dsh-agy-link 0.4.57 → 0.4.59

package/CHANGELOG.md

@@ -1,5 +1,68 @@
 # Changelog
 
+## 0.4.59 (2026-10-16)
+
+### English
+
+- **Fix: turns queued for the Windows credential slot could pend forever as invisible zombies, immune to Stop (cardboard-empire incident, 2026-10-16 22:44).**
+  - **Incident**: a turn dispatched while another session's 32-minute run held the process-global credential slot never received the release wake-up. The turn sat at `request/context` with no agy process spawned for 30+ minutes; the idle watchdog never armed (it only arms after spawn); Stop did nothing because no wait in the dispatch phase observed the abort signal; and the leaked dispatch held one of the 3 `maxConcurrent` slots, starving later turns of other sessions into the same wedge.
+  - **Changes**:
+    1. **`AsyncMutex` rewrite** (`credential-slot.ts`): the promise-chain FIFO could never remove a waiter — an abandoned/aborted one would wedge the whole chain behind it. Now an explicit queue: a cancelled or timed-out waiter is REMOVED and the holder's release wakes the head directly. Cancelling a waiter deliberately does NOT grant the mutex (it is still held).
+    2. **Abort + bounded wait for the slot** (`acquireCredentialSlot`): new `signal` / `dispatchTimeoutMs` resolve-options. Stop now ends a queued dispatch immediately (`AbortedWaitError`); a bounded wait fails visibly (`WaitTimeoutError`) instead of parking silently.
+    3. **Lost-wake-up self-heal**: while queued, a liveness poll (5s) re-checks and takes the mutex directly if it is actually free — the exact failure shape from the incident now self-corrects within seconds even if a wake-up is ever lost again.
+    4. **Dispatch observability**: a 2-minute heartbeat logs the queue state ("dispatch still waiting Nm — X waiter(s), Y holder(s) … press Stop to cancel") so a stuck dispatch is visible in the console instead of a silent spinner.
+    5. **Dispatch retry** (`adapter.ts`): on a hard-cap slot timeout the dispatch releases the concurrency slot, backs off abort-aware (2s→4s→…→15s), and retries (`dispatchRetries`, default 1); exhaustion fails the turn VISIBLY with guidance — never an infinite pending state. Retry is confined to the pre-spawn dispatch phase; a turn that already emitted output is never re-driven.
+    6. **Rate-limit spacing sleep** is now abort-aware (Stop during the 60s window no longer spawns a turn nobody is reading).
+  - **Config**: new `dispatchTimeoutMinutes` (default **15** — each attempt waits up to 15 minutes for the slot, so persistence ≈ (1+retries)×15 min before a visible failure; 0 = wait indefinitely, still abort-aware / poll-healed / heartbeat-logged) and `dispatchRetries` (default 1). User-facing entry: `/agy dispatch` (inspect live queue + effective caps), `/agy dispatch <minutes|off>` and `/agy dispatch-retries <n>` — persisted via runtime overrides, effective next turn.
+  - **Fix: artificial concurrency limits removed — native agy parallelism restored.**
+    - agy is a stateless CLI and handles concurrent processes natively; the only machine-global constraint on Windows is the single credential store, and only when its IDENTITY changes.
+    - **Same-account fast path** (`parallelSameAccount`, default **on**): a run whose credential already sits in the slot starts immediately WITHOUT the mutex, so N sessions on one account run truly in parallel (concurrent refreshes on one grant are safe — refresh tokens are not single-use). `/agy parallel <on|off>` toggles it.
+    - **Account switches still serialize** (correctness): a secondary waits for same-account runs to drain before swapping the slot, new fast paths are refused while a switch pends, and the switch restores the primary afterwards — the anti-corruption invariants are unchanged and covered by new tests.
+    - **`maxConcurrent` default 3 → 0 (unlimited)**: no artificial admission bound; Google rate limits and the pool's cooldowns are the natural regulators. `/agy max-concurrent <n|off>`.
+  - **Tests**: mutex cancel-removes-and-wakes-next; timeout keeps the queue flowing; lost-wake-up poll grant; `acquireCredentialSlot` rejects when already aborted, honors Stop while queued, and fails visibly on the bounded wait.
+
+### 中文 (Chinese)
+
+- **修复：排队等 Windows 凭据槽位的回合可能永远挂起成隐形僵尸，且 Stop 无法取消（cardboard-empire 事件，2026-10-16 22:44）。**
+  - **事件**：一个回合在另一会话 32 分钟长任务持有进程级凭据槽位期间派发，之后永远没有收到释放唤醒。该回合停在 `request/context`，30 多分钟没有拉起任何 agy 进程；空闲看门狗从未武装（只在 spawn 后才武装）；按 Stop 无效，因为派发阶段的所有等待都没有观察中止信号；泄漏的派发还占着 3 个 `maxConcurrent` 槽位之一，把其他会话的新回合也拖进同样的卡死。
+  - **修改**：
+    1. **重写 `AsyncMutex`**（credential-slot.ts）：原来的 promise 链式 FIFO 无法移除等待者——一个被放弃/中止的等待者会把整条链卡死。现在改为显式队列：被取消/超时的等待者会被移除，持有者释放时直接唤醒队头。取消等待者刻意不发放互斥锁（锁仍被持有）。
+    2. **槽位等待支持中止与限时**（`acquireCredentialSlot`）：新增 `signal` / `dispatchTimeoutMs` 选项。Stop 现在立即结束排队中的派发（`AbortedWaitError`）；限时等待可见地失败（`WaitTimeoutError`），不再静默挂起。
+    3. **丢失唤醒自愈**：排队期间每 5 秒自检一次，发现锁实际空闲就直接取锁——即使唤醒再次丢失，本事件形态也会在数秒内自愈。
+    4. **派发可观测性**：每 2 分钟心跳记录队列状态（"dispatch still waiting Nm — X waiter(s), Y holder(s) … press Stop to cancel"），卡死的派发在控制台可见，而不是无声转圈。
+    5. **派发重试**（adapter.ts）：槽位硬超时后释放并发槽位、可中止退避（2s→4s→…→15s）并重试（`dispatchRetries`，默认 1）；重试耗尽则让回合可见地失败并给出处理指引——绝不无限 pending。重试仅限 spawn 前的派发阶段；已经产出内容的回合绝不重跑。
+    6. **限流退避 sleep** 支持中止（60 秒窗口内的 Stop 不再照常 spawn 一个没人读的回合）。
+  - **配置**：新增 `dispatchTimeoutMinutes`（默认 **15** —— 每轮最多等 15 分钟，含重试总坚持 ≈ (1+重试)×15 分钟后可见失败；0 = 无限等待，仍可中止/轮询自愈/心跳可见）与 `dispatchRetries`（默认 1）。用户入口：`/agy dispatch`（查看实时队列与当前配置）、`/agy dispatch <分钟|off>` 与 `/agy dispatch-retries <次数>` —— 经 runtime overrides 持久化，下一回合生效。
+  - **修复：移除人为并发限制，恢复 agy 原生并行能力。**
+    - agy 是无状态 CLI，天然支持多进程并发；Windows 上唯一的机器级约束是单一凭据库，且仅在**账号身份切换**时才需要互斥。
+    - **同账号快路径**（`parallelSameAccount`，默认**开**）：凭据已在槽位中的账号立即启动、完全不取互斥锁 —— N 个会话在同一账号上真并行（同一授权的并发 token 刷新是安全的，refresh token 非一次性）。`/agy parallel <on|off>` 开关。
+    - **账号切换仍然串行**（正确性）：副账号先等同账号 run 全部退出再换槽位；切换等待期间拒绝新的快路径；切换完成后恢复主账号 —— 防腐蚀不变量原样保留，新增测试覆盖。
+    - **`maxConcurrent` 默认 3 → 0（不限制）**：移除人为准入上限；Google 速率限制与账号池冷却是天然调节器。`/agy max-concurrent <n|off>`。
+  - **测试**：互斥锁取消后移除并唤醒下一个；超时不阻塞队列；丢失唤醒的轮询补偿；`acquireCredentialSlot` 已中止即拒绝、排队中响应 Stop、限时等待可见失败。
+
+## 0.4.58 (2026-10-16)
+
+- **Fix: DSH `/goal` loop restart bug (autonomous runs continuing indefinitely instead of marking complete).**
+  - **Root Cause**:
+    1. In `src/host/mapper.ts`, whenever an agy run finished with `!ev.ok` (e.g. background EOF/network timeout right as generation finishes), it yielded `{ type: 'finish', reason: { kind: 'stop' } }` and returned early, bypassing the `supportsGoalUpdate` synthetic `update_goal` completion call even when agy generated a full, successful text response. DSH interpreted this as an uncompleted round and scheduled subsequent rounds indefinitely.
+    2. In `src/index.ts`, `sessionGoal` attempted to read `session.events`, but DSH `Session` instances store events in `session.log` / `session.snapshotEvents()`, causing session goal resolution to always return `null`.
+    3. In `src/host/dsh-goal.ts`, `isGoalToolContinuation` only inspected `messages[messages.length - 1]`. When DSH executes `update_goal`, it defers a `<goal_complete>` user notice (`source.kind: 'tool-goal'`), placing the tool result at `messages.length - 2` and causing agy to respawn on the completion notice.
+  - **Fix**:
+    1. `EventMapper.map` now unifies the finish path so `update_goal` and `exit_plan_mode` are always dispatched upon successful response generation regardless of trailing transport EOF flags.
+    2. `sessionGoal` queries DSH's live `ctx.goals.get(agent)` in O(1) and falls back to `session.log` / `session.snapshotEvents()`.
+    3. `isGoalToolContinuation` checks the trailing span for `agytc-bridge-goal-`, `source.kind === 'tool-goal'`, and `<goal_complete>`, finishing cleanly without respawning agy.
+    4. Marked `tool-goal` and `<goal_complete>` as synthetic harness messages so they never get treated as human user instructions.
+
+- **Fix: real-time 5-hour quota consumption and rolling countdown now accurately display instead of staying frozen at 100% / blank.**
+  - **Root Cause**:
+    1. Google's `retrieveUserQuotaSummary` endpoint returns coarse group-level numbers (`gemini-5h: 1.0`), while `fetchAvailableModels` reports the actual per-model 5-hour consumption and active rolling reset time (e.g. `0.70`, reset in 12 minutes). `QuotaService.refreshAccountQuota` gated the per-model tightening behind `else if (familyQuotas[fam]!.remainingFraction === undefined)`, so whenever the coarse summary returned `1.0`, active model usage was completely ignored and the family quota was locked at `100%`.
+    2. In `fetchAvailableModels`, hitting any staging endpoint (`daily-cloudcode-pa`) set `this.preferredEndpointIndex`, causing subsequent `retrieveUserQuotaSummary` calls to target the staging endpoint (which omits Gemini entirely).
+    3. `mergeFallbackFamilyQuota` returned stale `prev` data whenever `prev.remainingFraction` existed, freezing accounts at their 10:04 AM state (`resetTime` in the past), which caused `formatQuotaWindow` to drop the expired timestamp as empty and render no duration at all.
+  - **Fix**:
+    1. `fetchAvailableModels` now only sets `preferredEndpointIndex` if the endpoint is the official production endpoint (index 0).
+    2. Active 5-hour model consumption (window <= 6h) now tightens `familyQuotas[fam].remainingFraction` and its `resetTime` even when summary returned a coarse `1.0`.
+    3. Full-quota rows where `resetTime` has expired safely fall back to "已重置 · 可用" instead of a blank row, while active windows display the real rolling countdown (e.g. `↻ 02:50 (4小时 55分钟)`).
+
 ## 0.4.57 (2026-10-16)
 
 ### English

package/README.md

@@ -24,7 +24,7 @@
 
 # 中文
 
-把 **Google Antigravity 模型接入 DeepSeek Harness（DSH）** —— 支持**多账号智能池化轮换**、**官方双 Bucket 配额监控（5小时滚动 + 7天周额度）**、**浏览器免粘贴一键登录**与**浅色/深色主题高对比度自适应**，由官方未修改的 `agy` CLI 驱动，完整支持流式输出、思考折叠（thinking）、原生工具卡片与精确 token 用量。
+把 **Google Antigravity 模型接入 DeepSeek Harness（DSH）** —— 支持**多账号智能池化轮换**、**官方多 Bucket 配额监控（5小时滚动 + 7天周额度 + Argon 独立周池）**、**浏览器免粘贴一键登录**与**浅色/深色主题高对比度自适应**，由官方未修改的 `agy` CLI 驱动，完整支持流式输出、思考折叠（thinking）、原生工具卡片与精确 token 用量。
 
 <p align="center">
   <img src="./docs/assets/dashboard.png" alt="Antigravity 管理控制台 - 多账号池化与配额监控" width="460" />
@@ -54,11 +54,14 @@
 
 - 👥 **多账号池化管理 (Account Pool)**：在 DSH 内添加任意数量的 Google 账号（主账号 + 备用账号群），每个账号拥有独立的 HOME 目录沙箱与凭证隔离。
 - 🔄 **顺序耗尽故障转移 (Sequential Drain)**：当前账号额度用尽（触发 429 限流或 5h / 周额度耗尽）时，系统**自动平滑接力至下一个可用账号**，对话完全不中断！
-- 📊 **官方双 Bucket 配额监控 (Dual-Bucket Quota)**：直接调用 Antigravity 官方专用的 `v1internal:retrieveUserQuotaSummary` 接口，同时展示 **5小时滚动额度** 与 **7天周额度** 真实数据及精准重置倒计时。
+- 🕰 **额度到期优先轮换 (Quota-Expiry-First)**：多个账号可用时，优先切换到**重置窗口最早到期**的账号，把"还剩很久才重置"的额度留给后面，整体池化利用率最大化。
+- 🧠 **网络抖动智能甄别 (Jitter-Safe Auth)**：代理抖动导致的 keyring 鉴权超时会被自动识别为**可重试的网络错误**而非"登录失效"——基于 agy 本次运行日志的 `keyringAuth` 传输证据精准分类，且粘性"需重新登录"隔离需二次确认，健康账号绝不会被误标。
+- 📊 **官方多 Bucket 配额监控 (Multi-Bucket Quota)**：直接调用 Antigravity 官方专用的 `v1internal:retrieveUserQuotaSummary` 接口，同时展示 **5小时滚动额度**、**7天周额度**，以及付费 Pro/Ultra 账号专属的 **Gemini 4 Argon 独立周额度池**（不占用普通 Gemini 池）。
+- 🔀 **手动切换当前账号 (Manual Switch-Active)**：控制台卡片一键「设为当前使用」，即刻把调度指针钉到指定账号。
 - 🔑 **GUI 内浏览器免粘贴登录 (In-GUI Zero-Paste OAuth)**：点击「➕ 添加账号」自动调起系统浏览器，本地回环监听自动捕获授权凭证，**全程无需手动复制粘贴授权码**。
 - 🎨 **多主题高对比度自适应 (Light & Dark Themes)**：原生适配 DSH 浅色/深色主题，告别发暗发灰与看不清文字，UI 视觉清晰锐利。
-- 🌐 **独立账号网络代理 (Per-Account Proxy)**：支持为每个账号独立绑定 HTTP(S) / SOCKS 代理，避免多账号同 IP 引起风控。
-- ⚡ **分模型族独立冷却 (Family-Scoped Cooldown)**：Gemini 与 Claude / GPT-OSS 速率限制独立计算，某个模型族受限不影响其他模型族正常调用。
+- 🌐 **独立账号网络代理 (Per-Account Proxy)**：支持为每个账号独立绑定 HTTP(S) / SOCKS 代理，避免多账号同 IP 引起风控；未显式配置时自动探测系统代理（macOS `scutil` / Windows 注册表 / Linux gsettings）。
+- ⚡ **分模型族独立冷却 (Family-Scoped Cooldown)**：Gemini、Claude、GPT-OSS 与 Argon 的速率限制独立计算，某个模型族受限不影响其他模型族正常调用。
 
 ---
 
@@ -66,20 +69,23 @@
 
 | 能力 | 说明 |
 | ---- | ---- |
-| 👥 **多账号池化轮换** | 支持主账号 + 多个备用账号；遇到 429 或配额耗尽自动平滑切换，模型族独立冷却 |
-| 📊 **官方双 Bucket 配额监控** | 实时拉取官方端点，同时呈现 **5h 滚动额度** 与 **7d 周额度** 双进度条与倒计时，单模型明细可展开 |
+| 👥 **多账号池化轮换** | 支持主账号 + 多个备用账号；遇到 429 或配额耗尽自动平滑切换，模型族独立冷却，额度到期早的账号优先接班 |
+| 🧠 **抖动安全鉴权 (Jitter-Safe Auth)** | 基于 agy 运行日志的 keyring 传输证据区分"网络抖动"与"真登出"，抖动自动按可重试网络错误处理；粘性隔离需二次确认，杜绝误标"需重新登录" |
+| 📊 **官方多 Bucket 配额监控** | 实时拉取官方端点，同时呈现 **5h 滚动额度**、**7d 周额度**与 **Argon 独立周池**（付费 Pro/Ultra）多进度条与倒计时，单模型明细可展开 |
 | 🔑 **浏览器一键登录** | 点击添加账号自动唤起 Google 授权页，本地回环自动捕获，全程无需复制粘贴任何代码 |
+| 🔀 **手动切换当前账号** | 控制台「设为当前使用」按钮即刻钉住调度指针；顶部徽标始终显示服务器实际调度的账号 |
 | 🎨 **多主题高对比 UI** | 浅色、深色主题自适应变色，纯矢量 SVG 图标（无 Emoji），字迹清晰不发暗 |
-| 🌐 **独立账号代理** | 每个账号支持独立配置 HTTP(S) 代理，隔离 IP 出口 |
-| 🔌 **原生模型路由** | 在 DSH 模型配置中注册 `antigravity` 提供方，`/model` 选择器随心切换 Gemini / Claude / GPT-OSS |
+| 🌐 **独立账号代理** | 每个账号支持独立配置 HTTP(S) 代理，隔离 IP 出口；亦可自动探测系统代理 |
+| 🔌 **原生模型路由** | 在 DSH 模型配置中注册 `antigravity` 提供方，`/model` 选择器随心切换 Gemini / Claude / GPT-OSS / Argon |
 | 🌊 **完整流式映射** | 文本、思考过程（thinking turn）与工具活动均无损映射到 DSH 原生流协议 |
 | 🃏 **原生工具卡片** | agy 执行的终端命令（`run_command`）、文件修改（inline diff）均以 DSH 原生卡片渲染 |
 | 🔗 **会话上下文保真** | DSH 会话与 agy 原生会话绑定（`--conversation`），由 agy 管理完整历史，每轮仅发送增量 |
+| 🎯 **DSH 目标与计划集成** | 长任务自动携带 DSH goal / plan 上下文，工具续跑不丢任务状态 |
 | 📊 **精确 Token 统计** | 输入 / 输出 / 思考 / 缓存读取 token 完整计入 DSH 用量统计，全面适配 1M 上下文 |
 | 🎛 **顶部控制台徽标** | 顶部栏 `AGY (n)` 徽标一键弹出控制台，直观查看账号池、配额进度条与代理状态 |
 | 🖼 **图片多模态** | 支持多模态图片传入，自动落盘本地媒体目录并通过 `--add-dir` 安全授权给 agy 查看 |
 | 🤝 **`agy_ask` 辅助工具** | 允许任意 DSH 模型把单次任务委托给 Antigravity 模型（AskAntigravity 协作模式） |
-| ⌨️ **`/agy` 快捷命令族** | `status` / `auth` / `models` / `mode` / `effort` / `workspace` / `clear` / `doctor` / `help` |
+| ⌨️ **`/agy` 快捷命令族** | `status` / `pool` / `auth` / `models` / `mode` / `effort` / `workspace` / `goal` / `session` / `enable-account` / `disable-account` / `clear` / `doctor` / `help` |
 
 ---
 
@@ -144,8 +150,9 @@ dsh plugin --profile web add dsh-agy-link
 
 1. **短生命周期进程驱动**：每一轮 DSH 对话启动一个独立的官方 `agy -p --output-format stream-json` 进程，解析 NDJSON 事件流。
 2. **多账号沙箱机制**：除主账号沿用系统默认 Keychain / HOME 外，所有备用账号在插件私有目录下建立专属 HOME 隔离区，独立写入 agy 格式的标准 OAuth 凭证。
-3. **双 Bucket 官方配额汇总**：插件定时后台静默轮询官方 `v1internal:retrieveUserQuotaSummary`，精准掌控每个账号的 5h 滚动削峰水位与 7d 账号阶梯周额度。
-4. **会话级无缝故障转移**：当遭遇 HTTP 429、额度耗尽或凭证异常时，号池调度器自动标记当前账号家族进入冷却，并无缝将后续请求路由到池内下一个有效账号。
+3. **多 Bucket 官方配额汇总**：插件定时后台静默轮询官方 `v1internal:retrieveUserQuotaSummary`，精准掌控每个账号的 5h 滚动削峰水位、7d 账号阶梯周额度，以及付费账号的 Argon 独立周池。
+4. **会话级无缝故障转移**：当遭遇 HTTP 429、额度耗尽或凭证异常时，号池调度器自动标记当前账号家族进入冷却（或按额度到期时间择优轮换），并无缝将后续请求路由到池内下一个有效账号。
+5. **失败分类与自愈**：错误按 AUTH / NETWORK / RATE_LIMIT / ELIGIBILITY 等精确分类；网络抖动借由 agy 运行日志自动甄别为可重试故障，绝不误伤健康账号的登录状态。
 
 ---
 
@@ -170,7 +177,7 @@ MIT License.
 
 # English
 
-Bring **Google Antigravity models into DeepSeek Harness (DSH)** — featuring **Multi-Account Pooling & Automatic Rotation**, **Official Dual-Bucket Quota Tracking (5h Rolling + 7d Weekly)**, **Zero-Paste In-GUI OAuth Login**, and **Theme-Adaptive High-Contrast UI**, powered by the official unmodified `agy` CLI.
+Bring **Google Antigravity models into DeepSeek Harness (DSH)** — featuring **Multi-Account Pooling & Automatic Rotation**, **Official Multi-Bucket Quota Tracking (5h Rolling + 7d Weekly + Argon Weekly Pool)**, **Zero-Paste In-GUI OAuth Login**, and **Theme-Adaptive High-Contrast UI**, powered by the official unmodified `agy` CLI.
 
 <p align="center">
   <img src="./docs/assets/dashboard.png" alt="Antigravity Management Console - Multi-Account Pool & Quota Monitor" width="460" />
@@ -199,11 +206,14 @@ Have multiple Google Antigravity / Gemini accounts? **dsh-agy-link makes multi-a
 
 - 👥 **Multi-Account Pooling**: Manage unlimited Google accounts (Primary + Secondary pool) with fully isolated HOME sandbox environments and credentials.
 - 🔄 **Sequential Drain Failover**: When an account reaches its rate limits (429) or runs out of 5h/weekly quotas, requests **automatically and smoothly fail over to the next available account** without interrupting your conversation!
-- 📊 **Official Dual-Bucket Quota Tracking**: Direct integration with Antigravity's official `v1internal:retrieveUserQuotaSummary` endpoint, providing real-time visibility for both **5-Hour Rolling Limit** and **7-Day Weekly Limit** with live countdowns.
+- 🕰 **Quota-Expiry-First Rotation**: With several accounts available, the scheduler prefers the one whose **reset window expires soonest**, maximizing utilization across the whole pool.
+- 🧠 **Jitter-Safe Auth Classification**: A keyring-auth timeout caused by proxy jitter is recognized as a **retryable network error**, not a sign-out — classified from the `keyringAuth` transport evidence in agy's own run log, and sticky "needs re-login" quarantine requires a second confirmation, so healthy accounts are never falsely flagged.
+- 📊 **Official Multi-Bucket Quota Tracking**: Direct integration with Antigravity's official `v1internal:retrieveUserQuotaSummary` endpoint, providing real-time visibility for the **5-Hour Rolling Limit**, the **7-Day Weekly Limit**, and the **Gemini 4 Argon weekly pool** (paid Pro/Ultra accounts, billed separately from the plain Gemini pool).
+- 🔀 **Manual Switch-Active**: One click on "Set active" pins the scheduler pointer to the account you choose.
 - 🔑 **In-GUI Zero-Paste OAuth**: One-click "Add Account" opens your browser and automatically captures OAuth tokens via local loopback — **no copying and pasting of authorization codes required**.
 - 🎨 **Theme-Adaptive High-Contrast UI**: Seamlessly adapts to Light and Dark DSH themes with crystal clear typography and crisp contrast.
-- 🌐 **Per-Account Proxy**: Configure dedicated HTTP(S) / SOCKS proxy for each individual account to isolate IP addresses.
-- ⚡ **Family-Scoped Cooldowns**: Gemini, Claude, and GPT-OSS rate limits are calculated independently, preventing one exhausted model from blocking others.
+- 🌐 **Per-Account Proxy**: Configure dedicated HTTP(S) / SOCKS proxy for each individual account to isolate IP addresses; when unset, the system proxy is auto-detected (macOS `scutil` / Windows registry / Linux gsettings).
+- ⚡ **Family-Scoped Cooldowns**: Gemini, Claude, GPT-OSS, and Argon rate limits are calculated independently, preventing one exhausted model from blocking others.
 
 ---
 
@@ -211,20 +221,23 @@ Have multiple Google Antigravity / Gemini accounts? **dsh-agy-link makes multi-a
 
 | Feature | Description |
 | --- | --- |
-| 👥 **Multi-Account Pool** | Primary + unlimited spare accounts with automatic Sequential Drain rotation upon rate limits |
-| 📊 **Dual-Bucket Quota HUD** | Real-time dual progress bars for both **5h rolling** and **7d weekly** quota limits with exact reset countdowns |
+| 👥 **Multi-Account Pool** | Primary + unlimited spare accounts with automatic Sequential Drain rotation upon rate limits; quota-expiry-first scheduling |
+| 🧠 **Jitter-Safe Auth** | Distinguishes network jitter from a real sign-out via keyring transport evidence in agy's run log; sticky quarantine requires confirmation — no false "needs re-login" flags |
+| 📊 **Multi-Bucket Quota HUD** | Real-time progress bars for the **5h rolling**, **7d weekly**, and **Argon weekly** (paid Pro/Ultra) pools with exact reset countdowns |
 | 🔑 **Zero-Paste Browser Login** | Automatic browser-based Google OAuth login with loopback callback handler |
+| 🔀 **Manual Switch-Active** | Pin the scheduler to any account from the console; the header badge always names the server-scheduled account |
 | 🎨 **Theme-Adaptive UI** | Dynamic light/dark theme switching, pure SVG vector marks (no emojis), high contrast |
-| 🌐 **Per-Account Proxy** | Dedicated HTTP(S) proxy per account slot |
-| 🔌 **Native Model Routing** | Registers `antigravity` provider in DSH; choose Gemini / Claude / GPT-OSS in `/model` picker |
+| 🌐 **Per-Account Proxy** | Dedicated HTTP(S) proxy per account slot, or auto-detected system proxy |
+| 🔌 **Native Model Routing** | Registers `antigravity` provider in DSH; choose Gemini / Claude / GPT-OSS / Argon in `/model` picker |
 | 🌊 **Full Streaming Protocol** | Native streaming for text, thinking turn annotations, and tool calls |
 | 🃏 **Native Tool UI Cards** | Command runs and inline diffs render as clean, native DSH tool cards |
 | 🔗 **Session Continuity** | Binds DSH sessions to native agy conversations (`--conversation`) for zero-redundancy context |
+| 🎯 **DSH Goal & Plan Integration** | Long-running tasks carry DSH goal / plan context across tool continuations |
 | 📊 **Accurate Token Metering** | Input, output, thinking, and cacheRead tokens are fully reported to DSH with 1M context support |
 | 🎛 **Top Header Console Badge** | Click the `AGY (n)` badge in the header to instantly open the management console |
 | 🖼 **Multimodal Images** | Stages images to local storage and passes safe absolute paths via `--add-dir` |
 | 🤝 **`agy_ask` Delegation** | Allows other DSH models to delegate subtasks to Antigravity models |
-| ⌨️ **`/agy` Commands** | Full command suite: `status`, `auth`, `models`, `mode`, `effort`, `workspace`, `clear`, `doctor`, `help` |
+| ⌨️ **`/agy` Commands** | Full command suite: `status`, `pool`, `auth`, `models`, `mode`, `effort`, `workspace`, `goal`, `session`, `enable-account`, `disable-account`, `clear`, `doctor`, `help` |
 
 ---
 
@@ -273,6 +286,7 @@ dsh plugin --profile web add dsh-agy-link
 | `defaultEffort` | `DSH_AGY_DEFAULT_EFFORT` | `(model default)` | Thinking budget: `low` / `medium` / `high` |
 | `hiddenModels` | `DSH_AGY_HIDDEN_MODELS` | `[]` | Model slugs hidden from the `/model` picker (deny-list, newly discovered models stay visible; manage them via the "Model visibility" row in the settings panel) |
 | `timeoutMs` | `DSH_AGY_TIMEOUT_MS` | `600000` | Activity watchdog timeout in milliseconds |
+| `longToolIdleMinutes` | `DSH_AGY_LONG_TOOL_IDLE_MINUTES` | `240` | Idle budget while a tool step is ACTIVE (minutes); `0` keeps the normal `timeoutMs` budget so wedged tools fail fast |
 | `workspaceRoot` | `DSH_AGY_WORKSPACE_ROOT` | session cwd | Working directory root |
 
 ---

package/dist/client.js

@@ -105,6 +105,7 @@ window.__ModuleLoader__.load({
 			"quota.fiveHour": "5 小时额度",
 			"quota.weekly": "周额度",
 			"quota.refreshed": "额度已刷新",
+			"quota.windowReset": "已重置 · 可用",
 			"proxy.button": "代理",
 			"proxy.placeholder": "专属代理 URL（如：http://127.0.0.1:7890；留空则使用全局）",
 			"proxy.save": "保存",
@@ -244,6 +245,7 @@ window.__ModuleLoader__.load({
 			"quota.fiveHour": "5-hour quota",
 			"quota.weekly": "Weekly quota",
 			"quota.refreshed": "Quota refreshed",
+			"quota.windowReset": "Reset · available",
 			"proxy.button": "Proxy",
 			"proxy.placeholder": "Dedicated proxy URL (for example: http://127.0.0.1:7890; leave blank to use the global proxy)",
 			"proxy.save": "Save",
@@ -383,6 +385,7 @@ window.__ModuleLoader__.load({
 			"quota.fiveHour": "Cota de 5 horas",
 			"quota.weekly": "Cota semanal",
 			"quota.refreshed": "Cota atualizada",
+			"quota.windowReset": "Redefinida · disponível",
 			"proxy.button": "Proxy",
 			"proxy.placeholder": "URL do proxy exclusivo (por exemplo: http://127.0.0.1:7890; deixe vazio para usar o proxy global)",
 			"proxy.save": "Salvar",
@@ -522,6 +525,7 @@ window.__ModuleLoader__.load({
 			"quota.fiveHour": "Cuota de 5 horas",
 			"quota.weekly": "Cuota semanal",
 			"quota.refreshed": "Cuota actualizada",
+			"quota.windowReset": "Reiniciada · disponible",
 			"proxy.button": "Proxy",
 			"proxy.placeholder": "URL de proxy exclusivo (por ejemplo: http://127.0.0.1:7890; déjelo vacío para usar el proxy global)",
 			"proxy.save": "Guardar",
@@ -3592,11 +3596,17 @@ div[data-variant="think"] [class*="thinkBody"] {
 		* Format reset timestamp into readable date/time + relative countdown.
 		*/
 		function formatQuotaWindow(t, resetTimeStr) {
-			if (!resetTimeStr) return { resetText: "" };
+			if (!resetTimeStr) return {
+				resetText: "",
+				expired: false
+			};
 			try {
 				const d = new Date(resetTimeStr);
 				const diffMs = d.getTime() - Date.now();
-				if (diffMs <= 0) return { resetText: "" };
+				if (Number.isNaN(d.getTime()) || diffMs <= 0) return {
+					resetText: "",
+					expired: true
+				};
 				const totalMins = Math.ceil(diffMs / 6e4);
 				const days = Math.floor(totalMins / 1440);
 				const hours = Math.floor(totalMins % 1440 / 60);
@@ -3605,9 +3615,15 @@ div[data-variant="think"] [class*="thinkBody"] {
 				const countdown = days > 0 ? `${days}${t("duration.day")} ${hours}${t("duration.hour")}` : hours > 0 ? `${hours}${t("duration.hour")} ${mins}${t("duration.minute")}` : `${mins}${t("duration.minute")}`;
 				const hh = d.getHours().toString().padStart(2, "0");
 				const mm = d.getMinutes().toString().padStart(2, "0");
-				return { resetText: isWeekly ? `${d.getMonth() + 1}/${d.getDate()} ${hh}:${mm} (${countdown})` : `${hh}:${mm} (${countdown})` };
+				return {
+					resetText: isWeekly ? `${d.getMonth() + 1}/${d.getDate()} ${hh}:${mm} (${countdown})` : `${hh}:${mm} (${countdown})`,
+					expired: false
+				};
 			} catch {
-				return { resetText: "" };
+				return {
+					resetText: "",
+					expired: true
+				};
 			}
 		}
 		/** Inline brand logo (Gemini / Claude / OpenAI) as a crisp SVG mark. */
@@ -4603,8 +4619,11 @@ body.dark,
 					const pct5h = has5h ? Math.max(0, Math.min(100, Math.round(info.remainingFraction * 100))) : -1;
 					const cdNote = inCooldown ? t("account.localCooldown") : "";
 					const w5h = formatQuotaWindow(t, info?.resetTime);
-					const pctWeekly = typeof info?.weeklyFraction === "number" && Number.isFinite(info.weeklyFraction) ? Math.max(0, Math.min(100, Math.round(info.weeklyFraction * 100))) : -1;
+					const expiredFull5h = w5h.expired && has5h && pct5h >= 100;
+					const hasWeekly = typeof info?.weeklyFraction === "number" && Number.isFinite(info.weeklyFraction);
+					const pctWeekly = hasWeekly ? Math.max(0, Math.min(100, Math.round(info.weeklyFraction * 100))) : -1;
 					const wWeekly = formatQuotaWindow(t, info?.weeklyResetTime);
+					const expiredFullWeekly = wWeekly.expired && hasWeekly && pctWeekly >= 100;
 					const getColors = (pct) => {
 						if (pct < 0) return {
 							bar: "var(--agy-quota-none-border)",
@@ -4689,7 +4708,7 @@ body.dark,
 						fontSize: "12.5px",
 						marginBottom: "5px",
 						color: "var(--agy-text-primary)"
-					} }, brandIcon(FAMILY_BRAND[familyKey], 14), h("span", null, label)), familyKey !== "argon" || has5h ? renderLine(t("quota.fiveHour"), pct5h, c5h, w5h.resetText ? w5h.resetText + cdNote : cdNote.replace(/^ · /, "")) : null, renderLine(t("quota.weekly"), pctWeekly, cWeekly, wWeekly.resetText));
+					} }, brandIcon(FAMILY_BRAND[familyKey], 14), h("span", null, label)), familyKey !== "argon" || has5h ? renderLine(t("quota.fiveHour"), pct5h, c5h, w5h.resetText ? w5h.resetText + cdNote : expiredFull5h ? t("quota.windowReset") + cdNote : cdNote.replace(/^ · /, "")) : null, renderLine(t("quota.weekly"), pctWeekly, cWeekly, wWeekly.resetText ? wWeekly.resetText : expiredFullWeekly ? t("quota.windowReset") : ""));
 				};
 				const activeAccountId = pool?.activeAccountId ?? pool?.lastActiveAccountId ?? pool?.activeAccountIds?.google ?? pool?.primaryAccountId;
 				const renderedAccountCards = accounts.map((acc) => {

package/dist/index.js

@@ -77,7 +77,32 @@ function defaultConfig() {
 		defaultEffort: "",
 		timeoutMs: 6e5,
 		longToolIdleMinutes: 240,
-		maxConcurrent: 3,
+		/**
+		* Hard cap (minutes) on waiting for the Windows credential slot before the
+		* dispatch releases, backs off and retries (dispatchRetries). Each attempt
+		* waits up to this long, so persistence ≈ (1 + dispatchRetries) × N
+		* minutes before the turn fails visibly. 0 = wait indefinitely (the wait
+		* stays abort-aware, poll-healed and heartbeat-logged).
+		*/
+		dispatchTimeoutMinutes: 15,
+		/** Extra dispatch attempts after a credential-slot hard-cap timeout. */
+		dispatchRetries: 1,
+		/**
+		* Same-account credential-slot fast path (default true): sessions running
+		* on the account whose credential already sits in the Windows slot start
+		* immediately WITHOUT exclusivity — agy is a stateless CLI and handles
+		* concurrent processes natively. Only account SWITCHES serialize.
+		* false restores full-run slot exclusivity (one agy process at a time).
+		*/
+		parallelSameAccount: true,
+		/**
+		* Cross-session cap on concurrent agy request streams. 0 = UNLIMITED
+		* (default): native agy concurrency — agy is a stateless CLI and runs
+		* concurrent processes natively; Google rate limits and the account
+		* pool's cooldowns are the natural regulators. Set a positive number to
+		* re-introduce an admission bound.
+		*/
+		maxConcurrent: 0,
 		contextWindowDefault: 1048576,
 		maxTokensDefault: 65536,
 		forwardSystemPrompt: false,
@@ -363,6 +388,9 @@ function resolveConfig(entry, env = process.env, overrides = readOverrides()) {
 		defaultEffort: asString(get("defaultEffort")) ?? base.defaultEffort,
 		timeoutMs: asNum(get("timeoutMs")) ?? base.timeoutMs,
 		longToolIdleMinutes: asNum(get("longToolIdleMinutes")) ?? base.longToolIdleMinutes,
+		dispatchTimeoutMinutes: asNum(get("dispatchTimeoutMinutes")) ?? base.dispatchTimeoutMinutes,
+		dispatchRetries: asNum(get("dispatchRetries")) ?? base.dispatchRetries,
+		parallelSameAccount: asBool(get("parallelSameAccount")) ?? base.parallelSameAccount,
 		maxConcurrent: asNum(get("maxConcurrent")) ?? base.maxConcurrent,
 		contextWindowDefault: asNum(get("contextWindowDefault")) ?? base.contextWindowDefault,
 		maxTokensDefault: asNum(get("maxTokensDefault")) ?? base.maxTokensDefault,
@@ -1408,9 +1436,9 @@ function parseGoalRoundText(text) {
 	const maxRounds = roundMatch && roundMatch[2] ? parseInt(roundMatch[2], 10) : void 0;
 	const objMatch = text.match(/Objective:\s*(?:"([^"]*)"|'([^']*)'|([^\n]+))/);
 	const objective = objMatch ? (objMatch[1] || objMatch[2] || objMatch[3])?.trim() : void 0;
-	const idMatch = text.match(/goal-[a-zA-Z0-9_-]+/);
+	const idMatch = text.match(/goal-[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/) ?? text.match(/\bid:\s*["']?([a-zA-Z0-9_-]+)["']?/);
 	return {
-		goalId: idMatch ? idMatch[0] : void 0,
+		goalId: idMatch ? idMatch[1] ?? idMatch[0] : void 0,
 		round,
 		maxRounds,
 		objective
@@ -1472,14 +1500,21 @@ function isPlanMode(messages) {
 	return false;
 }
 /**
-* Check if the trailing message is the tool result of a bridge-emitted `update_goal` call.
+* Check if the trailing span represents completion of a bridge-emitted `update_goal` call.
+* This covers both the direct tool-result message and DSH's deferred `<goal_complete>` notice.
 */
 function isGoalToolContinuation(messages) {
 	if (messages.length === 0) return false;
-	const last = messages[messages.length - 1];
-	if (!last) return false;
-	const callId = last.toolCallId ?? last.source?.callId;
-	if (typeof callId === "string" && callId.startsWith("agytc-bridge-goal-")) return true;
+	const spanStart = Math.max(0, messages.length - 4);
+	for (let i = messages.length - 1; i >= spanStart; i--) {
+		const m = messages[i];
+		if (!m) continue;
+		const callId = m.toolCallId ?? m.source?.callId;
+		if (typeof callId === "string" && callId.startsWith("agytc-bridge-goal-")) return true;
+		const src = m.source;
+		if (src && typeof src === "object" && src.kind === "tool-goal") return true;
+		if (extractText$1(m).includes("<goal_complete>")) return true;
+	}
 	return false;
 }
 /**
@@ -1817,21 +1852,7 @@ var EventMapper = class {
 				const d = this.appendDelta("[agy finished with error] " + ev.error + "\n");
 				if (d) yield d;
 			}
-			const closeErr = this.closeOpen();
-			if (closeErr) yield closeErr;
-			yield {
-				type: "usage",
-				usage: usageFromRaw(this.opts.usage?.finalUsage(ev.usage) ?? ev.usage)
-			};
-			yield {
-				type: "finish",
-				reason: { kind: "stop" },
-				...ev.conversationId !== "" ? { replayState: { response: { conversationId: ev.conversationId } } } : {}
-			};
-			this.finished = true;
-			return;
-		}
-		if (!this.sawTextStep && ev.response !== "") {
+		} else if (!this.sawTextStep && ev.response !== "") {
 			yield* this.ensureBlock("text");
 			const d = this.appendDelta(ev.response);
 			if (d) yield d;
@@ -1842,7 +1863,7 @@ var EventMapper = class {
 			type: "usage",
 			usage: usageFromRaw(this.opts.usage?.finalUsage(ev.usage) ?? ev.usage)
 		};
-		if (this.opts.supportsGoalUpdate && this.opts.goalContext?.goalId) {
+		if (this.opts.supportsGoalUpdate && this.opts.goalContext) {
 			for (const ch of buildGoalCompleteToolCallBlock(this.opts.goalContext, this.blockIdx)) yield ch;
 			this.blockIdx++;
 			yield {
@@ -28260,30 +28281,138 @@ function accountTokenFilePath(account, homeDir) {
 /**
 * FIFO async mutex. One instance guards the single Windows credential slot;
 * holding it across an entire agy run is what makes the handoff safe.
+*
+* The original implementation chained promises (`tail.then(gate)`), which is
+* FIFO but structurally unable to remove a waiter: a turn abandoned or aborted
+* while queued stayed in the chain forever, and if its gate was never resolved
+* every later waiter wedged with it (the 2026-10-16 cardboard-empire zombie
+* turn: queued 30+ minutes past the slot's release, immune to Stop, because
+* nothing observed the wait). This rewrite keeps an explicit queue so a
+* cancelled or timed-out waiter is REMOVED and the next waiter is woken in its
+* place, and the wait is guarded by a short poll that re-checks liveness — a
+* lost wakeup can no longer park a turn silently.
 */
 var AsyncMutex = class {
-	tail = Promise.resolve();
-	depth = 0;
+	holders = 0;
+	queue = [];
 	/** Number of holders plus waiters; 0 means the mutex is free. */
 	get pending() {
-		return this.depth;
+		return this.holders + this.queue.length;
+	}
+	/** Waiters currently queued behind the holder(s). */
+	get waiting() {
+		return this.queue.length;
 	}
-	async acquire() {
-		this.depth += 1;
-		let release;
-		const gate = new Promise((resolve) => {
-			release = resolve;
+	/**
+	* Acquire the mutex.
+	*
+	* @param opts.signal  cancel the wait (the waiter is removed and the next
+	*   one is woken); rejects with `AbortedWaitError`
+	* @param opts.timeoutMs  bound the wait; rejects with `WaitTimeoutError`
+	* @param opts.pollMs  liveness self-check interval while queued (0 = off).
+	*   The poll re-checks `shouldProceed` — a hook that lets the caller verify
+	*   the wait is still legitimate (e.g. the queue actually advanced). If it
+	*   returns true while the mutex appears free, the waiter takes the mutex
+	*   directly, healing a lost wakeup within one poll interval instead of
+	*   hanging forever.
+	*/
+	async acquire(opts = {}) {
+		const signal = opts.signal;
+		if (signal?.aborted) throw new AbortedWaitError("aborted before mutex acquisition");
+		if (this.holders < 1) {
+			this.holders += 1;
+			return () => this.releaseOne();
+		}
+		const pollMs = opts.pollMs ?? 0;
+		const timeoutMs = opts.timeoutMs;
+		let onAbort = null;
+		let timer = null;
+		let pollTimer = null;
+		return new Promise((resolve, reject) => {
+			let settled = false;
+			let entry = null;
+			let takenDirectly = false;
+			const cleanup = () => {
+				if (onAbort) {
+					signal?.removeEventListener("abort", onAbort);
+					onAbort = null;
+				}
+				if (timer) {
+					clearTimeout(timer);
+					timer = null;
+				}
+				if (pollTimer) {
+					clearInterval(pollTimer);
+					pollTimer = null;
+				}
+			};
+			const take = () => {
+				this.holders += 1;
+				return () => this.releaseOne();
+			};
+			const grant = () => {
+				if (settled) return;
+				settled = true;
+				cleanup();
+				resolve(take());
+			};
+			const fail = (err) => {
+				if (settled) return;
+				settled = true;
+				cleanup();
+				if (entry !== null) {
+					const idx = this.queue.indexOf(entry);
+					if (idx >= 0) this.queue.splice(idx, 1);
+					entry = null;
+				} else if (takenDirectly) this.releaseOne();
+				reject(err);
+			};
+			entry = () => grant();
+			this.queue.push(entry);
+			onAbort = () => {
+				fail(new AbortedWaitError("aborted while waiting for the mutex"));
+			};
+			signal?.addEventListener("abort", onAbort, { once: true });
+			if (timeoutMs !== void 0 && timeoutMs > 0) {
+				timer = setTimeout(() => fail(new WaitTimeoutError("timed out waiting for the mutex")), timeoutMs);
+				timer.unref?.();
+			}
+			if (pollMs > 0 && opts.shouldProceed !== void 0) {
+				pollTimer = setInterval(() => {
+					if (settled) return;
+					if (this.holders < 1 && this.queue[0] === entry && opts.shouldProceed?.()) {
+						const idx = this.queue.indexOf(entry);
+						if (idx >= 0) this.queue.splice(idx, 1);
+						entry = null;
+						takenDirectly = true;
+						grant();
+					}
+				}, pollMs);
+				pollTimer.unref?.();
+			}
 		});
-		const previous = this.tail;
-		this.tail = previous.then(() => gate, () => gate);
-		await previous;
-		let released = false;
-		return () => {
-			if (released) return;
-			released = true;
-			this.depth -= 1;
-			release();
-		};
+	}
+	releaseOne() {
+		this.holders -= 1;
+		this.wakeNext();
+	}
+	wakeNext() {
+		const next = this.queue.shift();
+		if (next) queueMicrotask(next);
+	}
+};
+/** The caller's abort signal fired while queued on the mutex. */
+var AbortedWaitError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "AbortedWaitError";
+	}
+};
+/** The bounded wait elapsed before the mutex became available. */
+var WaitTimeoutError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "WaitTimeoutError";
 	}
 };
 const credentialSlotMutex = new AsyncMutex();
@@ -28414,16 +28543,38 @@ var SlotUnavailableError = class extends Error {
 		this.name = "SlotUnavailableError";
 	}
 };
+let primaryFastRuns = 0;
+let slotSwitchPending = false;
+/** Live fast-path (same-account) run count — exported for diagnostics. */
+function fastPathRunCount() {
+	return primaryFastRuns;
+}
 /**
-* Take exclusive ownership of the credential slot for a run and arrange its
-* guaranteed restoration.
+* Take ownership of the credential slot for a run and arrange its guaranteed
+* restoration.
 *
 * Non-Windows platforms have no shared slot (per-account Keychain isolation
 * works), so this is a no-op there.
 *
+* Same-account runs (the sticky primary — the common case) take a FAST PATH:
+* when the slot already provably holds this account's credential and no slot
+* switch is pending, the run starts IMMEDIATELY without the mutex, so
+* multiple sessions on one account run truly in parallel (agy is a stateless
+* CLI and handles concurrent processes natively). Only identity SWITCHES
+* serialize.
+*
+* @param options.signal  cancels the wait for the slot — without it a turn
+*   queued behind another session's long run ignored Stop entirely (the
+*   cardboard-empire zombie turn, 2026-10-16).
+* @param options.dispatchTimeoutMs  bounds the wait; 0/undefined waits
+*   indefinitely (the wait stays observable and cancellable either way).
+* @param options.parallel  same-account fast path (default true). false
+*   restores full-run exclusivity.
 * @throws SlotUnavailableError when the slot cannot be handed over safely.
-* The caller must abort the run instead of silently signing in as the wrong
-* account (which would spend that account's quota).
+*   The caller must abort the run instead of silently signing in as the wrong
+*   account (which would spend that account's quota).
+* @throws AbortedWaitError when the signal aborted while queued.
+* @throws WaitTimeoutError when the bounded wait elapsed.
 */
 async function acquireCredentialSlot(account, pool, options = {}) {
 	const io = resolveIo(options);
@@ -28431,13 +28582,46 @@ async function acquireCredentialSlot(account, pool, options = {}) {
 	const baseDir = options.baseDir ?? defaultPoolDir();
 	const homeDir = options.homeDir ?? process.env.HOME ?? process.env.USERPROFILE ?? "";
 	const log = options.log ?? (() => {});
-	const releaseMutex = await credentialSlotMutex.acquire();
+	const parallel = options.parallel !== false;
+	const isPrimarySlot = Boolean(account.systemHome) || !account.dir;
+	if (parallel && isPrimarySlot && !slotSwitchPending && !options.signal?.aborted) {
+		const stored = readPrimaryCredential(baseDir);
+		if (stored && sameCredentialGrant(io.readSlot(), stored.raw)) {
+			primaryFastRuns += 1;
+			log("[agy-link] same-account fast path: slot already holds the primary credential — running without exclusivity");
+			return {
+				identity: stored.email,
+				release: () => {
+					primaryFastRuns = Math.max(0, primaryFastRuns - 1);
+					try {
+						const afterRaw = io.readSlot();
+						if (afterRaw && afterRaw !== stored.raw && sameCredentialGrant(afterRaw, stored.raw)) writePrimaryCredential({
+							raw: afterRaw,
+							email: stored.email,
+							savedAt: Date.now()
+						}, baseDir);
+					} catch {}
+				}
+			};
+		}
+	}
+	const releaseMutex = await credentialSlotMutex.acquire({
+		signal: options.signal,
+		timeoutMs: options.dispatchTimeoutMs,
+		pollMs: 5e3,
+		shouldProceed: () => true
+	});
 	let released = false;
 	const done = () => {
 		if (released) return;
 		released = true;
+		slotSwitchPending = false;
 		releaseMutex();
 	};
+	if (options.signal?.aborted) {
+		done();
+		throw new AbortedWaitError("aborted after acquiring the credential slot");
+	}
 	try {
 		const primary = await resolvePrimaryCredential(pool, {
 			...options,
@@ -28446,7 +28630,6 @@ async function acquireCredentialSlot(account, pool, options = {}) {
 		});
 		const accountFile = accountTokenFilePath(account, homeDir);
 		const accountRaw = readTokenFileRaw(accountFile);
-		const isPrimarySlot = Boolean(account.systemHome) || !account.dir;
 		if (!primary) {
 			done();
 			throw new SlotUnavailableError("Cannot verify the primary Antigravity credential, so the Windows credential slot cannot be handed over safely. Sign the primary account in again, then retry.");
@@ -28478,6 +28661,23 @@ async function acquireCredentialSlot(account, pool, options = {}) {
 				}
 			};
 		}
+		if (parallel && primaryFastRuns > 0) {
+			slotSwitchPending = true;
+			const deadline = options.dispatchTimeoutMs !== void 0 && options.dispatchTimeoutMs > 0 ? Date.now() + options.dispatchTimeoutMs : 0;
+			log(`[agy-link] waiting for ${primaryFastRuns} same-account run(s) to finish before switching the credential slot to ${account.alias || account.id}`);
+			while (primaryFastRuns > 0) {
+				if (options.signal?.aborted) {
+					slotSwitchPending = false;
+					throw new AbortedWaitError("aborted while waiting for same-account runs to finish");
+				}
+				if (deadline !== 0 && Date.now() > deadline) {
+					slotSwitchPending = false;
+					throw new WaitTimeoutError(`timed out waiting for ${primaryFastRuns} same-account run(s) to finish before switching the credential slot`);
+				}
+				await new Promise((r) => setTimeout(r, 200));
+			}
+			slotSwitchPending = false;
+		}
 		if (!accountRaw) {
 			done();
 			throw new SlotUnavailableError(`Account ${account.alias || account.id} has no stored credential. Sign it in again before using it.`);
@@ -29263,11 +29463,11 @@ function isSyntheticHarnessMessage(m) {
 	const src = m.source;
 	const kind = src?.kind;
 	if (kind !== void 0 && kind !== "" && kind !== "user") {
-		if (kind === "time-context" || kind === "skill-catalog" || kind === "runtime-context" || kind === "model-selection" || kind === "system-reminder" || kind === "dsh-session-title-llm" || kind === "synthetic") return true;
+		if (kind === "time-context" || kind === "skill-catalog" || kind === "runtime-context" || kind === "model-selection" || kind === "system-reminder" || kind === "dsh-session-title-llm" || kind === "tool-goal" || kind === "synthetic") return true;
 		if (kind === "plugin" && src.form === "snapshot") return true;
 	}
 	const text = textOf(m).trim();
-	if (text.startsWith("Time sampled while preparing") || text.startsWith("<system-reminder>") || text.startsWith("Current runtime context") || text.startsWith("[model changed:") || text.startsWith("[conversation so far]") || text.startsWith("A skill is a reusable set of task-specific instructions")) return true;
+	if (text.startsWith("Time sampled while preparing") || text.startsWith("<system-reminder>") || text.startsWith("Current runtime context") || text.startsWith("[model changed:") || text.startsWith("[conversation so far]") || text.startsWith("<goal_complete>") || text.startsWith("A skill is a reusable set of task-specific instructions")) return true;
 	return false;
 }
 /**
@@ -29725,12 +29925,18 @@ var AgyAdapter = class AgyAdapter extends LlmAdapter {
 			};
 			return;
 		}
-		const goalContext = detectGoalContext(options.messages);
-		if (goalContext && (!goalContext.goalId || goalContext.revision === void 0) && sessionKey && this.deps.sessionGoal) {
+		let goalContext = detectGoalContext(options.messages);
+		if ((!goalContext || !goalContext.goalId || goalContext.revision === void 0) && sessionKey && this.deps.sessionGoal) {
 			const sg = this.deps.sessionGoal(sessionKey);
 			if (sg) {
-				if (!goalContext.goalId) goalContext.goalId = sg.goalId;
-				if (goalContext.revision === void 0) goalContext.revision = sg.revision;
+				if (!goalContext) goalContext = {
+					goalId: sg.goalId,
+					revision: sg.revision
+				};
+				else {
+					if (!goalContext.goalId) goalContext.goalId = sg.goalId;
+					if (goalContext.revision === void 0) goalContext.revision = sg.revision;
+				}
 			}
 		}
 		const supportsGoalUpdate = Boolean(options.tools?.some((t) => t.name === "update_goal"));
@@ -29782,7 +29988,17 @@ var AgyAdapter = class AgyAdapter extends LlmAdapter {
 			while (this.requestTimestamps.length > 0 && this.requestTimestamps[0] < windowStart) this.requestTimestamps.shift();
 			if (this.requestTimestamps.length >= cfg.rateLimitPerMinute) {
 				const delayMs = this.requestTimestamps[0] + 6e4 - now;
-				if (delayMs > 0) await new Promise((r) => setTimeout(r, delayMs));
+				if (delayMs > 0) await new Promise((resolve, reject) => {
+					const timer = setTimeout(() => {
+						options.signal?.removeEventListener("abort", onAbort);
+						resolve();
+					}, delayMs);
+					const onAbort = () => {
+						clearTimeout(timer);
+						reject(new LlmError("aborted during rate-limit spacing", Err.AGY_ERROR));
+					};
+					options.signal?.addEventListener("abort", onAbort, { once: true });
+				});
 			}
 			this.requestTimestamps.push(Date.now());
 		}
@@ -30084,28 +30300,89 @@ var AgyAdapter = class AgyAdapter extends LlmAdapter {
 			promptViaStdin: true
 		}) : argsBase;
 		const stdinPayload = promptViaStdin ? buildStreamInputLine(prompt) : void 0;
-		const release = await this.deps.acquire(options.signal);
+		const dispatchHardCapMs = cfg.dispatchTimeoutMinutes > 0 ? cfg.dispatchTimeoutMinutes * 6e4 : 0;
+		const dispatchStartedAt = Date.now();
+		const DISPATCH_HEARTBEAT_MS = 12e4;
+		let dispatchHeartbeat = null;
+		const stopDispatchHeartbeat = () => {
+			if (dispatchHeartbeat !== null) {
+				clearInterval(dispatchHeartbeat);
+				dispatchHeartbeat = null;
+			}
+		};
+		const startDispatchHeartbeat = () => {
+			if (dispatchHeartbeat !== null) return;
+			dispatchHeartbeat = setInterval(() => {
+				const mins = Math.max(1, Math.round((Date.now() - dispatchStartedAt) / 6e4));
+				const mutex = credentialSlotMutex;
+				this.deps.log?.("agy dispatch still waiting: " + mins + "m — credential slot queue: " + mutex.waiting + " waiter(s), " + (mutex.pending - mutex.waiting) + " holder(s) (another session may be running a long agy tool) — the turn is waiting for the slot; press Stop to cancel");
+			}, DISPATCH_HEARTBEAT_MS);
+			dispatchHeartbeat.unref?.();
+		};
+		const dispatchSleep = async (ms) => {
+			if (options.signal?.aborted) throw new LlmError("request aborted during dispatch backoff", Err.AGY_ERROR);
+			await new Promise((resolve, reject) => {
+				const timer = setTimeout(() => {
+					options.signal?.removeEventListener("abort", onAbort);
+					resolve();
+				}, ms);
+				const onAbort = () => {
+					clearTimeout(timer);
+					reject(new LlmError("request aborted during dispatch backoff", Err.AGY_ERROR));
+				};
+				options.signal?.addEventListener("abort", onAbort, { once: true });
+			});
+		};
+		let release = null;
 		let released = false;
 		let slotLease;
+		let granted = false;
+		let dispatchBackoffMs = 2e3;
+		const maxDispatchAttempts = 1 + Math.max(0, cfg.dispatchRetries);
 		try {
-			slotLease = process.env.NODE_TEST_CONTEXT === void 0 ? await acquireCredentialSlot(account ?? void 0, this.deps.pool, {
-				baseDir: this.deps.pool?.dir,
-				proxyUrl: account?.proxyUrl || cfg.proxyUrl || detectSystemProxy() || void 0,
-				log: (msg) => this.deps.log?.(msg)
-			}) : void 0;
+			for (let attempt = 1; attempt <= maxDispatchAttempts && !granted; attempt++) try {
+				release = await this.deps.acquire(options.signal);
+				startDispatchHeartbeat();
+				slotLease = process.env.NODE_TEST_CONTEXT === void 0 ? await acquireCredentialSlot(account ?? void 0, this.deps.pool, {
+					baseDir: this.deps.pool?.dir,
+					proxyUrl: account?.proxyUrl || cfg.proxyUrl || detectSystemProxy() || void 0,
+					log: (msg) => this.deps.log?.(msg),
+					signal: options.signal,
+					dispatchTimeoutMs: dispatchHardCapMs,
+					parallel: cfg.parallelSameAccount
+				}) : void 0;
+				granted = true;
+			} catch (e) {
+				release?.();
+				release = null;
+				if (e instanceof AbortedWaitError) throw new LlmError("request aborted while waiting for the agy credential slot", Err.AGY_ERROR);
+				if (e instanceof WaitTimeoutError) {
+					if (attempt < maxDispatchAttempts) {
+						this.deps.log?.("agy dispatch attempt " + attempt + "/" + maxDispatchAttempts + " timed out after " + cfg.dispatchTimeoutMinutes + "m waiting for the credential slot — releasing and retrying in " + Math.round(dispatchBackoffMs / 1e3) + "s");
+						stopDispatchHeartbeat();
+						await dispatchSleep(dispatchBackoffMs);
+						dispatchBackoffMs = Math.min(dispatchBackoffMs * 2, 15e3);
+						continue;
+					}
+					throw new LlmError("could not take the agy credential slot within " + cfg.dispatchTimeoutMinutes + "m (another run may be wedged holding it). Check the console for the dispatch heartbeat, restart DSH if a run is truly stuck.", Err.TIMEOUT);
+				}
+				const detail = e instanceof SlotUnavailableError ? e.message : brief(String(e));
+				throw new LlmError(detail, Err.AGY_ERROR);
+			}
 		} catch (e) {
-			release();
+			stopDispatchHeartbeat();
 			this.clearInFlightPrompt(sessionKey, prompt);
-			const detail = e instanceof SlotUnavailableError ? e.message : brief(String(e));
-			throw new LlmError(detail, Err.AGY_ERROR);
+			throw e;
 		}
+		stopDispatchHeartbeat();
 		const releaseOnce = () => {
 			if (released) return;
 			released = true;
 			try {
 				slotLease?.release();
 			} catch {}
-			release();
+			release?.();
+			release = null;
 		};
 		if (options.signal?.aborted) {
 			releaseOnce();
@@ -31171,6 +31448,10 @@ const HELP = [
 	"- `/agy models` — refresh and list discovered models",
 	"- `/agy mode <skip|plan|accept-edits>` — permission mode (next turn)",
 	"- `/agy effort <low|medium|high|default>` — default reasoning effort",
+	"- `/agy dispatch [minutes|off]` — credential-slot wait cap per attempt (omit to inspect; `off` = unlimited)",
+	"- `/agy dispatch-retries <n>` — extra dispatch attempts after the cap",
+	"- `/agy parallel <on|off>` — same-account parallel agy runs (Windows slot fast path)",
+	"- `/agy max-concurrent <n|off>` — cap on concurrent agy request streams (off = unlimited, native)",
 	"- `/agy workspace [path]` — set the agy working directory (absolute path; omit to show)",
 	"- `/agy clear` — drop the most recent conversation binding",
 	"- `/agy doctor` — write a diagnostic report and return its path",
@@ -31180,7 +31461,7 @@ function agyCommandDefinition(deps) {
 	return {
 		name: "agy",
 		description: "Antigravity (agy CLI) bridge: status, login, models, mode, diagnostics, goal",
-		input: { hint: "<status|pool|goal|session|enable-account|disable-account|models|mode|effort|workspace|clear|doctor|help>" },
+		input: { hint: "<status|pool|goal|session|enable-account|disable-account|models|mode|effort|dispatch|dispatch-retries|parallel|max-concurrent|workspace|clear|doctor|help>" },
 		handler: (invocation) => handle(deps, invocation.rawInput, invocation)
 	};
 }
@@ -31463,6 +31744,49 @@ async function handle(deps, raw, invocation) {
 			deps.setOverride("defaultEffort", arg === "default" ? "" : arg);
 			return ok("Default effort set to **" + (arg === "default" ? "model default" : arg) + "**.");
 		}
+		if (sub === "dispatch" || sub === "dispatch-retries") {
+			const cfg = deps.cfg();
+			const mutex = credentialSlotMutex;
+			if (arg === "") return ok([
+				"**Agy 派发守护（dispatch guards）**",
+				`- 硬超时：**${cfg.dispatchTimeoutMinutes > 0 ? `${cfg.dispatchTimeoutMinutes} 分钟/次` : "不限时（无限等待）"}**（重试次数 ${cfg.dispatchRetries}${cfg.dispatchTimeoutMinutes > 0 ? `，总坚持 ≈ ${(1 + cfg.dispatchRetries) * cfg.dispatchTimeoutMinutes} 分钟` : ""}）`,
+				"- 同账号并行：**" + (cfg.parallelSameAccount ? "开（快路径，多会话并行跑同一账号）" : "关（同一时刻仅 1 个 agy 进程）") + "**",
+				`- 并发上限：**${cfg.maxConcurrent > 0 ? cfg.maxConcurrent + " 个流" : "不限制（原生并发）"}**`,
+				`- 当前凭据槽位队列：**${mutex.waiting} 个等待者 / ${mutex.pending - mutex.waiting} 个持有者**，同账号快路径活跃 **${fastPathRunCount()}** 个`,
+				`- 排队期间：Stop 随时可停；丢失唤醒 5 秒内自愈；每 2 分钟心跳日志`,
+				`- 修改：/agy dispatch <分钟|off>　/agy dispatch-retries <次数>　/agy parallel <on|off>`
+			].join("\n"));
+			if (sub === "dispatch") {
+				if (arg === "off" || arg === "0") {
+					deps.setOverride("dispatchTimeoutMinutes", 0);
+					return ok("派发硬超时已关闭：排队将无限等待（仍然 Stop 可停、轮询自愈、心跳可见）。");
+				}
+				const minutes = Number(arg);
+				if (!Number.isFinite(minutes) || minutes <= 0 || !Number.isInteger(minutes)) return err("usage: /agy dispatch <分钟数|off>");
+				deps.setOverride("dispatchTimeoutMinutes", minutes);
+				return ok(`派发硬超时设为 **${minutes} 分钟/次**（含 ${cfg.dispatchRetries} 次重试，总坚持 ≈ ${(1 + cfg.dispatchRetries) * minutes} 分钟）— 下一个回合生效。`);
+			}
+			const retries = Number(arg);
+			if (!Number.isFinite(retries) || retries < 0 || !Number.isInteger(retries) || retries > 10) return err("usage: /agy dispatch-retries <0-10>");
+			deps.setOverride("dispatchRetries", retries);
+			return ok(`派发重试次数设为 **${retries}**${cfg.dispatchTimeoutMinutes > 0 ? `，总坚持 ≈ ${(1 + retries) * cfg.dispatchTimeoutMinutes} 分钟` : ""} — 下一个回合生效。`);
+		}
+		if (sub === "parallel") {
+			if (arg !== "on" && arg !== "off") return err("usage: /agy parallel <on|off>");
+			const on = arg === "on";
+			deps.setOverride("parallelSameAccount", on);
+			return ok(on ? "同账号并行已**开启**：同一账号的多个会话立即并行跑 agy（无需独占凭据槽位），仅账号切换时串行 — 下一个回合生效。" : "同账号并行已**关闭**：恢复同一时刻仅 1 个 agy 进程（全串行）— 下一个回合生效。");
+		}
+		if (sub === "max-concurrent") {
+			if (arg === "off" || arg === "0") {
+				deps.setOverride("maxConcurrent", 0);
+				return ok("并发上限已移除：**不限制**（原生 agy 并发，Google 速率与账号冷却为天然调节）— 下一个回合生效。");
+			}
+			const n = Number(arg);
+			if (!Number.isFinite(n) || !Number.isInteger(n) || n < 1 || n > 64) return err("usage: /agy max-concurrent <1-64|off>");
+			deps.setOverride("maxConcurrent", n);
+			return ok(`并发上限设为 **${n}** 个请求流 — 下一个回合生效。`);
+		}
 		if (sub === "workspace") {
 			if (arg === "") return ok("Current workspace: " + (deps.cfg().workspaceRoot !== "" ? deps.cfg().workspaceRoot : "(session cwd / process cwd)"));
 			if (arg === "default" || arg === "clear") {
@@ -32232,7 +32556,7 @@ var QuotaService = class {
 					body: JSON.stringify({})
 				}, proxyUrl);
 				if (res.ok) {
-					this.preferredEndpointIndex = AGY_ENDPOINTS.indexOf(endpoint);
+					if (AGY_ENDPOINTS.indexOf(endpoint) === 0) this.preferredEndpointIndex = 0;
 					return await res.json();
 				}
 				if (res.status === 401 || res.status === 403) break;
@@ -32339,13 +32663,18 @@ var QuotaService = class {
 				resetTime,
 				updatedAt: now
 			});
-			else if (familyQuotas[fam].remainingFraction === void 0) {
+			else {
 				const curRemaining = familyQuotas[fam].remainingFraction ?? 1;
-				if (remaining < curRemaining) {
-					familyQuotas[fam].remainingFraction = remaining;
-					familyQuotas[fam].resetTime = resetTime;
-				} else if (remaining === curRemaining) {
-					if (resetTime && (!familyQuotas[fam].resetTime || Date.parse(resetTime) > Date.parse(familyQuotas[fam].resetTime))) familyQuotas[fam].resetTime = resetTime;
+				const fbReset = resetTime ? Date.parse(resetTime) : NaN;
+				const is5hWindow = !Number.isNaN(fbReset) && fbReset - now <= 216e5;
+				if (familyQuotas[fam].remainingFraction === void 0 || is5hWindow) {
+					if (remaining < curRemaining) {
+						familyQuotas[fam].remainingFraction = remaining;
+						familyQuotas[fam].resetTime = resetTime;
+					} else if (familyQuotas[fam].remainingFraction === void 0) {
+						familyQuotas[fam].remainingFraction = remaining;
+						familyQuotas[fam].resetTime = resetTime;
+					}
 				}
 			}
 		}
@@ -32760,7 +33089,7 @@ function resolveAssetDir() {
 	for (const c of candidates) if (existsSync(c)) return c;
 	return join(currentDir, "assets");
 }
-/** Cross-session concurrency limiter (ADR-12). */
+/** Cross-session concurrency limiter (ADR-12). max() <= 0 means unlimited. */
 var Semaphore = class {
 	max;
 	active = 0;
@@ -32770,7 +33099,12 @@ var Semaphore = class {
 	}
 	async acquire(signal) {
 		if (signal?.aborted) throw new Error("aborted before semaphore acquisition");
-		if (this.active < Math.max(1, this.max())) {
+		const limit = this.max();
+		if (limit <= 0) {
+			this.active++;
+			return () => this.releaseOne();
+		}
+		if (this.active < limit) {
 			this.active++;
 			return () => this.releaseOne();
 		}
@@ -32896,10 +33230,23 @@ function apply(ctx, entryConfig = {}) {
 			return ctx.get("sessions")?.get(sessionId)?.header?.cwd;
 		},
 		sessionGoal: (sessionId) => {
+			try {
+				const agents = ctx.get("agents") ?? ctx.agents;
+				const goals = ctx.get("goals") ?? ctx.goals;
+				const agent = agents?.get(sessionId);
+				if (agent && goals) {
+					const g = goals.get(agent);
+					if (g?.id && g.phase === "active" && (g.activation === void 0 || g.activation === "armed")) return {
+						goalId: g.id,
+						revision: typeof g.revision === "number" ? g.revision : 1
+					};
+				}
+			} catch {}
 			const session = (ctx.get("sessions") ?? ctx.sessions)?.get(sessionId);
-			if (!session?.events) return null;
-			for (let i = session.events.length - 1; i >= 0; i--) {
-				const ev = session.events[i];
+			const evs = session?.snapshotEvents?.() ?? session?.ownEvents?.() ?? session?.log ?? session?.events;
+			if (!evs) return null;
+			for (let i = evs.length - 1; i >= 0; i--) {
+				const ev = evs[i];
 				if (ev?.type === "goal/change" && ev.data && typeof ev.data === "object") {
 					const d = ev.data;
 					if (d.operation === "clear") return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-agy-link",
-  "version": "0.4.57",
+  "version": "0.4.59",
   "description": "Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.",
   "type": "module",
   "license": "MIT",