dsh-agy 0.3.2 → 0.4.1

package/lib/{accounts-CKWybAfc.mjs → accounts-BjdDqUq1.mjs}

@@ -544,6 +544,87 @@ function resolveMasterKeyCodec(dshHome) {
 	};
 }
 //#endregion
+//#region src/store/paths.ts
+/**
+* The `agy` data folder: every data file this plugin creates lives under
+* `$DSH_HOME/agy/` instead of scattered across the DSH home.
+*
+* Why one folder: agy owned five JSON files sitting directly in `$DSH_HOME`
+* (accounts, stats, models, thinking, fingerprint override) next to the host's
+* own files. A folder is the boundary a user can see, back up, or delete whole.
+*
+* Migration is a ONE-SHOT ATOMIC RENAME, not a read-merge with lazy fallback:
+*
+* - `agy/` sits on the same filesystem as `$DSH_HOME`, so `rename` is atomic
+*   and preserves the 0600 mode.
+* - A read-merge would need every store to carry two paths, two file locks,
+*   and per-store merge logic — and the merge itself can still lose updates
+*   (accounts mutate, stats counts).
+* - A lazy fallback reads the old path forever, which defeats the point: the
+*   old file would never leave the home directory.
+*
+* Version-skew window contract: after a migration an OLD build recreates its
+* legacy file, and its writes are invisible to the new layout — the both-files
+* warning in `migrateToAgyDir` is the detector for exactly that (it fires when
+* a later process finds both files present). Local SOP re-syncs all profiles at
+* once, so the window is one app restart; npm users restart every dsh surface
+* per the release note. Accounts logged in by an old CLI during skew need one
+* re-login — enumerable, one-time, accepted in exchange for zero merge code.
+*/
+/** The directory under `$DSH_HOME` holding every agy data file. */
+function agyDataDir(dshHome = resolveDshHome()) {
+	return join(dshHome, "agy");
+}
+/** A data file inside the agy directory. */
+function agyDataFile(name, dshHome = resolveDshHome()) {
+	return join(agyDataDir(dshHome), name);
+}
+/**
+* One-time legacy -> `agy/` migration for one data file.
+*
+* 1. New file already present: warn-once (via `skew`) when the legacy file is
+*    ALSO present — an old-version process is still writing the old path.
+*    Return the new path regardless: the new layout wins once it exists.
+* 2. No legacy file: fresh install (or already migrated), nothing to do.
+* 3. Otherwise create the directory and rename. On ANY failure (`agy/` cannot
+*    be created, EXDEV, permissions, a locked target on Windows) fall back to
+*    the LEGACY path for this process: for accounts, the old layout with the
+*    real pool beats a new empty one, and `skew` surfaces the reason instead
+*    of hiding it.
+*
+* The caller decides what `skew` becomes; `plugin-common.ts` and the CLI log
+* it once per process at most.
+*/
+function migrateToAgyDir(name, dshHome = resolveDshHome()) {
+	const legacy = join(dshHome, name);
+	const file = agyDataFile(name, dshHome);
+	if (existsSync(file)) return {
+		file,
+		migrated: false,
+		skew: existsSync(legacy)
+	};
+	if (!existsSync(legacy)) return {
+		file,
+		migrated: false,
+		skew: false
+	};
+	try {
+		mkdirSync(agyDataDir(dshHome), { recursive: true });
+		renameSync(legacy, file);
+		return {
+			file,
+			migrated: true,
+			skew: false
+		};
+	} catch {
+		return {
+			file: legacy,
+			migrated: false,
+			skew: true
+		};
+	}
+}
+//#endregion
 //#region src/runtime/rotation.ts
 const BACKOFF_TIERS_MS = [
 	5e3,
@@ -1091,14 +1172,23 @@ function earliestResetTime(a, b) {
 * counts Claude and GPT under one third-party counter, so the weekly budget
 * belongs to both. No model-id prefix rule can recover that split, which is why
 * the mapping lives here rather than in `modelFamilyOf`.
+*
+* Window-aware as of #56: a bucket id resolves a family only when the window it
+* describes is one `CachedQuota` can hold AND the id agrees with the token (see
+* `agreedWindowKind`). The prefix and the window were two independent decisions
+* once, and an unrecognized window still claimed a family.
 */
-function familiesForBucketId(bucketId) {
+function familiesForBucketId(bucketId, window) {
 	const id = bucketId.toLowerCase();
-	if (id.startsWith("gemini-")) return ["google"];
-	if (id.startsWith("3p-") || id.startsWith("third_party-")) return ["anthropic", "openai"];
-	if (id.startsWith("claude-")) return ["anthropic"];
-	if (id.startsWith("gpt-") || id.startsWith("openai-")) return ["openai"];
-	return [];
+	const families = [];
+	if (id.startsWith("gemini-")) families.push("google");
+	else if (id.startsWith("3p-") || id.startsWith("third_party-")) families.push("anthropic", "openai");
+	else if (id.startsWith("claude-")) families.push("anthropic");
+	else if (id.startsWith("gpt-") || id.startsWith("openai-")) families.push("openai");
+	if (families.length === 0) return [];
+	const declared = window === void 0 ? advertisedWindowOf(id) : window.toLowerCase();
+	if (declared === void 0 || agreedWindowKind(id, declared) === void 0) return [];
+	return families;
 }
 /**
 * The families a group's LABEL covers, consulted only when no bucket id was
@@ -1124,7 +1214,6 @@ function familiesForGroupName(name) {
 	if (claude && gpt) families.push("anthropic", "openai");
 	else if (claude) families.push("anthropic");
 	else if (gpt) families.push("openai");
-	else if (families.length === 0 && (label.includes("3p") || label.includes("third"))) families.push("anthropic", "openai");
 	return families;
 }
 /**
@@ -1145,13 +1234,44 @@ function familiesForGroupName(name) {
 function windowKind(window) {
 	return QUOTA_WINDOWS[window.toLowerCase()]?.kind;
 }
+/** The window token a bucket id advertises, when it ends with one upstream names. */
+function advertisedWindowOf(bucketId) {
+	const id = bucketId.toLowerCase();
+	const token = id.slice(id.lastIndexOf("-") + 1);
+	return QUOTA_WINDOWS[token] ? token : void 0;
+}
+/**
+* The field a window belongs in, decided from an AGREED (id, token) pair — or
+* `undefined` when the pair cannot be agreed.
+*
+* The family used to come from the bucket id's prefix while the field came from
+* the window token, as two independent decisions nothing checked against each
+* other. A bucket whose window the cache cannot hold still claimed the family,
+* and its reading was then filed by whichever field the TOKEN named. `gemini-weekly`
+* declaring `5h` is the shape that puts a multi-day weekly fraction into
+* `remainingFraction` (the 5-hour field), where `isFamilyDrained` and
+* `parseFutureResetMs` block the account for days on a window they misread.
+*
+* Refusing an unagreed pair is deliberately the strict option: the permissive
+* mapping is exactly the coupling that let two window vocabularies drift into
+* destroying a measurement. A bucket id that advertises no recognizable token is
+* held to the declared one alone, so a rename does not silently disable the cache.
+*/
+function agreedWindowKind(bucketId, window) {
+	const declared = window.toLowerCase();
+	const kind = windowKind(declared);
+	if (kind === void 0) return void 0;
+	const advertised = advertisedWindowOf(bucketId);
+	if (advertised !== void 0 && advertised !== declared) return void 0;
+	return kind;
+}
 /** The families one group belongs to: its bucket ids first, its label second. */
 function familiesForGroup(group) {
 	const families = [];
 	const add = (family) => {
 		if (!families.includes(family)) families.push(family);
 	};
-	for (const window of group.windows) for (const family of familiesForBucketId(window.bucketId)) add(family);
+	for (const window of group.windows) for (const family of familiesForBucketId(window.bucketId, window.window)) add(family);
 	if (families.length === 0) for (const family of familiesForGroupName(group.name)) add(family);
 	return families;
 }
@@ -1163,9 +1283,16 @@ function familiesForGroup(group) {
 * `remainingFraction` and `resetTime`, with no window field at all, which is why
 * a weekly limit used to be invisible to rotation.
 *
-* Two groups can land on one family (upstream may split `3p` later), so each
-* window keeps the MOST pressured reading rather than letting the last group
-* win — the same rule the per-model merge below uses.
+* Two groups can land on one family (upstream may split `3p` later), so the
+* family record keeps the MOST pressured reading of each window across those
+* groups (`Math.min` below) rather than letting the last group win — the same
+* rule the per-model merge uses.
+*
+* WITHIN one group the rule is deliberately different: `??=` keeps upstream's
+* FIRST bucket of each window, because a group is upstream's own 5h + weekly
+* pair and a duplicate would otherwise depend on upstream's ordering. "Most
+* pressured" therefore applies to two GROUPS landing on one family, not to two
+* buckets inside one group.
 */
 function ingestQuotaGroups(groups) {
 	const families = /* @__PURE__ */ new Map();
@@ -1175,7 +1302,7 @@ function ingestQuotaGroups(groups) {
 		let rolling;
 		let weekly;
 		for (const window of group.windows) {
-			const kind = windowKind(window.window);
+			const kind = agreedWindowKind(window.bucketId, window.window);
 			if (kind === "rolling") rolling ??= window;
 			else if (kind === "weekly") weekly ??= window;
 		}
@@ -1248,21 +1375,70 @@ function ingestFamilyQuotas(discovered, groups, previous) {
 	}
 	return Object.fromEntries(families);
 }
-/** The quota record for one family, or the most-pressured family when the model is unknown. */
-function familyQuotaFor(account, family) {
+/**
+* The lowest fraction a record reports across its LIVE windows — its overall
+* pressure.
+*
+* A window whose reset has already passed describes a window that no longer
+* exists, so it does not count — the same rule `isQuotaStale` applies when it
+* sizes the TTL from the selected record. Scoring a dead window would let one
+* family's expired weekly reading win the selection and represent the account,
+* masking another family's live pressure (issue #69: a dead weekly at 0.004
+* beat a live 0.2 and stretched the refresh TTL from 5 to 15 minutes).
+*
+* `undefined` means the record carries no usable LIVE reading at all, which is
+* deliberately different from a measured zero: only a real number can size a
+* refresh interval.
+*/
+function pressureScore(entry, now) {
+	const fractions = [];
+	if (typeof entry.remainingFraction === "number" && Number.isFinite(entry.remainingFraction) && !resetInPast(entry.resetTime, now)) fractions.push(entry.remainingFraction);
+	if (typeof entry.weeklyFraction === "number" && Number.isFinite(entry.weeklyFraction) && !resetInPast(entry.weeklyResetTime, now)) fractions.push(entry.weeklyFraction);
+	return fractions.length === 0 ? void 0 : Math.min(...fractions);
+}
+/**
+* The quota record for one family, or the most-pressured family when the model
+* is unknown.
+*
+* "Most pressured" compares BOTH windows and reports the record whose LOWEST
+* window is the lowest of all of them. That matters because `isQuotaStale` sizes
+* the refresh TTL from whichever record this returns: a family at 0.9 / weekly
+* 0.004 is more pressured than one at 0.2, and comparing the 5-hour fraction
+* alone picked the 0.2 record — so the weekly-driven 60s TTL was never applied
+* to the family actually being requested and a spent week was discovered late.
+*
+* A record carrying ONLY a weekly reading participates for the same reason: #48
+* produces that shape legitimately (the anthropic/openai entries of a
+* Gemini-only pool), and the old `typeof entry.remainingFraction !== 'number'`
+* guard skipped it outright, leaving the week invisible to TTL sizing.
+*
+* Selection considers LIVE windows only (`pressureScore` drops a window whose
+* reset has passed) — but the with-family path returns the record as-is either
+* way, because its consumers guard each window individually.
+*
+* @param account - the account whose cache to read.
+* @param family - the exact family's record; omit to select the most pressured.
+* @param now - current time (Unix ms), which decides whether a window is live.
+*/
+function familyQuotaFor(account, family, now = Date.now()) {
 	const cache = account.cachedQuota ?? {};
 	if (family) return cache[family];
 	let worst;
+	let worstScore;
 	for (const entry of Object.values(cache)) {
-		if (typeof entry.remainingFraction !== "number") continue;
-		if (!worst || entry.remainingFraction < (worst.remainingFraction ?? 1)) worst = entry;
+		const score = pressureScore(entry, now);
+		if (score === void 0) continue;
+		if (worstScore === void 0 || score < worstScore) {
+			worst = entry;
+			worstScore = score;
+		}
 	}
 	return worst;
 }
 /** Whether the account's quota cache needs a refresh (missing, or past its health-based TTL). */
 function isQuotaStale(account, now = Date.now()) {
 	if (!account.cachedQuota || !account.cachedQuotaUpdatedAt) return true;
-	const mostPressured = familyQuotaFor(account);
+	const mostPressured = familyQuotaFor(account, void 0, now);
 	const ttl = computeSoftQuotaCacheTtlMs(resetInPast(mostPressured?.resetTime, now) ? void 0 : mostPressured?.remainingFraction, resetInPast(mostPressured?.weeklyResetTime, now) ? void 0 : mostPressured?.weeklyFraction);
 	return now - account.cachedQuotaUpdatedAt > ttl;
 }
@@ -1296,26 +1472,6 @@ function resetInPast(resetTime, now) {
 	return !Number.isNaN(reset) && reset <= now;
 }
 /**
-* Whether the requested family on this account is soft-quota-exhausted.
-*
-* BOTH windows are checked, because they refill on different clocks. The 5-hour
-* bucket can be nearly empty while the weekly budget is untouched, and the
-* reverse — a spent weekly budget stays spent across four 5-hour refills. Before
-* this, only the 5-hour reading was consulted, so an account whose week was over
-* kept being selected until a real request failed.
-*
-* A window whose reset has already passed is IGNORED rather than read: its
-* fraction describes a window that no longer exists, so the account stays
-* selectable until the next measurement replaces the stale value.
-*/
-function isFamilyDrained(account, family, now = Date.now()) {
-	const quota = familyQuotaFor(account, family);
-	if (!quota) return false;
-	if (typeof quota.remainingFraction === "number" && !resetInPast(quota.resetTime, now) && quota.remainingFraction < .15) return true;
-	if (typeof quota.weeklyFraction === "number" && !resetInPast(quota.weeklyResetTime, now) && quota.weeklyFraction <= .01) return true;
-	return false;
-}
-/**
 * Required drain rate: headroomFraction / remainingHours — how fast the
 * family's remaining quota must be consumed to avoid expiring unused at its
 * reset (mirrors AuthStorage.#computeWindowRequiredDrain with a daily window).
@@ -1350,6 +1506,32 @@ function parseFutureResetMs(resetTime, now) {
 	return reset;
 }
 /**
+* Whether the requested family on this account is effectively quota-exhausted
+* for account STEERING (affinity pins, the active-account preference): an
+* explicit quota-exhausted cooldown in force, a spent 5-hour window
+* (`remainingFraction <= 0` with a future reset), or a weekly window at or
+* below `WEEKLY_QUOTA_THRESHOLD` — a spent week refills in days, so its rule
+* mirrors `isFamilyDrained`'s weekly branch rather than the block wall.
+*
+* Deliberately a DIFFERENT predicate from the one in `pickAccount`'s `!picked`
+* branch, which applies a strict zero to BOTH windows to mirror
+* `rankPoolCandidates`' block wall when classifying `AgyPoolBlockedError`; and
+* deliberately NARROWER than `isFamilyDrained`'s 5-hour rule
+* (`SOFT_QUOTA_THRESHOLD`): account prioritization holds a chosen account
+* until it is actually spent, not until ranking would prefer another one.
+*/
+function isFamilyQuotaExhausted(account, family, now = Date.now()) {
+	if (account.cooldownReason === "quota-exhausted" && (account.coolingDownUntil ?? 0) > now) return true;
+	const quota = familyQuotaFor(account, family);
+	if (!quota) return false;
+	const spent = (fraction, resetTime, threshold = 0) => {
+		if (typeof fraction !== "number" || fraction > threshold || !resetTime) return false;
+		const resetMs = parseFutureResetMs(resetTime, now);
+		return resetMs !== void 0 && resetMs > now;
+	};
+	return spent(quota.remainingFraction, quota.resetTime, 0) || spent(quota.weeklyFraction, quota.weeklyResetTime, .01);
+}
+/**
 * Rank pool candidates for one request, mirroring AuthStorage's antigravity
 * ordering: unblocked first (earliest unblock time among blocked), hot windows
 * last, measured usage before unmeasured, required-drain descending, then
@@ -1361,10 +1543,12 @@ function rankPoolCandidates(entries, modelId, now = Date.now(), startIndex = 0)
 	const activePos = entries.findIndex((e) => e.index === startIndex);
 	const clampedStart = activePos >= 0 ? activePos : 0;
 	const candidates = (entries.length === 0 ? [] : [...entries.slice(clampedStart), ...entries.slice(0, clampedStart)]).map(({ account, index }, orderPos) => {
-		const quota = familyQuotaFor(account, family);
-		const remaining = quota?.remainingFraction;
+		const quota = familyQuotaFor(account, family, now);
+		const live5h = quota !== void 0 && !resetInPast(quota.resetTime, now);
+		const liveWeekly = quota !== void 0 && !resetInPast(quota.weeklyResetTime, now);
+		const remaining = live5h ? quota.remainingFraction : void 0;
 		const used = typeof remaining === "number" ? Math.min(Math.max(1 - remaining, 0), 1) : void 0;
-		const weeklyRemaining = quota?.weeklyFraction;
+		const weeklyRemaining = liveWeekly ? quota.weeklyFraction : void 0;
 		const weeklyUsed = typeof weeklyRemaining === "number" ? Math.min(Math.max(1 - weeklyRemaining, 0), 1) : void 0;
 		let blockedUntil = null;
 		if (account.coolingDownUntil && account.coolingDownUntil > now) blockedUntil = account.coolingDownUntil;
@@ -1436,18 +1620,17 @@ const DEFAULT_FINGERPRINT_DATA = {
 	],
 	ideTypes: ["ANTIGRAVITY"]
 };
-const USER_OVERRIDE_FILE = "agy-fingerprint-data.json";
 /**
-* Effective fingerprint data: a user override at `$DSH_HOME/agy-fingerprint-data.json`
+* Effective fingerprint data: a user override at `$DSH_HOME/agy/agy-fingerprint-data.json`
 * wins when present and parseable (hot-updatable without a code release — the
-* bundled copy is compiled in), otherwise the bundled defaults.
+* bundled copy is compiled in), otherwise the bundled defaults. The legacy
+* `$DSH_HOME/agy-fingerprint-data.json` location is migrated once by rename.
 */
 let cachedData = null;
 function getFingerprintData() {
 	if (cachedData) return cachedData;
 	try {
-		const dshHome = process.env.DSH_HOME ? process.env.DSH_HOME : join(process.env.HOME ?? ".", ".dsh");
-		const overrideFile = join(dshHome, USER_OVERRIDE_FILE);
+		const overrideFile = migrateToAgyDir("agy-fingerprint-data.json", process.env.DSH_HOME ? process.env.DSH_HOME : join(process.env.HOME ?? ".", ".dsh")).file;
 		if (existsSync(overrideFile)) {
 			const parsed = JSON.parse(readFileSync(overrideFile, "utf8"));
 			if (parsed && Array.isArray(parsed.versionPool) && parsed.versionPool.length > 0) {
@@ -1545,6 +1728,30 @@ function fingerprintMode() {
 	return process.env.DSH_AGY_FINGERPRINT_MODE === "stable" ? "stable" : "dynamic";
 }
 /**
+* Fraction-per-hour per window bucket, from two snapshots.
+*
+* Pure and exported for a direct unit test. Rules:
+* - the FIRST sample yields nothing (no baseline yet), and so does a pair
+*   closer than `MIN_BURN_SAMPLE_MS` — two probes seconds apart measure the
+*   probe jitter, not the burn;
+* - a RISING fraction is a reset (or refresh noise), never negative burn;
+* - a bucket with no baseline simply has no rate yet.
+*
+* Returns null when no bucket produced a rate, so the caller can keep the
+* previous rates instead of overwriting them with an empty read.
+*/
+function sampleLimitBurn(prev, next) {
+	if (prev === void 0) return null;
+	const elapsedH = (next.at - prev.at) / 36e5;
+	if (elapsedH < 3e5 / 36e5) return null;
+	const perHour = {};
+	for (const [bucketId, fraction] of Object.entries(next.fractions)) {
+		const before = prev.fractions[bucketId];
+		if (before !== void 0 && before > fraction) perHour[bucketId] = (before - fraction) / elapsedH;
+	}
+	return Object.keys(perHour).length > 0 ? perHour : null;
+}
+/**
 * Resolve the impersonation headers for one request from the account's
 * persistent fingerprint (stable identity).
 *
@@ -1553,7 +1760,7 @@ function fingerprintMode() {
 * deliberately DETERMINISTIC rather than randomized: a per-request platform or
 * version would make one account appear to be several different machines, which
 * is the anomaly this identity exists to avoid. It reads
-* {@link getFingerprintData} so a `$DSH_HOME/agy-fingerprint-data.json` override
+* {@link getFingerprintData} so a `$DSH_HOME/agy/agy-fingerprint-data.json` override
 * still applies on this path.
 */
 function impersonationHeadersFor(account) {
@@ -1575,6 +1782,22 @@ var AgySessionManager = class AgySessionManager {
 	refreshInFlight = /* @__PURE__ */ new Map();
 	/** In-flight quota fetches keyed by account: concurrent selections share one fetchAvailableModels call. */
 	quotaRefreshInFlight = /* @__PURE__ */ new Map();
+	/**
+	* In-flight `retrieveUserQuotaSummary` probes keyed by account.
+	*
+	* ONE promise per account per cycle, shared by BOTH consumers:
+	* `refreshLimits` (display, writes `cachedLimits`) and `refreshQuotaCache`
+	* (scheduling, writes `cachedQuota`). Since #48 both read the same endpoint for
+	* the same account, so a stale account paid two round trips where one would
+	* do; `quotaRefreshInFlight` de-duplicated only WITHIN the scheduling path.
+	* Sharing makes the two caches agree on what upstream actually said.
+	*
+	* It carries the FETCH and nothing else: the invariant that `refreshLimits`
+	* must never write `cachedQuota` (which `rankPoolCandidates` turns into a
+	* `blockedUntil`) is about WHERE a result lands, and each path still decides
+	* that for itself.
+	*/
+	quotaSummaryInFlight = /* @__PURE__ */ new Map();
 	failureCounts = /* @__PURE__ */ new Map();
 	/** Accounts whose request-time project discovery already failed (no retry per request). */
 	projectRetryFailed = /* @__PURE__ */ new Set();
@@ -1642,6 +1865,62 @@ var AgySessionManager = class AgySessionManager {
 			at: now
 		});
 	}
+	/**
+	* Which accounts have upstream requests in flight, for the UI's live line.
+	*
+	* The join runs HERE, not in the RPC layer: the in-flight map is keyed by
+	* `accountKey` (id ?? email ?? idx-<refresh>), a derivation the management
+	* surface must not have to replicate — its own email-first key would miss
+	* every account carrying both fields. Counts go through `inFlightCount`, so
+	* an entry leaked past its TTL reads as idle instead of busy forever.
+	*/
+	async inFlightAccounts() {
+		const storage = await this.store.load();
+		const now = Date.now();
+		const busy = [];
+		for (const [index, account] of storage.accounts.entries()) {
+			const count = this.inFlightCount(this.accountKey(account), now);
+			if (count > 0) busy.push({
+				index,
+				email: account.email ?? null,
+				count
+			});
+		}
+		return busy;
+	}
+	/** Last fraction snapshot per account, for `sampleLimitBurn` (memory only). */
+	limitFractions = /* @__PURE__ */ new Map();
+	/** Latest burn rate per account: bucketId -> fraction/hour (memory only). */
+	limitBurn = /* @__PURE__ */ new Map();
+	noteLimitSample(key, groups, at) {
+		const fractions = {};
+		for (const group of groups) for (const window of group.windows) if (window.remainingFraction !== null) fractions[window.bucketId] = window.remainingFraction;
+		const next = {
+			at,
+			fractions
+		};
+		const burn = sampleLimitBurn(this.limitFractions.get(key), next);
+		if (burn !== null) this.limitBurn.set(key, { perHour: burn });
+		this.limitFractions.set(key, next);
+	}
+	/**
+	* Burn rates per account INDEX, for the `account.limits` reply.
+	*
+	* The index join runs here, like `inFlightAccounts`: the rate map is keyed
+	* by `accountKey`, a derivation the management surface must not replicate.
+	*/
+	async limitBurnRates() {
+		const storage = await this.store.load();
+		const out = [];
+		for (const [index, account] of storage.accounts.entries()) {
+			const entry = this.limitBurn.get(this.accountKey(account));
+			if (entry !== void 0) out.push({
+				index,
+				perHour: entry.perHour
+			});
+		}
+		return out;
+	}
 	/** The map key for a conversation; anonymous callers share one bucket. */
 	conversationKeyFor(conversationKey) {
 		const trimmed = conversationKey?.trim();
@@ -1682,6 +1961,28 @@ var AgySessionManager = class AgySessionManager {
 	clearAffinityForAccount(accountKey) {
 		for (const [conversation, pin] of this.affinity) if (pin.key === accountKey) this.affinity.delete(conversation);
 	}
+	/**
+	* Clear all session affinity pins.
+	*
+	* Called when an account is explicitly activated by the user, so all
+	* ongoing and upcoming conversations immediately steer to the newly
+	* activated account rather than staying pinned to the previous one.
+	*/
+	clearAllAffinity() {
+		this.affinity.clear();
+	}
+	/**
+	* Explicitly activate an account by index: sets `storage.activeIndex = index`,
+	* clears session affinity pins so conversations immediately switch to the
+	* activated account, and resets transient failure counts.
+	*/
+	async activateAccount(index) {
+		await this.store.mutate((storage) => {
+			if (index < 0 || index >= storage.accounts.length) throw new Error("account not found");
+			storage.activeIndex = index;
+		});
+		this.clearAllAffinity();
+	}
 	constructor(options) {
 		this.store = options.store;
 		this.onRotate = options.onRotate;
@@ -1786,6 +2087,49 @@ var AgySessionManager = class AgySessionManager {
 		return this.refreshToken(key, account, cached);
 	}
 	/**
+	* Probe `retrieveUserQuotaSummary` for one account, sharing ONE in-flight
+	* promise with every other caller in this cycle.
+	*
+	* Returns `[]` on any failure — the fetch itself already answers a dead
+	* endpoint with an empty list — so both consumers read "no groups" the same
+	* way. The promise is dropped as soon as it settles, so the NEXT cycle
+	* re-probes.
+	*
+	* The account's proxy is honoured here or the call would egress direct and
+	* leak the account's real IP, and one timeout bounds the whole endpoint
+	* fallback chain.
+	*/
+	probeQuotaSummary(account) {
+		const key = this.accountKey(account);
+		const existing = this.quotaSummaryInFlight.get(key);
+		if (existing) return existing;
+		const probe = (async () => {
+			try {
+				const auth = await this.accessTokenFor(account);
+				if (!auth) return [];
+				const { fetchQuotaSummary } = await import("./quota-summary-adID82I2.mjs");
+				const routed = accountFetch({ proxyUrl: account.proxy });
+				const bounded = (input, init) => {
+					const timeout = AbortSignal.timeout(AgySessionManager.QUOTA_FETCH_TIMEOUT_MS);
+					const signal = init?.signal ? AbortSignal.any([init.signal, timeout]) : timeout;
+					return routed(input, {
+						...init,
+						signal
+					});
+				};
+				return await fetchQuotaSummary(auth.access, account.projectId, bounded);
+			} catch {
+				return [];
+			}
+		})();
+		this.quotaSummaryInFlight.set(key, probe);
+		const release = () => {
+			if (this.quotaSummaryInFlight.get(key) === probe) this.quotaSummaryInFlight.delete(key);
+		};
+		probe.then(release, release);
+		return probe;
+	}
+	/**
 	* Refresh the display-only 5h/weekly windows for every enabled account.
 	*
 	* SEPARATE from `refreshQuotaCache`, and deliberately so. That method writes
@@ -1833,22 +2177,7 @@ var AgySessionManager = class AgySessionManager {
 		const probes = await Promise.all(targets.map(async (account) => {
 			const key = this.accountKey(account);
 			try {
-				const auth = await this.accessTokenFor(account);
-				if (!auth) return {
-					key,
-					ok: false
-				};
-				const { fetchQuotaSummary } = await import("./quota-summary-adID82I2.mjs");
-				const routed = accountFetch({ proxyUrl: account.proxy });
-				const bounded = (input, init) => {
-					const timeout = AbortSignal.timeout(AgySessionManager.QUOTA_FETCH_TIMEOUT_MS);
-					const signal = init?.signal ? AbortSignal.any([init.signal, timeout]) : timeout;
-					return routed(input, {
-						...init,
-						signal
-					});
-				};
-				const groups = await fetchQuotaSummary(auth.access, account.projectId, bounded);
+				const groups = await this.probeQuotaSummary(account);
 				if (groups.length === 0) return {
 					key,
 					ok: false
@@ -1876,11 +2205,17 @@ var AgySessionManager = class AgySessionManager {
 		if (updates.length === 0) return result;
 		for (const update of updates) {
 			const target = storage.accounts.find((candidate) => this.accountKey(candidate) === update.key);
-			if (target) target.cachedLimits = {
-				groups: update.groups,
-				updatedAt: update.updatedAt
-			};
+			if (target) {
+				target.cachedLimits = {
+					groups: update.groups,
+					updatedAt: update.updatedAt
+				};
+				this.noteLimitSample(update.key, update.groups, update.updatedAt);
+			}
 		}
+		const live = new Set(storage.accounts.map((account) => this.accountKey(account)));
+		for (const key of this.limitFractions.keys()) if (!live.has(key)) this.limitFractions.delete(key);
+		for (const key of this.limitBurn.keys()) if (!live.has(key)) this.limitBurn.delete(key);
 		try {
 			await this.store.mutate((s) => {
 				for (const update of updates) {
@@ -1911,7 +2246,6 @@ var AgySessionManager = class AgySessionManager {
 					const auth = await this.accessTokenFor(account);
 					if (!auth) return null;
 					const { fetchAvailableModels } = await import("./models-Qn0-sh6X.mjs").then((n) => n.r);
-					const { fetchQuotaSummary } = await import("./quota-summary-adID82I2.mjs");
 					const routed = accountFetch({ proxyUrl: account.proxy });
 					const bounded = (input, init) => {
 						const timeout = AbortSignal.timeout(AgySessionManager.QUOTA_FETCH_TIMEOUT_MS);
@@ -1921,7 +2255,7 @@ var AgySessionManager = class AgySessionManager {
 							signal
 						});
 					};
-					const [discovered, groups] = await Promise.all([fetchAvailableModels(auth.access, account.projectId, bounded), fetchQuotaSummary(auth.access, account.projectId, bounded)]);
+					const [discovered, groups] = await Promise.all([fetchAvailableModels(auth.access, account.projectId, bounded), this.probeQuotaSummary(account)]);
 					const quotas = ingestFamilyQuotas(discovered, groups, account.cachedQuota);
 					return {
 						key,
@@ -1962,7 +2296,8 @@ var AgySessionManager = class AgySessionManager {
 	}
 	/**
 	* Pick the account for one request: the affinity pin wins while it is fresh,
-	* healthy, and not drained for the requested model; otherwise the pool is
+	* healthy, and not quota-exhausted for the requested model; the explicitly
+	* activated account wins next while it is usable; otherwise the pool is
 	* ranked by family-scoped usage (OMP-aligned) and the best candidate wins.
 	*/
 	async pickAccount(storage, model, conversationKey) {
@@ -1975,7 +2310,7 @@ var AgySessionManager = class AgySessionManager {
 			const lastIndex = storage.accounts.findIndex((a) => this.accountKey(a) === pinnedKey);
 			if (lastIndex !== -1) {
 				const last = storage.accounts[lastIndex];
-				if (last.enabled !== false && !isCoolingDown(last, now) && !isFamilyRateLimited(last, familyKey, now) && !isFamilyDrained(last, family, now)) return {
+				if (last.enabled !== false && !isCoolingDown(last, now) && !isFamilyRateLimited(last, familyKey, now) && !isFamilyQuotaExhausted(last, family, now)) return {
 					account: last,
 					index: lastIndex
 				};
@@ -1986,12 +2321,18 @@ var AgySessionManager = class AgySessionManager {
 			index
 		})).filter(({ account }) => account.enabled !== false);
 		if (eligible.length === 0) return void 0;
+		const active = storage.accounts[storage.activeIndex];
+		const isActiveUsable = (acc) => acc !== void 0 && acc.enabled !== false && !isCoolingDown(acc, now) && !isFamilyRateLimited(acc, familyKey, now) && !isFamilyQuotaExhausted(acc, family, now);
+		if (isActiveUsable(active) && this.inFlightCount(this.accountKey(active), now) < 3) return {
+			account: active,
+			index: storage.activeIndex
+		};
 		const ranked = rankPoolCandidates(eligible, model, now, storage.activeIndex);
 		const picked = ranked.find((candidate) => candidate.blockedUntil === null && this.inFlightCount(this.accountKey(candidate.account), now) < 3) ?? ranked.find((candidate) => candidate.blockedUntil === null);
 		if (!picked) {
 			const quotaExhausted = (account) => {
 				if (account.cooldownReason === "quota-exhausted" && (account.coolingDownUntil ?? 0) > now) return true;
-				const quota = familyQuotaFor(account, family);
+				const quota = familyQuotaFor(account, family, now);
 				if (!quota) return false;
 				const spent = (fraction, resetTime) => {
 					if (typeof fraction !== "number" || fraction > 0 || !resetTime) return false;
@@ -2168,6 +2509,13 @@ var AgySessionManager = class AgySessionManager {
 			if (decision.action === "revoke") {
 				this.tokenCache.delete(key);
 				this.failureCounts.delete(key);
+				const currentIndex = storage.accounts.findIndex((a) => this.accountKey(a) === key);
+				const nextIndex = pickNextAccountIndex(storage.accounts, currentIndex >= 0 ? currentIndex : storage.activeIndex, Date.now());
+				if (nextIndex !== storage.activeIndex) {
+					storage.activeIndex = nextIndex;
+					nextIndexToRotate = nextIndex;
+				}
+				this.clearAffinityForAccount(key);
 				return;
 			}
 			if (kind === "rate-limit" && info?.rateLimitCategory !== "soft_rate_limit") {
@@ -2183,7 +2531,7 @@ var AgySessionManager = class AgySessionManager {
 					}
 				}
 			}
-			if (decision.action === "rotate") {
+			if (decision.action === "rotate" || decision.action === "cool") {
 				const currentIndex = storage.accounts.findIndex((a) => this.accountKey(a) === key);
 				const familyKey = familyKeyOf(info?.model);
 				const nextIndex = pickNextAccountIndex(storage.accounts, currentIndex >= 0 ? currentIndex : storage.activeIndex, Date.now(), familyKey);
@@ -2201,7 +2549,8 @@ var AgySessionManager = class AgySessionManager {
 				source: "chat",
 				ok: false,
 				rotated: true,
-				poolEvent: true
+				poolEvent: true,
+				reason: kind
 			});
 		}
 	}
@@ -2241,7 +2590,7 @@ var AgySessionManager = class AgySessionManager {
 		};
 		try {
 			const account = session.account.email ?? session.account.id;
-			const { toAgyRequestBody } = await import("./translate-BQu8HLvB.mjs").then((n) => n.n);
+			const { toAgyRequestBody } = await import("./translate-YhGDUuVa.mjs").then((n) => n.n);
 			const { fetchAgyFirstOk } = await import("./constants-BpyRirvk.mjs").then((n) => n.f);
 			const { parseAgySse } = await import("./parse-Bs4rPkHA.mjs").then((n) => n.n);
 			const requestId = generateAntigravityRequestId();
@@ -2682,6 +3031,6 @@ var JsonAccountStore = class {
 	}
 };
 //#endregion
-export { resolveMasterKeyCodec as _, generateFingerprint as a, describeFetchError as b, resolveAntigravityVersionBounded as c, MASTER_KEY_REF as d, createAesGcmCodec as f, resolveDshHome as g, persistMasterKey as h, isAgyDisabled as i, clearExpiredState as l, loadMasterKey as m, maskProxyUrl as n, recordFingerprintVersion as o, deriveKey as p, AgySessionManager as r, resolveAntigravityVersion as s, JsonAccountStore as t, pickProbeProxyUrl as u, classifyFetchError as v, isSessionAccumulationOverflow as x, classifyHttpError as y };
+export { isSessionAccumulationOverflow as S, resolveDshHome as _, generateFingerprint as a, classifyHttpError as b, resolveAntigravityVersionBounded as c, migrateToAgyDir as d, MASTER_KEY_REF as f, persistMasterKey as g, loadMasterKey as h, isAgyDisabled as i, clearExpiredState as l, deriveKey as m, maskProxyUrl as n, recordFingerprintVersion as o, createAesGcmCodec as p, AgySessionManager as r, resolveAntigravityVersion as s, JsonAccountStore as t, pickProbeProxyUrl as u, resolveMasterKeyCodec as v, describeFetchError as x, classifyFetchError as y };
 
-//# sourceMappingURL=accounts-CKWybAfc.mjs.map
+//# sourceMappingURL=accounts-BjdDqUq1.mjs.map