dsh-agy-link 0.4.43 → 0.4.46

package/dist/index.js

@@ -1,13 +1,13 @@
 import { createRequire } from "node:module";
 import { execFile, execFileSync, spawn } from "node:child_process";
-import path, { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
-import { accessSync, chmodSync, constants, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import path, { delimiter, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { accessSync, chmodSync, constants, copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import * as dshLlm from "@deepseek-ai/dsh-llm";
 import { LlmAdapter, LlmError } from "@deepseek-ai/dsh-llm";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { defineTool } from "@deepseek-ai/dsh-tools";
-import { copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, unlink, writeFile } from "node:fs/promises";
+import { chmod, copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { promisify } from "node:util";
 import { createServer } from "node:http";
 import { fileURLToPath } from "node:url";
@@ -81,6 +81,7 @@ function defaultConfig() {
 		defaultModel: "",
 		defaultEffort: "",
 		timeoutMs: 6e5,
+		longToolIdleMinutes: 240,
 		maxConcurrent: 3,
 		contextWindowDefault: 1048576,
 		maxTokensDefault: 65536,
@@ -92,6 +93,7 @@ function defaultConfig() {
 		compactionMaxChars: 8e5,
 		workspaceRoot: "",
 		fallbackModels: DEFAULT_FALLBACK_MODELS,
+		hiddenModels: [],
 		askTool: false,
 		mediaDir: "",
 		mediaTtlMs: 864e5,
@@ -117,9 +119,19 @@ function defaultConfig() {
 function isAuthoritativeAuthError(message) {
 	return /invalid_grant|invalid_client|revoked|disabled|unauthorized_client/i.test(message);
 }
-/** Transient transport failures — never proof that a login is dead. */
+/**
+* Transient transport failures — never proof that a login is dead.
+*
+* Deliberately broader than the classic dial/DNS set: agy reports "not signed
+* in" whenever it cannot VALIDATE the stored token, so a flaky proxy produces
+* `Post https://oauth2.googleapis.com/token: EOF`, `TLS handshake timeout` or
+* `token validation failed due to network error (token may still be valid)`
+* next to an auth-shaped banner. Treating that as a sign-out ends the turn on
+* a HEALTHY account and DSH renders the AUTH code as "API key is invalid"
+* (observed live: 2026-10-10 14:17, session-c65a826e turn 22).
+*/
 function looksLikeNetworkError(message) {
-	return /dial tcp|fetch failed|econn(?:refused|reset|aborted)|enotfound|ehostunreach|enetunreach|socket hang up|getaddrinfo|bad gateway|service unavailable/i.test(message);
+	return /dial tcp|fetch failed|econn(?:refused|reset|aborted)|enotfound|ehostunreach|enetunreach|socket hang up|getaddrinfo|bad gateway|service unavailable|unexpected eof|\beof\b|tls handshake timeout|i\/o timeout|network (?:error|is unreachable)|no route to host|connection reset|context deadline exceeded|temporary failure in name resolution|proxyconnect|token validation failed|validate (?:the )?token|silent auth failed/i.test(message);
 }
 /**
 * Decide whether a failed call may flag an account as "needs re-login".
@@ -153,6 +165,21 @@ const Err = {
 	TIMEOUT: "TIMEOUT",
 	PROCESS_EXIT: "PROCESS_EXIT",
 	INVALID_OUTPUT: "INVALID_OUTPUT",
+	/**
+	* Transport failure wrapped around an auth-looking refusal. agy cannot tell
+	* "the token is gone" from "I could not validate the token because the
+	* network died", and it reports both as "not logged into Antigravity".
+	* Kept separate from AUTH so the turn is retried on ANOTHER account instead
+	* of ending on a healthy one (and so no account is flagged for re-login).
+	*/
+	NETWORK: "NETWORK",
+	/**
+	* Soft Google-side capacity refusal ("model overloaded" / "experiencing high
+	* traffic"). Account-scoped for retry purposes — the sticky pointer moves to
+	* the next account — but it is NEVER a cooldown reason: nothing was spent, so
+	* a 15-minute penalty would only shrink the pool.
+	*/
+	OVERLOADED: "OVERLOADED",
 	UNKNOWN_MODEL: "UNKNOWN_MODEL",
 	UNSUPPORTED_REASONING_EFFORT: "UNSUPPORTED_REASONING_EFFORT",
 	AUX_DISABLED: "AUX_DISABLED",
@@ -186,15 +213,29 @@ function extractAuthUrl(text) {
 */
 function looksLikeHardRateLimit(text) {
 	if (!text) return false;
-	return /RESOURCE_EXHAUSTED|code[ :]?429\b|status[ :]?429\b|HTTP[ :]?429\b|too many requests|individual quota reached|quota (?:exceeded|reached|exhausted)|rate[ -]?limit(?:ed)? (?:exceeded|reached|hit)|exceeded (?:your |the )?quota/i.test(text);
+	return /RESOURCE_EXHAUSTED|code[ :]?429\b|status[ :]?429\b|HTTP[ :]?429\b|too many requests|individual quota reached|quota (?:exceeded|reached|exhausted)|rate[ -]?limit(?:ed)? (?:exceeded|reached|hit)|exceeded (?:your |the )?quota|has been exhausted|exhausted your quota|out of quota|check quota|insufficient quota/i.test(text);
+}
+/**
+* Failures that belong to the ACCOUNT (spent quota, refused region, broken
+* transport, capacity refusal, signed-out login) rather than to the request.
+* The retry policy retries these and the adapter rotates the sticky pointer,
+* so the retry is served by a different account instead of interrupting the
+* user's turn. Deterministic request-level failures (AGY_ERROR, a bare
+* PROCESS_EXIT from a crash) are deliberately excluded: re-running those
+* merely repeats the same work on another account.
+*/
+function isAccountScopedFailure(code) {
+	return code === "RATE_LIMIT" || code === "ELIGIBILITY" || code === "NETWORK" || code === "OVERLOADED" || code === "AUTH";
 }
 /**
 * Soft heuristic adds capacity signals (model overloaded / high traffic).
 * Shapes the user-facing error message only — NEVER cools an account down.
+* The adapter still ROTATES on these: nothing was spent locally, and ending a
+* turn while an idle account could serve it is the interruption users report.
 */
 function looksLikeRateLimit(text) {
 	if (!text) return false;
-	return looksLikeHardRateLimit(text) || /model overloaded|experiencing high traffic/i.test(text);
+	return looksLikeHardRateLimit(text) || /model overloaded|experiencing high traffic|is overloaded|capacity (?:exhausted|unavailable)|temporarily overloaded/i.test(text);
 }
 /**
 * Parse reset duration in milliseconds from rate-limit / quota-exhausted error strings.
@@ -259,6 +300,20 @@ function asNum(v) {
 	if (typeof v === "number" && Number.isFinite(v)) return v;
 	if (typeof v === "string" && v.trim() !== "" && Number.isFinite(Number(v))) return Number(v);
 }
+/** Trimmed, de-duplicated string list; non-string / blank entries are dropped. */
+function asStringArray(v) {
+	if (!Array.isArray(v)) return void 0;
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const x of v) {
+		if (typeof x !== "string") continue;
+		const s = x.trim();
+		if (s === "" || seen.has(s)) continue;
+		seen.add(s);
+		out.push(s);
+	}
+	return out;
+}
 const MODES = [
 	"skip",
 	"plan",
@@ -283,6 +338,7 @@ function resolveConfig(entry, env = process.env, overrides = readOverrides()) {
 		defaultModel: asString(get("defaultModel")) ?? base.defaultModel,
 		defaultEffort: asString(get("defaultEffort")) ?? base.defaultEffort,
 		timeoutMs: asNum(get("timeoutMs")) ?? base.timeoutMs,
+		longToolIdleMinutes: asNum(get("longToolIdleMinutes")) ?? base.longToolIdleMinutes,
 		maxConcurrent: asNum(get("maxConcurrent")) ?? base.maxConcurrent,
 		contextWindowDefault: asNum(get("contextWindowDefault")) ?? base.contextWindowDefault,
 		maxTokensDefault: asNum(get("maxTokensDefault")) ?? base.maxTokensDefault,
@@ -294,6 +350,7 @@ function resolveConfig(entry, env = process.env, overrides = readOverrides()) {
 		compactionMaxChars: asNum(get("compactionMaxChars")) ?? base.compactionMaxChars,
 		workspaceRoot: asString(get("workspaceRoot")) ?? base.workspaceRoot,
 		fallbackModels: Array.isArray(get("fallbackModels")) ? get("fallbackModels").filter((x) => !!x && typeof x === "object" && typeof x.id === "string") : base.fallbackModels,
+		hiddenModels: asStringArray(get("hiddenModels")) ?? base.hiddenModels,
 		askTool: asBool(get("askTool")) ?? base.askTool,
 		mediaDir: asString(get("mediaDir")) ?? base.mediaDir,
 		mediaTtlMs: asNum(get("mediaTtlMs")) ?? base.mediaTtlMs,
@@ -324,7 +381,15 @@ function resolveConfig(entry, env = process.env, overrides = readOverrides()) {
 		const t = asNum(env.DSH_AGY_TIMEOUT_MS);
 		if (t && t > 0) cfg.timeoutMs = t;
 	}
+	if (env.DSH_AGY_LONG_TOOL_IDLE_MINUTES) {
+		const t = asNum(env.DSH_AGY_LONG_TOOL_IDLE_MINUTES);
+		if (t !== void 0 && t >= 0) cfg.longToolIdleMinutes = t;
+	}
 	if (env.DSH_AGY_EXTRA_ARGS) cfg.extraArgs = env.DSH_AGY_EXTRA_ARGS.split(/\s+/).filter(Boolean);
+	if (env.DSH_AGY_HIDDEN_MODELS) {
+		const list = asStringArray(env.DSH_AGY_HIDDEN_MODELS.split(","));
+		if (list) cfg.hiddenModels = list;
+	}
 	if (env.DSH_AGY_WORKSPACE_ROOT) cfg.workspaceRoot = env.DSH_AGY_WORKSPACE_ROOT;
 	if (env.DSH_AGY_MEDIA_DIR) cfg.mediaDir = env.DSH_AGY_MEDIA_DIR;
 	if (env.DSH_AGY_MEDIA_TTL_MS) {
@@ -381,7 +446,7 @@ function shouldPollAccount(account) {
 	if (!account.enabled) return false;
 	if (account.authRequired) return false;
 	const now = Date.now();
-	for (const cd of Object.values(account.cooldowns)) if (cd && cd.cooldownUntil > now) return false;
+	for (const cd of Object.values(account.cooldowns ?? {})) if (cd && cd.cooldownUntil > now) return false;
 	return true;
 }
 /**
@@ -415,6 +480,17 @@ function defaultPoolData() {
 function defaultConversationsDir() {
 	return process.env.DSH_AGY_CONVERSATIONS_DIR ?? join(homedir(), ".gemini", "antigravity-cli", "conversations");
 }
+/**
+* Conversations directory for one run's HOME. Secondary pool accounts run
+* under an isolated HOME, so the fallback discovery must watch THEIR
+* conversations dir — snapshotting the system HOME silently never saw those
+* conversation databases (agy-db.ts fixed the same class of bug for its DB
+* readers; this aligns discovery with it).
+*/
+function conversationsDirFor(accountHome) {
+	if (accountHome !== void 0 && accountHome !== "") return join(accountHome, ".gemini", "antigravity-cli", "conversations");
+	return defaultConversationsDir();
+}
 function snapshotConversations(dir = defaultConversationsDir()) {
 	const files = /* @__PURE__ */ new Map();
 	try {
@@ -461,10 +537,19 @@ const waiters = Symbol("waiters");
 var RunRecording = class {
 	runId;
 	events = [];
+	/** Arrival timestamp for every recorded event (same index as `events`). */
+	eventTimes = [];
 	settled = false;
 	failure = null;
 	resultConversationId = null;
 	lastStepUsageRaw = null;
+	/**
+	* Per-step generation timing for token-speed statistics: stepKey ->
+	* { startedAt, lastAt, outputTokens }. The last usage sample of a step wins
+	* (updates are cumulative snapshots of one internal call), so replacing —
+	* not accumulating — keeps the numbers honest.
+	*/
+	stepSpeed = /* @__PURE__ */ new Map();
 	[waiters] = /* @__PURE__ */ new Set();
 	/** DB-resolved full tool args keyed by event index (set during span driving). */
 	fullArgs = null;
@@ -473,6 +558,16 @@ var RunRecording = class {
 	/** Isolated pool-account HOME used for this run's agy conversation DB. */
 	accountHome = void 0;
 	/**
+	* Index of the event where the most recent span CUT (the last event the
+	* previous run_code call yielded), or null while no span has finished on
+	* this recording. Lets the duplicate-request debounce RESCUE an identical
+	* prompt by re-driving the live recording from the cut point instead of
+	* throwing BUSY at a mid-flight agentic turn (2026-10-10 23:0x incident:
+	* a span whose mirror result did not parse as a continuation fell through
+	* to full prompt assembly and the debounce killed the whole turn).
+	*/
+	lastCutIndex = null;
+	/**
 	* Set by the adapter right after spawn. A mid-turn user steer makes DSH
 	* open a NEW stream() call for the same session while this run's process
 	* is still alive; without aborting it, two agy processes would append to
@@ -486,11 +581,66 @@ var RunRecording = class {
 	append(ev) {
 		if (this.settled) return;
 		this.events.push(ev);
+		const now = Date.now();
+		this.eventTimes.push(now);
 		if (ev.kind === "result") this.resultConversationId = ev.conversationId ?? null;
 		if (ev.kind === "init" && typeof ev.conversationId === "string" && ev.conversationId !== "") this.resultConversationId = this.resultConversationId ?? ev.conversationId;
+		if (ev.kind === "step" && ev.usage) {
+			const out = typeof ev.usage.output_tokens === "number" && Number.isFinite(ev.usage.output_tokens) ? ev.usage.output_tokens : 0;
+			if (out > 0) {
+				const prev = this.stepSpeed.get(ev.stepKey);
+				if (prev === void 0) this.stepSpeed.set(ev.stepKey, {
+					startedAt: now,
+					lastAt: now,
+					outputTokens: out
+				});
+				else {
+					prev.lastAt = now;
+					prev.outputTokens = out;
+				}
+			}
+		}
 		this.wake();
 	}
 	/**
+	* Token-speed statistics over the generation steps recorded so far
+	* (tokens/second of model OUTPUT, thinking included where agy reports it).
+	*
+	* `avgTps` is the output-weighted mean (Σ tokens / Σ seconds) over steps
+	* with a measurable window (≥ 500 ms); `lastTps` is the most recently
+	* measured step. Tool-only and instantaneous steps are excluded, so the
+	* numbers reflect actual generation speed rather than tool wait time.
+	*/
+	speedStats() {
+		let tokens = 0;
+		let ms = 0;
+		let steps = 0;
+		let lastTps = null;
+		for (const s of this.stepSpeed.values()) {
+			tokens += s.outputTokens;
+			const windowMs = s.lastAt - s.startedAt;
+			if (s.outputTokens > 0 && windowMs >= 500) {
+				ms += windowMs;
+				steps++;
+			}
+		}
+		for (let i = this.events.length - 1; i >= 0; i--) {
+			const ev = this.events[i];
+			if (ev === void 0 || ev.kind !== "step") continue;
+			const s = this.stepSpeed.get(ev.stepKey);
+			if (s === void 0) continue;
+			if (s.outputTokens > 0 && s.lastAt - s.startedAt >= 500) lastTps = s.outputTokens / ((s.lastAt - s.startedAt) / 1e3);
+			break;
+		}
+		return {
+			lastTps,
+			avgTps: ms > 0 ? tokens / (ms / 1e3) : null,
+			outputTokens: tokens,
+			measuredSteps: steps,
+			generatingMs: ms
+		};
+	}
+	/**
 	* Usage accounting (verified against agy 1.1.16 stream-json): step_update
 	* usage is PER-CALL (the current context size at that internal LLM call),
 	* while the result envelope's usage is CUMULATIVE across the whole agy
@@ -641,28 +791,92 @@ function parseMirrorCallId(callId) {
 	};
 }
 const MAX_RETAINED_RUNS = 8;
-/** Bounded registry keeping the most recent runs for continuation spans. */
+/**
+* Bounded registry keeping the most recent runs for continuation spans.
+*
+* Eviction is deliberately conservative: a run is only dropped when it is
+* SETTLED, UNPINNED and is not the most recently used entry. A wedged agy
+* tool step can keep a run alive for hours while other DSH sessions create
+* their own runs (flash-blast incident, 2026-10-10): a pure FIFO cap evicted
+* that run mid-flight, and the mirror call the span had already queued —
+* `agy_tool({run, step})` — could no longer be resolved, so the model lost
+* the tool result and burned the turn debugging the bridge instead.
+*/
 var RunRegistry = class {
 	runs = /* @__PURE__ */ new Map();
+	/** runId -> pin count while a span is actively driving that recording. */
+	pinned = /* @__PURE__ */ new Map();
 	create() {
 		const rec = new RunRecording();
 		this.remember(rec);
 		return rec;
 	}
+	/**
+	* Insert a run, or refresh one that is about to be consumed again (a
+	* continuation span re-registers its recording so a long-lived run is the
+	* most recent entry and survives the eviction that follows its cut).
+	*/
 	remember(rec) {
+		if (this.runs.has(rec.runId)) this.runs.delete(rec.runId);
 		this.runs.set(rec.runId, rec);
-		while (this.runs.size > MAX_RETAINED_RUNS) {
-			const oldest = this.runs.keys().next().value;
-			if (oldest === void 0) break;
-			this.runs.delete(oldest);
-		}
+		this.evict();
 	}
 	get(runId) {
 		return this.runs.get(runId);
 	}
+	/**
+	* Pin a run for the duration of a span drive. Pinned (and unsettled) runs
+	* are exempt from eviction, so a span that waits hours for a wedged tool
+	* step can still resolve the mirror calls it emits afterwards.
+	*/
+	pin(runId) {
+		this.pinned.set(runId, (this.pinned.get(runId) ?? 0) + 1);
+	}
+	unpin(runId) {
+		const n = this.pinned.get(runId);
+		if (n === void 0) return;
+		if (n <= 1) this.pinned.delete(runId);
+		else this.pinned.set(runId, n - 1);
+	}
 	/** Drop a settled run early (called when its final span finished stop). */
 	forget(runId) {
 		this.runs.delete(runId);
+		this.pinned.delete(runId);
+	}
+	/** Retained run ids, oldest first (diagnostics / tests). */
+	get runIds() {
+		return [...this.runs.keys()];
+	}
+	/** Number of retained runs. */
+	get size() {
+		return this.runs.size;
+	}
+	/** Number of currently pinned run ids (diagnostics / tests). */
+	get pinnedCount() {
+		return this.pinned.size;
+	}
+	/**
+	* Trim back to the cap without ever breaking an in-flight run: evict the
+	* oldest SETTLED, UNPINNED entry, never the most recent one (the next
+	* mirror dispatch or continuation addresses it). Live (unsettled) and
+	* pinned runs are exempt, so the registry may temporarily exceed the cap
+	* while several runs are in flight — strictly better than failing a replay.
+	*/
+	evict() {
+		while (this.runs.size > MAX_RETAINED_RUNS) {
+			let newest;
+			for (const id of this.runs.keys()) newest = id;
+			let victim;
+			for (const [id, rec] of this.runs) {
+				if (id === newest) continue;
+				if (!rec.isSettled) continue;
+				if (this.pinned.has(id)) continue;
+				victim = id;
+				break;
+			}
+			if (victim === void 0) return;
+			this.runs.delete(victim);
+		}
 	}
 };
 //#endregion
@@ -741,14 +955,37 @@ function toolStepBrief(toolName, args) {
 		return "";
 	};
 	if (toolName === "run_command" || toolName === "execute_command") {
-		const cmd = pickStr("Command", "command", "Cmd", "cmd");
+		const cmd = pickStr("CommandLine", "command_line", "Command", "command", "Cmd", "cmd");
 		return cmd !== "" ? "$ " + cmd.slice(0, 80) : "run command";
 	}
-	if (toolName === "view_file" || toolName === "read_file") return "read " + (pickStr("Path", "path", "TargetFile", "File") || "file");
-	if (toolName === "write_to_file" || toolName === "create_file") return "write " + (pickStr("Path", "path", "TargetFile", "File") || "file");
-	if (toolName === "replace_file_content" || toolName === "edit_file") return "edit " + (pickStr("Path", "path", "TargetFile", "File") || "file");
+	if (toolName === "view_file" || toolName === "read_file") return "read " + (pickStr("AbsolutePath", "absolute_path", "Path", "path", "TargetFile", "File") || "file");
+	if (toolName === "write_to_file" || toolName === "create_file") return "write " + (pickStr("TargetFile", "target_file", "Path", "path", "AbsolutePath", "File") || "file");
+	if (toolName === "replace_file_content" || toolName === "edit_file") return "edit " + (pickStr("TargetFile", "target_file", "Path", "path", "AbsolutePath", "File") || "file");
 	if (toolName === "grep_search" || toolName === "search") return "search " + (pickStr("Query", "query", "SearchPattern") || "");
-	if (toolName === "list_dir" || toolName === "list_directory") return "ls " + (pickStr("Path", "path", "DirectoryPath") || ".");
+	if (toolName === "search_web" || toolName === "web_search") return "search web " + (pickStr("query", "Query", "search_query", "q") || "");
+	if (toolName === "read_url_content" || toolName === "web_fetch" || toolName === "fetch_web_page") return "fetch " + (pickStr("Url", "url", "target_url", "targetUrl") || "url");
+	if (toolName === "list_dir" || toolName === "list_directory") return "ls " + (pickStr("DirectoryPath", "directory_path", "Path", "path", "AbsolutePath") || ".");
+	if (toolName === "manage_task") {
+		const action = pickStr("Action", "action") || "manage";
+		const id = pickStr("TaskId", "taskId", "task_id");
+		return id !== "" ? "task " + action + " " + id : "task " + action;
+	}
+	if (toolName === "schedule") {
+		const prompt = pickStr("Prompt", "prompt");
+		const cron = pickStr("CronExpression", "cron_expression");
+		const dur = pickStr("DurationSeconds", "duration_seconds");
+		const timing = cron ? "cron " + cron : dur ? dur + "s" : "";
+		return timing ? "schedule " + timing : prompt ? "schedule " + prompt.slice(0, 40) : "schedule";
+	}
+	if (toolName === "invoke_subagent") {
+		const subs = a.Subagents ?? a.subagents;
+		const firstRole = Array.isArray(subs) && subs.length > 0 && typeof subs[0].Role === "string" ? subs[0].Role : "";
+		return firstRole ? "subagent: " + firstRole : "invoke subagent";
+	}
+	if (toolName === "send_message") {
+		const recipient = pickStr("Recipient", "recipient", "to");
+		return recipient ? "msg " + recipient : "send message";
+	}
 	return toolName;
 }
 /** agy serializes some tool args as a JSON string; presenters get an object. */
@@ -774,6 +1011,7 @@ function pick$1(input, ...keys) {
 	for (const k of keys) {
 		const v = input[k];
 		if (typeof v === "string") return v;
+		if (typeof v === "number" && Number.isFinite(v)) return String(v);
 	}
 }
 /** Native pending-card projection for one mirrored agy tool call. */
@@ -897,12 +1135,68 @@ function presentMirrorCall(args) {
 				rawInput: input
 			};
 		}
-		case "read_url_content": {
-			const url = pick$1(input, "Url", "url") ?? "";
+		case "search_web":
+		case "web_search": {
+			const q = pick$1(input, "query", "Query", "search_query", "q") ?? "";
+			return {
+				card: "generic",
+				title: pick$1(input, "Description", "description", "toolAction", "toolSummary") ?? (q !== "" ? "Web search " + q : "Web search"),
+				kind: "search",
+				rawInput: input
+			};
+		}
+		case "read_url_content":
+		case "web_fetch":
+		case "fetch_web_page":
+		case "fetch_url": {
+			const url = pick$1(input, "Url", "url", "target_url", "targetUrl") ?? "";
 			return {
 				card: "generic",
 				title: pick$1(input, "Description", "description", "toolAction", "toolSummary") ?? (url ? `Fetch ${url}` : "Fetch URL"),
-				kind: "fetch"
+				kind: "fetch",
+				rawInput: input
+			};
+		}
+		case "manage_task": {
+			const action = pick$1(input, "Action", "action") ?? "manage";
+			const taskId = pick$1(input, "TaskId", "taskId", "task_id");
+			return {
+				card: "generic",
+				title: pick$1(input, "Description", "description", "toolAction", "toolSummary") ?? (taskId ? `Task ${action} (${taskId})` : `Task ${action}`),
+				kind: "execute",
+				rawInput: input
+			};
+		}
+		case "schedule": {
+			const prompt = pick$1(input, "Prompt", "prompt");
+			const cron = pick$1(input, "CronExpression", "cron_expression");
+			const duration = pick$1(input, "DurationSeconds", "duration_seconds");
+			const desc = pick$1(input, "Description", "description", "toolAction", "toolSummary");
+			const timing = cron ? `cron ${cron}` : duration ? `${duration}s timer` : "";
+			return {
+				card: "generic",
+				title: desc ?? (timing ? `Schedule ${timing}` : prompt ? `Schedule: ${prompt}` : "Schedule"),
+				kind: "other",
+				rawInput: input
+			};
+		}
+		case "invoke_subagent": {
+			const subs = input.Subagents ?? input.subagents;
+			const firstRole = Array.isArray(subs) && subs.length > 0 && typeof subs[0].Role === "string" ? subs[0].Role : Array.isArray(subs) && subs.length > 0 && typeof subs[0].TypeName === "string" ? subs[0].TypeName : void 0;
+			return {
+				card: "generic",
+				title: pick$1(input, "Description", "description", "toolAction", "toolSummary") ?? (firstRole ? `Subagent: ${firstRole}` : "Invoke subagent"),
+				kind: "execute",
+				rawInput: input
+			};
+		}
+		case "send_message": {
+			const recipient = pick$1(input, "Recipient", "recipient", "to");
+			return {
+				card: "generic",
+				title: pick$1(input, "Description", "description", "toolAction", "toolSummary") ?? (recipient ? `Message subagent ${recipient}` : "Send message"),
+				kind: "other",
+				rawInput: input
 			};
 		}
 		case "generate_image": {
@@ -927,10 +1221,17 @@ function presentMirrorResult(args, result) {
 	switch (name) {
 		case "run_command":
 		case "bash":
-		case "execute_command": return {
-			card: "terminal",
-			output: text
-		};
+		case "execute_command": {
+			let exitCode;
+			const m = /The command exited with code (\d+)/i.exec(text);
+			if (m && m[1]) exitCode = parseInt(m[1], 10);
+			else if (result.isError) exitCode = 1;
+			return {
+				card: "terminal",
+				output: text,
+				...exitCode !== void 0 ? { exitCode } : {}
+			};
+		}
 		case "replace_file_content":
 		case "write_to_file":
 		case "write_file":
@@ -964,6 +1265,23 @@ function resultText$1(content) {
 function clip(s, max) {
 	return s.length > max ? s.slice(0, max) + "… (+" + (s.length - max) + " chars)" : s;
 }
+/** Short preview of the recorded step for the degraded-result message. */
+function stepLabel(toolName, input) {
+	if (toolName === "") return "";
+	return toolStepBrief(toolName, input);
+}
+/**
+* Degraded result for a mirrored step whose recording is gone (bridge
+* restarted, or the run was recycled while a wedged tool step held the span
+* for hours). It must NOT read like a harness error: the model used to
+* receive `no recorded agy run` and spent the whole turn reverse-engineering
+* this plugin instead of finishing the user's task (flash-blast incident,
+* 2026-10-10). The step really did run — only its replay is unavailable.
+*/
+function recordingUnavailable(step, toolName, input, reason) {
+	const label = stepLabel(toolName, input);
+	return "⚠ [agy bridge] This agy tool step executed, but its recorded output is no longer resident in the bridge (" + (reason !== void 0 && reason !== "" ? reason : "the step ran for a long time and the in-memory recording was recycled") + "). Nothing is wrong with the tool or the workspace, and there is nothing to debug here — do NOT investigate the bridge, its logs or this message; continue the user's task. If the output is needed, re-run the same operation as a new step. Step #" + step + (label !== "" ? ": " + label : "");
+}
 function defineAgyMirrorTool(deps) {
 	const enrichArgs = (args) => {
 		if (typeof args.tool === "string" && args.tool !== "") return args;
@@ -1013,11 +1331,15 @@ function defineAgyMirrorTool(deps) {
 			exec.signal;
 			const runId = typeof args.run === "string" ? args.run : "";
 			const step = typeof args.step === "number" ? args.step : -1;
-			typeof args.tool === "string" && args.tool;
+			const toolName = typeof args.tool === "string" ? args.tool : "";
+			const input = toolInput(args);
 			const rec = deps.runs.get(runId);
-			if (rec === void 0) throw new Error("agy_tool: no recorded agy run \"" + runId + "\" — this tool only replays bridge-recorded activity");
+			if (rec === void 0) return recordingUnavailable(step, toolName, input);
 			const t = rec.toolEventAt(step);
-			if (t === null) throw new Error("agy_tool: event " + step + " of run " + runId + " is not a completed tool step");
+			if (t === null) {
+				const reason = (step >= 0 && step < rec.length ? rec.eventAt(step) : void 0) === void 0 ? "the step index is outside this recording — the step has not been recorded (yet), or the bridge restarted" : "event #" + step + " in this recording is not a completed tool step";
+				return recordingUnavailable(step, toolName !== "" ? toolName : "unknown", input, reason);
+			}
 			if (t.error !== void 0) throw new Error("agy tool " + t.name + " failed: " + t.error);
 			const out = t.output;
 			if (out === void 0 || out === null) return "";
@@ -1057,7 +1379,17 @@ var EventMapper = class {
 	openAcc = "";
 	emittedByKey = /* @__PURE__ */ new Map();
 	announcedTools = /* @__PURE__ */ new Set();
+	pendingAnnounced = /* @__PURE__ */ new Set();
 	thinkingAnnounced = /* @__PURE__ */ new Set();
+	/**
+	* Steps whose banner already streamed WITHOUT prose (issue #43: desktop
+	* hosts with no sqlite reader). Separate from `thinkingAnnounced` on
+	* purpose: DB prose can resolve AFTER the banner streamed, and marking the
+	* step announced there would drop the real text (the exact regression
+	* issue #43 fixed). When prose arrives later it is appended WITHOUT the
+	* banner and the entry is consumed.
+	*/
+	bannerOnlyShown = /* @__PURE__ */ new Set();
 	bannerOnlyThinkingEmitted = false;
 	sawTextStep;
 	finished = false;
@@ -1118,12 +1450,21 @@ var EventMapper = class {
 	* banner. When real thought prose is present, place the banner and thought
 	* text on the same initial line so DSH's collapsed summary renders:
 	*   [agy thinking turn · *** thinking tokens] [Chain-of-Thought body]
+	*
+	* With `allowBannerOnly` the bare banner is emitted when the DB prose never
+	* arrived (desktop hosts without any sqlite reader, issue #43): the user
+	* then at least SEES that a thinking turn happened and how large it was —
+	* previously high-effort turns rendered nothing at all.
 	*/
-	*emitThinking(absIndex, thoughtTokens) {
+	*emitThinking(stepKey, absIndex, thoughtTokens, allowBannerOnly = false) {
 		const text = this.opts.resolvedThoughts?.get(absIndex);
-		if (!(text !== void 0 && text.trim() !== "")) return;
+		const hasText = text !== void 0 && text.trim() !== "";
+		if (!hasText && !allowBannerOnly) return;
+		const bannerAlreadyShown = this.bannerOnlyShown.has(stepKey);
+		if (hasText) this.bannerOnlyShown.delete(stepKey);
 		yield* this.ensureBlock("reasoning");
-		const combined = `${thoughtTokens > 0 ? "[agy thinking turn · " + thoughtTokens + " thinking tokens]" : "[agy thinking turn]"} ${text.trim()}\n`;
+		const banner = thoughtTokens > 0 ? "[agy thinking turn · " + thoughtTokens + " thinking tokens]" : "[agy thinking turn]";
+		const combined = !hasText ? `${banner}\n` : bannerAlreadyShown ? `${text.trim()}\n` : `${banner} ${text.trim()}\n`;
 		const d = this.appendDelta(combined);
 		if (d) yield d;
 	}
@@ -1142,19 +1483,26 @@ var EventMapper = class {
 				const thoughtTokens = ev.usage?.thinking_tokens ?? 0;
 				const stepTextEmitted = (this.emittedByKey.get(ev.stepKey) ?? "") !== "";
 				const dbThought = this.opts.resolvedThoughts?.get(absIndex);
-				const shouldAnnounce = dbThought !== void 0 && dbThought.trim() !== "" || thoughtTokens > 0;
-				if (shouldAnnounce && !stepTextEmitted && !this.thinkingAnnounced.has(ev.stepKey)) {
+				const hasRealThought = dbThought !== void 0 && dbThought.trim() !== "";
+				if (hasRealThought && !stepTextEmitted && !this.thinkingAnnounced.has(ev.stepKey)) {
 					this.thinkingAnnounced.add(ev.stepKey);
-					yield* this.emitThinking(absIndex, thoughtTokens);
+					yield* this.emitThinking(ev.stepKey, absIndex, thoughtTokens);
 				}
-				const deferred = shouldAnnounce && stepTextEmitted && !this.thinkingAnnounced.has(ev.stepKey);
+				const deferred = hasRealThought && stepTextEmitted && !this.thinkingAnnounced.has(ev.stepKey);
 				if (ev.text === "" && !ev.fragment) {
 					if (deferred) {
 						this.thinkingAnnounced.add(ev.stepKey);
-						yield* this.emitThinking(absIndex, thoughtTokens);
+						yield* this.emitThinking(ev.stepKey, absIndex, thoughtTokens);
+					} else if (!this.sawTextStep && thoughtTokens > 0 && !this.thinkingAnnounced.has(ev.stepKey)) {
+						this.bannerOnlyShown.add(ev.stepKey);
+						yield* this.emitThinking(ev.stepKey, absIndex, thoughtTokens, true);
 					}
 					return;
 				}
+				if (!hasRealThought && !this.sawTextStep && thoughtTokens > 0 && !this.thinkingAnnounced.has(ev.stepKey)) {
+					this.bannerOnlyShown.add(ev.stepKey);
+					yield* this.emitThinking(ev.stepKey, absIndex, thoughtTokens, true);
+				}
 				this.sawTextStep = true;
 				yield* this.ensureBlock("text");
 				let d;
@@ -1170,7 +1518,7 @@ var EventMapper = class {
 				if (d) yield d;
 				if (deferred) {
 					this.thinkingAnnounced.add(ev.stepKey);
-					yield* this.emitThinking(absIndex, thoughtTokens);
+					yield* this.emitThinking(ev.stepKey, absIndex, thoughtTokens);
 				}
 				return;
 			}
@@ -1190,13 +1538,25 @@ var EventMapper = class {
 						if (d) yield d;
 					}
 				} else {
-					const d = this.appendDelta("[agy subagent] " + ev.text + "\n");
+					const prev = this.emittedByKey.get(ev.stepKey) ?? "";
+					const deltaText = suffixDelta(prev, ev.text);
+					this.emittedByKey.set(ev.stepKey, ev.text);
+					const banner = prev === "" ? "[agy subagent] " : "";
+					const d = this.appendDelta(banner + deltaText);
 					if (d) yield d;
 				}
 				return;
 			}
 			if (ev.stepKind === "tool" && ev.tool) {
-				if (!(ev.state === "DONE" || ev.state === "ERROR" || ev.state === void 0 && (ev.tool.output !== void 0 || ev.tool.error !== void 0))) return;
+				if (!(ev.state === "DONE" || ev.state === "ERROR" || ev.state === void 0 && (ev.tool.output !== void 0 || ev.tool.error !== void 0))) {
+					if (this.opts.cutOnTool && !this.finished && ev.state === "ACTIVE" && !this.pendingAnnounced.has(ev.stepKey)) {
+						this.pendingAnnounced.add(ev.stepKey);
+						yield* this.ensureBlock("reasoning");
+						const d = this.appendDelta("[agy tool running: " + ev.tool.name + " — the result card streams when it finishes]\n");
+						if (d) yield d;
+					}
+					return;
+				}
 				if (this.announcedTools.has(ev.stepKey)) return;
 				this.announcedTools.add(ev.stepKey);
 				if (!this.opts.cutOnTool) return;
@@ -1232,9 +1592,10 @@ var EventMapper = class {
 					}
 				};
 				this.blockIdx++;
+				const trackedCut = this.opts.usage?.finalUsage({});
 				yield {
 					type: "usage",
-					usage: {
+					usage: trackedCut !== void 0 && Object.keys(trackedCut).length > 0 ? usageFromRaw(trackedCut) : {
 						inputTokens: 0,
 						outputTokens: 0
 					}
@@ -1292,14 +1653,22 @@ var EventMapper = class {
 		};
 		this.finished = true;
 	}
-	/** Terminal error/abort: close what is open, zero usage, failure finish. */
+	/**
+	* Terminal error/abort: close what is open and finish with the failure.
+	*
+	* The usage sample is the last per-call context size when agy reported one,
+	* NOT a hard-coded 0/0: DSH's token meter treats the last sample as current
+	* context occupancy, so a failed turn used to reset the meter and could fire
+	* a bogus compaction a step later.
+	*/
 	*emitFailure(kind, code, message) {
 		if (this.finished) return;
 		const close = this.closeOpen();
 		if (close) yield close;
+		const tracked = this.opts.usage?.finalUsage({});
 		yield {
 			type: "usage",
-			usage: {
+			usage: tracked !== void 0 && Object.keys(tracked).length > 0 ? usageFromRaw(tracked) : {
 				inputTokens: 0,
 				outputTokens: 0
 			}
@@ -1475,11 +1844,49 @@ function buildFallbackCatalog(defs) {
 		efforts: Array.isArray(d.efforts) && d.efforts.length > 0 ? d.efforts.filter((e) => typeof e === "string" && e.trim() !== "") : null
 	}));
 }
-var ModelCatalog = class {
+/**
+* Sanitized (id, name) projection of a catalog: trimmed non-empty ids with
+* first occurrence winning — exactly what listModels serves to DSH. Shared
+* with the settings UI's model-visibility list so the picker and the UI can
+* never disagree about which models exist.
+*/
+function sanitizeCatalogEntries(models) {
+	const seen = /* @__PURE__ */ new Set();
+	const entries = [];
+	const dropped = [];
+	for (const m of models) {
+		if (!m || typeof m.id !== "string") continue;
+		const id = m.id.trim();
+		if (id === "") continue;
+		if (seen.has(id)) {
+			dropped.push(id);
+			continue;
+		}
+		seen.add(id);
+		const name = typeof m.name === "string" && m.name.trim() !== "" ? m.name.trim() : id;
+		entries.push({
+			id,
+			name
+		});
+	}
+	return {
+		entries,
+		dropped
+	};
+}
+var ModelCatalog = class ModelCatalog {
 	discover;
 	ttlMs;
 	current;
 	refreshing = null;
+	/**
+	* While the catalog is still on the fallback source, re-probe at most once
+	* per this interval: `agy models` costs a 30s-capped spawn, and with the
+	* user signed out EVERY listModels call (picker open, resolveModel, stream)
+	* used to trigger one — a spawn storm that never converged.
+	*/
+	static FALLBACK_RETRY_MS = 6e4;
+	lastAttemptAt = 0;
 	constructor(discover, fallbackDefs, ttlMs) {
 		this.discover = discover;
 		this.ttlMs = ttlMs;
@@ -1495,8 +1902,11 @@ var ModelCatalog = class {
 	/** Refresh if stale; never throws — failures keep the previous catalog. */
 	async refreshIfNeeded() {
 		if (this.refreshing) return this.refreshing;
-		const age = Date.now() - this.current.discoveredAt;
+		const now = Date.now();
+		const age = now - this.current.discoveredAt;
 		if (this.current.source === "discovered" && age < this.ttlMs) return;
+		if (this.current.source === "fallback" && now - this.lastAttemptAt < ModelCatalog.FALLBACK_RETRY_MS) return;
+		this.lastAttemptAt = now;
 		this.refreshing = this.refresh().finally(() => {
 			this.refreshing = null;
 		});
@@ -1844,6 +2254,7 @@ var StreamJsonParser = class {
 		consecutiveGarbage: 0,
 		authUrl: void 0,
 		sawAuthFailure: false,
+		authFailureText: void 0,
 		lastResultError: void 0
 	};
 	/** Ring buffer of raw stdout lines for /agy doctor export. */
@@ -1875,7 +2286,11 @@ var StreamJsonParser = class {
 		this.stats.lines++;
 		this.recentLines.push(line);
 		if (this.recentLines.length > this.maxRecent) this.recentLines.splice(0, this.recentLines.length - this.maxRecent);
-		if (looksLikeAuthFailure(line)) this.stats.sawAuthFailure = true;
+		if (looksLikeAuthFailure(line)) {
+			this.stats.sawAuthFailure = true;
+			const prev = this.stats.authFailureText ?? "";
+			if (prev.length < 600) this.stats.authFailureText = (prev === "" ? "" : prev + " ") + line.trim().slice(0, 300);
+		}
 		if (this.stats.authUrl === void 0) {
 			const u = extractAuthUrl(line);
 			if (u) this.stats.authUrl = u;
@@ -2193,20 +2608,17 @@ function ensureIsolatedKeychain(dir, platform = process.platform, run = (file, a
 	if (platform !== "darwin") return false;
 	if (dir === "") return false;
 	const kc = join(dir, "Library", "Keychains", "login.keychain-db");
+	if (existsSync(kc)) return false;
 	try {
 		const env = {
 			...process.env,
 			HOME: dir
 		};
-		if (existsSync(kc)) {
-			run("security", ["set-keychain-settings", kc], env);
-			return false;
-		}
 		mkdirSync(join(dir, "Library", "Keychains"), { recursive: true });
 		run("security", [
 			"create-keychain",
 			"-p",
-			randomBytes(18).toString("base64url"),
+			"",
 			kc
 		], env);
 		run("security", [
@@ -2215,6 +2627,12 @@ function ensureIsolatedKeychain(dir, platform = process.platform, run = (file, a
 			kc
 		], env);
 		run("security", ["set-keychain-settings", kc], env);
+		run("security", [
+			"unlock-keychain",
+			"-p",
+			"",
+			kc
+		], env);
 		return true;
 	} catch {
 		return false;
@@ -2379,9 +2797,24 @@ function killTree(child) {
 		escalating.delete(child);
 	});
 }
+/**
+* Environment for spawning a script through `process.execPath`.
+*
+* In the packaged desktop host `process.execPath` is the **Electron binary**,
+* not node: without this flag the child would boot a second GUI instance
+* instead of executing the script. Plain node ignores the variable, so the
+* POSIX/test paths are unaffected.
+*/
+function nodeScriptEnv(env) {
+	return {
+		...env,
+		ELECTRON_RUN_AS_NODE: "1"
+	};
+}
 function startAgyProcess(opts) {
 	const started = Date.now();
 	const viaCmd = IS_WIN && isCmdShim(opts.bin);
+	const isNode = IS_WIN && /\.(mjs|js|cjs)$/i.test(opts.bin);
 	const env = withAgyQuietEnv(opts.env ?? process.env);
 	const child = viaCmd ? spawn(process.env.ComSpec ?? "cmd.exe", [
 		"/d",
@@ -2398,6 +2831,15 @@ function startAgyProcess(opts) {
 		],
 		windowsVerbatimArguments: true,
 		windowsHide: true
+	}) : isNode ? spawn(process.execPath, [opts.bin, ...opts.args], {
+		cwd: opts.cwd,
+		env: nodeScriptEnv(env),
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		],
+		windowsHide: true
 	}) : spawn(opts.bin, opts.args, {
 		cwd: opts.cwd,
 		env,
@@ -2521,6 +2963,10 @@ async function probeProcess(bin, args, timeoutMs = 3e4, signal, env) {
 var SessionStore = class {
 	file;
 	data = {};
+	/** Keys written by THIS process since the last persist. */
+	dirty = /* @__PURE__ */ new Set();
+	/** Keys deleted by THIS process since the last persist. */
+	removed = /* @__PURE__ */ new Set();
 	constructor(file) {
 		this.file = file;
 		this.load();
@@ -2537,26 +2983,54 @@ var SessionStore = class {
 	}
 	set(key, b) {
 		this.data[key] = b;
+		this.dirty.add(key);
+		this.removed.delete(key);
 		this.persist();
 	}
 	delete(key) {
 		delete this.data[key];
+		this.dirty.delete(key);
+		this.removed.add(key);
 		this.persist();
 	}
 	clear() {
+		for (const key of Object.keys(this.data)) this.removed.add(key);
 		this.data = {};
+		this.dirty.clear();
 		this.persist();
 	}
 	all() {
 		return this.data;
 	}
-	/** Atomic write: tmp file + rename, then merge on next load. */
+	/**
+	* Atomic write: tmp file + rename, MERGING with whatever another host
+	* process wrote in the meantime (web + headless share this file). Only the
+	* keys this process touched are overwritten and only the keys it deleted are
+	* dropped, so a concurrent writer's bindings survive instead of being
+	* clobbered — which used to cost a session its agy conversation (fresh
+	* digest-only prompt, or a binding pointing at the wrong conversation).
+	*/
 	persist() {
 		try {
 			mkdirSync(dirname(this.file), { recursive: true });
+			let merged = {};
+			if (this.dirty.size > 0 || this.removed.size > 0) try {
+				if (existsSync(this.file)) {
+					const onDisk = JSON.parse(readFileSync(this.file, "utf8"));
+					if (onDisk && typeof onDisk === "object") merged = onDisk;
+				}
+			} catch {}
+			for (const key of this.removed) delete merged[key];
+			for (const key of this.dirty) {
+				const b = this.data[key];
+				if (b !== void 0) merged[key] = b;
+			}
 			const tmp = join(dirname(this.file), "." + require$$basename(this.file) + ".tmp");
-			writeFileSync(tmp, JSON.stringify(this.data, null, 2), "utf8");
+			writeFileSync(tmp, JSON.stringify(merged, null, 2), "utf8");
 			renameSync(tmp, this.file);
+			this.data = merged;
+			this.dirty.clear();
+			this.removed.clear();
 		} catch {}
 	}
 };
@@ -2621,6 +3095,20 @@ const TOOL_STEP_TYPES = /* @__PURE__ */ new Set([
 const MAX_CACHE_AGE_MS = 3e5;
 let cache = null;
 let cacheTime = 0;
+/**
+* Failure backoff state. Without it, a missing `sqlite3` binary (or an
+* oversized/locked DB) made EVERY step event re-spawn sqlite3: the empty
+* result was cached as `loaded: true` with empty maps, every new stepIndex
+* missed, and the spawn storm repeated for the whole session with no log.
+*  - ENOENT (binary absent): negative-cache for the full cache window.
+*  - Other failures (lock, maxBuffer, parse): short backoff so the adapter's
+*    deliberate 50-100ms WAL-flush retries still get a fresh chance.
+*/
+let lastFailureAt = 0;
+let failureWindowMs = 0;
+let warnedUnavailable = false;
+/** In-flight loader: parallel readFullToolArgs/readStepThoughts share one spawn. */
+let loadInFlight = null;
 /** agy conversation ids are path-safe tokens; reject anything else before join(). */
 const SAFE_CONVERSATION_ID = /^[A-Za-z0-9_-]{1,64}$/;
 function isSafeConversationId(id) {
@@ -2753,8 +3241,37 @@ function extractStepThoughts(payload) {
 	return null;
 }
 /**
+* node:sqlite reader (Node >= 22.5, REQUIRED node >= 24 for this plugin).
+* Preferred over the sqlite3 CLI: GUI/desktop hosts often lack the CLI on
+* PATH (macOS GUI apps do not inherit the shell PATH; Windows never ships
+* one), which is exactly the "thinking/tool args invisible on desktop"
+* report (issue #43). `undefined` = not probed yet, `null` = unavailable.
+*/
+let nodeSqliteQuery;
+async function queryViaNodeSqlite(dbPath, sql) {
+	if (nodeSqliteQuery === null) throw new Error("node:sqlite unavailable");
+	if (nodeSqliteQuery === void 0) try {
+		const mod = await import("node:sqlite");
+		if (typeof mod.DatabaseSync !== "function") throw new Error("DatabaseSync missing");
+		const Database = mod.DatabaseSync;
+		nodeSqliteQuery = async (p, q) => {
+			const db = new Database(p);
+			try {
+				return db.prepare(q).all().map((r) => `${String(r.idx)}|${String(r.step_type)}|${typeof r.payload_hex === "string" ? r.payload_hex : ""}`);
+			} finally {
+				db.close();
+			}
+		};
+	} catch (err) {
+		nodeSqliteQuery = null;
+		throw err instanceof Error ? err : new Error(String(err));
+	}
+	return nodeSqliteQuery(dbPath, sql);
+}
+/**
 * Copy the agy SQLite DB to a temp path (avoiding WAL lock issues), then
-* query tool and thought step payloads via sqlite3 CLI.
+* query tool and thought step payloads — node:sqlite first, sqlite3 CLI as
+* the fallback reader.
 */
 async function loadAgyDbData(conversationId, accountHome) {
 	const steps = /* @__PURE__ */ new Map();
@@ -2771,21 +3288,37 @@ async function loadAgyDbData(conversationId, accountHome) {
 		thoughts,
 		seenSteps
 	};
+	let tmpDir = null;
 	const tmpDb = join(tmpdir(), `agy-db-${conversationId.slice(0, 8)}-${Date.now()}.db`);
 	try {
-		await copyFile(dbPath, tmpDb);
+		tmpDir = await mkdtemp(join(tmpdir(), "agy-db-"));
+		const target = join(tmpDir, "conversation.db");
+		await copyFile(dbPath, target);
+		await chmod(target, 384).catch(() => void 0);
 		try {
-			await copyFile(dbPath + "-wal", tmpDb + "-wal");
+			await copyFile(dbPath + "-wal", target + "-wal");
 		} catch {}
 		try {
-			await copyFile(dbPath + "-shm", tmpDb + "-shm");
+			await copyFile(dbPath + "-shm", target + "-shm");
 		} catch {}
-		const { stdout } = await execFileAsync("sqlite3", [tmpDb, `SELECT idx, step_type, hex(step_payload) FROM steps WHERE (step_type IN (5,7,8,9,14,15,17,21,33,101,132,138,139)) AND length(step_payload) > 20`], {
-			timeout: 5e3,
-			encoding: "utf-8",
-			maxBuffer: 26214400
-		});
-		for (const line of stdout.split("\n")) {
+		const sql = `SELECT idx, step_type, hex(step_payload) AS payload_hex FROM steps WHERE (step_type IN (5,7,8,9,14,15,17,21,33,101,132,138,139)) AND length(step_payload) > 20`;
+		let lines = null;
+		try {
+			lines = await queryViaNodeSqlite(target, sql);
+		} catch {
+			try {
+				const { stdout } = await execFileAsync("sqlite3", [target, sql], {
+					timeout: 5e3,
+					encoding: "utf-8",
+					maxBuffer: 26214400
+				});
+				lines = stdout.split("\n");
+			} catch {
+				lines = null;
+			}
+		}
+		if (lines === null) throw new Error("no sqlite reader available (node:sqlite and sqlite3 CLI both failed)");
+		for (const line of lines) {
 			const firstPipe = line.indexOf("|");
 			if (firstPipe < 0) continue;
 			const secondPipe = line.indexOf("|", firstPipe + 1);
@@ -2806,16 +3339,37 @@ async function loadAgyDbData(conversationId, accountHome) {
 				if (th !== null && th.trim() !== "" && !/^SYSTEM ROLE/i.test(th.trim())) thoughts.set(idx, th);
 			}
 		}
-	} catch {} finally {
-		try {
-			await unlink(tmpDb);
-		} catch {}
-		try {
-			await unlink(tmpDb + "-wal");
-		} catch {}
-		try {
-			await unlink(tmpDb + "-shm");
+		lastFailureAt = 0;
+		failureWindowMs = 0;
+	} catch (err) {
+		const code = err.code;
+		if (code === "ENOENT") failureWindowMs = MAX_CACHE_AGE_MS;
+		else failureWindowMs = 300;
+		lastFailureAt = Date.now();
+		if (!warnedUnavailable) {
+			warnedUnavailable = true;
+			try {
+				console.error("[dsh-agy-link] agy conversation DB unavailable (" + String(err) + ") — falling back to stream-carried metadata only" + (code === "ENOENT" ? "; install the sqlite3 CLI for full tool args and thoughts" : ""));
+			} catch {}
+		}
+	} finally {
+		if (tmpDir !== null) try {
+			await rm(tmpDir, {
+				recursive: true,
+				force: true
+			});
 		} catch {}
+		else {
+			try {
+				await unlink(tmpDb);
+			} catch {}
+			try {
+				await unlink(tmpDb + "-wal");
+			} catch {}
+			try {
+				await unlink(tmpDb + "-shm");
+			} catch {}
+		}
 	}
 	return {
 		steps,
@@ -2939,6 +3493,38 @@ function scanFallbackJson(payload) {
 	return null;
 }
 /**
+* Shared loader behind readFullToolArgs/readStepThoughts: deduplicates
+* concurrent callers into ONE spawn, and honors the failure backoff so a
+* missing/failing sqlite3 cannot turn every step event into a re-spawn.
+*/
+async function loadCached(conversationId, accountHome) {
+	const now = Date.now();
+	if (lastFailureAt !== 0 && now - lastFailureAt < failureWindowMs) return;
+	const key = conversationId + "|" + (accountHome ?? "");
+	if (loadInFlight !== null && loadInFlight.key === key) {
+		await loadInFlight.promise;
+		return;
+	}
+	const promise = loadAgyDbData(conversationId, accountHome);
+	loadInFlight = {
+		key,
+		promise
+	};
+	try {
+		const data = await promise;
+		cache = {
+			conversationId,
+			steps: data.steps,
+			thoughts: data.thoughts,
+			checkedSteps: data.seenSteps,
+			loaded: true
+		};
+		cacheTime = now;
+	} finally {
+		if (loadInFlight !== null && loadInFlight.promise === promise) loadInFlight = null;
+	}
+}
+/**
 * Read the full tool parameter object for a given step index from the agy
 * conversation database. Returns null when the DB is unavailable or does
 * not contain the requested step.
@@ -2954,16 +3540,8 @@ async function readFullToolArgs(conversationId, stepIndex, accountHome) {
 		if (cached !== void 0) return cached;
 		if (cache.checkedSteps.has(stepIndex)) return null;
 	}
-	const data = await loadAgyDbData(conversationId, accountHome);
-	cache = {
-		conversationId,
-		steps: data.steps,
-		thoughts: data.thoughts,
-		checkedSteps: data.seenSteps,
-		loaded: true
-	};
-	cacheTime = now;
-	return data.steps.get(stepIndex) ?? null;
+	await loadCached(conversationId, accountHome);
+	return cache?.steps.get(stepIndex) ?? null;
 }
 /**
 * Read the full thought/reasoning text for a given step index from the agy
@@ -2978,16 +3556,8 @@ async function readStepThoughts(conversationId, stepIndex, accountHome) {
 		if (cached !== void 0) return cached;
 		if (cache.checkedSteps.has(stepIndex)) return null;
 	}
-	const data = await loadAgyDbData(conversationId, accountHome);
-	cache = {
-		conversationId,
-		steps: data.steps,
-		thoughts: data.thoughts,
-		checkedSteps: data.seenSteps,
-		loaded: true
-	};
-	cacheTime = now;
-	return data.thoughts.get(stepIndex) ?? null;
+	await loadCached(conversationId, accountHome);
+	return cache?.thoughts.get(stepIndex) ?? null;
 }
 //#endregion
 //#region src/host/adapter.ts
@@ -3035,22 +3605,85 @@ function textOf(m) {
 	walk(m.content);
 	return parts.filter((s) => s !== "").join("\n");
 }
-function isForeignAssistant(m) {
+function isForeignAssistant(m, currentConvId) {
 	if (m.role !== "assistant") return false;
 	const src = m.source;
-	return !src || src.provider !== "antigravity";
+	if (!src || src.provider !== "antigravity") return true;
+	if (currentConvId) {
+		const replayConvId = src.replayState && typeof src.replayState === "object" ? src.replayState.response?.conversationId : void 0;
+		if (typeof replayConvId === "string" && replayConvId !== "" && replayConvId !== currentConvId) return true;
+	}
+	return false;
+}
+/**
+* Detect synthetic harness messages injected by DSH.
+*
+* DSH injects runtime telemetry and reminder blocks with `role: 'user'`, such as:
+* - time-context: "Time sampled while preparing turn X, step Y: ..."
+* - skill-catalog: "<system-reminder>\nA skill is a reusable set..."
+* - runtime-context: "Current runtime context. This snapshot supersedes..."
+* - model-selection: "[model changed: ...]"
+* - system-reminder: "<system-reminder>..."
+*
+* These are harness infrastructure, NEVER real human user tasks. If treated
+* as a user task, they overwrite the user's actual instruction with a timestamp
+* or reminder block, causing agy to completely ignore the user's latest input
+* (e.g. session-c65a826e where 42 time samples were appended).
+*/
+function isSyntheticHarnessMessage(m) {
+	if (isToolResultMessage(m)) return false;
+	const src = m.source;
+	const kind = src?.kind;
+	if (kind !== void 0 && kind !== "" && kind !== "user") {
+		if (kind === "time-context" || kind === "skill-catalog" || kind === "runtime-context" || kind === "model-selection" || kind === "system-reminder" || kind === "dsh-session-title-llm" || kind === "synthetic") return true;
+		if (kind === "plugin" && src.form === "snapshot") return true;
+	}
+	const text = textOf(m).trim();
+	if (text.startsWith("Time sampled while preparing") || text.startsWith("<system-reminder>") || text.startsWith("Current runtime context") || text.startsWith("[model changed:") || text.startsWith("[conversation so far]") || text.startsWith("A skill is a reusable set of task-specific instructions")) return true;
+	return false;
 }
 /**
-* Latest real human turn (not a tool result, not assistant). This is the
-* live task; a digest or tool-result-only trailing span must never drop it
+* Latest real human turn (not a tool result, not assistant, not harness metadata).
+* This is the live task; a digest or tool-result-only trailing span must never drop it
 * (issue #35: "续跑提示词里没有任务").
 */
 function latestUserTaskText(messages) {
 	for (let i = messages.length - 1; i >= 0; i--) {
 		const m = messages[i];
-		if (m === void 0 || m.role === "system" || m.role === "assistant") continue;
-		if (isToolResultMessage(m)) continue;
-		const text = textOf(m);
+		if (m === void 0) continue;
+		if (isSyntheticHarnessMessage(m)) continue;
+		if (isToolResultMessage(m) || m.role === "assistant" || m.role === "system") continue;
+		if (m.role === "user") return textOf(m).trim();
+	}
+	return "";
+}
+/**
+* Last user message REGARDLESS of the synthetic-looking prefix heuristics,
+* searched only within the TRAILING span (after the last assistant message).
+*
+* The sniffing exists so harness telemetry (time samples, skill catalogs,
+* `<system-reminder>` snapshots) never overwrites a REAL task. But when the
+* synthetic-looking message is the ONLY user content of the turn — the user
+* pasted a reminder block to ask about it — filtering it left the turn with
+* no task at all ("request carries no user text"). Callers fall back to this.
+*
+* The span bound keeps the image-only regression fixed: a trailing
+* image-only turn must NOT rescue an older question from before the last
+* assistant reply, exactly as latestUserTaskText refuses to.
+*/
+function latestUserMessageAny(messages) {
+	let lastAssistantIdx = -1;
+	for (let i = messages.length - 1; i >= 0; i--) {
+		const m = messages[i];
+		if (m !== void 0 && m.role === "assistant") {
+			lastAssistantIdx = i;
+			break;
+		}
+	}
+	for (let i = messages.length - 1; i > lastAssistantIdx; i--) {
+		const m = messages[i];
+		if (m === void 0 || m.role !== "user" || isToolResultMessage(m)) continue;
+		const text = textOf(m).trim();
 		if (text !== "") return text;
 	}
 	return "";
@@ -3128,6 +3761,7 @@ function buildDigest(messages, fromIdx, maxChars) {
 	for (let i = fromIdx; i < messages.length; i++) {
 		const m = messages[i];
 		if (m === void 0 || m.role === "system") continue;
+		if (isSyntheticHarnessMessage(m)) continue;
 		const text = textOf(m);
 		if (text === "") continue;
 		if (taskLine !== "" && !isToolResultMessage(m) && m.role === "user" && text === taskText) continue;
@@ -3196,12 +3830,17 @@ function sawAuthFailure(parser, outcome) {
 /**
 * Bounded wait for an aborted run to settle, so a steer replacement never
 * overlaps the process it just killed on the same agy conversation.
+* Returns whether the run actually settled before the deadline.
 */
 async function waitForRunSettle(run, timeoutMs) {
 	const deadline = Date.now() + timeoutMs;
-	while (!run.isSettled && Date.now() < deadline) await new Promise((r) => setTimeout(r, 50));
+	while (Date.now() < deadline) {
+		if (run.isSettled) return true;
+		await new Promise((r) => setTimeout(r, 50));
+	}
+	return run.isSettled;
 }
-var AgyAdapter = class extends LlmAdapter {
+var AgyAdapter = class AgyAdapter extends LlmAdapter {
 	deps;
 	warnedKeys = /* @__PURE__ */ new Set();
 	/** sessionKey -> in-flight run, for steer-time preemption. */
@@ -3217,6 +3856,32 @@ var AgyAdapter = class extends LlmAdapter {
 	minSpawnIntervalMs = 500;
 	/** Global sliding window timestamps for batch rate-limiting protection */
 	requestTimestamps = [];
+	/**
+	* sessionKey -> account failovers claimed inside the current window.
+	*
+	* A settled recording that died of an ACCOUNT-scoped failure is retried on
+	* another account instead of being replayed (post-tool quota exhaustion used
+	* to dead-end the turn). That retry happens inside one DSH step, so DSH's own
+	* retry budget cannot bound it: without this counter a soft capacity refusal
+	* (which cools nothing) would rotate A→B→C→A…, re-running the user's tools on
+	* every cycle.
+	*/
+	failoverBudget = /* @__PURE__ */ new Map();
+	static FAILOVER_WINDOW_MS = 12e4;
+	/**
+	* Same shape, but for HARD rate-limit hops only. A hard 429 gives the failed
+	* account a cooldown of at least the server-quoted reset (default 10m), so
+	* each claim provably makes progress and cannot loop. The generic 120s/2-hop
+	* budget above exists to stop SOFT failures (which cool nothing) from
+	* rotating forever — but a long-running turn's quota failures arrive spread
+	* over minutes (observed live: 429 at 20:28 with "Resets in 11m", further
+	* hops at 20:28:43 and 20:29:17), so the tight window spent itself while a
+	* full-quota account sat idle and the turn dead-ended (2026-10-10 20:29).
+	* Rate-limit hops get their own pool-depth budget over a window as long as
+	* the default cooldown, refreshed on every fresh failure.
+	*/
+	rateLimitFailover = /* @__PURE__ */ new Map();
+	static RATE_LIMIT_FAILOVER_WINDOW_MS = 6e5;
 	constructor(deps) {
 		super();
 		this.deps = deps;
@@ -3237,25 +3902,69 @@ var AgyAdapter = class extends LlmAdapter {
 		});
 	}
 	/**
-	* Fail fast on auth and abort; allow one retry for transient process
-	* failures (timeout, crash, malformed stream) per ADR-11.
+	* Claim one account failover for a session, bounded by the pool's spare
+	* depth ((enabled accounts - 1) inside a short window). Returns false when
+	* the failure is not account-scoped or the budget is spent — the caller then
+	* replays the recorded failure so the turn ends with the real error.
+	*/
+	claimFailover(sessionKey, code) {
+		if (!isAccountScopedFailure(code)) return false;
+		const enabled = (this.deps.pool?.getAccounts() ?? []).filter((a) => a.enabled).length;
+		const max = Math.max(1, enabled - 1);
+		const now = Date.now();
+		if (code === Err.RATE_LIMIT) {
+			const prevRl = this.rateLimitFailover.get(sessionKey);
+			const freshRl = prevRl === void 0 || now - prevRl.firstAt > AgyAdapter.RATE_LIMIT_FAILOVER_WINDOW_MS;
+			const countRl = freshRl ? 0 : prevRl.count;
+			if (countRl >= max) return false;
+			this.rateLimitFailover.set(sessionKey, {
+				count: countRl + 1,
+				firstAt: freshRl ? now : prevRl.firstAt
+			});
+			return true;
+		}
+		const prev = this.failoverBudget.get(sessionKey);
+		const fresh = prev === void 0 || now - prev.firstAt > AgyAdapter.FAILOVER_WINDOW_MS;
+		const count = fresh ? 0 : prev.count;
+		if (count >= max) return false;
+		this.failoverBudget.set(sessionKey, {
+			count: count + 1,
+			firstAt: fresh ? now : prev.firstAt
+		});
+		return true;
+	}
+	/**
+	* Fail fast on auth and abort; allow retries for transient process failures
+	* (timeout, crash, malformed stream) per ADR-11.
 	*
-	* RATE_LIMIT is retryable on purpose: the failed account was put into
-	* cooldown and the sticky pointer advanced before the error surfaced, so the
-	* retry is served by the NEXT account in the pool — quota exhaustion used to
-	* dead-end in a user-visible error even though a healthy account was idle.
+	* Account-scoped failures (RATE_LIMIT / ELIGIBILITY / NETWORK / OVERLOADED)
+	* are retryable on purpose: the failed account was cooled down or skipped and
+	* the sticky pointer advanced BEFORE the error surfaced, so the retry is
+	* served by the NEXT account in the pool — quota exhaustion used to dead-end
+	* in a user-visible error even though a healthy account was idle.
+	*
+	* The budget follows the pool: a 3-account pool gets 2 retries, because one
+	* hop is not enough to survive a spent account followed by a second account
+	* whose token expired mid-flight (observed live: primary ELIGIBILITY → g98
+	* "not signed in" → turn lost, 2026-10-10 14:17). A single-account pool keeps
+	* the old single retry.
 	*/
 	providerRetryPolicy(_provider) {
+		const enabledAccounts = (this.deps.pool?.getAccounts() ?? []).filter((a) => a.enabled).length;
+		const retryableCodes = [
+			Err.TIMEOUT,
+			Err.PROCESS_EXIT,
+			Err.INVALID_OUTPUT,
+			Err.RATE_LIMIT,
+			Err.ELIGIBILITY,
+			Err.NETWORK,
+			Err.OVERLOADED
+		];
+		if (enabledAccounts >= 2) retryableCodes.push(Err.AUTH);
 		return {
 			mode: "normal",
-			maxRetries: 1,
-			retryableCodes: [
-				Err.TIMEOUT,
-				Err.PROCESS_EXIT,
-				Err.INVALID_OUTPUT,
-				Err.RATE_LIMIT,
-				Err.ELIGIBILITY
-			],
+			maxRetries: enabledAccounts >= 3 ? 2 : 1,
+			retryableCodes,
 			initialDelayMs: 2e3,
 			maxDelayMs: 1e4,
 			jitterRatio: .1
@@ -3269,29 +3978,16 @@ var AgyAdapter = class extends LlmAdapter {
 	}
 	async listModels(_provider) {
 		this.deps.catalog.refreshIfNeeded();
-		const cat = this.deps.catalog.get();
-		const seen = /* @__PURE__ */ new Set();
-		const models = [];
-		const dropped = [];
-		for (const m of cat.models) {
-			if (!m || typeof m.id !== "string") continue;
-			const id = m.id.trim();
-			if (id === "") continue;
-			if (seen.has(id)) {
-				dropped.push(id);
-				continue;
-			}
-			seen.add(id);
-			const name = typeof m.name === "string" && m.name.trim() !== "" ? m.name.trim() : id;
-			models.push({
-				provider: PROVIDER_ID,
-				id,
-				name,
-				inputModalities: ["text", "image"]
-			});
-		}
+		const cfg = this.deps.getConfig();
+		const { entries, dropped } = sanitizeCatalogEntries(this.deps.catalog.get().models);
 		if (dropped.length > 0) this.warnOnce("catalog-dupes", "model catalog contained duplicate ids [" + dropped.join(", ") + "] — kept first occurrence so DSH does not drop the whole provider group (INVALID_CATALOG)");
-		return models;
+		const hidden = new Set(cfg.hiddenModels.map((s) => s.trim()));
+		return entries.filter((m) => !hidden.has(m.id)).map((m) => ({
+			provider: PROVIDER_ID,
+			id: m.id,
+			name: m.name,
+			inputModalities: ["text", "image"]
+		}));
 	}
 	async resolveModel(_provider, model, _signal) {
 		const cfg = this.deps.getConfig();
@@ -3372,10 +4068,12 @@ var AgyAdapter = class extends LlmAdapter {
 		const cfg = this.deps.getConfig();
 		const bin = this.deps.bin();
 		if (!bin) throw new LlmError("agy binary not found on PATH — install it via https://antigravity.google/docs/cli/install", Err.AGY_NOT_INSTALLED);
-		const isAux = options.purpose === "compaction" || options.purpose === "session-title";
-		if (isAux && !cfg.allowAuxiliary) throw new LlmError("auxiliary calls are disabled for the antigravity route (allowAuxiliary: false)", Err.AUX_DISABLED);
+		const isReview = typeof options.system === "string" && options.system.includes("REVIEW_POLICY");
+		const isAux = options.purpose === "compaction" || options.purpose === "session-title" || isReview;
+		if (isAux && !isReview && !cfg.allowAuxiliary) throw new LlmError("auxiliary calls are disabled for the antigravity route (allowAuxiliary: false)", Err.AUX_DISABLED);
 		const toolNames = new Set((options.tools ?? []).map((t) => t.name));
 		const isCodeMode = toolNames.has("run_code") && !toolNames.has("agy_tool");
+		const hasToolSupport = options.tools === void 0 || toolNames.has("agy_tool") || toolNames.has("run_code");
 		const sessionKey = options.sessionId !== void 0 ? String(options.sessionId) : "";
 		let workspaceRoot = cfg.workspaceRoot;
 		if (workspaceRoot === "") {
@@ -3389,28 +4087,15 @@ var AgyAdapter = class extends LlmAdapter {
 		const continuation = detectContinuation(options.messages);
 		if (continuation !== null) {
 			const rec = this.deps.runs.get(continuation.runId);
-			if (rec === void 0) {
-				yield {
-					type: "usage",
-					usage: {
-						inputTokens: 0,
-						outputTokens: 0
-					}
-				};
-				yield {
-					type: "finish",
-					reason: {
-						kind: "error",
-						failure: {
-							message: "agy run " + continuation.runId + " is no longer available (server restarted?) — please resend your message",
-							code: Err.AGY_ERROR
-						}
-					}
-				};
+			const deadFailure = rec !== void 0 && rec.isSettled ? rec.failureInfo : null;
+			if (rec !== void 0 && !(deadFailure !== null && this.claimFailover(sessionKey, deadFailure.code))) {
+				yield* this.driveSpan(rec, continuation.eventIndex + 1, hasToolSupport, isCodeMode);
 				return;
 			}
-			yield* this.driveSpan(rec, continuation.eventIndex + 1, true, isCodeMode);
-			return;
+			if (rec !== void 0) {
+				this.deps.runs.forget(continuation.runId);
+				this.warnOnce("dead-continuation:" + continuation.runId, "agy run " + continuation.runId + " settled in " + (deadFailure?.code ?? "") + " — retrying this step on another account instead of replaying it");
+			} else this.warnOnce("stale-continuation:" + continuation.runId, "agy run " + continuation.runId + " is no longer available in memory (server restarted?) — falling back to fresh turn prompt assembly");
 		}
 		const catalog = this.deps.catalog.get();
 		const rawModel = options.model;
@@ -3476,17 +4161,38 @@ var AgyAdapter = class extends LlmAdapter {
 				}
 			}
 			if (!account) {
-				const countdown = this.deps.pool.getEarliestResetCountdown(family);
-				const waitStr = countdown ? ` (earliest reset in ${Math.ceil(countdown / 1e3)}s)` : "";
-				throw new LlmError(`All Antigravity accounts in pool are in cooldown for ${family}${waitStr}. Add an account or wait for reset.`, Err.AGY_ERROR);
+				const pool = this.deps.pool;
+				const accounts = pool.getAccounts().filter((a) => a.enabled);
+				const cooling = accounts.filter((a) => pool.isAccountEligible(a, family) === false && !a.authRequired).length;
+				const signedOut = accounts.filter((a) => a.authRequired === true).length;
+				const countdown = pool.getEarliestAvailableCountdown?.(family) ?? pool.getEarliestResetCountdown(family);
+				if (countdown !== null && countdown > 0 && countdown <= 2e4) {
+					await new Promise((r) => setTimeout(r, countdown + 250));
+					account = pool.selectAccount(family);
+				}
+				if (!account) {
+					const why = signedOut > 0 && signedOut === accounts.length ? "every account needs a re-login (run /agy auth)" : `no account can serve ${family} right now (${cooling} in cooldown, ${signedOut} signed out)`;
+					const waitStr = countdown !== null && countdown > 0 ? ` (earliest reset in ${Math.ceil(countdown / 1e3)}s)` : "";
+					throw new LlmError(`All Antigravity accounts are unavailable: ${why}${waitStr}. Add an account, wait for reset, or run /agy clear-cooldown.`, Err.AGY_ERROR);
+				}
 			}
 		}
 		if (account && !isAux) this.deps.pool?.markAccountActive(account.id);
+		if (process.platform === "win32" && account && !account.systemHome && !isAux) this.warnOnce("win-keyring-slot:" + account.id, "Windows cannot isolate pool credentials: agy authenticates via the system-wide Credential Manager slot (gemini:antigravity), so this isolated account still uses the system login (issue #45 — see KNOWN-GAPS.md)");
 		const sessionAccountKey = account ? `${sessionKey}:${account.id}` : sessionKey;
 		let binding = sessionAccountKey !== "" ? this.deps.store.get(sessionAccountKey) : void 0;
+		if (binding === void 0 && sessionKey !== "") {
+			binding = this.deps.store.get(sessionKey);
+			if (binding === void 0 && account === void 0) {
+				for (const [k, b] of Object.entries(this.deps.store.all())) if (k.startsWith(`${sessionKey}:`)) {
+					binding = b;
+					break;
+				}
+			}
+		}
 		if (binding === void 0 && !isAux && sessionKey !== "") {
 			const live = this.activeRuns.get(sessionKey);
-			const liveCid = live !== void 0 && !live.isSettled ? live.conversationId : null;
+			const liveCid = live !== void 0 && !live.isSettled && (live.accountHome ?? "") === (account?.dir ?? "") ? live.conversationId : null;
 			if (liveCid) binding = {
 				conversationId: liveCid,
 				lastMessageCount: Math.max(0, lastAssistantIdx + 1),
@@ -3518,20 +4224,37 @@ var AgyAdapter = class extends LlmAdapter {
 			}
 			prompt = "[summarize this conversation for context compaction]\n\n" + parts.join("\n\n") + "\n\nProduce a compact summary that preserves decisions, file paths, and open tasks.";
 		} else {
-			const trailingText = trailingUser.map(textOf).filter((s) => s !== "");
-			const taskText = latestUserTaskText(messages);
+			const trailingStart = binding !== void 0 ? Math.max(Math.min(binding.lastMessageCount, messages.length), lastAssistantIdx + 1) : lastAssistantIdx + 1;
+			const effectiveTrailingUser = messages.slice(trailingStart).filter((m) => {
+				const role = m.role;
+				if (role !== "user" && role !== "tool") return false;
+				if (isSyntheticHarnessMessage(m)) return false;
+				return true;
+			});
+			const taskText = latestUserTaskText(messages) || latestUserMessageAny(messages);
+			const dropToolPayloads = binding !== void 0;
+			const trailingText = effectiveTrailingUser.filter((m) => !(dropToolPayloads && isToolResultMessage(m))).map(textOf).map((s) => s.trim()).filter((s) => s !== "");
 			const trailingJoined = trailingText.join("\n\n");
 			if (taskText !== "") prompt = trailingText.includes(taskText) || trailingJoined.includes(taskText) ? trailingJoined : trailingJoined === "" ? taskText : taskText + "\n\n" + trailingJoined;
 			else prompt = trailingJoined;
+			if (prompt === "" && dropToolPayloads && effectiveTrailingUser.length > 0) prompt = "[continue — the tool output for your last tool call is already in this conversation]";
 			if (binding === void 0 && lastAssistantIdx >= 0) prompt = buildDigest(messages, 0, cfg.contextTransferMaxChars) + prompt;
 			else if (binding !== void 0) {
 				const from = Math.min(binding.lastMessageCount, messages.length);
 				const end = Math.max(from, lastAssistantIdx + 1);
-				const span = messages.slice(from, end).filter((m) => m.role !== "assistant" || isForeignAssistant(m));
+				const currentConvId = binding.conversationId;
+				const span = messages.slice(from, end).filter((m) => m.role !== "assistant" || isForeignAssistant(m, currentConvId));
 				if (span.some((m) => m.role === "assistant")) prompt = buildDigest(span, 0, cfg.digestMaxChars) + prompt;
+				if (binding.interrupted === true) prompt = "[the previous turn was interrupted before it finished — do not continue or answer that unfinished work; respond only to the newest request below]\n\n" + prompt;
 			}
 		}
-		if (cfg.forwardSystemPrompt && options.system) prompt = "System instructions:\n" + options.system + "\n\n" + prompt;
+		if (cfg.forwardSystemPrompt) {
+			const sysInstruction = options.system || (() => {
+				const sm = messages.find((m) => m.role === "system");
+				return sm ? textOf(sm).trim() : "";
+			})();
+			if (sysInstruction) prompt = "System instructions:\n" + sysInstruction + "\n\n" + prompt;
+		}
 		let stagedDirs = [];
 		const newlySentImageIds = [];
 		if (!isAux) {
@@ -3562,18 +4285,39 @@ var AgyAdapter = class extends LlmAdapter {
 			const liveRun = this.activeRuns.get(sessionKey);
 			const runLive = liveRun !== void 0 && !liveRun.isSettled;
 			const samePrompt = prevPrompt !== void 0 && prevPrompt.prompt === prompt;
-			if (runLive && samePrompt) throw new LlmError("Duplicate request ignored: an identical request is already running for this session.", Err.BUSY);
+			if (runLive && samePrompt) {
+				const rescueFrom = liveRun.lastCutIndex !== null ? liveRun.lastCutIndex + 1 : null;
+				if (rescueFrom !== null) {
+					this.deps.log?.("duplicate-debounce rescue: identical prompt for a live agy run " + liveRun.runId + " — re-driving from event " + rescueFrom + " instead of throwing BUSY");
+					this.activeSessionPrompts.set(sessionKey, {
+						prompt,
+						startedAt: now,
+						inFlight: true
+					});
+					yield* this.driveSpan(liveRun, rescueFrom, hasToolSupport, isCodeMode);
+					return;
+				}
+				throw new LlmError("Duplicate request ignored: an identical request is already running for this session.", Err.BUSY);
+			}
 			if (samePrompt && prevPrompt !== void 0 && prevPrompt.inFlight && liveRun === void 0 && now - prevPrompt.startedAt < 2e3) throw new LlmError("Duplicate request ignored: an identical request is already running for this session.", Err.BUSY);
 			if (runLive && !samePrompt) {
-				const liveCid = liveRun.conversationId;
+				const liveCid = (liveRun.accountHome ?? "") === (account?.dir ?? "") ? liveRun.conversationId : null;
 				if (liveCid !== null && binding === void 0 && !isAux && sessionAccountKey !== "") binding = {
 					conversationId: liveCid,
 					lastMessageCount: Math.max(0, lastAssistantIdx + 1),
 					updatedAt: Date.now(),
-					model: currentModel
+					model: currentModel,
+					interrupted: true
 				};
-				liveRun.requestAbort?.();
-				await waitForRunSettle(liveRun, 3500);
+				else if (binding !== void 0) binding.interrupted = true;
+				if (liveRun.hasResult) {
+					if (!await waitForRunSettle(liveRun, 1500)) this.deps.log?.("previous agy run did not exit within 1.5s after producing its result — preempting it");
+				}
+				if (!liveRun.isSettled) {
+					liveRun.requestAbort?.();
+					if (!await waitForRunSettle(liveRun, 3500)) this.warnOnce("settle-timeout:" + sessionKey, "the preempted agy run did not exit within 3.5s — starting the replacement anyway; its late write-back is ignored because the newer run owns the session");
+					if (!prompt.includes("the previous turn was interrupted")) prompt = "[the previous turn was interrupted before it finished — do not continue or answer that unfinished work; respond only to the newest request below]\n\n" + prompt;
+				}
 			}
 			this.activeSessionPrompts.set(sessionKey, {
 				prompt,
@@ -3581,18 +4325,57 @@ var AgyAdapter = class extends LlmAdapter {
 				inFlight: true
 			});
 		}
-		const before = snapshotConversations();
 		const rec = this.deps.runs.create();
 		rec.accountHome = account && account.dir ? account.dir : void 0;
+		const conversationsDir = conversationsDirFor(rec.accountHome);
+		const before = snapshotConversations(conversationsDir);
 		const parser = new StreamJsonParser();
 		this.deps.onParser?.(parser);
 		let streamCid = null;
 		const openToolKeys = /* @__PURE__ */ new Set();
-		const printTimeoutMinutes = Math.max(240, Math.ceil(cfg.timeoutMs / 6e4));
-		const longToolIdleMs = printTimeoutMinutes * 6e4;
+		const openToolSince = /* @__PURE__ */ new Map();
+		const longToolIdleMinutes = cfg.longToolIdleMinutes > 0 ? cfg.longToolIdleMinutes : 0;
+		const printTimeoutMinutes = Math.max(longToolIdleMinutes > 0 ? longToolIdleMinutes : 240, Math.ceil(cfg.timeoutMs / 6e4));
+		const longToolIdleMs = longToolIdleMinutes > 0 ? longToolIdleMinutes * 6e4 : cfg.timeoutMs;
 		let runningProc = null;
+		/**
+		* True once agy produced ANY output for this run. A run that has already
+		* emitted events is demonstrably alive and authenticated; a silent gap
+		* after that is a long model/tool phase, not a dead process. The idle
+		* watchdog used to kill those at the 10-minute default — 12 of the 37
+		* failures in one week of this user's logs were exactly
+		* "agy run was idle for 600000ms without output", each one costing the
+		* whole turn and a resend. Before the first event the strict budget stays:
+		* that is the genuinely wedged/unreachable-Google shape.
+		*/
+		let sawAnyEvent = false;
+		/** Timestamp of the most recent stdout line — drives the silence heartbeat. */
+		let lastOutputAt = 0;
 		const applyToolIdleBudget = () => {
-			runningProc?.noteActivity(openToolKeys.size > 0 ? longToolIdleMs : cfg.timeoutMs);
+			runningProc?.noteActivity(openToolKeys.size > 0 || sawAnyEvent ? longToolIdleMs : cfg.timeoutMs);
+		};
+		const TOOL_HEARTBEAT_MS = 3e5;
+		let toolHeartbeat = null;
+		const stopToolHeartbeat = () => {
+			if (toolHeartbeat !== null) {
+				clearInterval(toolHeartbeat);
+				toolHeartbeat = null;
+			}
+		};
+		const startToolHeartbeat = () => {
+			if (toolHeartbeat !== null) return;
+			toolHeartbeat = setInterval(() => {
+				if (openToolKeys.size === 0 && !sawAnyEvent) {
+					stopToolHeartbeat();
+					return;
+				}
+				let oldest = Date.now();
+				for (const startedAt of openToolSince.values()) if (startedAt < oldest) oldest = startedAt;
+				if (openToolKeys.size === 0 && lastOutputAt > 0) oldest = lastOutputAt;
+				const mins = Math.max(1, Math.round((Date.now() - oldest) / 6e4));
+				this.deps.log?.(openToolKeys.size > 0 ? "agy tool step still running: " + openToolKeys.size + " open, oldest " + mins + "m (idle budget " + Math.round(longToolIdleMs / 6e4) + "m) — the turn is waiting on agy" : "agy run still working: no new output for " + mins + "m (idle budget " + Math.round(longToolIdleMs / 6e4) + "m) — the turn is waiting on agy; press Stop to cancel");
+			}, TOOL_HEARTBEAT_MS);
+			toolHeartbeat.unref?.();
 		};
 		const activeModelForArgs = activeModel === "" ? cfg.defaultModel : activeModel;
 		const effectiveAddDirs = workspaceRoot !== "" ? stagedDirs.includes(workspaceRoot) ? stagedDirs : [workspaceRoot, ...stagedDirs] : stagedDirs;
@@ -3628,6 +4411,10 @@ var AgyAdapter = class extends LlmAdapter {
 			released = true;
 			release();
 		};
+		if (options.signal?.aborted) {
+			releaseOnce();
+			throw new LlmError("request aborted before the agy process was spawned", Err.AGY_ERROR);
+		}
 		if (account && account.dir) ensureIsolatedKeychain(account.dir);
 		const env = {
 			...process.env,
@@ -3640,16 +4427,17 @@ var AgyAdapter = class extends LlmAdapter {
 			...account && account.dir ? isolatedHomeEnv(account.dir) : {},
 			...proxyEnvFor(account?.proxyUrl || cfg.proxyUrl || void 0)
 		};
-		if (account) {
-			const lastSpawn = this.lastAccountSpawnTime.get(account.id) ?? 0;
-			const elapsed = Date.now() - lastSpawn;
-			const jitter = Math.floor(Math.random() * 300);
-			const targetInterval = this.minSpawnIntervalMs + jitter;
-			if (elapsed < targetInterval) await new Promise((r) => setTimeout(r, targetInterval - elapsed));
-			this.lastAccountSpawnTime.set(account.id, Date.now());
-		}
 		let proc;
+		let spawned = false;
 		try {
+			if (account) {
+				const lastSpawn = this.lastAccountSpawnTime.get(account.id) ?? 0;
+				const elapsed = Date.now() - lastSpawn;
+				const jitter = Math.floor(Math.random() * 300);
+				const targetInterval = this.minSpawnIntervalMs + jitter;
+				if (elapsed < targetInterval) await new Promise((r) => setTimeout(r, targetInterval - elapsed));
+				this.lastAccountSpawnTime.set(account.id, Date.now());
+			}
 			proc = startAgyProcess({
 				bin,
 				args,
@@ -3658,7 +4446,12 @@ var AgyAdapter = class extends LlmAdapter {
 				signal: options.signal,
 				env,
 				stdinPayload,
+				stderrKeepalive: true,
 				onLine: (line) => {
+					sawAnyEvent = true;
+					lastOutputAt = Date.now();
+					startToolHeartbeat();
+					applyToolIdleBudget();
 					for (const ev of parser.feed(line + "\n")) {
 						if (ev.kind === "init" && ev.conversationId) streamCid = ev.conversationId;
 						if (ev.kind === "result" && ev.conversationId !== "") streamCid = ev.conversationId;
@@ -3666,40 +4459,62 @@ var AgyAdapter = class extends LlmAdapter {
 							if (!(ev.state === "DONE" || ev.state === "ERROR" || ev.state === void 0 && (ev.tool.output !== void 0 || ev.tool.error !== void 0))) {
 								if (!openToolKeys.has(ev.stepKey)) {
 									openToolKeys.add(ev.stepKey);
+									openToolSince.set(ev.stepKey, Date.now());
 									applyToolIdleBudget();
+									startToolHeartbeat();
 								}
-							} else if (openToolKeys.delete(ev.stepKey)) applyToolIdleBudget();
+							} else if (openToolKeys.delete(ev.stepKey)) {
+								openToolSince.delete(ev.stepKey);
+								applyToolIdleBudget();
+								if (openToolKeys.size === 0) stopToolHeartbeat();
+							}
 						}
 						rec.append(ev);
 					}
 				}
 			});
+			spawned = true;
 			runningProc = proc;
 			applyToolIdleBudget();
 			if (!isAux && sessionKey !== "") {
 				rec.requestAbort = () => proc.kill("abort");
 				this.activeRuns.set(sessionKey, rec);
 			}
+			if (options.signal?.aborted) proc.kill("abort");
 		} catch (e) {
 			releaseOnce();
 			this.clearInFlightPrompt(sessionKey, prompt);
 			throw new LlmError("failed to spawn agy: " + brief(String(e)), Err.PROCESS_EXIT);
+		} finally {
+			if (!spawned) {
+				releaseOnce();
+				this.clearInFlightPrompt(sessionKey, prompt);
+			}
 		}
 		(async () => {
 			const outcome = await proc.outcome;
 			releaseOnce();
+			stopToolHeartbeat();
+			openToolKeys.clear();
+			openToolSince.clear();
 			if (this.activeRuns.get(sessionKey) === rec) this.activeRuns.delete(sessionKey);
 			this.clearInFlightPrompt(sessionKey, prompt);
 			for (const ev of parser.flush()) {
 				if (ev.kind === "result" && ev.conversationId !== "") streamCid = ev.conversationId;
 				rec.append(ev);
 			}
-			const diffed = diffConversations(before).conversationId;
+			const diffed = diffConversations(before, conversationsDir).conversationId;
 			const conversationId = streamCid ?? diffed;
 			const r = rec.getResultEvent();
 			const consumable = r !== null && (r.ok || r.response !== "");
 			const rawErrText = [outcome.stderrTail, parser.stats.lastResultError].filter(Boolean).join(" ");
 			const isRateLimit = looksLikeRateLimit(rawErrText);
+			const transportFailure = looksLikeNetworkError([
+				rawErrText,
+				parser.stats.authFailureText ?? "",
+				outcome.stderrTail,
+				outcome.stdout.slice(0, 4e3)
+			].filter(Boolean).join(" "));
 			const silentTimeout = outcome.timedOut === true && outcome.stdout.trim() === "";
 			let failure = null;
 			if (outcome.aborted) failure = {
@@ -3712,7 +4527,11 @@ var AgyAdapter = class extends LlmAdapter {
 				code: Err.TIMEOUT,
 				message: "agy run was idle for " + cfg.timeoutMs + "ms without output" + (silentTimeout ? " — agy never emitted a single event; it is likely unable to reach Google (check proxy/network). 无法连接 Google，请检查代理或网络配置" : "")
 			};
-			else if (sawAuthFailure(parser, outcome)) failure = {
+			else if (sawAuthFailure(parser, outcome)) failure = transportFailure ? {
+				kind: "error",
+				code: Err.NETWORK,
+				message: "agy could not validate its Google login over the network (transport failure, not a sign-out) — retrying on another account. " + (rawErrText !== "" ? brief(rawErrText) : "")
+			} : {
 				kind: "error",
 				code: Err.AUTH,
 				message: "agy is not signed in — run /agy auth (or run agy once in a terminal) to login"
@@ -3721,7 +4540,7 @@ var AgyAdapter = class extends LlmAdapter {
 				const bestMsg = parser.stats.lastResultError || (outcome.stderrTail ? brief(outcome.stderrTail) : "Rate limit or quota reached");
 				failure = {
 					kind: "error",
-					code: looksLikeHardRateLimit(rawErrText) ? Err.RATE_LIMIT : Err.AGY_ERROR,
+					code: looksLikeHardRateLimit(rawErrText) ? Err.RATE_LIMIT : Err.OVERLOADED,
 					message: "Google Antigravity quota / rate limit reached: " + bestMsg
 				};
 			} else if (looksLikeEligibilityFailure(rawErrText) || looksLikeEligibilityFailure(parser.stats.lastResultError ?? "")) {
@@ -3751,9 +4570,12 @@ var AgyAdapter = class extends LlmAdapter {
 				};
 			}
 			rec.settle(failure);
+			const superseded = this.activeRuns.get(sessionKey) !== void 0 && this.activeRuns.get(sessionKey) !== rec;
 			if (failure === null) {
 				if (account) this.deps.pool?.recordSuccess(account.id, family);
-				if (!isAux && sessionAccountKey !== "") {
+				this.failoverBudget.delete(sessionKey);
+				this.rateLimitFailover.delete(sessionKey);
+				if (!isAux && sessionAccountKey !== "" && !superseded) {
 					const finalId = binding !== void 0 ? binding.conversationId : conversationId;
 					if (finalId) this.deps.store.set(sessionAccountKey, {
 						conversationId: finalId,
@@ -3764,21 +4586,23 @@ var AgyAdapter = class extends LlmAdapter {
 					});
 				}
 			} else {
-				const effectiveRateLimit = isRateLimit || looksLikeRateLimit(failure.message);
 				if (account && !outcome.aborted && looksLikeHardRateLimit(rawErrText)) this.deps.pool?.recordFailure(account.id, family, failure.message);
 				if (account && silentTimeout) this.deps.pool?.advanceAccount(account.id, family);
 				if (account && failure.code === Err.ELIGIBILITY) this.deps.pool?.advanceAccount(account.id, family);
+				if (!outcome.aborted && failure.code !== Err.RATE_LIMIT && (failure.code === Err.NETWORK || failure.code === Err.OVERLOADED || failure.code === Err.AUTH || outcome.code !== 0 || parser.stats.lastResultError !== void 0) && account) this.deps.pool?.advanceAccount(account.id, family);
 				if (account && shouldMarkAuthRequired(failure.code, failure.message)) this.deps.pool?.markAuthRequired(account.id, failure.message);
-				const staleConversation = failure.code === Err.AUTH || effectiveRateLimit || failure.message && /conversation.*(not found|invalid|not recognized|expired|does not exist)|session.*(expired|invalid)/i.test(failure.message);
+				const staleConversation = failure.code === Err.AUTH || failure.message !== "" && /conversation.*(not found|invalid|not recognized|expired|does not exist)|session.*(expired|invalid)/i.test(failure.message);
+				const interruptedTurn = failure.kind === "aborted" || outcome.timedOut === true;
 				if (!isAux && sessionAccountKey !== "" && staleConversation) this.deps.store.delete(sessionAccountKey);
-				else if (!isAux && sessionAccountKey !== "" && !staleConversation) {
+				else if (!isAux && sessionAccountKey !== "" && !superseded) {
 					const finalId = binding !== void 0 ? binding.conversationId : conversationId;
 					if (finalId) this.deps.store.set(sessionAccountKey, {
 						conversationId: finalId,
 						lastMessageCount: messages.length,
 						updatedAt: Date.now(),
 						model: activeModel,
-						sentImageIds: mergeSentImageIds(binding?.sentImageIds, newlySentImageIds)
+						sentImageIds: mergeSentImageIds(binding?.sentImageIds, []),
+						...interruptedTurn || binding?.interrupted === true ? { interrupted: true } : {}
 					});
 				}
 			}
@@ -3787,7 +4611,8 @@ var AgyAdapter = class extends LlmAdapter {
 				processCode: outcome.aborted ? "ABORTED" : outcome.timedOut ? Err.TIMEOUT : outcome.code === 0 ? "OK" : "EXIT_" + String(outcome.code),
 				toolErrors: rec.toolErrors(),
 				durationMs: outcome.durationMs,
-				model
+				model,
+				tokenSpeed: rec.speedStats()
 			});
 		})().catch((err) => {
 			releaseOnce();
@@ -3797,7 +4622,7 @@ var AgyAdapter = class extends LlmAdapter {
 				message: "internal error: " + brief(String(err))
 			});
 		});
-		yield* this.driveSpan(rec, 0, !isAux, isCodeMode);
+		yield* this.driveSpan(rec, 0, !isAux && hasToolSupport, isCodeMode);
 	}
 	/**
 	* Stream one span of a recording: map events from `from` until the mapper
@@ -3807,6 +4632,17 @@ var AgyAdapter = class extends LlmAdapter {
 	* provider error.
 	*/
 	async *driveSpan(rec, from, cutOnTool, useCodeWrapper) {
+		this.deps.runs.remember(rec);
+		this.deps.runs.pin(rec.runId);
+		try {
+			yield* this.driveSpanBody(rec, from, cutOnTool, useCodeWrapper);
+		} finally {
+			this.deps.runs.unpin(rec.runId);
+			this.deps.runs.remember(rec);
+		}
+	}
+	/** Body of {@link driveSpan}: map recorded events until the span finishes. */
+	async *driveSpanBody(rec, from, cutOnTool, useCodeWrapper) {
 		const queue = new ChunkQueue();
 		(async () => {
 			const resolved = /* @__PURE__ */ new Map();
@@ -3834,8 +4670,12 @@ var AgyAdapter = class extends LlmAdapter {
 						if (activeConvId !== null && Number.isFinite(stepIdx)) try {
 							let th = await readStepThoughts(activeConvId, stepIdx, rec.accountHome);
 							if (th === null && (ev.state === "DONE" || (ev.usage?.thinking_tokens ?? 0) > 0 || ev.stepKind === "thinking")) {
-								await new Promise((r) => setTimeout(r, 50));
+								await new Promise((r) => setTimeout(r, 60));
 								th = await readStepThoughts(activeConvId, stepIdx, rec.accountHome);
+								if (th === null) {
+									await new Promise((r) => setTimeout(r, 100));
+									th = await readStepThoughts(activeConvId, stepIdx, rec.accountHome);
+								}
 							}
 							if (th !== null && th.trim() !== "") {
 								resolvedThoughts.set(i, th);
@@ -3878,7 +4718,10 @@ var AgyAdapter = class extends LlmAdapter {
 					}
 					for (const ch of mapper.map(ev, i)) queue.push(ch);
 					i++;
-					if (mapper.isFinished) break;
+					if (mapper.isFinished) {
+						rec.lastCutIndex = i - 1;
+						break;
+					}
 				}
 				if (!mapper.isFinished) {
 					const f = rec.failureInfo;
@@ -27642,10 +28485,21 @@ function agentFor(proxyUrl) {
 	}
 	return envAgent;
 }
+/**
+* Default timeout for one Google endpoint call. undici's own default
+* headers timeout is 300s, so a hung refresh-token / quota endpoint used to
+* park the whole chain (token refresh → two endpoints → userinfo) for many
+* minutes — enough for `/agy refresh-quota` to look dead. Callers may pass
+* their own `signal`; it is combined with the timeout.
+*/
+const AGY_FETCH_TIMEOUT_MS = 1e4;
 /** fetch() honoring env proxies, or an explicit per-account proxy URL. */
 function agyFetch(url, init = {}, proxyUrl) {
+	const callerSignal = init.signal ?? void 0;
+	const signal = callerSignal !== void 0 ? AbortSignal.any([AbortSignal.timeout(AGY_FETCH_TIMEOUT_MS), callerSignal]) : AbortSignal.timeout(AGY_FETCH_TIMEOUT_MS);
 	return (0, import_undici.fetch)(url, {
 		...init,
+		signal,
 		dispatcher: agentFor(proxyUrl)
 	});
 }
@@ -27827,7 +28681,14 @@ function startCallbackListener(timeoutMs = 3e5) {
 				"Content-Type": "text/html",
 				connection: "close"
 			});
-			res.end(`<h2>Authorization failed: ${oauthError}</h2>`);
+			res.end(`<h2>Authorization failed: ${oauthError.replace(/[&<>"']/g, (ch) => ({
+				"&": "&amp;",
+				"<": "&lt;",
+				">": "&gt;",
+				"\"": "&quot;",
+				"'": "&#39;"
+			})[ch] ?? ch)}</h2>`);
+			clearTimeout(timeout);
 			rejectResult(/* @__PURE__ */ new Error(`oauth error: ${oauthError}`));
 			setTimeout(() => server.close(), 1500);
 			return;
@@ -27842,6 +28703,7 @@ function startCallbackListener(timeoutMs = 3e5) {
 			connection: "close"
 		});
 		res.end(CALLBACK_SUCCESS_HTML);
+		clearTimeout(timeout);
 		resolveResult({
 			code,
 			state
@@ -27849,6 +28711,7 @@ function startCallbackListener(timeoutMs = 3e5) {
 		setTimeout(() => server.close(), 1500);
 	});
 	server.on("error", (error) => {
+		clearTimeout(timeout);
 		rejectResult(error.code === "EADDRINUSE" ? /* @__PURE__ */ new Error(`port ${OAUTH_CALLBACK_PORT} is busy`) : error);
 	});
 	server.listen(OAUTH_CALLBACK_PORT, "127.0.0.1");
@@ -27872,16 +28735,21 @@ function openBrowser(url) {
 	return new Promise((resolve) => {
 		try {
 			if (process.platform === "darwin") execFile("open", [url], (err) => resolve(!err));
-			else if (process.platform === "win32") execFile("cmd.exe", [
-				"/d",
-				"/s",
-				"/c",
-				`start "" "${url}"`
-			], {
-				windowsVerbatimArguments: true,
-				windowsHide: true
-			}, (err) => resolve(!err));
-			else execFile("xdg-open", [url], (err) => resolve(!err));
+			else if (process.platform === "win32") {
+				if (url.includes("\"") || /[\r\n]/.test(url)) {
+					resolve(false);
+					return;
+				}
+				execFile("cmd.exe", [
+					"/d",
+					"/s",
+					"/c",
+					`start "" "${url}"`
+				], {
+					windowsVerbatimArguments: true,
+					windowsHide: true
+				}, (err) => resolve(!err));
+			} else execFile("xdg-open", [url], (err) => resolve(!err));
 		} catch {
 			resolve(false);
 		}
@@ -27921,6 +28789,8 @@ var AuthHelper = class {
 	urlTimer = null;
 	activeHomeDir = null;
 	activeAccountId = null;
+	/** Monotonic begin() generation; a superseded begin must not write state. */
+	beginSeq = 0;
 	signedInCache = null;
 	signedInFlight = null;
 	constructor(bin) {
@@ -28038,6 +28908,7 @@ var AuthHelper = class {
 	}
 	/** Start (or restart) the login flow; resolves with the consent URL. */
 	async begin(homeDir, accountId, proxyUrl) {
+		const seq = ++this.beginSeq;
 		this.activeHomeDir = homeDir || null;
 		this.activeAccountId = accountId || null;
 		if (!this.startProbe(homeDir, proxyUrl)) {
@@ -28062,6 +28933,7 @@ var AuthHelper = class {
 				resolve(null);
 			}, URL_WAIT_MS);
 		});
+		if (seq !== this.beginSeq) return this.status();
 		if (this.urlTimer) clearTimeout(this.urlTimer);
 		this.urlTimer = null;
 		if (!url) {
@@ -28082,6 +28954,7 @@ var AuthHelper = class {
 				margin: 1
 			});
 		} catch {}
+		if (seq !== this.beginSeq) return this.status();
 		this.state = {
 			phase: "pending",
 			accountId: this.activeAccountId || void 0,
@@ -28123,7 +28996,11 @@ var AuthHelper = class {
 			};
 			return this.status();
 		}
-		const outcome = await Promise.race([proc.outcome, new Promise((resolve) => setTimeout(() => resolve(null), CODE_SETTLE_MS))]);
+		let settleTimer = null;
+		const outcome = await Promise.race([proc.outcome, new Promise((resolve) => {
+			settleTimer = setTimeout(() => resolve(null), CODE_SETTLE_MS);
+		})]);
+		if (settleTimer !== null) clearTimeout(settleTimer);
 		if (outcome === null) {
 			this.state = {
 				phase: "failed",
@@ -28170,7 +29047,9 @@ var AuthHelper = class {
 		}
 		if (this.urlTimer) clearTimeout(this.urlTimer);
 		this.urlTimer = null;
+		const waiter = this.urlWaiter;
 		this.urlWaiter = null;
+		waiter?.(null);
 	}
 	dispose() {
 		this.cancel();
@@ -28178,6 +29057,73 @@ var AuthHelper = class {
 	}
 };
 //#endregion
+//#region src/host/diagnostics.ts
+/**
+* Redact user:pass credentials from a proxy URL for display in command output
+* and reports. The full URL (with embedded credentials) stays in config only.
+*/
+function redactProxyUrl(url) {
+	if (url === "") return url;
+	try {
+		const u = new URL(url);
+		if (u.username !== "" || u.password !== "") {
+			u.username = u.username !== "" ? "***" : "";
+			u.password = u.password !== "" ? "***" : "";
+			return u.toString();
+		}
+		return url;
+	} catch {
+		return "<proxy-url-redacted>";
+	}
+}
+/** Redact auth URLs, long tokens, and authorization codes. */
+function redactLine(line) {
+	let out = line;
+	out = out.replace(/https:\/\/accounts\.google\.com\/\S+/g, "<auth-url-redacted>");
+	out = out.replace(/\b[0-9]{4,}\//g, "4/<code-redacted>");
+	out = out.replace(/ya29\.[A-Za-z0-9._-]+/g, "<oauth-token-redacted>");
+	out = out.replace(/Bearer\s+\S+/gi, "Bearer <redacted>");
+	out = out.replace(/\b1\/\/0[A-Za-z0-9._-]{10,}/g, "<oauth-refresh-token-redacted>");
+	out = out.replace(/\bAIza[0-9A-Za-z_-]{30,}\b/g, "<api-key-redacted>");
+	out = out.replace(/\b(?:https?|socks[45]):\/\/[^\s/]*:[^\s/@]*@[^\s]+/gi, "<proxy-url-redacted>");
+	return out;
+}
+function writeDoctorReport(deps) {
+	const cfg = deps.cfg();
+	const cat = deps.catalog().get();
+	const bindings = deps.store().all();
+	const lines = [];
+	lines.push("# dsh-agy-link diagnostic report");
+	lines.push("");
+	lines.push("- generated: " + (/* @__PURE__ */ new Date()).toISOString());
+	lines.push("- agy binary: " + (deps.bin() ?? "NOT FOUND"));
+	lines.push("- agy version: " + (deps.version() ?? "unknown"));
+	const cfgDump = {
+		...cfg,
+		extraArgs: cfg.extraArgs.length
+	};
+	if (typeof cfgDump.proxyUrl === "string" && cfgDump.proxyUrl !== "") cfgDump.proxyUrl = redactProxyUrl(cfgDump.proxyUrl);
+	lines.push("- plugin config: " + JSON.stringify(cfgDump));
+	lines.push("- catalog: " + cat.source + " — " + cat.models.length + " models" + (cat.lastError === void 0 ? "" : " — error: " + cat.lastError));
+	for (const m of cat.models) lines.push("  - " + m.id + (m.efforts ? " [" + m.efforts.join("/") + "]" : ""));
+	lines.push("- conversation bindings: " + Object.keys(bindings).length);
+	for (const [k, b] of Object.entries(bindings)) lines.push("  - " + k + " -> " + b.conversationId + " @ " + new Date(b.updatedAt).toISOString());
+	lines.push("- node: " + process.version + " — " + process.platform + " " + process.arch);
+	lines.push("");
+	lines.push("## last stream-json stdout (redacted, tail)");
+	lines.push("");
+	lines.push("```");
+	const recent = deps.recentLines();
+	for (const l of recent.slice(-400)) lines.push(redactLine(l));
+	lines.push("```");
+	lines.push("");
+	const dir = join(stateDir(), "diagnostics");
+	mkdirSync(dir, { recursive: true });
+	const file = join(dir, "doctor-" + (/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 14) + ".md");
+	writeFileSync(file, lines.join("\n"), "utf8");
+	return file;
+}
+//#endregion
 //#region src/host/commands.ts
 const HELP = [
 	"**/agy** — Antigravity (agy CLI) bridge",
@@ -28229,7 +29175,7 @@ async function handle(deps, raw) {
 					const sec = Math.ceil((cd.cooldownUntil - Date.now()) / 1e3);
 					cds.push(`${fam} cooldown: ${sec}s left (${cd.reason})`);
 				}
-				lines.push(`${i + 1}. **${a.alias}** (${a.email || a.id})${isPrimary ? " ⭐ primary" : ""}`, `   - Proxy: ${a.proxyUrl || deps.cfg().proxyUrl || "system default"}`, `   - Quota: Gemini ${qG} | Claude ${qC} | GPT-OSS ${qO}`, cds.length > 0 ? `   - ⚠️ ${cds.join("; ")}` : "   - Status: 🟢 Ready");
+				lines.push(`${i + 1}. **${a.alias}** (${a.email || a.id})${isPrimary ? " ⭐ primary" : ""}`, `   - Proxy: ${a.proxyUrl ? redactProxyUrl(a.proxyUrl) : deps.cfg().proxyUrl ? redactProxyUrl(deps.cfg().proxyUrl) : "system default"}`, `   - Quota: Gemini ${qG} | Claude ${qC} | GPT-OSS ${qO}`, cds.length > 0 ? `   - ⚠️ ${cds.join("; ")}` : "   - Status: 🟢 Ready");
 			}
 			return ok(lines.join("\n"));
 		}
@@ -28237,10 +29183,12 @@ async function handle(deps, raw) {
 			const pool = deps.pool?.();
 			if (!pool) return err("Account pool not available");
 			const acc = pool.createAccountSlot(arg || void 0);
+			pool.markAuthRequired(acc.id, "not signed in yet — complete the terminal login");
 			return ok([
 				`**Account slot created: [${acc.alias}]** (id: \`${acc.id}\`)`,
 				`- Isolated directory: \`${acc.dir}\``,
 				`- Run in terminal: \`HOME="${acc.dir}" agy\` to authenticate this Google account.`,
+				`- The slot stays OUT of rotation (authRequired) until the login completes and a quota refresh verifies it.`,
 				`- Once logged in, run: \`/agy pool\` or click 🔄 刷新额度 in WebUI.`
 			].join("\n"));
 		}
@@ -28341,7 +29289,12 @@ async function renderStatus(deps) {
 	const cfg = deps.cfg();
 	const bin = deps.bin();
 	const authHelper = deps.auth();
-	const auth = authHelper ? await Promise.race([authHelper.resolvedStatus(), new Promise((r) => setTimeout(() => r(void 0), 8e3))]) : void 0;
+	let probeTimer = null;
+	const auth = authHelper ? await Promise.race([authHelper.resolvedStatus(), new Promise((r) => {
+		probeTimer = setTimeout(() => r(void 0), 8e3);
+	})]).finally(() => {
+		if (probeTimer !== null) clearTimeout(probeTimer);
+	}) : void 0;
 	const cat = deps.catalog().get();
 	const bindings = Object.keys(deps.store().all()).length;
 	const last = deps.lastRun();
@@ -28359,6 +29312,7 @@ async function renderStatus(deps) {
 		"- catalog: " + cat.models.length + " models — " + cat.source + (cat.lastError === void 0 ? "" : " — last error: " + cat.lastError),
 		"- conversation bindings: " + bindings,
 		"- last run process: " + (last ? (last.processOk ? "ok" : last.processCode) + " — " + last.model + " in " + Math.round(last.durationMs / 100) / 10 + "s" : "none yet"),
+		...last?.tokenSpeed !== void 0 && (last.tokenSpeed.measuredSteps > 0 || last.tokenSpeed.outputTokens > 0) ? ["- last run tokens: " + last.tokenSpeed.outputTokens + " output tokens" + (last.tokenSpeed.avgTps !== null ? " — avg " + last.tokenSpeed.avgTps.toFixed(1) + " tok/s" : "") + (last.tokenSpeed.lastTps !== null ? " (last generation step: " + last.tokenSpeed.lastTps.toFixed(1) + " tok/s)" : "")] : [],
 		...last && last.toolErrors.length > 0 ? [
 			"- last run tool errors (" + last.toolErrors.length + "): " + last.toolErrors.join(" | "),
 			...errorKinds.includes("missing_file") ? ["- Guidance: `missing_file` — verify the expected workspace/artifact path for this conversation; do not invent paths or bypass protections."] : [],
@@ -28380,50 +29334,6 @@ function err(text) {
 	};
 }
 //#endregion
-//#region src/host/diagnostics.ts
-/** Redact auth URLs, long tokens, and authorization codes. */
-function redactLine(line) {
-	let out = line;
-	out = out.replace(/https:\/\/accounts\.google\.com\/\S+/g, "<auth-url-redacted>");
-	out = out.replace(/\b[0-9]{4,}\//g, "4/<code-redacted>");
-	out = out.replace(/ya29\.[A-Za-z0-9._-]+/g, "<oauth-token-redacted>");
-	out = out.replace(/Bearer\s+\S+/gi, "Bearer <redacted>");
-	return out;
-}
-function writeDoctorReport(deps) {
-	const cfg = deps.cfg();
-	const cat = deps.catalog().get();
-	const bindings = deps.store().all();
-	const lines = [];
-	lines.push("# dsh-agy-link diagnostic report");
-	lines.push("");
-	lines.push("- generated: " + (/* @__PURE__ */ new Date()).toISOString());
-	lines.push("- agy binary: " + (deps.bin() ?? "NOT FOUND"));
-	lines.push("- agy version: " + (deps.version() ?? "unknown"));
-	lines.push("- plugin config: " + JSON.stringify({
-		...cfg,
-		extraArgs: cfg.extraArgs.length
-	}));
-	lines.push("- catalog: " + cat.source + " — " + cat.models.length + " models" + (cat.lastError === void 0 ? "" : " — error: " + cat.lastError));
-	for (const m of cat.models) lines.push("  - " + m.id + (m.efforts ? " [" + m.efforts.join("/") + "]" : ""));
-	lines.push("- conversation bindings: " + Object.keys(bindings).length);
-	for (const [k, b] of Object.entries(bindings)) lines.push("  - " + k + " -> " + b.conversationId + " @ " + new Date(b.updatedAt).toISOString());
-	lines.push("- node: " + process.version + " — " + process.platform + " " + process.arch);
-	lines.push("");
-	lines.push("## last stream-json stdout (redacted, tail)");
-	lines.push("");
-	lines.push("```");
-	const recent = deps.recentLines();
-	for (const l of recent.slice(-400)) lines.push(redactLine(l));
-	lines.push("```");
-	lines.push("");
-	const dir = join(stateDir(), "diagnostics");
-	mkdirSync(dir, { recursive: true });
-	const file = join(dir, "doctor-" + (/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 14) + ".md");
-	writeFileSync(file, lines.join("\n"), "utf8");
-	return file;
-}
-//#endregion
 //#region src/host/pool.ts
 function defaultPoolDir() {
 	const dshState = process.env.DSH_STATE_DIR || join(homedir(), ".dsh");
@@ -28433,12 +29343,23 @@ var AccountPoolManager = class {
 	data;
 	baseDir;
 	file;
+	/**
+	* Account ids this process has seen (loaded from disk + created here). On
+	* persist, disk ids OUTSIDE this set were added by another host process and
+	* are preserved instead of being clobbered (same merge contract as
+	* sessions.json: web + headless share this file).
+	*/
+	knownIds = /* @__PURE__ */ new Set();
+	/** Serialized snapshot of the last successful persist/load; skips no-op writes. */
+	persistedJson = "";
 	constructor(baseDir = defaultPoolDir()) {
 		this.baseDir = baseDir;
 		this.file = join(baseDir, "pool.json");
 		this.data = this.load();
 		this.bootstrapDefaultAccount();
 		this.normalizeLegacyPrimary();
+		this.persistedJson = JSON.stringify(this.data);
+		for (const acc of this.data.accounts) this.knownIds.add(acc.id);
 	}
 	load() {
 		try {
@@ -28446,7 +29367,11 @@ var AccountPoolManager = class {
 				const raw = readFileSync(this.file, "utf8");
 				const parsed = JSON.parse(raw);
 				if (parsed && Array.isArray(parsed.accounts)) {
-					for (const acc of parsed.accounts) if (acc.cooldowns) {
+					for (const acc of parsed.accounts) {
+						if (!acc || typeof acc !== "object") continue;
+						if (acc.cooldowns === void 0 || acc.cooldowns === null) acc.cooldowns = {};
+						if (acc.quotas === void 0 || acc.quotas === null) acc.quotas = {};
+						if (acc.enabled === void 0) acc.enabled = true;
 						for (const [fam, cd] of Object.entries(acc.cooldowns)) if (cd && cd.reason === "agy run aborted by caller") delete acc.cooldowns[fam];
 					}
 					return {
@@ -28455,16 +29380,45 @@ var AccountPoolManager = class {
 					};
 				}
 			}
-		} catch {}
+		} catch {
+			try {
+				if (existsSync(this.file)) copyFileSync(this.file, this.file + ".corrupt-" + Date.now());
+			} catch {}
+		}
 		return defaultPoolData();
 	}
 	persist() {
+		const serialized = JSON.stringify(this.data);
+		let merged = this.data;
+		try {
+			if (existsSync(this.file)) {
+				const onDisk = JSON.parse(readFileSync(this.file, "utf8"));
+				if (onDisk && Array.isArray(onDisk.accounts)) {
+					const ours = new Set(this.data.accounts.map((a) => a.id));
+					const foreign = onDisk.accounts.filter((a) => a && typeof a === "object" && a.id !== void 0 && !ours.has(a.id) && !this.knownIds.has(a.id));
+					if (foreign.length > 0) {
+						merged = {
+							...this.data,
+							accounts: [...this.data.accounts, ...foreign]
+						};
+						for (const acc of foreign) this.knownIds.add(acc.id);
+					}
+				}
+			}
+		} catch {}
 		try {
 			mkdirSync(dirname(this.file), { recursive: true });
+			if (serialized === this.persistedJson && merged === this.data) return;
 			const tmp = join(dirname(this.file), ".pool.json.tmp");
-			writeFileSync(tmp, JSON.stringify(this.data, null, 2), "utf8");
+			writeFileSync(tmp, JSON.stringify(merged, null, 2), "utf8");
 			renameSync(tmp, this.file);
-		} catch {}
+			this.persistedJson = JSON.stringify(merged);
+			if (merged !== this.data) this.data = merged;
+		} catch (e) {
+			try {
+				console.error("[dsh-agy-link] pool persist failed: " + String(e));
+			} catch {}
+		}
 	}
 	/**
 	* Bootstraps the primary account on first start.
@@ -28557,6 +29511,7 @@ var AccountPoolManager = class {
 			quotas: {}
 		};
 		this.data.accounts.push(newAccount);
+		this.knownIds.add(newAccount.id);
 		this.persist();
 		return newAccount;
 	}
@@ -28634,6 +29589,7 @@ var AccountPoolManager = class {
 			quotas: {}
 		};
 		this.data.accounts.push(newAccount);
+		this.knownIds.add(newAccount.id);
 		this.persist();
 		return newAccount;
 	}
@@ -28641,12 +29597,16 @@ var AccountPoolManager = class {
 		const idx = this.data.accounts.findIndex((a) => a.id === id);
 		if (idx === -1) return false;
 		const [removed] = this.data.accounts.splice(idx, 1);
-		if (removed) try {
-			if (existsSync(removed.dir)) rmSync(removed.dir, {
-				recursive: true,
-				force: true
-			});
-		} catch {}
+		if (removed) {
+			const rel = removed.dir !== "" ? relative(this.baseDir, removed.dir) : "";
+			const contained = rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+			if (removed.dir && contained && !removed.systemHome && existsSync(removed.dir)) try {
+				rmSync(removed.dir, {
+					recursive: true,
+					force: true
+				});
+			} catch {}
+		}
 		if (this.data.primaryAccountId === id) this.data.primaryAccountId = void 0;
 		if (this.data.lastActiveAccountId === id) this.data.lastActiveAccountId = void 0;
 		if (this.data.activeAccountIds) {
@@ -28768,13 +29728,13 @@ var AccountPoolManager = class {
 	*/
 	isAccountEligible(acc, family, now = Date.now()) {
 		if (!acc.enabled || acc.authRequired) return false;
-		const cd = acc.cooldowns[family];
+		const cd = acc.cooldowns?.[family];
 		if (cd && cd.cooldownUntil > now) return false;
-		const quota = acc.quotas[family];
+		const quota = acc.quotas?.[family];
 		if (quota && typeof quota.remainingFraction === "number" && quota.remainingFraction <= .02) {
 			if (quota.resetTime) {
 				const resetMs = Date.parse(quota.resetTime);
-				if (!Number.isNaN(resetMs) && resetMs > now) return false;
+				if (Number.isNaN(resetMs) || resetMs > now) return false;
 			}
 		}
 		if (quota && typeof quota.weeklyFraction === "number" && quota.weeklyFraction <= .01) {
@@ -28806,7 +29766,7 @@ var AccountPoolManager = class {
 	* sooner of the 5h window reset and the weekly cap reset. NaN when unknown.
 	*/
 	nextQuotaResetAt(acc, family) {
-		const q = acc.quotas[family];
+		const q = acc.quotas?.[family];
 		const stamps = [q?.resetTime, q?.weeklyResetTime].filter((v) => typeof v === "string" && v !== "").map((v) => Date.parse(v)).filter((t) => !Number.isNaN(t));
 		return stamps.length === 0 ? NaN : Math.min(...stamps);
 	}
@@ -28870,10 +29830,11 @@ var AccountPoolManager = class {
 		};
 		if (email) acc.email = email;
 		const now = Date.now();
+		const futureReset = (iso) => typeof iso === "string" && iso !== "" && !Number.isNaN(Date.parse(iso)) && Date.parse(iso) > now;
 		for (const [famKey, info] of Object.entries(quotas)) {
 			if (!info) continue;
-			const isExhausted5h = typeof info.remainingFraction === "number" && info.remainingFraction <= .02 && (!info.resetTime || Date.parse(info.resetTime) > now);
-			const isExhaustedWeekly = typeof info.weeklyFraction === "number" && info.weeklyFraction <= .01 && (!info.weeklyResetTime || Date.parse(info.weeklyResetTime) > now);
+			const isExhausted5h = typeof info.remainingFraction === "number" && info.remainingFraction <= .02 && !futureReset(info.resetTime);
+			const isExhaustedWeekly = typeof info.weeklyFraction === "number" && info.weeklyFraction <= .01 && !futureReset(info.weeklyResetTime);
 			if (isExhausted5h || isExhaustedWeekly) {
 				if (this.data.activeAccountIds?.[famKey] === id || this.data.lastActiveAccountId === id) this.selectAccount(famKey);
 			}
@@ -28886,6 +29847,7 @@ var AccountPoolManager = class {
 	recordFailure(id, family, reason, serverResetTime) {
 		const acc = this.getAccount(id);
 		if (!acc) return;
+		acc.cooldowns ??= {};
 		const failures = (acc.cooldowns[family]?.consecutiveFailures ?? 0) + 1;
 		let cooldownUntil;
 		const parsedDuration = parseResetDurationMs(serverResetTime || reason);
@@ -28915,17 +29877,21 @@ var AccountPoolManager = class {
 			delete acc.authError;
 			delete acc.authMarkedAt;
 		}
-		if (acc.cooldowns[family]) delete acc.cooldowns[family];
+		if (acc.cooldowns?.[family]) delete acc.cooldowns[family];
 		this.persist();
 	}
 	clearCooldown(id, family) {
 		if (id) {
 			const acc = this.getAccount(id);
 			if (!acc) return;
+			acc.cooldowns ??= {};
+			if (family) delete acc.cooldowns[family];
+			else acc.cooldowns = {};
+		} else for (const acc of this.data.accounts) {
+			acc.cooldowns ??= {};
 			if (family) delete acc.cooldowns[family];
 			else acc.cooldowns = {};
-		} else for (const acc of this.data.accounts) if (family) delete acc.cooldowns[family];
-		else acc.cooldowns = {};
+		}
 		this.persist();
 	}
 	/**
@@ -28973,13 +29939,42 @@ var AccountPoolManager = class {
 		let earliest = null;
 		for (const acc of this.data.accounts) {
 			if (!acc.enabled) continue;
-			const cd = acc.cooldowns[family];
+			const cd = acc.cooldowns?.[family];
 			if (cd && cd.cooldownUntil > now) {
 				if (earliest === null || cd.cooldownUntil < earliest) earliest = cd.cooldownUntil;
 			}
 		}
 		return earliest !== null ? Math.max(0, earliest - now) : null;
 	}
+	/**
+	* Earliest moment ANY enabled account could serve `family` again: the sooner
+	* of a cooldown expiry and a quota-window reset.
+	*
+	* `getEarliestResetCountdown` only inspects cooldowns, while an account can
+	* be excluded by its remaining 5h/weekly fraction (isAccountEligible) — so a
+	* fully quota-drained pool reported NO wait at all ("Add an account or wait
+	* for reset") even though every account knew exactly when it resets. Signed
+	* out and disabled accounts are skipped: no countdown can fix them.
+	*/
+	getEarliestAvailableCountdown(family) {
+		const now = Date.now();
+		let earliest = null;
+		const bump = (at) => {
+			if (at === null || Number.isNaN(at) || at <= now) return;
+			if (earliest === null || at < earliest) earliest = at;
+		};
+		for (const acc of this.data.accounts) {
+			if (!acc.enabled || acc.authRequired) continue;
+			const cd = acc.cooldowns?.[family];
+			if (cd && cd.cooldownUntil > now) bump(cd.cooldownUntil);
+			const quota = acc.quotas?.[family];
+			if (quota === void 0) continue;
+			const drained5h = typeof quota.remainingFraction === "number" && quota.remainingFraction <= .02 && typeof quota.resetTime === "string" && Date.parse(quota.resetTime) > now;
+			const drainedWeekly = typeof quota.weeklyFraction === "number" && quota.weeklyFraction <= .01 && typeof quota.weeklyResetTime === "string" && Date.parse(quota.weeklyResetTime) > now;
+			if (drained5h || drainedWeekly) bump(this.nextQuotaResetAt(acc, family));
+		}
+		return earliest !== null ? Math.max(0, earliest - now) : null;
+	}
 };
 //#endregion
 //#region src/host/pool-auth.ts
@@ -29010,9 +30005,12 @@ var PoolAuthFlow = class {
 			...this.statusValue,
 			...patch
 		};
-		if (patch.phase === "done") this.doneResetTimer = setTimeout(() => {
-			if (this.statusValue.phase === "done") this.statusValue = { phase: "idle" };
-		}, DONE_STATUS_TTL_MS);
+		if (patch.phase === "done") {
+			this.doneResetTimer = setTimeout(() => {
+				if (this.statusValue.phase === "done") this.statusValue = { phase: "idle" };
+			}, DONE_STATUS_TTL_MS);
+			this.doneResetTimer.unref?.();
+		}
 	}
 	/**
 	* Shared starter: PKCE + loopback listener + server-side browser open.
@@ -29054,7 +30052,7 @@ var PoolAuthFlow = class {
 			code: browserOpened ? void 0 : "browser_manual"
 		});
 		this.log(`pool auth begun (${mode} mode, browserOpened=${browserOpened}${active.primary ? ", primary" : ""})`);
-		if (listener) listener.result.then(({ code, state: returnedState }) => this.finishWithCode(code, returnedState)).catch((err) => {
+		if (listener) listener.result.then(({ code, state: returnedState }) => this.finishWithCode(code, returnedState, active)).catch((err) => {
 			if (!this.flow || this.flow.listener !== listener) return;
 			this.fail("callback_failed", err);
 		});
@@ -29105,16 +30103,27 @@ var PoolAuthFlow = class {
 			phase: "waiting",
 			code: "invalid_state"
 		};
-		await this.finishWithCode(parsed.code, parsed.state ?? flow.state);
+		await this.finishWithCode(parsed.code, parsed.state ?? flow.state, flow);
 		const after = this.status();
 		return {
 			...after,
 			ok: after.phase === "done"
 		};
 	}
-	async finishWithCode(code, returnedState) {
+	/**
+	* Settle the ACTIVE flow with an authorization code.
+	*
+	* `owner` names the flow the code belongs to. Without it, a STALE flow's
+	* late callback (its `exchangeCode` still in flight while the user cancelled
+	* and began flow B) settled against `this.flow` — flow B — and either killed
+	* the new flow with `invalid_state` (deleting B's staging dir) or, worse,
+	* wrote flow A's token file into the freshly cleaned A dir and committed a
+	* ghost account. The identity check makes a stale settlement a no-op.
+	*/
+	async finishWithCode(code, returnedState, owner) {
 		const flow = this.flow;
 		if (!flow || this.statusValue.phase !== "waiting") return;
+		if (owner !== void 0 && owner !== flow) return;
 		if (returnedState !== flow.state) {
 			this.fail("invalid_state");
 			return;
@@ -29269,30 +30278,40 @@ function parseGoKeyringPayload(raw) {
 	}
 }
 /**
+* Promisified execFile with a hard timeout. The keyring readers used to run
+* execFileSync, so a locked Keychain prompt or a slow PowerShell cold start
+* (up to 8s) froze the WHOLE DSH event loop on every quota poll — the service
+* runs inside the host process. Async with a timeout keeps the host live.
+*/
+function execFileT(file, args, timeoutMs) {
+	return new Promise((resolve, reject) => {
+		execFile(file, [...args], {
+			encoding: "utf8",
+			timeout: timeoutMs,
+			windowsHide: true
+		}, (err, stdout) => {
+			if (err !== null && err !== void 0) reject(err);
+			else resolve(typeof stdout === "string" ? stdout : String(stdout));
+		});
+	});
+}
+/**
 * Reads the active primary Antigravity OAuth token from the Linux Secret
 * Service (GNOME Keyring / KDE Wallet via FreeDesktop secrets). agy 1.1.15+
 * on Linux stores primary credentials via go-keyring under service "gemini"
 * / username "antigravity" — the same JSON shape as the macOS Keychain.
 * GH #8: without this reader, Linux quota resolution always returned null.
 */
-function readLinuxSecretToken() {
+async function readLinuxSecretToken() {
 	if (process.platform !== "linux") return null;
 	try {
-		const raw = execFileSync("secret-tool", [
+		const raw = (await execFileT("secret-tool", [
 			"lookup",
 			"service",
 			"gemini",
 			"username",
 			"antigravity"
-		], {
-			encoding: "utf8",
-			timeout: 3e3,
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		}).trim();
+		], 3e3)).trim();
 		if (raw) {
 			const tok = parseGoKeyringPayload(raw);
 			if (tok) return tok;
@@ -29314,15 +30333,7 @@ function readLinuxSecretToken() {
 		"    pass"
 	].join("\n");
 	for (const pyBin of ["python3", "python"]) try {
-		const raw = execFileSync(pyBin, ["-c", pyScript], {
-			encoding: "utf8",
-			timeout: 4e3,
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		}).trim();
+		const raw = (await execFileT(pyBin, ["-c", pyScript], 4e3)).trim();
 		if (raw) {
 			const tok = parseGoKeyringPayload(raw);
 			if (tok) return tok;
@@ -29335,25 +30346,17 @@ function readLinuxSecretToken() {
 * agy 1.1.15+ on macOS stores primary credentials via go-keyring in the Keychain
 * under service "gemini" / account "antigravity" (base64-encoded JSON).
 */
-function readMacKeychainToken() {
+async function readMacKeychainToken() {
 	if (process.platform !== "darwin") return null;
 	try {
-		const raw = execFileSync("security", [
+		const raw = (await execFileT("security", [
 			"find-generic-password",
 			"-s",
 			"gemini",
 			"-a",
 			"antigravity",
 			"-w"
-		], {
-			encoding: "utf8",
-			timeout: 3e3,
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		}).trim();
+		], 3e3)).trim();
 		if (!raw) return null;
 		return parseGoKeyringPayload(raw);
 	} catch {
@@ -29368,58 +30371,48 @@ function readMacKeychainToken() {
 * empty on Windows: the on-disk `antigravity-oauth-token` file is often
 * absent while agy itself still authenticates via CredRead (issue #30).
 */
-function readWindowsCredentialToken() {
+async function readWindowsCredentialToken() {
 	if (process.platform !== "win32") return null;
 	try {
-		const script = [
-			"$sig = @'",
-			"using System;",
-			"using System.Runtime.InteropServices;",
-			"public class AgyCred {",
-			"  [DllImport(\"advapi32.dll\", SetLastError=true, CharSet=CharSet.Unicode)]",
-			"  public static extern bool CredRead(string target, int type, int flags, out IntPtr credential);",
-			"  [DllImport(\"advapi32.dll\", SetLastError=true)]",
-			"  public static extern void CredFree(IntPtr cred);",
-			"  [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]",
-			"  public struct CREDENTIAL {",
-			"    public int Flags; public int Type; public IntPtr TargetName;",
-			"    public IntPtr Comment; public long LastWritten; public int CredentialBlobSize;",
-			"    public IntPtr CredentialBlob; public int Persist; public int AttributeCount;",
-			"    public IntPtr Attributes; public IntPtr TargetAlias; public IntPtr UserName;",
-			"  }",
-			"  public static byte[] Read(string target) {",
-			"    IntPtr p;",
-			"    if (!CredRead(target, 1, 0, out p)) return null;",
-			"    CREDENTIAL c = (CREDENTIAL)Marshal.PtrToStructure(p, typeof(CREDENTIAL));",
-			"    byte[] b = new byte[c.CredentialBlobSize];",
-			"    Marshal.Copy(c.CredentialBlob, b, 0, c.CredentialBlobSize);",
-			"    CredFree(p);",
-			"    return b;",
-			"  }",
-			"}",
-			"'@",
-			"Add-Type -TypeDefinition $sig -ErrorAction Stop",
-			"$b = [AgyCred]::Read('gemini:antigravity')",
-			"if ($b -eq $null) { exit 1 }",
-			"[Console]::Out.Write([System.Text.Encoding]::UTF8.GetString($b))"
-		].join("\n");
-		const raw = execFileSync("powershell.exe", [
+		const raw = (await execFileT("powershell.exe", [
 			"-NoProfile",
 			"-NonInteractive",
 			"-ExecutionPolicy",
 			"Bypass",
 			"-Command",
-			script
-		], {
-			encoding: "utf8",
-			timeout: 8e3,
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			],
-			windowsHide: true
-		}).trim();
+			[
+				"$sig = @'",
+				"using System;",
+				"using System.Runtime.InteropServices;",
+				"public class AgyCred {",
+				"  [DllImport(\"advapi32.dll\", SetLastError=true, CharSet=CharSet.Unicode)]",
+				"  public static extern bool CredRead(string target, int type, int flags, out IntPtr credential);",
+				"  [DllImport(\"advapi32.dll\", SetLastError=true)]",
+				"  public static extern void CredFree(IntPtr cred);",
+				"  [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]",
+				"  public struct CREDENTIAL {",
+				"    public int Flags; public int Type; public IntPtr TargetName;",
+				"    public IntPtr Comment; public long LastWritten; public int CredentialBlobSize;",
+				"    public IntPtr CredentialBlob; public int Persist; public int AttributeCount;",
+				"    public IntPtr Attributes; public IntPtr TargetAlias; public IntPtr UserName;",
+				"  }",
+				"  public static byte[] Read(string target) {",
+				"    IntPtr p;",
+				"    if (!CredRead(target, 1, 0, out p)) return null;",
+				"    CREDENTIAL c = (CREDENTIAL)Marshal.PtrToStructure(p, typeof(CREDENTIAL));",
+				"    byte[] b = new byte[c.CredentialBlobSize];",
+				"    Marshal.Copy(c.CredentialBlob, b, 0, c.CredentialBlobSize);",
+				"    CredFree(p);",
+				"    return b;",
+				"  }",
+				"}",
+				"'@",
+				"Add-Type -TypeDefinition $sig -ErrorAction Stop",
+				"$b = [AgyCred]::Read('gemini:antigravity')",
+				"if ($b -eq $null) { exit 1 }",
+				"[Console]::Out.Write([System.Text.Encoding]::UTF8.GetString($b))"
+			].join("\n")
+		], 8e3)).trim();
 		if (!raw) return null;
 		return parseGoKeyringPayload(raw);
 	} catch {
@@ -29430,6 +30423,8 @@ var QuotaService = class {
 	pool;
 	globalProxy;
 	preferredEndpointIndex = 0;
+	/** accountId -> in-flight getValidAccessToken attempt (dedup). */
+	tokenRefreshInFlight = /* @__PURE__ */ new Map();
 	/**
 	* @param globalProxy resolves the plugin-wide proxy URL; used when the
 	* account has no dedicated proxyUrl. Injected so tests stay network-free.
@@ -29450,7 +30445,7 @@ var QuotaService = class {
 	* Read the system-HOME Keychain credential. Protected so tests (and future
 	* platforms) can substitute the reader without touching the real Keychain.
 	*/
-	readSystemKeychainToken() {
+	async readSystemKeychainToken() {
 		if (process.platform === "darwin") return readMacKeychainToken();
 		if (process.platform === "linux") return readLinuxSecretToken();
 		if (process.platform === "win32") return readWindowsCredentialToken();
@@ -29468,7 +30463,7 @@ var QuotaService = class {
 	* WRONG account's numbers). Isolated pool accounts only ever read their
 	* own directory's file; the Keychain is one shared slot they must not see.
 	*/
-	getStoredToken(account) {
+	async getStoredToken(account) {
 		const disk = (() => {
 			const file = this.getTokenFilePath(account);
 			if (!existsSync(file)) return null;
@@ -29479,7 +30474,7 @@ var QuotaService = class {
 			return null;
 		})();
 		if (account.systemHome || !account.dir) {
-			const keychainToken = this.readSystemKeychainToken();
+			const keychainToken = await this.readSystemKeychainToken();
 			if (keychainToken && (keychainToken.accessToken || keychainToken.refreshToken)) return keychainToken;
 		}
 		return disk;
@@ -29504,16 +30499,33 @@ var QuotaService = class {
 				raw.access_token = tokens.access_token;
 				if (tokens.expiryMs) raw.expiry = tokens.expiryMs;
 			}
-			writeFileSync(file, JSON.stringify(raw), "utf8");
+			writeFileSync(file, JSON.stringify(raw), {
+				encoding: "utf8",
+				mode: 384
+			});
 		} catch {}
 	}
 	/**
 	* Get a valid access token, refreshing via refresh_token when expired.
 	* Uses the public Antigravity client credentials (env-overridable), so
 	* refresh works out of the box.
+	*
+	* Concurrent calls for the SAME account share one in-flight attempt: the
+	* poll timer, three manual HTTP entry points and per-account allSettled
+	* used to race into duplicate refreshTokens for one account (double
+	* risk-control exposure for the same outcome).
 	*/
 	async getValidAccessToken(account) {
-		const tok = this.getStoredToken(account);
+		const existing = this.tokenRefreshInFlight.get(account.id);
+		if (existing !== void 0) return existing;
+		const attempt = this.getValidAccessTokenUncached(account).finally(() => {
+			this.tokenRefreshInFlight.delete(account.id);
+		});
+		this.tokenRefreshInFlight.set(account.id, attempt);
+		return attempt;
+	}
+	async getValidAccessTokenUncached(account) {
+		const tok = await this.getStoredToken(account);
 		if (!tok) return null;
 		if (tok.accessToken && (!tok.expiryMs || tok.expiryMs > Date.now() + 6e4)) return tok.accessToken;
 		if (tok.refreshToken) try {
@@ -29648,11 +30660,12 @@ var QuotaService = class {
 			let weeklyReset;
 			for (const b of group.buckets || []) {
 				const w = (b.window || b.bucketId || "").toLowerCase();
-				if (w.includes("5h")) {
-					fiveHourFrac = b.remainingFraction;
+				const frac = typeof b.remainingFraction === "number" && Number.isFinite(b.remainingFraction) ? Math.min(1, Math.max(0, b.remainingFraction)) : void 0;
+				if (w.includes("5h") || w.includes("five_hour") || w.includes("5-hour")) {
+					fiveHourFrac = frac;
 					fiveHourReset = b.resetTime;
-				} else if (w.includes("weekly")) {
-					weeklyFrac = b.remainingFraction;
+				} else if (w.includes("weekly") || w.includes("week")) {
+					weeklyFrac = frac;
 					weeklyReset = b.resetTime;
 				}
 			}
@@ -29669,9 +30682,10 @@ var QuotaService = class {
 		if (discovered && discovered.models) for (const [modelId, entry] of Object.entries(discovered.models)) {
 			const fam = modelFamilyOf(modelId);
 			if (fam === "unknown") continue;
-			const remaining = entry.quotaInfo?.remainingFraction;
+			const rawRemaining = entry.quotaInfo?.remainingFraction;
+			const remaining = typeof rawRemaining === "number" && Number.isFinite(rawRemaining) ? Math.min(1, Math.max(0, rawRemaining)) : void 0;
 			const resetTime = entry.quotaInfo?.resetTime;
-			if (typeof remaining !== "number" || !Number.isFinite(remaining)) continue;
+			if (remaining === void 0) continue;
 			if (!familyModels[fam]) familyModels[fam] = [];
 			familyModels[fam].push({
 				modelId,
@@ -29719,7 +30733,7 @@ var QuotaService = class {
 		if (!force) {
 			const now = Date.now();
 			for (const acc of accounts) {
-				const flagged = acc.authRequired || Object.values(acc.cooldowns).some((cd) => cd && cd.cooldownUntil > now);
+				const flagged = acc.authRequired || Object.values(acc.cooldowns ?? {}).some((cd) => cd && cd.cooldownUntil > now);
 				if (!acc.systemHome || !flagged) continue;
 				const detected = detectEmailFromAgyLogs(acc.systemHome || !acc.dir ? homedir() : acc.dir);
 				if (detected && detected !== acc.email) this.pool.resetAccountIdentity(acc.id, detected);
@@ -29904,15 +30918,39 @@ function writeMcpConfig(workspaceRoot, bridge) {
 		}
 	};
 	root.mcpServers = servers;
+	let written = false;
 	try {
 		writeFileSync(file, JSON.stringify(root, null, 2) + "\n", "utf8");
+		written = true;
 	} catch {
 		return () => {};
 	}
 	return () => {
 		try {
+			if (!written) return;
+			let current = null;
+			try {
+				if (existsSync(file)) current = readFileSync(file, "utf8");
+			} catch {
+				current = null;
+			}
+			if (current === null) return;
+			let parsed = {};
+			try {
+				const v = JSON.parse(current);
+				if (v && typeof v === "object") parsed = v;
+			} catch {
+				return;
+			}
+			const curServers = parsed.mcpServers && typeof parsed.mcpServers === "object" ? parsed.mcpServers : {};
+			if (!(MCP_SERVER_KEY in curServers)) return;
 			if (previous === null) {
-				if (existsSync(file)) unlinkSync(file);
+				delete curServers[MCP_SERVER_KEY];
+				if (Object.keys(curServers).length === 0) unlinkSync(file);
+				else writeFileSync(file, JSON.stringify({
+					...parsed,
+					mcpServers: curServers
+				}, null, 2) + "\n", "utf8");
 			} else writeFileSync(file, previous, "utf8");
 		} catch {}
 	};
@@ -29958,6 +30996,11 @@ function apply(ctx, entryConfig = {}) {
 	let lastRun = null;
 	let lastParser = new StreamJsonParser();
 	const getConfig = () => resolveConfig(entryConfig);
+	const notifyPicker = () => {
+		try {
+			ctx.emit("llm/adapters-updated");
+		} catch {}
+	};
 	const bin = () => {
 		if (binCache === void 0 || binCache === null) binCache = resolveAgyBin(getConfig());
 		return binCache;
@@ -30085,6 +31128,7 @@ function apply(ctx, entryConfig = {}) {
 				log("version probe failed — continuing with fallback catalog");
 			}
 			await catalog.refreshIfNeeded().catch(() => void 0);
+			notifyPicker();
 		})();
 	}, 4e3);
 	bootProbeTimer.unref?.();
@@ -30121,6 +31165,7 @@ function apply(ctx, entryConfig = {}) {
 	const toolsSvcRef = { current: null };
 	const askToolDispose = { current: null };
 	const mirrorToolDispose = { current: null };
+	const preExecuteDispose = { current: null };
 	const syncAskTool = () => {
 		const want = getConfig().askTool && bin() !== null;
 		if (want && askToolDispose.current === null && toolsSvcRef.current) {
@@ -30150,7 +31195,17 @@ function apply(ctx, entryConfig = {}) {
 		toolsSvcRef.current = sub.get("tools");
 		syncAskTool();
 		syncMirrorTool();
+		const unlisten = sub.on("tools/pre-execute", async (exec, next) => {
+			if (exec.name === "agy_tool") return { kind: "allow" };
+			return next();
+		}, {
+			prepend: true,
+			global: true
+		});
+		preExecuteDispose.current = typeof unlisten === "function" ? unlisten : null;
 		return () => {
+			if (preExecuteDispose.current !== null) preExecuteDispose.current();
+			preExecuteDispose.current = null;
 			if (askToolDispose.current !== null) askToolDispose.current();
 			askToolDispose.current = null;
 			if (mirrorToolDispose.current !== null) mirrorToolDispose.current();
@@ -30213,7 +31268,10 @@ function apply(ctx, entryConfig = {}) {
 							count: cat.models.length,
 							lastError: cat.lastError ?? null
 						},
+						catalogModels: sanitizeCatalogEntries(cat.models).entries,
+						hiddenModels: cfg.hiddenModels,
 						bindings: Object.keys(store.all()).length,
+						credentialIsolationLimited: process.platform === "win32" && pool.getAccounts().some((a) => a.enabled && !a.systemHome),
 						lastRun
 					});
 				})();
@@ -30259,7 +31317,7 @@ function apply(ctx, entryConfig = {}) {
 							if (acc) quota.refreshAccountQuota(acc).catch(() => void 0);
 						} else quota.refreshAllQuotas().catch(() => void 0);
 						store.clear();
-						catalog.forceRefresh().catch(() => void 0);
+						catalog.forceRefresh().then(() => notifyPicker()).catch(() => void 0);
 					}
 					sendJson(res, 200, st);
 				})();
@@ -30388,6 +31446,7 @@ function apply(ctx, entryConfig = {}) {
 					const body = await readBody(req);
 					const alias = typeof body.alias === "string" ? body.alias : void 0;
 					const acc = pool.createAccountSlot(alias);
+					pool.markAuthRequired(acc.id, "not signed in yet — complete the terminal login");
 					if (body.autoOpenTerminal !== false && acc.dir) {
 						if (process.platform === "darwin") {
 							const script = `tell application "Terminal" to activate\ntell application "Terminal" to do script "export HOME='${acc.dir}'; agy"`;
@@ -30534,7 +31593,7 @@ function apply(ctx, entryConfig = {}) {
 						const acc = pool.getAccount(id);
 						if (acc) await quota.refreshAccountQuota(acc, true);
 					} else await quota.refreshAllQuotas(true);
-					catalog.forceRefresh().catch(() => void 0);
+					catalog.forceRefresh().then(() => notifyPicker()).catch(() => void 0);
 					sendJson(res, 200, {
 						ok: true,
 						pool: pool.getPoolData()
@@ -30578,14 +31637,20 @@ function apply(ctx, entryConfig = {}) {
 						"defaultModel",
 						"defaultEffort",
 						"askTool",
-						"workspaceRoot"
+						"workspaceRoot",
+						"hiddenModels"
 					].includes(key)) {
 						sendJson(res, 400, { error: "key not settable" });
 						return;
 					}
+					if (key === "hiddenModels" && (!Array.isArray(body.value) || !body.value.every((x) => typeof x === "string"))) {
+						sendJson(res, 400, { error: "hiddenModels must be an array of model ids" });
+						return;
+					}
 					setOverride(key, body.value);
 					syncAskTool();
 					syncMirrorTool();
+					if (key === "hiddenModels") notifyPicker();
 					sendJson(res, 200, {
 						ok: true,
 						key,