feat: background quota refresh for idle accounts

[iceteaSA]

Stacked on #8 — the diff below includes #8's commits until it merges, at which point this narrows to the three commits a18055c, 91e6e4a, 9aa16ec. Review #8 first.

Why

Antigravity responses carry no quota headers — I dumped every response header on a live streamGenerateContent and there is nothing like x-codex-* or anthropic-ratelimit-* to piggyback on. Quota is poll-only, and today it is only polled when a request finds a stale cache or when someone opens /antigravity-quota. An account you are not actively using therefore shows bars from whenever you last used it, indefinitely.

This adds a 5-minute jittered background refresh so idle accounts stay current.

Design

Three layers, in order:

Freshness gate — read the sidebar's checkedAt and skip if it is younger than max(intervalMs − 60s, intervalMs / 2). This is the only hard cross-process bound: N opencode processes on one machine converge on roughly one poll per interval regardless of the lock. The /2 floor matters at the 1-minute minimum interval, where the naive interval − 60s collapses to zero and disables dedup entirely.

Fenced lock — acquireFencedFileLock, held elsewhere means skip. An optimization, not the correctness mechanism.

Lock throws → fail closed. Skip the tick, jitter the next. There is deliberately no fallback mutex: a fallback for "the lock failed" is a second, worse lock, and it cannot be made single-winner without a fencing token — which is what acquireFencedFileLock already is. An earlier attempt at this feature hardened exactly such a marker through three review rounds before the design was cut; the invariant comment in the module says so, to stop the next reader re-deriving it.

The poll reuses the existing path end to end — getAccountsForQuotaCheck → quotaManager.refreshAccounts → updateQuotaCache (identity stamps intact) → one pushSidebarQuotaSnapshot per tick, after the cache update. No new fetch or write surface, and per-window data lands exactly as it does through the modal.

One instance per plugin, unref()'d timer, async dispose() that awaits the in-flight tick, registered in the producer phase so it stops before the sidebar drain.

Config

{
  "background_quota_refresh": true,              // default on
  "background_quota_refresh_interval_minutes": 5 // 1–60
}

The e2e harness disables it in quick mode so tests stay deterministic.

Verification

18 tests in the module, including the ones that would otherwise be theatre:

• The fail-closed test throws the lock for real, via a NUL byte in the lock path — the kernel rejects the mkdir, acquireFencedFileLock throws, and the tick skips. A second poller on a valid path proves the timer survives.
• The wiring tests fail when the lifecycle.register(...) line is removed. Verified by removing it.
• The re-entry guard test fails when the guard is commented out. Verified by commenting it out.

Live, on an idle host: checkedAt climbed to 3.9 minutes, reset on its own, climbed again — one autonomous refresh 4.3 minutes after the previous, no request sent and no dialog opened, with windows intact in the written snapshot.

unit           1909 pass, 0 fail
e2e            42 pass, 0 fail, zero leaked temp roots
typecheck      clean
format + lint  clean, 0 warnings
smoke          packed-tarball TUI install resolves

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Adds a jittered background quota refresh for idle accounts and migrates quota to a windowed two‑pool model (gemini / non‑gemini) with per‑window UI. Also wires the account‑dialog OAuth flow end to end with immediate runtime reload and quota safety via identity stamps.

• New Features

  • Background quota refresh with freshness gate + fenced lock; one sidebar snapshot per tick; configurable via background_quota_refresh and background_quota_refresh_interval_minutes.
  • Windowed quota via retrieveUserQuotaSummary (weekly/5h): derive most‑constrained per‑pool remaining/reset; tolerant bucket parsing; endpoint failover; parallel RUQS+CLI fetches; honor managedProjectId 403 gate with fallback to projectId.
  • Two‑pool schema (gemini / non‑gemini) across core, CLI, plugin, and TUI: normalize legacy keys; gemini-claude-* and gpt-oss* map to non‑gemini; tab_* and all Gemini IDs map to gemini; TUI renders per‑window rows and shows both pools in the collapsed row; publish captured plan tier {id, paidId?, capturedAt}.
  • Account dialog OAuth: URL → code → optional label; atomic pending consumption; persists and reloads the live runtime; refreshes sidebar on open; clearer error messages.

• Bug Fixes

  • Quota correctness: writes keyed by refresh token with expectedRefreshToken guard; cachedQuotaAccountId stamp persisted and checked; mismatched stamps drop cached quota to prevent cross‑account attribution.
  • Loader/runtime and UI: fetch delegates to the live runtime; serialized reloads; CLI transport errors surfaced; closeDebugLog() flushes logs deterministically; preserve reset times and per‑family active indices/cooldowns through removals; publish real active‑account flag + health.
  • Back‑compat and resilience: normalize legacy quota keys for soft‑quota/rotation; tolerant RUQS parsing and modelCount; endpoint failover on 5xx/429; project managedProjectId sourced from the stored account record.

^{Written for commit 5fddd9e. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 51 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[iceteaSA]

All 14 addressed in 9aa16ec..f020a3c. The two that turned out to be real bugs rather than polish:

The poller defeated the stale-quota guard. It wrote cachedQuotaAccountId into both identity fields on every snapshot, so redactAccountForSidebar's cachedQuotaAccountId !== currentQuotaAccountId comparison could never be true. The guard exists to stop one account's quota rendering on another after a reorder, and for poller-written snapshots it was structurally dead. Now derived from the live refresh token, matching the two correct call sites.

Transport failures were being reported as "no CLI quota available." Chasing the CLI-error finding turned up a blank catch {} per endpoint inside fetchGeminiCliQuota, so socket hangs, DNS failures and timeouts all surfaced as a permanent-looking "not configured" status. It now collects per-endpoint errors and throws when every endpoint fails a transport-level attempt; a 403 still returns empty buckets, because that one is authoritative. The single caller already had a .catch(), and a CLI failure still doesn't discard the summary result.

Also fixed: the legacy-key blank (pre-upgrade cachedQuota keys weren't just invisible — killswitch and soft-quota read the same map, so a configured threshold sat inert until the first refresh; now normalized at read time, with the writer emitting canonical keys); per-window rows surviving an apply; the managed-project fallback firing only on 403; the poller using the injected transport; a runTick throw no longer stopping polling for the process lifetime; collapsed-row tone from the worst pool; resolveNextIndex using the storage-snapshot position; guarded listAccounts() on OAuth failure paths; and a resetTime merge that dropped the earlier reset when the first pool won.

Refresh-on-open now respects backoff (the explicit Refresh button keeps forcing, deliberately).

Worth flagging on the tests: four of the first-round fixes shipped with tests that passed when their fix was reverted, including an e2e that passed with the poller disabled. Those are rewritten, and every new or modified test in this range was reverse-verified — revert the fix, confirm RED, restore. 1924 unit / 43 e2e.

[cubic-dev-ai]

All reported issues were addressed across 20 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 5 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 10 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 16 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 9 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>