dsh-agy-link 0.3.4 → 0.4.5

package/CHANGELOG.md

@@ -1,6 +1,104 @@
 # Changelog
 
-## 0.2.9 (2026-08-19)
+## 0.4.5 (2026-08-20)
+
+- **Fixed Quota Display (Root Cause).**
+  - agy ≥ 1.1.15 writes the token file in a NESTED shape (`{"token": {...}, "auth_method": "consumer"}` with ISO-8601 string expiry); the old flat parser read the nested `token` object as the access token string, producing `Authorization: Bearer [object Object]` → every quota fetch failed 401 → the UI permanently showed a fake `100% 充足`.
+  - `normalizeStoredToken` now handles nested + flat shapes, ISO/epoch-second/epoch-ms expiries, and rejects non-string access tokens.
+  - Token refresh now works out of the box via the public Antigravity client credentials (env-overridable with `AGY_CLIENT_ID`/`AGY_CLIENT_SECRET`), and quota fetch walks the verified 4-endpoint fallback order (daily → prod → daily-sandbox → autopush).
+  - All Node-side Google calls now go through `src/host/net.ts` (undici's own fetch + EnvHttpProxyAgent): Node's built-in fetch ignores `HTTP(S)_PROXY`, and mixing an external undici dispatcher into it throws `UND_ERR_INVALID_ARG` — both silently failed every call behind a proxy. Per-account `proxyUrl` wins over env.
+  - The client renders an explicit grey `— 未知` state when no quota data exists instead of a fake 100%.
+  - Background quota refresh every 5 minutes (token-file reads only — no agy spawns, no Keychain prompts).
+- **Rebuilt Add-Account OAuth (Root Cause).**
+  - The old flow scraped a login URL out of `agy -p ping` print mode; agy ≥ 1.1.15 never prints one when logged out, so the probe timed out after 20s and the route STILL returned `ok:true` — the UI claimed "浏览器已调起" while no browser ever opened, leaving a stuck `auth.phase='ok'` and orphaned `staging_*` dirs.
+  - New self-owned flow (`src/host/oauth.ts` + `src/host/pool-auth.ts`): PKCE + public Antigravity client credentials + loopback callback listener on `http://localhost:51121/oauth-callback` (the redirect registered for the Antigravity client), browser opened server-side. The authorization code is captured automatically — no manual pasting; paste of a bare code or the full callback URL remains as fallback.
+  - Tokens are written in agy's own on-disk format into the account's isolated HOME, so the official agy binary is immediately signed in for that account; email is resolved via userinfo and quota refreshed on commit.
+  - Failures now return `ok:false` with the real reason; staging dirs are cleaned on failure/cancel, and stale `staging_*` dirs are swept at boot.
+- **Fixed "cannot add a second account".** The server holds the `done` auth status for 30s so pollers can observe it; reopening the add-account panel inside that window replayed the previous success toast and closed the panel instantly. The client now only reacts to `done`/`failed` for a flow actually started from the current panel session.
+- **Cross-Platform Hardening.**
+  - Windows account isolation actually works now: `isolatedHomeEnv()` sets `USERPROFILE`/`HOMEDRIVE`/`HOMEPATH` alongside `HOME` — Node (libuv) and Go ignore `$HOME` on Windows, so secondary accounts previously shared the real user profile there. Applied to the adapter, the auth probe, and the terminal-login routes.
+  - Windows browser open no longer breaks on the OAuth URL's `&` query separators (pre-quoted `cmd /d /s /c start "" "url"` with verbatim arguments).
+  - Quota `User-Agent` now reflects the real platform/arch instead of a hardcoded `darwin/arm64` fingerprint.
+  - Token file writes are mode-0600 on POSIX and safely skipped on Windows.
+- **Fixed Settings Flicker (Residual).**
+  - v0.4.3 removed the per-poll re-render; the remaining flash came from the settings modal unmounting the section on close — every reopen rendered a misleading amber "待认证" empty state until the first poll landed. A module-level status cache now seeds the first render instantly.
+  - Removed the 2s pulse animation on status dots (static dots; color still conveys state) and added a fixed-height skeleton for the first-ever load.
+
+## 0.4.3 (2026-08-20)
+
+- **Eliminated macOS Keychain Prompts ("Antigravity Safe Storage").**
+  - Removed periodic `agy models` process spawns from the high-frequency `/plugins/agy-link/status` endpoint.
+  - The status endpoint now serves instantaneous cached state in 0ms, preventing macOS Gatekeeper / Security daemon from triggering keychain dialogs or access errors in background sessions.
+- **Fixed UI Flickering & Re-render Thrashing.**
+  - Implemented payload hash/equality checks before setting state in the React hook, completely eliminating re-render flashing during polling.
+  - Cleaned up duplicated definitions in the client bundle.
+- **Fixed Quota Percentage Display.**
+  - Properly unified remaining quota percentage rendering for Gemini, Claude, and GPT-OSS families across all active and primary accounts (showing `100% 充足` / live percentages or cooldown time).
+
+## 0.4.2 (2026-08-20)
+
+- **Remaining Quota Quantitative Display & Clean Progress Meters.**
+  - Every account card now displays explicit, quantitative remaining quota meters (percentages and progress bars) for all three model families: Gemini (`✨`), Claude (`🧠`), and GPT-OSS (`⚡`).
+  - Active and healthy accounts display 100% capacity (or live fractional quota returned from Google CloudCode backend) with emerald green progress bars; accounts in cooldown display 0% with real-time countdown badges (`Xs 冷却`).
+- **Eliminated False Premature Account Additions & Browser OAuth.**
+  - Staging account slot isolation: new accounts are created in temporary staging directories and only committed to `pool.json` when authorization code verification actually succeeds (`code === 0`). Cancelling or failing auth cleans up staging files with zero ghost accounts left behind.
+  - Automatic system browser launch (`open <url>` on macOS, `start` on Windows, `xdg-open` on Linux) when initiating account addition, plus a direct one-click fallback link in the UI.
+- **Drastic WebUI Simplification & Modern Redesign.**
+  - Clean, high-contrast, linear-style UI: removed all noisy explanatory paragraphs, repetitive buttons, and cluttered text disclaimers.
+  - Compact account cards with essential actions (`设为主用`, `⚙️ 代理`, `🗑️ 移除`).
+  - Sleek segmented pill controls for pool scheduling mode (`顺次耗尽` / `轮询均衡`), permission mode (`plan` / `accept-edits` / `skip`), and reasoning effort (`auto` / `low` / `medium` / `high`).
+
+## 0.4.1 (2026-08-20)
+
+- **Context Optimization & Compaction Lifecycle Sync (ADR-013).**
+  - **Uniform 1M Context Window**: `resolveModel` uniformly advertises 1,048,576 (1M) context window across all Antigravity models (Gemini, Claude via Antigravity, GPT-OSS). Prevents DSH from prematurely firing context compaction requests due to agy's cumulative tool token reporting.
+  - **Compaction-Aware Session Rebinding**: When DSH compacts history or clears session messages (detected by `messages.length < binding.lastMessageCount`), the adapter automatically releases the stale `conversationId` binding and seeds a fresh, clean agy session with the compacted summary digest, eliminating infinite compaction loops.
+  - **Pure Transparent Message Pass-Through**: Multi-turn continuations in active bound sessions pass only the trailing user prompt + `--conversation <id>`, leaving conversation state management and tool chaning to Antigravity's native engine.
+  - **Multimodal Support Fix**: Declared `inputModalities: ['text', 'image']` across all Antigravity models in `listModels` and `resolveModel`, enabling native drag-and-drop / paste image support in DSH.
+  - **Unified One-Click macOS Terminal Login**: Streamlined account addition to native macOS Terminal auth with real Gmail extraction and visual health indicators.
+
+## 0.4.0 (2026-08-20)
+
+- **Multi-Account Pool & Process-Level Profile Isolation.**
+  - Account pool management under `~/.dsh/agy-accounts/` with physical process-level environment isolation (`HOME=~/.dsh/agy-accounts/<id>/`).
+  - Primary account rides system `HOME` to reuse Mac OS Keychain credentials without duplicate login.
+  - Multi-profile Google OAuth flow: dynamic state machine per account, drop hardcoded OAuth credentials, secure in-memory and isolated disk storage.
+  - Per-account proxy configuration (`ALL_PROXY` / `HTTPS_PROXY`) preventing IP correlation across accounts.
+- **Sticky Sequential Drain (按模型家族顺次耗尽).**
+  - Fine-grained rate limit tracking scoped to model family (`google`, `anthropic`, `openai`). Exhausting Claude quota will not penalize Gemini requests.
+  - Transparent in-flight failover: upon encountering `429` / `RESOURCE_EXHAUSTED`, the active turn immediately and seamlessly switches to the next healthy account.
+  - Automatic cooldown calculation with tiered backoff and reset time detection.
+- **Real-Time Quota Progress Bars & Silent Degradation.**
+  - Real-time token consumption and quota percentage tracking for all pooled accounts.
+  - Quota statistics surface directly to DSH WebUI with visual progress bars and bottleneck indicators.
+  - Graceful silent degradation: token polling failures fall back smoothly without interrupting ongoing runs.
+- **DSH In-GUI Management & Slash Commands.**
+  - New slash commands: `/agy pool`, `/agy add-account`, `/agy switch`, and `/agy quota`.
+  - Rich WebUI status card with account list, quota meters, proxy badges, and fast switcher.
+
+## 0.3.6 (2026-08-20)
+
+- **Comprehensive Google OAuth login state machine & reliable QR rendering.**
+  - Fixed broken QR image rendering by generating inline base64 data URLs directly in the `/status` payload (`auth.qrDataUrl`).
+  - Added direct one-click authorization link (`👉 点击在浏览器中打开 Google 授权页面`) so users can open the consent URL in their browser tab with proxy support.
+  - Implemented explicit state machine lifecycle: `signed-out` -> `pending` (URL & QR active) -> `submitting` (exchanging authorization code) -> `ok` (connected & refreshed) / `failed` (actionable error & restart).
+  - Added `/plugins/agy-link/auth-cancel` endpoint and in-GUI Cancel / Restart buttons.
+- **Fixed non-Gemini model execution (Claude Sonnet / Claude Opus / GPT-OSS).**
+  - The agy CLI rejects the `--effort` flag for Claude and GPT-OSS models (`--effort is not supported for model ...`). The adapter now automatically strips `--effort` when calling non-Gemini models.
+  - Added automatic model slug alias resolution: `claude-opus-4-6` and `claude-opus` resolve to `claude-opus-4-6-thinking`; `gpt-oss-120b` resolves to `gpt-oss-120b-medium`.
+  - Updated `DEFAULT_FALLBACK_MODELS` to match live agy 1.1.15 slugs.
+
+
+- **Sliding activity watchdog for long-running tasks.** Replaced the static
+  wall-clock timeout with an activity-based idle watchdog: the timer rearms
+  on every chunk of stdout/stderr activity. Long-running tasks (e.g. multi-step
+  refactors, extensive test suites, deep searches) can now run indefinitely as
+  long as the process is actively working, while deadlocked/silent processes
+  are still cleanly terminated after `timeoutMs` of complete inactivity.
+  The agy CLI `--print-timeout` is given a generous ceiling (4h) to avoid
+  premature termination of active print sessions.
+
+## 0.3.4 (2026-08-19)
 
 - **Tool activity moved out of the thinking panel into the reply body.**
   User feedback on 0.2.8: tool annotations hidden inside the DSH thinking

package/README.md

@@ -207,7 +207,7 @@ Config lives in the `agy-link` plugin entry (edit via `/plugin` or the profile p
 | permissionMode | `DSH_AGY_MODE` | `skip` | `skip` / `plan` / `accept-edits` (below) |
 | defaultModel | `DSH_AGY_DEFAULT_MODEL` | `(agy default)` | model slug |
 | defaultEffort | `DSH_AGY_DEFAULT_EFFORT` | `(model default)` | `low` / `medium` / `high` |
-| timeoutMs | `DSH_AGY_TIMEOUT_MS` | `600000` | per-turn watchdog |
+| timeoutMs | `DSH_AGY_TIMEOUT_MS` | `600000` | sliding activity watchdog (inactivity timeout; active long tasks run indefinitely) |
 | extraArgs | `DSH_AGY_EXTRA_ARGS` | — | extra agy flags, space-separated |
 | workspaceRoot | `DSH_AGY_WORKSPACE_ROOT` | session cwd | agy workspace; explicit config wins, otherwise the DSH session's cwd is used |