dsh-agy-link 0.4.15 → 0.4.18

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 0.4.18 (2026-08-25)
+
+- **Quota Fallback Never Clobbers Good Data (5h=100%/weekly-missing 根因).**
+  - **What happened**: `retrieveUserQuotaSummary` transiently failed (proxy blip) while `fetchAvailableModels` still answered; the per-model fallback then OVERWROTE the stored family entry with a single-window partial shape — weeklyFraction vanished and the 5h row received wrong-window numbers (observed 5h=100%, reset a week out, weekly `—`, while the live API actually reported 5h 84% / weekly 47%).
+  - **`mergeFallbackFamilyQuota`**: last-known-good complete family data now always wins over partial fallback; the fallback only fills families with no usable previous entry (first-ever refresh). Verified live: both endpoints answer correctly and a successful summary refresh fully restores the display.
+  - Added `scripts/diag-quota.mts` one-shot endpoint probe for future incidents.
+
+## 0.4.17 (2026-08-25)
+
+- **Ghost-Cooldown & Quota-Display Fix (额度显示 0% 根因).**
+  - **What happened**: the UI showed 5h quota as 0% while `agy` reported 98% — the parsed quota data was CORRECT all along, but (a) any active local cooldown forced the 5h bar to render 0%, and (b) the loose rate-limit classifier kept creating ghost cooldowns: it scanned the ENTIRE stdout (model prose mentioning "rate limit"/"quota", hash fragments containing "429") and matched bare keywords, so an unrelated tool/permission error froze a healthy account out of rotation with a 15-minute+ cooldown (captured real reason: `rate limit reached: declaring permissions: cortex tool write_to_file … invalid tool call error`).
+  - **Hard vs soft classification**: new `looksLikeHardRateLimit` (RESOURCE_EXHAUSTED / code·status·HTTP 429 / too many requests / individual quota reached / quota exceeded·reached·exhausted / rate limit exceeded·reached·hit) is the ONLY pattern allowed to put an account into cooldown; soft signals (model overloaded / high traffic) still shape the error message but never cool accounts.
+  - **Scan scope narrowed**: error classification reads stderr + the result envelope's error field only — stdout (event JSON + model prose) no longer participates.
+  - **Honest quota bars**: a local cooldown no longer overwrites the server-reported fraction with 0%; it now appends a `· 本地冷却中` note next to the reset time instead.
+  - Regression tests pin the exact incident text (cortex tool permission error) as a non-rate-limit fixture.
+
+## 0.4.16 (2026-08-24)
+
+- **External Re-Login Sync (换号自动/手动同步).**
+  - **Root cause fixed**: after `agy logout` + re-login as a DIFFERENT account, the pool slot kept the old account's email, cooldowns, quotas and `auth_required` quarantine — and poll gating (0.4.15) then skipped the flagged slot forever, freezing the UI on the stale account.
+  - **`resetAccountIdentity`**: detecting a changed email (from local CLI logs, zero network) now resets all identity-bound state (cooldowns / quotas / auth quarantine) while keeping slot config — the new account starts clean instead of inheriting the old one's restrictions.
+  - **Zero-network reconciliation before poll gating**: the background poller pre-checks flagged slots via local log scan, so an external re-login self-heals within one poll cycle (≤15 min) without any extra request to Google. Manual click is instant.
+  - **Auth self-heal on success**: a successful authenticated quota fetch clears a stale `auth_required` flag (the old token's invalid_grant no longer condemns the new login).
+  - **Manual refresh upgrades**: the 刷新 button now also re-reads the model catalog (one `agy models` spawn per explicit click only — new subscription tier may expose different models), and every account card gains a 同步 button for single-account refresh.
+  - **Primary slot always re-bootstrapped (real root cause of "UI stuck on old account")**: the primary slot was only created for an EMPTY pool, so once deleted it never came back while other accounts remained — the system-HOME login (e.g. after `agy logout` + re-login) had no slot to attach to and the UI kept showing an isolated account as 主账号. The slot is now recreated at the front on every load; deleting it no longer promotes an isolated account to primary. Disable the slot instead of deleting if unwanted.
+
 ## 0.4.15 (2026-08-24)
 
 - **Quota Polling Risk-Exposure Minimization (root-cause follow-up).**

package/dist/client.js

@@ -963,8 +963,8 @@ body.dark,
 					const info = acc.quotas[familyKey];
 					const cd = acc.cooldowns[familyKey];
 					const inCooldown = cd && cd.cooldownUntil > Date.now();
-					let pct5h = typeof info?.remainingFraction === "number" && Number.isFinite(info.remainingFraction) ? Math.max(0, Math.min(100, Math.round(info.remainingFraction * 100))) : -1;
-					if (inCooldown) pct5h = 0;
+					const pct5h = typeof info?.remainingFraction === "number" && Number.isFinite(info.remainingFraction) ? Math.max(0, Math.min(100, Math.round(info.remainingFraction * 100))) : -1;
+					const cdNote = inCooldown ? " · 本地冷却中" : "";
 					const w5h = formatQuotaWindow(info?.resetTime);
 					const pctWeekly = typeof info?.weeklyFraction === "number" && Number.isFinite(info.weeklyFraction) ? Math.max(0, Math.min(100, Math.round(info.weeklyFraction * 100))) : -1;
 					const wWeekly = formatQuotaWindow(info?.weeklyResetTime);
@@ -1052,7 +1052,7 @@ body.dark,
 						fontSize: "12.5px",
 						marginBottom: "5px",
 						color: "var(--agy-text-primary)"
-					} }, brandIcon(FAMILY_BRAND[familyKey], 14), h("span", null, label)), renderLine("5h 额度", pct5h, c5h, w5h.resetText), renderLine("周额度", pctWeekly, cWeekly, wWeekly.resetText));
+					} }, brandIcon(FAMILY_BRAND[familyKey], 14), h("span", null, label)), renderLine("5h 额度", pct5h, c5h, w5h.resetText ? w5h.resetText + cdNote : cdNote.replace(/^ · /, "")), renderLine("周额度", pctWeekly, cWeekly, wWeekly.resetText));
 				};
 				const renderedAccountCards = accounts.map((acc) => {
 					const isPrimary = acc.id === pool?.primaryAccountId;
@@ -1140,7 +1140,17 @@ body.dark,
 							gap: "3px"
 						},
 						onClick: () => toggleExpand(acc.id)
-					}, isExpanded ? [uiIcon("chevronUp", 11), " 收起"] : [uiIcon("chevronDown", 11), " 明细"]) : null, !isPrimary ? h("button", {
+					}, isExpanded ? [uiIcon("chevronUp", 11), " 收起"] : [uiIcon("chevronDown", 11), " 明细"]) : null, h("button", {
+						type: "button",
+						className: "agy-btn",
+						style: {
+							...S.btnSm,
+							gap: "4px"
+						},
+						title: "刷新此账号（换号后点这里立即同步 email / 额度 / 模型）",
+						disabled: isBusy,
+						onClick: () => void refreshQuota(acc.id)
+					}, loadingAction === `refresh:${acc.id}` ? [renderSpinner(), "同步中"] : [uiIcon("refresh", 11), " 同步"]), !isPrimary ? h("button", {
 						type: "button",
 						className: "agy-btn",
 						style: {

package/dist/index.js

@@ -115,9 +115,25 @@ function extractAuthUrl(text) {
 	if (!m) return void 0;
 	return m[0].replace(/[)\]>.,;\x27\x22]+$/, "");
 }
+/**
+* HARD, server-issued rate-limit signatures — the ONLY patterns allowed to
+* put an account into cooldown. Deliberately narrow: bare `429` or
+* `rate limit` matched incidental substrings in the wild (hash/UUID
+* fragments, model prose mentioning quotas, unrelated tool/permission
+* errors quoting such words) and produced ghost cooldowns that froze
+* healthy accounts out of rotation.
+*/
+function looksLikeHardRateLimit(text) {
+	if (!text) return false;
+	return /RESOURCE_EXHAUSTED|code[ :]?429\b|status[ :]?429\b|HTTP[ :]?429\b|too many requests|individual quota reached|quota (?:exceeded|reached|exhausted)|rate[ -]?limit(?:ed)? (?:exceeded|reached|hit)|exceeded (?:your |the )?quota/i.test(text);
+}
+/**
+* Soft heuristic adds capacity signals (model overloaded / high traffic).
+* Shapes the user-facing error message only — NEVER cools an account down.
+*/
 function looksLikeRateLimit(text) {
 	if (!text) return false;
-	return /429|too many requests|resource_exhausted|quota exceeded|quota reached|individual quota reached|rate limit|model overloaded|server.*experiencing high traffic|exceeded.*quota/i.test(text);
+	return looksLikeHardRateLimit(text) || /model overloaded|experiencing high traffic/i.test(text);
 }
 /**
 * Parse reset duration in milliseconds from rate-limit / quota-exhausted error strings.
@@ -2364,11 +2380,8 @@ var AgyAdapter = class extends LlmAdapter {
 			const conversationId = streamCid ?? diffed;
 			const r = rec.getResultEvent();
 			const consumable = r !== null && (r.ok || r.response !== "");
-			const isRateLimit = looksLikeRateLimit([
-				outcome.stderrTail,
-				outcome.stdout,
-				parser.stats.lastResultError
-			].filter(Boolean).join(" "));
+			const rawErrText = [outcome.stderrTail, parser.stats.lastResultError].filter(Boolean).join(" ");
+			const isRateLimit = looksLikeRateLimit(rawErrText);
 			let failure = null;
 			if (outcome.aborted) failure = {
 				kind: "aborted",
@@ -2423,7 +2436,7 @@ var AgyAdapter = class extends LlmAdapter {
 				}
 			} else {
 				const effectiveRateLimit = isRateLimit || looksLikeRateLimit(failure.message);
-				if (account && effectiveRateLimit) this.deps.pool?.recordFailure(account.id, family, failure.message);
+				if (account && looksLikeHardRateLimit(rawErrText)) this.deps.pool?.recordFailure(account.id, family, failure.message);
 				if (account && (failure.code === Err.AUTH || /invalid_grant|not signed in|auth/i.test(failure.message))) this.deps.pool?.markAuthRequired(account.id, failure.message);
 				if (!isAux && sessionAccountKey !== "") {
 					if (failure.code === Err.AUTH || effectiveRateLimit || failure.message && /conversation.*(not found|invalid|not recognized|expired|does not exist)|session.*(expired|invalid)/i.test(failure.message)) this.deps.store.delete(sessionAccountKey);
@@ -27082,7 +27095,7 @@ var AccountPoolManager = class {
 	* and signed in via /agy add-account.
 	*/
 	bootstrapDefaultAccount() {
-		if (this.data.accounts.length > 0) return;
+		if (this.data.accounts.some((a) => a.systemHome)) return;
 		const primary = {
 			id: "acc_primary",
 			alias: "主账号 (系统登录)",
@@ -27093,7 +27106,7 @@ var AccountPoolManager = class {
 			cooldowns: {},
 			quotas: {}
 		};
-		this.data.accounts.push(primary);
+		this.data.accounts.unshift(primary);
 		this.data.primaryAccountId = primary.id;
 		this.persist();
 	}
@@ -27243,7 +27256,7 @@ var AccountPoolManager = class {
 				force: true
 			});
 		} catch {}
-		if (this.data.primaryAccountId === id) this.data.primaryAccountId = this.data.accounts[0]?.id;
+		if (this.data.primaryAccountId === id) this.data.primaryAccountId = void 0;
 		if (this.data.activeAccountIds) {
 			for (const [fam, accId] of Object.entries(this.data.activeAccountIds)) if (accId === id) delete this.data.activeAccountIds[fam];
 		}
@@ -27284,6 +27297,22 @@ var AccountPoolManager = class {
 		}
 		this.persist();
 	}
+	/**
+	* External re-login detected (agy logout + new login): identity-bound
+	* state from the PREVIOUS account (cooldowns, quotas, auth quarantine)
+	* must not leak onto the new one. Resets everything email-bound while
+	* keeping slot config (alias, dir, proxy, enabled).
+	*/
+	resetAccountIdentity(id, newEmail) {
+		const acc = this.getAccount(id);
+		if (!acc) return;
+		acc.email = newEmail;
+		acc.cooldowns = {};
+		acc.quotas = {};
+		delete acc.authRequired;
+		delete acc.authError;
+		this.persist();
+	}
 	clearAuthRequired(id) {
 		const acc = this.getAccount(id);
 		if (!acc) return;
@@ -27652,6 +27681,18 @@ var PoolAuthFlow = class {
 };
 //#endregion
 //#region src/host/quota.ts
+/**
+* When the quota-summary endpoint transiently fails, per-model fallback
+* data carries a SINGLE window (sometimes the weekly one) and no weekly
+* fields. Overwriting a previously COMPLETE family entry with that partial
+* shape dropped weeklyFraction to none and put wrong-window numbers into
+* the 5h row (observed: 5h=100% / reset a week out / weekly missing).
+* Rule: last-known-good complete data always wins over partial fallback.
+*/
+function mergeFallbackFamilyQuota(prev, fallback) {
+	if (prev && typeof prev.remainingFraction === "number") return prev;
+	return fallback;
+}
 function detectEmailFromAgyLogs(homeDir) {
 	const logDir = join(homeDir, ".gemini", "antigravity-cli", "log");
 	if (!existsSync(logDir)) return void 0;
@@ -27902,20 +27943,16 @@ var QuotaService = class {
 			const detected = detectEmailFromAgyLogs(home);
 			if (detected) email = detected;
 		}
+		if (email && email !== account.email) this.pool.resetAccountIdentity(account.id, email);
 		const accessToken = await this.getValidAccessToken(account);
-		if (!accessToken) {
-			if (email && email !== account.email) this.pool.updateAccountQuotas(account.id, account.quotas, email);
-			return null;
-		}
+		if (!accessToken) return null;
 		const [summary, discovered] = await Promise.all([this.fetchQuotaSummary(accessToken, account.proxyUrl), this.fetchAvailableModels(accessToken, account.proxyUrl)]);
 		if (!email) {
 			const info = await this.fetchUserInfo(accessToken, account.proxyUrl);
 			if (info?.email) email = info.email;
 		}
-		if (!summary && (!discovered || !discovered.models)) {
-			if (email && email !== account.email) this.pool.updateAccountQuotas(account.id, account.quotas, email);
-			return null;
-		}
+		if (!summary && (!discovered || !discovered.models)) return null;
+		if (account.authRequired) this.pool.clearAuthRequired(account.id);
 		const familyQuotas = {};
 		if (summary && Array.isArray(summary.groups)) for (const group of summary.groups) {
 			const dName = (group.displayName || "").toLowerCase();
@@ -27960,11 +27997,11 @@ var QuotaService = class {
 				remainingFraction: remaining,
 				resetTime
 			});
-			if (!familyQuotas[fam]) familyQuotas[fam] = {
+			if (!familyQuotas[fam]) familyQuotas[fam] = mergeFallbackFamilyQuota(account.quotas[fam], {
 				remainingFraction: remaining,
 				resetTime,
 				updatedAt: now
-			};
+			});
 			else if (familyQuotas[fam].remainingFraction === void 0) {
 				const curRemaining = familyQuotas[fam].remainingFraction ?? 1;
 				if (remaining < curRemaining) {
@@ -27988,9 +28025,25 @@ var QuotaService = class {
 	* auth-quarantined / in cooldown) so the poller never keeps knocking on
 	* Google endpoints for accounts already known to be limited. Manual force
 	* refresh from the UI refreshes everything.
+	*
+	* Before gating, a ZERO-NETWORK identity reconciliation runs for flagged
+	* slots: an external `agy logout` + re-login writes the new email into the
+	* newest CLI logs, and detecting that locally lets us reset the stale
+	* quarantine/cooldowns so the slot rejoins polling — no extra request to
+	* Google is made for this check (risk-control neutral).
 	*/
 	async refreshAllQuotas(force = false) {
-		const accounts = force ? this.pool.getAccounts() : this.pool.getAccounts().filter(shouldPollAccount);
+		let accounts = this.pool.getAccounts();
+		if (!force) {
+			const now = Date.now();
+			for (const acc of accounts) {
+				const flagged = acc.authRequired || Object.values(acc.cooldowns).some((cd) => cd && cd.cooldownUntil > now);
+				if (!acc.systemHome || !flagged) continue;
+				const detected = detectEmailFromAgyLogs(acc.systemHome || !acc.dir ? homedir() : acc.dir);
+				if (detected && detected !== acc.email) this.pool.resetAccountIdentity(acc.id, detected);
+			}
+			accounts = accounts.filter(shouldPollAccount);
+		}
 		await Promise.allSettled(accounts.map((acc) => this.refreshAccountQuota(acc, force)));
 	}
 };
@@ -28737,6 +28790,7 @@ function apply(ctx, entryConfig = {}) {
 						const acc = pool.getAccount(id);
 						if (acc) await quota.refreshAccountQuota(acc, true);
 					} else await quota.refreshAllQuotas(true);
+					catalog.forceRefresh().catch(() => void 0);
 					sendJson(res, 200, {
 						ok: true,
 						pool: pool.getPoolData()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-agy-link",
-  "version": "0.4.15",
+  "version": "0.4.18",
   "description": "Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.",
   "type": "module",
   "license": "MIT",