paseo-smart-session 3.2.0 → 3.4.0

package/server/store.ts

@@ -73,7 +73,18 @@ export interface ContextSample {
   readonly title: string | null;
 }
 
-type LogKind = "usage" | "context";
+/**
+ * One ZeroSub account's reading, as ZeroSub took it (`usage.json`), kept so each
+ * account gets a pace and a forecast. Shaped like a usage sample, so the same block
+ * logic reads it, plus the account it belongs to: ZeroSub's id, never an email.
+ */
+export interface AccountSample extends Omit<UsageSample, "src"> {
+  readonly src: "zerosub";
+  readonly accountId: string;
+  readonly family: "claude" | "codex";
+}
+
+type LogKind = "usage" | "context" | "accounts";
 
 /** Monthly files: small enough to read whole, coarse enough to stay few. */
 function logPath(kind: LogKind, at: string): string {
@@ -113,6 +124,10 @@ export async function appendContext(sample: ContextSample): Promise<void> {
   await append("context", sample.at, sample);
 }
 
+export async function appendAccount(sample: AccountSample): Promise<void> {
+  await append("accounts", sample.at, sample);
+}
+
 /**
  * Reads a log back.
  *
@@ -169,6 +184,14 @@ export async function readUsage(options: { sinceMs?: number } = {}): Promise<Usa
   return since === null ? rows : rows.filter((row) => Date.parse(row.at) >= since);
 }
 
+export async function readAccounts(options: { sinceMs?: number } = {}): Promise<AccountSample[]> {
+  const since = options.sinceMs ?? null;
+  const rows = await readLog<AccountSample>("accounts", since);
+  // Defensive: a row from a future shape, or a hand-edited one, is skipped, not thrown on.
+  return rows.filter((row) => typeof row?.accountId === "string" && typeof row.at === "string" && typeof row.windows === "object" && row.windows !== null
+    && (since === null || Date.parse(row.at) >= since));
+}
+
 export async function readContext(options: { sinceMs?: number } = {}): Promise<ContextSample[]> {
   const since = options.sinceMs ?? null;
   const rows = await readLog<ContextSample>("context", since);

package/server/subscriptions.ts

@@ -0,0 +1,208 @@
+/**
+ * Every ZeroSub subscription's history and status, read-only.
+ *
+ * The recorder already keeps the CLI login's plan usage (`usage-*.jsonl`). Under
+ * ZeroSub the other accounts' readings exist only as the latest copy in ZeroSub's own
+ * `usage.json`, overwritten in place. So each new one is kept here in
+ * `accounts-*.jsonl`, keyed by ZeroSub's account id (never an email), which gives
+ * every account a pace and a forecast. ZeroSub's files are only read: nothing here
+ * writes them, opens an account home, or asks ZeroSub for a refresh, a switch or a
+ * reset.
+ */
+
+import { readAgents, withDaemon } from "./daemon.ts";
+import { readZeroSub } from "./guard/zerosub.ts";
+import { appendAccount, readAccounts, readUsage, type AccountSample } from "./store.ts";
+import { burnRatePctPerHour, segmentBlocks, thinPoints } from "../shared/blocks.ts";
+import { accountOf, outUntil, type ZeroSubAccount, type ZeroSubReading, type ZeroSubSnapshot, type ZeroSubWindow } from "../shared/guard/zerosub.ts";
+import { STALE_AFTER_MS, poolForecast, subscriptionName, type Subscription, type SubscriptionWindow } from "../shared/subscriptions.ts";
+import { canonicalWindowId, effectiveAt, type UsageSample } from "../shared/usage.ts";
+
+const DAY = 24 * 60 * 60_000;
+/** Enough history for an open week and its pace. */
+const HISTORY_MS = 8 * DAY;
+/** The CLI's own Claude login: the recorder measures it, and more often than ZeroSub. */
+const RECORDED_ACCOUNT = "claude-main";
+
+/**
+ * A ZeroSub window under Smart Session's ids: `five_hour` and `seven_day` for both
+ * families (Codex's are told apart by length), so one set of rules reads both.
+ */
+export function canonicalAccountWindow(family: "claude" | "codex", window: ZeroSubWindow): string {
+  if (family === "claude") return canonicalWindowId(window.id);
+  if (window.minutes !== null) return window.minutes <= 6 * 60 ? "five_hour" : window.minutes >= 6 * DAY / 60_000 ? "seven_day" : window.id;
+  return window.id === "primary" ? "five_hour" : window.id === "secondary" ? "seven_day" : window.id;
+}
+
+/** ZeroSub's reading as an account sample, with the window ids Smart Session uses. */
+export function accountSample(account: ZeroSubAccount, reading: ZeroSubReading, at: string): AccountSample {
+  const windows: Record<string, { pct: number; resetsAt: string | null }> = {};
+  for (const window of reading.windows) windows[canonicalAccountWindow(account.family, window)] = { pct: window.usedPct, resetsAt: window.resetsAt };
+  return { at, fetchedAt: reading.fetchedAt, src: "zerosub", account: null, accountId: account.id, family: account.family, windows, credits: null };
+}
+
+/** The newest reading already kept per account; filled from the log on first use. */
+let lastKept: Map<string, string> | null = null;
+
+/**
+ * Keeps every new ZeroSub reading. Runs on the recorder's tick; costs three small file
+ * reads when nothing changed and nothing at all without ZeroSub.
+ */
+export async function recordAccounts(now = Date.now()): Promise<number> {
+  const snapshot = await readZeroSub();
+  if (snapshot === null) return 0;
+  if (lastKept === null) {
+    lastKept = new Map();
+    for (const row of await readAccounts({ sinceMs: now - HISTORY_MS })) {
+      const previous = lastKept.get(row.accountId);
+      if (row.fetchedAt && (!previous || Date.parse(row.fetchedAt) > Date.parse(previous))) lastKept.set(row.accountId, row.fetchedAt);
+    }
+  }
+  let kept = 0;
+  for (const account of snapshot.accounts) {
+    if (account.id === RECORDED_ACCOUNT) continue;
+    const reading = snapshot.readings[account.id];
+    if (!reading || reading.windows.length === 0) continue;
+    const previous = lastKept.get(account.id);
+    if (previous && Date.parse(reading.fetchedAt) <= Date.parse(previous)) continue;
+    await appendAccount(accountSample(account, reading, new Date(now).toISOString()));
+    lastKept.set(account.id, reading.fetchedAt);
+    kept += 1;
+  }
+  return kept;
+}
+
+export function forgetAccounts(): void {
+  lastKept = null;
+  cached = null;
+}
+
+/** One account's windows from its history, with the live reading as the newest point. */
+export function windowsFrom(samples: readonly UsageSample[], readAt: string | null, now: number): { windows: SubscriptionWindow[]; history: { t: string; pct: number }[] } {
+  const open = new Map<string, ReturnType<typeof segmentBlocks>[number]>();
+  for (const block of segmentBlocks(samples)) open.set(block.windowId, block);
+  const fresh = readAt !== null && now - Date.parse(readAt) <= STALE_AFTER_MS;
+  const windows = [...open.values()].map((block) => ({
+    id: block.windowId,
+    pct: block.finalPct,
+    resetsAt: block.resetsAt,
+    // A rate measured hours ago is not the pace now.
+    burnPctPerHour: fresh ? burnRatePctPerHour(block) : null,
+  }));
+  const session = open.get("five_hour");
+  return { windows, history: session ? thinPoints(session.points, 48) : [] };
+}
+
+export interface SubscriptionsView {
+  readonly zerosub: boolean;
+  readonly autoSwitch: boolean;
+  readonly accounts: Subscription[];
+  /** Which account each live agent runs on. */
+  readonly agents: Record<string, string>;
+}
+
+const NONE: SubscriptionsView = { zerosub: false, autoSwitch: false, accounts: [], agents: {} };
+
+export function buildView(
+  snapshot: ZeroSubSnapshot,
+  input: { recorded: readonly UsageSample[]; accountRows: readonly AccountSample[]; liveAgents: readonly { id: string; provider: string }[] },
+  now: number,
+): SubscriptionsView {
+  const agents: Record<string, string> = {};
+  const counts = new Map<string, number>();
+  for (const agent of input.liveAgents) {
+    const account = accountOf(snapshot, agent.id, agent.provider);
+    if (!account) continue;
+    agents[agent.id] = account.id;
+    counts.set(account.id, (counts.get(account.id) ?? 0) + 1);
+  }
+  const defaults = (family: "claude" | "codex") => {
+    const chosen = snapshot.defaults[family];
+    const ofFamily = snapshot.accounts.filter((a) => a.family === family);
+    return ofFamily.find((a) => a.id === chosen)?.id ?? ofFamily.find((a) => a.kind === "main")?.id ?? ofFamily[0]?.id ?? null;
+  };
+
+  const accounts = snapshot.accounts.map((account): Subscription => {
+    const reading = snapshot.readings[account.id];
+    const own = input.accountRows.filter((row) => row.accountId === account.id) as unknown as UsageSample[];
+    const live = reading ? [accountSample(account, reading, new Date(now).toISOString()) as unknown as UsageSample] : [];
+    // The CLI login's windows come from the recorder when it has them: fresher, and with history.
+    const recorded = account.id === RECORDED_ACCOUNT && input.recorded.length > 0;
+    const samples = recorded ? input.recorded : [...own, ...live];
+    const readAt = recorded ? effectiveAt(input.recorded[input.recorded.length - 1]!) : reading?.fetchedAt ?? null;
+    const { windows, history } = windowsFrom(samples, readAt, now);
+    const { name, named } = subscriptionName(account, snapshot.accounts);
+    return {
+      id: account.id,
+      family: account.family,
+      kind: account.kind,
+      name,
+      named,
+      isDefault: defaults(account.family) === account.id,
+      signedIn: account.signedIn,
+      disabled: account.disabled,
+      limitedUntil: account.limitedUntil,
+      outUntil: (() => {
+        // The guard's rule for "out", over the windows shown here.
+        const out = outUntil({ providerId: account.family, status: windows.length > 0 ? "available" : "unavailable", fetchedAt: readAt, windows: windows.map((w) => ({ id: w.id, usedPct: w.pct, remainingPct: null, resetsAt: w.resetsAt })) }, account, now);
+        return out === null ? null : new Date(out).toISOString();
+      })(),
+      createdAt: account.createdAt,
+      agents: counts.get(account.id) ?? 0,
+      readAt,
+      windows,
+      credits: reading?.credits ?? null,
+      history,
+    };
+  });
+  return { zerosub: true, autoSwitch: snapshot.autoSwitch, accounts, agents };
+}
+
+/** Several clients poll this; the answer is good for a few seconds. */
+let cached: { at: number; view: SubscriptionsView } | null = null;
+const CACHE_MS = 10_000;
+
+export async function subscriptionsView(now = Date.now()): Promise<SubscriptionsView> {
+  if (cached && now - cached.at < CACHE_MS) return cached.view;
+  const snapshot = await readZeroSub();
+  if (snapshot === null) {
+    cached = { at: now, view: NONE };
+    return NONE;
+  }
+  const since = now - HISTORY_MS;
+  const [recorded, accountRows, liveAgents] = await Promise.all([
+    readUsage({ sinceMs: since }),
+    readAccounts({ sinceMs: since }),
+    withDaemon((client) => readAgents(client)).then((rows) => rows.filter((row) => row.status !== "closed")).catch(() => []),
+  ]);
+  const view = buildView(snapshot, { recorded, accountRows, liveAgents }, now);
+  cached = { at: now, view };
+  return view;
+}
+
+/**
+ * What `budget_status` adds for an agent under ZeroSub when its provider has several
+ * subscriptions: the pool, by name. Null without ZeroSub or with one account.
+ */
+export async function budgetPool(agentId: string | undefined, now = Date.now()) {
+  const view = await subscriptionsView(now);
+  if (!view.zerosub) return null;
+  const own = agentId === undefined ? undefined : view.accounts.find((a) => a.id === view.agents[agentId]);
+  const family = own?.family ?? "claude";
+  const mine = view.accounts.filter((a) => a.family === family);
+  if (mine.length < 2) return null;
+  const pool = poolForecast(view.accounts, family, now, { autoSwitch: view.autoSwitch });
+  const name = (id: string | null) => mine.find((a) => a.id === id)?.name ?? "another account";
+  const at = (ms: number) => new Date(ms).toISOString();
+  const next = pool.takeovers[0];
+  return {
+    family,
+    accounts: pool.total,
+    withRoom: pool.withRoom,
+    pacePctPerHour: pool.pace === null ? null : Math.round(pool.pace * 10) / 10,
+    runsOutAt: pool.runsOutAt === null ? null : at(pool.runsOutAt),
+    next: next ? { name: name(next.accountId), at: at(next.at) } : null,
+    back: pool.backAt === null ? null : { name: name(pool.backAccount), at: at(pool.backAt) },
+    staleReadings: pool.stale,
+  };
+}

package/shared/guard/limit-notice.ts

@@ -0,0 +1,87 @@
+/**
+ * Whether a finished turn ended on the CLI's limit notice.
+ *
+ * Claude Code does not fail a turn at the limit: it completes it with a synthetic reply,
+ * "You've hit your 5-hour limit · resets 3pm (…)". Paseo reports that as an ordinary
+ * completed turn, so the guard's failed-turn path never sees it. ZeroSub reads the same
+ * reply to fail over (`server/limits.ts` in `@kapybara/zerosub` 1.5.0); when it finds no
+ * account with room it stops there, and nothing continues the agent after the reset
+ * unless Session Guard records a pause. These are ZeroSub's patterns, so the guard
+ * treats exactly the turns ZeroSub treats as limits as limits.
+ *
+ * Only the first line of each candidate counts, and only CLI-generated places are read:
+ * error rows, warning notifications, `[System Error]` replies and, for Claude, the
+ * final two replies. Prose earlier in a turn never matches.
+ */
+
+export interface TurnRow {
+  readonly type: string;
+  readonly text?: string;
+  readonly message?: string;
+  readonly level?: string;
+}
+
+const END = String.raw`(?=\s*(?:·|\.|$))`;
+const APOSTROPHE = "['’]";
+const CLAUDE: readonly RegExp[] = [
+  new RegExp(`^You${APOSTROPHE}ve hit your (?:5-hour |session |weekly |Opus |Sonnet |Fable )?limit${END}`, "i"),
+  new RegExp(`^You${APOSTROPHE}ve reached your (?:Fable|Opus|Sonnet|Haiku)(?: [\\w.]{1,10})? limit${END}`),
+  /Claude AI usage limit reached\|\d{9,}/,
+  new RegExp(
+    `^You${APOSTROPHE}ve hit your (?:usage limit|usage credit limit|team${APOSTROPHE}s shared budget|(?:monthly|individual) spend limit|individual usage limit|(?:org|channel)${APOSTROPHE}s monthly (?:usage|spend) limit)${END}`,
+    "i",
+  ),
+  new RegExp(`^You${APOSTROPHE}re out of (?:usage credits|extra usage)${END}`, "i"),
+  /^Your org is out of usage\s*·/i,
+];
+const CODEX: readonly RegExp[] = [
+  new RegExp(`^You${APOSTROPHE}ve hit your usage limit\\b`, "i"),
+  /^The usage limit has been reached\b/i,
+  /"type"\s*:\s*"usage_limit_reached"/,
+  /^Your workspace is out of credits\b/i,
+  /^You hit your spend cap\b/i,
+];
+
+const SYSTEM_ERROR = /^\[System Error\]\s*/;
+const MAX_NOTICE = 400;
+const clean = (text: string) => text.replace(SYSTEM_ERROR, "").replace(/^API Error:\s*/i, "").trim();
+const firstLine = (text: string) => (text.split("\n")[0] ?? text).trim();
+
+/** The limit notice a finished turn ended on, given that turn's rows oldest first; null when none. */
+export function limitNotice(provider: string, rows: readonly TurnRow[]): string | null {
+  const patterns = provider === "claude" ? CLAUDE : provider === "codex" ? CODEX : null;
+  if (!patterns) return null;
+  const found: string[] = [];
+  let replies = 0;
+  for (let index = rows.length - 1; index >= 0; index -= 1) {
+    const row = rows[index]!;
+    if (row.type === "user_message") break;
+    if (row.type === "error" && row.message) found.push(row.message);
+    else if (row.type === "notification" && row.level !== "info" && row.message) found.push(row.message);
+    else if (row.type === "assistant_message" && typeof row.text === "string") {
+      if (SYSTEM_ERROR.test(row.text) || (provider === "claude" && replies < 2)) found.push(row.text);
+      replies += 1;
+    }
+  }
+  for (const text of found.map(clean)) {
+    if (text.length === 0 || text.length > MAX_NOTICE) continue;
+    const line = firstLine(text);
+    if (patterns.some((pattern) => pattern.test(provider === "claude" ? line : text))) return line;
+  }
+  return null;
+}
+
+/**
+ * One turn's rows from a tail page of the agent's timeline, oldest first. Providers can
+ * reuse a turn id, so reading back from the turn's last row, another turn's prompt is
+ * where this one began (as ZeroSub's `turnRows`).
+ */
+export function turnRows<T extends TurnRow>(entries: readonly { item: T; turnId?: string }[], turnId: string): T[] {
+  const rows: T[] = [];
+  for (let index = entries.length - 1; index >= 0; index -= 1) {
+    const entry = entries[index]!;
+    if (entry.turnId === turnId) rows.push(entry.item);
+    else if (rows.length > 0 && entry.turnId && entry.item.type === "user_message") break;
+  }
+  return rows.reverse();
+}

package/shared/guard/zerosub.ts

@@ -30,6 +30,8 @@ export interface ZeroSubAccount {
   readonly disabled: boolean;
   readonly limitedUntil: string | null;
   readonly limitKind: "window" | "budget" | null;
+  /** When it was added; ZeroSub's last tie-break between accounts with equal room. */
+  readonly createdAt: string | null;
 }
 
 export interface ZeroSubWindow {
@@ -43,6 +45,8 @@ export interface ZeroSubReading {
   readonly fetchedAt: string;
   readonly cached: boolean;
   readonly windows: readonly ZeroSubWindow[];
+  /** Prepaid credits past full windows (ChatGPT credits for Codex), when reported. */
+  readonly credits: { readonly balance: number | null; readonly unlimited: boolean } | null;
 }
 
 export interface ZeroSubSnapshot {
@@ -54,6 +58,8 @@ export interface ZeroSubSnapshot {
   readonly readings: Readonly<Record<string, ZeroSubReading>>;
   /** ZeroSub's "Automatic switching" preference. */
   readonly autoSwitch: boolean;
+  /** The account each family opens new sessions on, when the person chose one. */
+  readonly defaults: Readonly<Record<ZeroSubFamily, string | null>>;
 }
 
 /** ZeroSub's ids for the CLI's own login (`server/state.ts` `MAIN_ACCOUNT_ID`). */
@@ -89,6 +95,7 @@ function parseAccount(value: unknown): ZeroSubAccount | null {
     disabled: raw.disabled === true,
     limitedUntil: text(raw.limitedUntil),
     limitKind: raw.limitKind === "window" || raw.limitKind === "budget" ? raw.limitKind : null,
+    createdAt: text(raw.createdAt),
   };
 }
 
@@ -104,7 +111,13 @@ function parseReading(value: unknown): ZeroSubReading | null {
     if (!window || !id || usedPct === null) continue;
     windows.push({ id, usedPct, resetsAt: text(window.resetsAt), minutes: finite(window.minutes) });
   }
-  return { fetchedAt, cached: raw.cached === true, windows };
+  const credits = record(raw.credits);
+  return {
+    fetchedAt,
+    cached: raw.cached === true,
+    windows,
+    credits: credits ? { balance: finite(credits.balance), unlimited: credits.unlimited === true } : null,
+  };
 }
 
 /**
@@ -141,7 +154,9 @@ export function parseZeroSub(state: unknown, usage: unknown, preferences: unknow
 
   // Paseo stores plugin settings as `{ version, values }`; missing means ZeroSub's default (on).
   const values = record(record(preferences)?.values);
-  return { accounts, sessions, continuedElsewhere, readings, autoSwitch: values?.autoSwitch !== false };
+  const chosen = record(raw.defaults);
+  const defaults = { claude: text(chosen?.claude), codex: text(chosen?.codex) };
+  return { accounts, sessions, continuedElsewhere, readings, autoSwitch: values?.autoSwitch !== false, defaults };
 }
 
 /** The ZeroSub family a Paseo provider belongs to, if ZeroSub manages it. */
@@ -174,22 +189,63 @@ const limited = (account: ZeroSubAccount, now: number) => {
 
 /**
  * One account's usage as a provider row the guard reads, or an unavailable row when
- * there is no trustworthy reading. A limit the CLI reported is the freshest word on a
- * window, so it shows as full until it lifts.
+ * there is no trustworthy reading. Whether the account is out is `withOut`'s job.
  */
-export function accountUsage(snapshot: ZeroSubSnapshot, account: ZeroSubAccount, now: number): ProviderUsage {
+export function accountUsage(snapshot: ZeroSubSnapshot, account: ZeroSubAccount): ProviderUsage {
   const reading = snapshot.readings[account.id];
   if (!reading || reading.windows.length === 0) return { providerId: account.family, status: "unavailable", fetchedAt: null, windows: [] };
-  const full = limited(account, now) && account.limitKind === "window";
   const windows: UsageWindow[] = reading.windows.map((window) => ({
     id: paseoWindowId(account.family, window),
-    usedPct: full ? Math.max(100, window.usedPct) : window.usedPct,
+    usedPct: window.usedPct,
     remainingPct: null,
     resetsAt: window.resetsAt,
   }));
   return { providerId: account.family, status: "available", fetchedAt: reading.fetchedAt, windows };
 }
 
+const pctOf = (window: UsageWindow): number | null =>
+  typeof window.usedPct === "number" ? window.usedPct : typeof window.remainingPct === "number" ? 100 - window.remainingPct : null;
+
+/**
+ * When an account is out, the time it gets room again (ms); null while it has room.
+ *
+ * Out means ZeroSub recorded a limit on it (the CLI's notice, or a full reading), or a
+ * window it reads that has not rolled over yet is full. That includes the weekly
+ * window: the session window the guard watches can show room while the account is
+ * out for days. A recorded budget limit counts too: the account takes no turn.
+ */
+export function outUntil(row: ProviderUsage, account: ZeroSubAccount, now: number): number | null {
+  const ends: number[] = [];
+  const until = time(account.limitedUntil);
+  if (until !== null && until > now) ends.push(until);
+  for (const window of row.status === "available" ? row.windows : []) {
+    const resets = time(window.resetsAt);
+    if (resets !== null && resets <= now) continue; // Rolled over since that reading.
+    if ((pctOf(window) ?? 0) >= 100) ends.push(resets ?? now);
+  }
+  return ends.length ? Math.max(...ends) : null;
+}
+
+/**
+ * An out account's row, with the guard's session windows shown full until it gets room
+ * again. The guard pauses and anchors on its session window alone, so this is how an
+ * account out on another window, or at a limit no reading shows yet, reads as out; the
+ * anchor is when the account as a whole has room again.
+ */
+function withOut(row: ProviderUsage, account: ZeroSubAccount, now: number, sessionWindowIds: readonly string[]): ProviderUsage {
+  const until = outUntil(row, account, now);
+  if (until === null || row.status !== "available") return row;
+  let changed = false;
+  const windows = row.windows.map((window) => {
+    const resets = time(window.resetsAt);
+    // Already full until the account has room again: the reading says so itself.
+    if (!sessionWindowIds.includes(window.id) || ((pctOf(window) ?? 0) >= 100 && resets !== null && resets >= until)) return window;
+    changed = true;
+    return { ...window, usedPct: Math.max(100, pctOf(window) ?? 100), remainingPct: null, resetsAt: new Date(Math.max(until, resets ?? 0)).toISOString() };
+  });
+  return changed ? { ...row, windows } : row;
+}
+
 /**
  * Whether an account could take an agent right now: usable by ZeroSub's own rules
  * (signed in, not set aside, no recorded limit) and, stricter than ZeroSub, with a
@@ -214,12 +270,32 @@ export function accountsWithRoom(snapshot: ZeroSubSnapshot, current: ZeroSubAcco
     account.family === current.family && account.id !== current.id && hasRoom(snapshot, account, thresholdPct, sessionWindowIds, now)).length;
 }
 
+/**
+ * Whether ZeroSub would move the agent to another account at the limit, by ZeroSub's
+ * own rule (`isUsable` in its routing): automatic switching on and another account of
+ * the provider signed in, not set aside and with no recorded limit. Looser than
+ * `hasRoom`, deliberately: once the CLI has reported the limit it is ZeroSub that
+ * decides, and this is what it decides with.
+ */
+export function switchesAtLimit(snapshot: ZeroSubSnapshot, current: ZeroSubAccount, now: number): boolean {
+  return snapshot.autoSwitch && snapshot.accounts.some((account) =>
+    account.family === current.family && account.id !== current.id && account.signedIn && !account.disabled && !limited(account, now));
+}
+
 /** The view Session Guard's engine asks, once per pass. */
 export interface AccountView {
-  /** Usage as the agent's own account sees it. */
+  /** Usage as the agent's own account sees it, with an out account's session windows shown full. */
   usageFor(agentId: string, provider: string): Usage;
   /** ZeroSub will move this agent to another account with room when its account hits the limit. */
   failsOver(agentId: string, provider: string): boolean;
+  /** After the CLI reported the limit: ZeroSub is moving this agent to another account itself. */
+  switchesAtLimit(agentId: string, provider: string): boolean;
+  /**
+   * Whether an account this agent can use has room, shown by a reading taken after
+   * `since` (a pause): its own account, or — when ZeroSub would fail it over there —
+   * another one. Null while every account is still out.
+   */
+  roomSince(agentId: string, provider: string, since: number): "own" | "elsewhere" | null;
   /** ZeroSub already carries this agent's Codex task on in another tab. */
   continuedElsewhere(agentId: string): boolean;
 }
@@ -230,19 +306,40 @@ export function accountView(
   policy: { thresholdPct: number; windowIds: readonly string[] },
   now: number,
 ): AccountView {
+  const roomAfter = (account: ZeroSubAccount, since: number) => {
+    const fetched = time(snapshot.readings[account.id]?.fetchedAt);
+    return fetched !== null && fetched > since && hasRoom(snapshot, account, policy.thresholdPct, policy.windowIds, now);
+  };
   return {
     usageFor(agentId, provider) {
       const account = accountOf(snapshot, agentId, provider);
-      // The CLI login is what Paseo and the recorder already measure, and measure more often.
-      if (!account || account.kind === "main") return usage;
-      const own = accountUsage(snapshot, account, now);
-      return { ...usage, providers: [...usage.providers.filter((p) => p.providerId !== provider), { ...own, providerId: provider }] };
+      if (!account) return usage;
+      // The CLI login is what Paseo and the recorder already measure, and measure more
+      // often; ZeroSub only adds a limit it recorded on it.
+      const own = account.kind === "main"
+        ? usage.providers.find((p) => p.providerId === provider)
+        : { ...accountUsage(snapshot, account), providerId: provider };
+      if (!own) return usage;
+      const shown = withOut(own, account, now, policy.windowIds);
+      if (shown === own && account.kind === "main") return usage;
+      return { ...usage, providers: [...usage.providers.filter((p) => p.providerId !== provider), shown] };
     },
     failsOver(agentId, provider) {
       if (!snapshot.autoSwitch) return false;
       const account = accountOf(snapshot, agentId, provider);
       return account !== null && accountsWithRoom(snapshot, account, policy.thresholdPct, policy.windowIds, now) > 0;
     },
+    switchesAtLimit(agentId, provider) {
+      const account = accountOf(snapshot, agentId, provider);
+      return account !== null && switchesAtLimit(snapshot, account, now);
+    },
+    roomSince(agentId, provider, since) {
+      const account = accountOf(snapshot, agentId, provider);
+      if (!account) return null;
+      if (roomAfter(account, since)) return "own";
+      if (!snapshot.autoSwitch) return null;
+      return snapshot.accounts.some((other) => other.family === account.family && other.id !== account.id && roomAfter(other, since)) ? "elsewhere" : null;
+    },
     continuedElsewhere: (agentId) => snapshot.continuedElsewhere.has(agentId),
   };
 }

package/shared/smart-session.ts

@@ -66,6 +66,27 @@ export const budgetStatus = defineRpc({
         readAt: z.string().nullable(),
       })
       .optional(),
+    /**
+     * All of the agent's provider's ZeroSub subscriptions together, when there are
+     * several: how many have room, how long they last at this pace, and which takes
+     * over next. Names only, never emails. Absent without ZeroSub.
+     */
+    pool: z
+      .object({
+        family: z.enum(["claude", "codex"]),
+        accounts: z.number(),
+        withRoom: z.number(),
+        /** The pool's pace in session-window points per hour; null when nothing is in use. */
+        pacePctPerHour: z.number().nullable(),
+        /** When no account has room at this pace; null when it lasts the forecast's day. */
+        runsOutAt: z.string().nullable(),
+        next: z.object({ name: z.string(), at: z.string() }).nullable(),
+        /** After it runs dry, the first account back. */
+        back: z.object({ name: z.string(), at: z.string() }).nullable(),
+        /** Accounts whose reading is over 30 minutes old. */
+        staleReadings: z.number(),
+      })
+      .optional(),
     /** Finished session windows from the last 14 days, oldest first. */
     past: z.array(PastWindowSchema).optional(),
     recorder: RecorderStatusSchema,
@@ -73,6 +94,51 @@ export const budgetStatus = defineRpc({
   }),
 });
 
+const SubscriptionWindowSchema = z.object({
+  id: z.string(),
+  pct: z.number(),
+  resetsAt: z.string().nullable(),
+  burnPctPerHour: z.number().nullable(),
+});
+
+/** One ZeroSub account. Names are the person's own or neutral ("CLI login", "Account 2"); never an email. */
+export const SubscriptionSchema = z.object({
+  id: z.string(),
+  family: z.enum(["claude", "codex"]),
+  kind: z.enum(["main", "managed"]),
+  name: z.string(),
+  named: z.boolean(),
+  isDefault: z.boolean(),
+  signedIn: z.boolean(),
+  disabled: z.boolean(),
+  limitedUntil: z.string().nullable(),
+  /** When the account has room again (the guard's own rule); null while it has room. */
+  outUntil: z.string().nullable().optional(),
+  createdAt: z.string().nullable(),
+  agents: z.number(),
+  readAt: z.string().nullable(),
+  windows: z.array(SubscriptionWindowSchema),
+  credits: z.object({ balance: z.number().nullable(), unlimited: z.boolean() }).nullable(),
+  history: z.array(z.object({ t: z.string(), pct: z.number() })).optional(),
+});
+
+/**
+ * Every ZeroSub subscription on this host, with its windows and pace. `zerosub` is
+ * false (and the lists empty) when ZeroSub is not enabled: then nothing changes.
+ */
+export const subscriptionsStatus = defineRpc({
+  name: "smart-session.subscriptions",
+  input: z.object({}),
+  output: z.object({
+    zerosub: z.boolean(),
+    autoSwitch: z.boolean(),
+    accounts: z.array(SubscriptionSchema),
+    /** Which account each live session runs on, by agent id. */
+    agents: z.record(z.string(), z.string()),
+    error: z.string().nullable(),
+  }),
+});
+
 export const ContextStatusSchema = z.object({
   agentId: z.string(),
   title: z.string().nullable(),