dsh-plugin-subscription-oauth 0.8.3 → 0.8.5

package/lib/providers/antigravity.d.ts

@@ -32,6 +32,9 @@ export declare const ANTIGRAVITY_AUTHORIZE_URL = "https://accounts.google.com/o/
 export declare const ANTIGRAVITY_TOKEN_URL = "https://oauth2.googleapis.com/token";
 /** Google's profile endpoint, used for the account label. */
 export declare const ANTIGRAVITY_USERINFO_URL = "https://www.googleapis.com/oauth2/v2/userinfo";
+/** Minimum beat between Antigravity dispatch attempts, so a refused account is not re-hit
+ *  at once and a sweep across the pool does not become a burst. */
+export declare const ANTIGRAVITY_PACING_MS = 2000;
 /** Default Cloud Code Assist origin. */
 export declare const ANTIGRAVITY_BASE_URL = "https://daily-cloudcode-pa.googleapis.com";
 /** Production origin, tried when the daily one is unavailable. */

package/lib/providers/antigravity.js

@@ -34,6 +34,34 @@ export const ANTIGRAVITY_AUTHORIZE_URL = 'https://accounts.google.com/o/oauth2/v
 export const ANTIGRAVITY_TOKEN_URL = 'https://oauth2.googleapis.com/token';
 /** Google's profile endpoint, used for the account label. */
 export const ANTIGRAVITY_USERINFO_URL = 'https://www.googleapis.com/oauth2/v2/userinfo';
+/** Minimum beat between Antigravity dispatch attempts, so a refused account is not re-hit
+ *  at once and a sweep across the pool does not become a burst. */
+export const ANTIGRAVITY_PACING_MS = 2_000;
+/** The last moment an Antigravity dispatch started; the next waits out the beat. */
+let lastAntigravityDispatchAt = 0;
+/**
+ * Wait out the Antigravity pacing beat before a dispatch attempt.
+ *
+ * A request right after a refused one is what turns a transient Google safety check into
+ * a sustained block; a short, provider-scoped pause between attempts is the discipline
+ * that keeps the pool reachable. Aborts when the caller's signal fires.
+ *
+ * @param signal - the caller's abort signal.
+ */
+async function paceAntigravityAttempt(signal) {
+    const wait = lastAntigravityDispatchAt + ANTIGRAVITY_PACING_MS - Date.now();
+    lastAntigravityDispatchAt = Date.now();
+    if (wait <= 0 || signal.aborted)
+        return;
+    await new Promise((resolve) => {
+        const onAbort = () => { clearTimeout(timer); resolve(); };
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', onAbort);
+            resolve();
+        }, wait);
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
+}
 /** Default Cloud Code Assist origin. */
 export const ANTIGRAVITY_BASE_URL = 'https://daily-cloudcode-pa.googleapis.com';
 /** Production origin, tried when the daily one is unavailable. */
@@ -430,30 +458,22 @@ export class AntigravityAdapter extends LlmAdapter {
             const diag = [`pool=${accounts.join(',') || '(none)'}`];
             const tried = new Set();
             let token = await this.options.tokens.resolve();
-            // Move an account known to be spent (from a past failure) to the back, so a fresh
-            // request starts on one that has allowance. A lone account still serves.
-            const order = [...accounts.filter((a) => a !== token.account && !this.isSpent(a)), token.account,
-                ...accounts.filter((a) => a !== token.account && this.isSpent(a))];
+            // Stay on the default account until it refuses. opencodex keeps account affinity —
+            // a request stays on one account and only moves after a 429 — because switching
+            // accounts on every request is what reads to Google as two accounts in play at once
+            // and trips the verify gate. Reordering here caused exactly that.
+            const order = [token.account, ...accounts.filter((a) => a !== token.account)];
             for (const accountKey of order) {
                 if (tried.has(accountKey))
                     continue;
                 tried.add(accountKey);
                 token = await this.options.tokens.resolve(accountKey);
-                // A transport failure (DNS, connect timeout) on one account may be that account's
-                // path, not the provider's; try the next account before giving up, the same way a
-                // spent allowance does. A lone account still surfaces the real error.
-                let response;
-                try {
-                    response = await this.request(options, model, token.account, token.accessToken, watchdog.signal);
-                }
-                catch (error) {
-                    const transport = error instanceof TypeError || error.name === 'AbortError';
-                    if (transport && order.length > 1 && !watchdog.timedOut) {
-                        diag.push(`transport on ${token.account}, moving to next`);
-                        continue;
-                    }
-                    throw error;
-                }
+                // Pacing: a connect attempt right after a refused one is what turns a transient
+                // Google safety check into a sustained block, so the streamer waits out a short
+                // beat before each retry. opencodex keeps this discipline with a request pacer;
+                // this is the same idea narrowed to one provider.
+                await paceAntigravityAttempt(watchdog.signal);
+                let response = await this.request(options, model, token.account, token.accessToken, watchdog.signal);
                 if (response.status === 401 || response.status === 403) {
                     // The stored token was accepted locally but refused on the wire; force one
                     // refresh. A 403 that survives the refresh is Google's "verify your account"

package/lib/providers/responses-stream.d.ts

@@ -15,6 +15,12 @@ import type { GenerateOptions, StreamChunk } from '@deepseek-ai/dsh-llm';
 import type { SessionBase } from '../auth/store.js';
 import type { TokenManager } from '../auth/tokens.js';
 import type { UsageWindow } from '../protocol.js';
+/**
+ * Minimum beat between dispatch attempts on one route, so a refused account is not
+ * re-hit at once and a sweep across the pool does not become a burst. opencodex keeps
+ * this discipline with a request pacer; this is the same idea narrowed to one plugin.
+ */
+export declare const DISPATCH_PACING_MS = 2000;
 /**
  * Build the cross-account hooks one route needs to draw on its whole account pool.
  *

package/lib/providers/responses-stream.js

@@ -15,6 +15,35 @@ import { EMPTY_RESPONSE_CODE, LlmError } from '@deepseek-ai/dsh-llm';
 import { allowanceScheduler } from '../auth/allowance-scheduler.js';
 import { streamResponses } from '../translate/responses.js';
 import { httpLlmError, idleWatchdog, mapFetchFailure } from './common.js';
+/**
+ * Minimum beat between dispatch attempts on one route, so a refused account is not
+ * re-hit at once and a sweep across the pool does not become a burst. opencodex keeps
+ * this discipline with a request pacer; this is the same idea narrowed to one plugin.
+ */
+export const DISPATCH_PACING_MS = 2_000;
+/** Per-route last-dispatch instants, so each route paces its own attempts. */
+const lastDispatchAt = new Map();
+/**
+ * Wait out a route's pacing beat before a dispatch attempt.
+ *
+ * @param route - the route key pacing its own attempts.
+ * @param signal - the caller's abort signal.
+ */
+async function paceDispatch(route, signal) {
+    const last = lastDispatchAt.get(route) ?? 0;
+    const wait = last + DISPATCH_PACING_MS - Date.now();
+    lastDispatchAt.set(route, Date.now());
+    if (wait <= 0 || signal.aborted)
+        return;
+    await new Promise((resolve) => {
+        const onAbort = () => { clearTimeout(timer); resolve(); };
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', onAbort);
+            resolve();
+        }, wait);
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
+}
 /**
  * Build the cross-account hooks one route needs to draw on its whole account pool.
  *
@@ -101,28 +130,17 @@ export async function* streamProviderResponses(options, input) {
         if (models.length === 0) {
             throw new LlmError(`${label} has no enabled model to dispatch to`, EMPTY_RESPONSE_CODE);
         }
-        // When the provider meters per account and an account's allowance can run out,
-        // every account is a candidate: a spent one falls through to the next, so one
-        // model id draws on the whole pool's allowance. Accounts are tried in order;
-        // the first that serves the request wins.
+        // Stay on the default account until it refuses. opencodex keeps account affinity — a
+        // request stays on one account and only moves after a 429 — because switching accounts
+        // on every request is what reads to a provider as several accounts in play at once and
+        // trips the safety gate. Reordering candidates here caused exactly that.
         let accounts = input.accounts === undefined
             ? undefined
             : [...await input.accounts()];
-        // Send work straight to an account that has allowance: one already known to be
-        // spent until a future reset is moved to the back, so a fresh request does not
-        // fail against it once to find out. This is a preference, not a skip — a lone
-        // account still serves, and the spent-retry below catches a stale record.
-        if (accounts !== undefined && accounts.length > 1 && input.isAccountSpent !== undefined) {
-            const fresh = [];
-            const tired = [];
-            for (const account of accounts) {
-                if (await input.isAccountSpent(account))
-                    tired.push(account);
-                else
-                    fresh.push(account);
-            }
-            if (tired.length > 0 && fresh.length > 0) {
-                accounts = [...fresh, ...tired];
+        if (accounts !== undefined && accounts.length > 1) {
+            const defaultAccount = await tokens.defaultAccount();
+            if (defaultAccount !== undefined) {
+                accounts = [defaultAccount, ...accounts.filter((a) => a !== defaultAccount)];
             }
         }
         const tryAccounts = accounts === undefined || accounts.length === 0
@@ -130,6 +148,10 @@ export async function* streamProviderResponses(options, input) {
             : accounts;
         for (const accountKey of tryAccounts) {
             let token = await tokens.resolve(accountKey);
+            // Pace each dispatch: a request right after a refused one is what turns a
+            // transient safety check into a sustained block, so the streamer waits out a
+            // short beat before each attempt (the same discipline opencodex keeps).
+            await paceDispatch(label, watchdog.signal);
             // Track which accounts a spent-allowance already moved past, so a later model
             // in the chain does not re-try an account known to be exhausted.
             const spent = new Set();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-subscription-oauth",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "description": "Use subscription accounts as DeepSeek Harness LLM providers — Kimi Code (OAuth device flow), Grok / X Premium (OIDC + PKCE), Google Antigravity (Google OAuth + Cloud Code Assist) and GLM / BigModel (ZCode's browser sign-in) — with per-model visibility, drag-to-reorder Auto fallback and plan quotas from the web Settings page",
   "license": "MIT",
   "author": "EricFL1998",