Code
- * Assist :retrieveUserQuota for Antigravity) or parses rate-limit events from
- * Codex session logs. Results are normalized into a common UsageSnapshot
- * shape, cached to disk, and rendered as terminal progress bars for the
- * `agents view` command.
- */
 import { execFile } from 'child_process';
 import { createHash } from 'crypto';
 import * as fs from 'fs';
@@ -33,37 +22,12 @@ const CLAUDE_TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
 const CLAUDE_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
 const CLAUDE_OAUTH_BETA_HEADER = 'oauth-2025-04-20';
 const CLAUDE_REFRESH_LEEWAY_MS = 5 * 60 * 1000;
-/**
- * Why a usage read produced no snapshot, when the cause is the credential or the
- * server rather than the payload. Every provider used to return `error: null`
- * for all three, which made an account nobody can read indistinguishable from a
- * healthy one: the caller fell back to whatever was in the SWR cache and
- * rendered its bars as fact. On `yosemite-s1` that hid five Claude accounts
- * whose stored access token had expired — one of them eleven days earlier —
- * behind a cache frozen for 26h, and balanced routing launched into an account
- * that was actually at its weekly cap.
- *
- * No usage read ever refreshes a token (RUSH-1822 for Claude; the same rule for
- * Kimi/Droid/Cursor, whose own CLIs rotate on their next launch), so an expired
- * credential cannot heal on its own — the account stays unreadable until that
- * agent actually runs, or a long-lived token is provisioned for it.
- *
- * Shared across all four networked providers on purpose: the failure shape is
- * identical, and wiring only Claude would leave `agents view --refresh`
- * reporting Claude accounts while silently presenting stale Kimi, Droid, and
- * Cursor readings as confirmed.
- */
 export function usageNoCredentialError(agent) {
     return `No readable ${agent} credential — sign in, or provision a long-lived token for this account.`;
 }
 export function usageExpiredCredentialError(agent) {
     return `${agent} credential expired — re-auth this account (a usage read never refreshes it).`;
 }
-/**
- * Kimi-specific expired-credential wording. A normal Kimi launch refreshes its
- * own OAuth access token, so the recovery action for an expired Kimi credential
- * is to run Kimi once — not to re-auth through agents-cli (RUSH-3198).
- */
 export function usageExpiredKimiCredentialError() {
     return `Kimi credential expired — run Kimi once to refresh it (a usage read never refreshes it).`;
 }
@@ -72,31 +36,13 @@ export function usageRejectedError(agent, status) {
         ? `${agent} is rate-limiting the usage endpoint for this machine (HTTP 429).`
         : `${agent} rejected the usage read (HTTP ${status}).`;
 }
-/**
- * Canonical phrase for the Anthropic setup-token scope gap (RUSH-2392).
- * `claude setup-token` mints `user:inference` only; the usage endpoint requires
- * `user:profile`. The account can still run; usage bars cannot populate via
- * that token. Callers detect this string with {@link isUsageHeadlessScopeError}
- * so the UI can render it distinctly from a generic "unverified" failure.
- */
 export const USAGE_HEADLESS_SCOPE_MARKER = 'usage unavailable (headless)';
-/**
- * Distinct error when Claude's usage API returns 403 because the setup-token
- * lacks `user:profile` (RUSH-2392). Not a revocation, not a missing mint —
- * a permanent tradeoff of the headless credential.
- */
 export function usageHeadlessScopeError(agent = 'Claude') {
     return `${agent} ${USAGE_HEADLESS_SCOPE_MARKER} — setup-token lacks user:profile; account can still run.`;
 }
-/** True when an error string is the setup-token scope gap (RUSH-2392). */
 export function isUsageHeadlessScopeError(error) {
     return typeof error === 'string' && error.includes(USAGE_HEADLESS_SCOPE_MARKER);
 }
-/**
- * Canonical phrase for a Claude account the usage reader holds no usable
- * credential for. Distinct from {@link USAGE_HEADLESS_SCOPE_MARKER}, which
- * means a setup-token WAS read and the endpoint refused its scope.
- */
 export const USAGE_NO_USAGE_CREDENTIAL_MARKER = 'usage unavailable (no usage credential)';
 /**
  * Claude's own no-credential message. The shared
@@ -113,16 +59,9 @@ export function usageNoClaudeUsageCredentialError() {
     return (`Claude ${USAGE_NO_USAGE_CREDENTIAL_MARKER} — a usage read never uses your login ` +
         '(RUSH-1822); a setup-token cannot read usage (RUSH-2392). The account still runs.');
 }
-/** True when an error string is the Claude no-usage-credential state (#2987). */
 function isUsageNoUsageCredentialError(error) {
     return typeof error === 'string' && error.includes(USAGE_NO_USAGE_CREDENTIAL_MARKER);
 }
-/**
- * Detect Anthropic's usage-endpoint scope denial: HTTP 403 whose body names
- * `user:profile` (or "scope requirement"). A bare 403 without that body stays
- * classified as a real rejection — only the known setup-token shape is special
- * (RUSH-2392).
- */
 export function isClaudeUsageScopeDenied(status, bodyText) {
     if (status !== 403)
         return false;
@@ -131,18 +70,6 @@ export function isClaudeUsageScopeDenied(status, bodyText) {
     const lower = bodyText.toLowerCase();
     return lower.includes('user:profile') || lower.includes('scope requirement');
 }
-/**
- * The read threw rather than answering — a timeout, DNS/TLS failure, a payload
- * that would not parse, a credential that would not decrypt. Every provider
- * swallowed these into `error: null`, which is the same silence as an expired
- * token: the caller renders a stale snapshot as confirmed. The cause is carried
- * verbatim because these are the failures a user cannot otherwise see.
- */
-/**
- * The provider told us to back off and we are still inside that window, so this
- * read made no request at all. Distinct from `usageRejectedError(agent, 429)`,
- * which is the 429 itself: this one says we are *honouring* it.
- */
 export function usageThrottledError(agent, untilMs) {
     return `${agent} rate-limited this machine — not retrying for ${formatBackoffRemaining(untilMs)}.`;
 }
@@ -152,38 +79,9 @@ export function usageUnreachableError(agent, cause) {
         ? `${agent} usage read failed: ${detail}`
         : `${agent} usage read failed.`;
 }
-/**
- * Marker for a log-based (`network: false`) provider — Codex, Grok — that has
- * simply never recorded a rate-limit event on this machine yet: no session
- * log exists, or no session in it carries usage data. Distinct on purpose from
- * `usageUnreachableError`: that one means the local log COULDN'T be read (a
- * real failure worth surfacing distinctly); this one means there is nothing to
- * read because the account has not run here, which is expected for a fresh
- * install and should render as a benign state, not an error (RUSH-3040).
- */
 const USAGE_NO_RECENT_USAGE_MARKER = 'no usage recorded yet';
 export const USAGE_BENIGN_STATE = Symbol('usageBenignState');
-/**
- * Sentinel `UsageInfo.error` for a read-only lookup whose cache held nothing
- * (`getUsageInfoForIdentity`). No request was made and nothing failed — the
- * daemon simply has not collected this account yet. It was an unclassified
- * literal, so `classifyUsageErrorKind` fell through to `'rejected'` and
- * `agents view` printed the generic "usage unavailable" for a cold cache,
- * which reads as a failure the operator should chase (#2987). The string value
- * is unchanged; callers that already compare against `'stale'` keep working.
- */
 export const USAGE_NOT_COLLECTED_MARKER = 'stale';
-/**
- * Human-facing form of a `UsageInfo.error` for a machine/JSON consumer
- * (`agents view --json`'s `usageError`). Every error string this module
- * constructs is already a full human sentence EXCEPT the internal
- * {@link USAGE_NOT_COLLECTED_MARKER} (`'stale'`) sentinel, which a read-only
- * lookup returns for a never-cached account when `--refresh` was not passed. That
- * value is an internal cache signal, not an error message, and leaking it verbatim
- * contradicts the field's "human-readable" contract (PHNX-3348). Map it to a
- * plain-language, actionable string and pass every genuine error through
- * unchanged. Returns `null` when there is no error.
- */
 export function usageErrorForDisplay(error) {
     if (!error)
         return null;
@@ -192,18 +90,6 @@ export function usageErrorForDisplay(error) {
     }
     return error;
 }
-/**
- * Shared error-classification + 429 backoff for a networked usage fetch whose
- * only signal is an HTTP status (or none at all, on a network failure) —
- * Antigravity's :retrieveUserQuota and Muse's Meta Model API probe are both
- * this shape. They were added to `USAGE_SOURCES` after the four original
- * `usageXError` constructors and did not get their own scheme (usage.ts's
- * error handling was written for "four networked providers"; RUSH-3040).
- * Route every no-snapshot outcome for either through this one function so a
- * future entry cannot be added second-class again — it owns noting the 429
- * backoff, so callers must NOT also call {@link noteUsageRateLimited} for the
- * same response.
- */
 export function classifyUsageFetchFailure(agent, agentId, status, retryAfterHeader, usageScope) {
     if (status === 429) {
         noteUsageRateLimited(agentId, retryAfterHeader ?? null, { account: usageScope });
@@ -213,7 +99,6 @@ export function classifyUsageFetchFailure(agent, agentId, status, retryAfterHead
         return usageRejectedError(agent, status);
     return usageUnreachableError(agent);
 }
-/** Classify a `UsageInfo.error` string into its {@link UsageErrorKind}, or null when there is no error. */
 export function classifyUsageErrorKind(error) {
     if (!error)
         return null;
@@ -236,17 +121,6 @@ export function classifyUsageErrorKind(error) {
         return 'unreachable';
     return 'rejected';
 }
-/**
- * True when a Claude OAuth access token is within the refresh leeway of expiry
- * (or already expired) — i.e. it "would need a refresh" before the next use.
- *
- * Single source of truth for the expiry gate, shared by the two callers that
- * must agree on it but act differently: the run/usage hot path
- * (`getClaudeAccessToken`) refreshes when this is true; the health probe
- * (`probeClaudeStatus`) must NOT refresh and instead reports the non-fatal
- * `expired` state (RUSH-1822). A missing `expiresAt` is treated as "still
- * fresh" (never force a refresh on a token with no known expiry).
- */
 export function claudeAccessTokenNeedsRefresh(expiresAt, nowMs = Date.now()) {
     if (expiresAt == null)
         return false;
@@ -260,12 +134,6 @@ const CLAUDE_SCOPES = [
     'user:file_upload',
 ];
 const CLAUDE_KEYCHAIN_SERVICE = 'Claude Code-credentials';
-/**
- * Test seam for the usage cache path, mirroring `setUsageBackoffDirForTest`.
- * `getCacheDir()` resolves from a module-level constant captured at import, so
- * overriding `HOME` in a test does NOT redirect this cache — it would write into
- * the developer's real `~/.agents/.cache/`. Point it at a tmpdir instead.
- */
 let claudeUsageCachePathOverride = null;
 export function setClaudeUsageCachePathForTest(cachePath) {
     const prev = claudeUsageCachePathOverride;
@@ -284,21 +152,13 @@ const USAGE_BAR_LEN = 10;
 const FULL = '\u2588';
 const EMPTY = '\u2591';
 const PARTIAL_BLOCKS = ['', '\u258F', '\u258E', '\u258D', '\u258C', '\u258B', '\u258A', '\u2589'];
-// A window we EXPECTED but have no reading for \u2014 e.g. Claude's 5h "session"
-// window when the account has no usage in the current rolling window, so the
-// usage API returns five_hour.utilization = null and no session bar is written.
-// It must read as neither 0% (EMPTY '\u2591') nor 100% (FULL '\u2588') \u2014 a full block was
-// alarming and looked maxed-out \u2014 so use a dashed row that says "no data".
 const NO_DATA = '\u2504';
-/** Construct the benign no-local-log result without overloading `error`. */
 function usageNoRecentUsageInfo() {
     return { snapshot: null, error: null, [USAGE_BENIGN_STATE]: 'no-recent-usage' };
 }
-/** Read a benign state for the human renderer; symbols are omitted by JSON serialization. */
 export function getUsageBenignState(info) {
     return info[USAGE_BENIGN_STATE] ?? null;
 }
-/** The single registry of agent usage sources and their transport. */
 const USAGE_SOURCES = {
     claude: { fetch: getClaudeUsageInfo, network: true },
     codex: { fetch: getCodexUsageInfo, network: false },
@@ -313,29 +173,17 @@ export const USAGE_SOURCE_AGENT_IDS = Object.keys(USAGE_SOURCES);
 function getUsageSource(agentId) {
     return USAGE_SOURCES[agentId];
 }
-/** Fetch usage info for a given agent through the canonical source registry. */
 export async function getUsageInfo(agentId, options) {
     const source = getUsageSource(agentId);
     return source ? source.fetch(options) : { snapshot: null, error: null };
 }
-/**
- * Combine a caller-supplied abort signal (the daemon tick deadline) with a
- * per-fetch timeout, so a provider fetch is bounded by whichever fires first
- * (PHNX-3608). With no caller signal it degrades to the timeout alone —
- * byte-identical to the previous `AbortSignal.timeout(ms)` behaviour.
- */
 function usageFetchSignal(signal, timeoutMs) {
     const timeout = AbortSignal.timeout(timeoutMs);
     return signal ? AbortSignal.any([signal, timeout]) : timeout;
 }
-/** Derive a stable lookup key from account info for usage deduplication. */
 export function getUsageLookupKey(info) {
     return info?.usageKey || info?.accountKey || null;
 }
-/**
- * Deduplicate identity inputs into canonical (most-recently-active) accounts
- * and build the corresponding fetch inputs for each unique usage key.
- */
 export function buildCanonicalUsageContext(inputs) {
     const canonicalByUsageKey = new Map();
     const usageFetchInputs = new Map();
@@ -359,31 +207,12 @@ export function buildCanonicalUsageContext(inputs) {
     }
     return { canonicalByUsageKey, usageFetchInputs };
 }
-/**
- * Whether an agent exposes usage/limit data we can render — Claude/Kimi/Droid/
- * Cursor/Antigravity via a live API, Codex/Grok via local session logs.
- * Everything else has no usage concept, so callers use this to decide whether
- * a missing snapshot is worth flagging as "usage unavailable" (a signed-in
- * Claude account with no data) versus simply not applicable (OpenCode).
- */
 export function agentReportsUsage(agentId) {
     return getUsageSource(agentId) !== undefined;
 }
-/**
- * Whether an agent's usage source makes a live NETWORK call (Claude/Kimi/Droid/
- * Cursor/Antigravity) versus reading local session logs (Codex/Grok). Both
- * kinds publish through the shared cache; callers use this only to distinguish
- * provider I/O from local collection.
- */
 export function agentUsesNetworkUsage(agentId) {
     return getUsageSource(agentId)?.network === true;
 }
-/**
- * Concurrent live usage fetches for a single `agents view` / rotation pass.
- * High enough to finish a multi-account refresh in one round-trip window; low
- * enough that a cold cache of 10+ accounts cannot open 10+ HTTP calls at once
- * (and cannot stack behind delayed responses until the process is pegged).
- */
 export const USAGE_FETCH_CONCURRENCY = 3;
 export async function getUsageInfoByIdentity(inputs, opts) {
     const { canonicalByUsageKey, usageFetchInputs } = buildCanonicalUsageContext(inputs);
@@ -402,26 +231,11 @@ export async function getUsageInfoByIdentity(inputs, opts) {
         usageByKey: new Map(usageResults.map(({ key, usage }) => [key, usage])),
     };
 }
-/**
- * In-process dedup complements the device-wide lease. It avoids lock contention
- * when several callers in one process explicitly request the same refresh.
- */
 const inFlightLiveFetches = new Map();
-/**
- * Fetch usage for one identity. Ordinary callers always read the shared cache;
- * the daemon and explicit `--refresh` calls collect through one device lease.
- */
 export async function getUsageInfoForIdentity(input, opts) {
     const usageKey = getUsageLookupKey(input.info);
     const forceRefresh = opts?.forceRefresh === true;
-    // Reading is the default. Only an explicit forceRefresh is authorized to
-    // collect provider/local-log state; callers cannot accidentally turn a
-    // display or routing path into a collector by omitting an option.
     const readOnly = !forceRefresh;
-    // The on-disk cache is shared for both provider and local-log sources and is
-    // keyed by usageKey, which is namespaced per agent (`claude:org=…`,
-    // `kimi:user=…`, `droid:org=…`, `cursor:user=…`, `antigravity:sub=…`), so one
-    // cache file holds every account without collision.
     if (!usageKey) {
         if (readOnly)
             return { snapshot: null, error: USAGE_NOT_COLLECTED_MARKER };
@@ -436,49 +250,20 @@ export async function getUsageInfoForIdentity(input, opts) {
         });
     }
     const cached = readClaudeUsageCache(usageKey);
-    // `readOnly` (the `agents run` routing hot path): serve the cache and NEVER
-    // touch the network — not even a background refresh. `collectRunCandidates`
-    // used to pass a 5-minute `maxAgeMs`, which made a snapshot older than that
-    // fall through to the blocking live fetch below (getUsageInfo → provider HTTP),
-    // adding one round trip per account to `agents run` cold-start on a box whose
-    // cache had gone stale. The daemon now owns keeping this cache fresh
-    // (`runUsageRefresh`, adaptive + rate-capped), so the router only ever reads
-    // it. A stale-or-absent snapshot is handled downstream by the router's own
-    // freshness guard (`isUsageVerified` in rotate.ts), which routes around a
-    // number it can't confirm rather than trusting an old one — so returning a
-    // stale snapshot here is safe, and an absent one reports
-    // {@link USAGE_NOT_COLLECTED_MARKER}.
     if (readOnly) {
-        // A row carries a CONFIRMED reading when it has a fresh window, a
-        // subscription plan (meterless-healthy, e.g. Grok's tier), or a live refusal
-        // (out_of_credits / session_limit). Those report `usageError: null`.
         if (cached && (cached.windows.length > 0 || cached.plan || cached.unavailable)) {
             return { snapshot: cached, error: null };
         }
-        // A row whose ONLY content is last-known stale readings — the all-expired
-        // Claude case, its windows moved to `staleWindows` (view-only) so the
-        // TERMINAL view still renders the number with its age — must NOT read as a
-        // healthy account. `staleWindows` is deliberately excluded from `--json`
-        // (which projects only `windows`), so keep `usageError` non-null: a consumer
-        // polling `agents view --json` must still see the staleness signal, the exact
-        // RUSH-2858 weeks-stale case this marker exists for. The snapshot is still
-        // returned, so the human view is unaffected.
         if (cached)
             return { snapshot: cached, error: USAGE_NOT_COLLECTED_MARKER };
         return { snapshot: null, error: USAGE_NOT_COLLECTED_MARKER };
     }
-    // Explicit refresh: block on the shared device collector.
     return fetchLiveUsageDeduped(input, usageKey, cached, opts?.fileOnly === true, {
         allowInteractiveLogin: opts?.allowInteractiveLogin === true,
         nativeFileLogin: opts?.nativeFileLogin === true,
         signal: opts?.signal,
     });
 }
-/**
- * Single-flight live usage fetch per usage key. Concurrent callers (view +
- * rotation, or two rows sharing an account) await the same promise rather than
- * opening duplicate HTTP requests that then time out and pile up.
- */
 async function fetchLiveUsageDeduped(input, usageKey, cached, fileOnly, opts) {
     const existing = inFlightLiveFetches.get(usageKey);
     if (existing)
@@ -498,8 +283,6 @@ async function fetchLiveUsageDeduped(input, usageKey, cached, fileOnly, opts) {
                 home: input.home,
                 cliVersion: input.cliVersion,
                 organizationId: input.info.organizationId,
-                // Scope this fetch's 429 backoff to the account being fetched, so one
-                // throttled account cannot park the whole provider (RUSH-3036).
                 usageScope: usageKey,
                 fileOnly,
                 allowInteractiveLogin: opts?.allowInteractiveLogin === true,
@@ -513,7 +296,6 @@ async function fetchLiveUsageDeduped(input, usageKey, cached, fileOnly, opts) {
                 writeClaudeUsageCache(usageKey, usage.snapshot);
                 return usage;
             }
-            // Live fetch failed — last-resort fallback to whatever cache we had.
             if (latestCached)
                 return { snapshot: latestCached, error: usage.error };
             return usage;
@@ -527,23 +309,11 @@ async function fetchLiveUsageDeduped(input, usageKey, cached, fileOnly, opts) {
         inFlightLiveFetches.delete(usageKey);
     }
 }
-/**
- * Pick which usage windows to render in a compact one-line summary.
- *
- * Overview rows (`agents view` all agents) must stay narrow enough that one
- * multi-window agent (Antigravity's four model quotas, Droid's three buckets)
- * does not force every other row to pad to ~200 columns and wrap. Prefer the
- * canonical session + week windows when present; otherwise take the highest
- * utilization remaining. Returns the full set when `maxWindows` is unset.
- */
 export function pickCompactUsageWindows(windows, maxWindows) {
     const filtered = windows.filter((window) => window.key !== 'sonnet_week');
     if (maxWindows === undefined || maxWindows <= 0 || filtered.length <= maxWindows) {
         return filtered;
     }
-    // Pick by object identity, not by key. Antigravity normalizes every model
-    // quota as key: 'session', so a key-set filter would keep only the first and
-    // drop the rest even when maxWindows > 1.
     const chosen = [];
     const take = (w) => {
         if (!w || chosen.includes(w) || chosen.length >= maxWindows)
@@ -562,12 +332,6 @@ export function pickCompactUsageWindows(windows, maxWindows) {
     }
     return chosen;
 }
-/**
- * Shared builder for {@link formatUsageSummary} options in `agents view` and
- * account-catalog rows. One builder, no copy — captures `headless`,
- * `unverified`, `expectedWindows`, `errorKind`, `benignState`, and the grok
- * `noRecentUsageLabel` consistently.
- */
 export function viewUsageSummaryOptions(agentId, signedIn, usageInfo, maxWindows, version) {
     const headless = isUsageHeadlessScopeError(usageInfo?.error);
     const benignState = usageInfo ? getUsageBenignState(usageInfo) : null;
@@ -587,22 +351,15 @@ export function viewUsageSummaryOptions(agentId, signedIn, usageInfo, maxWindows
             : null,
     };
 }
-/** Human label for a classified usage error, for the no-bars branch of {@link formatUsageSummary}. */
 function formatUsageErrorKindLabel(kind, detail) {
     switch (kind) {
         case 'no-credential':
             return 'sign in / provision token';
-        // Both of these are permanent for the account as configured, and both used
-        // to render as the generic bucket — which reads as a transient failure and
-        // sends operators back to `claude setup-token` for a remedy that cannot
-        // work (#2987). Name the state instead.
         case 'no-usage-credential':
             return USAGE_NO_USAGE_CREDENTIAL_MARKER;
         case 'headless-scope':
             return USAGE_HEADLESS_SCOPE_MARKER;
         case 'expired-credential':
-            // Kimi refreshes its own credential on a normal launch; the recovery hint
-            // is embedded in the error string so the label matches the exact action.
             if (detail?.includes('run Kimi once'))
                 return 'run Kimi once';
             return 're-auth for usage';
@@ -620,35 +377,19 @@ function formatUsageErrorKindLabel(kind, detail) {
             return 'usage unavailable';
     }
 }
-/** Format a one-line usage summary with compact bars for inline display. */
 export function formatUsageSummary(plan, snapshot, planWidth = 3, opts) {
     const parts = [];
     if (plan) {
         parts.push(chalk.gray(plan.padEnd(planWidth)));
     }
     if (snapshot) {
-        // A blocking marker renders AFTER the bars: leading it pushed every gauge
-        // out of its column, so one throttled account misaligned the whole table.
         const blocked = snapshot.unavailable?.reason === 'out_of_credits'
             ? chalk.red('out of credits')
             : snapshot.unavailable?.reason === 'session_limit' && snapshot.unavailable.resetsAt
                 ? chalk.yellow(`session-limited (${formatResetHint(snapshot.unavailable.resetsAt)})`)
                 : null;
-        // Compact rows show BLOCKING windows — the same set
-        // deriveUsageStatusFromSnapshot uses for the rate-limited badge — so an
-        // account throttled by its month window (Droid meters on 5h/week/month)
-        // shows the bar that explains why. Claude's Sonnet week is a per-model
-        // sub-limit, not a blocking window; it renders only in the full
-        // per-version usage section. Each window reads "S: ███░░ 58% (3d)" — the
-        // gauge, the exact percentage, and a compact hint of when it resets.
-        //
-        // Overview caps the window count (see pickCompactUsageWindows) so one
-        // multi-meter agent cannot force the whole table to wrap.
         const selected = pickCompactUsageWindows(snapshot.windows, opts?.maxWindows);
         const hidden = Math.max(0, snapshot.windows.filter((w) => w.key !== 'sonnet_week').length - selected.length);
-        // Last-known windows the freshness gate dropped (see UsageSnapshot.staleWindows).
-        // Rendered with an age suffix so a stale reading stays visible instead of a
-        // bare "unavailable"; never in `snapshot.windows`, so routing never sees them.
         const now = new Date();
         const staleWindows = snapshot.staleWindows ?? [];
         const staleByKey = new Map(staleWindows.map((w) => [w.key, w]));
@@ -658,8 +399,6 @@ export function formatUsageSummary(plan, snapshot, planWidth = 3, opts) {
             : selected.map((window) => ({ key: window.key, window, shortLabel: window.shortLabel }));
         const windowParts = windowsToRender.map(({ key, window, shortLabel }, index) => {
             if (!window) {
-                // A window we expected but have no fresh reading for: render the
-                // last-known value with its age if we still have it, else "unavailable".
                 const stale = staleByKey.get(key);
                 const rendered = stale
                     ? renderStaleUsageWindow(stale, snapshot.capturedAt, shortLabel, now)
@@ -679,9 +418,6 @@ export function formatUsageSummary(plan, snapshot, planWidth = 3, opts) {
             parts.push(windowParts.join('  '));
         }
         else if (staleWindows.length > 0) {
-            // No fresh bars, but we have last-known readings (e.g. Grok's weekly bar
-            // from an ended billing period): show them with an age suffix rather than
-            // the "run once to refresh" hint, which hid a number we actually had.
             const cap = opts?.maxWindows ?? staleWindows.length;
             const rendered = staleWindows
                 .slice(0, cap)
@@ -691,11 +427,6 @@ export function formatUsageSummary(plan, snapshot, planWidth = 3, opts) {
         else if (snapshot.refreshHint) {
             parts.push(chalk.dim(snapshot.refreshHint));
         }
-        // The bars came from the cache and the live read that should have confirmed
-        // them failed, so they are the last thing we saw — not the current state.
-        // Drawing them unmarked is what let a 26h-old "48% used" read as fact.
-        // Headless-scope (RUSH-2392) is a known permanent gap, not a flaky cache:
-        // prefer that label over the generic "unverified" so operators do not re-mint.
         if (opts?.headless) {
             parts.push(chalk.dim(USAGE_HEADLESS_SCOPE_MARKER));
         }
@@ -706,61 +437,23 @@ export function formatUsageSummary(plan, snapshot, planWidth = 3, opts) {
             parts.push(blocked);
     }
     else if (opts?.headless) {
-        // No bars at all: still name the scope gap so "usage pending" is not
-        // mistaken for a missing setup-token or seeding failure (RUSH-2392).
         parts.push(chalk.dim(USAGE_HEADLESS_SCOPE_MARKER));
     }
     else if (opts?.benignState === 'no-recent-usage') {
         parts.push(chalk.dim(opts.noRecentUsageLabel || USAGE_NO_RECENT_USAGE_MARKER));
     }
     else if (opts?.unavailable) {
-        // Signed-in account we could NOT fetch usage for (no live token in a reachable
-        // home / org mismatch / fetch error). Say so explicitly instead of drawing a
-        // blank gauge that reads like "0% used" — and name the SPECIFIC cause when
-        // the caller passed one, rather than the generic bucket that used to cover
-        // ~6 different failures (RUSH-3040).
         parts.push(chalk.dim(formatUsageErrorKindLabel(opts.errorKind, opts.errorDetail)));
     }
     return parts.join('  ');
 }
-/**
- * The snapshot's windows that are still LIVE — reset time not yet passed. A
- * window past its `resetsAt` has rolled over: its `usedPercent` is a reading of
- * the PREVIOUS period, not a live throttle (PHNX-4116). Both the throttle
- * verdict ({@link deriveUsageStatusFromSnapshot}) and the displayed
- * `usedPercent` (`devices/harness-inventory.ts`) MUST select from this SAME set,
- * or a maxed-then-reset account reads `available` yet shows a stale 99% next to
- * its "ready" verdict (#3705). Callers still narrow further (dropping
- * `sonnet_week`, the model sub-limit); this is only the reset-rollover cut.
- */
 export function liveUsageWindows(snapshot, now = Date.now()) {
     return snapshot.windows.filter((window) => !(window.resetsAt && window.resetsAt.getTime() <= now));
 }
-/**
- * Derive an account's real throttle state from its live usage windows — the
- * single signal both the `agents view` badge and run-rotation eligibility share
- * (`hasUsageAvailable` in rotate.ts treats a `rate_limited` verdict here as
- * ineligible). A window at 100% utilization means the account is throttled until
- * that window resets. Rotation *weighting* still ranks eligible accounts by
- * weekly headroom (`getRoutingUsedPercent`); this function is the yes/no gate.
- *
- * Returns `null` when there is no snapshot, so callers render no badge rather
- * than a misleading one. This deliberately never consults
- * `cachedExtraUsageDisabledReason`: that field describes why pay-as-you-go
- * overage is disabled (`out_of_credits` = no overage credits purchased,
- * `org_level_disabled` = an admin turned overage off), NOT whether the account
- * can do work right now. A Pro account at 5% weekly usage with overage disabled
- * is fully usable, yet that flag would mislabel it "out of credits".
- *
- * The model-specific `sonnet_week` sub-limit is excluded: hitting it throttles
- * one model, not the account, so it shouldn't flip the whole row to throttled.
- */
 export function deriveUsageStatusFromSnapshot(snapshot, now = Date.now()) {
     if (!snapshot)
         return null;
     if (snapshot.unavailable) {
-        // out_of_credits has no clock — it stays blocking until a successful run
-        // clears it. session_limit blocks only until its reset time.
         if (snapshot.unavailable.reason === 'out_of_credits')
             return 'rate_limited';
         if (snapshot.unavailable.resetsAt && snapshot.unavailable.resetsAt.getTime() > now) {
@@ -790,30 +483,12 @@ export function deriveUsageHeadroom(snapshot, prev) {
     }
     const deltaPercent = session.usedPercent - prev.usedPercent;
     const deltaMinutes = (capturedAt - prev.capturedAt) / 60_000;
-    // Flat, falling (a window reset), or a zero/negative time delta: no live burn
-    // to project from, so this account is not "projected to cap".
     if (deltaPercent <= 0 || deltaMinutes <= 0)
         return { status, minutesToLimit: null };
     const burnPerMinute = deltaPercent / deltaMinutes;
     const remaining = Math.max(0, 100 - session.usedPercent);
     return { status, minutesToLimit: remaining / burnPerMinute };
 }
-/**
- * Compact colored badge for the account's overall usage status. Renders only
- * when the account is throttled — `available` and `null` return ''.
- *
- * - `out_of_credits` → red "out of credits" (terminal account, all buckets dry)
- * - `rate_limited`   → yellow "rate-limited" (transient throttling)
- *
- * The badge sits between the usage bars and `lastActive` in `agents view`, so
- * a glance at the row tells the user whether the version can do useful work.
- * The same signal is exposed as `usageStatus` in `agents view --json` for
- * programmatic consumers (e.g. the swarmify panel's "resume in healthy agent").
- *
- * The switch is exhaustive on purpose — adding a new `AccountInfo.usageStatus`
- * value without updating the cases here is a build error at `_exhaustive`,
- * which is exactly the bug class this PR is fixing.
- */
 export function formatUsageStatusBadge(usageStatus) {
     if (usageStatus === null || usageStatus === undefined)
         return '';
@@ -828,7 +503,6 @@ export function formatUsageStatusBadge(usageStatus) {
         }
     }
 }
-/** Format a multi-line usage section for detailed agent views. */
 export function formatUsageSection(usage) {
     if (!usage.snapshot && !usage.error) {
         return [];
@@ -853,25 +527,8 @@ export function formatUsageSection(usage) {
     lines.push(`    ${chalk.dim(`Source: ${usage.snapshot.sourceLabel}`)}`);
     return lines;
 }
-/** Fetch Codex usage by scanning the most recent session files for rate-limit events. */
 async function getCodexUsageInfo(options) {
     try {
-        // Codex usage is read from on-disk session transcripts, which carry no
-        // account identity and are not removed on logout. To keep the bar scoped to
-        // the account signed in NOW, floor the scan at the current login time: the
-        // id_token's `auth_time` claim — the OIDC time-of-authentication. A session
-        // written before that login belongs to whoever was signed in before (e.g.
-        // after `codex logout` + login into a different account), and showing its
-        // rate_limits is the "wrong usage after switch" bug.
-        //
-        // `auth_time` — not the auth.json file mtime — is the correct floor: Codex
-        // rewrites auth.json on every token refresh (advancing its mtime), but a
-        // refresh_token grant does not re-authenticate the user, so `auth_time`
-        // stays at the real login. Flooring on mtime would blank the bar after each
-        // background refresh; flooring on `auth_time` does not. No readable
-        // credential means the version is signed out — report no usage. A credential
-        // that carries no `auth_time` falls back to no floor (prior behavior) rather
-        // than hide a signed-in account's usage.
         const base = options?.home || os.homedir();
         let sinceMs;
         try {
@@ -889,11 +546,6 @@ async function getCodexUsageInfo(options) {
             const match = await readLatestCodexRateLimits(filePath);
             if (!match)
                 continue;
-            // Same freshness filter Grok already applies (RUSH-3040): a window whose
-            // reset time or windowMinutes-derived expiry has passed is a STALE read,
-            // not a current one — rendering it as-is is how a codex bar kept showing
-            // "100% used" past its own reset. Try the next-older session file rather
-            // than surfacing a stale bar.
             const windows = normalizeCodexWindows(match.rateLimits).filter((window) => isCachedUsageWindowFresh(window, match.capturedAt, now));
             if (windows.length === 0)
                 continue;
@@ -907,52 +559,21 @@ async function getCodexUsageInfo(options) {
                 error: null,
             };
         }
-        // No session ever recorded a rate-limit event on this machine (or none of
-        // the ones found were still fresh) — a benign "nothing to show yet", not a
-        // failure (RUSH-3040). Distinct from the outer catch below, which is a
-        // genuine read/parse failure.
         return usageNoRecentUsageInfo();
     }
     catch (err) {
         return { snapshot: null, error: usageUnreachableError('Codex', err) };
     }
 }
-/**
- * The access token to use for a READ-ONLY Claude usage fetch, or null when the
- * stored token is within the refresh leeway.
- *
- * Returns null instead of refreshing on purpose. Claude's refresh token is
- * single-use and rotates server-side on every refresh; with one account signed
- * into several machines, refreshing here would stampede that one token and
- * silently invalidate every other holder — the RUSH-1822 failure, except in the
- * usage path (fired in the background by the SWR cache and by `agents run`'s
- * default "balanced" rotation on every unpinned run) rather than the health
- * probe. So a usage read must never rotate: a near-expiry token yields "no usage
- * right now" instead of a fleet-wide logout. Mirrors {@link probeClaudeStatus};
- * the single legitimate refresh belongs to the actual claude run, never a read.
- * Pure — unit-tested.
- */
+// Usage probes never refresh credentials or fall into interactive OAuth; foreground headed reads must opt in explicitly.
 export function claudeUsageAccessTokenNoRefresh(oauth) {
     if (claudeAccessTokenNeedsRefresh(oauth.expiresAt ?? null))
         return null;
     const token = oauth.accessToken?.trim();
     return token ? token : null;
 }
-/** Fetch Claude usage via the Anthropic OAuth usage API. */
 async function getClaudeUsageInfo(options) {
     try {
-        // accessTokenCache: this is the every-60s watchdog hot path and usage needs
-        // only the access token, so it reads ONLY the file-based setup-token and never
-        // the interactive login (reading that ACL-bound token and firing it at the
-        // usage API is what got it revoked — RUSH-1822). No setup-token => null =>
-        // "usage pending". fileOnly additionally forbids the ACL keychain path.
-        //
-        // allowInteractiveLogin is the one sanctioned exception (USAGE-READ-1/2): a
-        // foreground human `agents view` on a `personal` device MAY fall through to
-        // the interactive login when no setup-token exists, because that login is the
-        // only credential carrying the `user:profile` scope the usage endpoint
-        // requires (the setup-token is user:inference → 403, RUSH-2392). It is unset
-        // for every background caller, so the RUSH-1822 guarantee is untouched there.
         const oauth = await loadClaudeOauth(options?.home, {
             accessTokenCache: options?.nativeFileLogin !== true,
             fileOnly: options?.fileOnly === true || options?.nativeFileLogin === true,
@@ -960,26 +581,17 @@ async function getClaudeUsageInfo(options) {
             nativeFileLogin: options?.nativeFileLogin === true,
         });
         if (!oauth?.accessToken) {
-            // NOT the shared no-credential message: "sign in" is not a remedy here.
-            // The account this reads for is usually signed in already — the reader is
-            // forbidden from touching that login (RUSH-1822) — so the shared wording
-            // asked the operator to redo the one thing they had already done (#2987).
             return { snapshot: null, error: usageNoClaudeUsageCredentialError() };
         }
         const requestedOrgId = normalizeString(options?.organizationId);
         const liveOrgId = normalizeString(oauth.organizationUuid);
         if (!isClaudeUsageOrgMatch(requestedOrgId, liveOrgId)) {
-            // Not a fault: this home is signed into a different org than the identity
-            // being read, so there is nothing to report for it.
             return { snapshot: null, error: null };
         }
-        // Read-only: never refresh a single-use token just to read usage (RUSH-1822).
         const accessToken = claudeUsageAccessTokenNoRefresh(oauth);
         if (!accessToken) {
             return { snapshot: null, error: usageExpiredCredentialError('Claude') };
         }
-        // Honour a live Retry-After rather than re-arming the penalty (see
-        // usage-backoff.ts). No request at all while the window is open.
         const throttledUntil = usageRateLimitedUntil('claude', Date.now(), options?.usageScope);
         if (throttledUntil) {
             return { snapshot: null, error: usageThrottledError('Claude', throttledUntil) };
@@ -998,16 +610,12 @@ async function getClaudeUsageInfo(options) {
             if (response.status === 429) {
                 noteUsageRateLimited('claude', response.headers.get('retry-after'), { account: options?.usageScope });
             }
-            // Setup-token is user:inference only; usage needs user:profile → 403
-            // with a scope-requirement body. Distinct from a real rejection so the
-            // UI does not say "unverified" / re-mint (RUSH-2392).
             if (response.status === 403) {
                 let bodyText = '';
                 try {
                     bodyText = await response.text();
                 }
                 catch {
-                    // ignore — fall through to generic rejection
                 }
                 if (isClaudeUsageScopeDenied(response.status, bodyText)) {
                     return { snapshot: null, error: usageHeadlessScopeError('Claude') };
@@ -1031,19 +639,9 @@ async function getClaudeUsageInfo(options) {
         };
     }
     catch (err) {
-        // A thrown request (timeout, DNS, TLS, a malformed payload) is a failed
-        // read like any other — staying silent here would hand the caller a stale
-        // snapshot to render as confirmed, which is the bug this file just closed.
         return { snapshot: null, error: usageUnreachableError('Claude', err) };
     }
 }
-/**
- * Resolve Kimi's OAuth credential file. Sign-in is account-global but each
- * installed version has an isolated home; the file physically lives only in the
- * home the user logged in under. Check the per-version home first, then the
- * active location under the real HOME — mirrors resolveAccountCredentialPath in
- * agents.ts so every version reflects the true account state.
- */
 function resolveKimiCredentialPath(home) {
     const rel = ['.kimi-code', 'credentials', 'kimi-code.json'];
     const perVersion = path.join(home || os.homedir(), ...rel);
@@ -1051,14 +649,14 @@ function resolveKimiCredentialPath(home) {
         if (fs.existsSync(perVersion))
             return perVersion;
     }
-    catch { /* unreadable */ }
+    catch { }
     const active = path.join(process.env.AGENTS_REAL_HOME || os.homedir(), ...rel);
     if (active !== perVersion) {
         try {
             if (fs.existsSync(active))
                 return active;
         }
-        catch { /* unreadable */ }
+        catch { }
     }
     return null;
 }
@@ -1087,8 +685,6 @@ async function getKimiUsageInfo(options) {
         if (expiresAt !== null && Date.now() / 1000 >= expiresAt) {
             return { snapshot: null, error: usageExpiredKimiCredentialError() };
         }
-        // Honour a live Retry-After rather than re-arming the penalty (see
-        // usage-backoff.ts). No request at all while the window is open.
         const throttledUntil = usageRateLimitedUntil('kimi', Date.now(), options?.usageScope);
         if (throttledUntil) {
             return { snapshot: null, error: usageThrottledError('Kimi', throttledUntil) };
@@ -1101,8 +697,6 @@ async function getKimiUsageInfo(options) {
             },
             signal: usageFetchSignal(options?.signal, 5000),
         });
-        // 401/403 => expired token, 404 => no Kimi For Coding subscription. Either
-        // way there are no bars to draw, and the status is what tells them apart.
         if (!response.ok) {
             if (response.status === 429) {
                 noteUsageRateLimited('kimi', response.headers.get('retry-after'), { account: options?.usageScope });
@@ -1126,29 +720,22 @@ async function getKimiUsageInfo(options) {
         };
     }
     catch (err) {
-        // A thrown request (timeout, DNS, TLS, a malformed payload) is a failed
-        // read like any other — staying silent here would hand the caller a stale
-        // snapshot to render as confirmed, which is the bug this file just closed.
         return { snapshot: null, error: usageUnreachableError('Kimi', err) };
     }
 }
-/** Normalize the Kimi /usages payload into the common UsageWindow shape. */
 export function normalizeKimiWindows(data) {
     const windows = [];
-    // Per-window rate limit (e.g. a 300-minute bucket) -> "session".
     const shortLimit = Array.isArray(data.limits)
         ? data.limits.find((entry) => entry?.detail)
         : null;
     const session = normalizeKimiWindow(shortLimit?.detail, 'session', 'Current session', 'S', kimiWindowMinutes(shortLimit?.window));
     if (session)
         windows.push(session);
-    // Rolling account quota -> "week".
     const period = normalizeKimiWindow(data.usage, 'week', 'Current period', 'W', null);
     if (period)
         windows.push(period);
     return windows;
 }
-/** Normalize a single Kimi quota bucket (used/limit strings) into a UsageWindow. */
 function normalizeKimiWindow(quota, key, label, shortLabel, windowMinutes) {
     const limit = kimiNumber(quota?.limit);
     const used = kimiNumber(quota?.used);
@@ -1166,7 +753,6 @@ function normalizeKimiWindow(quota, key, label, shortLabel, windowMinutes) {
         windowMinutes: windowMinutes ?? inferWindowMinutes(key),
     };
 }
-/** Parse a numeric field that Kimi serializes as a string (e.g. "100"). */
 function kimiNumber(value) {
     if (typeof value === 'number' && Number.isFinite(value))
         return value;
@@ -1175,7 +761,6 @@ function kimiNumber(value) {
     }
     return null;
 }
-/** Convert a Kimi limit window (duration + timeUnit enum) to minutes. */
 function kimiWindowMinutes(window) {
     const duration = typeof window?.duration === 'number' ? window.duration : null;
     if (duration === null || duration <= 0)
@@ -1183,14 +768,13 @@ function kimiWindowMinutes(window) {
     switch (window?.timeUnit) {
         case 'TIME_UNIT_HOUR': return duration * 60;
         case 'TIME_UNIT_SECOND': return duration / 60;
-        default: return duration; // TIME_UNIT_MINUTE or unknown -> minutes
+        default: return duration;
     }
 }
-/** Derive a display plan label from Kimi's membership tier or subscription type. */
 export function formatKimiPlan(data) {
     const level = data.user?.membership?.level;
     const raw = (typeof level === 'string' && level) || (typeof data.subType === 'string' && data.subType) || '';
-    const tail = raw.split('_').pop() || ''; // LEVEL_INTERMEDIATE -> INTERMEDIATE
+    const tail = raw.split('_').pop() || '';
     if (!tail)
         return null;
     return tail.charAt(0).toUpperCase() + tail.slice(1).toLowerCase();
@@ -1221,8 +805,6 @@ async function getDroidUsageInfo(options) {
         if (typeof exp === 'number' && Date.now() / 1000 >= exp) {
             return { snapshot: null, error: usageExpiredCredentialError('Droid') };
         }
-        // Honour a live Retry-After rather than re-arming the penalty (see
-        // usage-backoff.ts). No request at all while the window is open.
         const throttledUntil = usageRateLimitedUntil('droid', Date.now(), options?.usageScope);
         if (throttledUntil) {
             return { snapshot: null, error: usageThrottledError('Droid', throttledUntil) };
@@ -1235,7 +817,6 @@ async function getDroidUsageInfo(options) {
             },
             signal: usageFetchSignal(options?.signal, 5000),
         });
-        // 401 => revoked/expired token. No bars to draw, and the status says why.
         if (!response.ok) {
             if (response.status === 429) {
                 noteUsageRateLimited('droid', response.headers.get('retry-after'), { account: options?.usageScope });
@@ -1258,38 +839,17 @@ async function getDroidUsageInfo(options) {
         };
     }
     catch (err) {
-        // A thrown request (timeout, DNS, TLS, a malformed payload) is a failed
-        // read like any other — staying silent here would hand the caller a stale
-        // snapshot to render as confirmed, which is the bug this file just closed.
         return { snapshot: null, error: usageUnreachableError('Droid', err) };
     }
 }
-/** Probe Claude's OAuth token against the usage endpoint. Never refreshes — reports `expired` for a near-expiry token; see the comment below (RUSH-1822). */
 export async function probeClaudeStatus(home, cliVersion, usageScope, signal) {
-    // accessTokenCache: the daemon warms this probe every ~3 min per account, so it
-    // reads ONLY the file-based setup-token and never the interactive login —
-    // transmitting that ACL-bound token to the usage API from a background loop is
-    // what got it revoked (RUSH-1822). No setup-token => token 'missing' below.
     const oauth = await loadClaudeOauth(home, { accessTokenCache: true });
     const accessToken = oauth?.accessToken?.trim();
     if (!accessToken)
         return { status: null, token: 'missing' };
-    // Never refresh from a health probe. Claude's refresh token is single-use and
-    // rotates on every refresh; with one account signed into several machines the
-    // daemon's every-3-min fleet-cache warm (probeLocalFleetAuth -> here) would
-    // stampede that one rotating token and silently invalidate every other
-    // holder, dropping the fleet to "run /login" (RUSH-1822). Mirror the sibling
-    // Kimi/Droid probes, which never refresh: if the stored token is within the
-    // refresh leeway of expiry, report the non-fatal `expired` state ("would need
-    // a refresh") instead of rotating it, and leave the single legitimate refresh
-    // to the run/usage hot path (getClaudeAccessToken).
     if (claudeAccessTokenNeedsRefresh(oauth?.expiresAt ?? null)) {
         return { status: null, token: 'expired' };
     }
-    // A probe is a request like any other: while the provider's Retry-After
-    // window is open, report the throttle from the recorded state instead of
-    // firing again and re-arming it (usage-backoff.ts). This 3-min-cadence
-    // probe is what created the loop it now respects.
     if (usageRateLimitedUntil('claude', Date.now(), usageScope))
         return { status: 429, token: 'present' };
     try {
@@ -1306,15 +866,12 @@ export async function probeClaudeStatus(home, cliVersion, usageScope, signal) {
         if (response.status === 429) {
             noteUsageRateLimited('claude', response.headers.get('retry-after'), { account: usageScope });
         }
-        // Setup-token is user:inference only; usage needs user:profile → 403.
-        // That is NOT a revocation — the account still runs (RUSH-2392).
         if (response.status === 403) {
             let bodyText = '';
             try {
                 bodyText = await response.text();
             }
             catch {
-                // Body unreadable: fall through to a bare 403 (classified as revoked).
             }
             if (isClaudeUsageScopeDenied(response.status, bodyText)) {
                 return {
@@ -1331,7 +888,6 @@ export async function probeClaudeStatus(home, cliVersion, usageScope, signal) {
         return { status: null, token: 'present', error: err instanceof Error ? err.message : String(err) };
     }
 }
-/** Probe Kimi's OAuth token against the /usages endpoint. Never refreshes (single-use rotation — see getKimiUsageInfo). */
 export async function probeKimiStatus(home, usageScope, signal) {
     const credPath = resolveKimiCredentialPath(home);
     if (!credPath)
@@ -1350,12 +906,6 @@ export async function probeKimiStatus(home, usageScope, signal) {
         return { status: null, token: 'missing' };
     if (expiresAt !== null && Date.now() / 1000 >= expiresAt)
         return { status: null, token: 'expired' };
-    // A probe is a request like any other: while the provider's Retry-After
-    // window is open, report the throttle from the recorded state instead of
-    // firing again and re-arming it (usage-backoff.ts). This 3-min-cadence probe
-    // is what created the loop it now respects. It sits AFTER the local
-    // missing/expired checks — as in probeClaudeStatus and probeDroidStatus — so
-    // a genuinely broken credential is never misreported as merely throttled.
     if (usageRateLimitedUntil('kimi', Date.now(), usageScope))
         return { status: 429, token: 'present' };
     try {
@@ -1373,7 +923,6 @@ export async function probeKimiStatus(home, usageScope, signal) {
         return { status: null, token: 'present', error: err instanceof Error ? err.message : String(err) };
     }
 }
-/** Probe Droid's WorkOS token against the billing-limits endpoint. Never refreshes (single-use rotation — see getDroidUsageInfo). */
 export async function probeDroidStatus(home, usageScope, signal) {
     const cred = decryptDroidAuthPayload(home || os.homedir());
     const accessToken = cred?.access_token;
@@ -1382,10 +931,6 @@ export async function probeDroidStatus(home, usageScope, signal) {
     const exp = decodeJwtPayload(accessToken)?.exp;
     if (typeof exp === 'number' && Date.now() / 1000 >= exp)
         return { status: null, token: 'expired' };
-    // A probe is a request like any other: while the provider's Retry-After
-    // window is open, report the throttle from the recorded state instead of
-    // firing again and re-arming it (usage-backoff.ts). This 3-min-cadence
-    // probe is what created the loop it now respects.
     if (usageRateLimitedUntil('droid', Date.now(), usageScope))
         return { status: 429, token: 'present' };
     try {
@@ -1403,12 +948,6 @@ export async function probeDroidStatus(home, usageScope, signal) {
         return { status: null, token: 'present', error: err instanceof Error ? err.message : String(err) };
     }
 }
-/**
- * Normalize the Factory billing-limits payload into the common UsageWindow
- * shape. Orgs on the legacy (non token-rate-limit) billing model have no
- * meaningful windows, so they render nothing — mirrors droid's own gate on
- * `usesTokenRateLimitsBilling` before it reads `limits.standard`.
- */
 export function normalizeDroidWindows(data) {
     if (data.usesTokenRateLimitsBilling !== true)
         return [];
@@ -1422,7 +961,6 @@ export function normalizeDroidWindows(data) {
     ];
     return windows.filter((window) => window !== null);
 }
-/** Normalize a single Droid billing-limits window. */
 function normalizeDroidWindow(window, key, label, shortLabel) {
     const usedPercent = normalizePercent(window?.usedPercent);
     if (usedPercent === null)
@@ -1436,14 +974,6 @@ function normalizeDroidWindow(window, key, label, shortLabel) {
         windowMinutes: inferWindowMinutes(key),
     };
 }
-/**
- * Collect Codex JSONL session files sorted newest-first.
- *
- * `sinceMs` drops files modified before it. Codex session transcripts are not
- * tagged with the account that wrote them, so this mtime floor is how usage is
- * kept account-scoped: a session older than the current login belongs to a
- * prior account (see {@link getCodexUsageInfo}).
- */
 function collectCodexSessionFiles(home, sinceMs) {
     const base = home || os.homedir();
     const dir = path.join(base, '.codex', 'sessions');
@@ -1466,7 +996,6 @@ function collectCodexSessionFiles(home, sinceMs) {
     files.sort((a, b) => b.mtime - a.mtime);
     return files.map((file) => file.path);
 }
-/** Stream a Codex JSONL file and return the last rate_limits payload found. */
 async function readLatestCodexRateLimits(filePath) {
     return new Promise((resolve) => {
         let latest = null;
@@ -1486,21 +1015,18 @@ async function readLatestCodexRateLimits(filePath) {
                 };
             }
             catch {
-                /* malformed session line */
             }
         });
         rl.on('close', () => resolve(latest));
         rl.on('error', () => resolve(latest));
     });
 }
-/** Normalize Codex rate-limit windows into the common UsageWindow shape. */
 function normalizeCodexWindows(rateLimits) {
     return [rateLimits.primary, rateLimits.secondary]
         .map(normalizeCodexWindow)
         .filter((window) => window !== null)
         .sort((a, b) => (a.windowMinutes ?? 0) - (b.windowMinutes ?? 0));
 }
-/** Normalize a single Codex rate-limit window. */
 function normalizeCodexWindow(window) {
     const usedPercent = normalizePercent(window?.used_percent);
     if (usedPercent === null)
@@ -1516,7 +1042,6 @@ function normalizeCodexWindow(window) {
         windowMinutes,
     };
 }
-/** Codex assigns quota windows to primary/secondary by plan, so duration carries their meaning. */
 function classifyCodexWindow(windowMinutes) {
     if (windowMinutes !== null && windowMinutes >= 28 * 24 * 60) {
         return { key: 'month', label: 'Current month', shortLabel: 'M' };
@@ -1526,7 +1051,6 @@ function classifyCodexWindow(windowMinutes) {
     }
     return { key: 'session', label: 'Current session', shortLabel: 'S' };
 }
-/** Normalize Claude API usage windows into the common UsageWindow shape. */
 function normalizeClaudeWindows(data) {
     const windows = [
         normalizeClaudeWindow(data.five_hour, 'session', 'Current session', 'S'),
@@ -1535,7 +1059,6 @@ function normalizeClaudeWindows(data) {
     ];
     return windows.filter((window) => window !== null);
 }
-/** Normalize a single Claude API usage window. */
 function normalizeClaudeWindow(window, key, label, shortLabel) {
     const usedPercent = normalizePercent(window?.utilization);
     if (usedPercent === null)
@@ -1549,12 +1072,6 @@ function normalizeClaudeWindow(window, key, label, shortLabel) {
         windowMinutes: inferWindowMinutes(key),
     };
 }
-/**
- * Parse a wrapped Claude OAuth payload — the `{ claudeAiOauth, organizationUuid }`
- * shape written by BOTH the macOS Keychain item and the Linux `.credentials.json`
- * file — into our credential struct. Returns null when there is no usable access
- * token. Never throws (malformed JSON => null).
- */
 function parseClaudeOauthPayload(raw) {
     try {
         const payload = JSON.parse(raw.trim());
@@ -1570,69 +1087,18 @@ function parseClaudeOauthPayload(raw) {
         return null;
     }
 }
-// ── Stale no-ACL Claude OAuth cache eviction (retired subsystem) ──
-//
-// Earlier versions cached Claude's OAuth ACCESS token in a device-local no-ACL
-// keychain item so a read-only usage/probe read wouldn't pop the macOS Touch ID
-// prompt that the ACL-bound source item (`Claude Code-credentials-<hash>`) forces.
-// That cache is retired: read-only probes now authenticate ONLY with a file-based
-// setup-token and never read the interactive login (see loadClaudeOauth), so
-// nothing populates the cache anymore. deleteCachedClaudeOauth remains — a
-// credential rotation still evicts a stale item an earlier version may have
-// written, so an old no-ACL copy of the interactive token can't linger.
 const CLAUDE_OAUTH_CACHE_PREFIX = 'agents-cli.claude-oauth-cache.';
-/** The no-ACL cache item name for a Claude keychain service (hashed to stay tidy). */
 function claudeOauthCacheItem(service) {
     const hash = createHash('sha256').update(service).digest('hex').slice(0, 16);
     return `${CLAUDE_OAUTH_CACHE_PREFIX}${hash}`;
 }
-/**
- * Evict any no-ACL access-token cache item so a source rotation or sign-out is
- * reflected immediately. The cache itself is retired — read-only probes no longer
- * read or write it (loadClaudeOauth returns a file-based setup-token or nothing) —
- * but this eviction remains so a credential rotation still clears a stale cache
- * item that an earlier agents-cli version may have written no-ACL.
- */
 function deleteCachedClaudeOauth(service) {
     try {
         deleteKeychainTokenSync(claudeOauthCacheItem(service));
     }
     catch {
-        /* best-effort — cache is an optimization */
     }
 }
-/**
- * Load a version home's Claude OAuth credential from the two stores Claude Code
- * uses, tried in order:
- *
- *  1. The OS keychain (`getKeychainToken`). Canonical on macOS — Claude Code
- *     writes the token to the login keychain and we read it via `/usr/bin/security`.
- *  2. `<home>/.claude/.credentials.json`. On a headless Linux box (the
- *     `agents view --device <linux>` case) there is no reachable Secret Service, so
- *     the Claude CLI stores its OAuth token in this plaintext file instead. The
- *     keychain read above finds nothing on that platform, so we fall back to the
- *     file. Same wrapped `{ claudeAiOauth }` shape, so one parser handles both.
- *
- * Without step 2 the live usage fetch got no token on Linux, so `agents view`
- * (run remotely over SSH by `--device`) rendered no usage bars even though the
- * account + plan — read from the plaintext `.claude.json` — showed fine.
- *
- * `opts.accessTokenCache` marks a read-only, access-token-only consumer (the
- * usage fetch and the auth-health probe). Such a caller authenticates ONLY with
- * a file-based setup-token and, when none is provisioned, gets `null` — it never
- * reads Claude Code's interactive login (transmitting that ACL-bound OAuth token
- * to Anthropic's API is what gets it revoked; see the branch body and
- * docs/secrets.md). It is OFF by default so full-credential
- * callers that refresh (`isClaudeAuthValid` -> `getClaudeAccessToken`) still
- * read the interactive login. Rush Cloud dispatch does not call this helper
- * at all (SING-1b: the account manifest is email-only; RUSH-2359 removed the
- * leftover blob reader that used to send the interactive login).
- *
- * `opts.fileOnly` skips the ACL keychain read entirely — setup-token and
- * `.credentials.json` only. Used by the daemon usage refresher so a background
- * tick can never pop Touch ID.
- */
-/** True when `<home>/.claude/.credentials.json` is a native rotating OAuth blob. */
 export function claudeHomeHasNativeOauthFile(home) {
     return readClaudeNativeCredentialsFile(home) !== null;
 }
@@ -1642,8 +1108,6 @@ function readClaudeNativeCredentialsFile(home) {
         if (!fs.existsSync(credsPath))
             return null;
         const parsed = parseClaudeOauthPayload(fs.readFileSync(credsPath, 'utf-8'));
-        // A native rotating blob has a refresh token. A setup-token-shaped file
-        // (access only) is not a native login and must not be polled as one.
         if (!parsed?.accessToken?.trim() || !parsed.refreshToken?.trim())
             return null;
         return parsed;
@@ -1653,55 +1117,18 @@ function readClaudeNativeCredentialsFile(home) {
     }
 }
 export async function loadClaudeOauth(home, opts) {
-    // Headed usage poller: the native rotating blob in `.credentials.json` is
-    // the only credential that carries `user:profile` without opening the ACL
-    // keychain (Touch ID) or firing a setup-token that 403s on /oauth/usage.
     if (opts?.nativeFileLogin === true) {
         return readClaudeNativeCredentialsFile(home);
     }
-    // Read-only usage/probe callers (accessTokenCache) authenticate ONLY with a
-    // file-based setup-token from the `auth` bundle — never Claude Code's
-    // interactive login. The usage endpoint accepts any sk-ant-oat01 bearer, and
-    // the file-based token never pops Touch ID. When no setup-token is provisioned
-    // the probe reports unprovisioned rather than reading the interactive
-    // credential (see below) — that is the whole point of this branch.
     if (opts?.accessTokenCache === true) {
         const setupToken = resolveClaudeSetupToken(home);
         if (setupToken) {
-            // No expiresAt: a setup-token is long-lived and non-rotating, and a null
-            // expiry reads as "still fresh" (claudeAccessTokenNeedsRefresh) so the
-            // probe never reports it expired or tries to refresh it. The endpoint is
-            // the source of truth if it has actually been revoked.
             return { accessToken: setupToken };
         }
-        // No provisioned setup-token. A read-only usage/health probe MUST NOT fall
-        // through to Claude Code's interactive login credential. The daemon's usage
-        // (~60s) and auth-health (~3min) warms would otherwise read the ACL-bound
-        // OAuth token and transmit it to api.anthropic.com/api/oauth/usage — an
-        // interactive credential used programmatically, which Anthropic flags and
-        // revokes (the fleet-wide-logout class, RUSH-1822), and which violates the
-        // invariant that the interactive/rotating login is untouchable
-        // (docs/secrets.md). Report unprovisioned (-> probe
-        // token 'missing' -> auth-health 'unconfigured', benign for rotation); seed a
-        // setup-token via the mint-auth path to restore usage/probe for the account.
-        //
-        // The single sanctioned exception (USAGE-READ-1/2): a foreground human
-        // `agents view` on a headed device (personal or desktop) sets allowInteractiveLogin, and only
-        // then do we fall through to the interactive-login read below — the one
-        // credential carrying `user:profile`, which the usage endpoint requires. This
-        // is a human running one command, not an unattended loop, so it is not the
-        // revocation risk RUSH-1822 fixed. Every background caller leaves the flag
-        // unset and still returns null here.
         if (opts?.allowInteractiveLogin !== true) {
             return null;
         }
     }
-    // Full-credential callers (isClaudeAuthValid -> getClaudeAccessToken)
-    // legitimately read the interactive login to run/refresh Claude. Rush Cloud
-    // dispatch does not (SING-1b / RUSH-2359). The OS keychain/keyring step is
-    // macOS/Linux-only; Windows and any
-    // fileOnly caller skip to the .credentials.json read below (the Claude CLI
-    // stores its OAuth token in that file too).
     if (!opts?.fileOnly && (process.platform === 'darwin' || process.platform === 'linux')) {
         const service = getClaudeKeychainService(home);
         try {
@@ -1710,7 +1137,6 @@ export async function loadClaudeOauth(home, opts) {
                 return fromKeychain;
         }
         catch {
-            // No keychain item, or no reachable keyring (headless Linux) — fall through.
         }
     }
     const credsPath = path.join(home ?? os.homedir(), '.claude', '.credentials.json');
@@ -1720,33 +1146,22 @@ export async function loadClaudeOauth(home, opts) {
         }
     }
     catch {
-        // Unreadable file — treat as not signed in.
     }
     return null;
 }
-/**
- * Save Claude OAuth credentials to the system keychain/keyring.
- * Reads the existing payload, merges the new OAuth fields, and writes back.
- * Exported for regression tests; not part of the public command surface.
- */
 async function saveClaudeOauth(home, credentials) {
-    // Windows not yet supported: Claude Code keeps its credential in the file
-    // there, so the rotated credential is written by the harness, not here.
     if (process.platform !== 'darwin' && process.platform !== 'linux') {
         return false;
     }
     try {
         const service = getClaudeKeychainService(home);
-        // Read existing payload to preserve other fields
         let existingPayload = {};
         try {
             const stdout = getKeychainTokenSync(service);
             existingPayload = JSON.parse(stdout.trim());
         }
         catch {
-            // No existing entry, start fresh
         }
-        // Merge new credentials into existing payload
         const newPayload = {
             ...existingPayload,
             claudeAiOauth: {
@@ -1758,15 +1173,12 @@ async function saveClaudeOauth(home, credentials) {
             },
         };
         const payloadJson = JSON.stringify(newPayload);
-        // Delete existing entry first, then add updated entry
         try {
             await deleteKeychainToken(service);
         }
         catch {
-            // Entry might not exist, ignore
         }
         await setKeychainToken(service, payloadJson);
-        // A new credential rotation means any cached access token is stale.
         deleteCachedClaudeOauth(service);
         return true;
     }
@@ -1774,10 +1186,6 @@ async function saveClaudeOauth(home, credentials) {
         return false;
     }
 }
-/**
- * Derive the Keychain service name for a Claude home directory.
- * Managed (non-default) homes get a hash suffix for isolation.
- */
 export function getClaudeKeychainService(home) {
     if (!home) {
         return CLAUDE_KEYCHAIN_SERVICE;
@@ -1786,16 +1194,12 @@ export function getClaudeKeychainService(home) {
     const hash = createHash('sha256').update(configDir).digest('hex').slice(0, 8);
     return `${CLAUDE_KEYCHAIN_SERVICE}-${hash}`;
 }
-/**
- * Check whether a requested org ID matches the live OAuth org ID.
- * Returns true when either is absent (no filtering) or when they match.
- */
+// Organization identity guards attribution because different accounts can share email and home labels.
 export function isClaudeUsageOrgMatch(requestedOrgId, liveOrgId) {
     const requested = normalizeString(requestedOrgId);
     const live = normalizeString(liveOrgId);
     return !requested || !live || requested === live;
 }
-/** Read a cached usage snapshot for a given usage key. Returns null if absent or stale. */
 export function readClaudeUsageCache(usageKey, cachePath = getClaudeUsageCachePath(), now = new Date()) {
     const cache = readClaudeUsageCacheFile(cachePath);
     const cached = cache[usageKey];
@@ -1808,13 +1212,10 @@ export function readClaudeUsageCache(usageKey, cachePath = getClaudeUsageCachePa
     }
     return snapshot;
 }
-/** Delete an expired cache row only if it is still expired under the write lock. */
 export function pruneExpiredClaudeUsageCacheEntry(usageKey, cachePath = getClaudeUsageCachePath(), now = new Date()) {
     try {
         ensureLockTarget(cachePath, '{}');
         withFileLock(cachePath, () => {
-            // The row may have been refreshed after readClaudeUsageCache observed it.
-            // Re-read under the lock so stale cleanup cannot erase that newer write.
             const latest = readClaudeUsageCacheFile(cachePath);
             const current = latest[usageKey];
             if (!current || deserializeClaudeUsageSnapshot(current, now))
@@ -1824,16 +1225,12 @@ export function pruneExpiredClaudeUsageCacheEntry(usageKey, cachePath = getClaud
         });
     }
     catch {
-        /* best-effort cache cleanup — lock busy or disk full */
     }
 }
-/** Write a usage snapshot to the on-disk cache. */
 export function writeClaudeUsageCache(usageKey, snapshot, cachePath = getClaudeUsageCachePath()) {
     try {
         ensureLockTarget(cachePath, '{}');
         withFileLock(cachePath, () => {
-            // Re-read under the lock so a concurrent daemon tick / agents view
-            // refresh cannot drop another account's row (lost update).
             const cache = readClaudeUsageCacheFile(cachePath);
             const prior = cache[usageKey];
             cache[usageKey] = {
@@ -1841,20 +1238,14 @@ export function writeClaudeUsageCache(usageKey, snapshot, cachePath = getClaudeU
                     ...snapshot,
                     unavailable: carryForwardUnavailable(prior?.unavailable, snapshot.unavailable),
                 }),
-                // A per-model refusal has its own independent lifecycle (see
-                // noteClaudeModelRefusal / clearClaudeModelRefusal) — a global usage
-                // write must never drop it, the same reason `unavailable` is carried
-                // forward above rather than overwritten.
                 modelRefusals: prior?.modelRefusals,
             };
             atomicWriteFileSync(cachePath, JSON.stringify(cache, null, 2), 'utf-8');
         });
     }
     catch {
-        /* best-effort cache write — lock busy or disk full */
     }
 }
-/** Atomically merge partial native Claude windows into the current fresh row. */
 export function mergeClaudeUsageCacheWindows(usageKey, snapshot, cachePath = getClaudeUsageCachePath()) {
     try {
         ensureLockTarget(cachePath, '{}');
@@ -1874,22 +1265,14 @@ export function mergeClaudeUsageCacheWindows(usageKey, snapshot, cachePath = get
                     plan: snapshot.plan ?? priorSnapshot?.plan ?? null,
                     unavailable: carryForwardUnavailable(prior?.unavailable, snapshot.unavailable),
                 }),
-                // See writeClaudeUsageCache: a per-model refusal survives a windows-only merge too.
                 modelRefusals: prior?.modelRefusals,
             };
             atomicWriteFileSync(cachePath, JSON.stringify(cache, null, 2), 'utf-8');
         });
     }
     catch {
-        /* best-effort cache write — lock busy or disk full */
     }
 }
-/**
- * Export the local usage cache rows worth publishing to fleet peers (PHNX-3392
- * usage-sync). Returns the raw serialized rows keyed by usage identity, filtered
- * to those carrying at least one window — an empty row has nothing to teach a
- * worker. The transport is the on-disk cache form, so there is no Date round-trip.
- */
 export function exportClaudeUsageCacheRows(cachePath = getClaudeUsageCachePath()) {
     const cache = readClaudeUsageCacheFile(cachePath);
     const out = {};
@@ -1905,26 +1288,6 @@ function parseCapturedAtMs(capturedAt) {
     const ms = Date.parse(capturedAt);
     return Number.isFinite(ms) ? ms : null;
 }
-/**
- * Merge usage rows received from a fleet peer into the local cache, NEWEST-WINS
- * per identity by `capturedAt` (PHNX-3392 usage-sync). A worker has no local
- * usage writer, so an incoming row is almost always the freshest it will get; the
- * timestamp guard exists so a stale push from one headed peer can never overwrite
- * a fresher row another peer (or, on a headed receiver, the local status-line)
- * already wrote. An incoming row with no `capturedAt` cannot prove it is newer, so
- * it never displaces an existing timestamped row. Returns the count updated.
- * Locked + atomic like every other cache writer, but through the ASYNC lock: it
- * runs on the daemon's usage-sync tick once per peer reply (PHNX-4116), where
- * the sync lock's `sleepSync` would freeze every other service under contention.
- *
- * Deliberately NOT role-gated on the receiver. "Consume only on worker/unmarked"
- * is a SENDER-side optimization (don't waste a push on a headed peer that reads
- * its own usage), not a safety invariant — the actual safety property is this
- * newest-wins guard. Receiving on a headed box is harmless (its fresher local
- * status-line row survives) or helpful (an account it is signed into but never
- * runs now shows a usage bar), so gating here on the receiver's own — laggier —
- * view of its role would only reject legitimate data.
- */
 export async function ingestPeerClaudeUsageRows(rows, cachePath = getClaudeUsageCachePath()) {
     const incoming = Object.entries(rows).filter(([, row]) => row && Array.isArray(row.windows) && row.windows.length > 0);
     if (incoming.length === 0)
@@ -1939,7 +1302,6 @@ export async function ingestPeerClaudeUsageRows(rows, cachePath = getClaudeUsage
                 if (prior) {
                     const priorMs = parseCapturedAtMs(prior.capturedAt);
                     const incomingMs = parseCapturedAtMs(row.capturedAt);
-                    // Keep local unless the incoming row PROVES it is strictly newer.
                     if (incomingMs === null)
                         continue;
                     if (priorMs !== null && priorMs >= incomingMs)
@@ -1953,11 +1315,9 @@ export async function ingestPeerClaudeUsageRows(rows, cachePath = getClaudeUsage
         });
     }
     catch {
-        /* best-effort cache write — lock busy or disk full */
     }
     return merged;
 }
-/** Read the entire usage cache file from disk. */
 function readClaudeUsageCacheFile(cachePath) {
     if (!fs.existsSync(cachePath)) {
         return {};
@@ -1970,28 +1330,15 @@ function readClaudeUsageCacheFile(cachePath) {
         return {};
     }
 }
-/** Write the entire usage cache to disk. Best-effort; failures are silent. */
 function writeClaudeUsageCacheFile(cache, cachePath) {
     try {
         fs.mkdirSync(path.dirname(cachePath), { recursive: true });
         atomicWriteFileSync(cachePath, JSON.stringify(cache, null, 2), 'utf-8');
     }
     catch {
-        /* best-effort cache write */
     }
 }
-/** Convert a live UsageSnapshot to its JSON-serializable cached form. */
 function serializeClaudeUsageSnapshot(snapshot) {
-    // Persist the union of fresh `windows` and last-known `staleWindows`.
-    // `deserializeClaudeUsageSnapshot` re-runs the freshness gate on read and
-    // re-partitions the serialized windows into fresh vs. stale, so what matters
-    // is that every last-known reading reaches disk. Claude's collector returns
-    // raw windows (no `staleWindows`) and relies on that read-side partition. But
-    // Grok's collector pre-partitions in the fetch, moving an ended-period reading
-    // onto `staleWindows` — serializing only `windows` dropped it, so the very
-    // number a daemon `--refresh` just captured was gone from the next cached
-    // `agents view grok`, which rendered the plan alone (no bar). Include the
-    // stale windows here so the round-trip preserves them for any collector.
     const persistedWindows = [...snapshot.windows, ...(snapshot.staleWindows ?? [])];
     return {
         capturedAt: snapshot.capturedAt?.toISOString() || null,
@@ -2015,24 +1362,6 @@ function serializeClaudeUsageSnapshot(snapshot) {
         pollerDevice: snapshot.freshness?.poller,
     };
 }
-/**
- * Deserialize a cached snapshot, dropping windows whose reset time has passed.
- *
- * An expired window is UNKNOWN, not 0%: the counter reset, and anything may
- * have burned since. Zeroing-but-keeping it (the previous behavior) rendered a
- * weeks-frozen cache as "S: 0% (now)" with `deriveUsageStatusFromSnapshot` →
- * 'available', so a genuinely rate-limited account read as an idle dispatch
- * candidate (RUSH-2858). Dropping keeps them out of `windows` (routing stays
- * blind), but they are preserved on `staleWindows` so the view can render the
- * last-known number with its age instead of a bare "unavailable" — a row that
- * carries only stale windows therefore survives (it is worth showing), and only
- * a row with NOTHING to show — no fresh window, no stale window, no plan, no
- * refusal — deserializes to null so `readClaudeUsageCache` deletes it.
- *
- * A row that carries a plan survives even with no fresh windows: the plan is a
- * truthful reading in its own right, and losing it is what made the cached view
- * contradict the refreshed one for meterless harnesses. See the guard below.
- */
 function deserializeClaudeUsageSnapshot(snapshot, now) {
     const capturedAt = parseDateValue(snapshot.capturedAt);
     const deserialized = snapshot.windows.map((window) => ({
@@ -2044,23 +1373,9 @@ function deserializeClaudeUsageSnapshot(snapshot, now) {
         windowMinutes: window.windowMinutes,
     }));
     const windows = deserialized.filter((window) => isCachedUsageWindowFresh(window, capturedAt, now));
-    // The dropped windows are still the LAST reading we saw for those meters —
-    // routing must not trust them (they stay out of `windows`), but the view
-    // renders them with an age suffix rather than a bare "unavailable" (see
-    // UsageSnapshot.staleWindows). Skip any meter that already has a fresh row.
     const freshKeys = new Set(windows.map((window) => window.key));
     const staleWindows = deserialized.filter((window) => !freshKeys.has(window.key) && !isCachedUsageWindowFresh(window, capturedAt, now));
     const unavailable = deserializeUnavailable(snapshot.unavailable, now);
-    // A windowless row is not automatically worthless. Grok's collector reports
-    // the subscription tier and no meters at all, so treating "no fresh windows"
-    // as "nothing cached" deleted the only truthful thing we knew about the
-    // account: `--refresh` wrote {plan: 'SuperGrok Heavy', windows: []}, the very
-    // next plain `agents view` deserialized it to null, `readClaudeUsageCache`
-    // pruned the row, and the row rendered "usage unavailable" one read after a
-    // successful refresh. Keep a plan-bearing row — it renders as the plan alone,
-    // and `deriveUsageStatusFromSnapshot` still returns null for zero windows, so
-    // it can never read as a 0% bar or an "available" badge (the RUSH-2858
-    // property that made expired windows drop in the first place).
     if (windows.length === 0 &&
         staleWindows.length === 0 &&
         !unavailable &&
@@ -2083,13 +1398,6 @@ function deserializeClaudeUsageSnapshot(snapshot, now) {
             : undefined,
     };
 }
-/**
- * Carry a prior refusal marker forward across a daemon usage refresh, and drop
- * an expired one. A live `snapshot.unavailable` (a refusal just observed) wins.
- * `out_of_credits` survives refreshes with no reset — only a successful run
- * clears it (clearClaudeAccountRefusal). A `session_limit` survives only while
- * its reset time is still in the future.
- */
 function carryForwardUnavailable(prior, live) {
     if (live)
         return live;
@@ -2102,10 +1410,6 @@ function carryForwardUnavailable(prior, live) {
         ? { reason: 'session_limit', resetsAt: reset }
         : undefined;
 }
-/**
- * Deserialize a cached `unavailable` marker, dropping an expired session_limit
- * but keeping a clock-less out_of_credits.
- */
 function deserializeUnavailable(cached, now) {
     if (!cached)
         return undefined;
@@ -2116,23 +1420,16 @@ function deserializeUnavailable(cached, now) {
         ? { reason: 'session_limit', resetsAt: reset }
         : undefined;
 }
-/** Whether any per-model refusal in the row is still live (not clock-expired). */
 function hasLiveModelRefusal(modelRefusals, now) {
     if (!modelRefusals)
         return false;
     return Object.values(modelRefusals).some((entry) => {
         if (!entry.resetsAt)
-            return true; // no clock given — sticky until cleared
+            return true;
         const reset = parseDateValue(entry.resetsAt);
         return !reset || reset.getTime() > now.getTime();
     });
 }
-/**
- * Persist a Claude tokens/credits exhaustion (`out of usage credits` / `monthly
- * spend limit`) from a real run. Unlike a rate/session limit this does NOT reset
- * on a clock, so no reset time is stored — rotation excludes the account until a
- * later successful run clears it via {@link clearClaudeAccountRefusal}.
- */
 export function noteClaudeOutOfCredits(usageKey, cachePath = getClaudeUsageCachePath()) {
     try {
         ensureLockTarget(cachePath, '{}');
@@ -2144,14 +1441,8 @@ export function noteClaudeOutOfCredits(usageKey, cachePath = getClaudeUsageCache
         });
     }
     catch {
-        /* best-effort cache write — lock busy or disk full */
     }
 }
-/**
- * Clear any persisted refusal marker for an account after a run SUCCEEDS on it.
- * This is the recovery path for `out_of_credits` (which has no clock) and also
- * proactively clears a stale `session_limit` the moment the account serves again.
- */
 export function clearClaudeAccountRefusal(usageKey, cachePath = getClaudeUsageCachePath()) {
     try {
         if (!fs.existsSync(cachePath))
@@ -2167,13 +1458,8 @@ export function clearClaudeAccountRefusal(usageKey, cachePath = getClaudeUsageCa
         });
     }
     catch {
-        /* best-effort cache write */
     }
 }
-/**
- * Persist a Claude session-limit refusal from a real run until its stated reset.
- * This quota is not part of Anthropic's five-hour/weekly usage response.
- */
 export function noteClaudeSessionLimit(usageKey, resetsAt, cachePath = getClaudeUsageCachePath()) {
     try {
         ensureLockTarget(cachePath, '{}');
@@ -2188,23 +1474,8 @@ export function noteClaudeSessionLimit(usageKey, resetsAt, cachePath = getClaude
         });
     }
     catch {
-        /* best-effort cache write — lock busy or disk full */
     }
 }
-/**
- * Persist a Claude MODEL-specific refusal — "You've reached your Fable limit.
- * Run /usage-credits to continue or switch models with /model." — a distinct
- * class from {@link noteClaudeOutOfCredits} / {@link noteClaudeSessionLimit}:
- * those exclude the whole account, this excludes only ONE model on it (an
- * organization quota group can meter models separately). `accountKey` MUST be
- * the candidate's stable native-account key (see `candidateAccountKey` in
- * rotate.ts), never the org-shared `usageKey` — using the org key here would
- * poison every sibling account under that org for a limit that named one
- * model on one login. No invented reset: `resetsAt` is written only when the
- * refusal text carried one; otherwise the marker is sticky until a later
- * successful run on this exact (account, model) clears it via
- * {@link clearClaudeModelRefusal}.
- */
 export function claudeModelRefusalKey(accountId, home) {
     if (accountId)
         return `account:${accountId}`;
@@ -2237,16 +1508,8 @@ export function noteClaudeModelRefusal(accountKey, model, refusal, cachePath = g
         });
     }
     catch {
-        /* best-effort cache write — lock busy or disk full */
     }
 }
-/**
- * Clear a persisted model-refusal marker for exactly ONE (account, model)
- * pair after a run SUCCEEDS on that same account+model. Never clears a
- * sibling model on the same account, and never fires for an interactive
- * detach or an unknown outcome — the caller must have demonstrated an actual
- * completed success on this exact model before calling this.
- */
 export function clearClaudeModelRefusal(accountKey, model, cachePath = getClaudeUsageCachePath()) {
     model = modelFamily(model);
     try {
@@ -2267,15 +1530,8 @@ export function clearClaudeModelRefusal(accountKey, model, cachePath = getClaude
         });
     }
     catch {
-        /* best-effort cache write */
     }
 }
-/**
- * Read a live (non-expired) model-refusal marker for (accountKey, model), or
- * null when none is recorded or the recorded one has passed its clock. A
- * marker with no `resetsAt` never expires here — it is sticky until
- * {@link clearClaudeModelRefusal} observes a real success.
- */
 export function getClaudeModelRefusal(accountKey, model, nowMs = Date.now(), cachePath = getClaudeUsageCachePath()) {
     const cache = readClaudeUsageCacheFile(cachePath);
     const entry = cache[accountKey]?.modelRefusals?.[modelFamily(model)];
@@ -2289,14 +1545,6 @@ export function getClaudeModelRefusal(accountKey, model, nowMs = Date.now(), cac
     }
     return { family: entry.family, resetsAt: null };
 }
-/**
- * Parse Claude's model-specific refusal — the CLI's own phrasing when ONE
- * model's quota is exhausted while the account otherwise keeps serving:
- * "You've reached your Fable limit. Run /usage-credits to continue or switch
- * models with /model." Deliberately narrow (unlike the broad RATE_LIMIT_PATTERNS
- * scan) so a session that merely discusses `/usage-credits` cannot false-positive.
- * Tolerates both a straight and curly apostrophe.
- */
 export function parseClaudeModelRefusal(text) {
     const candidates = [text];
     for (const line of text.split('\n')) {
@@ -2308,7 +1556,7 @@ export function parseClaudeModelRefusal(text) {
                 candidates.push(row.message.content.filter((block) => block.type === 'text').map((block) => block.text ?? '').join('\n'));
             }
         }
-        catch { /* Plain terminal output is checked directly. */ }
+        catch { }
     }
     for (const candidate of candidates) {
         const match = /(?:^|\n)\s*You['’]ve reached your ([^\n.]+) limit\.\s*Run \/usage-credits to continue or switch models with \/model\./i.exec(candidate);
@@ -2317,7 +1565,6 @@ export function parseClaudeModelRefusal(text) {
     }
     return null;
 }
-/** Parse Claude's `hit your session limit · resets …` refusal. */
 export function parseClaudeSessionLimitReset(text, nowMs = Date.now()) {
     if (!/hit your session limit/i.test(text))
         return null;
@@ -2360,7 +1607,6 @@ export function parseClaudeSessionLimitReset(text, nowMs = Date.now()) {
         return null;
     }
 }
-/** Check whether a cached usage window is still relevant (not expired or reset). */
 function isCachedUsageWindowFresh(window, capturedAt, now) {
     if (window.resetsAt && window.resetsAt.getTime() <= now.getTime()) {
         return false;
@@ -2373,7 +1619,6 @@ function isCachedUsageWindowFresh(window, capturedAt, now) {
     }
     return true;
 }
-/** Obtain a valid access token, refreshing if expired. Saves refreshed tokens to Keychain. */
 async function getClaudeAccessToken(oauth, home) {
     const accessToken = oauth.accessToken?.trim();
     if (!accessToken) {
@@ -2389,11 +1634,9 @@ async function getClaudeAccessToken(oauth, home) {
     if (!refreshed?.accessToken) {
         return null;
     }
-    // Persist refreshed credentials to Keychain so they survive across runs
     await saveClaudeOauth(home, refreshed);
     return refreshed.accessToken.trim();
 }
-/** Refresh an expired Claude OAuth access token using the refresh token. */
 async function refreshClaudeToken(oauth) {
     const response = await fetch(CLAUDE_TOKEN_URL, {
         method: 'POST',
@@ -2422,11 +1665,6 @@ async function refreshClaudeToken(oauth) {
         scopes: data.scope ? data.scope.split(/\s+/).filter(Boolean) : (oauth.scopes || CLAUDE_SCOPES),
     };
 }
-/**
- * Check whether the Claude OAuth credentials for a given home are usable.
- * Attempts a token refresh if the access token is expired.
- * Returns true only when a valid access token can be obtained.
- */
 export async function isClaudeAuthValid(home) {
     const oauth = await loadClaudeOauth(home);
     if (!oauth)
@@ -2434,25 +1672,21 @@ export async function isClaudeAuthValid(home) {
     const token = await getClaudeAccessToken(oauth, home);
     return token !== null;
 }
-/** Build a User-Agent string for Claude API requests. */
 function getClaudeUserAgent(cliVersion) {
     return cliVersion ? `claude-code/${cliVersion}` : 'claude-code';
 }
-/** Clamp a numeric value to 0..100, returning null for non-finite values. */
 function normalizePercent(value) {
     if (typeof value !== 'number' || !Number.isFinite(value)) {
         return null;
     }
     return Math.max(0, Math.min(100, value));
 }
-/** Validate and return a positive window duration, or null. */
 function normalizeWindowMinutes(value) {
     if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0) {
         return null;
     }
     return value;
 }
-/** Infer the window duration in minutes from a well-known window key. */
 function inferWindowMinutes(key) {
     switch (key) {
         case 'session':
@@ -2464,7 +1698,6 @@ function inferWindowMinutes(key) {
             return 43200;
     }
 }
-/** Parse a date value from a number (epoch seconds or ms) or ISO string. */
 function parseDateValue(value) {
     if (value === null || value === undefined || value === '') {
         return null;
@@ -2482,22 +1715,18 @@ function parseDateValue(value) {
     }
     return null;
 }
-/** Trim and return a string, or null if empty/non-string. */
 function normalizeString(value) {
     if (typeof value !== 'string')
         return null;
     const trimmed = value.trim();
     return trimmed || null;
 }
-/** Render a full-width usage bar for detailed views. */
 function renderUsageBar(usedPercent) {
     return renderBar(usedPercent, USAGE_BAR_LEN);
 }
-/** Render a compact usage bar for inline summaries. */
 function renderCompactUsageBar(usedPercent) {
     return renderBar(usedPercent, COMPACT_BAR_LEN);
 }
-/** Render a proportional colored progress bar at one-eighth-cell resolution. */
 export function renderBar(usedPercent, length) {
     const clamped = Math.max(0, Math.min(100, usedPercent));
     const eighths = Math.round((clamped / 100) * length * 8);
@@ -2507,11 +1736,9 @@ export function renderBar(usedPercent, length) {
     const gauge = FULL.repeat(filled) + PARTIAL_BLOCKS[partial];
     return color(gauge) + chalk.dim(EMPTY.repeat(length - filled - (partial > 0 ? 1 : 0)));
 }
-/** Apply the appropriate color to a text string based on usage percentage. */
 function colorUsage(text, usedPercent) {
     return getUsageColor(usedPercent)(text);
 }
-/** Return a chalk color function based on the usage percentage threshold. */
 export function getUsageColor(usedPercent) {
     if (usedPercent >= 100)
         return chalk.red;
@@ -2519,17 +1746,10 @@ export function getUsageColor(usedPercent) {
         return chalk.yellow;
     return chalk.cyan;
 }
-/** Format a percentage value with at most one decimal place. */
 function formatPercent(value) {
     const rounded = Math.round(value * 10) / 10;
     return Number.isInteger(rounded) ? String(rounded) : rounded.toFixed(1);
 }
-/**
- * Compact "time until reset" hint for the inline usage bars: "5m", "2h", "3d",
- * or "now" once elapsed. Deliberately coarse (single unit, whole numbers) so it
- * fits after a bar without wrapping the row — the detailed section
- * (`formatResetAt`) carries the precise clock time.
- */
 function formatResetHint(date) {
     const diffMs = date.getTime() - Date.now();
     if (diffMs <= 0)
@@ -2543,11 +1763,6 @@ function formatResetHint(date) {
     const days = Math.round(hours / 24);
     return `${days}d`;
 }
-/**
- * Compact elapsed-time label for a stale reading's age: "30m", "6h", "2d".
- * Coarse single-unit like {@link formatResetHint}, floored at "1m" so a
- * just-expired window never reads "0m".
- */
 function formatAgeShort(diffMs) {
     const mins = Math.max(1, Math.round(diffMs / 60000));
     if (mins < 60)
@@ -2558,15 +1773,6 @@ function formatAgeShort(diffMs) {
     const days = Math.round(hours / 24);
     return `${days}d`;
 }
-/**
- * Staleness suffix for a last-known window the freshness gate dropped. A window
- * whose reset/period boundary passed while the sample itself is still inside its
- * `windowMinutes` rolled OVER — the number describes a period that is done, so
- * name it ("period ended 1h", e.g. Grok's weekly billing period). A window
- * that aged past its own `windowMinutes` (Claude's 5h session read never
- * refreshed in time) is a stale sample of a still-rolling window, so report the
- * capture age ("6h old"). Falls back to the reset age, then a bare "stale".
- */
 function formatStaleWindowSuffix(window, capturedAt, now) {
     const resetPassed = !!window.resetsAt && window.resetsAt.getTime() <= now.getTime();
     const captureExpired = !!capturedAt &&
@@ -2581,20 +1787,12 @@ function formatStaleWindowSuffix(window, capturedAt, now) {
         return `period ended ${formatAgeShort(now.getTime() - window.resetsAt.getTime())}`;
     return 'stale';
 }
-/**
- * Render a dropped-but-last-known window as "S: ▍░░░░ 30%* (6h old)": the gauge
- * and percentage exactly as a live bar, then the `*` stale marker the listing
- * legend explains and a dim age, so the number is always visible and
- * unmistakably not current. VIEW-ONLY — these windows are never in
- * `snapshot.windows`, so routing never sees them.
- */
 function renderStaleUsageWindow(window, capturedAt, shortLabel, now) {
     const bar = renderCompactUsageBar(window.usedPercent);
     const pct = colorUsage(`${Math.round(window.usedPercent)}%`, window.usedPercent);
     const suffix = formatStaleWindowSuffix(window, capturedAt, now);
     return `${chalk.gray(`${shortLabel}:`)} ${bar} ${pct}${chalk.dim('*')} ${chalk.dim(`(${suffix})`)}`;
 }
-/** Format a reset timestamp as a human-readable relative or absolute time. */
 function formatResetAt(date) {
     const timezone = Intl.DateTimeFormat().resolvedOptions().timeZone;
     const now = new Date();
@@ -2619,7 +1817,6 @@ function formatResetAt(date) {
     }
     return `${date.toLocaleString('en-US', options)} (${timezone})`;
 }
-/** Safe wrapper around fs.realpathSync that returns null on error. */
 function safeRealpathSync(filePath) {
     try {
         return fs.realpathSync(filePath);
@@ -2628,7 +1825,6 @@ function safeRealpathSync(filePath) {
         return null;
     }
 }
-/** Safe wrapper around fs.statSync that returns null on error. */
 function safeStatSync(filePath) {
     try {
         return fs.statSync(filePath);
@@ -2637,19 +1833,6 @@ function safeStatSync(filePath) {
         return null;
     }
 }
-/**
- * Resolve the Grok billing log to read usage from.
- *
- * `agents view grok` reads usage per INSTALLED VERSION, passing each version's
- * isolated home (`~/.agents/.history/versions/grok/<ver>`). Grok writes
- * `unified.jsonl` only to the shared real home `~/.grok/logs/unified.jsonl`
- * even though GROK_HOME isolates auth/config/models per version. A per-version
- * log, if one ever appears, still wins; otherwise we return the shared path
- * marked `shared: true` so the caller can attribute it to at most one identity.
- * Grok accounts are version-scoped (`NATIVE_ACCOUNT_CAPABILITIES.grok.scope ===
- * 'version'`) — the shared file has no owner, so it must not be stamped onto
- * every version home.
- */
 function resolveGrokBillingLogPath(home) {
     const rel = ['.grok', 'logs', 'unified.jsonl'];
     const perVersion = path.join(home || os.homedir(), ...rel);
@@ -2657,21 +1840,17 @@ function resolveGrokBillingLogPath(home) {
         if (fs.existsSync(perVersion))
             return { logPath: perVersion, shared: false };
     }
-    catch { /* unreadable */ }
-    // `AGENTS_REAL_HOME` is the seam every version-home consumer honors: a
-    // daemon/service-manager child's HOME can be baked to something other than
-    // the account's real home, so os.homedir() alone is not a reliable stand-in.
+    catch { }
     const shared = path.join(process.env.AGENTS_REAL_HOME || os.homedir(), ...rel);
     if (shared !== perVersion) {
         try {
             if (fs.existsSync(shared))
                 return { logPath: shared, shared: true };
         }
-        catch { /* unreadable */ }
+        catch { }
     }
     return null;
 }
-/** This home's own `.grok/auth.json` only — never the shared-home fallback. */
 function readGrokAuthIdentity(home) {
     const authPath = path.join(home, '.grok', 'auth.json');
     try {
@@ -2730,11 +1909,7 @@ function grokIdentityFromBillingPayload(parsed) {
 function sameHomePath(a, b) {
     return (safeRealpathSync(a) ?? path.resolve(a)) === (safeRealpathSync(b) ?? path.resolve(b));
 }
-/**
- * Whether the shared `~/.grok` billing log may be attached to this home.
- * Grok logins are per version home; the shared last line is one account's
- * meter. Fail loud: never copy it onto every installed identity.
- */
+// A real-HOME Grok billing log serves a version home only when payload/auth identities match; unknown identity belongs only to real HOME.
 function sharedGrokLogAppliesToHome(home, match) {
     const realHome = process.env.AGENTS_REAL_HOME || os.homedir();
     const requestedHome = home || os.homedir();
@@ -2742,18 +1917,13 @@ function sharedGrokLogAppliesToHome(home, match) {
     if (match.identity) {
         return grokIdentitiesMatch(match.identity, thisId);
     }
-    // No identity on the line (the live Grok shape). Attribute the reading to
-    // exactly one canonical identity: the real home itself, or the version home
-    // whose own auth.json matches the shared `~/.grok/auth.json`.
     if (sameHomePath(requestedHome, realHome))
         return true;
     return grokIdentitiesMatch(thisId, readGrokAuthIdentity(realHome));
 }
-/** Parse the latest billing info from Grok's unified log. */
 async function getGrokUsageInfo(options) {
     try {
         const resolved = resolveGrokBillingLogPath(options?.home);
-        // No log yet: a benign "nothing recorded here", not a failure (RUSH-3040).
         if (!resolved)
             return usageNoRecentUsageInfo();
         const match = await readLatestGrokBilling(resolved.logPath);
@@ -2762,18 +1932,8 @@ async function getGrokUsageInfo(options) {
         if (resolved.shared && !sharedGrokLogAppliesToHome(options?.home, match)) {
             return usageNoRecentUsageInfo();
         }
-        // Grok has no live usage API (`network: false`) — bars are last-seen from
-        // this machine's unified.jsonl only. Drop windows whose billing period has
-        // already ended so a stale 100% does not paint "rate-limited" after reset,
-        // and so an expired 92% on one box cannot disagree with a fresh reading on
-        // another. Missing `creditUsagePercent` never reaches here as a 0% bar
-        // (see readLatestGrokBilling).
         const now = new Date();
         const windows = match.windows.filter((window) => isCachedUsageWindowFresh(window, match.capturedAt, now));
-        // A window from an ended billing period is the LAST reading we saw — routing
-        // must not trust it (kept out of `windows`), but the view renders it with a
-        // "period ended Xh ago" suffix instead of the bare refresh hint. Only when
-        // there is nothing at all to show does the refresh hint stand alone.
         const staleWindows = match.windows.filter((window) => !isCachedUsageWindowFresh(window, match.capturedAt, now));
         const version = options?.cliVersion;
         const refreshHint = windows.length === 0 && staleWindows.length === 0
@@ -2796,21 +1956,9 @@ async function getGrokUsageInfo(options) {
         return { snapshot: null, error: usageUnreachableError('Grok', err) };
     }
 }
-/**
- * Muse Code usage.
- *
- * Prefer live Meta Model API rate-limit headers when a key is available
- * (META_API_KEY / MODEL_API_KEY / ~/.config/muse/auth.json). Fall back to
- * aggregating `model_completed.usage` from local session.jsonl logs under
- * ~/.local/share/muse/sessions for a last-7-days token window.
- */
 async function getMuseUsageInfo(options) {
     try {
         const base = options?.home || os.homedir();
-        // Honour a live Retry-After rather than re-arming the penalty (see
-        // usage-backoff.ts). The local log fallback still works while the live
-        // probe is throttled — only report the throttle when there is truly
-        // nothing else to show.
         const throttledUntil = usageRateLimitedUntil('muse', Date.now(), options?.usageScope);
         if (throttledUntil) {
             const local = await readMuseLocalSessionUsage(base);
@@ -2824,9 +1972,6 @@ async function getMuseUsageInfo(options) {
         const local = await readMuseLocalSessionUsage(base);
         if (local)
             return { snapshot: local, error: null };
-        // No live snapshot and no local log — every source came up empty. Only
-        // now does the probe's own outcome become the reported error, mirroring
-        // Cursor's "surface the last resort's failure" pattern above.
         if (!probe.hasKey)
             return { snapshot: null, error: usageNoCredentialError('Muse') };
         if (probe.noHeaders)
@@ -2837,13 +1982,9 @@ async function getMuseUsageInfo(options) {
         };
     }
     catch (err) {
-        // A thrown request (timeout, DNS, TLS, a malformed payload) is a failed
-        // read like any other — staying silent here would hand the caller a stale
-        // snapshot to render as confirmed (RUSH-3040).
         return { snapshot: null, error: usageUnreachableError('Muse', err) };
     }
 }
-/** Resolve a Muse API key from env or auth.json without logging the value. */
 function resolveMuseApiKey(base) {
     const envKey = process.env.META_API_KEY?.trim() || process.env.MODEL_API_KEY?.trim();
     if (envKey)
@@ -2868,16 +2009,9 @@ function resolveMuseApiKey(base) {
         }
     }
     catch {
-        /* unreadable auth */
     }
     return null;
 }
-/**
- * Probe Meta Model API for rate-limit headers. Uses GET /v1/models (no token
- * spend). The 429 backoff is noted by the CALLER via
- * {@link classifyUsageFetchFailure}, not here, so a throttled read is recorded
- * exactly once regardless of which branch of `getMuseUsageInfo` observes it.
- */
 async function probeMuseRateLimits(base) {
     const key = resolveMuseApiKey(base);
     if (!key)
@@ -2951,11 +2085,6 @@ function headerNumber(headers, name) {
     const n = Number(raw);
     return Number.isFinite(n) ? n : null;
 }
-/**
- * Aggregate Muse session token usage from local session.jsonl files for the
- * last 7 days. Scales the bar against 10M tokens (soft visibility scale — Meta
- * is pay-as-you-go with no hard local cap).
- */
 async function readMuseLocalSessionUsage(base) {
     const root = path.join(base, '.local', 'share', 'muse', 'sessions');
     if (!fs.existsSync(root))
@@ -3015,7 +2144,6 @@ async function readMuseLocalSessionUsage(base) {
                 }
             }
             catch {
-                /* skip unreadable session */
             }
         }
     };
@@ -3023,7 +2151,6 @@ async function readMuseLocalSessionUsage(base) {
     const total = inputTokens + outputTokens + cachedTokens;
     if (total === 0 && files === 0)
         return null;
-    // Soft 10M-token scale for the bar (pay-as-you-go has no hard local cap).
     const softCap = 10_000_000;
     const usedPercent = Math.max(0, Math.min(100, (total / softCap) * 100));
     const formatK = (n) => n >= 1_000_000 ? `${(n / 1_000_000).toFixed(1)}M` : n >= 1000 ? `${(n / 1000).toFixed(1)}k` : String(n);
@@ -3064,11 +2191,6 @@ async function readLatestGrokBilling(filePath) {
                         ? config.currentPeriod
                         : null;
                     if (currentPeriod?.end && typeof config.creditUsagePercent === 'number') {
-                        // `creditUsagePercent` is Grok's weekly credit consumption (0-100);
-                        // the billing period's `end` is when that window resets.
-                        // Do NOT coerce a missing percent to 0 — a new period often lands a
-                        // billing line before the gauge is populated, and inventing 0% makes
-                        // `agents view` disagree across devices (and looks like a fresh week).
                         const rawPercent = config.creditUsagePercent;
                         windows.push({
                             key: 'week',
@@ -3088,22 +2210,12 @@ async function readLatestGrokBilling(filePath) {
                 }
             }
             catch {
-                /* malformed session line */
             }
         });
         rl.on('close', () => resolve(latest));
         rl.on('error', () => resolve(latest));
     });
 }
-/**
- * Normalize Cursor's /api/usage payload into the common UsageWindow shape.
- *
- * Only free / legacy request-capped plans carry a `maxRequestUsage` on the
- * premium ("gpt-4") bucket — that's the fast-request cap the plan meters, and it
- * maps cleanly to a monthly window. Usage-based plans report `maxRequestUsage:
- * null` (no request cap — spend is metered in dollars instead), so they have no
- * bar to draw here and return no windows rather than a misleading empty gauge.
- */
 export function normalizeCursorUsage(data) {
     const premium = data['gpt-4'];
     if (!premium || typeof premium !== 'object')
@@ -3113,10 +2225,6 @@ export function normalizeCursorUsage(data) {
         return [];
     const used = typeof premium.numRequests === 'number' ? premium.numRequests : 0;
     const startOfMonth = typeof data.startOfMonth === 'string' ? parseDateValue(data.startOfMonth) : null;
-    // The request quota resets one calendar month after the period start. Guard the
-    // month-end overflow: setMonth on a day the target month lacks (Jan 31 -> Feb 31)
-    // rolls forward into the month after (Mar 3), so clamp back to the intended
-    // month's last day.
     let resetsAt = null;
     if (startOfMonth) {
         resetsAt = new Date(startOfMonth);
@@ -3136,25 +2244,12 @@ export function normalizeCursorUsage(data) {
         },
     ];
 }
-/**
- * Normalize a single Cursor percent-based window (auto/api/total), or null when
- * the percent is not a finite number — the "no empty gauges" rule.
- * `windowMinutes` stays null: every window shares one billing-cycle reset
- * (`resetsAt`, from the explicit `billingCycleEnd`), not an inferred cadence, so
- * inferring one from the (repurposed) `session`/`week`/`month` key would let the
- * SWR cache zero the bar out long before the real reset.
- */
 function normalizeCursorPercentWindow(percent, key, label, shortLabel, resetsAt) {
     const usedPercent = normalizePercent(percent);
     if (usedPercent === null)
         return null;
     return { key, label, shortLabel, usedPercent, resetsAt, windowMinutes: null };
 }
-/**
- * Normalize Cursor's dashboard `get-current-period-usage` payload — the
- * primary usage source, giving the same Auto+Composer / API / Total breakdown
- * the web dashboard shows.
- */
 export function normalizeCursorPeriodUsage(data) {
     const resetsAt = parseDateValue(data.billingCycleEnd);
     const plan = data.planUsage;
@@ -3165,14 +2260,6 @@ export function normalizeCursorPeriodUsage(data) {
     ];
     return windows.filter((window) => window !== null);
 }
-/**
- * Normalize Cursor's `usage-summary` fallback payload — the same Auto/API/Total
- * breakdown nested under `individualUsage.plan`, used when the primary
- * dashboard endpoint returns no usable `planUsage` (seen on some
- * enterprise/team accounts). An unlimited plan (`isUnlimited: true`) with no
- * usable percent has nothing to draw and returns no windows, rather than a
- * misleading empty gauge.
- */
 export function normalizeCursorUsageSummary(data) {
     const resetsAt = parseDateValue(data.billingCycleEnd);
     const plan = data.individualUsage?.plan;
@@ -3183,7 +2270,6 @@ export function normalizeCursorUsageSummary(data) {
     ];
     return windows.filter((window) => window !== null);
 }
-/** Read Cursor's OAuth access token + config-file subject from the local CLI config/auth files. */
 function readCursorCredentials(base) {
     try {
         const cfgPath = path.join(base, '.cursor', 'cli-config.json');
@@ -3202,22 +2288,10 @@ function readCursorCredentials(base) {
         return null;
     }
 }
-/**
- * Resolve the OAuth subject Cursor expects in the `WorkosCursorSessionToken`
- * cookie: the access token's own JWT `sub` claim first (the subject that
- * actually signed the token in hand), falling back to the subject
- * `cli-config.json` recorded at login when the token carries no usable `sub`.
- */
 function resolveCursorSubject(accessToken, cfgSub) {
     const jwtSub = normalizeString(decodeJwtPayload(accessToken)?.sub);
     return jwtSub || cfgSub;
 }
-/**
- * POST the dashboard current-period-usage endpoint and normalize its windows.
- * Returns null on any network/auth failure so the caller falls through to the
- * next source — only a genuine empty-windows response distinguishes "no usage
- * to report" from "couldn't reach this source".
- */
 async function fetchCursorPeriodWindows(cookie) {
     try {
         const response = await fetch(CURSOR_PERIOD_USAGE_URL, {
@@ -3244,10 +2318,6 @@ async function fetchCursorPeriodWindows(cookie) {
         return null;
     }
 }
-/**
- * GET the usage-summary fallback endpoint and normalize its windows. Same
- * null-on-failure contract as {@link fetchCursorPeriodWindows}.
- */
 async function fetchCursorUsageSummaryWindows(cookie) {
     try {
         const response = await fetch(CURSOR_USAGE_SUMMARY_URL, {
@@ -3271,30 +2341,6 @@ async function fetchCursorUsageSummaryWindows(cookie) {
         return null;
     }
 }
-/**
- * Fetch Cursor usage. Cursor authenticates every one of these requests with a
- * `WorkosCursorSessionToken` cookie of the form `<oauth-subject>::<access-token>`
- * (the same pair the web dashboard sends), not a bearer header, so all three
- * sources below share one resolved cookie.
- *
- * Three sources, tried in order, because no single endpoint carries usable data
- * for every plan shape:
- *
- *  1. `get-current-period-usage` — the primary source, and the richest: the
- *     Auto+Composer / API / Total percent breakdown the dashboard itself shows.
- *  2. `usage-summary` — some enterprise/team accounts return no usable
- *     `planUsage` from (1); this nests the same three percentages under
- *     `individualUsage.plan` instead.
- *  3. The legacy `/api/usage` request-cap endpoint — the original source,
- *     kept as the final fallback for free/legacy plans that predate the
- *     percent-based breakdown above and only ever exposed a monthly request cap.
- *
- * The first source to yield a non-empty window list wins; a source that errors
- * or returns no usable numbers falls through to the next rather than surfacing
- * an error — only the last resort's own response/error is surfaced when every
- * source comes up empty, so a plan enrolled in exactly one billing model still
- * renders instead of reporting three swallowed failures.
- */
 async function getCursorUsageInfo(options) {
     try {
         const base = options?.home || os.homedir();
@@ -3336,8 +2382,6 @@ async function getCursorUsageInfo(options) {
             },
             signal: usageFetchSignal(options?.signal, 5000),
         });
-        // 401/redirect => revoked/expired session. No bars to draw, and the status
-        // says why.
         if (!response.ok) {
             if (response.status === 429) {
                 noteUsageRateLimited('cursor', response.headers.get('retry-after'));
@@ -3356,38 +2400,17 @@ async function getCursorUsageInfo(options) {
         };
     }
     catch (err) {
-        // A thrown request (timeout, DNS, TLS, a malformed payload) is a failed
-        // read like any other — staying silent here would hand the caller a stale
-        // snapshot to render as confirmed, which is the bug this file just closed.
         return { snapshot: null, error: usageUnreachableError('Cursor', err) };
     }
 }
-// ---------------------------------------------------------------------------
-// Antigravity (`agy`) usage — Google Code Assist per-model quota buckets
-// ---------------------------------------------------------------------------
 const ANTIGRAVITY_TOKEN_URL = 'https://oauth2.googleapis.com/token';
-// Production Code Assist endpoint first; the daily track is where `agy` itself
-// points when the account is enrolled in the daily channel (its log shows
-// daily-cloudcode-pa), so fall back to it when prod rejects the call.
 const ANTIGRAVITY_QUOTA_URLS = [
     'https://cloudcode-pa.googleapis.com/v1internal:retrieveUserQuota',
     'https://daily-cloudcode-pa.googleapis.com/v1internal:retrieveUserQuota',
 ];
-// The public installed-app OAuth client the released `agy` binary itself
-// ships (Google installed-app clients are non-confidential by design — the
-// same client community tooling uses). Needed because a Google token refresh
-// requires the client id/secret pair the login was minted under.
 const ANTIGRAVITY_CLIENT_ID = '1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com';
 const ANTIGRAVITY_CLIENT_SECRET = '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';
-/** Refresh leeway — treat an access token expiring within a minute as expired. */
 const ANTIGRAVITY_REFRESH_LEEWAY_MS = 60 * 1000;
-/**
- * Parse a stored `agy` OAuth payload into its token. Handles both on-disk
- * shapes: the raw `{ token: {…} }` JSON (Linux file fallback) and the
- * `go-keyring-base64:<base64>` wrapper zalando/go-keyring writes into the
- * macOS Keychain item (service `gemini`, account `antigravity`). Never throws
- * (malformed input => null).
- */
 export function parseAntigravityOauthPayload(raw) {
     try {
         let text = raw.trim();
@@ -3406,12 +2429,6 @@ export function parseAntigravityOauthPayload(raw) {
         return null;
     }
 }
-/**
- * True when the stored access token is expired (or inside the refresh leeway).
- * A missing/unparseable expiry is treated as still-fresh — the quota call
- * below is the source of truth if the token is actually dead (401 => render
- * nothing), and we never want to force a refresh without evidence.
- */
 export function antigravityTokenNeedsRefresh(expiry, nowMs = Date.now()) {
     if (!expiry)
         return false;
@@ -3420,13 +2437,6 @@ export function antigravityTokenNeedsRefresh(expiry, nowMs = Date.now()) {
         return false;
     return nowMs + ANTIGRAVITY_REFRESH_LEEWAY_MS >= ms;
 }
-/**
- * Resolve the `agy` OAuth credential file. agy is a self-updating global
- * install (no per-version homes), but check the passed home first and then the
- * active location under the real HOME — mirrors resolveKimiCredentialPath.
- * Present only on Linux without a Secret Service daemon; macOS logins live in
- * the Keychain instead.
- */
 function resolveAntigravityCredentialPath(home) {
     const rel = ['.gemini', 'antigravity-cli', 'antigravity-oauth-token'];
     const perHome = path.join(home || os.homedir(), ...rel);
@@ -3434,25 +2444,17 @@ function resolveAntigravityCredentialPath(home) {
         if (fs.existsSync(perHome))
             return perHome;
     }
-    catch { /* unreadable */ }
+    catch { }
     const active = path.join(process.env.AGENTS_REAL_HOME || os.homedir(), ...rel);
     if (active !== perHome) {
         try {
             if (fs.existsSync(active))
                 return active;
         }
-        catch { /* unreadable */ }
+        catch { }
     }
     return null;
 }
-/**
- * Load the stored `agy` OAuth token: the file fallback first, then the OS
- * keyring (macOS Keychain / Linux Secret Service — go-keyring's two stores;
- * the probe command pair mirrors antigravityOsKeyringProbe in agents.ts, with
- * `-w` on macOS to read the secret value, not just metadata). Returns null on
- * Windows or when no readable credential exists. Honors the
- * AGENTS_NO_KEYCHAIN_PROBE=1 test guard.
- */
 async function loadAntigravityOauth(home) {
     const credPath = resolveAntigravityCredentialPath(home);
     if (credPath) {
@@ -3461,7 +2463,7 @@ async function loadAntigravityOauth(home) {
             if (parsed)
                 return parsed;
         }
-        catch { /* unreadable file — fall through to the keyring */ }
+        catch { }
     }
     if (process.env.AGENTS_NO_KEYCHAIN_PROBE === '1')
         return null;
@@ -3480,16 +2482,6 @@ async function loadAntigravityOauth(home) {
         return null;
     }
 }
-/**
- * Refresh an `agy` access token against Google's token endpoint. This is safe
- * from a read path in a way Claude/WorkOS refreshes are NOT: Google's OAuth
- * refresh tokens are stable and non-rotating — a refresh mints a new access
- * token and leaves the refresh token (and every other live access token)
- * valid, so refreshing here cannot invalidate a concurrently running `agy`.
- * We still never write the refreshed token back: `agy` rewrites its own
- * keychain item on launch, and a read-only usage fetch must not mutate the
- * user's credential.
- */
 async function refreshAntigravityAccessToken(refreshToken) {
     try {
         const response = await fetch(ANTIGRAVITY_TOKEN_URL, {
@@ -3512,13 +2504,6 @@ async function refreshAntigravityAccessToken(refreshToken) {
         return null;
     }
 }
-/**
- * POST :retrieveUserQuota against the Code Assist endpoints in order, returning
- * the first successful bucket list. `buckets: null` when every endpoint rejects
- * (expired token, no quota API for the account) or the network fails — `status`
- * carries the LAST rejection's HTTP status (or null when every attempt threw)
- * so the caller can classify the failure instead of it reading as silence.
- */
 async function fetchAntigravityQuota(accessToken) {
     let lastStatus = null;
     let lastRetryAfter = null;
@@ -3548,7 +2533,6 @@ async function fetchAntigravityQuota(accessToken) {
     }
     return { buckets: null, status: lastStatus, retryAfter: lastRetryAfter };
 }
-/** Compact model tag for the inline bar — 'gemini-2.5-flash-lite' => '2.5FL'. */
 export function antigravityModelShortLabel(modelId) {
     const stripped = modelId.replace(/^gemini-/i, '');
     const parts = stripped.split('-').filter(Boolean);
@@ -3557,16 +2541,6 @@ export function antigravityModelShortLabel(modelId) {
     const [version, ...rest] = parts;
     return version + rest.map((part) => (part[0] ? part[0].toUpperCase() : '')).join('');
 }
-/**
- * Normalize the per-model quota buckets into the common UsageWindow shape —
- * one window per model (`gemini-3.1-pro`, `gemini-2.5-flash`, …), keyed
- * `session` since each bucket is a short-cycle quota with its own reset time.
- * Duplicate buckets for one model keep the LOWEST remaining fraction (the
- * most conservative read). Sorted most-used first so the bar closest to
- * throttling leads the row. `windowMinutes` stays null: the API reports only
- * the reset timestamp, not the window length, and an inferred 5h session
- * length would wrongly zero the SWR cache between resets.
- */
 export function normalizeAntigravityWindows(buckets) {
     const byModel = new Map();
     for (const bucket of buckets) {
@@ -3596,14 +2570,6 @@ export function normalizeAntigravityWindows(buckets) {
     windows.sort((a, b) => b.usedPercent - a.usedPercent);
     return windows;
 }
-/**
- * Fetch Antigravity usage via Google Code Assist's :retrieveUserQuota — the
- * quota API `agy` itself talks to (its log shows the sibling :loadCodeAssist
- * and :fetchAvailableModels calls on the same host). Auth is the stored `agy`
- * OAuth token (OS keyring on macOS, file fallback on Linux), refreshed
- * in-memory when expired — safe because Google's refresh tokens are
- * non-rotating (see refreshAntigravityAccessToken).
- */
 async function getAntigravityUsageInfo(options) {
     try {
         const token = await loadAntigravityOauth(options?.home);
@@ -3615,10 +2581,6 @@ async function getAntigravityUsageInfo(options) {
         }
         if (!accessToken)
             return { snapshot: null, error: usageExpiredCredentialError('Antigravity') };
-        // Honour a live Retry-After rather than re-arming the penalty (see
-        // usage-backoff.ts). No request at all while the window is open. Antigravity
-        // previously had NO rate-limit backoff at all (RUSH-3040) — every refresh
-        // re-hit a throttled endpoint.
         const throttledUntil = usageRateLimitedUntil('antigravity', Date.now(), options?.usageScope);
         if (throttledUntil) {
             return { snapshot: null, error: usageThrottledError('Antigravity', throttledUntil) };
@@ -3644,9 +2606,6 @@ async function getAntigravityUsageInfo(options) {
         };
     }
     catch (err) {
-        // A thrown request (timeout, DNS, TLS, a malformed payload) is a failed
-        // read like any other — staying silent here would hand the caller a stale
-        // snapshot to render as confirmed (RUSH-3040).
         return { snapshot: null, error: usageUnreachableError('Antigravity', err) };
     }
 }