@code-yeongyu/senpi 2026.11.2-3 → 2026.11.3-2

package/dist/core/extensions/builtin/anthropic-subscription/account-block-log.js

@@ -0,0 +1,18 @@
+import { seatDigest } from "./seat-digest.js";
+import { logContinuityEvent } from "./session-observability.js";
+const MAX_DETAIL_CHARS = 200;
+/**
+ * Writes one `account_blocked` line to session.log for every block that is saved, so a pool that later
+ * refuses a request locally has a recorded cause (senpi#4671). The account is named by its seat digest,
+ * never its name (Desktop#4753); an unknown end time is left out rather than guessed.
+ */
+export function logAccountBlocked(record) {
+    logContinuityEvent("account_blocked", {
+        seat: seatDigest(record.account),
+        reason: record.reason,
+        ...(record.until === undefined ? {} : { until: new Date(record.until).toISOString() }),
+        shared: record.shared,
+        error: record.detail.slice(0, MAX_DETAIL_CHARS),
+    });
+}
+//# sourceMappingURL=account-block-log.js.map

package/dist/core/extensions/builtin/anthropic-subscription/affinity.d.ts

@@ -31,6 +31,12 @@ export type UnavailableAccount = {
 };
 /** The origin of an account pin, highest precedence first (`resolveClaudeAccountPin`). */
 export type PinSource = "cli" | "settings" | "stored";
+/** One pool member's state when the pool refused a request: why it is out, and until when. */
+export type BlockedAccountState = {
+    readonly name: string;
+    readonly reason: string;
+    readonly until: number | undefined;
+};
 export declare class AllAccountsBlockedError extends Error {
     readonly soonestUnblockAt: number | undefined;
     /**
@@ -49,7 +55,9 @@ export declare class AllAccountsBlockedError extends Error {
     readonly limitedModel: string | undefined;
     /** Set only when account fallback is off, so the guidance names that account instead of the whole pool. */
     readonly unavailableAccount: UnavailableAccount | undefined;
-    constructor(soonestUnblockAt: number | undefined, blockReason?: "auth_error", limitedModel?: string, unavailableAccount?: UnavailableAccount);
+    /** Every candidate's state, so the error names which account needs /login and which waits on a reset (senpi#4671). */
+    readonly accounts: readonly BlockedAccountState[];
+    constructor(soonestUnblockAt: number | undefined, blockReason?: "auth_error", limitedModel?: string, unavailableAccount?: UnavailableAccount, accounts?: readonly BlockedAccountState[]);
 }
 export declare function getAffinityKey(options: Pick<AffinityOptions, "affinityKey" | "sessionId">): string;
 /**

package/dist/core/extensions/builtin/anthropic-subscription/affinity.js

@@ -2,14 +2,21 @@ import { createHash } from "node:crypto";
 import { applyAccountOrder } from "@earendil-works/pi-ai/auth/pool/select";
 import { activeModelBlockUntil, pruneModelBlocks } from "../../../credential-pool/model-scope.js";
 export const DEFAULT_AFFINITY_KEY = "claude-sdk-oauth-default";
+function describeAccountState(state) {
+    const until = state.until === undefined ? "re-login" : new Date(state.until).toISOString();
+    const login = state.reason === "auth_error" ? ` (run /login anthropic-subscription for ${state.name})` : "";
+    return `${state.name}: ${state.reason} until ${until}${login}`;
+}
 export class AllAccountsBlockedError extends Error {
-    constructor(soonestUnblockAt, blockReason, limitedModel, unavailableAccount) {
+    constructor(soonestUnblockAt, blockReason, limitedModel, unavailableAccount, accounts = []) {
         const until = soonestUnblockAt === undefined ? undefined : new Date(soonestUnblockAt).toISOString();
-        super(limitedModel !== undefined && until !== undefined
+        const summary = limitedModel !== undefined && until !== undefined
             ? `All Anthropic Subscription accounts have hit the usage limit for model ${limitedModel} until ${until}.`
             : until === undefined
                 ? "All Anthropic Subscription accounts are blocked until re-login."
-                : `All Anthropic Subscription accounts are blocked until ${until}.`);
+                : `All Anthropic Subscription accounts are blocked until ${until}.`;
+        super(accounts.length === 0 ? summary : `${summary} Accounts: ${accounts.map(describeAccountState).join("; ")}.`);
+        this.accounts = accounts;
         this.limitedModel = limitedModel;
         this.name = "AllAccountsBlockedError";
         this.soonestUnblockAt = soonestUnblockAt;
@@ -119,6 +126,10 @@ export function selectAccount(accounts, options = {}) {
         return afterClear;
     throw new AllAccountsBlockedError(soonestUnblockAt(candidates, now, options.model), candidates.length > 0 && candidates.every((account) => account.blockReason === "auth_error")
         ? "auth_error"
-        : undefined, limitedModel(candidates, now, options.model), unavailableAccount);
+        : undefined, limitedModel(candidates, now, options.model), unavailableAccount, candidates.map((account) => ({
+        name: account.name,
+        reason: account.blockReason ?? (isAccountBlocked(account, now) ? "blocked" : "model_limit"),
+        until: unblockAt(account, now, options.model),
+    })));
 }
 //# sourceMappingURL=affinity.js.map

package/dist/core/extensions/builtin/anthropic-subscription/failover.d.ts

@@ -1,5 +1,6 @@
 import type { CredentialStore } from "@earendil-works/pi-ai";
 import type { AccountSlot } from "./accounts.ts";
+import { AllAccountsBlockedError } from "./affinity.ts";
 import type { SdkErrorClassification } from "./errors.ts";
 export declare const MAX_RATE_LIMIT_BLOCK_MS: number;
 export declare const DEFAULT_RATE_LIMIT_BLOCK_MS = 60000;
@@ -49,7 +50,12 @@ export declare class ClassifiedSdkError extends Error {
     readonly classification: SdkErrorClassification;
     readonly original: unknown;
     readonly suppressTurnRetry: boolean;
-    constructor(classification: SdkErrorClassification, original: unknown, suppressTurnRetry: boolean);
+    /**
+     * The pool's state when this failure left no other account to try (senpi#4671). The failure stays the
+     * error; the pool refusal is context, so a refresh failure or a 401 is never hidden behind "all blocked".
+     */
+    readonly poolState: AllAccountsBlockedError | undefined;
+    constructor(classification: SdkErrorClassification, original: unknown, suppressTurnRetry: boolean, poolState?: AllAccountsBlockedError);
 }
 /**
  * Runs one attempt per account for account-level failures (a limit, billing, auth), plus at most

package/dist/core/extensions/builtin/anthropic-subscription/failover.js

@@ -1,6 +1,7 @@
 import { AUTH_BLOCK_REPROBE_MS } from "../../../credential-pool/auth-reprobe.js";
 import { activeModelBlockUntil, mergeModelBlocks, modelBlockKey, pruneModelBlocks, withModelBlock, } from "../../../credential-pool/model-scope.js";
 import { usageLimitResetMs } from "../../../credential-pool/reset-time.js";
+import { logAccountBlocked } from "./account-block-log.js";
 import { AllAccountsBlockedError, clearExpiredBlocks } from "./affinity.js";
 import { isConfirmedAccountUsageLimit, usageLimitBlockMs } from "./usage-limit-block.js";
 export const MAX_RATE_LIMIT_BLOCK_MS = 48 * 60 * 60 * 1_000;
@@ -91,13 +92,14 @@ export function forgetSessionBlocksFor(name) {
     return lifted;
 }
 export class ClassifiedSdkError extends Error {
-    constructor(classification, original, suppressTurnRetry) {
+    constructor(classification, original, suppressTurnRetry, poolState) {
         const detail = original instanceof Error ? original.message : String(original);
-        super(`${suppressTurnRetry ? TURN_RETRY_SUPPRESSION_PREFIX : ""}${detail}`);
+        super(`${suppressTurnRetry ? TURN_RETRY_SUPPRESSION_PREFIX : ""}${detail}`, poolState === undefined ? undefined : { cause: poolState });
         this.name = "ClassifiedSdkError";
         this.classification = classification;
         this.original = original;
         this.suppressTurnRetry = suppressTurnRetry;
+        this.poolState = poolState;
     }
 }
 function record(value) {
@@ -356,6 +358,13 @@ export async function* runFailover(options) {
                 attempt--;
                 continue;
             }
+            logAccountBlocked({
+                account: blocked.name,
+                reason: blocked.blockReason ?? "model_limit",
+                until: blocked.blockedUntil ?? activeModelBlockUntil(blocked.modelBlocks, options.model, now()),
+                shared,
+                detail: errorText(error),
+            });
             accounts = replaceAccount(accounts, blocked);
             const event = {
                 account: blocked,
@@ -363,14 +372,22 @@ export async function* runFailover(options) {
                 attempt: attempt + 1,
                 visibleDeltaEmitted,
             };
+            let poolState;
             try {
                 if (!visibleDeltaEmitted && attempt + 1 < attemptLimit) {
                     event.nextAccount = options.selectFn(accounts);
                 }
             }
+            catch (selectError) {
+                if (!(selectError instanceof AllAccountsBlockedError))
+                    throw selectError;
+                poolState = selectError;
+            }
             finally {
                 await options.onFailover?.(event);
             }
+            if (poolState !== undefined)
+                throw new ClassifiedSdkError(classification, error, visibleDeltaEmitted, poolState);
             if (visibleDeltaEmitted)
                 throw classified;
         }

package/dist/core/extensions/builtin/anthropic-subscription/guidance.d.ts

@@ -1,8 +1,14 @@
-import type { PinSource, UnavailableAccount } from "./affinity.ts";
+import type { BlockedAccountState, PinSource, UnavailableAccount } from "./affinity.ts";
 import type { SdkErrorKind } from "./errors.ts";
 import type { ClaudeCodeRun } from "./executable.ts";
 export declare function noAccountGuidance(hasAnthropicCredential: boolean): string;
-export declare function allAccountsBlockedGuidance(soonestUnblockAt: number | undefined, blockReason?: "auth_error"): string;
+/**
+ * The pool context of a failure that left no other account (senpi#4671): the failure stays the error, and this
+ * names the soonest retry (which goal mode reads) and every account's state. No refusal note: the pool did not
+ * refuse the request, the account failed it.
+ */
+export declare function exhaustedPoolGuidance(soonestUnblockAt: number | undefined, accounts: readonly BlockedAccountState[]): string;
+export declare function allAccountsBlockedGuidance(soonestUnblockAt: number | undefined, blockReason?: "auth_error", accounts?: readonly BlockedAccountState[]): string;
 /**
  * How to move off a pinned account. `/claude-account pin` only writes the stored pin, which a CLI or a
  * settings pin outranks (`resolveClaudeAccountPin`), so for those it would change nothing (senpi#3672).

package/dist/core/extensions/builtin/anthropic-subscription/guidance.js

@@ -11,7 +11,29 @@ export function noAccountGuidance(hasAnthropicCredential) {
     lines.push("  Or set CLAUDE_CODE_OAUTH_TOKEN (and _2.._N for more accounts),", "  or log in with the claude CLI for ambient auth.");
     return lines.join("\n");
 }
-export function allAccountsBlockedGuidance(soonestUnblockAt, blockReason) {
+/** One line per pool member, naming the account that needs /login (senpi#4671). */
+function accountStateLines(accounts) {
+    return accounts.map((account) => {
+        const until = account.until === undefined ? "re-login" : new Date(account.until).toISOString();
+        const login = account.reason === "auth_error" ? ` - run /login ${PROVIDER} for this account` : "";
+        return `  ${account.name}: ${account.reason} until ${until}${login}`;
+    });
+}
+/**
+ * The pool context of a failure that left no other account (senpi#4671): the failure stays the error, and this
+ * names the soonest retry (which goal mode reads) and every account's state. No refusal note: the pool did not
+ * refuse the request, the account failed it.
+ */
+export function exhaustedPoolGuidance(soonestUnblockAt, accounts) {
+    const eta = soonestUnblockAt !== undefined && Number.isFinite(soonestUnblockAt)
+        ? new Date(soonestUnblockAt).toISOString()
+        : "after re-login";
+    return [
+        `  No other Claude account is available. Soonest automatic retry: ${eta}.`,
+        ...accountStateLines(accounts),
+    ].join("\n");
+}
+export function allAccountsBlockedGuidance(soonestUnblockAt, blockReason, accounts = []) {
     if (blockReason === "auth_error") {
         // omo#8383: name the authentication failure; the recovery is a re-login. Only a pool whose every
         // account is auth-blocked says so (senpi#2081), and the outer credential pool reads the refusal note
@@ -22,6 +44,7 @@ export function allAccountsBlockedGuidance(soonestUnblockAt, blockReason) {
         return [
             `All Claude accounts for ${PROVIDER} are currently blocked (authentication error).`,
             ...recheck,
+            ...accountStateLines(accounts),
             `  /login ${PROVIDER}  - re-authenticate to refresh the blocked account`,
             `  /claude-account list  - inspect account states`,
             ACCOUNT_POOL_REFUSAL_NOTE,
@@ -33,6 +56,7 @@ export function allAccountsBlockedGuidance(soonestUnblockAt, blockReason) {
     return [
         `All Claude accounts for ${PROVIDER} are currently blocked (rate limit or auth errors).`,
         `  Soonest automatic retry: ${eta}.`,
+        ...accountStateLines(accounts),
         `  /claude-account list  - inspect account states`,
         `  /login ${PROVIDER}  - add another account`,
         ACCOUNT_POOL_REFUSAL_NOTE,

package/dist/core/extensions/builtin/anthropic-subscription/provider-diagnostic.d.ts

@@ -0,0 +1,9 @@
+import { type ProviderDiagnostic } from "@earendil-works/pi-ai";
+/**
+ * The providerDiagnostic for an Anthropic Subscription turn failure (senpi#4672), mirroring the
+ * chatgpt-subscription adapter (senpi#3771). A pool the extension refused locally is `auth` when every
+ * account waits on a new login, otherwise `rate_limit` with the soonest retry; a classified SDK failure maps
+ * to its provider token. The result is revalidated against the closed vocabulary, so nothing else escapes.
+ */
+export declare function anthropicSubscriptionDiagnostic(error: unknown): ProviderDiagnostic | undefined;
+//# sourceMappingURL=provider-diagnostic.d.ts.map

package/dist/core/extensions/builtin/anthropic-subscription/provider-diagnostic.js

@@ -0,0 +1,59 @@
+import { sanitizeProviderDiagnostic, } from "@earendil-works/pi-ai";
+import { isThinkingBindingMismatchText } from "@earendil-works/pi-ai/api/anthropic-thinking-binding";
+import { AllAccountsBlockedError } from "./affinity.js";
+import { classifySdkError } from "./errors.js";
+import { ClassifiedSdkError } from "./failover.js";
+/** The allowlisted provider token each classified SDK failure proves; kinds that prove nothing map to none. */
+const SDK_KIND_DIAGNOSTICS = {
+    auth_error: { category: "auth", code: "authentication_error" },
+    rate_limit: { category: "rate_limit", code: "rate_limit_error" },
+    overloaded: { category: "provider_unavailable", code: "overloaded_error" },
+    billing: { category: "unknown", code: "billing_error" },
+    org_not_allowed: { category: "unknown", code: "permission_error" },
+};
+const CAUSE_DEPTH = 8;
+/** The pool refusal behind `error`: the error itself or one it carries as `cause`, so wrapping never hides it. */
+function poolRefusal(error) {
+    let current = error;
+    for (let depth = 0; depth < CAUSE_DEPTH && current instanceof Error; depth++) {
+        if (current instanceof AllAccountsBlockedError)
+            return current;
+        current = current.cause;
+    }
+    return undefined;
+}
+/**
+ * The providerDiagnostic for an Anthropic Subscription turn failure (senpi#4672), mirroring the
+ * chatgpt-subscription adapter (senpi#3771). A pool the extension refused locally is `auth` when every
+ * account waits on a new login, otherwise `rate_limit` with the soonest retry; a classified SDK failure maps
+ * to its provider token. The result is revalidated against the closed vocabulary, so nothing else escapes.
+ */
+export function anthropicSubscriptionDiagnostic(error) {
+    const pool = poolRefusal(error);
+    if (pool !== undefined) {
+        // A pin to an account that is no longer configured is a configuration error, not a limit: no diagnostic.
+        if (pool.unavailableAccount?.configured === false)
+            return undefined;
+        const auth = pool.blockReason === "auth_error";
+        return sanitizeProviderDiagnostic({
+            category: auth ? "auth" : "rate_limit",
+            code: auth ? "account_pool_auth_blocked" : "account_pool_blocked",
+            evidence: "structured_code",
+            ...(auth || pool.soonestUnblockAt === undefined ? {} : { resetsAt: pool.soonestUnblockAt }),
+        });
+    }
+    const original = error instanceof ClassifiedSdkError ? error.original : error;
+    if (original instanceof Error && isThinkingBindingMismatchText(original.message)) {
+        // senpi#5587: the API refused a replayed thinking block bound to a different conversation.
+        return sanitizeProviderDiagnostic({
+            category: "invalid_request",
+            httpStatus: 400,
+            code: "invalid_request_error",
+            evidence: "structured_code",
+        });
+    }
+    const kind = error instanceof ClassifiedSdkError ? error.classification.kind : classifySdkError(error).kind;
+    const mapped = SDK_KIND_DIAGNOSTICS[kind];
+    return mapped === undefined ? undefined : sanitizeProviderDiagnostic({ ...mapped, evidence: "structured_code" });
+}
+//# sourceMappingURL=provider-diagnostic.js.map

package/dist/core/extensions/builtin/anthropic-subscription/session-registry-pump.d.ts

@@ -5,6 +5,13 @@ export type { SessionTurnResult } from "./session-turn-types.ts";
 export declare const DEFAULT_PRE_REPLAY_MAX_MESSAGES = 64;
 export declare const DEFAULT_PRE_REPLAY_MAX_BYTES: number;
 export declare const SESSION_TURN_ABORT_GRACE_MS = 1000;
+/**
+ * How long a turn submitted while the previous turn of the same session is still active waits for that turn to
+ * settle before the submission is refused. The common case settles within the abort grace above: the agent loop
+ * starts the next turn (a steer, a follow-up, a monitor notification) right after it interrupted or finished
+ * consuming the previous one, while the pump still waits for the SDK's terminal result of that turn.
+ */
+export declare const SESSION_TURN_ADMISSION_WAIT_MS = 10000;
 export interface SessionTurnRequest {
     message: SDKUserMessage["message"];
     signal?: AbortSignal;
@@ -16,5 +23,11 @@ export declare class ConcurrentSessionTurnAdmissionError extends Error {
     readonly code = "claude_sdk_oauth_concurrent_turn_admission";
     constructor(sessionId: string);
 }
+/**
+ * Waits for `settled`, bounded by SESSION_TURN_ADMISSION_WAIT_MS: "admitted" once it settles, "aborted" when
+ * `signal` aborts first, and a ConcurrentSessionTurnAdmissionError when the bound passes, so a stuck pump cannot
+ * hold the session's callers forever.
+ */
+export declare function waitForTurnAdmission(sessionId: string, settled: Promise<unknown>, signal: AbortSignal | undefined, schedule?: (callback: () => void, delayMs: number) => () => void): Promise<"admitted" | "aborted">;
 export declare function submitSessionTurn(registry: AnthropicSubscriptionSessionRegistry, entry: AnthropicSubscriptionSessionEntry, request: SessionTurnRequest, limits?: PreReplayBufferLimits): Promise<SessionTurnResult>;
 //# sourceMappingURL=session-registry-pump.d.ts.map

package/dist/core/extensions/builtin/anthropic-subscription/session-registry-pump.js

@@ -8,6 +8,13 @@ import { SessionTurnAttributionError } from "./session-turn-types.js";
 export const DEFAULT_PRE_REPLAY_MAX_MESSAGES = 64;
 export const DEFAULT_PRE_REPLAY_MAX_BYTES = 256 * 1024;
 export const SESSION_TURN_ABORT_GRACE_MS = 1_000;
+/**
+ * How long a turn submitted while the previous turn of the same session is still active waits for that turn to
+ * settle before the submission is refused. The common case settles within the abort grace above: the agent loop
+ * starts the next turn (a steer, a follow-up, a monitor notification) right after it interrupted or finished
+ * consuming the previous one, while the pump still waits for the SDK's terminal result of that turn.
+ */
+export const SESSION_TURN_ADMISSION_WAIT_MS = 10_000;
 export class ConcurrentSessionTurnAdmissionError extends Error {
     constructor(sessionId) {
         super(`Concurrent Anthropic Subscription turn admission for session ${sessionId}`);
@@ -154,12 +161,66 @@ async function runPump(registry, entry) {
         failTurn(registry, entry, error instanceof Error ? error : new Error(String(error)));
     }
 }
+/**
+ * Waits for `settled`, bounded by SESSION_TURN_ADMISSION_WAIT_MS: "admitted" once it settles, "aborted" when
+ * `signal` aborts first, and a ConcurrentSessionTurnAdmissionError when the bound passes, so a stuck pump cannot
+ * hold the session's callers forever.
+ */
+export function waitForTurnAdmission(sessionId, settled, signal, schedule = scheduleAbort) {
+    return new Promise((resolve, reject) => {
+        let done = false;
+        let cancelTimer;
+        const finish = (run) => {
+            if (done)
+                return;
+            done = true;
+            cancelTimer?.();
+            signal?.removeEventListener("abort", onAbort);
+            run();
+        };
+        const onAbort = () => finish(() => resolve("aborted"));
+        if (signal?.aborted) {
+            onAbort();
+            return;
+        }
+        // The scheduler may fire synchronously (tests inject one); `done` then stops every later step.
+        cancelTimer = schedule(() => finish(() => reject(new ConcurrentSessionTurnAdmissionError(sessionId))), SESSION_TURN_ADMISSION_WAIT_MS);
+        if (done)
+            return;
+        signal?.addEventListener("abort", onAbort, { once: true });
+        const admitted = () => finish(() => resolve("admitted"));
+        void settled.then(admitted, admitted);
+    });
+}
+/**
+ * A turn submitted while the session's previous turn is still active waits for that turn to settle, bounded by
+ * SESSION_TURN_ADMISSION_WAIT_MS, then submits. One SDK session runs one turn at a time, so the second request is
+ * logically after the first; refusing it (the behavior before this guard) surfaced as a provider failure and moved
+ * the session to a fallback model for no reason of the provider's. An abort of the waiting request resolves it as
+ * an aborted turn; a previous turn that does not settle in time keeps the refusal.
+ */
+async function admitAfter(registry, entry, active, settled, request, limits) {
+    const generation = entry.generation;
+    const outcome = await waitForTurnAdmission(entry.senpiSessionId, settled, request.signal, request.scheduleAbort);
+    if (outcome === "aborted")
+        return { uuid: createSessionUuid(), messages: [], aborted: true };
+    if (!registry.isCurrentGeneration(entry.senpiSessionId, generation)) {
+        throw new Error("Anthropic Subscription session closed while a turn waited for admission");
+    }
+    if (currentTurn(entry) === active)
+        entry.activeTurn = null;
+    return submitSessionTurn(registry, entry, request, limits);
+}
 export function submitSessionTurn(registry, entry, request, limits = {
     maxMessages: DEFAULT_PRE_REPLAY_MAX_MESSAGES,
     maxBytes: DEFAULT_PRE_REPLAY_MAX_BYTES,
 }) {
-    if (currentTurn(entry))
-        throw new ConcurrentSessionTurnAdmissionError(entry.senpiSessionId);
+    const active = currentTurn(entry);
+    if (active) {
+        if (!active.settled)
+            throw new ConcurrentSessionTurnAdmissionError(entry.senpiSessionId);
+        return admitAfter(registry, entry, active, active.settled, request, limits);
+    }
     if (entry.state === "STARTING")
         transitionToIdleSynced(entry);
     transitionToTurnWaiting(entry);
@@ -199,6 +260,7 @@ export function submitSessionTurn(registry, entry, request, limits = {
             limits,
         };
     });
+    turn.settled = promise.then(() => undefined, () => undefined);
     entry.activeTurn = turn;
     if (!entry.pumpTask)
         entry.pumpTask = runPump(registry, entry);

package/dist/core/extensions/builtin/anthropic-subscription/session-registry-wiring.js

@@ -178,6 +178,13 @@ export function registerSessionRegistry(pi) {
         await writeStoredBinding(sessionFile, stored);
     });
     pi.on("session_shutdown", (event, ctx) => {
+        // A config hot-reload keeps the session and this module's registry (session_start skips
+        // "reload" above), and the resident query captures no per-load state: its hooks and tool
+        // handlers are module constants. The next turn's fingerprint check restarts the process
+        // only when the reload changed the prompt, tools or options. Closing here re-spawned Claude
+        // Code on every reload, and on a real account re-attached the claude.ai connectors.
+        if (event.reason === "reload")
+            return;
         closeSession(ctx.sessionManager.getSessionId(), event.reason);
     });
     pi.on("session_extensions_removed", async (_event, ctx) => {

package/dist/core/extensions/builtin/anthropic-subscription/session-stream.js

@@ -12,7 +12,7 @@ import { bindingFromEntry, bindingInvalidationReason, getBinding } from "./sessi
 import { closeSession, getOrCreateSession, getSession, isIdleExpired, } from "./session-registry.js";
 import { admitRestoredBinding } from "./session-restored-admission.js";
 import { buildDeltaPromptBlocks, configFingerprint, sentHashesForEntry, sentMessageHashes, sentMessages, } from "./session-sync.js";
-import { createSessionTurnAttempt } from "./session-turn-attempt.js";
+import { createSessionTurnAttempt, waitForActiveTurn } from "./session-turn-attempt.js";
 function userMessage(content) {
     return { role: "user", content };
 }
@@ -46,6 +46,10 @@ async function createResidentAttempt(input, auth) {
     const sessionId = input.streamOptions.sessionId;
     const messages = sentMessages(input.context);
     const hashes = sentMessageHashes(messages);
+    // Continuity and the delta are read from the settled previous turn, never from one still in flight.
+    const pending = getSession(sessionId);
+    if (pending)
+        await waitForActiveTurn(pending, input.streamOptions.signal);
     const existing = getSession(sessionId);
     const fingerprint = configFingerprint(auth.options, input.context, auth.authLane, auth.accountName);
     const residentHashes = existing ? (sentHashesForEntry(existing) ?? hashes) : hashes;

package/dist/core/extensions/builtin/anthropic-subscription/session-turn-attempt.d.ts

@@ -4,6 +4,13 @@ import { type AnthropicSubscriptionSessionEntry } from "./session-registry.ts";
 type StagedContinuityDecision = {
     emit(): void;
 };
+/**
+ * Holds a new attempt until the attempt running the entry's previous turn finished and recorded the sent stream
+ * (`recordSyncedStream`), bounded and abortable like the pump's own admission wait. The caller decides
+ * continuity and the delta only after this, so the delta starts after the earlier turn's message instead of
+ * sending it again (senpi#5015 review).
+ */
+export declare function waitForActiveTurn(entry: AnthropicSubscriptionSessionEntry, signal: AbortSignal | undefined): Promise<void>;
 /** Claude Code's wording for a fork point absent from its transcript; the captured id is the dead one. */
 export declare const RESUME_MESSAGE_MISSING: RegExp;
 export declare function createSessionTurnAttempt(entry: AnthropicSubscriptionSessionEntry, message: SDKUserMessage["message"], hashes: readonly string[], signal: AbortSignal | undefined, staged: StagedContinuityDecision, 

package/dist/core/extensions/builtin/anthropic-subscription/session-turn-attempt.js

@@ -2,8 +2,24 @@ import { BoundedAsyncQueue, SESSION_STREAM_QUEUE_CAPACITY } from "./bounded-queu
 import { sdkResultFailure } from "./errors.js";
 import { bindingFromEntry, forgetBinding, rememberBinding } from "./session-reattach.js";
 import { closeSession, isCurrentGeneration, sessionRegistry, } from "./session-registry.js";
-import { submitSessionTurn } from "./session-registry-pump.js";
+import { submitSessionTurn, waitForTurnAdmission } from "./session-registry-pump.js";
 import { recordSyncedStream, sentHashPrefixDigest } from "./session-sync.js";
+/** Pending while the attempt that submitted the entry's latest turn has not yet recorded what that turn sent. */
+const attemptBookkeeping = new WeakMap();
+/**
+ * Holds a new attempt until the attempt running the entry's previous turn finished and recorded the sent stream
+ * (`recordSyncedStream`), bounded and abortable like the pump's own admission wait. The caller decides
+ * continuity and the delta only after this, so the delta starts after the earlier turn's message instead of
+ * sending it again (senpi#5015 review).
+ */
+export async function waitForActiveTurn(entry, signal) {
+    const pending = attemptBookkeeping.get(entry);
+    if (!pending)
+        return;
+    if ((await waitForTurnAdmission(entry.senpiSessionId, pending, signal)) === "aborted") {
+        throw new Error("Anthropic Subscription turn aborted while waiting for the previous turn");
+    }
+}
 function successfulTurn(messages) {
     return messages.some((message) => message.type === "result" && message.subtype === "success" && sdkResultFailure(message) === undefined);
 }
@@ -91,6 +107,16 @@ servedLineage) {
     return {
         messages: (async function* () {
             const queue = new BoundedAsyncQueue(SESSION_STREAM_QUEUE_CAPACITY);
+            let markBookkept;
+            const bookkeeping = new Promise((resolve) => {
+                markBookkept = resolve;
+            });
+            attemptBookkeeping.set(entry, bookkeeping);
+            const bookkept = () => {
+                if (attemptBookkeeping.get(entry) === bookkeeping)
+                    attemptBookkeeping.delete(entry);
+                markBookkept();
+            };
             const completion = submitSessionTurn(sessionRegistry, entry, {
                 message,
                 signal,
@@ -147,6 +173,7 @@ servedLineage) {
             finally {
                 // A consumer that stops reading early must not leave the pump waiting for room.
                 queue.close();
+                bookkept();
             }
         })(),
         discard: () => {

package/dist/core/extensions/builtin/anthropic-subscription/session-turn-types.d.ts

@@ -23,6 +23,8 @@ export interface ActiveTurn {
     resolve: (result: SessionTurnResult) => void;
     reject: (error: Error) => void;
     limits: PreReplayBufferLimits;
+    /** Settles (never rejects) once the turn resolved or rejected; a turn submitted behind it waits here. */
+    settled?: Promise<void>;
 }
 export interface PreReplayBufferLimits {
     maxMessages: number;

package/dist/core/extensions/builtin/anthropic-subscription/stream-guidance.js

@@ -2,7 +2,7 @@ import { AllAccountsBlockedError } from "./affinity.js";
 import { errorAccountContext } from "./account-context.js";
 import { classifySdkError } from "./errors.js";
 import { ClassifiedSdkError } from "./failover.js";
-import { allAccountsBlockedGuidance, claudeCodeVersionFloorGuidance, sdkErrorGuidance, singleAccountUnavailableGuidance, switchAccountLine, } from "./guidance.js";
+import { allAccountsBlockedGuidance, claudeCodeVersionFloorGuidance, exhaustedPoolGuidance, sdkErrorGuidance, singleAccountUnavailableGuidance, switchAccountLine, } from "./guidance.js";
 import { ClaudeSignInRequiredError } from "./sign-in-again.js";
 export function withAuthGuidance(error, message, ran, now = Date.now()) {
     // The sign-in-again prompt is the remedy; the generic auth_error hint ("token was rejected... refresh") contradicts it.
@@ -10,7 +10,7 @@ export function withAuthGuidance(error, message, ran, now = Date.now()) {
         return message;
     if (error instanceof AllAccountsBlockedError) {
         const guidance = error.unavailableAccount === undefined
-            ? allAccountsBlockedGuidance(error.soonestUnblockAt, error.blockReason)
+            ? allAccountsBlockedGuidance(error.soonestUnblockAt, error.blockReason, error.accounts)
             : singleAccountUnavailableGuidance(error.unavailableAccount, error.soonestUnblockAt, error.blockReason);
         // The model-limit sentence is how the fallback chain learns the limit binds this model only (senpi#5007).
         return error.limitedModel === undefined
@@ -28,7 +28,9 @@ export function withAuthGuidance(error, message, ran, now = Date.now()) {
         guidance = `${selected} ${action}`;
     }
     const versionGuidance = claudeCodeVersionFloorGuidance(message, ran);
-    const hints = [guidance, versionGuidance].filter((hint) => hint !== undefined);
+    const pool = error instanceof ClassifiedSdkError ? error.poolState : undefined;
+    const poolGuidance = pool && exhaustedPoolGuidance(pool.soonestUnblockAt, pool.accounts);
+    const hints = [guidance, versionGuidance, poolGuidance].filter((hint) => hint !== undefined);
     return hints.length > 0 ? `${message}\n${hints.join("\n")}` : message;
 }
 /**

package/dist/core/extensions/builtin/anthropic-subscription/stream.js

@@ -13,6 +13,7 @@ import { refusalError } from "./refusal.js";
 import { getSdkBoundary, loadClaudeAgentSdk } from "./sdk-boundary.js";
 import { emitContinuityObservation } from "./session-observability.js";
 import { forgetBinding } from "./session-reattach.js";
+import { anthropicSubscriptionDiagnostic } from "./provider-diagnostic.js";
 import { requireAnthropicSubscriptionCwd } from "./session-cwd.js";
 import { residentSessionMessages } from "./session-stream.js";
 import { loadAnthropicSubscriptionProviderSettingsFromDisk, resolveCompactionOwner, resumeModeSource, } from "./settings.js";
@@ -268,6 +269,9 @@ export function streamAnthropicSubscription(model, context, options) {
             if (billed)
                 updateUsage(model, output, billed, "query");
             output.errorMessage = withAuthGuidance(error, errorMessage(error), claudeCodeRun);
+            const diagnostic = output.stopReason === "error" ? anthropicSubscriptionDiagnostic(error) : undefined;
+            if (diagnostic !== undefined)
+                output.providerDiagnostic = diagnostic;
             markColdSeedOverflow(output, model, coldSeedAttempt, coldSeedEstimate, options?.sessionId);
             stream.push({ type: "error", reason: output.stopReason, error: output });
         }

package/dist/core/extensions/builtin/bash-timeout/index.d.ts

@@ -1,5 +1,5 @@
 import type { ExtensionAPI } from "../../types.ts";
 export type { BashTimeoutDefaults, BashToolInputLike } from "./timeout.ts";
-export { applyBashTimeout, BASH_DEFAULT_TIMEOUT_SECONDS, BASH_MAX_TIMEOUT_SECONDS, buildBashTimeoutPrompt, resolveBashTimeoutDefaults, } from "./timeout.ts";
+export { applyBashTimeout, BASH_DEFAULT_TIMEOUT_SECONDS, resolveBashTimeoutDefaults } from "./timeout.ts";
 export default function bashTimeoutExtension(pi: ExtensionAPI): void;
 //# sourceMappingURL=index.d.ts.map

package/dist/core/extensions/builtin/bash-timeout/index.js

@@ -1,8 +1,5 @@
-import { isAnthropicBashEnabled } from "../anthropic-bash/index.js";
-import { isEvalOnlyRouting } from "../eval-only-routing.js";
-import { resolveForegroundWindowSeconds } from "../terminal/tools/foreground-window.js";
-import { applyBashTimeout, buildBashTimeoutPrompt, resolveBashTimeoutDefaults, } from "./timeout.js";
-export { applyBashTimeout, BASH_DEFAULT_TIMEOUT_SECONDS, BASH_MAX_TIMEOUT_SECONDS, buildBashTimeoutPrompt, resolveBashTimeoutDefaults, } from "./timeout.js";
+import { applyBashTimeout, resolveBashTimeoutDefaults } from "./timeout.js";
+export { applyBashTimeout, BASH_DEFAULT_TIMEOUT_SECONDS, resolveBashTimeoutDefaults } from "./timeout.js";
 export default function bashTimeoutExtension(pi) {
     const env = typeof process !== "undefined" ? process.env : {};
     const defaults = resolveBashTimeoutDefaults(env);
@@ -17,28 +14,6 @@ export default function bashTimeoutExtension(pi) {
                 input.timeout = timeout;
         }
     });
-    /**
-     * Native Anthropic bash replaces the PTY `bash` tool and the terminal
-     * extension steps aside with it, so nothing implements the auto-detach the
-     * policy would otherwise advertise.
-     */
-    const resolveWindow = (ctx) => {
-        if (isAnthropicBashEnabled() && ctx?.model?.api === "anthropic-messages")
-            return undefined;
-        return resolveForegroundWindowSeconds(env);
-    };
-    pi.on("before_agent_start", async (event, ctx) => {
-        // A session with no `bash` tool has nothing this policy can describe. A host that exposes
-        // only the handler surface (no getAllTools) keeps the policy, as the terminal section does.
-        if (typeof pi.getAllTools === "function" && !pi.getAllTools().some((tool) => tool.name === "bash")) {
-            return undefined;
-        }
-        const foregroundWindowSeconds = resolveWindow(ctx);
-        const prompt = buildBashTimeoutPrompt(defaults, {
-            ...(foregroundWindowSeconds === undefined ? {} : { foregroundWindowSeconds }),
-            evalOnly: isEvalOnlyRouting(pi),
-        });
-        return { systemPrompt: `${event.systemPrompt}${prompt}` };
-    }, { previewSafe: true });
+    // The timeout facts reach the model through the terminal section (senpi#5335); this extension adds no prompt text.
 }
 //# sourceMappingURL=index.js.map