dsh-plugin-subscription-oauth 0.8.1 → 0.8.3

package/lib/auth/allowance-scheduler.d.ts

@@ -17,9 +17,13 @@
 export interface AllowanceState {
     /** Epoch milliseconds at which the account's allowance resets, when known. */
     resetsAt?: number;
+    /** Epoch milliseconds until which the account is cooling after a refused request. */
+    cooldownUntil?: number;
     /** Epoch milliseconds at which this state was last learned. */
     learnedAt: number;
 }
+/** Default cooldown after a refused request, so the provider's gate is not re-hit at once. */
+export declare const DEFAULT_REFUSAL_COOLDOWN_MS: number;
 /** In-memory, per-provider memory of account reset times. */
 export declare class AllowanceScheduler {
     private readonly byProvider;
@@ -33,6 +37,38 @@ export declare class AllowanceScheduler {
      * @param resetsAt - epoch milliseconds of the allowance reset, when known.
      */
     noteReset(provider: string, account: string, resetsAt?: number): void;
+    /**
+     * Cool one account after its request was refused, so the provider's gate is not
+     * re-hit at once.
+     *
+     * A 403 "verify your account" is Google's safety gate, not a dead credential; hitting
+     * it in a tight loop across every account is what turns a transient check into a
+     * sustained block. Cooling the refused account for a short beat (and trying another)
+     * is what keeps the pool reachable — the same discipline a careful client keeps.
+     *
+     * @param provider - the provider route id.
+     * @param account - the account key.
+     * @param until - epoch milliseconds to cool until; defaults to a short beat.
+     */
+    coolDown(provider: string, account: string, until?: number): void;
+    /**
+     * Whether one account is cooling after a refused request and should be left alone.
+     *
+     * @param provider - the provider route id.
+     * @param account - the account key.
+     * @returns whether the account is mid-cooldown.
+     */
+    isCooling(provider: string, account: string): boolean;
+    /**
+     * Forget one account's remembered state, when the account is removed.
+     *
+     * A signed-out account's allowance state is no longer meaningful — there is no
+     * account to schedule around — and a re-added account starts fresh.
+     *
+     * @param provider - the provider route id.
+     * @param account - the account key to forget.
+     */
+    clear(provider: string, account: string): void;
     /**
      * Whether one account's allowance is known to be spent now.
      *

package/lib/auth/allowance-scheduler.js

@@ -13,6 +13,8 @@
  *
  * @module dsh-plugin-subscription-oauth/auth/allowance-scheduler
  */
+/** Default cooldown after a refused request, so the provider's gate is not re-hit at once. */
+export const DEFAULT_REFUSAL_COOLDOWN_MS = 2 * 60 * 1000;
 /** In-memory, per-provider memory of account reset times. */
 export class AllowanceScheduler {
     byProvider = new Map();
@@ -33,7 +35,56 @@ export class AllowanceScheduler {
      * @param resetsAt - epoch milliseconds of the allowance reset, when known.
      */
     noteReset(provider, account, resetsAt) {
-        this.provider(provider).set(account, { ...resetsAt === undefined ? {} : { resetsAt }, learnedAt: Date.now() });
+        const existing = this.byProvider.get(provider)?.get(account);
+        this.provider(provider).set(account, {
+            ...existing?.cooldownUntil === undefined ? {} : { cooldownUntil: existing.cooldownUntil },
+            ...resetsAt === undefined ? {} : { resetsAt },
+            learnedAt: Date.now(),
+        });
+    }
+    /**
+     * Cool one account after its request was refused, so the provider's gate is not
+     * re-hit at once.
+     *
+     * A 403 "verify your account" is Google's safety gate, not a dead credential; hitting
+     * it in a tight loop across every account is what turns a transient check into a
+     * sustained block. Cooling the refused account for a short beat (and trying another)
+     * is what keeps the pool reachable — the same discipline a careful client keeps.
+     *
+     * @param provider - the provider route id.
+     * @param account - the account key.
+     * @param until - epoch milliseconds to cool until; defaults to a short beat.
+     */
+    coolDown(provider, account, until = Date.now() + DEFAULT_REFUSAL_COOLDOWN_MS) {
+        const existing = this.byProvider.get(provider)?.get(account);
+        this.provider(provider).set(account, {
+            ...existing?.resetsAt === undefined ? {} : { resetsAt: existing.resetsAt },
+            cooldownUntil: until,
+            learnedAt: Date.now(),
+        });
+    }
+    /**
+     * Whether one account is cooling after a refused request and should be left alone.
+     *
+     * @param provider - the provider route id.
+     * @param account - the account key.
+     * @returns whether the account is mid-cooldown.
+     */
+    isCooling(provider, account) {
+        const state = this.byProvider.get(provider)?.get(account);
+        return state?.cooldownUntil !== undefined && Date.now() < state.cooldownUntil;
+    }
+    /**
+     * Forget one account's remembered state, when the account is removed.
+     *
+     * A signed-out account's allowance state is no longer meaningful — there is no
+     * account to schedule around — and a re-added account starts fresh.
+     *
+     * @param provider - the provider route id.
+     * @param account - the account key to forget.
+     */
+    clear(provider, account) {
+        this.byProvider.get(provider)?.delete(account);
     }
     /**
      * Whether one account's allowance is known to be spent now.
@@ -50,6 +101,8 @@ export class AllowanceScheduler {
         const state = this.byProvider.get(provider)?.get(account);
         if (state === undefined)
             return false;
+        if (state.cooldownUntil !== undefined && Date.now() < state.cooldownUntil)
+            return true;
         if (state.resetsAt === undefined)
             return false;
         return Date.now() < state.resetsAt;

package/lib/auth/provider-controller.js

@@ -16,6 +16,7 @@
 import { ACCOUNT_NOT_FOUND, BAD_REQUEST, MODEL_NOT_FOUND, REAUTH_REQUIRED, ProviderError } from '../errors.js';
 import { entryMatches, resolveCatalog } from '../providers/catalog.js';
 import { accountLabelOf, accountKeyOf } from './store.js';
+import { allowanceScheduler } from './allowance-scheduler.js';
 /** Human-readable message for any thrown value. */
 function messageOf(error) {
     return error instanceof Error ? error.message : String(error);
@@ -239,8 +240,14 @@ export class ProviderController {
     async logout(account) {
         this.refused.delete(account ?? '');
         const key = account ?? await this.options.store.defaultAccount();
-        if (key !== undefined)
+        if (key !== undefined) {
             await this.options.store.remove(key);
+            // Drop every trace of the signed-out account: the remembered allowance state (so
+            // the scheduler stops treating it as live) and the cached usage figures (so the
+            // card and chip stop showing its quota).
+            allowanceScheduler.clear(this.options.spec.id, key);
+            this.usageByAccount.delete(key);
+        }
         return this.status();
     }
     /** Promote one account to default. */

package/lib/providers/antigravity.js

@@ -425,6 +425,9 @@ export class AntigravityAdapter extends LlmAdapter {
             const accounts = typeof this.options.tokens.accounts === 'function'
                 ? await this.options.tokens.accounts()
                 : [];
+            // Surface the account pool and the 429 outcome to the caller, so a non-switch is
+            // diagnosable from the browser where the node stdout is hidden.
+            const diag = [`pool=${accounts.join(',') || '(none)'}`];
             const tried = new Set();
             let token = await this.options.tokens.resolve();
             // Move an account known to be spent (from a past failure) to the back, so a fresh
@@ -436,33 +439,71 @@ export class AntigravityAdapter extends LlmAdapter {
                     continue;
                 tried.add(accountKey);
                 token = await this.options.tokens.resolve(accountKey);
-                let response = await this.request(options, model, token.account, token.accessToken, watchdog.signal);
+                // A transport failure (DNS, connect timeout) on one account may be that account's
+                // path, not the provider's; try the next account before giving up, the same way a
+                // spent allowance does. A lone account still surfaces the real error.
+                let response;
+                try {
+                    response = await this.request(options, model, token.account, token.accessToken, watchdog.signal);
+                }
+                catch (error) {
+                    const transport = error instanceof TypeError || error.name === 'AbortError';
+                    if (transport && order.length > 1 && !watchdog.timedOut) {
+                        diag.push(`transport on ${token.account}, moving to next`);
+                        continue;
+                    }
+                    throw error;
+                }
                 if (response.status === 401 || response.status === 403) {
-                    // The stored token was accepted locally but refused on the wire; force
-                    // one refresh, then report the credential as dead if it still fails.
+                    // The stored token was accepted locally but refused on the wire; force one
+                    // refresh. A 403 that survives the refresh is Google's "verify your account"
+                    // gate, not a dead credential — the account is fine, it just cannot serve now —
+                    // so the call moves to the next account rather than failing. Only a 401 marks
+                    // the credential as dead.
                     token = await this.options.tokens.resolve(token.account, true);
                     response = await this.request(options, model, token.account, token.accessToken, watchdog.signal);
-                    if (response.status === 401 || response.status === 403) {
+                    if (response.status === 401) {
                         this.options.onCredentialRejected?.(token.account);
                     }
                 }
-                // A spent allowance (402/429) moves to the next account, remembering when this
+                // A spent allowance (402/429) moves to the next account, remembering when a spent
                 // one refills so later requests skip it until then.
                 if (!response.ok && (response.status === 402 || response.status === 429) && order.length > 1) {
+                    diag.push(`${response.status} on ${token.account}, moving to next`);
                     this.noteSpent(token.account);
                     const resetAt = await this.resetAt(token.account);
                     allowanceScheduler.noteReset(ANTIGRAVITY_PROVIDER_ID, token.account, resetAt);
                     continue;
                 }
-                if (!response.ok)
-                    throw await httpLlmError(response, 'Antigravity API');
+                // A 403 "verify your account" is Google's safety gate, not a dead credential.
+                // Cool the account (so the gate is not re-hit at once) and move to the next —
+                // but only if one has not been cooled already this pass, else the loop would
+                // sweep every account and trip the gate on all of them at once.
+                if (!response.ok && response.status === 403 && order.length > 1) {
+                    const alreadyCooled = [...tried].some((account) => allowanceScheduler.isCooling(ANTIGRAVITY_PROVIDER_ID, account));
+                    if (!alreadyCooled) {
+                        diag.push(`403 on ${token.account}, cooling and moving to next`);
+                        allowanceScheduler.coolDown(ANTIGRAVITY_PROVIDER_ID, token.account);
+                        continue;
+                    }
+                    diag.push(`403 on ${token.account}, another account already cooling; stopping the sweep`);
+                }
+                if (!response.ok) {
+                    diag.push(`fail ${response.status} on ${token.account} (no switch)`);
+                    const error = await httpLlmError(response, 'Antigravity API');
+                    // The diagnostic rides the message so it surfaces where the user sees the
+                    // failure, since the node half's stdout is unreachable in the desktop shell.
+                    error.message = `${error.message} [${diag.join(' | ')}]`;
+                    throw error;
+                }
                 if (response.body === null) {
                     throw new LlmError('Antigravity API returned no response body', EMPTY_RESPONSE_CODE);
                 }
                 yield* streamAntigravity(response.body, () => { watchdog.pulse(); });
                 return;
             }
-            throw new LlmError('Antigravity API: every account\'s allowance is spent', EMPTY_RESPONSE_CODE);
+            const exhausted = new LlmError(`Antigravity API: every account's allowance is spent [${diag.join(' | ')}]`, EMPTY_RESPONSE_CODE);
+            throw exhausted;
         }
         catch (error) {
             throw mapFetchFailure('Antigravity API', this.refreshHint(error), watchdog, options.signal);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-subscription-oauth",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "description": "Use subscription accounts as DeepSeek Harness LLM providers — Kimi Code (OAuth device flow), Grok / X Premium (OIDC + PKCE), Google Antigravity (Google OAuth + Cloud Code Assist) and GLM / BigModel (ZCode's browser sign-in) — with per-model visibility, drag-to-reorder Auto fallback and plan quotas from the web Settings page",
   "license": "MIT",
   "author": "EricFL1998",