opencode-auth-load-balancer 0.2.1 → 0.3.0

package/dist/providers/anthropic/constants.d.ts

@@ -35,10 +35,15 @@ export declare const DEFAULT_FAMILY_ORDER: readonly string[];
 /** 429 header naming which rate-limit window is the binding constraint. */
 export declare const REPRESENTATIVE_CLAIM_HEADER = "anthropic-ratelimit-unified-representative-claim";
 /**
- * `representative-claim` values that name a MODEL-TIER window (a per-model
- * weekly/5h cap, e.g. `seven_day_opus`, `seven_day_fable`) rather than an
- * account-wide one (bare `five_hour` / `seven_day`). The capture group is the
- * tier name — the key of `PoolAccount.modelCooldownsUntil`.
+ * `representative-claim` values that name a TIER-scoped window (a per-model
+ * weekly/5h cap OR the premium/overage bucket — e.g. `seven_day_opus`,
+ * `seven_day_fable`, `seven_day_overage_included`) rather than a bare
+ * account-wide one (`five_hour` / `seven_day`). Used ONLY as a GATE by
+ * `planReactiveFallback`; the captured suffix is NOT the cooldown key. Anthropic
+ * emits non-model-family suffixes (`overage_included`) that no request's model
+ * family ever equals, so keying on the suffix records a dead
+ * `modelCooldownsUntil` entry the proactive skip can never consult — the cooldown
+ * is keyed by the REQUEST's model family instead (see `planReactiveFallback`).
  */
 export declare const MODEL_TIER_CLAIM_RE: RegExp;
 /** 429 header with the unix-seconds reset time of the binding window. */

package/dist/providers/anthropic/fallback.d.ts

@@ -40,7 +40,9 @@ export declare function resolveFallbackSetting(): FallbackSetting;
  * on a cheap condition (a stored tier cooldown or a response header) BEFORE
  * this parse.
  */
-export declare function downgradeModel(body: string, models: readonly string[]): ModelFallback | null;
+export declare function downgradeModel(body: string, models: readonly string[]): (ModelFallback & {
+    fromTier: string;
+}) | null;
 /**
  * REACTIVE: on a rejected response, when the binding limit is a MODEL-TIER cap
  * (`representative-claim: seven_day_<tier>` / `five_hour_<tier>`) and the sent

package/dist/providers/openai/usage.d.ts

@@ -1,16 +1,22 @@
 import type { PoolAccount, UsageSnapshot } from '../../types';
 /**
  * Parse usage from Codex response headers (x-codex-{primary,secondary}-*).
- * primary = ~5h window (hourly), secondary = weekly window. The parse itself
- * (null-short-circuit, "no capturedAt", "`{}` collapses to null") lives in the
- * shared `parseWindowPairHeaders` — only the header names and the percent
- * scale are Codex-specific.
+ * The historical default is primary = ~5h and secondary = weekly; when the
+ * primary-window-minutes header identifies a seven-day primary, swap the pair
+ * before using the shared parser (see `isWeeklyMinutes`). An absent/
+ * unparsable duration header keeps the historical default — `Number(null)` is
+ * NaN, and every comparison against NaN is false. The parse itself (null-short-circuit,
+ * "no capturedAt", "`{}` collapses to null") lives in the shared
+ * `parseWindowPairHeaders` — only the header names, the percent scale, and
+ * this role detection are Codex-specific.
  */
 export declare function parseUsageHeaders(headers: Headers): Partial<UsageSnapshot> | null;
 /**
- * Poll GET /wham/usage for authoritative 5h (primary) + weekly (secondary)
- * utilization without consuming inference quota. Null on failure. Sends the Codex
- * CLI's `codex-cli` UA and the `chatgpt-account-id` (from the stored id or, as a
- * fallback, decoded from the access-token JWT) — required for team/workspace accounts.
+ * Poll GET /wham/usage for authoritative 5h + weekly utilization without
+ * consuming inference quota, assigning each returned window to its role BY
+ * DURATION (see `isWeeklyMinutes`) rather than by position. Null on failure.
+ * Sends the Codex CLI's `codex-cli` UA and the `chatgpt-account-id` (from the
+ * stored id or, as a fallback, decoded from the access-token JWT) — required
+ * for team/workspace accounts.
  */
 export declare function fetchUsage(account: PoolAccount, now: number): Promise<UsageSnapshot | null>;

package/dist/providers/registry.d.ts

@@ -0,0 +1,26 @@
+import type { ProviderAdapter } from './types';
+/**
+ * Every provider adapter this plugin ships, in one place.
+ *
+ * The per-provider plugin exports in `index.ts` each own exactly ONE adapter
+ * (opencode registers an auth hook per provider), but the provider-agnostic
+ * surfaces — the usage-endpoint refresh and the `auth_lb_status` dashboard —
+ * must reach ALL of them. Without a shared registry those call sites
+ * hand-listed the pair and drifted: the request path only ever refreshed the
+ * adapter whose fetch it belonged to, so a provider you did not actively send
+ * requests to (e.g. Codex while you work in Claude) had NO refresh cycle at
+ * all after its startup seed and its usage froze for the whole opencode
+ * process lifetime. Adding a third provider now means editing this array only.
+ *
+ * `readonly` so a consumer cannot mutate the shared list; iteration order is
+ * irrelevant (each account is matched to its own adapter by `providerID`).
+ */
+export declare const ADAPTERS: readonly ProviderAdapter[];
+/**
+ * The adapter that owns `providerID`, or undefined for a pool row whose
+ * provider this build does not know (a hand-edited file, or a row left behind
+ * by a newer version). A linear scan, not a Map: the registry has a handful of
+ * entries and this runs per account on the request hot path, where building a
+ * Map per call would cost more than the scan it replaces.
+ */
+export declare function adapterFor(adapters: readonly ProviderAdapter[], providerID: string): ProviderAdapter | undefined;

package/dist/providers/types.d.ts

@@ -48,12 +48,16 @@ export interface ModelFallback {
 }
 /**
  * Reactive-fallback plan returned from a rejected (429) response whose headers
- * indicate a MODEL-TIER cap (not an account-wide limit). `tier` names the
- * limited tier (e.g. "opus", "fable") and `resetAt` (epoch ms) is when it
- * recovers — persisted as `PoolAccount.modelCooldownsUntil[tier]` so subsequent
- * requests for that tier avoid the account without paying a rejected
- * round-trip. `fallback` is the downgraded body the fetch loop adopts once the
- * WHOLE pool proves limited for the tier.
+ * indicate a MODEL-TIER cap (not an account-wide limit). `tier` is the REQUEST's
+ * own model family (e.g. "opus", "fable") — the exact key the fetch loop's
+ * proactive skip reads as `requestModelTier(body)` — NOT the raw claim suffix
+ * (Anthropic emits non-family suffixes like `overage_included` that no request
+ * ever maps to; keying on them recorded a dead `modelCooldownsUntil` entry the
+ * skip could never consult). `resetAt` (epoch ms) is when the tier recovers —
+ * persisted as `PoolAccount.modelCooldownsUntil[tier]` so subsequent requests
+ * for that tier avoid the account without paying a rejected round-trip.
+ * `fallback` is the downgraded body the fetch loop adopts once the WHOLE pool
+ * proves limited for the tier.
  */
 export interface ReactiveModelFallback {
     tier: string;

package/dist/scheduler/select.d.ts

@@ -13,13 +13,16 @@ export interface Selection {
  * 1. Restrict to the provider's non-disabled accounts, minus `exclude` (already
  *    tried this request).
  * 2. Prefer the subset that is currently available (not exhausted / cooling down).
- * 3. Among those, pick the highest urgency score.
+ * 3. Among those, pick the highest urgency score — but KEEP the incumbent
+ *    (`incumbentId`, the provider's current in-use account) when its score is
+ *    within `INCUMBENT_HYSTERESIS` of the best, so near-equal scores don't churn
+ *    the account and waste prompt cache.
  * 4. If none are available, fall back to the least-bad account (lowest weekly
  *    utilization) and flag the selection as `degraded`.
  *
  * Returns null when the provider has no usable account left.
  */
-export declare function selectAccount(accounts: PoolAccount[], providerID: string, now: number, cfg?: SchedulerConfig, exclude?: ReadonlySet<string>): Selection | null;
+export declare function selectAccount(accounts: PoolAccount[], providerID: string, now: number, cfg?: SchedulerConfig, exclude?: ReadonlySet<string>, incumbentId?: string | null): Selection | null;
 /**
  * Session-aware selection. Balances prompt-cache stickiness against headroom safety
  * and quota perishability:

package/dist/status.d.ts

@@ -1,5 +1,5 @@
 import { type SchedulerConfig } from './scheduler/config';
-import type { PoolFile } from './types';
+import { type PoolFile } from './types';
 interface AccountStatus {
     id: string;
     label: string;

package/dist/types.d.ts

@@ -78,17 +78,71 @@ export interface PoolAccount {
      * parse without a cast.
      */
     opusCooldownUntil?: number;
-    /** Non-null when the account needs manual re-login (e.g. revoked refresh token). */
+    /**
+     * Non-null when the scheduler skips this account. Two sources, both gated by
+     * `isAvailable`: the automatic `invalid_grant: re-login required (…)` reason
+     * written on a revoked refresh token (`src/refresh.ts`), and the manual
+     * `MANUAL_DISABLED_REASON` sentinel written by the disable action (TUI menu /
+     * `auth_lb_disable` tool). The dashboards distinguish the two to render
+     * `disabled` (a user turned it off) vs `re-login` (needs a fresh OAuth login).
+     */
     disabledReason: string | null;
 }
+/**
+ * Sentinel `disabledReason` written by the MANUAL disable action (the TUI
+ * sidebar menu and the `auth_lb_disable` tool), distinct from the automatic
+ * `invalid_grant: re-login required (…)` reason `src/refresh.ts` writes when a
+ * refresh token is revoked. Both are non-null so `isAvailable` skips the
+ * account; the value is kept distinct only so the dashboards can render
+ * `disabled` (a user turned it off) rather than `re-login` (needs a fresh login).
+ */
+export declare const MANUAL_DISABLED_REASON = "manually disabled";
+/**
+ * Re-login intents expire after ten minutes. A bounded lifetime prevents an
+ * abandoned TUI OAuth flow from redirecting a later, unrelated provider login
+ * onto the account row that happened to be clicked earlier.
+ */
+export declare const RELOGIN_TTL_MS = 600000;
+export interface ReloginIntent {
+    /** `PoolAccount.id` the freshly exchanged tokens must land on. */
+    accountId: string;
+    /** Provider the re-login was started for; an intent for another provider is ignored. */
+    providerID: string;
+    /** epoch ms after which the intent is stale and dropped at the read boundary. */
+    expiresAt: number;
+}
 /** A conversation's sticky account assignment (preserves prompt cache across turns). */
 export interface SessionAssignment {
     accountId: string;
     updatedAt: number;
+    /**
+     * Set when THIS session's most recent successful request was served on an
+     * auto-downgraded fallback model (the requested model tier's weekly cap is
+     * exhausted pool-wide, so the request descended the fallback ladder). Read by
+     * the TUI bottom bar to PERSISTENTLY surface the degrade — the `onModelFallback`
+     * toast is transient and gone by the next turn, yet the session keeps running
+     * on the fallback model. `from`/`to` are the raw model ids (original requested
+     * model → served model), matching the toast wording. The whole session row is
+     * overwritten on every success, so the next request served on the requested
+     * model naturally clears this back to `undefined`.
+     */
+    fallback?: {
+        from: string;
+        to: string;
+    };
 }
 export interface PoolFile {
     version: 1;
     accounts: PoolAccount[];
+    /**
+     * Short-lived TUI → server handshake consumed by the first `addAccount` for
+     * this provider. It identifies the clicked pool row when a provider rotates
+     * refresh tokens and exposes no stable account id (Anthropic); without it a
+     * completed re-login appends a duplicate while leaving the revoked row
+     * behind. Absent in the steady state so `JSON.stringify` keeps the pool file
+     * compact.
+     */
+    relogin?: ReloginIntent;
     /**
      * providerID -> account that most recently served a request. Drives the ▶
      * "in use" marker in the status tool/CLI and the TUI bottom bar/sidebar;

package/dist/usage-refresh.d.ts

@@ -1,5 +1,17 @@
 import type { ProviderAdapter } from './providers/types';
 import type { PoolFile } from './types';
+/**
+ * Max lifetime of a TRANSIENT (non-quota) cooldown. fetch.ts cools a thrown
+ * network error or a header-less 429/402 for at most `ACCOUNT_COOLDOWN_MS`
+ * (5min) and an auth 401/403 for `AUTH_COOLDOWN_MS` (2min); ONLY a quota 429's
+ * `Retry-After` writes a cooldown beyond this. So a cooldown whose remainder
+ * still exceeds this bound is necessarily quota-derived — the one class that can
+ * outlive its own usage window after an out-of-band reset (see the stale-cooldown
+ * reconciliation below). Kept `=== ACCOUNT_COOLDOWN_MS` by a drift-guard test;
+ * defined locally because importing it from fetch.ts (which imports THIS module)
+ * would form a cycle.
+ */
+export declare const MAX_TRANSIENT_COOLDOWN_MS: number;
 /**
  * Test-only window into the module-private `lastPoll` throttle map. Never
  * imported by production code — only by usage-refresh tests that need to
@@ -9,22 +21,28 @@ import type { PoolFile } from './types';
  */
 export declare function _lastPollIdsForTests(): Set<string>;
 /**
- * Best-effort: seed/refresh usage for accounts whose WEEKLY snapshot is missing or
- * stale (`capturedAt` is stamped only when a weekly window arrives — see
- * `applyUsagePartial` in fetch.ts), via the provider's dedicated usage endpoint.
- * Throttled per account (at most one poll per account per SEED_TTL_MS). Callers
- * invoke it fire-and-forget, so it adds no latency to the request path; failures
- * are swallowed — response headers remain the primary, always-fresh usage signal
- * and this fixes cold-start blindness AND out-of-band server-side resets (e.g. a
- * promotional weekly-quota reset) that response headers alone don't converge.
- *
- * Returns a promise (for tests / explicit awaiting); request-path callers ignore it.
+ * Refresh stale usage for ONE provider's accounts (see `refreshUsage`).
  *
- * `poolSnapshot` lets the request hot path reuse the pool it JUST read for
- * account selection instead of paying a second serialized file read +
- * JSON.parse per request. The snapshot is only consulted for the staleness
- * gates below; the actual usage write still goes through `mutatePool` (which
- * re-reads under the lock), so a slightly stale snapshot is harmless. Callers
- * without a pool in hand (e.g. the startup seed in index.ts) omit it.
+ * Used by the flows that are inherently scoped to a single provider: the
+ * OAuth login callback (only the just-added account matters) and each
+ * provider plugin's startup seed, which awaits ITS provider's usage before
+ * priming that provider's in-use marker. Ambient callers must NOT use this —
+ * see `refreshAllUsageInBackground`.
  */
 export declare function refreshUsageInBackground(adapter: ProviderAdapter, now: number, poolSnapshot?: PoolFile): Promise<void>;
+/**
+ * Refresh stale usage across EVERY registered provider (see `refreshUsage`).
+ *
+ * This is what the ambient callers — the request hot path and the
+ * `auth_lb_status` dashboard — use, and the distinction is load-bearing:
+ * usage converges to server-side truth from response headers (only for the
+ * provider you are actually sending requests to) or from a usage-endpoint
+ * poll. Scoping that poll to the requesting provider left an IDLE provider
+ * with no refresh cycle whatsoever after its one startup seed, so working all
+ * day in Claude froze the Codex numbers in the dashboard/TUI at whatever they
+ * were when opencode launched (and vice versa). Refreshing the whole registry
+ * instead costs nothing in the steady state — the per-account staleness gate
+ * and `lastPoll` throttle inside `refreshUsage` are unchanged, so an idle
+ * provider is polled at most once per SEED_TTL_MS and a fresh one not at all.
+ */
+export declare function refreshAllUsageInBackground(now: number, poolSnapshot?: PoolFile): Promise<void>;

package/dist/util.d.ts

@@ -30,11 +30,12 @@ export declare function clamp01(n: number): number;
 export declare function isFiniteNumber(v: unknown): v is number;
 /**
  * True for a plain JSON object (non-null `object`, not an array). Shared
- * trust-boundary predicate for the two consumers that accept arbitrary JSON
+ * trust-boundary predicate for the consumers that accept arbitrary JSON
  * shapes: the user-editable pool file's `lastSelected` / `sessions`
- * containers and session rows (`pool/store.ts`), and the incoming `system`
+ * containers and session rows (`pool/store.ts`), the incoming `system`
  * prompt blocks in the Anthropic request transform
- * (`providers/anthropic/transform.ts`). NOTE:
+ * (`providers/anthropic/transform.ts`), and the Codex `/wham/usage`
+ * `rate_limit` envelope (`providers/openai/usage.ts`). NOTE:
  * `tui/auth-load-balancer-tui.logic.ts` ships its OWN `isPlainRecordValue`
  * copy by design — the TUI runtime cannot import `src/`.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-auth-load-balancer",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Load-balance opencode requests across multiple Anthropic (Claude) and OpenAI (Codex) OAuth accounts, weighted primarily by weekly usage with drain-before-reset scheduling.",
   "type": "module",
   "license": "MIT",
@@ -41,19 +41,19 @@
     "prepare": "husky"
   },
   "peerDependencies": {
-    "@opencode-ai/plugin": ">=1.17.13"
+    "@opencode-ai/plugin": ">=1.17.18"
   },
   "devDependencies": {
-    "@opencode-ai/plugin": "^1.17.13",
-    "@opentui/core": "0.4.2",
-    "@opentui/solid": "0.4.2",
+    "@opencode-ai/plugin": "^1.17.18",
+    "@opentui/core": "0.4.3",
+    "@opentui/solid": "0.4.3",
     "@types/bun": "^1.3.14",
-    "@types/node": "^26.1.0",
+    "@types/node": "^26.1.1",
     "eslint-plugin-devup": "^2.0.19",
     "husky": "^9.1",
-    "oxlint": "1.72",
+    "oxlint": "1.73",
     "solid-js": "1.9.14",
-    "typescript": "^6.0.3"
+    "typescript": "^7.0.2"
   },
   "keywords": [
     "opencode",

package/tui/auth-load-balancer-tui.logic.ts

@@ -66,8 +66,12 @@ export interface PoolAccount {
 /** Loosely-typed view of the on-disk pool JSON (one shape for reads AND read-modify-writes). */
 export interface PoolShape {
   accounts?: PoolAccount[]
+  relogin?: { accountId?: string; providerID?: string; expiresAt?: number }
   lastSelected?: Record<string, string>
-  sessions?: Record<string, { accountId?: string }>
+  sessions?: Record<
+    string,
+    { accountId?: string; fallback?: { from?: string; to?: string } }
+  >
 }
 
 /**
@@ -222,6 +226,62 @@ export function mutatePoolFile(
   }
 }
 
+/**
+ * Sentinel `disabledReason` the manual disable toggle writes — the TUI copy of
+ * `src/types.ts`'s `MANUAL_DISABLED_REASON` (the TUI runtime cannot import
+ * `src/`; see the `isPlainRecordValue`/`isFiniteNumber` NOTEs above for the
+ * same trust boundary). Kept BYTE-IDENTICAL to the server constant so a manual
+ * disable written here reads back as `disabled` (not `re-login`) everywhere.
+ */
+export const MANUAL_DISABLED_REASON = 'manually disabled'
+
+/**
+ * NOTE: byte-identical copy of `src/types.ts`'s `RELOGIN_TTL_MS`, kept in sync
+ * by hand because the TUI runtime cannot import `src/`; see the
+ * `MANUAL_DISABLED_REASON` NOTE above for the same trust boundary.
+ */
+export const RELOGIN_TTL_MS = 600_000
+
+export function setReloginTargetInPool(
+  accountId: string,
+  providerID: string,
+  now: number,
+  path: string = POOL_FILE,
+): void {
+  mutatePoolFile((pool) => {
+    pool.relogin = {
+      accountId,
+      providerID,
+      expiresAt: now + RELOGIN_TTL_MS,
+    }
+  }, path)
+}
+
+export function clearReloginTargetInPool(path: string = POOL_FILE): void {
+  mutatePoolFile((pool) => {
+    delete pool.relogin
+  }, path)
+}
+
+/**
+ * Resolve the provider OAuth method by label instead of hardcoding an index:
+ * opencode aggregates auth methods from every plugin registered for a provider,
+ * so this plugin's position is not stable. Prefer its pooled-login label, then
+ * fall back to the provider's first OAuth method when no such label is present.
+ */
+export function pickAuthMethodIndex(
+  methods: readonly { type?: string; label?: string }[] | undefined,
+): number | null {
+  const pooled = methods?.findIndex(
+    (method) =>
+      method.type === 'oauth' &&
+      method.label?.toLowerCase().includes('load balancer'),
+  )
+  if (pooled !== undefined && pooled >= 0) return pooled
+  const oauth = methods?.findIndex((method) => method.type === 'oauth')
+  return oauth !== undefined && oauth >= 0 ? oauth : null
+}
+
 export function renameInPool(
   id: string,
   label: string,
@@ -248,6 +308,23 @@ export function deleteFromPool(id: string, path: string = POOL_FILE): void {
   }, path)
 }
 
+/**
+ * Toggle an account's MANUAL disable flag: `disabled` writes the
+ * `MANUAL_DISABLED_REASON` sentinel (the scheduler then skips it, exactly like
+ * the server's `isAvailable`), `!disabled` clears it. Reversible, so — unlike
+ * Delete — the sidebar calls this straight through with no confirm dialog.
+ */
+export function setDisabledInPool(
+  id: string,
+  disabled: boolean,
+  path: string = POOL_FILE,
+): void {
+  mutatePoolFile((pool) => {
+    const acct = (pool.accounts ?? []).find((a) => a.id === id)
+    if (acct) acct.disabledReason = disabled ? MANUAL_DISABLED_REASON : null
+  }, path)
+}
+
 /**
  * Normalize a raw (loosely-typed) pool account into the strict shape the shared
  * scorer reads. The pool file is user-editable and read RAW here (the server
@@ -284,6 +361,48 @@ export function toScore(a: PoolAccount): ScoreAccount {
   }
 }
 
+/**
+ * The account the CURRENT opencode session is pinned to for a provider — i.e.
+ * what THIS session is actually using — read from the pool's session map. The
+ * key is `<providerID>:s:<sessionID>`, exactly what `deriveSessionKey` +
+ * `recordSuccess` (src/fetch.ts) write on each served request. Returns
+ * `undefined` when there is no session (home screen) or the session has not yet
+ * pinned an account for this provider. The in-use (▶) marker uses this so it
+ * reflects the VIEWER's OWN session, not the global `lastSelected` (whichever
+ * session served most recently across the whole pool — misleading while several
+ * sessions run at once).
+ */
+export function sessionAccountId(
+  pool: PoolShape,
+  providerID: string,
+  sessionId: string | undefined,
+): string | undefined {
+  if (!sessionId) return undefined
+  return pool.sessions?.[`${providerID}:s:${sessionId}`]?.accountId
+}
+
+/**
+ * The active model downgrade for THIS session on `providerID`, or `undefined`
+ * when the session's latest request ran on the model it asked for (or there is
+ * no session). `{ from, to }` are the raw model ids (requested → served) the
+ * server recorded in {@link SessionAssignment.fallback}. The bottom bar shows it
+ * so a session silently running on a fallback model is visible even after the
+ * transient switch toast is gone. Both fields are re-validated as strings (a
+ * hand-edited pool could hold anything) — a malformed `fallback` reads as "no
+ * downgrade" rather than rendering `undefined`.
+ */
+export function sessionFallback(
+  pool: PoolShape,
+  providerID: string,
+  sessionId: string | undefined,
+): { from: string; to: string } | undefined {
+  if (!sessionId) return undefined
+  const fb = pool.sessions?.[`${providerID}:s:${sessionId}`]?.fallback
+  if (!fb || typeof fb.from !== 'string' || typeof fb.to !== 'string')
+    return undefined
+  return { from: fb.from, to: fb.to }
+}
+
 /**
  * Byte-deterministic ASCII string comparator (never `localeCompare` — keeps
  * tier/provider ordering byte-identical regardless of host locale). Ships its
@@ -307,16 +426,17 @@ export function until(resetAt: number | undefined, now: number): string {
   if (!isFiniteNumber(resetAt) || resetAt <= now) return '-'
   // Mirror the server's `relTime` (src/status.ts) semantics: floor minutes at 1
   // (a sub-30s future reset must not render "0m" — '-' is reserved for elapsed)
-  // and FLOOR the day figure (36h is "1d", not "2d") so the TUI bar's day/minute
-  // rounding can never disagree with the CLI/tool dashboard's. NOTE: this is
+  // keep <=48h as hours (47h is "47h", not "1d") before FLOORing the day
+  // figure so the TUI bar's day/minute rounding can never disagree with the
+  // CLI/tool dashboard's. NOTE: this is
   // coarser than the CLI within the hour band on purpose (bar-width budget) —
-  // the CLI renders `${hrs}h${mins % 60}m` (e.g. "3h25m"), this renders just
-  // `${hrs}h` (e.g. "3h"). Same day-level bucket, less precision inside it —
+  // after the <=120m minute band, the CLI renders `${hrs}h${mins % 60}m`
+  // (e.g. "3h25m"), this renders just `${hrs}h` (e.g. "3h"). Same day-level bucket, less precision inside it —
   // not byte-identical output.
   const mins = Math.max(1, Math.round((resetAt - now) / 60_000))
-  if (mins < 60) return `${mins}m`
+  if (mins <= 120) return `${mins}m`
   const hrs = Math.floor(mins / 60)
-  if (hrs < 24) return `${hrs}h`
+  if (mins <= 48 * 60) return `${hrs}h`
   return `${Math.floor(hrs / 24)}d`
 }
 /** A window's utilization for the bar: "-" when absent, "0%" once it has reset (stale value dropped). */
@@ -351,7 +471,10 @@ export function stateOf(
   tiers: [string, number][],
   now: number,
 ): string {
-  if (sa.disabledReason) return 're-login'
+  if (sa.disabledReason)
+    return sa.disabledReason === MANUAL_DISABLED_REASON
+      ? 'disabled'
+      : 're-login'
   if (sa.cooldownUntil > now) return `cooldown ${until(sa.cooldownUntil, now)}`
   if (isExhausted(sa, cfg, now)) return 'full'
   // A model-tier limit keeps the account usable (other models + downgrade),