@teamvibe/poller 0.8.4-rc.1 → 0.8.4-rc.3

package/README.md

@@ -74,23 +74,23 @@ All configuration is via environment variables (or `~/.teamvibe/.env`):
 |----------|----------|---------|-------------|
 | `TEAMVIBE_POLLER_TOKEN` | Yes | — | Your poller authentication token |
 | `CLAUDE_CODE_OAUTH_TOKEN` | No | — | Claude Code OAuth token (from `claude setup-token`) |
-| `EXPOSE_CLAUDE_TOKEN_TO_AGENT` | No | `false` | Opt in per poller to exposing the session token to agent subprocesses; accepts `1`/`true`/`yes`/`on` (case-insensitive) |
-| `TEAMVIBE_CLAUDE_OAUTH_TOKEN` | Injected | Unset | In the poller-injected env: with opt-in, the selected pool account's token, otherwise the poller's non-empty `CLAUDE_CODE_OAUTH_TOKEN`; inherited aliases are cleared. Claude settings can override this |
-| `TEAMVIBE_POOL_ACCOUNT_ID` | Injected | Unset | In the poller-injected env: with opt-in and a selected pool account, its account ID (no secret); absent without a pool account. Claude settings can override this |
+| `EXPOSE_CLAUDE_TOKEN_TO_AGENT` | No | `true` | Expose the session token to agent subprocesses by default; only `0`/`false`/`no`/`off` (case-insensitive) opt out. Unset or any other value is on |
+| `TEAMVIBE_CLAUDE_OAUTH_TOKEN` | Injected | Session token | In the poller-injected env: the selected pool account's token or the poller's non-empty `CLAUDE_CODE_OAUTH_TOKEN`; unset on explicit opt-out or without a token. Inherited aliases are cleared. Claude settings can override this |
+| `TEAMVIBE_POOL_ACCOUNT_ID` | Injected | Selected account ID | In the poller-injected env: the selected pool account ID (no secret); unset on explicit opt-out or without a pool account. Claude settings can override this |
 | `TEAMVIBE_API_URL` | No | `https://poller.api.teamvibe.ai` | API endpoint |
 | `MAX_CONCURRENT_SESSIONS` | No | `5` | Max parallel Claude sessions |
 | `CLAUDE_CLI_PATH` | No | `claude` | Path to Claude Code CLI |
 | `TEAMVIBE_DATA_DIR` | No | `~/.teamvibe` | Data directory for brains and state |
 
-Set `EXPOSE_CLAUDE_TOKEN_TO_AGENT=true` in the poller's environment to let agents run nested Claude sessions on the current session's account. Claude CLI strips `CLAUDE_CODE_OAUTH_TOKEN` from Bash subprocess environments by name, so agents can restore it from the alias:
+Agents can run nested Claude sessions on the current session's account by default, for both pool and non-pool sessions. Set `EXPOSE_CLAUDE_TOKEN_TO_AGENT=false` in the poller's environment to opt out (`0`, `no`, and `off` also disable it, case-insensitively); unset or any other value keeps it on. Claude CLI strips `CLAUDE_CODE_OAUTH_TOKEN` from Bash subprocess environments by name, so agents can restore it from the alias:
 
 ```bash
 CLAUDE_CODE_OAUTH_TOKEN="$TEAMVIBE_CLAUDE_OAUTH_TOKEN" claude -p "…"
 ```
 
-In the environment the poller injects, the alias and account ID follow the selected account on resume and failover; without opt-in, the poller leaves both variables unset. **This guarantee applies only to the injected process environment.** Claude CLI subsequently applies settings-file `env` entries: a brain's `CLAUDE_CONFIG_DIR/settings.json` can restore either variable when the flag is off or override it with a stale value when the flag is on. Project `.claude/settings.json` and `.claude/settings.local.json` can also override them. `settings.local.json` is a project source, not a user file next to `CLAUDE_CONFIG_DIR/settings.json`; recent CLI versions also read project-local settings from the main checkout for worktree sessions ([Claude settings sources](https://code.claude.com/docs/en/settings)). Before each spawn, the poller emits one warning listing the keys and files defining either variable in these settings sources, never their values. It never edits brain settings. Remove conflicting entries yourself to preserve the injected values in the agent's environment.
+In the environment the poller injects, the alias and account ID follow the selected account on resume and failover; with explicit opt-out, the poller leaves both variables unset. **This guarantee applies only to the injected process environment.** Claude CLI subsequently applies settings-file `env` entries: a brain's `CLAUDE_CONFIG_DIR/settings.json` can restore either variable when the flag is off or override it with a stale value when the flag is on. Project `.claude/settings.json` and `.claude/settings.local.json` can also override them. `settings.local.json` is a project source, not a user file next to `CLAUDE_CONFIG_DIR/settings.json`; recent CLI versions also read project-local settings from the main checkout for worktree sessions ([Claude settings sources](https://code.claude.com/docs/en/settings)). Before each spawn, the poller emits one warning listing the keys and files defining either variable in these settings sources, never their values. It never edits brain settings. Remove conflicting entries yourself to preserve the injected values in the agent's environment.
 
-**Security trade-off:** with opt-in, the agent and its subprocesses can read and use the token, bypassing Claude CLI's credential filtering. Enable this only for agents you trust with that credential. With no settings override, nested sessions use the selected session account; this option adds no nested-session usage accounting. Poller-side Claude output logs, returned output/errors, typing status and fallback Slack replies redact the actual injected Claude token and alias values, plus assignments to either token variable name, whether or not opt-in is enabled. This does not prevent agents from using credentials or sending them directly through their own tools.
+**Security trade-off:** by default, the agent and its subprocesses can read and use the token, bypassing Claude CLI's credential filtering. Opt out for agents you do not trust with that credential. With no settings override, nested sessions use the selected session account; this option adds no nested-session usage accounting. Poller-side Claude output logs, returned output/errors, typing status and fallback Slack replies redact the actual injected Claude token and alias values, plus assignments to either token variable name, whether exposure is enabled or explicitly disabled. This does not prevent agents from using credentials or sending them directly through their own tools.
 
 ## How It Works
 

package/dist/claude-rate-limit.d.ts

@@ -9,7 +9,7 @@ export interface ClaudeRateLimitWindow {
 export interface ClaudeRateLimitInfo extends ClaudeRateLimitWindow {
     status?: string;
     rateLimitType?: string;
-    unifiedWindows?: Partial<Record<ClaudeQuotaWindow, ClaudeRateLimitWindow>>;
+    unifiedWindows?: Partial<Record<string, ClaudeRateLimitWindow>>;
     overageStatus?: string;
     overageDisabledReason?: string;
     isUsingOverage?: boolean;

package/dist/claude-rate-limit.js

@@ -32,7 +32,9 @@ export function parseClaudeRateLimitInfo(value) {
     const windows = record(obj['unifiedWindows']);
     if (windows) {
         const parsed = {};
-        for (const key of ['five_hour', 'seven_day']) {
+        for (const key of Object.keys(windows).slice(0, 128)) {
+            if (key.length > 128 || !/^(five_hour|seven_day)(?:_[a-z_]+)?$/.test(key))
+                continue;
             const data = record(windows[key]);
             if (data)
                 parsed[key] = windowInfo(data);

package/dist/claude-spawner.js

@@ -460,7 +460,7 @@ export function sweepProcessGroup(proc, graceMs, options = {}) {
  * would look like if left uncapped.
  */
 export function buildSpawnEnv(params) {
-    const exposeToken = /^(1|true|yes|on)$/i.test(params.processEnv['EXPOSE_CLAUDE_TOKEN_TO_AGENT'] ?? '');
+    const exposeToken = !/^(0|false|no|off)$/i.test(params.processEnv['EXPOSE_CLAUDE_TOKEN_TO_AGENT'] ?? '');
     const accountToken = params.subscriptionAccount?.credential.unwrap();
     const sessionToken = accountToken ?? params.processEnv['CLAUDE_CODE_OAUTH_TOKEN'];
     return {
@@ -513,7 +513,7 @@ export function buildSpawnEnv(params) {
         // watched after the session (and worktree) is gone. See tv#265.
         POLLER_BRAIN_PATH: params.brainPath,
         // Claude strips its own token name from Bash subprocesses. This alias
-        // deliberately opts out of that protection, only at the poller level.
+        // exposes the session token by default; the poller can explicitly opt out.
         // Explicit undefined values also clear inherited/overlay aliases.
         TEAMVIBE_CLAUDE_OAUTH_TOKEN: exposeToken ? sessionToken || undefined : undefined,
         TEAMVIBE_POOL_ACCOUNT_ID: exposeToken ? params.subscriptionAccount?.accountId : undefined,
@@ -1588,7 +1588,9 @@ export async function spawnPoolClaudeCode(msg, sessionLog, selectedDirectory, se
             // fallback must report the fresh attempt's delivery flags independently.
             if (!runtime?.resumePending)
                 sawSendMessageCall = false;
-            const result = await runClaudeCode(msg, sessionLog, effectiveCwd, directory, id, runtime?.resumePending ? false : first, lastMessageTs, onMessageSent, typingIndicator, runtime);
+            const spawned = await runClaudeCode(msg, sessionLog, effectiveCwd, directory, id, runtime?.resumePending ? false : first, lastMessageTs, onMessageSent, typingIndicator, runtime);
+            const result = prepared?.account && spawned.rateLimitInfo?.status === 'rejected'
+                ? { ...spawned, success: false } : spawned;
             sawSendMessageCall ||= result.sawSendMessageCall === true;
             if (prepared?.account) {
                 if (poolAttempts.length >= 1000)
@@ -1622,7 +1624,7 @@ export async function spawnPoolClaudeCode(msg, sessionLog, selectedDirectory, se
                     retainWorktree = false;
                     return result;
                 }
-                if (result.quota && !result.killedByPoller) {
+                if ((result.quota || result.rateLimitInfo?.status === 'rejected') && !result.killedByPoller) {
                     runtime.resumePending = true;
                     retainWorktree = true;
                 }
@@ -1645,7 +1647,7 @@ export async function spawnPoolClaudeCode(msg, sessionLog, selectedDirectory, se
         let switched = false;
         const finishQuota = async (initial) => {
             let result = initial;
-            while (prepared?.account && result.quota && !result.killedByPoller && poolRuntime && runtime) {
+            while (prepared?.account && (result.quota || result.rateLimitInfo?.status === 'rejected') && !result.killedByPoller && poolRuntime && runtime) {
                 attemptedAccounts.add(prepared.account.accountId);
                 if (poolRuntime.shouldStop() || attemptedAccounts.size >= 1000)
                     throw new PoolDeferredError();
@@ -1653,7 +1655,8 @@ export async function spawnPoolClaudeCode(msg, sessionLog, selectedDirectory, se
                 logPoolFetch(sessionLog, prepared.pool);
                 if (prepared.pool.kind === 'ready')
                     await emitCandidateUsage(msg, prepared.pool.accounts, prepared.store);
-                // Reactive evidence was persisted by attempt() before choosing another account.
+                // Quota and passive rejection evidence were persisted before selection.
+                // The chain also excludes attempted accounts even if a concurrent observation replaces that evidence.
                 if (prepared.pool.kind === 'ready')
                     for (const account of prepared.pool.accounts) {
                         if (attemptedAccounts.has(account.accountId))

package/dist/pool-telemetry.d.ts

@@ -3,7 +3,7 @@ import { type StoredAccountUsage, type SubscriptionUsageStore } from './subscrip
 import type { PoolAttempt } from './subscription-runtime.js';
 import type { SessionMetrics, TeamVibeQueueMessage } from './types.js';
 /** Explicit transport DTO: never serialize a pool account/credential envelope. */
-export declare function accountUsageTelemetry(account: SubscriptionAccount, state: StoredAccountUsage): {
+export declare function accountUsageTelemetry(account: SubscriptionAccount, state: StoredAccountUsage, reportedAt?: number): {
     reactive: {
         observedAt: number;
         window: import("./claude-rate-limit.js").ClaudeQuotaWindow | undefined;
@@ -31,10 +31,11 @@ export declare function poolRunTelemetry(attempts: readonly PoolAttempt[], quota
         score?: number | undefined;
         reason?: "headroom_per_hour" | undefined;
         rateWindow?: {
-            window: "five_hour" | "seven_day";
             scope: "opus" | "haiku" | "global" | "sonnet" | "fable" | "uncertain";
             percent: number | undefined;
             resetAt: number | undefined;
+            kind?: "seven_day_overage_included" | "legacy-uncertain-seven-day" | undefined;
+            window: "five_hour" | "seven_day";
         } | undefined;
         accountId: string;
         accountLabel: string;
@@ -48,10 +49,11 @@ export declare function poolRunTelemetry(attempts: readonly PoolAttempt[], quota
     score?: number | undefined;
     reason?: "headroom_per_hour" | undefined;
     rateWindow?: {
-        window: "five_hour" | "seven_day";
         scope: "opus" | "haiku" | "global" | "sonnet" | "fable" | "uncertain";
         percent: number | undefined;
         resetAt: number | undefined;
+        kind?: "seven_day_overage_included" | "legacy-uncertain-seven-day" | undefined;
+        window: "five_hour" | "seven_day";
     } | undefined;
     accountId?: string | undefined;
     accountLabel?: string | undefined;

package/dist/pool-telemetry.js

@@ -1,6 +1,6 @@
 import { emitEvent } from './event-queue.js';
-import { normalizePassiveUsage, reactiveEligibleAt, } from './subscription-selection.js';
-import { safeQuota, safeRateLimitInfo, } from './subscription-usage-store.js';
+import { reactiveEligibleAt } from './subscription-selection.js';
+import { usageStateForSelection, safeQuota, safeRateLimitInfo, } from './subscription-usage-store.js';
 function safeText(value) {
     return value && value.length <= 128 && !/sk-ant-|Bearer\s|[\r\n]/i.test(value)
         ? value
@@ -30,18 +30,12 @@ function safeMetrics(metrics) {
     return result;
 }
 /** Explicit transport DTO: never serialize a pool account/credential envelope. */
-export function accountUsageTelemetry(account, state) {
-    const passive = state.passive
-        ? normalizePassiveUsage(state.passive.rateLimitInfo, state.passive.observedAt)
-        : undefined;
-    const probe = state.probe?.usage;
-    const usage = passive && (!probe || passive.observedAt >= probe.observedAt)
-        ? passive
-        : probe;
+export function accountUsageTelemetry(account, state, reportedAt = Date.now()) {
+    const { usage } = usageStateForSelection(state, reportedAt);
     return {
         accountId: account.accountId,
         accountLabel: account.label ?? account.accountId,
-        reportedAt: Date.now(),
+        reportedAt,
         ...(usage ? { usage } : {}),
         ...(state.probe
             ? {
@@ -92,6 +86,7 @@ export function poolRunTelemetry(attempts, quotaDeferEpisodes = 0) {
                 reason: a.reason,
                 rateWindow: {
                     window: a.rateWindow.window,
+                    ...(a.rateWindow.kind ? { kind: a.rateWindow.kind } : {}),
                     scope: a.rateWindow.scope,
                     percent: a.rateWindow.percent,
                     resetAt: a.rateWindow.resetAt,

package/dist/redact-text.d.ts

@@ -0,0 +1,2 @@
+/** Redact credentials in diagnostics without initializing poller authentication. */
+export declare function redactStartupText(text: string, configuredTokens?: readonly string[]): string;

package/dist/redact-text.js

@@ -0,0 +1,15 @@
+/** Redact credentials in diagnostics without initializing poller authentication. */
+export function redactStartupText(text, configuredTokens = []) {
+    let safe = text
+        .replace(/https?:\/\/[^\s/@]+@/gi, 'https://[REDACTED]@')
+        .replace(/\b(?:Authorization\s*:\s*)?Bearer\s+[^\s,;]+/gi, 'Bearer [REDACTED]')
+        .replace(/\bx-access-token\s*:\s*[^\s/@,;]+/gi, 'x-access-token:[REDACTED]')
+        // Cover both Claude's token name and the opt-in subprocess alias in
+        // shell assignments and JSON env diagnostics, even without a token list.
+        .replace(/(\b(?:CLAUDE_CODE_OAUTH_TOKEN|TEAMVIBE_CLAUDE_OAUTH_TOKEN)["']?\s*[:=]\s*)(?:"(?:\\.|[^"\\])*"|'[^']*'|[^\s,;]+)/gi, '$1[REDACTED]');
+    for (const token of configuredTokens) {
+        if (token)
+            safe = safe.split(token).join('[REDACTED]');
+    }
+    return safe;
+}

package/dist/startup-auth.d.ts

@@ -7,7 +7,7 @@ export declare class UnknownStartupFailureError extends Error {
     constructor(attempts: number);
 }
 /** The only formatter used for startup retry and terminal failure logs. */
-export declare function redactStartupText(text: string, configuredTokens?: readonly string[]): string;
+export { redactStartupText } from './redact-text.js';
 export declare function startupFailureDetail(error: unknown, operation: string, configuredTokens?: readonly string[]): string;
 export declare function isPermanentStartupFailure(error: unknown): boolean;
 /** Returns false when shutdown cancels startup. Permanent errors propagate to the caller. */

package/dist/startup-auth.js

@@ -1,3 +1,4 @@
+import { redactStartupText } from './redact-text.js';
 import { AuthHttpError, StartupConfigurationError } from './auth-provider.js';
 export class UnknownStartupFailureError extends Error {
     attempts;
@@ -34,20 +35,7 @@ function isTransient(error) {
     return false;
 }
 /** The only formatter used for startup retry and terminal failure logs. */
-export function redactStartupText(text, configuredTokens = []) {
-    let safe = text
-        .replace(/https?:\/\/[^\s/@]+@/gi, 'https://[REDACTED]@')
-        .replace(/\b(?:Authorization\s*:\s*)?Bearer\s+[^\s,;]+/gi, 'Bearer [REDACTED]')
-        .replace(/\bx-access-token\s*:\s*[^\s/@,;]+/gi, 'x-access-token:[REDACTED]')
-        // Cover both Claude's token name and the opt-in subprocess alias in
-        // shell assignments and JSON env diagnostics, even without a token list.
-        .replace(/(\b(?:CLAUDE_CODE_OAUTH_TOKEN|TEAMVIBE_CLAUDE_OAUTH_TOKEN)["']?\s*[:=]\s*)(?:"(?:\\.|[^"\\])*"|'[^']*'|[^\s,;]+)/gi, '$1[REDACTED]');
-    for (const token of configuredTokens) {
-        if (token)
-            safe = safe.split(token).join('[REDACTED]');
-    }
-    return safe;
-}
+export { redactStartupText } from './redact-text.js';
 export function startupFailureDetail(error, operation, configuredTokens = []) {
     let detail;
     if (error instanceof AuthHttpError)

package/dist/subscription-runtime.d.ts

@@ -71,5 +71,5 @@ export declare function preparePool(msg: TeamVibeQueueMessage, resolved: Resolve
 }>;
 export declare function accountPin(account: SubscriptionAccount, resolved: ResolvedPoolModel): SubscriptionPin;
 export declare function validateAccount(account: SubscriptionAccount, resolved: ResolvedPoolModel): Promise<void>;
-/** A snapshot TTL/recheck is not a provider reset. Report a reset only when reactive evidence establishes it. */
+/** A snapshot TTL/recheck is not a provider reset. Explicit rejections also establish resets. */
 export declare function poolDeferredError(pool: PoolFetchResult<SubscriptionAccount>, resolved: ResolvedPoolModel, store: SubscriptionUsageStore, eligibleAt?: number, log?: PoolInfoLogger): Promise<PoolDeferredError>;

package/dist/subscription-runtime.js

@@ -6,7 +6,7 @@ import { getPollerId } from './auth-provider.js';
 import { fetchSubscriptionPool } from './subscription-pool-client.js';
 import { selectPoolForResolvedModel } from './subscription-pool.js';
 import { FileSubscriptionUsageStore, usageStateForSelection } from './subscription-usage-store.js';
-import { PASSIVE_USAGE_TTL_MS, PROBE_USAGE_TTL_MS, reactiveEligibleAt, USAGE_THRESHOLD_PERCENT, POOL_RECHECK_MS } from './subscription-selection.js';
+import { normalizePassiveUsage, selectSubscriptionAccount, PASSIVE_USAGE_TTL_MS, PROBE_USAGE_TTL_MS, reactiveEligibleAt, USAGE_THRESHOLD_PERCENT, POOL_RECHECK_MS } from './subscription-selection.js';
 export class PoolDeferredError extends Error {
     eligibleAt;
     resetAt;
@@ -64,7 +64,7 @@ export async function validateAccount(account, resolved) {
         throw new PoolDeferredError(selected.kind === 'deferred' ? selected.eligibleAt : undefined);
 }
 /** Message-only evidence; never changes selection, eligibility or durable pause state. */
-async function poolUsageNotice(pool, store) {
+async function poolUsageNotice(pool, resolved, store) {
     if (pool.kind !== 'ready')
         return {};
     const now = Date.now();
@@ -75,7 +75,12 @@ async function poolUsageNotice(pool, store) {
             const ttl = usage?.source === 'passive' ? PASSIVE_USAGE_TTL_MS : PROBE_USAGE_TTL_MS;
             const windows = usage && usage.observedAt <= now && now < usage.observedAt + ttl
                 ? usage.windows.filter(w => w.resetAt === undefined || w.resetAt > now) : [];
-            const rejected = state.reactive?.some(r => r.observedAt <= now && reactiveEligibleAt(r) > now) ?? false;
+            const rejection = selectSubscriptionAccount({
+                pool: { kind: 'ready', accounts: [account] },
+                states: { [account.accountId]: { usage: usage ? { ...usage, windows: usage.windows.filter(w => w.status === 'rejected') } : undefined } },
+                model: resolved.model, now,
+            });
+            const rejected = rejection.kind === 'deferred' || (state.reactive?.some(r => r.observedAt <= now && reactiveEligibleAt(r) > now) ?? false);
             const blockers = windows.filter(w => w.percent !== undefined && w.percent >= (account.useFullQuota ? 100 : USAGE_THRESHOLD_PERCENT));
             const resets = blockers.map(w => w.resetAt);
             return {
@@ -94,9 +99,9 @@ async function poolUsageNotice(pool, store) {
         return {};
     }
 }
-/** A snapshot TTL/recheck is not a provider reset. Report a reset only when reactive evidence establishes it. */
+/** A snapshot TTL/recheck is not a provider reset. Explicit rejections also establish resets. */
 export async function poolDeferredError(pool, resolved, store, eligibleAt, log) {
-    const notice = await poolUsageNotice(pool, store);
+    const notice = await poolUsageNotice(pool, resolved, store);
     let usageDeferred = eligibleAt !== undefined;
     const deferredError = (resetAt) => {
         const error = new PoolDeferredError(eligibleAt, resetAt);
@@ -115,6 +120,9 @@ export async function poolDeferredError(pool, resolved, store, eligibleAt, log)
                 if (selected.kind !== 'deferred' || selected.eligibleAt !== eligibleAt)
                     continue;
                 const state = await store.read(account);
+                const usage = state.passive ? normalizePassiveUsage(state.passive.rateLimitInfo, state.passive.observedAt) : undefined;
+                if (usage?.windows.some(w => w.status === 'rejected' && w.resetAt === eligibleAt))
+                    return deferredError(new Date(eligibleAt).toISOString());
                 const live = state.reactive.filter(r => !r.quota.resetAt || Date.parse(r.quota.resetAt) > Date.now());
                 if (live.length && live.every(r => r.quota.resetAt && Number.isFinite(Date.parse(r.quota.resetAt))) && live.some(r => Date.parse(r.quota.resetAt) === eligibleAt))
                     return deferredError(new Date(eligibleAt).toISOString());

package/dist/subscription-selection.d.ts

@@ -5,6 +5,8 @@ export declare const USAGE_THRESHOLD_PERCENT = 90;
 export declare const PASSIVE_USAGE_TTL_MS: number;
 export declare const PROBE_USAGE_TTL_MS = 60000;
 export declare const POOL_RECHECK_MS: number;
+/** Safety hold from the rejection observation when the provider gives no reset. */
+export declare const REJECTED_BLOCK_MS: number;
 export interface AccountIdentity {
     workspaceId: string;
     accountId: string;
@@ -33,7 +35,12 @@ export type PoolFetchResult<A extends AccountIdentity = AccountIdentity> = {
 export interface UsageWindow {
     window: 'five_hour' | 'seven_day';
     scope: 'global' | 'sonnet' | 'opus' | 'haiku' | 'fable' | 'uncertain';
+    /** CLI kind, or the server compatibility provenance for a legacy Fable allowance. */
+    kind?: 'seven_day_overage_included' | 'legacy-uncertain-seven-day';
     status?: 'allowed' | 'allowed_warning' | 'rejected';
+    /** Retained rejections keep their own clock when merged into newer measurements. */
+    observedAt?: number;
+    source?: 'passive' | 'probe';
     percent?: number;
     resetAt?: number;
 }
@@ -42,6 +49,8 @@ export interface UsageObservation {
     observedAt: number;
     windows: readonly UsageWindow[];
 }
+/** Latest measurements plus durable rejections; omission or success never clears a hold. */
+export declare function mergeUsageObservations(observations: readonly (UsageObservation | undefined)[], now: number): UsageObservation | undefined;
 export interface ReactiveExhaustion {
     observedAt: number;
     quota: ClaudeQuotaFailure;

package/dist/subscription-selection.js

@@ -3,6 +3,40 @@ export const USAGE_THRESHOLD_PERCENT = 90;
 export const PASSIVE_USAGE_TTL_MS = 5 * 60_000;
 export const PROBE_USAGE_TTL_MS = 60_000;
 export const POOL_RECHECK_MS = 15 * 60_000;
+/** Safety hold from the rejection observation when the provider gives no reset. */
+export const REJECTED_BLOCK_MS = 15 * 60_000;
+/** Latest measurements plus durable rejections; omission or success never clears a hold. */
+export function mergeUsageObservations(observations, now) {
+    let latest;
+    const rejected = new Map();
+    for (const usage of observations) {
+        if (!usage || usage.observedAt > now)
+            continue;
+        if (!latest || usage.observedAt >= latest.observedAt)
+            latest = usage;
+        for (const w of usage.windows) {
+            const observedAt = w.observedAt ?? usage.observedAt;
+            if (w.status !== 'rejected' || observedAt > now)
+                continue;
+            const key = `${w.window}:${w.scope}`;
+            const previous = rejected.get(key);
+            if (!previous || observedAt >= previous.observedAt)
+                rejected.set(key, { ...w, observedAt, source: w.source ?? usage.source });
+        }
+    }
+    if (!latest)
+        return undefined;
+    const active = [...rejected.values()].filter(w => now < (w.resetAt ?? w.observedAt + REJECTED_BLOCK_MS));
+    return {
+        ...latest,
+        windows: [
+            ...latest.windows.filter(w => w.status !== 'rejected' &&
+                (w.observedAt ?? latest.observedAt) === latest.observedAt &&
+                (w.source ?? latest.source) === latest.source).slice(0, 133 - active.length),
+            ...active,
+        ],
+    };
+}
 export function record(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
@@ -22,29 +56,24 @@ function date(value) {
     const ms = Date.parse(value);
     return Number.isFinite(ms) && ms > 0 ? ms : undefined;
 }
+/** Undocumented CLI stream kinds: only explicit model names and the measured Fable alias. */
+function passiveWindowKind(kind) {
+    if (kind === 'seven_day_overage_included')
+        return { window: 'seven_day', scope: 'fable', kind };
+    const legacy = kind.match(/^(five_hour|seven_day)(?:_(sonnet|opus|haiku|fable))?$/);
+    return {
+        window: legacy?.[1] === 'five_hour' ? 'five_hour' : 'seven_day',
+        scope: legacy ? (legacy[2] ?? 'global') : 'uncertain',
+    };
+}
 export function normalizePassiveUsage(value, observedAt) {
     const info = record(value);
     const windows = [];
-    const unified = record(info['unifiedWindows']);
-    for (const window of ['five_hour', 'seven_day']) {
-        const raw = unified[window];
-        if (raw == null)
-            continue;
-        const item = record(raw);
-        windows.push({ window, scope: 'global', percent: percent(item['utilization'], 1), resetAt: epoch(item['resetsAt']) });
-    }
-    const type = info['rateLimitType'];
-    if (typeof type === 'string') {
-        const legacy = type.match(/^(five_hour|seven_day)(?:_(sonnet|opus|haiku|fable))?$/);
-        const candidate = {
-            window: legacy?.[1] === 'five_hour' ? 'five_hour' : 'seven_day',
-            scope: legacy ? (legacy[2] ?? 'global') : 'uncertain',
-            percent: percent(info['utilization'], 1), resetAt: epoch(info['resetsAt']),
-            ...(info['status'] === 'allowed' || info['status'] === 'allowed_warning' || info['status'] === 'rejected'
-                ? { status: info['status'] } : {}),
-        };
+    const add = (candidate) => {
         const existing = windows.find(w => w.window === candidate.window && w.scope === candidate.scope);
         if (existing) {
+            if (candidate.kind !== undefined)
+                existing.kind = candidate.kind;
             if (candidate.status !== undefined)
                 existing.status = candidate.status;
             // Collapse the same quota while retaining conservative conflict evidence.
@@ -56,6 +85,21 @@ export function normalizePassiveUsage(value, observedAt) {
         else {
             windows.push(candidate);
         }
+    };
+    for (const [kind, raw] of Object.entries(record(info['unifiedWindows'])).slice(0, 128)) {
+        if (raw == null)
+            continue;
+        const item = record(raw);
+        add({ ...passiveWindowKind(kind), percent: percent(item['utilization'], 1), resetAt: epoch(item['resetsAt']) });
+    }
+    const type = info['rateLimitType'];
+    if (typeof type === 'string') {
+        add({
+            ...passiveWindowKind(type),
+            percent: percent(info['utilization'], 1), resetAt: epoch(info['resetsAt']),
+            ...(info['status'] === 'allowed' || info['status'] === 'allowed_warning' || info['status'] === 'rejected'
+                ? { status: info['status'] } : {}),
+        });
     }
     return { source: 'passive', observedAt, windows };
 }
@@ -143,9 +187,22 @@ export function selectSubscriptionAccount(input) {
                 blockers.push(until);
         }
         const usage = state?.usage;
+        // A provider rejection outlives snapshot freshness. Never score it as headroom.
+        if (usage && usage.observedAt <= input.now) {
+            for (const w of usage.windows) {
+                if (w.status !== 'rejected' || !applicable(w.scope, input.model))
+                    continue;
+                const observedAt = w.observedAt ?? usage.observedAt;
+                if (observedAt > input.now)
+                    continue;
+                const until = w.resetAt ?? observedAt + REJECTED_BLOCK_MS;
+                if (input.now < until)
+                    blockers.push(until);
+            }
+        }
         const expiry = usage ? usage.observedAt + (usage.source === 'passive' ? PASSIVE_USAGE_TTL_MS : PROBE_USAGE_TTL_MS) : 0;
         const fresh = usage && usage.observedAt <= input.now && input.now < expiry;
-        const windows = fresh ? usage.windows.filter(w => applicable(w.scope, input.model) && (w.resetAt === undefined || w.resetAt > input.now)) : [];
+        const windows = fresh ? usage.windows.filter(w => w.status !== 'rejected' && (w.observedAt ?? usage.observedAt) === usage.observedAt && (w.source ?? usage.source) === usage.source && applicable(w.scope, input.model) && (w.resetAt === undefined || w.resetAt > input.now)) : [];
         const uncertain = windows.some(w => w.scope === 'uncertain' || (w.scope !== 'global' && !family(input.model)));
         for (const w of windows) {
             if (w.percent !== undefined && w.percent >= (account.useFullQuota ? 100 : USAGE_THRESHOLD_PERCENT))

package/dist/subscription-usage-store.d.ts

@@ -9,6 +9,8 @@ export interface ProbeObservation {
     usage?: UsageObservation;
 }
 export interface StoredAccountUsage {
+    /** Latest measured snapshot plus active rejected windows, persisted across observations. */
+    usage?: UsageObservation;
     passive?: {
         rateLimitInfo: ClaudeRateLimitInfo;
         observedAt: number;

package/dist/subscription-usage-store.js

@@ -1,13 +1,18 @@
+import { redactStartupText } from './redact-text.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import { parseClaudeRateLimitInfo } from './claude-rate-limit.js';
-import { normalizePassiveUsage, record, reactiveEligibleAt, PASSIVE_USAGE_TTL_MS } from './subscription-selection.js';
+import { normalizePassiveUsage, mergeUsageObservations, record, reactiveEligibleAt } from './subscription-selection.js';
 export function usageStateForSelection(state, now) {
-    const passive = state.passive ? normalizePassiveUsage(state.passive.rateLimitInfo, state.passive.observedAt) : undefined;
-    // Passive is primary while fresh; a completed optional probe may supplement a stale/missing snapshot.
-    const fresh = passive && passive.observedAt <= now && now < passive.observedAt + PASSIVE_USAGE_TTL_MS;
-    return { usage: fresh ? passive : state.probe?.status === 'ok' ? state.probe.usage : passive, reactive: state.reactive };
+    return {
+        usage: mergeUsageObservations([
+            state.usage,
+            state.passive ? normalizePassiveUsage(state.passive.rateLimitInfo, state.passive.observedAt) : undefined,
+            state.probe?.status === 'ok' ? state.probe.usage : undefined,
+        ], now),
+        reactive: state.reactive,
+    };
 }
 export class SubscriptionUsageStoreError extends Error {
     constructor() { super('Subscription usage store unavailable'); this.name = 'SubscriptionUsageStoreError'; }
@@ -30,12 +35,20 @@ function validTime(now) {
     if (typeof now !== 'number' || !Number.isFinite(now) || now <= 0 || now > 253402300799000)
         throw new SubscriptionUsageStoreError();
 }
+const loggedUnknownRateLimitKinds = new Set();
+const knownRateLimitKind = /^(?:(five_hour|seven_day)(?:_(sonnet|opus|haiku|fable))?|seven_day_overage_included)$/;
 export function safeRateLimitInfo(info) {
     const parsed = parseClaudeRateLimitInfo(info) ?? {};
     // Never persist arbitrary status strings or incidental stream fields.
     if (parsed.status !== 'allowed' && parsed.status !== 'allowed_warning' && parsed.status !== 'rejected')
         delete parsed.status;
-    if (parsed.rateLimitType && !/^(five_hour|seven_day)(?:_(sonnet|opus|haiku|fable))?$/.test(parsed.rateLimitType))
+    for (const kind of [parsed.rateLimitType, ...Object.keys(parsed.unifiedWindows ?? {})]) {
+        if (!kind || kind === 'uncertain' || knownRateLimitKind.test(kind) || !/^[a-z_]{1,128}$/.test(kind) || loggedUnknownRateLimitKinds.has(kind))
+            continue;
+        loggedUnknownRateLimitKinds.add(kind);
+        console.warn(redactStartupText(`[Pool] unknown rate limit kind=${kind}`));
+    }
+    if (parsed.rateLimitType && !knownRateLimitKind.test(parsed.rateLimitType))
         parsed.rateLimitType = 'uncertain';
     delete parsed.overageStatus;
     delete parsed.overageDisabledReason;
@@ -51,6 +64,28 @@ export function safeQuota(quota) {
         ...(Number.isFinite(reset) && reset > 0 ? { resetAt: new Date(reset).toISOString() } : {}),
     };
 }
+function safeUsage(value, source) {
+    const usage = record(value);
+    if (typeof usage['observedAt'] !== 'number' || !Array.isArray(usage['windows']))
+        throw new SubscriptionUsageStoreError();
+    validTime(usage['observedAt']);
+    const windows = usage['windows'].slice(0, 133).map(raw => {
+        const w = record(raw);
+        const window = w['window'] === 'five_hour' ? 'five_hour' : 'seven_day';
+        const scope = typeof w['scope'] === 'string' && ['global', 'sonnet', 'opus', 'haiku', 'fable'].includes(w['scope']) ? w['scope'] : 'uncertain';
+        const percent = typeof w['percent'] === 'number' && Number.isFinite(w['percent']) && w['percent'] >= 0 && w['percent'] <= 100 ? w['percent'] : undefined;
+        const resetAt = typeof w['resetAt'] === 'number' && Number.isFinite(w['resetAt']) && w['resetAt'] > 0 && w['resetAt'] <= 253402300799000 ? w['resetAt'] : undefined;
+        const status = w['status'] === 'allowed' || w['status'] === 'allowed_warning' || w['status'] === 'rejected' ? w['status'] : undefined;
+        const observedAt = typeof w['observedAt'] === 'number' ? w['observedAt'] : undefined;
+        if (observedAt !== undefined)
+            validTime(observedAt);
+        const source = w['source'] === 'passive' || w['source'] === 'probe' ? w['source'] : undefined;
+        return { window, scope, ...(w['kind'] === 'seven_day_overage_included' ? { kind: w['kind'] } : {}), percent, resetAt, ...(status ? { status } : {}), ...(observedAt ? { observedAt } : {}), ...(source ? { source } : {}) };
+    });
+    if (usage['windows'].length > 133)
+        windows.push({ window: 'seven_day', scope: 'uncertain' });
+    return { source, observedAt: usage['observedAt'], windows };
+}
 function safeProbe(value) {
     const obj = record(value);
     const status = obj['status'];
@@ -62,21 +97,7 @@ function safeProbe(value) {
     validTime(observedAt);
     const result = { status: status, observedAt };
     if (status === 'ok' && obj['usage']) {
-        const usage = record(obj['usage']);
-        if (typeof usage['observedAt'] !== 'number' || !Array.isArray(usage['windows']))
-            throw new SubscriptionUsageStoreError();
-        validTime(usage['observedAt']);
-        const windows = usage['windows'].slice(0, 133).map(raw => {
-            const w = record(raw);
-            const window = w['window'] === 'five_hour' ? 'five_hour' : 'seven_day';
-            const scope = typeof w['scope'] === 'string' && ['global', 'sonnet', 'opus', 'haiku', 'fable'].includes(w['scope']) ? w['scope'] : 'uncertain';
-            const percent = typeof w['percent'] === 'number' && Number.isFinite(w['percent']) && w['percent'] >= 0 && w['percent'] <= 100 ? w['percent'] : undefined;
-            const resetAt = typeof w['resetAt'] === 'number' && Number.isFinite(w['resetAt']) && w['resetAt'] > 0 && w['resetAt'] <= 253402300799000 ? w['resetAt'] : undefined;
-            return { window, scope, percent, resetAt };
-        });
-        if (usage['windows'].length > 133)
-            windows.push({ window: 'seven_day', scope: 'uncertain' });
-        result.usage = { source: 'probe', observedAt: usage['observedAt'], windows };
+        result.usage = safeUsage(obj['usage'], 'probe');
     }
     return result;
 }
@@ -88,6 +109,9 @@ function safeVersion(value) {
     }
     if (value.probe)
         state.probe = safeProbe(value.probe);
+    if (value.usage) {
+        state.usage = safeUsage(value.usage, value.usage.source === 'passive' ? 'passive' : 'probe');
+    }
     return state;
 }
 function safeReactive(value) {
@@ -158,7 +182,9 @@ export class FileSubscriptionUsageStore {
             const state = safeVersion(await this.#load(path, {}));
             if (state.passive && state.passive.observedAt > observedAt && !options?.expireFutureObservations)
                 return;
+            const previous = usageStateForSelection({ ...state, reactive: [] }, observedAt).usage;
             state.passive = { rateLimitInfo: safeRateLimitInfo(rateLimitInfo), observedAt };
+            state.usage = mergeUsageObservations([previous, normalizePassiveUsage(state.passive.rateLimitInfo, observedAt)], observedAt);
             await this.#save(path, state);
         });
     }
@@ -216,7 +242,11 @@ export class FileSubscriptionUsageStore {
         const path = this.#path(key, true);
         await serial(path, async () => {
             const state = safeVersion(await this.#load(path, {}));
+            // Network completion order must not discard a newer stored snapshot.
+            const mergeAt = Math.max(observation.observedAt, state.usage?.observedAt ?? 0, state.passive?.observedAt ?? 0);
+            const previous = usageStateForSelection({ ...state, reactive: [] }, mergeAt).usage;
             state.probe = safeProbe(observation);
+            state.usage = mergeUsageObservations([previous, state.probe.usage], mergeAt);
             await this.#save(path, state);
         });
     }

package/dist/usage-probe-job.js

@@ -3,7 +3,7 @@ import { mkdtemp, rm, mkdir } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { normalizePassiveUsage } from './subscription-selection.js';
-import { safeRateLimitInfo, } from './subscription-usage-store.js';
+import { safeRateLimitInfo, usageStateForSelection, } from './subscription-usage-store.js';
 import { parseClaudeRateLimitInfo, } from './claude-rate-limit.js';
 export function isUsageProbe(value) {
     return (!!value &&
@@ -176,7 +176,7 @@ export async function handleUsageProbe(job, options) {
             ...metadata,
             accountLabel: account.label ?? account.accountId,
             reportedAt: now,
-            usage,
+            usage: usageStateForSelection(await options.store.read(account), now).usage,
             lastRateLimitInfo: safe,
             probeStatus: 'ok',
             probeObservedAt: now,

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@teamvibe/poller",
-  "version": "0.8.4-rc.1",
+  "version": "0.8.4-rc.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@teamvibe/poller",
-      "version": "0.8.4-rc.1",
+      "version": "0.8.4-rc.3",
       "dependencies": {
         "@aws-sdk/client-dynamodb": "3.1108.0",
         "@aws-sdk/client-sqs": "3.1108.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teamvibe/poller",
-  "version": "0.8.4-rc.1",
+  "version": "0.8.4-rc.3",
   "type": "module",
   "main": "./dist/index.js",
   "bin": {