@blackbelt-technology/pi-agent-dashboard 0.5.0 → 0.5.1

package/packages/extension/src/__tests__/usage-limit-orderer.test.ts

@@ -0,0 +1,105 @@
+import { describe, it, expect } from "vitest";
+import { UsageLimitOrderer, USAGE_LIMIT_PATTERN } from "../usage-limit-orderer.js";
+
+describe("UsageLimitOrderer", () => {
+  it("returns null when no retry was pending", () => {
+    const o = new UsageLimitOrderer();
+    const result = o.maybeSynthesize("s1", {
+      messages: [{ role: "assistant", stopReason: "error", errorMessage: "usage_limit_reached" }],
+    });
+    expect(result).toBeNull();
+  });
+
+  it("returns null when retry was pending but error is not a usage-limit", () => {
+    const o = new UsageLimitOrderer();
+    o.noteRetryStart("s1");
+    const result = o.maybeSynthesize("s1", {
+      messages: [{ role: "assistant", stopReason: "error", errorMessage: "tool execution failed" }],
+    });
+    expect(result).toBeNull();
+  });
+
+  it("returns null on a non-error agent_end even with pending retry", () => {
+    const o = new UsageLimitOrderer();
+    o.noteRetryStart("s1");
+    const result = o.maybeSynthesize("s1", {
+      messages: [{ role: "assistant", stopReason: "end_turn" }],
+    });
+    expect(result).toBeNull();
+  });
+
+  it("synthesizes auto_retry_end on usage_limit_reached when retry was pending", () => {
+    const o = new UsageLimitOrderer();
+    o.noteRetryStart("s1");
+    const result = o.maybeSynthesize("s1", {
+      messages: [{ role: "assistant", stopReason: "error", errorMessage: "usage_limit_reached: 5000 RPM" }],
+    });
+    expect(result).not.toBeNull();
+    expect(result!.eventType).toBe("auto_retry_end");
+    expect(result!.data).toEqual({ success: false, attempt: -1, finalError: "usage_limit_reached: 5000 RPM" });
+  });
+
+  it.each([
+    "usage_limit_reached",
+    "usage_not_included",
+    "quota_exceeded",
+    "monthly limit reached for free tier",
+    "hourly limit hit",
+    "Your quota will reset after 18h31m10s",
+  ])("matches usage-limit variant: %s", (msg) => {
+    expect(USAGE_LIMIT_PATTERN.test(msg)).toBe(true);
+  });
+
+  it.each([
+    "rate limit exceeded",
+    "overloaded_error",
+    "tool execution failed",
+    "fetch failed",
+    "",
+  ])("does not match non-usage-limit variant: %s", (msg) => {
+    expect(USAGE_LIMIT_PATTERN.test(msg)).toBe(false);
+  });
+
+  it("clears pending after agent_end (no double-synthesis on subsequent agent_end)", () => {
+    const o = new UsageLimitOrderer();
+    o.noteRetryStart("s1");
+    const first = o.maybeSynthesize("s1", {
+      messages: [{ role: "assistant", stopReason: "error", errorMessage: "usage_limit_reached" }],
+    });
+    expect(first).not.toBeNull();
+    // Same payload again — pending was cleared, so no synthesis.
+    const second = o.maybeSynthesize("s1", {
+      messages: [{ role: "assistant", stopReason: "error", errorMessage: "usage_limit_reached" }],
+    });
+    expect(second).toBeNull();
+  });
+
+  it("noteRetryEnd clears pending so subsequent agent_end does not synthesize", () => {
+    const o = new UsageLimitOrderer();
+    o.noteRetryStart("s1");
+    o.noteRetryEnd("s1");
+    expect(o.hasPending("s1")).toBe(false);
+    const result = o.maybeSynthesize("s1", {
+      messages: [{ role: "assistant", stopReason: "error", errorMessage: "usage_limit_reached" }],
+    });
+    expect(result).toBeNull();
+  });
+
+  it("scopes pending state per-session", () => {
+    const o = new UsageLimitOrderer();
+    o.noteRetryStart("s1");
+    expect(o.hasPending("s2")).toBe(false);
+    const result = o.maybeSynthesize("s2", {
+      messages: [{ role: "assistant", stopReason: "error", errorMessage: "usage_limit_reached" }],
+    });
+    expect(result).toBeNull();
+  });
+
+  it("returns null on missing or empty messages array", () => {
+    const o = new UsageLimitOrderer();
+    o.noteRetryStart("s1");
+    expect(o.maybeSynthesize("s1", {})).toBeNull();
+    o.noteRetryStart("s1");
+    expect(o.maybeSynthesize("s1", { messages: [] })).toBeNull();
+  });
+});

package/packages/extension/src/ask-user-tool.ts

@@ -5,7 +5,7 @@
  * static tool-name conflicts with other extensions (e.g. pi-flows) that also
  * register ask_user. Runtime registration bypasses detectExtensionConflicts.
  */
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { polyfillMultiselect } from "./multiselect-polyfill.js";
 

package/packages/extension/src/bridge-context.ts

@@ -2,7 +2,7 @@
  * Shared mutable state for bridge modules.
  * Avoids passing 14+ closure variables to every extracted function.
  */
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import type { ConnectionManager } from "./connection.js";
 
 export interface BridgeContext {

package/packages/extension/src/bridge.ts

@@ -4,12 +4,14 @@
  * Global extension that connects to the dashboard server,
  * forwards all pi events, and relays commands back.
  */
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
-import { Loader } from "@mariozechner/pi-tui";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { Loader } from "@earendil-works/pi-tui";
 import { ConnectionManager } from "./connection.js";
 import { detectSessionSource } from "./source-detector.js";
 import { mapEventToProtocol } from "./event-forwarder.js";
 import { createCommandHandler } from "./command-handler.js";
+import { RetryTracker } from "./retry-tracker.js";
+import { UsageLimitOrderer } from "./usage-limit-orderer.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -191,6 +193,22 @@ function initBridge(pi: ExtensionAPI) {
   let hasRegisteredOnce = false; // see change: reattach-move-to-front
   let promptBus: PromptBus | undefined;
 
+  // Provider-retry synthesis trackers. pi's ExtensionAPI does not expose
+  // `auto_retry_*` events, so the bridge synthesizes them from observed
+  // `message_end` / `agent_end` events. See change: fix-provider-retry-infinite-loop.
+  const retryTracker = new RetryTracker();
+  const usageLimitOrderer = new UsageLimitOrderer();
+
+  /** Forward a synthesized auto_retry_* event using the standard event_forward shape. */
+  const sendSyntheticRetryEvent = (eventType: string, data: Record<string, unknown>): void => {
+    if (!isActive() || !sessionReady) return;
+    connection.send({
+      type: "event_forward",
+      sessionId,
+      event: { eventType, timestamp: Date.now(), data },
+    });
+  };
+
   // ── Per-message entry id tracking (for fix-per-message-fork) ──
   // Pi 0.69+ awaits extension handlers BEFORE sessionManager.appendMessage runs,
   // which means getLeafId() at emit time returns the previous leaf, not the
@@ -648,6 +666,14 @@ function initBridge(pi: ExtensionAPI) {
       if (cachedCtx?.abort) {
         cachedCtx.abort();
       }
+      // Clear retry-synthesis trackers — the user-initiated abort path
+      // already synthesizes its own auto_retry_end via command-handler.
+      // See change: fix-provider-retry-infinite-loop.
+      retryTracker.noteAbort(sessionId);
+      usageLimitOrderer.noteRetryEnd(sessionId);
+    },
+    isIdle: () => {
+      try { return cachedCtx?.isIdle?.() ?? false; } catch { return false; }
     },
     eventSink: (msg) => connection.send(msg),
     compact: (opts) => {
@@ -802,7 +828,25 @@ function initBridge(pi: ExtensionAPI) {
       if (!sessionReady) return;
       // Track agent streaming state (survives reconnect/reload)
       if (eventType === "agent_start") getBridgeState().isAgentStreaming = true;
-      if (eventType === "agent_end") getBridgeState().isAgentStreaming = false;
+      if (eventType === "agent_end") {
+        getBridgeState().isAgentStreaming = false;
+        // Provider-retry synthesis: forward auto_retry_end BEFORE agent_end
+        // when retries were in flight, so the dashboard's retry banner
+        // clears before the error banner appears. The usage-limit orderer
+        // takes precedence (it carries the actual error string); the retry
+        // tracker handles the non-usage-limit case. See change:
+        // fix-provider-retry-infinite-loop.
+        const orderedSynth = usageLimitOrderer.maybeSynthesize(sessionId, (event as any));
+        if (orderedSynth) {
+          sendSyntheticRetryEvent(orderedSynth.eventType, orderedSynth.data);
+          retryTracker.noteAbort(sessionId); // clear tracker; orderer's event is authoritative
+        } else {
+          const trackerSynth = retryTracker.observeAgentEnd(sessionId, event as any);
+          if (trackerSynth) {
+            sendSyntheticRetryEvent(trackerSynth.eventType, trackerSynth.data);
+          }
+        }
+      }
       // For model_select, enrich the event data with thinkingLevel
       if (eventType === "model_select") {
         const enriched = { ...event, thinkingLevel: (pi as any).getThinkingLevel?.() };
@@ -872,6 +916,18 @@ function initBridge(pi: ExtensionAPI) {
           const enriched = { ...event, entryId, nonce };
           const protoMsg = mapEventToProtocol(sessionId, enriched);
           connection.send(protoMsg);
+          // After forwarding the original message_end, ask the retry tracker
+          // whether to synthesize an auto_retry_* event. See change:
+          // fix-provider-retry-infinite-loop.
+          const synthetic = retryTracker.observeMessageEnd(sessionId, messageRef as any);
+          if (synthetic) {
+            sendSyntheticRetryEvent(synthetic.eventType, synthetic.data);
+            if (synthetic.eventType === "auto_retry_start") {
+              usageLimitOrderer.noteRetryStart(sessionId);
+            } else {
+              usageLimitOrderer.noteRetryEnd(sessionId);
+            }
+          }
         }, 0);
         return;
       }

package/packages/extension/src/command-handler.ts

@@ -3,7 +3,7 @@
  */
 import { readdirSync } from "node:fs";
 import { join, relative } from "node:path";
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import type {
   ServerToExtensionMessage,
   ExtensionToServerMessage,
@@ -145,6 +145,11 @@ export function createCommandHandler(
     getThinkingLevel?: () => string | undefined;
     shutdown?: () => void;
     abort?: () => void;
+    /**
+     * Probe agent idleness for the persistent-abort scheduler.
+     * See change: fix-provider-retry-infinite-loop.
+     */
+    isIdle?: () => boolean;
     getCwd?: () => string;
     /** Callback to send events (e.g., bash_output, command_feedback) back to server */
     eventSink?: (msg: ExtensionToServerMessage) => void;
@@ -161,6 +166,33 @@ export function createCommandHandler(
   },
 ): CommandHandler {
   const getSessionId = typeof sessionIdOrGetter === "function" ? sessionIdOrGetter : () => sessionIdOrGetter;
+
+  /**
+   * Persistent-abort scheduler. Re-invokes `options.abort()` at 200ms
+   * intervals for up to 2 seconds, breaking early when `options.isIdle()`
+   * returns true. Closes the retry race window in pi-coding-agent.
+   * See change: fix-provider-retry-infinite-loop.
+   */
+  const PERSISTENT_ABORT_INTERVAL_MS = 200;
+  const PERSISTENT_ABORT_MAX_MS = 2000;
+  function schedulePersistentAbort(opts: NonNullable<typeof options>): void {
+    if (!opts.abort) return;
+    const startedAt = Date.now();
+    const interval = setInterval(() => {
+      if (Date.now() - startedAt >= PERSISTENT_ABORT_MAX_MS) {
+        clearInterval(interval);
+        return;
+      }
+      try {
+        if (opts.isIdle?.()) {
+          clearInterval(interval);
+          return;
+        }
+      } catch { /* probe failure — keep trying */ }
+      try { opts.abort?.(); } catch { /* idempotent */ }
+    }, PERSISTENT_ABORT_INTERVAL_MS);
+  }
+
   return {
     async handle(msg: ServerToExtensionMessage): Promise<ExtensionToServerMessage | undefined> {
       const sessionId = getSessionId();
@@ -292,6 +324,31 @@ export function createCommandHandler(
           if (options?.abort) {
             options.abort();
           }
+          // Synthesize an immediate auto_retry_end so the dashboard clears
+          // any in-flight retry banner without waiting for pi's natural
+          // auto_retry_end (which is delayed by the abortable-sleep cancel
+          // window AND, on extension API, never reaches us at all — see
+          // https://github.com/badlogic/pi-mono/discussions/2073). The
+          // reducer no-ops auto_retry_end when retryState is undefined,
+          // so this is idempotent against later events.
+          if (options?.eventSink) {
+            options.eventSink({
+              type: "event_forward",
+              sessionId,
+              event: {
+                eventType: "auto_retry_end",
+                timestamp: Date.now(),
+                data: { success: false, attempt: -1, finalError: "Aborted by user" },
+              },
+            });
+          }
+          // Persistent-abort scheduler: pi-coding-agent's _retryAbortController
+          // is briefly `undefined` between sleep-end and the next
+          // agent.continue() call. An abort that arrives in that window is
+          // a no-op against the retry. Re-invoke abort every 200ms for up
+          // to 2s, breaking early when the agent is idle.
+          // See change: fix-provider-retry-infinite-loop.
+          if (options) schedulePersistentAbort(options);
           return undefined;
 
         case "request_commands": {
@@ -394,7 +451,7 @@ export function createCommandHandler(
         case "list_sessions": {
           try {
             // Dynamic import to avoid hard dependency at module load
-            const { SessionManager } = await import("@mariozechner/pi-coding-agent") as any;
+            const { SessionManager } = await import("@earendil-works/pi-coding-agent") as any;
             const cwd = msg.cwd || options?.getCwd?.() || process.cwd();
             const sessionInfos = await SessionManager.list(cwd);
             const sessions: PiSessionInfo[] = (sessionInfos || []).map((s: any) => ({

package/packages/extension/src/flow-event-wiring.ts

@@ -2,7 +2,7 @@
  * Flow event wiring: registers listeners for pi-flows events
  * and forwards them as protocol messages to the dashboard server.
  */
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import type { BridgeContext } from "./bridge-context.js";
 import { filterHiddenCommands } from "./bridge-context.js";
 import type { FlowInfo } from "@blackbelt-technology/pi-dashboard-shared/types.js";

package/packages/extension/src/multiselect-list.ts

@@ -23,7 +23,7 @@ interface Item {
 
 /**
  * Minimal shape of pi-tui's `Component` interface — we avoid importing from
- * `@mariozechner/pi-tui` directly so this module stays compile-friendly when
+ * `@earendil-works/pi-tui` directly so this module stays compile-friendly when
  * that peer dep isn't present (e.g. in unit tests running via vitest without
  * the full pi runtime).
  */

package/packages/extension/src/pi-env.d.ts

@@ -1,15 +1,8 @@
 // Ambient declarations for pi runtime packages.
-// The actual types are provided by whichever host (pi or OMP) loads this extension.
+// The actual types are provided by whichever host loads this extension.
 // tsconfig paths handles resolution when one of the packages is installed;
 // these declarations serve as fallback when neither is available (e.g. CI, dev without pi).
-declare module "@mariozechner/pi-coding-agent" {
-  export type ExtensionAPI = import("@oh-my-pi/pi-coding-agent").ExtensionAPI;
-}
-declare module "@mariozechner/pi-ai" {
-  export function StringEnum<T extends readonly string[]>(values: T, schema?: Record<string, unknown>): any;
-}
-
-declare module "@oh-my-pi/pi-coding-agent" {
+declare module "@earendil-works/pi-coding-agent" {
   export interface ModelRegistry {
     getAvailable(): Array<{ provider: string; id: string }>;
     refresh(): void;
@@ -35,3 +28,17 @@ declare module "@oh-my-pi/pi-coding-agent" {
     events: EventBus;
   }
 }
+
+// Legacy fork — re-exports the same ExtensionAPI shape so existing installs still type-check.
+declare module "@mariozechner/pi-coding-agent" {
+  export type ExtensionAPI = import("@earendil-works/pi-coding-agent").ExtensionAPI;
+  export type ModelRegistry = import("@earendil-works/pi-coding-agent").ModelRegistry;
+  export type EventBus = import("@earendil-works/pi-coding-agent").EventBus;
+}
+
+declare module "@earendil-works/pi-ai" {
+  export function StringEnum<T extends readonly string[]>(values: T, schema?: Record<string, unknown>): any;
+}
+declare module "@mariozechner/pi-ai" {
+  export function StringEnum<T extends readonly string[]>(values: T, schema?: Record<string, unknown>): any;
+}

package/packages/extension/src/provider-register.ts

@@ -11,7 +11,7 @@
  *   flow:resolve-model / flow:get-available-models
  */
 
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -373,7 +373,7 @@ async function loadPiAi(): Promise<PiAiHelpers> {
   if (_piAiLoadAttempted) return {};
   _piAiLoadAttempted = true;
   try {
-    const mod: any = await import("@mariozechner/pi-ai");
+    const mod: any = await import("@earendil-works/pi-ai");
     _piAiModule = { findEnvKeys: mod.findEnvKeys, getEnvApiKey: mod.getEnvApiKey };
     return _piAiModule;
   } catch {
@@ -436,6 +436,20 @@ function getModelRegistry(): any {
 // -- Provider registration (with auto-discovery) --------------------------
 
 async function registerEntry(pi: ExtensionAPI, name: string, entry: ProviderEntry): Promise<number> {
+  // Record snapshot SYNCHRONOUSLY before awaiting discovery so the very
+  // first providers_list push (typically fired from `session_start`
+  // shortly after `activate()` kicked off async registerEntry calls) carries
+  // the correct `custom: true` flags. Otherwise a slow / unreachable
+  // /v1/models endpoint causes custom providers from
+  // `~/.pi/agent/providers.json` to leak into Settings → Provider
+  // Authentication → API Keys until the discovery probe resolves.
+  // See change: fix-custom-provider-flag-race.
+  lastRegistered.set(name, {
+    baseUrl: entry.baseUrl,
+    apiKey: entry.apiKey,
+    api: entry.api ?? "openai-completions",
+  });
+
   const discovered = await discoverModels(entry.baseUrl, entry.apiKey);
 
   // Metadata (contextWindow, maxTokens, reasoning, cost, input) is resolved
@@ -464,13 +478,6 @@ async function registerEntry(pi: ExtensionAPI, name: string, entry: ProviderEntr
     models,
   });
 
-  // Record snapshot so reloadProviders can detect subsequent changes.
-  lastRegistered.set(name, {
-    baseUrl: entry.baseUrl,
-    apiKey: entry.apiKey,
-    api: entry.api ?? "openai-completions",
-  });
-
   // Notify bridge directly (same package — no cross-package event needed)
   onProvidersChanged?.();
 

package/packages/extension/src/retry-tracker.ts

@@ -0,0 +1,123 @@
+/**
+ * RetryTracker — synthesizes `auto_retry_start` / `auto_retry_end` events from
+ * observed pi events.
+ *
+ * Background: pi's ExtensionAPI does NOT expose `auto_retry_*` events to
+ * extensions (verified against pi 0.70/0.73 — see
+ * https://github.com/badlogic/pi-mono/discussions/2073). They fire only via
+ * `AgentSession._emit → _eventListeners` which only the embedded SDK can
+ * subscribe to.
+ *
+ * Workaround: pi-coding-agent's `_handleRetryableError` fires `message_end`
+ * for the failed assistant message BEFORE entering its retry sleep. The
+ * bridge sees that `message_end` via `pi.on("message_end")`. By matching
+ * the same regex pi-coding-agent uses internally, we can detect that a
+ * retry is about to happen and emit our own `auto_retry_start` to the
+ * dashboard. When the next non-error `message_end` or `agent_end` arrives,
+ * we emit `auto_retry_end`.
+ *
+ * `delayMs` and `maxAttempts` are unknowable from observed events (pi's
+ * settings are not exposed); we send sentinel `-1` for both. The
+ * RetryBanner renders an indeterminate "retrying…" UI in that case.
+ *
+ * See change: fix-provider-retry-infinite-loop.
+ */
+
+/**
+ * Regex copied verbatim from pi-coding-agent `agent-session.js`
+ * `_isRetryableError`. If pi adds new retryable categories, this regex
+ * goes stale — but the failure mode is "tracker silently misses some
+ * retries", never "tracker breaks". Sync at major pi version bumps.
+ */
+export const RETRYABLE_PATTERN =
+  /overloaded|provider.?returned.?error|rate.?limit|too many requests|429|500|502|503|504|service.?unavailable|server.?error|internal.?error|network.?error|connection.?error|connection.?refused|connection.?lost|other side closed|fetch failed|upstream.?connect|reset before headers|socket hang up|ended without|http2 request did not get a response|timed? out|timeout|terminated|retry delay/i;
+
+export interface SyntheticRetryEvent {
+  eventType: "auto_retry_start" | "auto_retry_end";
+  data: Record<string, unknown>;
+}
+
+/** Minimal shape we pluck from a `message_end` event. */
+export interface ObservedAssistantMessage {
+  role?: string;
+  stopReason?: string;
+  errorMessage?: string;
+}
+
+export class RetryTracker {
+  /** sessionId → 1-based attempt counter for the current retry chain. */
+  private attempt = new Map<string, number>();
+
+  /**
+   * Process a `message_end` event. Returns a synthetic event the bridge
+   * should ALSO forward (after the original message_end), or null.
+   */
+  observeMessageEnd(
+    sessionId: string,
+    message: ObservedAssistantMessage | undefined | null,
+  ): SyntheticRetryEvent | null {
+    if (!message || message.role !== "assistant") return null;
+
+    if (message.stopReason === "error") {
+      const err = typeof message.errorMessage === "string" ? message.errorMessage : "";
+      if (!err || !RETRYABLE_PATTERN.test(err)) return null;
+      const next = (this.attempt.get(sessionId) ?? 0) + 1;
+      this.attempt.set(sessionId, next);
+      return {
+        eventType: "auto_retry_start",
+        data: { attempt: next, maxAttempts: -1, delayMs: -1, errorMessage: err },
+      };
+    }
+
+    // Non-error assistant message — clears any in-flight retry chain.
+    if (this.attempt.has(sessionId)) {
+      const last = this.attempt.get(sessionId) ?? 0;
+      this.attempt.delete(sessionId);
+      return { eventType: "auto_retry_end", data: { success: true, attempt: last } };
+    }
+    return null;
+  }
+
+  /**
+   * Process an `agent_end` event. Returns a synthetic event the bridge
+   * should forward BEFORE the original agent_end, or null.
+   *
+   * Always clears any in-flight retry tracking (terminal turn boundary).
+   */
+  observeAgentEnd(
+    sessionId: string,
+    agentEndData: { messages?: unknown } | undefined | null,
+  ): SyntheticRetryEvent | null {
+    const wasRetrying = this.attempt.has(sessionId);
+    const last = this.attempt.get(sessionId) ?? -1;
+    this.attempt.delete(sessionId);
+    if (!wasRetrying) return null;
+
+    // Inspect terminal message for error context.
+    const messages = agentEndData?.messages;
+    const lastMsg =
+      Array.isArray(messages) && messages.length > 0
+        ? (messages[messages.length - 1] as ObservedAssistantMessage)
+        : undefined;
+    if (lastMsg?.stopReason === "error" && typeof lastMsg.errorMessage === "string") {
+      return {
+        eventType: "auto_retry_end",
+        data: { success: false, attempt: last, finalError: lastMsg.errorMessage },
+      };
+    }
+    return { eventType: "auto_retry_end", data: { success: true, attempt: last } };
+  }
+
+  /**
+   * Notify the tracker of a user abort. Clears in-flight tracking so a
+   * subsequent agent_end does not double-emit auto_retry_end.
+   */
+  noteAbort(sessionId: string): void {
+    this.attempt.delete(sessionId);
+  }
+
+  /** Test-only / bridge-coordination: is a retry currently in flight? */
+  isRetrying(sessionId: string): boolean {
+    return this.attempt.has(sessionId);
+  }
+}

package/packages/extension/src/session-sync.ts

@@ -39,7 +39,15 @@ export function sendStateSync(
   // dashboard restart) is a "reattach". Server applies the configured
   // `reattachPlacement` policy on "reattach".
   // See change: reattach-move-to-front.
-  const registerReason: "spawn" | "reattach" = bc.hasRegisteredOnce ? "reattach" : "spawn";
+  const isFirstRegister = !bc.hasRegisteredOnce;
+  const registerReason: "spawn" | "reattach" = isFirstRegister ? "spawn" : "reattach";
+
+  // Include the spawn correlation token (server-minted UUID injected via
+  // env var at spawn time) ONLY on the first register. Subsequent
+  // registers (reattach after dashboard restart, in-process Ctrl+F fork)
+  // omit it because the sessionId is already known to the server.
+  // See change: spawn-correlation-token (Decision 3).
+  const spawnToken = isFirstRegister ? process.env.PI_DASHBOARD_SPAWN_TOKEN : undefined;
 
   bc.connection.send({
     type: "session_register",
@@ -55,6 +63,7 @@ export function sendStateSync(
     eventCount,
     pid: process.pid,
     registerReason,
+    ...(spawnToken ? { spawnToken } : {}),
   });
 
   bc.hasRegisteredOnce = true;

package/packages/extension/src/usage-limit-orderer.ts

@@ -0,0 +1,76 @@
+/**
+ * Usage-limit event orderer.
+ *
+ * Tracks per-session whether an `auto_retry_start` was forwarded without a
+ * matching `auto_retry_end`, and — when an `agent_end` arrives whose terminal
+ * assistant message has a usage-limit / quota errorMessage — synthesizes an
+ * `auto_retry_end { success: false }` to emit BEFORE the `agent_end`.
+ *
+ * Pure logic (no I/O). The bridge wires this into its forwarding pipeline.
+ *
+ * See change: fix-provider-retry-infinite-loop.
+ */
+
+export const USAGE_LIMIT_PATTERN =
+  /usage[_ ]limit[_ ]reached|usage_not_included|quota[_ ]exceeded|monthly limit|hourly limit|reset after \d+[hms]/i;
+
+export interface SyntheticEventEnvelope {
+  eventType: "auto_retry_end";
+  data: { success: false; attempt: -1; finalError: string };
+}
+
+export class UsageLimitOrderer {
+  /** sessionId → true while a retry is in flight (no auto_retry_end seen yet). */
+  private pending = new Set<string>();
+
+  /**
+   * Notify the orderer of an outbound `auto_retry_start` for sessionId.
+   */
+  noteRetryStart(sessionId: string): void {
+    this.pending.add(sessionId);
+  }
+
+  /**
+   * Notify the orderer of an outbound `auto_retry_end` for sessionId.
+   * Subsequent `agent_end` events will not synthesize unless a new retry
+   * has been started.
+   */
+  noteRetryEnd(sessionId: string): void {
+    this.pending.delete(sessionId);
+  }
+
+  /**
+   * Inspect an `agent_end` payload. If the terminal message has a
+   * usage-limit error AND we have an unmatched retry-start for this session,
+   * return the synthetic event the bridge should forward BEFORE the agent_end.
+   *
+   * Returns null when no synthesis is needed. Always clears the pending flag
+   * after a terminal agent_end (errored or not) so we don't double-synthesize.
+   */
+  maybeSynthesize(
+    sessionId: string,
+    agentEndData: Record<string, unknown> | undefined,
+  ): SyntheticEventEnvelope | null {
+    const wasPending = this.pending.has(sessionId);
+    // Always clear on agent_end: a terminal turn ends any retry tracking.
+    this.pending.delete(sessionId);
+
+    if (!wasPending || !agentEndData) return null;
+    const messages = agentEndData.messages;
+    if (!Array.isArray(messages) || messages.length === 0) return null;
+    const last = messages[messages.length - 1] as Record<string, unknown> | undefined;
+    if (!last || last.stopReason !== "error") return null;
+    const errorMessage = typeof last.errorMessage === "string" ? last.errorMessage : "";
+    if (!errorMessage || !USAGE_LIMIT_PATTERN.test(errorMessage)) return null;
+
+    return {
+      eventType: "auto_retry_end",
+      data: { success: false, attempt: -1, finalError: errorMessage },
+    };
+  }
+
+  /** Test-only: inspect pending state. */
+  hasPending(sessionId: string): boolean {
+    return this.pending.has(sessionId);
+  }
+}