dsh-agy 0.4.0 → 0.4.1

package/README.md

@@ -137,11 +137,11 @@ dsh plugin --profile web remove dsh-agy
 # 2. Uninstall the CLI
 npm uninstall -g dsh-agy
 
-# 3. Optional: delete local account data (accounts + master key + fingerprint override)
+# 3. Optional: delete local account data (the whole agy data folder)
 dsh-agy logout              # remove accounts first (or skip)
-rm -f ~/.dsh/agy-accounts.json ~/.dsh/agy-stats.json ~/.dsh/agy-models.json
+rm -rf ~/.dsh/agy           # accounts, usage stats, model visibility, thinking budgets, recent ring
 # remove only the AGY_MASTER_KEY line from ~/.dsh/.credentials.yaml — keep other keys!
-rm -f ~/.dsh/agy-fingerprint-data.json   # only if you created an override
+# (an upgrade from ≤0.4 may leave legacy files in ~/.dsh itself: rm -f ~/.dsh/agy-*.json)
 
 # 4. Optional: revoke the Google-side authorization
 #    Google account security → Third-party access → revoke "Antigravity"
@@ -268,17 +268,28 @@ the context grows, bounded by the model's context window.
 
 ### Storage & secrets
 
-- Accounts: `~/.dsh/agy-accounts.json` — AES-256-GCM encrypted; the master key lives
-  in `~/.dsh/.credentials.yaml` (`AGY_MASTER_KEY`, 0600). `$DSH_HOME` relocates both.
+All agy data files live in one folder, `~/.dsh/agy/` (relocated wholesale by
+`$DSH_HOME`). Upgrading from ≤0.4 moves the legacy files in `~/.dsh/` there on
+first start — a one-shot atomic rename; if a legacy file reappears next to the
+folder afterwards, an old-version process is still running, and a warning says so.
+
+- Accounts: `~/.dsh/agy/agy-accounts.json` —
+  AES-256-GCM encrypted; the master key lives in `~/.dsh/.credentials.yaml`
+  (`AGY_MASTER_KEY`, 0600). `$DSH_HOME` relocates the whole tree.
 - Fingerprint pools (version strings, SDK clients) are user-overridable via
-  `~/.dsh/agy-fingerprint-data.json` — no code release needed to keep them current.
-- Model visibility: `~/.dsh/agy-models.json` (0600) — the hidden-model blacklist.
+  `~/.dsh/agy/agy-fingerprint-data.json` — no code release needed to keep them current.
+- Model visibility: `~/.dsh/agy/agy-models.json` (0600) — the hidden-model blacklist.
   Holds only the models you switched off, so re-enabling one removes its entry.
-- Usage statistics: `~/.dsh/agy-stats.json` (0600) — cumulative counters plus a
+- Usage statistics: `~/.dsh/agy/agy-stats.json` (0600) — cumulative counters plus a
   rolling 30-day window. Counts are merged under a file lock, so several
   processes (Desktop, a web-profile server, the CLI) record concurrently without
-  losing each other's data. It stores account emails but never tokens, proxies,
-  or project ids.
+  losing each other's data.
+- Recent activity: `~/.dsh/agy/agy-recent.json` (0600) — the last 200 requests and
+  rotations, persisted so the panel survives a restart and shows the other
+  processes' history too (external processes' new records arrive within 30s).
+- None of these files store tokens, proxies, or project ids — account emails
+  only; the tokens live encrypted in the accounts file and the master key in
+  the credentials document.
 
 ## ⚠️ Disclaimer
 

package/lib/{accounts-BN4h0AU4.mjs → accounts-BjdDqUq1.mjs}

@@ -544,6 +544,87 @@ function resolveMasterKeyCodec(dshHome) {
 	};
 }
 //#endregion
+//#region src/store/paths.ts
+/**
+* The `agy` data folder: every data file this plugin creates lives under
+* `$DSH_HOME/agy/` instead of scattered across the DSH home.
+*
+* Why one folder: agy owned five JSON files sitting directly in `$DSH_HOME`
+* (accounts, stats, models, thinking, fingerprint override) next to the host's
+* own files. A folder is the boundary a user can see, back up, or delete whole.
+*
+* Migration is a ONE-SHOT ATOMIC RENAME, not a read-merge with lazy fallback:
+*
+* - `agy/` sits on the same filesystem as `$DSH_HOME`, so `rename` is atomic
+*   and preserves the 0600 mode.
+* - A read-merge would need every store to carry two paths, two file locks,
+*   and per-store merge logic — and the merge itself can still lose updates
+*   (accounts mutate, stats counts).
+* - A lazy fallback reads the old path forever, which defeats the point: the
+*   old file would never leave the home directory.
+*
+* Version-skew window contract: after a migration an OLD build recreates its
+* legacy file, and its writes are invisible to the new layout — the both-files
+* warning in `migrateToAgyDir` is the detector for exactly that (it fires when
+* a later process finds both files present). Local SOP re-syncs all profiles at
+* once, so the window is one app restart; npm users restart every dsh surface
+* per the release note. Accounts logged in by an old CLI during skew need one
+* re-login — enumerable, one-time, accepted in exchange for zero merge code.
+*/
+/** The directory under `$DSH_HOME` holding every agy data file. */
+function agyDataDir(dshHome = resolveDshHome()) {
+	return join(dshHome, "agy");
+}
+/** A data file inside the agy directory. */
+function agyDataFile(name, dshHome = resolveDshHome()) {
+	return join(agyDataDir(dshHome), name);
+}
+/**
+* One-time legacy -> `agy/` migration for one data file.
+*
+* 1. New file already present: warn-once (via `skew`) when the legacy file is
+*    ALSO present — an old-version process is still writing the old path.
+*    Return the new path regardless: the new layout wins once it exists.
+* 2. No legacy file: fresh install (or already migrated), nothing to do.
+* 3. Otherwise create the directory and rename. On ANY failure (`agy/` cannot
+*    be created, EXDEV, permissions, a locked target on Windows) fall back to
+*    the LEGACY path for this process: for accounts, the old layout with the
+*    real pool beats a new empty one, and `skew` surfaces the reason instead
+*    of hiding it.
+*
+* The caller decides what `skew` becomes; `plugin-common.ts` and the CLI log
+* it once per process at most.
+*/
+function migrateToAgyDir(name, dshHome = resolveDshHome()) {
+	const legacy = join(dshHome, name);
+	const file = agyDataFile(name, dshHome);
+	if (existsSync(file)) return {
+		file,
+		migrated: false,
+		skew: existsSync(legacy)
+	};
+	if (!existsSync(legacy)) return {
+		file,
+		migrated: false,
+		skew: false
+	};
+	try {
+		mkdirSync(agyDataDir(dshHome), { recursive: true });
+		renameSync(legacy, file);
+		return {
+			file,
+			migrated: true,
+			skew: false
+		};
+	} catch {
+		return {
+			file: legacy,
+			migrated: false,
+			skew: true
+		};
+	}
+}
+//#endregion
 //#region src/runtime/rotation.ts
 const BACKOFF_TIERS_MS = [
 	5e3,
@@ -1539,18 +1620,17 @@ const DEFAULT_FINGERPRINT_DATA = {
 	],
 	ideTypes: ["ANTIGRAVITY"]
 };
-const USER_OVERRIDE_FILE = "agy-fingerprint-data.json";
 /**
-* Effective fingerprint data: a user override at `$DSH_HOME/agy-fingerprint-data.json`
+* Effective fingerprint data: a user override at `$DSH_HOME/agy/agy-fingerprint-data.json`
 * wins when present and parseable (hot-updatable without a code release — the
-* bundled copy is compiled in), otherwise the bundled defaults.
+* bundled copy is compiled in), otherwise the bundled defaults. The legacy
+* `$DSH_HOME/agy-fingerprint-data.json` location is migrated once by rename.
 */
 let cachedData = null;
 function getFingerprintData() {
 	if (cachedData) return cachedData;
 	try {
-		const dshHome = process.env.DSH_HOME ? process.env.DSH_HOME : join(process.env.HOME ?? ".", ".dsh");
-		const overrideFile = join(dshHome, USER_OVERRIDE_FILE);
+		const overrideFile = migrateToAgyDir("agy-fingerprint-data.json", process.env.DSH_HOME ? process.env.DSH_HOME : join(process.env.HOME ?? ".", ".dsh")).file;
 		if (existsSync(overrideFile)) {
 			const parsed = JSON.parse(readFileSync(overrideFile, "utf8"));
 			if (parsed && Array.isArray(parsed.versionPool) && parsed.versionPool.length > 0) {
@@ -1648,6 +1728,30 @@ function fingerprintMode() {
 	return process.env.DSH_AGY_FINGERPRINT_MODE === "stable" ? "stable" : "dynamic";
 }
 /**
+* Fraction-per-hour per window bucket, from two snapshots.
+*
+* Pure and exported for a direct unit test. Rules:
+* - the FIRST sample yields nothing (no baseline yet), and so does a pair
+*   closer than `MIN_BURN_SAMPLE_MS` — two probes seconds apart measure the
+*   probe jitter, not the burn;
+* - a RISING fraction is a reset (or refresh noise), never negative burn;
+* - a bucket with no baseline simply has no rate yet.
+*
+* Returns null when no bucket produced a rate, so the caller can keep the
+* previous rates instead of overwriting them with an empty read.
+*/
+function sampleLimitBurn(prev, next) {
+	if (prev === void 0) return null;
+	const elapsedH = (next.at - prev.at) / 36e5;
+	if (elapsedH < 3e5 / 36e5) return null;
+	const perHour = {};
+	for (const [bucketId, fraction] of Object.entries(next.fractions)) {
+		const before = prev.fractions[bucketId];
+		if (before !== void 0 && before > fraction) perHour[bucketId] = (before - fraction) / elapsedH;
+	}
+	return Object.keys(perHour).length > 0 ? perHour : null;
+}
+/**
 * Resolve the impersonation headers for one request from the account's
 * persistent fingerprint (stable identity).
 *
@@ -1656,7 +1760,7 @@ function fingerprintMode() {
 * deliberately DETERMINISTIC rather than randomized: a per-request platform or
 * version would make one account appear to be several different machines, which
 * is the anomaly this identity exists to avoid. It reads
-* {@link getFingerprintData} so a `$DSH_HOME/agy-fingerprint-data.json` override
+* {@link getFingerprintData} so a `$DSH_HOME/agy/agy-fingerprint-data.json` override
 * still applies on this path.
 */
 function impersonationHeadersFor(account) {
@@ -1761,6 +1865,62 @@ var AgySessionManager = class AgySessionManager {
 			at: now
 		});
 	}
+	/**
+	* Which accounts have upstream requests in flight, for the UI's live line.
+	*
+	* The join runs HERE, not in the RPC layer: the in-flight map is keyed by
+	* `accountKey` (id ?? email ?? idx-<refresh>), a derivation the management
+	* surface must not have to replicate — its own email-first key would miss
+	* every account carrying both fields. Counts go through `inFlightCount`, so
+	* an entry leaked past its TTL reads as idle instead of busy forever.
+	*/
+	async inFlightAccounts() {
+		const storage = await this.store.load();
+		const now = Date.now();
+		const busy = [];
+		for (const [index, account] of storage.accounts.entries()) {
+			const count = this.inFlightCount(this.accountKey(account), now);
+			if (count > 0) busy.push({
+				index,
+				email: account.email ?? null,
+				count
+			});
+		}
+		return busy;
+	}
+	/** Last fraction snapshot per account, for `sampleLimitBurn` (memory only). */
+	limitFractions = /* @__PURE__ */ new Map();
+	/** Latest burn rate per account: bucketId -> fraction/hour (memory only). */
+	limitBurn = /* @__PURE__ */ new Map();
+	noteLimitSample(key, groups, at) {
+		const fractions = {};
+		for (const group of groups) for (const window of group.windows) if (window.remainingFraction !== null) fractions[window.bucketId] = window.remainingFraction;
+		const next = {
+			at,
+			fractions
+		};
+		const burn = sampleLimitBurn(this.limitFractions.get(key), next);
+		if (burn !== null) this.limitBurn.set(key, { perHour: burn });
+		this.limitFractions.set(key, next);
+	}
+	/**
+	* Burn rates per account INDEX, for the `account.limits` reply.
+	*
+	* The index join runs here, like `inFlightAccounts`: the rate map is keyed
+	* by `accountKey`, a derivation the management surface must not replicate.
+	*/
+	async limitBurnRates() {
+		const storage = await this.store.load();
+		const out = [];
+		for (const [index, account] of storage.accounts.entries()) {
+			const entry = this.limitBurn.get(this.accountKey(account));
+			if (entry !== void 0) out.push({
+				index,
+				perHour: entry.perHour
+			});
+		}
+		return out;
+	}
 	/** The map key for a conversation; anonymous callers share one bucket. */
 	conversationKeyFor(conversationKey) {
 		const trimmed = conversationKey?.trim();
@@ -2045,11 +2205,17 @@ var AgySessionManager = class AgySessionManager {
 		if (updates.length === 0) return result;
 		for (const update of updates) {
 			const target = storage.accounts.find((candidate) => this.accountKey(candidate) === update.key);
-			if (target) target.cachedLimits = {
-				groups: update.groups,
-				updatedAt: update.updatedAt
-			};
+			if (target) {
+				target.cachedLimits = {
+					groups: update.groups,
+					updatedAt: update.updatedAt
+				};
+				this.noteLimitSample(update.key, update.groups, update.updatedAt);
+			}
 		}
+		const live = new Set(storage.accounts.map((account) => this.accountKey(account)));
+		for (const key of this.limitFractions.keys()) if (!live.has(key)) this.limitFractions.delete(key);
+		for (const key of this.limitBurn.keys()) if (!live.has(key)) this.limitBurn.delete(key);
 		try {
 			await this.store.mutate((s) => {
 				for (const update of updates) {
@@ -2383,7 +2549,8 @@ var AgySessionManager = class AgySessionManager {
 				source: "chat",
 				ok: false,
 				rotated: true,
-				poolEvent: true
+				poolEvent: true,
+				reason: kind
 			});
 		}
 	}
@@ -2864,6 +3031,6 @@ var JsonAccountStore = class {
 	}
 };
 //#endregion
-export { resolveMasterKeyCodec as _, generateFingerprint as a, describeFetchError as b, resolveAntigravityVersionBounded as c, MASTER_KEY_REF as d, createAesGcmCodec as f, resolveDshHome as g, persistMasterKey as h, isAgyDisabled as i, clearExpiredState as l, loadMasterKey as m, maskProxyUrl as n, recordFingerprintVersion as o, deriveKey as p, AgySessionManager as r, resolveAntigravityVersion as s, JsonAccountStore as t, pickProbeProxyUrl as u, classifyFetchError as v, isSessionAccumulationOverflow as x, classifyHttpError as y };
+export { isSessionAccumulationOverflow as S, resolveDshHome as _, generateFingerprint as a, classifyHttpError as b, resolveAntigravityVersionBounded as c, migrateToAgyDir as d, MASTER_KEY_REF as f, persistMasterKey as g, loadMasterKey as h, isAgyDisabled as i, clearExpiredState as l, deriveKey as m, maskProxyUrl as n, recordFingerprintVersion as o, createAesGcmCodec as p, AgySessionManager as r, resolveAntigravityVersion as s, JsonAccountStore as t, pickProbeProxyUrl as u, resolveMasterKeyCodec as v, describeFetchError as x, classifyFetchError as y };
 
-//# sourceMappingURL=accounts-BN4h0AU4.mjs.map
+//# sourceMappingURL=accounts-BjdDqUq1.mjs.map