@code-yeongyu/senpi 2026.10.16-2 → 2026.10.16-4

package/dist/core/package-manager.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { chmodSync, existsSync, globSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
 import { stripBom } from "../utils/text.js";
+import { projectAgentsSkillDirs } from "./trust-manager.js";
 function getEnv() {
     if (process.platform !== "linux" || Object.keys(process.env).length > 0) {
         return process.env;
@@ -207,36 +208,9 @@ function collectFiles(dir, filePattern, skipNodeModules = true, ignoreMatcher, r
     }
     return files;
 }
-function findGitRepoRoot(startDir) {
-    let dir = resolve(startDir);
-    while (true) {
-        if (existsSync(join(dir, ".git"))) {
-            return dir;
-        }
-        const parent = dirname(dir);
-        if (parent === dir) {
-            return null;
-        }
-        dir = parent;
-    }
-}
 function collectAncestorAgentsSkillDirs(startDir) {
-    const skillDirs = [];
-    const resolvedStartDir = resolve(startDir);
-    const gitRepoRoot = findGitRepoRoot(resolvedStartDir);
-    let dir = resolvedStartDir;
-    while (true) {
-        skillDirs.push(join(dir, ".agents", "skills"));
-        if (gitRepoRoot && dir === gitRepoRoot) {
-            break;
-        }
-        const parent = dirname(dir);
-        if (parent === dir) {
-            break;
-        }
-        dir = parent;
-    }
-    return skillDirs;
+    // The same walk the trust check uses: home and above are never project skills (#3420 review).
+    return projectAgentsSkillDirs(startDir);
 }
 function collectAutoPromptEntries(dir) {
     const entries = [];
@@ -1964,9 +1938,7 @@ export class DefaultPackageManager {
         };
         const userAgentsSkillsDir = join(getHomeDir(), ".agents", "skills");
         const projectTrusted = this.settingsManager.isProjectTrusted();
-        const projectAgentsSkillDirs = projectTrusted
-            ? collectAncestorAgentsSkillDirs(this.cwd).filter((dir) => resolve(dir) !== resolve(userAgentsSkillsDir))
-            : [];
+        const projectAgentsSkillDirs = projectTrusted ? collectAncestorAgentsSkillDirs(this.cwd) : [];
         const addResources = (resourceType, paths, metadata, overrides, baseDir) => {
             const target = this.getTargetMap(accumulator, resourceType);
             for (const path of paths) {

package/dist/core/project-trust.d.ts

@@ -2,6 +2,14 @@ import type { LoadExtensionsResult, ProjectTrustContext } from "./extensions/typ
 import type { DefaultProjectTrust } from "./settings-manager.ts";
 import { type ProjectTrustStore } from "./trust-manager.ts";
 export type AppMode = "interactive" | "print" | "json" | "rpc";
+/**
+ * Full access means no prompt anywhere (sisyphuslabs/omo-desktop-app#2465): a session whose
+ * permission preset is explicitly `full-access` trusts its project for that session. Explicit
+ * means the session's `permission-preset` flag (CLI, or `open_session.permissionPreset` through
+ * the launch profile), else the user's global setting. Project settings never count: they are what
+ * trust gates. The implicit default never counts either, so a plain launch keeps asking.
+ */
+export declare function presetTrustsProject(presetFlag: boolean | string | undefined, globalPreset: unknown): boolean;
 export interface ResolveProjectTrustedOptions {
     cwd: string;
     trustStore: ProjectTrustStore;

package/dist/core/project-trust.js

@@ -1,6 +1,18 @@
 import { APP_NAME, CONFIG_DIR_NAME } from "../config.js";
 import { emitProjectTrustEvent } from "./extensions/runner.js";
 import { getProjectTrustOptions, hasTrustRequiringProjectResources, } from "./trust-manager.js";
+/**
+ * Full access means no prompt anywhere (sisyphuslabs/omo-desktop-app#2465): a session whose
+ * permission preset is explicitly `full-access` trusts its project for that session. Explicit
+ * means the session's `permission-preset` flag (CLI, or `open_session.permissionPreset` through
+ * the launch profile), else the user's global setting. Project settings never count: they are what
+ * trust gates. The implicit default never counts either, so a plain launch keeps asking.
+ */
+export function presetTrustsProject(presetFlag, globalPreset) {
+    if (typeof presetFlag === "string")
+        return presetFlag === "full-access";
+    return globalPreset === "full-access";
+}
 function formatProjectTrustPrompt(cwd) {
     return `Trust project folder?\n${cwd}\n\nThis allows ${APP_NAME} to load ${CONFIG_DIR_NAME} settings and resources, install missing project packages, and execute project extensions.`;
 }

package/dist/core/provider-api-key-auth.d.ts

@@ -1,10 +1,18 @@
-import { type ApiKeyAuth, type ModelAuth, type Provider, type ProviderHeaders } from "@earendil-works/pi-ai";
+import { type ApiKeyAuth, type AuthContext, type AuthResult, type ModelAuth, type Provider, type ProviderHeaders } from "@earendil-works/pi-ai";
 import type { ModelsJsonProvider } from "./model-config.ts";
+interface AmbientAuthExtensionInput {
+    name?: string;
+    resolve(input: {
+        ctx: AuthContext;
+        signal: AbortSignal;
+    }): Promise<AuthResult | undefined>;
+}
 interface ProviderAuthExtensionInput {
     apiKey?: string;
     headers?: Record<string, string>;
     authHeader?: boolean;
     oauth?: unknown;
+    ambientAuth?: AmbientAuthExtensionInput;
 }
 export declare function composeApiKeyAuth(providerId: string, base: Provider | undefined, config: ModelsJsonProvider | undefined, extension: ProviderAuthExtensionInput | undefined): ApiKeyAuth | undefined;
 export declare function configuredApiKey(config: ModelsJsonProvider | undefined, extension: ProviderAuthExtensionInput | undefined): string | undefined;

package/dist/core/provider-api-key-auth.js

@@ -8,6 +8,14 @@ export function composeApiKeyAuth(providerId, base, config, extension) {
     const rawHeaders = configuredHeaders(config, extension);
     const headerSource = headerAuthResolutionSource(config?.headers, extension?.headers);
     const authHeader = extension?.authHeader ?? config?.authHeader ?? false;
+    const ambient = extension?.ambientAuth;
+    if (!inherited && rawKey === undefined && !headerSource && ambient) {
+        // A shared cloud credential chain (Google ADC, AWS env) owns the lane: an
+        // explicitly configured key, credential headers, or a base provider still
+        // win, and a resolution marked ambient never outranks a configured
+        // provider in automatic default selection (senpi#2327).
+        return ambientApiKeyAuth(providerId, ambient, rawHeaders, headerSource, authHeader);
+    }
     if (!inherited && rawKey === undefined && !headerSource && oauth) {
         // An OAuth provider with no key, no credential headers and no base normally
         // gets no api-key auth at all. Providers with ambient credentials still
@@ -101,6 +109,32 @@ function ambientOnlyAuth(providerId, oauth, rawHeaders, headerSource, authHeader
         resolve,
     };
 }
+/**
+ * Api-key adapter for extension providers whose credentials live in a shared
+ * cloud credential chain (Google ADC, AWS env). No login is offered — the chain
+ * is the only source — and `Models.checkAuth` resolves this auth, so the
+ * `ambient` marker reaches the provider's auth status.
+ */
+function ambientApiKeyAuth(providerId, ambient, rawHeaders, headerSource, authHeader) {
+    const resolve = async (input) => {
+        const result = await ambient.resolve({ ctx: input.ctx, signal: input.signal });
+        if (!result)
+            return undefined;
+        const explicitEnv = { ...(input.credential?.env ?? {}), ...(result.env ?? {}) };
+        const headerEnv = await configContextEnv(Object.values(rawHeaders ?? {}), input.ctx, explicitEnv);
+        const headers = await resolveHeadersOrThrow(rawHeaders, `provider "${providerId}"`, headerEnv);
+        return {
+            ...result,
+            auth: withConfiguredAuth(result.auth, headers, authHeader),
+            source: result.source ?? headerSource,
+        };
+    };
+    return {
+        name: ambient.name ?? "Ambient credentials",
+        ambientOnly: true,
+        resolve,
+    };
+}
 export function configuredApiKey(config, extension) {
     return extension?.apiKey ?? config?.apiKey;
 }

package/dist/core/provider-composer.d.ts

@@ -80,6 +80,15 @@ export interface ProviderConfigInput {
     extraBody?: Record<string, unknown>;
     authHeader?: boolean;
     oauth?: ExtensionOAuthConfig;
+    /**
+     * Ambient api-key auth resolved from a shared cloud credential chain (Google
+     * ADC, AWS env) rather than a credential configured for this provider. The
+     * provider counts as configured only while `resolve` yields a result, and the
+     * ambient marker keeps it from outranking a provider the user configured when
+     * the automatic default model is chosen (senpi#2327). Ignored when `apiKey`,
+     * credential headers, or a base provider already supply auth.
+     */
+    ambientAuth?: ProviderAmbientAuth;
     retryPolicy?: RetryPolicyProfile;
     models?: ProviderModelConfig[];
     refreshModels?(context: RefreshModelsContext): Promise<ProviderModelConfig[]>;
@@ -92,6 +101,20 @@ export interface ProviderConfigInput {
      */
     fallbackEligible?(): boolean;
 }
+/** Ambient api-key auth hook for extension providers (see `ProviderConfigInput.ambientAuth`). */
+export interface ProviderAmbientAuth {
+    /** Display name, e.g. "Google Cloud credentials". */
+    name?: string;
+    /**
+     * Resolve from the ambient chain. `undefined` means the chain currently
+     * supplies no credential, so the provider stays unavailable. A returned
+     * result should carry `ambient: true`.
+     */
+    resolve(input: {
+        ctx: AuthContext;
+        signal: AbortSignal;
+    }): Promise<AuthResult | undefined>;
+}
 export type AuthStatus = {
     configured: boolean;
     source?: "stored" | "runtime" | "environment" | "fallback" | "models_json_key" | "models_json_command" | HeaderAuthStatusSource;

package/dist/core/resource-loader.d.ts

@@ -1,6 +1,8 @@
 import { type Theme } from "../modes/interactive/theme/theme.ts";
 import type { ResourceDiagnostic } from "./diagnostics.ts";
 export type { ResourceCollision, ResourceDiagnostic } from "./diagnostics.ts";
+export { loadProjectContextFiles };
+import { loadProjectContextFiles } from "./context-files.ts";
 import { type EventBus } from "./event-bus.ts";
 import type { HostMcpRegistry } from "./extensions/builtin/mcp/host-registry.ts";
 import type { ExtensionFactory, InlineExtension, LoadExtensionsResult, LoadedHookSources, SessionContext, SessionKind } from "./extensions/types.ts";
@@ -64,6 +66,7 @@ export interface ResourceLoader {
             path: string;
             content: string;
         }>;
+        diagnostics?: ResourceDiagnostic[];
     };
     getSystemPrompt(): string | undefined;
     getSystemPromptSource(): {
@@ -85,13 +88,6 @@ export interface ResourceLoader {
  * session. Canonicalizing collapses both spellings to one path.
  */
 export declare function canonicalizeGlobalDefaultExtensionModulePath(modulePath: string): string;
-export declare function loadProjectContextFiles(options: {
-    cwd: string;
-    agentDir: string;
-}): Array<{
-    path: string;
-    content: string;
-}>;
 export interface DefaultResourceLoaderOptions {
     cwd: string;
     agentDir: string;
@@ -185,6 +181,7 @@ export declare class DefaultResourceLoader implements ResourceLoader {
     private themes;
     private themeDiagnostics;
     private agentsFiles;
+    private contextDiagnostics;
     private systemPrompt?;
     private systemPromptSourcePath?;
     private appendSystemPrompt;
@@ -222,6 +219,7 @@ export declare class DefaultResourceLoader implements ResourceLoader {
             path: string;
             content: string;
         }>;
+        diagnostics: ResourceDiagnostic[];
     };
     getSystemPrompt(): string | undefined;
     getSystemPromptSource(): {

package/dist/core/resource-loader.js

@@ -1,5 +1,5 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
-import { basename, dirname, join, resolve, sep } from "node:path";
+import { dirname, join, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { detectCapabilities, getTerminalColorMode } from "@earendil-works/pi-tui";
 import chalk from "chalk";
@@ -7,22 +7,24 @@ import { APP_NAME, CONFIG_DIR_NAME, findNodePackageDir, getAgentDir, getPackageD
 import { loadThemeFromPath } from "../modes/interactive/theme/theme.js";
 import { resolveInstallPath } from "../runtime-snapshot/marker.js";
 import { ACCEPTED_SHIM_BANNERS, GENERATED_SHIM_BANNER } from "./generated-shim-banner.js";
+export { loadProjectContextFiles };
 import { canonicalizePath, isLocalPath, resolvePath } from "../utils/paths.js";
 import { stripBom } from "../utils/text.js";
 import { bundledBuiltinExtensions } from "./bundled-resources.js";
+import { loadProjectContextFiles } from "./context-files.js";
 import { createEventBus } from "./event-bus.js";
 import { builtinExtensions, globalDefaultExtensionFactories, globalDefaultExtensionIds, } from "./extensions/builtin/index.js";
 import { createMcpExtension } from "./extensions/builtin/mcp/index.js";
 import { McpService } from "./extensions/builtin/mcp/service.js";
 import { createExtensionRuntime, loadExtensionFromFactory, loadExtensions, } from "./extensions/loader.js";
 import { EMPTY_SESSION_CONTEXT } from "./extensions/types.js";
-import { findGitPaths } from "./footer-data-provider.js";
 import { dedupePathsByPackageIdentity, findNearestPackageIdentity } from "./package-identity.js";
 import { DefaultPackageManager } from "./package-manager.js";
 import { loadPromptTemplates } from "./prompt-templates.js";
 import { memoizeResolvedPaths, resolvedPathsMemoKey } from "./resolved-paths-memo.js";
 import { SettingsManager } from "./settings-manager.js";
 import { loadSkills } from "./skills.js";
+import { warnIfLargeSkillCatalog } from "./skills-prompt.js";
 import { BUILTIN_PATH_PREFIX, createSourceInfo, getSyntheticPathSource, isSyntheticPath, } from "./source-info.js";
 import { resetTimings, time } from "./timings.js";
 const HOST_PROVIDED_EXTENSION_PACKAGES = new Set([
@@ -256,86 +258,9 @@ function resolveGeneratedGlobalDefaultExtensionFactory(extensionPath, agentDir)
         return undefined;
     }
 }
-function loadContextFileFromDir(dir) {
-    const candidates = ["AGENTS.override.md", "AGENTS.md", "AGENTS.MD", "CLAUDE.md", "CLAUDE.MD"];
-    for (const filename of candidates) {
-        const filePath = join(dir, filename);
-        if (existsSync(filePath)) {
-            try {
-                if (!statSync(filePath).isFile()) {
-                    continue;
-                }
-                return {
-                    path: filePath,
-                    content: stripBom(readFileSync(filePath, "utf-8")),
-                };
-            }
-            catch (error) {
-                console.error(chalk.yellow(`Warning: Could not read ${filePath}: ${error}`));
-            }
-        }
-    }
-    return null;
-}
-/**
- * The main repo's context file that a nested linked worktree's own copy shadows: both
- * occupy the same logical repository scope, so loading both applies that context twice. Returns
- * undefined when nothing is shadowed, leaving normal ancestor inheritance alone.
- *
- * Returned canonicalized (realpath), because `git worktree add` writes the `.git`
- * file's `gitdir:` target in realpath form while cwd may still be symlinked
- * (macOS `/tmp` -> `/private/tmp`).
- */
-function findShadowedContextFile(cwd) {
-    const gitPaths = findGitPaths(cwd);
-    if (!gitPaths)
-        return undefined;
-    const commonGitDir = canonicalizePath(gitPaths.commonGitDir);
-    const worktreeRoot = canonicalizePath(gitPaths.repoDir);
-    const mainRepoRoot = dirname(commonGitDir);
-    // False for an ordinary repo, where the two are the same dir, and for a sibling
-    // worktree (`git worktree add ../feat`), whose main repo is not an ancestor.
-    if (!worktreeRoot.startsWith(`${mainRepoRoot}${sep}`))
-        return undefined;
-    // dirname of the common git dir is the main worktree root only when that dir is
-    // itself checked out from the same repo. In a bare layout (`proj/.bare` +
-    // `proj/main`) it is just the directory holding `.bare`, which tracks nothing; a
-    // submodule's gitdir has no `commondir`, so it lands under `.git/modules`.
-    if (canonicalizePath(join(mainRepoRoot, ".git")) !== commonGitDir)
-        return undefined;
-    const worktreeContextFile = loadContextFileFromDir(worktreeRoot);
-    return worktreeContextFile ? join(mainRepoRoot, basename(worktreeContextFile.path)) : undefined;
-}
-export function loadProjectContextFiles(options) {
-    const resolvedCwd = resolvePath(options.cwd);
-    const resolvedAgentDir = resolvePath(options.agentDir);
-    const contextFiles = [];
-    const seenPaths = new Set();
-    const globalContext = loadContextFileFromDir(resolvedAgentDir);
-    if (globalContext) {
-        contextFiles.push(globalContext);
-        seenPaths.add(globalContext.path);
-    }
-    const ancestorContextFiles = [];
-    const shadowedContextFile = findShadowedContextFile(resolvedCwd);
-    let currentDir = resolvedCwd;
-    while (true) {
-        const contextFile = loadContextFileFromDir(currentDir);
-        const isShadowed = shadowedContextFile !== undefined && canonicalizePath(contextFile?.path ?? "") === shadowedContextFile;
-        if (contextFile && !isShadowed && !seenPaths.has(contextFile.path)) {
-            ancestorContextFiles.unshift(contextFile);
-            seenPaths.add(contextFile.path);
-        }
-        const parentDir = dirname(currentDir);
-        if (parentDir === currentDir)
-            break;
-        currentDir = parentDir;
-    }
-    contextFiles.push(...ancestorContextFiles);
-    return contextFiles;
-}
 export class DefaultResourceLoader {
     constructor(options) {
+        this.contextDiagnostics = [];
         this.cwd = resolvePath(options.cwd);
         this.agentDir = resolvePath(options.agentDir);
         this.settingsManager = options.settingsManager ?? SettingsManager.create(this.cwd, this.agentDir);
@@ -421,7 +346,7 @@ export class DefaultResourceLoader {
         return { themes: this.themes, diagnostics: this.themeDiagnostics };
     }
     getAgentsFiles() {
-        return { agentsFiles: this.agentsFiles };
+        return { agentsFiles: this.agentsFiles, diagnostics: this.contextDiagnostics };
     }
     getSystemPrompt() {
         return this.systemPrompt;
@@ -616,14 +541,16 @@ export class DefaultResourceLoader {
         }
         const agentsFiles = {
             agentsFiles: this.noContextFiles
-                ? []
+                ? Object.assign([], { diagnostics: [] })
                 : loadProjectContextFiles({
                     cwd: this.cwd,
                     agentDir: this.agentDir,
+                    ...this.settingsManager.getSettings().contextFiles,
                 }),
         };
         const resolvedAgentsFiles = this.agentsFilesOverride ? this.agentsFilesOverride(agentsFiles) : agentsFiles;
-        this.agentsFiles = resolvedAgentsFiles.agentsFiles;
+        this.agentsFiles = [...resolvedAgentsFiles.agentsFiles];
+        this.contextDiagnostics = agentsFiles.agentsFiles.diagnostics;
         time("contextFiles", "extensions");
         // SYSTEM.md / APPEND_SYSTEM.md file discovery was intentionally removed; the explicit
         // options are the only static prompt source (see packages/coding-agent/changes.md).
@@ -872,7 +799,7 @@ export class DefaultResourceLoader {
                 skill.sourceInfo ??
                 this.getDefaultSourceInfoForPath(skill.filePath),
         }));
-        this.skillDiagnostics = resolvedSkills.diagnostics;
+        this.skillDiagnostics = [...resolvedSkills.diagnostics, ...warnIfLargeSkillCatalog(this.skills)];
     }
     updatePromptsFromPaths(promptPaths, metadataByPath) {
         let promptsResult;

package/dist/core/retry-fallback/circuit-probes.d.ts

@@ -16,6 +16,7 @@ export declare class CircuitProbes {
     constructor(circuits: FallbackCircuitAccess | undefined);
     isOpen(selector: string): boolean;
     governs(selector: string): boolean;
+    isExhausted(selector: string): boolean;
     admit(selector: string): CircuitAdmission["kind"];
     holds(selector: string): boolean;
     get probing(): string | undefined;

package/dist/core/retry-fallback/circuit-probes.js

@@ -23,6 +23,9 @@ export class CircuitProbes {
     governs(selector) {
         return this.circuits?.governs(selector) ?? false;
     }
+    isExhausted(selector) {
+        return this.circuits?.isExhausted(selector) ?? false;
+    }
     admit(selector) {
         const admission = this.circuits?.admit(selector) ?? { kind: "closed" };
         if (admission.kind === "probe" && this.token?.selector !== selector) {

package/dist/core/retry-fallback/circuit.d.ts

@@ -29,6 +29,8 @@ export interface CircuitOpenRequest {
     retryAfterMs?: number;
     /** The reset window a usage limit named for itself; when present it alone sets the open. */
     resetWindowMs?: number;
+    /** The failure is a verdict for every session: the entry is spent (billing, quota, an account limit). A provider-named wait is not. */
+    exhausted?: boolean;
 }
 export interface ProbeToken {
     readonly selector: string;
@@ -63,6 +65,7 @@ export declare class FallbackCircuitBreaker {
     releaseOwnersWithPrefix(prefix: string): void;
     close(selector: string): void;
     has(selector: string): boolean;
+    isExhausted(selector: string): boolean;
     sweep(now: number): void;
 }
 /**
@@ -80,6 +83,8 @@ export interface FallbackCircuitAccess {
     /** Whether the breaker holds any state for the selector, i.e. it, not a session cooldown, governs recovery. */
     governs(selector: string): boolean;
     isOpen(selector: string, lane?: CircuitLane): boolean;
+    /** Whether the open circuit records a verdict every session should act on: the entry is spent. */
+    isExhausted(selector: string): boolean;
     admit(selector: string, lane?: CircuitLane): CircuitAdmission;
     release(token: ProbeToken): void;
     releaseAll(): void;

package/dist/core/retry-fallback/circuit.js

@@ -1,6 +1,7 @@
 import { resolve } from "node:path";
 import { parseRetryAfterMsMarker } from "@earendil-works/pi-ai/utils/retry-hint";
 import { usageLimitReset } from "../credential-pool/reset-time.js";
+import { isHealthExhaustionFailure } from "./circuit-probes.js";
 import { usageLimitScope } from "./usage-limit.js";
 /**
  * Fallback-chain circuit breaker. An entry that fails out of a configured chain
@@ -34,8 +35,14 @@ export class FallbackCircuitBreaker {
     }
     open(selector, request) {
         const previous = this.circuits.get(selector);
-        const consecutiveOpens = (previous?.consecutiveOpens ?? 0) + 1;
-        const cooldownMs = Math.min(request.cooldownMs * 2 ** (consecutiveOpens - 1), request.maxCooldownMs);
+        // A failure while the circuit is still open (concurrent sessions failing together) belongs to
+        // the same open episode: it takes no backoff step. Only a failure once the open has elapsed, a
+        // failed half-open probe, advances it (senpi#3467).
+        const sameEpisode = previous !== undefined && request.now < previous.openUntil;
+        const consecutiveOpens = (previous?.consecutiveOpens ?? 0) + (sameEpisode ? 0 : 1);
+        const cooldownMs = sameEpisode
+            ? previous.cooldownMs
+            : Math.min(request.cooldownMs * 2 ** (consecutiveOpens - 1), request.maxCooldownMs);
         const retryAfterMs = request.retryAfterMs;
         const hinted = retryAfterMs !== undefined && Number.isFinite(retryAfterMs) && retryAfterMs > 0
             ? request.now + retryAfterMs
@@ -53,7 +60,7 @@ export class FallbackCircuitBreaker {
         const hintedUntil = Math.min(retryFloorUntil, request.now + request.maxCooldownMs);
         const openUntil = resetWindowMs !== undefined && Number.isFinite(resetWindowMs) && resetWindowMs > 0
             ? Math.max(request.now + Math.min(resetWindowMs, request.maxCooldownMs), hintedUntil)
-            : Math.max(request.now + cooldownMs, hintedUntil);
+            : Math.max(sameEpisode ? previous.openUntil : request.now + cooldownMs, hintedUntil);
         this.circuits.set(selector, {
             openUntil,
             retryFloorUntil,
@@ -61,6 +68,7 @@ export class FallbackCircuitBreaker {
             cooldownMs,
             maxCooldownMs: request.maxCooldownMs,
             probe: undefined,
+            exhausted: request.exhausted === true || (sameEpisode && previous.exhausted),
         });
         return openUntil;
     }
@@ -111,6 +119,9 @@ export class FallbackCircuitBreaker {
     has(selector) {
         return this.circuits.has(selector);
     }
+    isExhausted(selector) {
+        return this.circuits.get(selector)?.exhausted === true;
+    }
     sweep(now) {
         for (const [selector, circuit] of this.circuits) {
             if (!circuit.probe && now >= circuit.openUntil + circuit.maxCooldownMs)
@@ -137,10 +148,22 @@ export function createFallbackCircuitAccess(deps) {
                 : undefined;
             const resetWindowMs = reset !== undefined && (reset.kind === "absolute" || reset.ms >= cooldownMs) ? reset.ms : undefined;
             deps.breaker.sweep(now);
-            const openUntil = deps.breaker.open(selector, { now, cooldownMs, maxCooldownMs, retryAfterMs, resetWindowMs });
+            // Only a verdict that the entry is spent for everyone (billing, quota, an account usage limit) moves
+            // sessions that never failed on it. A slow request, an overload or a rate limit with a Retry-After is
+            // this session's view: siblings keep their model and find out on their own request (senpi#3467).
+            const exhausted = message !== undefined && (isHealthExhaustionFailure(message) || usageLimitScope(message) === "account");
+            const openUntil = deps.breaker.open(selector, {
+                now,
+                cooldownMs,
+                maxCooldownMs,
+                retryAfterMs,
+                resetWindowMs,
+                exhausted,
+            });
             deps.logger.info("circuit_opened", { selector, durationMs: openUntil - now, retryAfterMs, resetWindowMs });
         },
         governs: (selector) => enabled() && deps.breaker.has(selector),
+        isExhausted: (selector) => enabled() && deps.breaker.isExhausted(selector),
         isOpen: (selector, lane = "turn") => enabled() && deps.breaker.isOpen(selector, deps.now(), laneOwner(deps.owner(), lane)),
         admit: (selector, lane = "turn") => enabled() ? deps.breaker.admit(selector, deps.now(), laneOwner(deps.owner(), lane)) : { kind: "closed" },
         release: (token) => deps.breaker.release(token),

package/dist/core/retry-fallback/controller.d.ts

@@ -10,6 +10,7 @@ export declare class RetryFallbackController {
     private lastExhaustedChainKey;
     private heldForNetworkBlip;
     private blipModel;
+    private readonly ownFailures;
     private readonly unusable;
     readonly probes: CircuitProbes;
     private canonicalCache;
@@ -56,6 +57,8 @@ export declare class RetryFallbackController {
     notifyCompactionApplied(): boolean;
     /** A user-driven model change abandons the fallback window entirely. */
     clearForManualModelChange(model: Model<Api>): void;
+    /** A response this session got from `selector` succeeded: the entry serves it again (senpi#3467). */
+    noteServed(selector: string): void;
     /**
      * Records a failure that makes the entry unusable for every session - billing
      * or quota exhaustion, or a transient failure that spent its budget or failed a
@@ -63,10 +66,12 @@ export declare class RetryFallbackController {
      */
     noteHealthFailure(model: Model<Api>, thinkingLevel: ThinkingLevel | undefined, failure: CircuitFailure): void;
     /**
-     * Turn-boundary skip: when the current entry's circuit was opened by this or a
-     * sibling session, move to the next closed entry without spending a request on
-     * it. With no closed entry left the current one stays and probes, so the chain
-     * never refuses a turn; a half-open current entry is claimed for this session.
+     * Turn-boundary skip: when the current entry's circuit is open because this session
+     * saw it fail (and has not been served by it since), or because its account is spent
+     * for everyone, move to the next closed entry without spending a request on it. A
+     * sibling's bare failure or Retry-After never moves this session (senpi#3467). With no
+     * closed entry left the current one stays and probes, so the chain never refuses a
+     * turn; a half-open current entry is claimed for this session.
      */
     rerouteAroundOpenCircuit(): Promise<boolean>;
     tryFallback(reason: FallbackReason, failure: {

package/dist/core/retry-fallback/controller.js

@@ -11,6 +11,9 @@ export class RetryFallbackController {
         this.triedSelectors = new Set();
         // A fallback forced by a network blip serves out its turn; only the next turn boundary reverts it.
         this.heldForNetworkBlip = false;
+        // Entries this session itself saw fail out of a chain: only these (or an entry spent for everyone)
+        // may move the session off its model at a turn boundary (senpi#3467).
+        this.ownFailures = new Set();
         this.deps = deps;
         this.probes = new CircuitProbes(deps.circuits);
         this.unusable = new UnusableEntries(deps.cooldowns);
@@ -159,11 +162,17 @@ export class RetryFallbackController {
         }
         this.state = undefined;
         this.heldForNetworkBlip = false;
+        this.ownFailures.delete(formatSelector(model));
         this.deps.cooldowns.clearModel(formatSelector(model));
         this.unusable.clear(model);
         this.probes.release();
         this.deps.circuits?.close(formatSelector(model));
     }
+    /** A response this session got from `selector` succeeded: the entry serves it again (senpi#3467). */
+    noteServed(selector) {
+        this.ownFailures.delete(selector);
+        this.probes.accept(selector);
+    }
     /**
      * Records a failure that makes the entry unusable for every session - billing
      * or quota exhaustion, or a transient failure that spent its budget or failed a
@@ -176,21 +185,29 @@ export class RetryFallbackController {
         // A pure network fault is the transport's, not the model's: it never opens the shared circuit (senpi#3306).
         if (isPureNetworkTransient(failure.errorMessage))
             return;
+        this.ownFailures.add(formatSelector(model));
         this.probes.noteFailure(formatSelector(model), failure);
     }
     /**
-     * Turn-boundary skip: when the current entry's circuit was opened by this or a
-     * sibling session, move to the next closed entry without spending a request on
-     * it. With no closed entry left the current one stays and probes, so the chain
-     * never refuses a turn; a half-open current entry is claimed for this session.
+     * Turn-boundary skip: when the current entry's circuit is open because this session
+     * saw it fail (and has not been served by it since), or because its account is spent
+     * for everyone, move to the next closed entry without spending a request on it. A
+     * sibling's bare failure or Retry-After never moves this session (senpi#3467). With no
+     * closed entry left the current one stays and probes, so the chain never refuses a
+     * turn; a half-open current entry is claimed for this session.
      */
     async rerouteAroundOpenCircuit() {
         const current = this.deps.getCurrentSelector();
         if (!this.deps.circuits || !current)
             return false;
         const currentBase = formatSelector(current.model);
+        // A half-open entry is still claimed as this session's single probe whoever opened it.
         if (this.probes.admit(currentBase) !== "open")
             return false;
+        // Another session's bare failure says this entry was slow for that session, not that it is
+        // down for this one: a session that never failed on it keeps its model and finds out itself.
+        if (!this.ownFailures.has(currentBase) && !this.probes.isExhausted(currentBase))
+            return false;
         const candidate = this.nextCandidate(false, true);
         if (!candidate || candidate.circuitOpen)
             return false;