dsh-agy-link 0.4.44 → 0.4.46

package/docs/KNOWN-GAPS.md

@@ -2,6 +2,22 @@
 
 Deliberate v1 boundaries and upstream-behavior notes.
 
+## Platform limits
+
+- **Windows: pool accounts cannot isolate credentials (issue #45)** — agy on
+  Windows stores its login in the system-wide Credential Manager slot
+  `gemini:antigravity` (go-keyring). `HOME`/`USERPROFILE`/`GEMINI_CLI_HOME`
+  isolation moves files only, so every isolated pool account still
+  authenticates — and bills — as the system login: round-robin rotates
+  workspaces, not credentials. The plugin surfaces
+  `credentialIsolationLimited` in `/plugins/agy-link/status` (rendered as a
+  warning banner in the settings panel) and logs once per isolated account
+  when it is selected. A real fix needs agy to namespace its keyring per
+  HOME or to fall back to the per-HOME token file when the keyring slot is
+  empty; swapping the shared slot via `CredWrite` around each spawn is not
+  implemented because concurrent runs (`maxConcurrent > 1`) would overwrite
+  each other's credential mid-run.
+
 ## Not forwarded to agy
 
 - **Images as true multimodal blocks** - agy print mode (`-p`) has no image

package/docs/README.en.md

@@ -52,6 +52,7 @@ In DSH, click the `AGY (n)` badge and choose **Add Account** to complete Google
 | `defaultModel` | `DSH_AGY_DEFAULT_MODEL` | agy default | Default model slug |
 | `defaultEffort` | `DSH_AGY_DEFAULT_EFFORT` | model default | `low`, `medium`, or `high` |
 | `timeoutMs` | `DSH_AGY_TIMEOUT_MS` | `600000` | Activity watchdog timeout in ms |
+| `longToolIdleMinutes` | `DSH_AGY_LONG_TOOL_IDLE_MINUTES` | `240` | Idle budget (minutes) while an agy tool step is still open; `0` = keep `timeoutMs` so a wedged tool fails fast |
 | `workspaceRoot` | `DSH_AGY_WORKSPACE_ROOT` | session cwd | Workspace root |
 
 ## `/agy` commands

package/docs/README.es.md

@@ -52,6 +52,7 @@ En DSH, haga clic en la insignia `AGY (n)` y seleccione **Add Account** para com
 | `defaultModel` | `DSH_AGY_DEFAULT_MODEL` | predeterminado de agy | Slug del modelo predeterminado |
 | `defaultEffort` | `DSH_AGY_DEFAULT_EFFORT` | predeterminado del modelo | `low`, `medium` o `high` |
 | `timeoutMs` | `DSH_AGY_TIMEOUT_MS` | `600000` | Timeout del watchdog en ms |
+| `longToolIdleMinutes` | `DSH_AGY_LONG_TOOL_IDLE_MINUTES` | `240` | Presupuesto de inactividad (minutos) mientras un paso de herramienta sigue abierto; `0` = mantener `timeoutMs` |
 | `workspaceRoot` | `DSH_AGY_WORKSPACE_ROOT` | cwd de la sesión | Raíz del workspace |
 
 ## Comandos `/agy`

package/docs/README.pt-BR.md

@@ -52,6 +52,7 @@ No DSH, clique no selo `AGY (n)` e selecione **Add Account** para concluir o log
 | `defaultModel` | `DSH_AGY_DEFAULT_MODEL` | padrão do agy | Slug do modelo padrão |
 | `defaultEffort` | `DSH_AGY_DEFAULT_EFFORT` | padrão do modelo | `low`, `medium` ou `high` |
 | `timeoutMs` | `DSH_AGY_TIMEOUT_MS` | `600000` | Timeout do watchdog, em ms |
+| `longToolIdleMinutes` | `DSH_AGY_LONG_TOOL_IDLE_MINUTES` | `240` | Orçamento de inatividade (minutos) enquanto um passo de ferramenta está aberto; `0` = manter `timeoutMs` |
 | `workspaceRoot` | `DSH_AGY_WORKSPACE_ROOT` | cwd da sessão | Raiz do workspace |
 
 ## Comandos `/agy`

package/docs/adr-012-account-pool.md

@@ -37,12 +37,16 @@ Spawning agy for Account $X$ simply injects `HOME=/path/to/~/.dsh/agy-accounts/a
 ### 2. Sticky Sequential Drain Strategy (按模型家族顺次耗尽)
 - **Family-Scoped Cooldown**: Quota is tracked per model family (`google`, `anthropic`, `openai`). If Account A hits 429 on Claude 4.6, only Account A's `anthropic` family is marked in cooldown. Account A can still serve Gemini 3.7 Flash requests.
 - **Sticky Affinity**: Requests stick to the first healthy account (e.g., Account A) to maximize conversation continuity and token caching.
-- **Transparent Fallback**: When an in-flight request on Account A receives 429 / quota exceeded, the adapter records cooldown on Account A for that family and immediately transparently retries on Account B in the same streaming span. The user experiences zero interruption.
+- **Transparent Fallback**: When a request on Account A is refused for an account-scoped reason (429 / quota, region eligibility, transport-flavoured auth, soft capacity), the adapter records the cooldown or rotates the sticky pointer, and the SAME step continues on Account B — either through DSH's automatic retry (the first-span case) or by discarding the dead recording and re-assembling on the next account (the post-tool case). The user experiences no interruption and never resends.
+  - Account failover is bounded by the pool: DSH's retry budget is `min(enabled accounts - 1, 2)` retries, and the post-tool failover allows at most `enabled accounts - 1` re-spawns per session inside a 2-minute window. A deterministic (request-level) failure is never failed over, so a broken request cannot loop through the pool re-running its tools.
+  - A genuine sign-out (`AUTH`) is retryable only when the pool has another account that may still be signed in; the failed account is flagged `authRequired` and leaves rotation.
 
 ### 3. Cooldown & Reset Handling
 - If the error contains a server reset time (or `Retry-After`), cooldown is set to `Date.now() + resetMs`.
-- Default cooldown window is 10 minutes (tiered up to 60 minutes on consecutive 429s).
+- Default cooldown window is 15 minutes (`defaultCooldownMs`, tiered up to 60 minutes on consecutive 429s).
 - Cooldown expires automatically; when Account A recovers, it resumes primary position.
+- Soft capacity refusals ("model overloaded" / high traffic) NEVER set a cooldown: nothing was spent. They rotate the pointer and are retryable anyway, so an idle account can still serve the turn.
+- "All accounts unavailable" reports the real state (N in cooldown, N signed out) with the earliest availability, which includes quota-window resets and not just cooldowns; a reset that is ≤ 20s away is waited out instead of failing the turn.
 
 ### 4. Optional Per-Account Proxy (防关联支持)
 Each account can optionally specify a dedicated proxy URL (`socks5://...` or `http://...`). When set, `ALL_PROXY` / `HTTPS_PROXY` / `HTTP_PROXY` are scoped exclusively to that account's child process. If unconfigured, it inherits the global host environment proxy.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-agy-link",
-  "version": "0.4.44",
+  "version": "0.4.46",
   "description": "Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.",
   "type": "module",
   "license": "MIT",