@andorra-labs/code 0.0.0-stage → 0.1.5

package/dist/vendor/engine/runtime/ai/utils/overflow.d.ts

@@ -0,0 +1,68 @@
+import type { AssistantMessage } from "../types.js";
+/**
+ * Check if an assistant message represents a context overflow error.
+ *
+ * This handles three cases:
+ * 1. Error-based overflow: Most providers return stopReason "error" with a
+ *    specific error message pattern.
+ * 2. Silent overflow: Some providers accept overflow requests and return
+ *    successfully. For these, we check if usage.input exceeds the context window.
+ * 3. Length-stop overflow: Xiaomi MiMo can return "length" with zero output when
+ *    the input fills the context window.
+ *
+ * ## Reliability by Provider
+ *
+ * **Reliable detection (returns error with detectable message):**
+ * - Anthropic: "prompt is too long: X tokens > Y maximum" or "request_too_large"
+ * - OpenAI (Completions & Responses): "exceeds the context window", "exceeds the model's maximum context length of X tokens", or "exceeds model's maximum context length (X)"
+ * - Google Gemini: "input token count exceeds the maximum"
+ * - xAI (Grok): "maximum prompt length is X but request contains Y"
+ * - Groq: "reduce the length of the messages"
+ * - Cerebras: 400/413 status code (no body)
+ * - Mistral: "Prompt contains X tokens ... too large for model with Y maximum context length"
+ * - OpenRouter (most backends): "maximum context length is X tokens"
+ * - OpenRouter/Poolside: "Input length X exceeds the maximum allowed input length of Y tokens."
+ * - Together AI: "The input (X tokens) is longer than the model's context length (Y tokens)."
+ * - llama.cpp: "exceeds the available context size"
+ * - LM Studio: "greater than the context length"
+ * - Kimi For Coding: "exceeded model token limit: X (requested: Y)"
+ * - DS4: "Prompt has X tokens, but the configured context size is Y tokens"
+ * - DashScope/Qwen: "Range of input length should be [1, X]"
+ * - z.ai: "Prompt too long"
+ *
+ * **Unreliable detection:**
+ * - z.ai: Sometimes accepts overflow silently (detectable via usage.input > contextWindow),
+ *   sometimes returns rate limit errors. Pass contextWindow param to detect silent overflow.
+ * - Xiaomi MiMo: Truncates input to fit contextWindow then returns stopReason "length" with
+ *   output=0. Pass contextWindow param to detect via the "filled context + zero output" signal.
+ * - Ollama: May truncate input silently for some setups, but may also return explicit
+ *   overflow errors that match the patterns above. Silent truncation still cannot be
+ *   detected here because we do not know the expected token count.
+ *
+ * ## Custom Providers
+ *
+ * If you've added custom models via settings.json, this function may not detect
+ * overflow errors from those providers. To add support:
+ *
+ * 1. Send a request that exceeds the model's context window
+ * 2. Check the errorMessage in the response
+ * 3. Create a regex pattern that matches the error
+ * 4. The pattern should be added to OVERFLOW_PATTERNS in this file, or
+ *    check the errorMessage yourself before calling this function
+ *
+ * @param message - The assistant message to check
+ * @param contextWindow - Optional context window size for detecting silent overflow (z.ai)
+ * @returns true if the message indicates a context overflow
+ */
+export declare function andorraIsContextOverflow(message: AssistantMessage, contextWindow?: number): boolean;
+/**
+ * Check whether a length stop ended below the caller or model's intended output limit.
+ * Such responses may be caused by context pressure or provider-side truncation, so callers
+ * can make one bounded compact-and-retry attempt. `desiredMaxOutput` must be the original
+ * limit before any context-based clamping.
+ */
+export declare function andorraIsRecoverableLength(message: AssistantMessage, desiredMaxOutput: number): boolean;
+/**
+ * Get the overflow patterns for testing purposes.
+ */
+export declare function andorraGetOverflowPatterns(): RegExp[];

package/dist/vendor/engine/runtime/ai/utils/overflow.js

@@ -0,0 +1,177 @@
+/**
+ * Regex patterns to detect context overflow errors from different providers.
+ *
+ * These patterns match error messages returned when the input exceeds
+ * the model's context window.
+ *
+ * Provider-specific patterns (with example error messages):
+ *
+ * - Anthropic: "prompt is too long: 213462 tokens > 200000 maximum"
+ * - Anthropic: "413 {\"error\":{\"type\":\"request_too_large\",\"message\":\"Request exceeds the maximum size\"}}"
+ * - OpenAI: "Your input exceeds the context window of this model"
+ * - OpenAI/LiteLLM: "Requested token count exceeds the model's maximum context length of 131072 tokens"
+ * - OpenAI-compatible: "Input length (265330) exceeds model's maximum context length (262144)."
+ * - Google: "The input token count (1196265) exceeds the maximum number of tokens allowed (1048575)"
+ * - xAI: "This model's maximum prompt length is 131072 but the request contains 537812 tokens"
+ * - Groq: "Please reduce the length of the messages or completion"
+ * - OpenRouter: "This endpoint's maximum context length is X tokens. However, you requested about Y tokens"
+ * - OpenRouter/Poolside: "Input length X exceeds the maximum allowed input length of Y tokens."
+ * - Together AI: "The input (X tokens) is longer than the model's context length (Y tokens)."
+ * - llama.cpp: "the request exceeds the available context size, try increasing it"
+ * - LM Studio: "tokens to keep from the initial prompt is greater than the context length"
+ * - GitHub Copilot: "prompt token count of X exceeds the limit of Y"
+ * - MiniMax: "invalid params, context window exceeds limit"
+ * - Kimi For Coding: "Your request exceeded model token limit: X (requested: Y)"
+ * - DS4: "Prompt has X tokens, but the configured context size is Y tokens"
+ * - Cerebras: "400/413 status code (no body)"
+ * - Mistral: "Prompt contains X tokens ... too large for model with Y maximum context length"
+ * - z.ai: `{"code":"1261","message":"Prompt too long"}` or silent overflow via usage.input > contextWindow
+ * - Xiaomi MiMo: Truncates input to fill contextWindow exactly, then returns finish_reason "length"
+ *   with output=0 (no room left to generate). Detected via stopReason "length" + zero output +
+ *   input filling the context window.
+ * - DashScope/Qwen: "Range of input length should be [1, X]" (HTTP 400 invalid_parameter_error)
+ * - Ollama: Some deployments truncate silently, others return errors like "prompt too long; exceeded max context length by X tokens"
+ */
+const OVERFLOW_PATTERNS = [
+    /prompt (?:is )?too long/i, // Anthropic and z.ai token overflow
+    /request_too_large/i, // Anthropic request byte-size overflow (HTTP 413)
+    /input is too long for requested model/i, // Amazon Bedrock
+    /exceeds the context window/i, // OpenAI (Completions & Responses API)
+    /exceeds (?:the )?(?:model'?s )?maximum context length(?: of [\d,]+ tokens?|\s*\([\d,]+\))/i, // OpenAI-compatible proxies (LiteLLM)
+    /input token count.*exceeds the maximum/i, // Google (Gemini)
+    /maximum prompt length is \d+/i, // xAI (Grok)
+    /reduce the length of the messages/i, // Groq
+    /maximum context length is \d+ tokens/i, // OpenRouter (most backends)
+    /exceeds (?:the )?maximum allowed input length of [\d,]+ tokens?/i, // OpenRouter/Poolside
+    /input \(\d+ tokens\) is longer than the model'?s context length \(\d+ tokens\)/i, // Together AI
+    /exceeds the limit of \d+/i, // GitHub Copilot
+    /exceeds the available context size/i, // llama.cpp server
+    /greater than the context length/i, // LM Studio
+    /context window exceeds limit/i, // MiniMax
+    /exceeded model token limit/i, // Kimi For Coding
+    /too large for model with \d+ maximum context length/i, // Mistral
+    /prompt has [\d,]+ tokens?, but the configured context size is [\d,]+ tokens?/i, // DS4 server
+    /model_context_window_exceeded/i, // z.ai non-standard finish_reason surfaced as error text
+    /prompt too long; exceeded (?:max )?context length/i, // Ollama explicit overflow error
+    /range of input length should be/i, // DashScope / Qwen Token Plan
+    /context[_ ]length[_ ]exceeded/i, // Generic fallback
+    /too many tokens/i, // Generic fallback
+    /token limit exceeded/i, // Generic fallback
+];
+const CEREBRAS_BODYLESS_OVERFLOW_PATTERN = /^4(?:00|13)\s*(?:status code)?\s*\(no body\)/i;
+/**
+ * Patterns that indicate non-overflow errors (e.g. rate limiting, server errors).
+ * Error messages matching any of these are excluded from overflow detection
+ * even if they also match an OVERFLOW_PATTERN.
+ *
+ * Example: Bedrock formats throttling errors as "ThrottlingException: Too many tokens,
+ * please wait before trying again." which would match the /too many tokens/i overflow
+ * pattern without this exclusion.
+ */
+const NON_OVERFLOW_PATTERNS = [
+    /^(Throttling error|Service unavailable):/i, // AWS Bedrock non-overflow errors (human-readable prefixes from formatBedrockError)
+    /rate limit/i, // Generic rate limiting
+    /too many requests/i, // Generic HTTP 429 style
+];
+/**
+ * Check if an assistant message represents a context overflow error.
+ *
+ * This handles three cases:
+ * 1. Error-based overflow: Most providers return stopReason "error" with a
+ *    specific error message pattern.
+ * 2. Silent overflow: Some providers accept overflow requests and return
+ *    successfully. For these, we check if usage.input exceeds the context window.
+ * 3. Length-stop overflow: Xiaomi MiMo can return "length" with zero output when
+ *    the input fills the context window.
+ *
+ * ## Reliability by Provider
+ *
+ * **Reliable detection (returns error with detectable message):**
+ * - Anthropic: "prompt is too long: X tokens > Y maximum" or "request_too_large"
+ * - OpenAI (Completions & Responses): "exceeds the context window", "exceeds the model's maximum context length of X tokens", or "exceeds model's maximum context length (X)"
+ * - Google Gemini: "input token count exceeds the maximum"
+ * - xAI (Grok): "maximum prompt length is X but request contains Y"
+ * - Groq: "reduce the length of the messages"
+ * - Cerebras: 400/413 status code (no body)
+ * - Mistral: "Prompt contains X tokens ... too large for model with Y maximum context length"
+ * - OpenRouter (most backends): "maximum context length is X tokens"
+ * - OpenRouter/Poolside: "Input length X exceeds the maximum allowed input length of Y tokens."
+ * - Together AI: "The input (X tokens) is longer than the model's context length (Y tokens)."
+ * - llama.cpp: "exceeds the available context size"
+ * - LM Studio: "greater than the context length"
+ * - Kimi For Coding: "exceeded model token limit: X (requested: Y)"
+ * - DS4: "Prompt has X tokens, but the configured context size is Y tokens"
+ * - DashScope/Qwen: "Range of input length should be [1, X]"
+ * - z.ai: "Prompt too long"
+ *
+ * **Unreliable detection:**
+ * - z.ai: Sometimes accepts overflow silently (detectable via usage.input > contextWindow),
+ *   sometimes returns rate limit errors. Pass contextWindow param to detect silent overflow.
+ * - Xiaomi MiMo: Truncates input to fit contextWindow then returns stopReason "length" with
+ *   output=0. Pass contextWindow param to detect via the "filled context + zero output" signal.
+ * - Ollama: May truncate input silently for some setups, but may also return explicit
+ *   overflow errors that match the patterns above. Silent truncation still cannot be
+ *   detected here because we do not know the expected token count.
+ *
+ * ## Custom Providers
+ *
+ * If you've added custom models via settings.json, this function may not detect
+ * overflow errors from those providers. To add support:
+ *
+ * 1. Send a request that exceeds the model's context window
+ * 2. Check the errorMessage in the response
+ * 3. Create a regex pattern that matches the error
+ * 4. The pattern should be added to OVERFLOW_PATTERNS in this file, or
+ *    check the errorMessage yourself before calling this function
+ *
+ * @param message - The assistant message to check
+ * @param contextWindow - Optional context window size for detecting silent overflow (z.ai)
+ * @returns true if the message indicates a context overflow
+ */
+export function andorraIsContextOverflow(message, contextWindow) {
+    // Case 1: Check error message patterns
+    if (message.stopReason === "error" && message.errorMessage) {
+        // Skip messages matching known non-overflow patterns (e.g. throttling / rate-limit)
+        const isNonOverflow = NON_OVERFLOW_PATTERNS.some((p) => p.test(message.errorMessage));
+        if (!isNonOverflow) {
+            if (OVERFLOW_PATTERNS.some((p) => p.test(message.errorMessage))) {
+                return true;
+            }
+            if (message.provider === "cerebras" && CEREBRAS_BODYLESS_OVERFLOW_PATTERN.test(message.errorMessage)) {
+                return true;
+            }
+        }
+    }
+    // Case 2: Silent overflow (z.ai style) - successful but usage exceeds context
+    if (contextWindow && message.stopReason === "stop") {
+        const inputTokens = message.usage.input + message.usage.cacheRead;
+        if (inputTokens > contextWindow) {
+            return true;
+        }
+    }
+    // Case 3: Length-stop overflow (Xiaomi MiMo style) - server truncates oversized input
+    // to fit the context window, leaving no room for output. Returns stopReason "length"
+    // with output=0 and input+cacheRead filling the context window.
+    if (contextWindow && message.stopReason === "length" && message.usage.output === 0) {
+        const inputTokens = message.usage.input + message.usage.cacheRead;
+        if (inputTokens >= contextWindow * 0.99) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Check whether a length stop ended below the caller or model's intended output limit.
+ * Such responses may be caused by context pressure or provider-side truncation, so callers
+ * can make one bounded compact-and-retry attempt. `desiredMaxOutput` must be the original
+ * limit before any context-based clamping.
+ */
+export function andorraIsRecoverableLength(message, desiredMaxOutput) {
+    return message.stopReason === "length" && desiredMaxOutput > 0 && message.usage.output < desiredMaxOutput;
+}
+/**
+ * Get the overflow patterns for testing purposes.
+ */
+export function andorraGetOverflowPatterns() {
+    return [...OVERFLOW_PATTERNS];
+}

package/dist/vendor/engine/runtime/ai/utils/pi-user-agent.d.ts

@@ -0,0 +1 @@
+export declare function andorraGetAndorraUserAgent(): string;

package/dist/vendor/engine/runtime/ai/utils/pi-user-agent.js

@@ -0,0 +1,11 @@
+function andorraLoadNodeOs() {
+    if (typeof process === "undefined" || !(process.versions?.node || process.versions?.bun)) {
+        return null;
+    }
+    return process.getBuiltinModule?.("node:os") ?? null;
+}
+// Keep runtime OS loading browser-safe. A top-level runtime import of node:os breaks browser/Vite builds.
+const nodeOs = andorraLoadNodeOs();
+export function andorraGetAndorraUserAgent() {
+    return nodeOs ? `pi (${nodeOs.platform()} ${nodeOs.release()}; ${nodeOs.arch()})` : "pi (browser)";
+}

package/dist/vendor/engine/runtime/ai/utils/provider-env.d.ts

@@ -0,0 +1,6 @@
+import type { ProviderEnv } from "../types.js";
+/**
+ * Resolve a provider env value from scoped overrides, normal process.env, then
+ * the duplicated Bun sandbox fallback for direct pi-ai consumers.
+ */
+export declare function andorraGetProviderEnvValue(name: string, env?: ProviderEnv): string | undefined;

package/dist/vendor/engine/runtime/ai/utils/provider-env.js

@@ -0,0 +1,43 @@
+let procEnvCache = null;
+/**
+ * Fallback for https://github.com/oven-sh/bun/issues/27802.
+ * Bun compiled binaries can expose an empty process.env inside Linux sandboxes
+ * even though /proc/self/environ contains the environment.
+ *
+ * This intentionally duplicates restoreSandboxEnv() in
+ * packages/coding-agent/src/bun/restore-sandbox-env.ts. The ai package can be
+ * used directly, without going through that entrypoint, so provider env lookup
+ * must not depend on process.env having been patched.
+ */
+function andorraGetBunSandboxEnvValue(name) {
+    if (typeof process === "undefined" || !process.versions?.bun || Object.keys(process.env).length > 0) {
+        return undefined;
+    }
+    if (procEnvCache === null) {
+        procEnvCache = new Map();
+        try {
+            const { readFileSync } = require("node:fs");
+            const data = readFileSync("/proc/self/environ", "utf-8");
+            for (const entry of data.split("\0")) {
+                const idx = entry.indexOf("=");
+                if (idx > 0) {
+                    procEnvCache.set(entry.slice(0, idx), entry.slice(idx + 1));
+                }
+            }
+        }
+        catch {
+            // /proc/self/environ may not exist or may not be readable.
+        }
+    }
+    return procEnvCache.get(name);
+}
+/**
+ * Resolve a provider env value from scoped overrides, normal process.env, then
+ * the duplicated Bun sandbox fallback for direct pi-ai consumers.
+ */
+export function andorraGetProviderEnvValue(name, env) {
+    return (env?.[name] ||
+        (typeof process !== "undefined" ? process.env[name] : undefined) ||
+        andorraGetBunSandboxEnvValue(name) ||
+        undefined);
+}

package/dist/vendor/engine/runtime/ai/utils/provider-retry.d.ts

@@ -0,0 +1,15 @@
+interface ProviderRetryOptions {
+    maxRetries?: number;
+    maxRetryDelayMs?: number;
+    signal?: AbortSignal;
+}
+/**
+ * Reproduce the retry behavior used by the OpenAI and Anthropic SDKs while making
+ * their backoff sleep interruptible. Their built-in retry timers ignore the
+ * request AbortSignal, so callers must invoke the SDK with `maxRetries: 0` and
+ * wrap the request with this helper. Provider-requested delays above
+ * `maxRetryDelayMs` fail immediately (60 seconds by default); set it to zero to
+ * disable the limit.
+ */
+export declare function andorraRetryProviderRequest<T>(request: () => Promise<T>, options?: ProviderRetryOptions): Promise<T>;
+export {};

package/dist/vendor/engine/runtime/ai/utils/provider-retry.js

@@ -0,0 +1,93 @@
+const DEFAULT_MAX_RETRY_DELAY_MS = 60_000;
+function andorraIsProviderError(error) {
+    if (!(error instanceof Error) || !("status" in error) || !("headers" in error))
+        return false;
+    return ((error.status === undefined || typeof error.status === "number") &&
+        (error.headers === undefined || error.headers instanceof Headers));
+}
+/** Mirrors the pinned OpenAI/Anthropic SDK retry policy; review when either SDK is upgraded. */
+function andorraIsRetryableProviderError(error) {
+    const shouldRetry = error.headers?.get("x-should-retry");
+    if (shouldRetry === "true")
+        return true;
+    if (shouldRetry === "false")
+        return false;
+    if (error.status === undefined)
+        return true;
+    return (error.status === 408 ||
+        error.status === 409 ||
+        error.status === 429 ||
+        (typeof error.status === "number" && error.status >= 500));
+}
+function andorraValidateServerRetryDelayMs(delayMs, maxRetryDelayMs, providerErrorMessage) {
+    const maxDelayMs = maxRetryDelayMs ?? DEFAULT_MAX_RETRY_DELAY_MS;
+    if (maxDelayMs > 0 && delayMs > maxDelayMs) {
+        throw new Error(`Server requested ${Math.ceil(delayMs / 1000)}s retry delay (max: ${Math.ceil(maxDelayMs / 1000)}s). ${providerErrorMessage}`);
+    }
+    return delayMs;
+}
+function andorraGetRetryDelayMs(error, retryIndex, maxRetryDelayMs) {
+    const retryAfterMs = error.headers?.get("retry-after-ms");
+    if (retryAfterMs) {
+        const value = Number.parseFloat(retryAfterMs);
+        if (!Number.isNaN(value))
+            return andorraValidateServerRetryDelayMs(value, maxRetryDelayMs, error.message);
+    }
+    const retryAfter = error.headers?.get("retry-after");
+    if (retryAfter) {
+        const seconds = Number.parseFloat(retryAfter);
+        const delayMs = Number.isNaN(seconds) ? Date.parse(retryAfter) - Date.now() : seconds * 1000;
+        return andorraValidateServerRetryDelayMs(delayMs, maxRetryDelayMs, error.message);
+    }
+    const exponentialDelay = Math.min(0.5 * 2 ** retryIndex, 8) * 1000;
+    return exponentialDelay * (1 - Math.random() * 0.25);
+}
+function andorraCreateAbortError() {
+    const error = new Error("Request aborted");
+    error.name = "AbortError";
+    return error;
+}
+function andorraAbortableSleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(andorraCreateAbortError());
+            return;
+        }
+        const andorraOnAbort = () => {
+            clearTimeout(timeout);
+            reject(andorraCreateAbortError());
+        };
+        const timeout = setTimeout(() => {
+            signal?.removeEventListener("abort", andorraOnAbort);
+            resolve();
+        }, Math.max(0, ms));
+        signal?.addEventListener("abort", andorraOnAbort, { once: true });
+    });
+}
+/**
+ * Reproduce the retry behavior used by the OpenAI and Anthropic SDKs while making
+ * their backoff sleep interruptible. Their built-in retry timers ignore the
+ * request AbortSignal, so callers must invoke the SDK with `maxRetries: 0` and
+ * wrap the request with this helper. Provider-requested delays above
+ * `maxRetryDelayMs` fail immediately (60 seconds by default); set it to zero to
+ * disable the limit.
+ */
+export async function andorraRetryProviderRequest(request, options = {}) {
+    const maxRetries = options.maxRetries ?? 0;
+    let retriesRemaining = maxRetries;
+    for (;;) {
+        try {
+            // Each retry is a fresh SDK request, so X-Stainless-Retry-Count remains zero.
+            return await request();
+        }
+        catch (error) {
+            if (options.signal?.aborted)
+                throw andorraCreateAbortError();
+            if (retriesRemaining <= 0 || !andorraIsProviderError(error) || !andorraIsRetryableProviderError(error))
+                throw error;
+            const retryIndex = maxRetries - retriesRemaining;
+            retriesRemaining--;
+            await andorraAbortableSleep(andorraGetRetryDelayMs(error, retryIndex, options.maxRetryDelayMs), options.signal);
+        }
+    }
+}

package/dist/vendor/engine/runtime/ai/utils/retry.d.ts

@@ -0,0 +1,57 @@
+import type { AssistantMessage } from "../types.js";
+/**
+ * Retry policy: bounded attempts with exponential backoff (`baseDelayMs * 2^(attempt-1)`).
+ * `maxAgentDelayMs` caps each computed delay and defaults to 60 seconds.
+ * Matches `settings.retry` (`enabled`, `maxRetries`, `baseDelayMs`, `maxAgentDelayMs`) in coding-agent; kept
+ * here so the classifier and the policy-driven retry loop live together and stay reusable
+ * by the SDK and other callers.
+ */
+export interface RetryPolicy {
+    enabled: boolean;
+    /** Max retry attempts (0 = no retries). The initial call never counts as a retry. */
+    maxRetries: number;
+    /** Base delay in ms. Per-attempt delay is `baseDelayMs * 2^(attempt-1)` before jitter. */
+    baseDelayMs: number;
+    /** Optional cap for agent-level retry delays in ms. Defaults to 60 seconds. */
+    maxAgentDelayMs?: number;
+}
+export declare const DEFAULT_MAX_AGENT_RETRY_DELAY_MS = 60000;
+export declare function andorraRetryDelayMs(policy: Pick<RetryPolicy, "baseDelayMs" | "maxAgentDelayMs">, attempt: number): number;
+/** Optional callbacks emitted by {@link retryAssistantCall} around each retry. */
+export interface RetryCallbacks {
+    /** Emitted before the backoff sleep of each retry attempt (1-indexed). */
+    onRetryScheduled?: (attempt: number, maxAttempts: number, delayMs: number, errorMessage: string) => void | Promise<void>;
+    /** Emitted after the backoff sleep, immediately before the retried call starts. */
+    onRetryAttemptStart?: () => void | Promise<void>;
+    /** Emitted once when the loop ends: success if a later call completed normally. */
+    onRetryFinished?: (success: boolean, attempt: number, finalError?: string) => void | Promise<void>;
+}
+/**
+ * Run a single assistant-producing call with bounded retry on transient errors.
+ *
+ * Behavior:
+ * - A successful response is returned immediately. Aborts are terminal and never
+ *   retried, but reported as unsuccessful if they happen after a retry was scheduled.
+ *   Aborts during the backoff sleep are normalized to an aborted `AssistantMessage`
+ *   too, so callers do not need to care when cancellation happened.
+ * - A non-retryable error (per {@link isRetryableAssistantError}, including quota/
+ *   billing exhaustion) is returned immediately so deterministic errors fail fast.
+ * - Otherwise retries up to `maxRetries` times with exponential backoff, emitting
+ *   `onRetryScheduled` before each sleep, `onRetryAttemptStart` after each sleep before
+ *   the retried call starts, and `onRetryFinished` once at the end (whether the loop
+ *   ends in success, exhausted retries, or an aborted backoff).
+ *
+ * When `policy` is undefined or disabled, the first response is returned unchanged
+ * (equivalent to calling `produce()` directly).
+ */
+export declare function andorraRetryAssistantCall(produce: () => Promise<AssistantMessage>, policy: RetryPolicy | undefined, signal: AbortSignal | undefined, callbacks?: RetryCallbacks): Promise<AssistantMessage>;
+/**
+ * Classifies whether a failed assistant message looks like a transient provider
+ * or transport error, so callers can decide if the last assistant turn should be
+ * restarted.
+ *
+ * This does not implement retry policy. Callers should first handle context
+ * overflow separately, then apply their own retry budget, backoff, and reporting
+ * before restarting the assistant turn.
+ */
+export declare function andorraIsRetryableAssistantError(message: AssistantMessage): boolean;

package/dist/vendor/engine/runtime/ai/utils/retry.js

@@ -0,0 +1,182 @@
+function andorraBuildProviderErrorPattern(patterns) {
+    return new RegExp(patterns.join("|"), "i");
+}
+const NON_RETRYABLE_PROVIDER_LIMIT_ERROR_PATTERN = andorraBuildProviderErrorPattern([
+    // OpenCode Go/free-tier limits returned as 429 JSON error types by OpenCode's
+    // Zen API. These are subscription/account limits, not transient throttles.
+    "GoUsageLimitError",
+    "FreeUsageLimitError",
+    // OpenCode Go subscription-limit text asks users to enable available-balance
+    // usage after rolling/weekly/monthly limits are reached.
+    "Monthly usage limit reached",
+    "available balance",
+    // Generic quota/budget/billing exhaustion. `insufficient_quota` is OpenAI's
+    // quota/billing error code; the other strings cover common gateway wording.
+    "insufficient_quota",
+    "out of budget",
+    "quota exceeded",
+    "billing",
+]);
+const RETRYABLE_PROVIDER_ERROR_PATTERN = andorraBuildProviderErrorPattern([
+    // Generic provider load, HTTP status, and server-side transient failures.
+    "overloaded",
+    "currently experiencing high demand",
+    "rate.?limit",
+    "too many requests",
+    "429",
+    "500",
+    "502",
+    "503",
+    "504",
+    "520",
+    "524",
+    "service.?unavailable",
+    "server.?error",
+    "internal.?error",
+    // Wrapper/provider text for transient upstream failures, including OpenRouter
+    // "Provider returned error" responses (#2264).
+    "provider.?returned.?error",
+    "exceeded request buffer limit while retrying upstream",
+    // Network, proxy, and fetch transport failures. This includes OpenAI Codex
+    // raw-fetch failures such as "upstream connect", "connection refused", and
+    // "reset before headers" (#733), plus OpenRouter connection drops (#3317).
+    "network.?error",
+    "connection.?error",
+    "connection.?refused",
+    "connection.?lost",
+    "other side closed",
+    "fetch failed",
+    "getaddrinfo",
+    "ENOTFOUND",
+    "EAI_AGAIN",
+    "upstream.?connect",
+    "reset before headers",
+    "socket hang up",
+    "socket connection was closed",
+    "timed? out",
+    "timeout",
+    "terminated",
+    // WebSocket transports can report close/error text instead of HTTP/fetch text.
+    "websocket.?closed",
+    "websocket.?error",
+    // Premature stream endings from SDKs and transports. Anthropic can throw
+    // "stream ended without ..." and "Anthropic stream ended before message_stop"
+    // (#4433); Bedrock/Smithy can throw an HTTP/2 no-response error (#3594).
+    "ended without",
+    "stream ended before message_stop",
+    "stream ended before a terminal response event",
+    "http2 request did not get a response",
+    // Provider-requested retry delay cap failures should flow through the outer
+    // retry policy so callers can surface/abort the backoff (#1123).
+    "retry delay",
+    // Explicit retry guidance emitted mid-stream by OpenAI Responses and Bedrock
+    // stream exceptions (#6019).
+    "you can retry your request",
+    "try your request again",
+    "please retry your request",
+    // gRPC based providers (e.g. NVIDIA NIM)
+    "ResourceExhausted",
+]);
+export const DEFAULT_MAX_AGENT_RETRY_DELAY_MS = 60_000;
+export function andorraRetryDelayMs(policy, attempt) {
+    const delay = policy.baseDelayMs * 2 ** Math.max(0, attempt - 1);
+    const safeDelay = Number.isSafeInteger(delay) ? delay : Number.MAX_SAFE_INTEGER;
+    return Math.min(safeDelay, policy.maxAgentDelayMs ?? DEFAULT_MAX_AGENT_RETRY_DELAY_MS);
+}
+class AndorraRetrySleepAbortError extends Error {
+    constructor() {
+        super("Aborted");
+    }
+}
+function andorraSleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(new AndorraRetrySleepAbortError());
+            return;
+        }
+        const timeout = setTimeout(resolve, ms);
+        signal?.addEventListener("abort", () => {
+            clearTimeout(timeout);
+            reject(new AndorraRetrySleepAbortError());
+        }, { once: true });
+    });
+}
+/**
+ * Run a single assistant-producing call with bounded retry on transient errors.
+ *
+ * Behavior:
+ * - A successful response is returned immediately. Aborts are terminal and never
+ *   retried, but reported as unsuccessful if they happen after a retry was scheduled.
+ *   Aborts during the backoff sleep are normalized to an aborted `AssistantMessage`
+ *   too, so callers do not need to care when cancellation happened.
+ * - A non-retryable error (per {@link isRetryableAssistantError}, including quota/
+ *   billing exhaustion) is returned immediately so deterministic errors fail fast.
+ * - Otherwise retries up to `maxRetries` times with exponential backoff, emitting
+ *   `onRetryScheduled` before each sleep, `onRetryAttemptStart` after each sleep before
+ *   the retried call starts, and `onRetryFinished` once at the end (whether the loop
+ *   ends in success, exhausted retries, or an aborted backoff).
+ *
+ * When `policy` is undefined or disabled, the first response is returned unchanged
+ * (equivalent to calling `produce()` directly).
+ */
+export async function andorraRetryAssistantCall(produce, policy, signal, callbacks) {
+    const maxAttempts = policy?.enabled ? policy.maxRetries : 0;
+    let attempt = 0;
+    let lastRetry;
+    for (;;) {
+        const response = await produce();
+        // Abort: terminal but not successful. Never retry an aborted message.
+        if (response.stopReason === "aborted") {
+            if (lastRetry)
+                await callbacks?.onRetryFinished?.(false, lastRetry.attempt);
+            return response;
+        }
+        // Success: non-error, non-abort responses return as-is.
+        if (response.stopReason !== "error") {
+            if (lastRetry)
+                await callbacks?.onRetryFinished?.(true, lastRetry.attempt);
+            return response;
+        }
+        // Non-retryable, or budget exhausted: return the final error message.
+        if (attempt >= maxAttempts || !andorraIsRetryableAssistantError(response)) {
+            if (lastRetry)
+                await callbacks?.onRetryFinished?.(false, lastRetry.attempt, response.errorMessage);
+            return response;
+        }
+        attempt++;
+        lastRetry = { attempt, errorMessage: response.errorMessage || "Unknown error" };
+        const delayMs = andorraRetryDelayMs(policy, attempt);
+        await callbacks?.onRetryScheduled?.(attempt, maxAttempts, delayMs, lastRetry.errorMessage);
+        // Normalize aborts during retry backoff to the same AssistantMessage shape as
+        // provider stream aborts, so callers do not need to care when cancellation happened.
+        try {
+            await andorraSleep(delayMs, signal);
+        }
+        catch (error) {
+            await callbacks?.onRetryFinished?.(false, attempt, lastRetry.errorMessage);
+            if (error instanceof AndorraRetrySleepAbortError) {
+                const { errorMessage: _errorMessage, ...rest } = response;
+                return { ...rest, stopReason: "aborted" };
+            }
+            throw error;
+        }
+        await callbacks?.onRetryAttemptStart?.();
+    }
+}
+/**
+ * Classifies whether a failed assistant message looks like a transient provider
+ * or transport error, so callers can decide if the last assistant turn should be
+ * restarted.
+ *
+ * This does not implement retry policy. Callers should first handle context
+ * overflow separately, then apply their own retry budget, backoff, and reporting
+ * before restarting the assistant turn.
+ */
+export function andorraIsRetryableAssistantError(message) {
+    if (message.stopReason !== "error" || !message.errorMessage)
+        return false;
+    const errorMessage = message.errorMessage;
+    if (NON_RETRYABLE_PROVIDER_LIMIT_ERROR_PATTERN.test(errorMessage))
+        return false;
+    return RETRYABLE_PROVIDER_ERROR_PATTERN.test(errorMessage);
+}