@buyong/pi-devin 0.1.3 → 0.1.5

package/src/pi/extension.ts

@@ -1,5 +1,5 @@
 import type { Model } from "@earendil-works/pi-ai";
-import { getAgentDir, type ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { getAgentDir, type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { createDevinProvider, type DevinProvider } from "./provider.ts";
 import { DEVIN_STATE_ENTRY } from "./lifecycle.ts";
 import { registerDevinCommand, updateUsageStatus } from "./devin-command.ts";
@@ -9,7 +9,7 @@ import { memoryFusionSettings, type FusionSettings } from "./fusion-settings.ts"
 import { createSidekickTool, fusionOf, SIDEKICK_TOOL_NAME, type SidekickToolOptions } from "./sidekick.ts";
 
 type ProviderOptions = NonNullable<Parameters<typeof createDevinProvider>[0]>;
-export interface DevinExtensionOptions extends Omit<ProviderOptions, "fusion" | "listsAllExactModels" | "recommendedOnly"> {
+export interface DevinExtensionOptions extends Omit<ProviderOptions, "fusion" | "listsAllExactModels" | "recommendedOnly" | "onAccountUsage"> {
   /** Store for the `/devin-fusion` choice. Kept in memory only when omitted. */
   fusionSettings?: FusionSettings;
   /** Store for the `/devin` display settings. Kept in memory only when omitted. */
@@ -24,14 +24,20 @@ export function registerDevinExtension(pi: ExtensionAPI, options: DevinExtension
   const { fusionSettings, devinSettings, isFusionChild, sidekick: sidekickOptions, ...providerOptions } = options;
   const settings = fusionSettings ?? memoryFusionSettings();
   const preferences = isFusionChild ? undefined : devinSettings ?? memoryDevinSettings();
+  // Context of the current session, used to redraw the status when the quota changes outside event handlers.
+  let statusContext: ExtensionContext | undefined;
+  const refreshStatus = (context: ExtensionContext, pendingMessage?: unknown) => { if (preferences) updateUsageStatus(context, provider, preferences, pendingMessage); };
   // The child Pi runs on the exact UID the lead chose, so it lists every exact UID and ignores the recommended filter.
   const provider = createDevinProvider({
     ...providerOptions, fusion: isFusionChild ? false : () => settings.read(), listsAllExactModels: isFusionChild === true,
     recommendedOnly: preferences ? () => preferences.read().recommendedOnly : undefined,
+    onAccountUsage: () => {
+      if (!statusContext) return;
+      try { refreshStatus(statusContext); } catch { /* The session was replaced or reloaded; its next session_start redraws. */ }
+    },
   });
   pi.registerProvider(provider);
   if (preferences) registerDevinCommand(pi, provider, preferences);
-  const refreshStatus = (context: Parameters<typeof updateUsageStatus>[0]) => { if (preferences) updateUsageStatus(context, provider, preferences); };
   const sidekick = isFusionChild ? undefined
     : createSidekickTool(pi, provider, { agentDir: sidekickOptions?.agentDir ?? getAgentDir, runtime: sidekickOptions?.runtime });
   if (sidekick) {
@@ -60,11 +66,14 @@ export function registerDevinExtension(pi: ExtensionAPI, options: DevinExtension
     });
     sidekick?.onSessionStart(context.sessionManager.getSessionId());
     syncSidekick(context.model);
+    statusContext = context;
     refreshStatus(context);
   });
   pi.on("message_end", (event, context) => {
-    if (event.message.role === "assistant" && event.message.provider === "devin") refreshStatus(context);
+    if (event.message.role === "assistant" && event.message.provider === "devin") refreshStatus(context, event.message);
   });
+  // Subagents and other sessions record quota in the shared store; any model's turn picks it up.
+  pi.on("turn_end", (_event, context) => { refreshStatus(context); });
   pi.on("before_agent_start", () => { provider.lifecycle.begin("agent"); });
   pi.on("agent_start", () => { provider.lifecycle.agentStarted(); });
   // Host retry or overflow recovery can continue after agent_end.
@@ -75,6 +84,6 @@ export function registerDevinExtension(pi: ExtensionAPI, options: DevinExtension
   pi.on("session_before_tree", (event) => { if (event.preparation.userWantsSummary) provider.lifecycle.beforeTree(); });
   pi.on("session_tree", (_event, context) => { provider.lifecycle.treeChanged(); refreshStatus(context); });
   pi.on("cache_warming_decision", (_event, context) => context.model?.provider === "devin" ? { action: "stop" } : undefined);
-  pi.on("session_shutdown", () => { sidekick?.reset(); provider.shutdown(); });
+  pi.on("session_shutdown", () => { statusContext = undefined; sidekick?.reset(); provider.shutdown(); });
   return provider;
 }

package/src/pi/models.ts

@@ -28,6 +28,8 @@ export interface DevinModel extends Model<typeof DEVIN_API> {
     fusion?: FusionSelection;
     /** Marked as recommended by the catalog. For a group, true when any variant is recommended. */
     recommended?: true;
+    /** Account identity hash (endpoint and user ID) the catalog belongs to. Lets a new session of the same account reuse it. */
+    account?: string;
   };
 }
 
@@ -39,6 +41,8 @@ export interface ProjectionOptions {
   recommendedOnly?: boolean;
   /** Also lists exact UIDs that a group already covers. Used only by the sidekick child Pi. */
   listsAllExactModels?: boolean;
+  /** Account identity hash recorded with every model. */
+  account?: string;
 }
 
 export function isFusionModelID(id: string): boolean { return id === FUSION_MODEL_ID; }
@@ -59,7 +63,7 @@ function thinkingMap(mappings: Partial<Record<EffectiveThinkingLevel, string>>)
   return Object.fromEntries(EFFECTIVE_THINKING_LEVELS.map((level) => [level, mappings[level] ?? null]));
 }
 
-function modelDefinition(id: string, name: string, variants: ModelVariant[], mappings: Partial<Record<EffectiveThinkingLevel, string>>, credential: Credential): DevinModel {
+function modelDefinition(id: string, name: string, variants: ModelVariant[], mappings: Partial<Record<EffectiveThinkingLevel, string>>, credential: Credential, account?: string): DevinModel {
   const first = variants[0].model;
   return {
     id, name, api: DEVIN_API, provider: "devin", baseUrl: credential.apiServerURL,
@@ -68,7 +72,7 @@ function modelDefinition(id: string, name: string, variants: ModelVariant[], map
     contextWindow: first.contextWindow, maxTokens: first.maxOutputTokens,
     // Placeholder for Pi's required numeric fields. It does not mean free or a real USD price.
     cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-    devin: { version: CATALOG_VERSION, scope: catalogScope(credential), costsUnknown: true, configs: variants.map((variant) => variant.config) },
+    devin: { version: CATALOG_VERSION, scope: catalogScope(credential), costsUnknown: true, configs: variants.map((variant) => variant.config), ...(account ? { account } : {}) },
   };
 }
 
@@ -199,7 +203,7 @@ export function modelsFromProjection(projection: VariantProjection, credential:
   const isListed = (uids: readonly string[]) => !isRecommendedOnly || uids.some((uid) => recommendedUIDs.has(uid));
   for (const group of published) {
     if (!isListed(Object.values(group.mappings))) continue;
-    const model = modelDefinition(ids.groups.get(group.id)!, names.get(group.id)!, publishedVariants(group), group.mappings, credential);
+    const model = modelDefinition(ids.groups.get(group.id)!, names.get(group.id)!, publishedVariants(group), group.mappings, credential, options.account);
     if (group.variants.some((variant) => variant.model.isRecommended)) model.devin.recommended = true;
     models.push(model);
   }
@@ -209,7 +213,7 @@ export function modelsFromProjection(projection: VariantProjection, credential:
   const listedNames = new Set(models.map((model) => model.name));
   for (const variant of exact) {
     const name = listedNames.has(variant.model.name) ? `${variant.model.name} (${variant.model.id})` : variant.model.name;
-    const model = modelDefinition(ids.variants.get(variant.model.id)!, name, [variant], { [variant.level!]: variant.model.id }, credential);
+    const model = modelDefinition(ids.variants.get(variant.model.id)!, name, [variant], { [variant.level!]: variant.model.id }, credential, options.account);
     if (variant.model.isRecommended) model.devin.recommended = true;
     models.push(model);
   }
@@ -218,7 +222,7 @@ export function modelsFromProjection(projection: VariantProjection, credential:
   if (pair) {
     const lead = projection.groups.find((group) => ids.groups.get(group.id) === pair.leadID)!;
     const sidekick = projection.variants.find((variant) => ids.variants.get(variant.model.id) === pair.sidekickID)!;
-    const model = modelDefinition(FUSION_MODEL_ID, `Devin Fusion · ${names.get(lead.id)} + ${sidekick.model.name}`, publishedVariants(lead), lead.mappings, credential);
+    const model = modelDefinition(FUSION_MODEL_ID, `Devin Fusion · ${names.get(lead.id)} + ${sidekick.model.name}`, publishedVariants(lead), lead.mappings, credential, options.account);
     model.devin.fusion = pair;
     models.push(model);
   }
@@ -228,13 +232,24 @@ export function modelsFromProjection(projection: VariantProjection, credential:
   return models;
 }
 
-function restoredProjection(stored: Readonly<ModelsStoreEntry> | undefined, credential: Credential): VariantProjection | undefined {
+const ACCOUNT_HASH = /^[a-f0-9]{64}$/;
+interface RestoredCatalog { projection: VariantProjection; account?: string; isSameSession: boolean }
+
+/**
+ * Restores the stored catalog of the same session, or of an earlier session of an account this process verified for `account`.
+ * Every entry must share one scope and one account, so a mixed or edited cache is never partly applied.
+ */
+function restoredCatalog(stored: Readonly<ModelsStoreEntry> | undefined, credential: Credential, account: string | undefined): RestoredCatalog | undefined {
   if (!stored?.models.length) return undefined;
   const scope = catalogScope(credential), configs = new Map<string, JsonObject>();
-  for (const model of stored.models) {
+  let storedScope: unknown, storedAccount: unknown;
+  for (const [index, model] of stored.models.entries()) {
     const metadata = object((model as DevinModel).devin, "cached Devin metadata");
     if ((model.type !== undefined && model.type !== "chat") || model.provider !== "devin" || model.api !== DEVIN_API || model.baseUrl !== credential.apiServerURL
-      || metadata.version !== CATALOG_VERSION || metadata.scope !== scope) return undefined;
+      || metadata.version !== CATALOG_VERSION || typeof metadata.scope !== "string") return undefined;
+    if (metadata.account !== undefined && (typeof metadata.account !== "string" || !ACCOUNT_HASH.test(metadata.account))) return undefined;
+    if (index === 0) { storedScope = metadata.scope; storedAccount = metadata.account; }
+    else if (metadata.scope !== storedScope || metadata.account !== storedAccount) return undefined;
     if (!Array.isArray(metadata.configs)) return undefined;
     const entries = [...metadata.configs, ...(Array.isArray(metadata.unavailable) ? metadata.unavailable : [])];
     for (const value of entries) {
@@ -245,7 +260,10 @@ function restoredProjection(stored: Readonly<ModelsStoreEntry> | undefined, cred
       configs.set(config.modelUid, config);
     }
   }
-  return restoreModelVariants([...configs.values()]);
+  const isSameSession = storedScope === scope;
+  // Another session's catalog is used only for the same verified account; account changes and logout never expose it.
+  if (!isSameSession && (account === undefined || storedAccount !== account)) return undefined;
+  return { projection: restoreModelVariants([...configs.values()]), account: account ?? storedAccount as string | undefined, isSameSession };
 }
 
 export interface DevinModelSource {
@@ -262,6 +280,8 @@ export interface DevinModelSource {
   getFusionChoices(): FusionChoices | undefined;
   /** Rebuilds the model list from the current catalog without network after a saved choice or setting changes. */
   rebuildModels(): void;
+  /** Scope of the credential seen by the last model refresh, even before its catalog loads. Undefined after logout or sign-in. */
+  currentScope(): string | undefined;
   invalidate(): void;
 }
 
@@ -276,20 +296,25 @@ export function createDevinModelSource(options: {
   recommendedOnly?: () => boolean;
   /** Also lists exact UIDs that a group already covers. Used only by the sidekick child Pi. */
   listsAllExactModels?: boolean;
+  /** Account identity hash this process verified for the credential, if any. */
+  accountOf?: (credential: Credential) => string | undefined;
 }): DevinModelSource {
   const now = options.now ?? Date.now, freshnessMs = options.freshnessMs ?? DEFAULT_FRESHNESS_MS;
   if (!Number.isSafeInteger(freshnessMs) || freshnessMs < 0) throw new Error("The model cache check interval must be an integer of 0 or more.");
   const readFusion = options.fusion;
   // The stored list is shared by every Pi process that uses the lead's agent directory. Only the default list is stored,
   // without display filters or the sidekick-only exact list. It still holds every catalog config, so each process rebuilds its own list after restore.
-  const build = (next: VariantProjection, credential: Credential, isForStorage = false) => modelsFromProjection(next, credential, {
+  const build = (next: VariantProjection, credential: Credential, account: string | undefined, isForStorage = false) => modelsFromProjection(next, credential, {
     fusion: readFusion === false ? false : readFusion?.(),
     recommendedOnly: !isForStorage && options.recommendedOnly?.() === true,
     listsAllExactModels: !isForStorage && options.listsAllExactModels === true,
+    account,
   });
-  let models: DevinModel[] = [], projection: VariantProjection | undefined, scope: string | undefined;
-  let checkedAtMs = 0, endpointOverride: string | undefined, modelCredential: Credential | undefined;
-  const clear = () => { models = []; projection = undefined; scope = undefined; checkedAtMs = 0; modelCredential = undefined; };
+  let models: DevinModel[] = [], projection: VariantProjection | undefined, scope: string | undefined, catalogAccount: string | undefined;
+  let checkedAtMs = 0, endpointOverride: string | undefined, modelCredential: Credential | undefined, credentialScope: string | undefined;
+  const clear = () => {
+    models = []; projection = undefined; scope = undefined; catalogAccount = undefined; checkedAtMs = 0; modelCredential = undefined; credentialScope = undefined;
+  };
   const currentProjection = (credential: Credential) => {
     if (!projection || scope !== catalogScope(credential)) throw new Error("No Devin model list matches the current account and endpoint. Refresh the model list.");
     return projection;
@@ -304,8 +329,9 @@ export function createDevinModelSource(options: {
     exactLevel: (uid) => projection?.variants.find((variant) => variant.model.id === uid && isUsable(variant))?.level,
     getFusionChoices: () => projection && readFusion !== false ? fusionChoices(projection) : undefined,
     rebuildModels() {
-      if (projection && modelCredential) models = build(projection, modelCredential);
+      if (projection && modelCredential) models = build(projection, modelCredential, catalogAccount);
     },
+    currentScope: () => credentialScope,
     invalidate: clear,
     filterModels(candidates, credential) {
       try {
@@ -342,21 +368,29 @@ export function createDevinModelSource(options: {
         return;
       }
       const expectedScope = catalogScope(credential);
-      let restored: VariantProjection | undefined;
-      try { restored = restoredProjection(context.stored, credential); }
+      let restored: RestoredCatalog | undefined;
+      try { restored = restoredCatalog(context.stored, credential, options.accountOf?.(credential)); }
       catch { /* A bad cache is never used as run data. The current good state is kept. */ }
       if (restored && (scope !== expectedScope || !projection || (context.stored?.checkedAt ?? 0) > checkedAtMs)) {
-        const restoredModels = build(restored, credential);
+        const { projection: restoredProjection, account: restoredAccount, isSameSession } = restored;
+        const restoredModels = build(restoredProjection, credential, restoredAccount);
         const checkedAt = context.stored?.checkedAt;
         const restoredAtMs = typeof checkedAt === "number" && Number.isFinite(checkedAt) && checkedAt >= 0 && checkedAt <= now() ? checkedAt : 0;
+        const accepted = await context.publish({
+          // A catalog reused for a new session of the same account is stored under the new session, so a restart restores it too.
+          ...(isSameSession ? {} : { persist: { models: build(restoredProjection, credential, restoredAccount, true), checkedAt: restoredAtMs } }),
+          update: () => {
+            projection = restoredProjection; models = restoredModels; scope = expectedScope; catalogAccount = restoredAccount; modelCredential = credential;
+            checkedAtMs = restoredAtMs; endpointOverride = context.baseUrl; credentialScope = expectedScope;
+          },
+        });
+        if (!accepted) return;
+      } else if (scope !== expectedScope || endpointOverride !== context.baseUrl || credentialScope !== expectedScope) {
         const accepted = await context.publish({ update: () => {
-          projection = restored; models = restoredModels; scope = expectedScope; modelCredential = credential;
-          checkedAtMs = restoredAtMs; endpointOverride = context.baseUrl;
+          if (scope !== expectedScope || endpointOverride !== context.baseUrl) clear();
+          endpointOverride = context.baseUrl; credentialScope = expectedScope;
         } });
         if (!accepted) return;
-      } else if (scope !== expectedScope || endpointOverride !== context.baseUrl) {
-        const accepted = await context.publish({ update: () => { clear(); endpointOverride = context.baseUrl; } });
-        if (!accepted) return;
       }
       if (!context.allowNetwork) return;
       const ageMs = now() - checkedAtMs;
@@ -364,14 +398,16 @@ export function createDevinModelSource(options: {
       const catalog = await awaitWithSignal(options.fetchCatalog(credential, context.signal), context.signal);
       context.signal.throwIfAborted();
       const nextProjection = projectModelVariants(catalog);
-      const nextModels = build(nextProjection, credential);
+      // Known after an account check in this process, or carried over from this same session's catalog.
+      const nextAccount = options.accountOf?.(credential) ?? (scope === expectedScope ? catalogAccount : undefined);
+      const nextModels = build(nextProjection, credential, nextAccount);
       const checkedAt = now();
       if (!Number.isSafeInteger(checkedAt) || checkedAt < 0) throw new Error("Invalid model cache check time.");
       await context.publish({
-        persist: { models: build(nextProjection, credential, true), checkedAt },
+        persist: { models: build(nextProjection, credential, nextAccount, true), checkedAt },
         update: () => {
-          projection = nextProjection; models = nextModels; scope = expectedScope; modelCredential = credential;
-          checkedAtMs = checkedAt; endpointOverride = context.baseUrl;
+          projection = nextProjection; models = nextModels; scope = expectedScope; catalogAccount = nextAccount; modelCredential = credential;
+          checkedAtMs = checkedAt; endpointOverride = context.baseUrl; credentialScope = expectedScope;
         },
       });
     },

package/src/pi/provider.ts

@@ -9,7 +9,7 @@ import { applyTeamModelPolicy } from "../core/models/access.ts";
 import type { BackendModelSelection, EffectiveThinkingLevel } from "../core/models/variants.ts";
 import { createFingerprintProvider, type FingerprintProvider } from "../core/protocol/fingerprint.ts";
 import { CHAT_METHOD } from "../core/protocol/protobuf.ts";
-import { awaitWithSignal, endpoint, isAuthenticationError, RPCError, safeError } from "../core/protocol/transport.ts";
+import { awaitWithSignal, endpoint, isAuthenticationError, isTransientConnectionFailure, RPCError, safeError } from "../core/protocol/transport.ts";
 import { object, requiredString, tokenCount, type Credential, type JsonObject } from "../core/types.ts";
 import { createDevinAccountAuth } from "./auth.ts";
 import { DevinLifecycle, type RequestLease, type SessionBinding } from "./lifecycle.ts";
@@ -18,10 +18,16 @@ import { catalogScope, createDevinModelSource, DEVIN_API, hasExtendedPromptCache
 import { FUSION_LEAD_GUIDANCE } from "./sidekick.ts";
 import { DevinResponseStream } from "./stream.ts";
 import { accountUsage, type AccountUsage } from "./usage.ts";
+import { memoryAccountUsageStore, type AccountUsageStore } from "./usage-store.ts";
 
 type LoginConfiguration = NonNullable<Parameters<typeof createDevinAccountAuth>[0]>["loginOptions"];
 
 /** Like Pi's built-in providers: the caller option wins; otherwise only PI_CACHE_RETENTION=long (provider env first) means long retention. */
+/** Node and Connect report these failures as codes ("read ECONNRESET", "unavailable: …") that Pi's host retry does not match. */
+function hostRetryableMessage(error: unknown, message: string): string {
+  return isTransientConnectionFailure(error) ? `Connection error (${message})` : message;
+}
+
 function resolveCacheRetention(options: SimpleStreamOptions): NonNullable<SimpleStreamOptions["cacheRetention"]> {
   if (options.cacheRetention) return options.cacheRetention;
   return (options.env?.PI_CACHE_RETENTION || process.env.PI_CACHE_RETENTION) === "long" ? "long" : "short";
@@ -33,7 +39,10 @@ export interface DevinProvider extends Provider<typeof DEVIN_API> {
   getFusionChoices(): FusionChoices | undefined;
   /** Rebuilds the model list from the current catalog without network after the saved Fusion choice or display settings change. */
   rebuildModels(): void;
-  /** Quota from the last account status received. Makes no request; undefined if none was received. */
+  /**
+   * Newest quota received for the current credential by this process or another one sharing the usage store.
+   * Makes no request; undefined if none was received or no credential is current.
+   */
   getAccountUsage(): AccountUsage | undefined;
   shutdown(): void;
 }
@@ -50,6 +59,10 @@ export function createDevinProvider(options: {
   recommendedOnly?: () => boolean;
   /** Also lists exact UIDs that a group already covers. Used only by the sidekick child Pi. */
   listsAllExactModels?: boolean;
+  /** Shares the last account quota with other Pi processes using the same agent directory. Kept in memory only when omitted. */
+  accountUsage?: AccountUsageStore;
+  /** Called after the quota or the current credential may have changed, outside Pi event handlers. */
+  onAccountUsage?: () => void;
   now?: () => number;
 } = {}): DevinProvider {
   const lifecycle = new DevinLifecycle(options.maxModelCalls);
@@ -58,7 +71,9 @@ export function createDevinProvider(options: {
   const fingerprints = new Map<string, FingerprintProvider>();
   const accounts = new Map<string, { ownerHash: string; status: JsonObject }>();
   const now = options.now ?? Date.now;
-  let latestUsage: AccountUsage | undefined;
+  const usageStore = options.accountUsage ?? memoryAccountUsageStore();
+  let latestUsage: { scope: string; usage: AccountUsage } | undefined;
+  const usageChanged = () => { try { options.onAccountUsage?.(); } catch { /* A display failure must not affect requests or refreshes. */ } };
   const clientFor = (credential: Credential, extra: DevinClientOptions = {}): DevinClient => {
     const key = catalogScope(credential);
     let fingerprint = fingerprints.get(key);
@@ -78,19 +93,26 @@ export function createDevinProvider(options: {
   const rememberAccount = (credential: Credential, ownerHash: string, status: JsonObject) => {
     if (lifetime.signal.aborted) return;
     if (accounts.size >= 16) accounts.delete(accounts.keys().next().value!);
-    accounts.set(catalogScope(credential), { ownerHash, status });
-    latestUsage = accountUsage(status, now());
+    const scope = catalogScope(credential);
+    accounts.set(scope, { ownerHash, status });
+    latestUsage = { scope, usage: accountUsage(status, now()) };
+    // Subagents and the Fusion sidekick run in other processes; a failed write only loses sharing.
+    try { usageStore.write(scope, latestUsage.usage); } catch { /* best effort */ }
+    usageChanged();
   };
   const auth = createDevinAccountAuth({
     loginOptions: { ...options.loginOptions, fetch: options.loginOptions?.fetch ?? options.fetch },
     createClient: (credential) => clientFor(credential, { profile: "login" }),
     getSignal: () => lifetime.signal,
+    isAccountChecked: (credential) => accounts.has(catalogScope(credential)),
     onValidated: rememberAccount,
-    onInvalidated: (credential, error) => { accounts.delete(catalogScope(credential)); latestUsage = undefined; lifecycle.abort(error); },
+    onInvalidated: (credential, error) => { accounts.delete(catalogScope(credential)); latestUsage = undefined; lifecycle.abort(error); usageChanged(); },
     onLogin: () => {
       accounts.clear(); fingerprints.clear(); latestUsage = undefined; source.invalidate();
       lifecycle.abort(new DOMException("The Devin account was re-authenticated.", "AbortError"));
+      usageChanged();
     },
+    now,
   });
   const authenticationFailed = (credential: Credential, error: unknown, generation: number) => {
     if (!isAuthenticationError(error)) return;
@@ -101,6 +123,7 @@ export function createDevinProvider(options: {
     recommendedOnly: options.recommendedOnly,
     listsAllExactModels: options.listsAllExactModels,
     credentialFromHost: (credential) => credential?.type === "oauth" ? auth.credentialFromHost(credential) : undefined,
+    accountOf: (credential) => accounts.get(catalogScope(credential))?.ownerHash,
     fetchCatalog: async (credential, signal) => {
       const generation = auth.generation;
       auth.assertUsable(credential);
@@ -141,18 +164,20 @@ export function createDevinProvider(options: {
           }
         };
         assertCacheRetention(selected);
+        // The per-request account check (permission and quota) runs here, outside Pi's shared credential lock.
         let account = accounts.get(catalogScope(credential));
-        if (!account) {
-          const probe = clientFor(credential, { profile: "login", fetch: requestOptions.fetch, timeoutMs: requestOptions.timeoutMs });
-          try {
-            const status = await probe.status(signal);
-            signal.throwIfAborted();
-            if (generation !== auth.generation) throw new DOMException("The Devin authentication generation changed.", "AbortError");
-            auth.assertUsable(credential);
-            rememberAccount(credential, requiredString(probe.accountIdentityHash, "Devin account scope"), status);
-            account = accounts.get(catalogScope(credential));
-          } finally { probe.transport.close(); }
-        }
+        const probe = clientFor(credential, { profile: "login", fetch: requestOptions.fetch, timeoutMs: requestOptions.timeoutMs });
+        try {
+          const status = await probe.status(signal);
+          signal.throwIfAborted();
+          if (generation !== auth.generation) throw new DOMException("The Devin authentication generation changed.", "AbortError");
+          auth.assertUsable(credential);
+          rememberAccount(credential, requiredString(probe.accountIdentityHash, "Devin account scope"), status);
+          account = accounts.get(catalogScope(credential));
+        } catch (error) {
+          // A check that cannot reach the server keeps the last known account; the model request reports its own failure.
+          if (!account || signal.aborted || !isTransientConnectionFailure(error)) throw error;
+        } finally { probe.transport.close(); }
         if (!account) throw new Error("The Devin account check was interrupted.");
         assertCanInfer(account.status);
         lease = await lifecycle.acquire(account.ownerHash, signal);
@@ -215,7 +240,7 @@ export function createDevinProvider(options: {
       } catch (error) {
         if (credential) authenticationFailed(credential, error, generation);
         accumulator.message.modelUid = actualUID || undefined;
-        response.fail(safeError(error, credential ? [credential.sessionToken] : []), error instanceof Error && error.name === "AbortError", isRedacted ? undefined : accumulator.message);
+        response.fail(hostRetryableMessage(error, safeError(error, credential ? [credential.sessionToken] : [])), error instanceof Error && error.name === "AbortError", isRedacted ? undefined : accumulator.message);
       } finally { client?.transport.close(); lease?.release(); }
     })();
     return response.stream;
@@ -224,8 +249,20 @@ export function createDevinProvider(options: {
     id: "devin", name: "Devin", auth: { oauth: auth }, lifecycle,
     getModels: source.getModels, filterModels: source.filterModels,
     getFusionChoices: source.getFusionChoices, rebuildModels: source.rebuildModels,
-    getAccountUsage: () => latestUsage ? { ...latestUsage } : undefined,
-    refreshModels: (context) => source.refreshModels({ ...context, signal: AbortSignal.any([context.signal, lifetime.signal]) }),
+    getAccountUsage: () => {
+      const scope = source.currentScope();
+      if (!scope) return undefined;
+      const local = latestUsage?.scope === scope ? latestUsage.usage : undefined;
+      let shared: AccountUsage | undefined;
+      try { shared = usageStore.read(scope); } catch { shared = undefined; }
+      const newest = shared && (!local || shared.fetchedAtMs > local.fetchedAtMs) ? shared : local;
+      return newest ? { ...newest } : undefined;
+    },
+    async refreshModels(context) {
+      // Sign-in, logout and restores change the current credential, which decides whose quota is shown.
+      try { await source.refreshModels({ ...context, signal: AbortSignal.any([context.signal, lifetime.signal]) }); }
+      finally { usageChanged(); }
+    },
     stream: (model, context, requestOptions) => infer(model, context, requestOptions), streamSimple: (model, context, requestOptions) => infer(model, context, requestOptions),
     attachSession(binding) {
       if (lifetime.signal.aborted) lifetime = new AbortController();

package/src/pi/sidekick-report.ts

@@ -30,13 +30,18 @@ export function truncateReport(text: string, maxChars = SIDEKICK_REPORT_CHAR_LIM
 export async function boundReport(text: string, maxChars = SIDEKICK_REPORT_CHAR_LIMIT): Promise<BoundedReport> {
   const result = truncateReport(text, maxChars);
   if (!result.isTruncated) return { text };
-  const notice = `[The sidekick report exceeded about ${SIDEKICK_REPORT_TOKEN_LIMIT} tokens and was cut.`;
+  let notice = `\n\n[The sidekick report exceeded about ${SIDEKICK_REPORT_TOKEN_LIMIT} tokens and was cut.`;
+  let fullReportPath: string | undefined;
   try {
     const directory = await mkdtemp(join(tmpdir(), "pi-devin-sidekick-report-"));
-    const fullReportPath = join(directory, "report.md");
-    await writeFile(fullReportPath, text, { encoding: "utf8", mode: 0o600 });
-    return { text: `${result.text}\n\n${notice} Full report: ${fullReportPath}]`, fullReportPath };
+    const path = join(directory, "report.md");
+    await writeFile(path, text, { encoding: "utf8", mode: 0o600 });
+    fullReportPath = path;
+    notice += ` Full report: ${path}]`;
   } catch (error) {
-    return { text: `${result.text}\n\n${notice} The full report could not be saved: ${error instanceof Error ? error.message : String(error)}]` };
+    notice += ` The full report could not be saved: ${error instanceof Error ? error.message : String(error)}]`;
   }
+  // The notice is part of the same budget, including a filesystem error if preservation failed.
+  const suffix = truncateReport(notice, maxChars).text;
+  return { text: truncateReport(text, maxChars - suffix.length).text + suffix, ...(fullReportPath ? { fullReportPath } : {}) };
 }

package/src/pi/sidekick-runtime.ts

@@ -151,35 +151,38 @@ export class SidekickRuntime {
   }
 
   handoff(message: string): Handoff {
-    if (this.pending) {
+    const current = this.pending;
+    if (current) {
       this.send({ type: "steer", message });
-      return { id: this.pending.id, done: this.pending.done, isSteer: true };
+      return { id: current.id, done: current.done, isSteer: true };
     }
     if (!this.isAlive()) this.start();
     let resolve!: (report: HandoffReport) => void;
     const done = new Promise<HandoffReport>((settle) => { resolve = settle; });
     const id = randomUUID();
     this.pending = { id, startedAt: Date.now(), toolCalls: 0, recentTools: [], isAborted: false, resolve, done };
-    try { this.send({ id, type: "prompt", message }); }
-    catch (error) { this.finish("error", "", error instanceof Error ? error.message : String(error)); }
+    this.send({ id, type: "prompt", message });
     return { id, done, isSteer: false };
   }
 
   abort(): void {
     if (!this.pending) return;
     this.pending.isAborted = true;
-    try { this.send({ type: "abort" }); } catch { this.finish("aborted", ""); }
+    this.send({ type: "abort" });
   }
 
   close(): void {
     const child = this.child;
     this.child = undefined;
     if (this.pending) this.finish("aborted", "", "Stopped the sidekick process.");
+    for (const resolve of this.waiting.values()) resolve(undefined);
+    this.waiting.clear();
     if (!child || child.exitCode !== null || child.signalCode !== null) return;
     child.stdin?.end();
-    child.kill("SIGTERM");
     const timer = setTimeout(() => { if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL"); }, KILL_GRACE_MS);
     timer.unref();
+    child.once("close", () => clearTimeout(timer));
+    child.kill("SIGTERM");
   }
 
   private start(): void {
@@ -195,6 +198,7 @@ export class SidekickRuntime {
     const decoder = new StringDecoder("utf8");
     let buffer = "";
     child.stdout?.on("data", (chunk: Buffer) => {
+      if (this.child !== child) return;
       buffer += decoder.write(chunk);
       let index: number;
       while ((index = buffer.indexOf("\n")) >= 0) {
@@ -205,28 +209,37 @@ export class SidekickRuntime {
         let record: Record<string, unknown>;
         try { record = JSON.parse(line) as Record<string, unknown>; } catch { continue; }
         this.handle(record);
+        if (this.child !== child) return;
       }
     });
-    child.stderr?.on("data", (chunk: Buffer) => { this.stderrTail = (this.stderrTail + chunk.toString("utf8")).slice(-STDERR_TAIL); });
-    child.on("error", (error) => { if (this.child === child) this.finish("error", "", error.message); });
-    child.on("close", () => {
-      if (this.child === child) this.child = undefined;
-      for (const resolve of this.waiting.values()) resolve(undefined);
-      this.waiting.clear();
-      if (this.pending) this.finish("error", "", this.stderrTail.trim() || "The sidekick process exited.");
-    });
+    child.stderr?.on("data", (chunk: Buffer) => { if (this.child === child) this.stderrTail = (this.stderrTail + chunk.toString("utf8")).slice(-STDERR_TAIL); });
+    child.stdin?.on("error", (error) => this.fail(child, error.message));
+    child.on("error", (error) => this.fail(child, error.message));
+    child.on("close", () => this.fail(child, this.stderrTail.trim() || "The sidekick process exited."));
+  }
+
+  /** Transport errors settle the handoff and all RPC waits once, even if the failed child closes after its replacement starts. */
+  private fail(child: ChildProcess | undefined, error: string): void {
+    if (this.child !== child) return;
+    this.finish(this.pending?.isAborted ? "aborted" : "error", "", error);
+    this.close();
   }
 
   private send(value: Record<string, unknown>): void {
-    if (!this.child?.stdin?.writable) throw new Error("Cannot write to the sidekick process.");
-    this.child.stdin.write(JSON.stringify(value) + "\n");
+    const child = this.child;
+    try {
+      if (!child?.stdin?.writable) throw new Error("Cannot write to the sidekick process.");
+      child.stdin.write(JSON.stringify(value) + "\n");
+    } catch (error) {
+      this.fail(child, error instanceof Error ? error.message : String(error));
+    }
   }
 
   private request(type: string): Promise<string | undefined> {
     const id = randomUUID();
     return new Promise((resolve) => {
       this.waiting.set(id, resolve);
-      try { this.send({ id, type }); } catch { this.waiting.delete(id); resolve(undefined); }
+      this.send({ id, type });
     });
   }
 
@@ -247,7 +260,7 @@ export class SidekickRuntime {
       case "extension_ui_request":
         // The sidekick never talks to the user. Dialogs that need an answer are returned as cancelled.
         if (["select", "confirm", "input", "editor"].includes(String(record.method))) {
-          try { this.send({ type: "extension_ui_response", id: record.id, cancelled: true }); } catch { /* shutting down */ }
+          this.send({ type: "extension_ui_response", id: record.id, cancelled: true });
         }
         return;
       case "tool_execution_start":