@code-yeongyu/senpi 2026.11.3-1 → 2026.11.3-2

package/dist/core/extensions/builtin/anthropic-subscription/guidance.js

@@ -11,7 +11,29 @@ export function noAccountGuidance(hasAnthropicCredential) {
     lines.push("  Or set CLAUDE_CODE_OAUTH_TOKEN (and _2.._N for more accounts),", "  or log in with the claude CLI for ambient auth.");
     return lines.join("\n");
 }
-export function allAccountsBlockedGuidance(soonestUnblockAt, blockReason) {
+/** One line per pool member, naming the account that needs /login (senpi#4671). */
+function accountStateLines(accounts) {
+    return accounts.map((account) => {
+        const until = account.until === undefined ? "re-login" : new Date(account.until).toISOString();
+        const login = account.reason === "auth_error" ? ` - run /login ${PROVIDER} for this account` : "";
+        return `  ${account.name}: ${account.reason} until ${until}${login}`;
+    });
+}
+/**
+ * The pool context of a failure that left no other account (senpi#4671): the failure stays the error, and this
+ * names the soonest retry (which goal mode reads) and every account's state. No refusal note: the pool did not
+ * refuse the request, the account failed it.
+ */
+export function exhaustedPoolGuidance(soonestUnblockAt, accounts) {
+    const eta = soonestUnblockAt !== undefined && Number.isFinite(soonestUnblockAt)
+        ? new Date(soonestUnblockAt).toISOString()
+        : "after re-login";
+    return [
+        `  No other Claude account is available. Soonest automatic retry: ${eta}.`,
+        ...accountStateLines(accounts),
+    ].join("\n");
+}
+export function allAccountsBlockedGuidance(soonestUnblockAt, blockReason, accounts = []) {
     if (blockReason === "auth_error") {
         // omo#8383: name the authentication failure; the recovery is a re-login. Only a pool whose every
         // account is auth-blocked says so (senpi#2081), and the outer credential pool reads the refusal note
@@ -22,6 +44,7 @@ export function allAccountsBlockedGuidance(soonestUnblockAt, blockReason) {
         return [
             `All Claude accounts for ${PROVIDER} are currently blocked (authentication error).`,
             ...recheck,
+            ...accountStateLines(accounts),
             `  /login ${PROVIDER}  - re-authenticate to refresh the blocked account`,
             `  /claude-account list  - inspect account states`,
             ACCOUNT_POOL_REFUSAL_NOTE,
@@ -33,6 +56,7 @@ export function allAccountsBlockedGuidance(soonestUnblockAt, blockReason) {
     return [
         `All Claude accounts for ${PROVIDER} are currently blocked (rate limit or auth errors).`,
         `  Soonest automatic retry: ${eta}.`,
+        ...accountStateLines(accounts),
         `  /claude-account list  - inspect account states`,
         `  /login ${PROVIDER}  - add another account`,
         ACCOUNT_POOL_REFUSAL_NOTE,

package/dist/core/extensions/builtin/anthropic-subscription/provider-diagnostic.d.ts

@@ -0,0 +1,9 @@
+import { type ProviderDiagnostic } from "@earendil-works/pi-ai";
+/**
+ * The providerDiagnostic for an Anthropic Subscription turn failure (senpi#4672), mirroring the
+ * chatgpt-subscription adapter (senpi#3771). A pool the extension refused locally is `auth` when every
+ * account waits on a new login, otherwise `rate_limit` with the soonest retry; a classified SDK failure maps
+ * to its provider token. The result is revalidated against the closed vocabulary, so nothing else escapes.
+ */
+export declare function anthropicSubscriptionDiagnostic(error: unknown): ProviderDiagnostic | undefined;
+//# sourceMappingURL=provider-diagnostic.d.ts.map

package/dist/core/extensions/builtin/anthropic-subscription/provider-diagnostic.js

@@ -0,0 +1,59 @@
+import { sanitizeProviderDiagnostic, } from "@earendil-works/pi-ai";
+import { isThinkingBindingMismatchText } from "@earendil-works/pi-ai/api/anthropic-thinking-binding";
+import { AllAccountsBlockedError } from "./affinity.js";
+import { classifySdkError } from "./errors.js";
+import { ClassifiedSdkError } from "./failover.js";
+/** The allowlisted provider token each classified SDK failure proves; kinds that prove nothing map to none. */
+const SDK_KIND_DIAGNOSTICS = {
+    auth_error: { category: "auth", code: "authentication_error" },
+    rate_limit: { category: "rate_limit", code: "rate_limit_error" },
+    overloaded: { category: "provider_unavailable", code: "overloaded_error" },
+    billing: { category: "unknown", code: "billing_error" },
+    org_not_allowed: { category: "unknown", code: "permission_error" },
+};
+const CAUSE_DEPTH = 8;
+/** The pool refusal behind `error`: the error itself or one it carries as `cause`, so wrapping never hides it. */
+function poolRefusal(error) {
+    let current = error;
+    for (let depth = 0; depth < CAUSE_DEPTH && current instanceof Error; depth++) {
+        if (current instanceof AllAccountsBlockedError)
+            return current;
+        current = current.cause;
+    }
+    return undefined;
+}
+/**
+ * The providerDiagnostic for an Anthropic Subscription turn failure (senpi#4672), mirroring the
+ * chatgpt-subscription adapter (senpi#3771). A pool the extension refused locally is `auth` when every
+ * account waits on a new login, otherwise `rate_limit` with the soonest retry; a classified SDK failure maps
+ * to its provider token. The result is revalidated against the closed vocabulary, so nothing else escapes.
+ */
+export function anthropicSubscriptionDiagnostic(error) {
+    const pool = poolRefusal(error);
+    if (pool !== undefined) {
+        // A pin to an account that is no longer configured is a configuration error, not a limit: no diagnostic.
+        if (pool.unavailableAccount?.configured === false)
+            return undefined;
+        const auth = pool.blockReason === "auth_error";
+        return sanitizeProviderDiagnostic({
+            category: auth ? "auth" : "rate_limit",
+            code: auth ? "account_pool_auth_blocked" : "account_pool_blocked",
+            evidence: "structured_code",
+            ...(auth || pool.soonestUnblockAt === undefined ? {} : { resetsAt: pool.soonestUnblockAt }),
+        });
+    }
+    const original = error instanceof ClassifiedSdkError ? error.original : error;
+    if (original instanceof Error && isThinkingBindingMismatchText(original.message)) {
+        // senpi#5587: the API refused a replayed thinking block bound to a different conversation.
+        return sanitizeProviderDiagnostic({
+            category: "invalid_request",
+            httpStatus: 400,
+            code: "invalid_request_error",
+            evidence: "structured_code",
+        });
+    }
+    const kind = error instanceof ClassifiedSdkError ? error.classification.kind : classifySdkError(error).kind;
+    const mapped = SDK_KIND_DIAGNOSTICS[kind];
+    return mapped === undefined ? undefined : sanitizeProviderDiagnostic({ ...mapped, evidence: "structured_code" });
+}
+//# sourceMappingURL=provider-diagnostic.js.map

package/dist/core/extensions/builtin/anthropic-subscription/session-registry-wiring.js

@@ -178,6 +178,13 @@ export function registerSessionRegistry(pi) {
         await writeStoredBinding(sessionFile, stored);
     });
     pi.on("session_shutdown", (event, ctx) => {
+        // A config hot-reload keeps the session and this module's registry (session_start skips
+        // "reload" above), and the resident query captures no per-load state: its hooks and tool
+        // handlers are module constants. The next turn's fingerprint check restarts the process
+        // only when the reload changed the prompt, tools or options. Closing here re-spawned Claude
+        // Code on every reload, and on a real account re-attached the claude.ai connectors.
+        if (event.reason === "reload")
+            return;
         closeSession(ctx.sessionManager.getSessionId(), event.reason);
     });
     pi.on("session_extensions_removed", async (_event, ctx) => {

package/dist/core/extensions/builtin/anthropic-subscription/stream-guidance.js

@@ -2,7 +2,7 @@ import { AllAccountsBlockedError } from "./affinity.js";
 import { errorAccountContext } from "./account-context.js";
 import { classifySdkError } from "./errors.js";
 import { ClassifiedSdkError } from "./failover.js";
-import { allAccountsBlockedGuidance, claudeCodeVersionFloorGuidance, sdkErrorGuidance, singleAccountUnavailableGuidance, switchAccountLine, } from "./guidance.js";
+import { allAccountsBlockedGuidance, claudeCodeVersionFloorGuidance, exhaustedPoolGuidance, sdkErrorGuidance, singleAccountUnavailableGuidance, switchAccountLine, } from "./guidance.js";
 import { ClaudeSignInRequiredError } from "./sign-in-again.js";
 export function withAuthGuidance(error, message, ran, now = Date.now()) {
     // The sign-in-again prompt is the remedy; the generic auth_error hint ("token was rejected... refresh") contradicts it.
@@ -10,7 +10,7 @@ export function withAuthGuidance(error, message, ran, now = Date.now()) {
         return message;
     if (error instanceof AllAccountsBlockedError) {
         const guidance = error.unavailableAccount === undefined
-            ? allAccountsBlockedGuidance(error.soonestUnblockAt, error.blockReason)
+            ? allAccountsBlockedGuidance(error.soonestUnblockAt, error.blockReason, error.accounts)
             : singleAccountUnavailableGuidance(error.unavailableAccount, error.soonestUnblockAt, error.blockReason);
         // The model-limit sentence is how the fallback chain learns the limit binds this model only (senpi#5007).
         return error.limitedModel === undefined
@@ -28,7 +28,9 @@ export function withAuthGuidance(error, message, ran, now = Date.now()) {
         guidance = `${selected} ${action}`;
     }
     const versionGuidance = claudeCodeVersionFloorGuidance(message, ran);
-    const hints = [guidance, versionGuidance].filter((hint) => hint !== undefined);
+    const pool = error instanceof ClassifiedSdkError ? error.poolState : undefined;
+    const poolGuidance = pool && exhaustedPoolGuidance(pool.soonestUnblockAt, pool.accounts);
+    const hints = [guidance, versionGuidance, poolGuidance].filter((hint) => hint !== undefined);
     return hints.length > 0 ? `${message}\n${hints.join("\n")}` : message;
 }
 /**

package/dist/core/extensions/builtin/anthropic-subscription/stream.js

@@ -13,6 +13,7 @@ import { refusalError } from "./refusal.js";
 import { getSdkBoundary, loadClaudeAgentSdk } from "./sdk-boundary.js";
 import { emitContinuityObservation } from "./session-observability.js";
 import { forgetBinding } from "./session-reattach.js";
+import { anthropicSubscriptionDiagnostic } from "./provider-diagnostic.js";
 import { requireAnthropicSubscriptionCwd } from "./session-cwd.js";
 import { residentSessionMessages } from "./session-stream.js";
 import { loadAnthropicSubscriptionProviderSettingsFromDisk, resolveCompactionOwner, resumeModeSource, } from "./settings.js";
@@ -268,6 +269,9 @@ export function streamAnthropicSubscription(model, context, options) {
             if (billed)
                 updateUsage(model, output, billed, "query");
             output.errorMessage = withAuthGuidance(error, errorMessage(error), claudeCodeRun);
+            const diagnostic = output.stopReason === "error" ? anthropicSubscriptionDiagnostic(error) : undefined;
+            if (diagnostic !== undefined)
+                output.providerDiagnostic = diagnostic;
             markColdSeedOverflow(output, model, coldSeedAttempt, coldSeedEstimate, options?.sessionId);
             stream.push({ type: "error", reason: output.stopReason, error: output });
         }

package/dist/core/extensions/builtin/btw/index.js

@@ -78,7 +78,9 @@ export default function btwExtension(pi) {
                     return undefined;
                 });
             }
-            const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
+            const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model, {
+                sessionId: ctx.sessionManager.getSessionId(),
+            });
             if (!auth.ok) {
                 if (active !== entry)
                     return;

package/dist/core/extensions/builtin/cache-keepalive/index.js

@@ -136,7 +136,9 @@ export function createCacheKeepAliveExtension(dependencies = {}) {
                         .getAllTools()
                         .filter((tool) => activeToolNames.has(tool.name))
                         .map(({ name, description, parameters }) => ({ name, description, parameters }));
-                const auth = await current.modelRegistry.getApiKeyAndHeaders(current.model);
+                const auth = await current.modelRegistry.getApiKeyAndHeaders(current.model, {
+                    sessionId: current.sessionManager.getSessionId(),
+                });
                 if (pingGeneration !== generation) {
                     inFlight = false;
                     arm();

package/dist/core/extensions/builtin/compaction/index.js

@@ -869,7 +869,7 @@ export default function compactionExtension(pi, remoteCompactionDependencies = {
         const model = event.model ?? ctx.model;
         if (!isOpenAiRemoteCompactionModel(model))
             return undefined;
-        const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
+        const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model, { sessionId: ctx.sessionManager.getSessionId() });
         if (!auth.ok)
             return undefined;
         const effectiveModel = auth.upstreamModelId || auth.baseUrl

package/dist/core/extensions/builtin/compaction/openai-remote.d.ts

@@ -36,7 +36,9 @@ type OpenAiRemoteCompactionContext = {
     getSystemPrompt(): string;
     model: Model<Api> | undefined;
     modelRegistry: {
-        getApiKeyAndHeaders(model: Model<Api>): Promise<{
+        getApiKeyAndHeaders(model: Model<Api>, options?: {
+            sessionId?: string;
+        }): Promise<{
             ok: true;
             apiKey?: string;
             headers?: ProviderHeaders;

package/dist/core/extensions/builtin/compaction/openai-remote.js

@@ -335,7 +335,7 @@ export async function runOpenAiRemoteCompaction(ctx, event, emit, dependencies =
         });
         return undefined;
     }
-    const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
+    const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model, { sessionId: ctx.sessionManager.getSessionId() });
     if (!auth.ok) {
         emit?.({
             version: 1,

package/dist/core/extensions/builtin/compaction/speculative.js

@@ -146,15 +146,16 @@ export async function runExtensionCompaction(context, snapshot, signal, onProgre
     // same provider resolution normal turns use; an unconfigured keyed provider still
     // has none of these and is rejected before a request.
     const authenticated = (resolved) => resolved?.ok === true && Boolean(resolved.apiKey || hasCredentialHeaders(resolved.headers) || resolved.ambient);
+    const session = { sessionId: context.sessionManager.getSessionId() };
     let selectedModel = context.getCompactionModel?.() ?? snapshot.model;
-    let auth = await context.modelRegistry?.getApiKeyAndHeaders(selectedModel);
+    let auth = await context.modelRegistry?.getApiKeyAndHeaders(selectedModel, session);
     if (signal?.aborted)
         return undefined;
     // A configured summary model whose credentials could not be confirmed earlier (#830) must not
     // disable compaction: without credentials at request time, summarize on the session model.
     if (selectedModel !== snapshot.model && !authenticated(auth)) {
         selectedModel = snapshot.model;
-        auth = await context.modelRegistry?.getApiKeyAndHeaders(selectedModel);
+        auth = await context.modelRegistry?.getApiKeyAndHeaders(selectedModel, session);
         if (signal?.aborted)
             return undefined;
     }

package/dist/core/extensions/builtin/cursor-cli-oauth/account-command.js

@@ -1,3 +1,4 @@
+import { stampLogin } from "@earendil-works/pi-ai/auth/pool/login-id";
 import { accountLabel } from "@earendil-works/pi-ai/auth/pool/slots";
 import { describeAccountBlock } from "../../../credential-account-status.js";
 import { emitProviderAccountsChanged } from "../anthropic-subscription/account-events.js";
@@ -248,7 +249,8 @@ async function importAccount(ctx, deps, source) {
                 : await importCredential(before, importDeps);
             const existing = new Set(listAccounts(before).map((account) => account.name));
             importedName = listAccounts(updated).find((account) => !existing.has(account.name))?.name;
-            return updated;
+            // An import adds a signed-in account, so it stamps a login id like a login (senpi#4099).
+            return stampLogin(updated);
         });
     }
     catch (error) {

package/dist/core/extensions/builtin/cursor-cli-oauth/native-bootstrap.js

@@ -1,3 +1,4 @@
+import { stampLogin } from "@earendil-works/pi-ai/auth/pool/login-id";
 import { emptyCredential, listAccounts, SENTINEL_OAUTH_FIELDS } from "./accounts.js";
 import { CURSOR_CLI_OAUTH_PROVIDER_ID, importNativeCursorCredential } from "./oauth-login.js";
 function asManagedCredential(credential) {
@@ -31,7 +32,8 @@ async function bootstrapNativeCredential(deps) {
                 return latest;
             if (latest !== undefined && !latestManaged)
                 return latest;
-            return importNativeCursorCredential(latestManaged ?? emptyCredential(), async () => native);
+            // The first-run copy adds a signed-in account, so it stamps a login id like a login (senpi#4099).
+            return stampLogin(await importNativeCursorCredential(latestManaged ?? emptyCredential(), async () => native));
         });
     }
     catch {

package/dist/core/extensions/builtin/look-at/runner.js

@@ -10,7 +10,9 @@ export async function runLookAt(args, signal, ctx, store, dependencies = {}) {
     if (!resolved) {
         throw new Error("No image-capable model is available. Configure a vision-capable provider and try look_at again.");
     }
-    const auth = await ctx.modelRegistry.getApiKeyAndHeaders(resolved.model);
+    const auth = await ctx.modelRegistry.getApiKeyAndHeaders(resolved.model, {
+        sessionId: ctx.sessionManager.getSessionId(),
+    });
     if (!auth.ok) {
         throw new Error(`look_at cannot use ${resolved.model.provider}/${resolved.model.id}: ${auth.error}. ` +
             `Configure credentials with /login ${resolved.model.provider} and try again.`);

package/dist/core/extensions/builtin/mcp/auth/callback.js

@@ -1,4 +1,5 @@
 import { createServer } from "node:http";
+import { oauthErrorHtml, oauthSuccessHtml } from "@earendil-works/pi-ai/utils/oauth-page";
 import { safeTimer } from "../wrap.js";
 import { OAuthFlowError } from "./oauth-errors.js";
 // Chooses the redirect channel for an authorization: a real loopback listener,
@@ -23,8 +24,6 @@ export async function openCallbackChannel(options) {
     };
 }
 const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
-const SUCCESS_HTML = "<!doctype html><title>senpi</title><p>Authorization complete. You can close this tab.</p>";
-const FAILURE_HTML = "<!doctype html><title>senpi</title><p>Authorization failed. Return to senpi and retry.</p>";
 // Lazily-bound 127.0.0.1 listener that exists only for the duration of one
 // OAuth authorization. The handle is unref'd so it never keeps the process
 // alive, and it tears down on success, invalid state, or a 5-minute timeout.
@@ -105,11 +104,11 @@ export class LoopbackCallbackServer {
         const state = url.searchParams.get("state") ?? undefined;
         const error = url.searchParams.get("error");
         if (error !== null || code === null || state === undefined || !this.#options.validateState(state)) {
-            res.writeHead(400, { "content-type": "text/html" }).end(FAILURE_HTML);
+            res.writeHead(400, { "content-type": "text/html" }).end(oauthErrorHtml("MCP server authorization failed. Return to the app and start the sign-in again."));
             void this.#fail(new OAuthFlowError("state_mismatch", `MCP server ${this.#options.serverName} authorization state did not match (possible CSRF or a stale/replayed link); restart the auth flow.`, { serverName: this.#options.serverName }));
             return;
         }
-        res.writeHead(200, { "content-type": "text/html" }).end(SUCCESS_HTML);
+        res.writeHead(200, { "content-type": "text/html" }).end(oauthSuccessHtml("MCP server authorization complete. You can close this tab."));
         this.#succeed({ code, state, iss: url.searchParams.get("iss") ?? undefined });
     }
     #succeed(result) {

package/dist/core/extensions/builtin/mcp/auth/oauth-provider.js

@@ -1,4 +1,5 @@
 import { randomBytes } from "node:crypto";
+import { oauthBrandName } from "@earendil-works/pi-ai/utils/oauth-page";
 import { fingerprintSecret } from "../log.js";
 import { OAuthFlowError } from "./oauth-errors.js";
 import { canonicalAuthorizationServerIssuer, credentialsMatchIssuer, validatedAuthorizationServerIssuer, } from "./oauth-issuer.js";
@@ -113,7 +114,7 @@ export class McpOAuthProvider {
             grant_types: ["authorization_code", "refresh_token"],
             response_types: ["code"],
             token_endpoint_auth_method: "none",
-            client_name: "senpi",
+            client_name: oauthBrandName(),
             scope: this.#options.scopes?.join(" "),
         };
     }

package/dist/core/model-registry.d.ts

@@ -43,12 +43,20 @@ export declare class ModelRegistry {
     /**
      * The live auth check reads the in-memory credentials. When the last read found the store
      * locked they were never loaded, so re-read now (bounded by the sync lock budget) instead
-     * of answering from the empty fallback for the rest of the process.
+     * of answering from the empty fallback for the rest of the process. A store that could not be
+     * loaded is re-read the same way, so a repaired auth.json is seen without a restart (#4413).
      */
     private retryBusyCredentialRead;
     getUpstreamModelId(model: Model<Api>): string | undefined;
     getServiceTier(model: Model<Api>): "auto" | "flex" | "priority" | "ultrafast" | undefined;
-    getApiKeyAndHeaders(model: Model<Api>): Promise<ResolvedRequestAuth>;
+    /**
+     * Request auth for a direct provider call. A caller acting for a session passes its id so the
+     * key belongs to the account that session's turns use; without it the stored credential is
+     * resolved as for session-less callers.
+     */
+    getApiKeyAndHeaders(model: Model<Api>, options?: {
+        sessionId?: string;
+    }): Promise<ResolvedRequestAuth>;
     getProviderAuthStatus(provider: string): AuthStatus;
     /** `getProviderAuthStatus` plus whether it is a non-stored sign-in, from one resolution (#3537). */
     resolveProviderAuth(provider: string): {

package/dist/core/model-registry.js

@@ -59,10 +59,11 @@ export class ModelRegistry {
     /**
      * The live auth check reads the in-memory credentials. When the last read found the store
      * locked they were never loaded, so re-read now (bounded by the sync lock budget) instead
-     * of answering from the empty fallback for the rest of the process.
+     * of answering from the empty fallback for the rest of the process. A store that could not be
+     * loaded is re-read the same way, so a repaired auth.json is seen without a restart (#4413).
      */
     retryBusyCredentialRead() {
-        if (this.authStorage.isCredentialStoreBusy())
+        if (this.authStorage.isCredentialStoreBusy() || this.authStorage.getLoadError())
             this.authStorage.reload();
     }
     getUpstreamModelId(model) {
@@ -71,9 +72,16 @@ export class ModelRegistry {
     getServiceTier(model) {
         return this.runtime.getCompatibilityRequestConfig(model).serviceTier;
     }
-    async getApiKeyAndHeaders(model) {
+    /**
+     * Request auth for a direct provider call. A caller acting for a session passes its id so the
+     * key belongs to the account that session's turns use; without it the stored credential is
+     * resolved as for session-less callers.
+     */
+    async getApiKeyAndHeaders(model, options = {}) {
         try {
-            const resolution = await this.runtime.getAuth(model);
+            const resolution = options.sessionId === undefined
+                ? await this.runtime.getAuth(model)
+                : await this.runtime.getSessionAuth(model, options.sessionId);
             const compatibility = this.runtime.getCompatibilityRequestConfig(model);
             if (!resolution) {
                 if (compatibility.authHeader) {

package/dist/core/model-runtime.d.ts

@@ -168,6 +168,14 @@ export declare class ModelRuntime implements Models {
     isFallbackEligible(providerId: string): boolean;
     getAuth(providerId: string, overrides?: ModelRuntimeAuthOverrides): Promise<AuthResult | undefined>;
     getAuth(model: AnyModel, overrides?: ModelRuntimeAuthOverrides): Promise<AuthResult | undefined>;
+    /**
+     * Auth for a request a session sends outside the rotation stream (compaction, /btw, look-at,
+     * cache keepalive). The key must belong to the account the session's own turns use, so a pooled
+     * provider resolves the slot the stream would pick for this session; without a pool, or when
+     * the stream would not rotate either, it is `getAuth(model)`.
+     */
+    getSessionAuth(model: Model<Api>, sessionId: string): Promise<AuthResult | undefined>;
+    private sessionSlotAuth;
     private enqueueCredentialOperation;
     private synchronizeCredentialState;
     setRuntimeApiKey(providerId: string, apiKey: string, options?: AuthOperationOptions): Promise<void>;

package/dist/core/model-runtime.js

@@ -1,6 +1,7 @@
 import { dirname, join } from "node:path";
 import { clampThinkingLevel, createModels, getCurrentTools, isModelType, lazyStream, ModelsError, normalizeContext, normalizeProviderId, providerNotConfiguredMessage, setWireIdentity, wrapStreamWithModelRecovery, } from "@earendil-works/pi-ai";
 import * as builtinProviderCatalog from "@earendil-works/pi-ai/providers/all";
+import { setOAuthPageBrand } from "@earendil-works/pi-ai/utils/oauth-page";
 import { assertChatModel, assertClassifierModel, assertImageModel, classifierErrorResult, imageErrorResult, } from "@earendil-works/pi-ai/utils/model-operations";
 import { APP_NAME, BRAND, getAgentDir } from "../config.js";
 import { operationSignal, raceWithAbortSignal } from "../utils/abort.js";
@@ -23,6 +24,7 @@ import { createVirtualModel, findLatestResponse, isVirtualModel, withVirtualMode
 // The product's identity must ride outgoing requests. This lives here because the AI package
 // is already part of this module's graph; the CLI bootstrap deliberately does not import it.
 setWireIdentity(BRAND?.userAgent ?? APP_NAME);
+setOAuthPageBrand({ name: APP_NAME, ...(BRAND?.logo ? { logo: BRAND.logo } : {}) });
 /** Availability re-reads after a busy credential store: 250, 500, 1000, 2000, 4000 ms. */
 const BUSY_AVAILABILITY_RETRY_LIMIT = 5;
 const BUSY_AVAILABILITY_RETRY_BASE_MS = 250;
@@ -550,6 +552,42 @@ export class ModelRuntime {
             },
         };
     }
+    /**
+     * Auth for a request a session sends outside the rotation stream (compaction, /btw, look-at,
+     * cache keepalive). The key must belong to the account the session's own turns use, so a pooled
+     * provider resolves the slot the stream would pick for this session; without a pool, or when
+     * the stream would not rotate either, it is `getAuth(model)`.
+     */
+    async getSessionAuth(model, sessionId) {
+        return this.getAuth(model, (await this.sessionSlotAuth(model, sessionId)) ?? {});
+    }
+    async sessionSlotAuth(model, sessionId) {
+        // The stream's own synchronous admission check, so a provider the stream would not rotate costs
+        // nothing beyond getAuth. Remote compaction's before_provider_request hook calls this on every
+        // request to such a model; there a pooled provider pays one extra credential read and two slot
+        // listings (each reads the pool's health state) before getAuth.
+        if (!this.couldRotateCredentials(model, undefined))
+            return undefined;
+        const sources = await this.credentialRotationSources(model, undefined);
+        if (!sources)
+            return undefined;
+        const { rotation } = await this.loadCredentialPool();
+        const { selectSessionSlot } = await import("./credential-pool/session-slot.js");
+        const slots = await rotation.listRotationSlots(sources, {
+            acquireLeases: false,
+            modelId: this.getCompatibilityRequestConfig(model).upstreamModelId ?? model.id,
+        });
+        const pooled = sources.credential;
+        const slot = selectSessionSlot(slots, {
+            affinityKey: sessionId,
+            useAffinity: sources.policy?.affinity !== false,
+            hasher: rotation.sha256SlotHasher,
+            ...(pooled?.order === undefined ? {} : { order: pooled.order }),
+        }, Date.now());
+        if (!slot)
+            return undefined;
+        return slot.lane === "env" ? { apiKey: slot.envKey } : { slotName: slot.name };
+    }
     enqueueCredentialOperation(providerId, signal, task) {
         const previous = this.credentialOperations.get(providerId) ?? Promise.resolve();
         let markStarted;

package/dist/core/retry-fallback/controller-types.d.ts

@@ -14,6 +14,8 @@ export interface ActiveFallbackState {
     pinnedByBilling: boolean;
     /** Derived OR of the two provenance flags - the only field consumers read. */
     pinned: boolean;
+    /** The original provider's login id when the episode began; a sign-in moves it and releases a billing pin (senpi#4099). */
+    recoveryRevision?: string;
 }
 export type FallbackReason = "transient" | "refusal" | "hard-error" | "billing";
 /** Absent: the original recovered after its cooldown. `fallback-unusable`: the fallback itself could not serve. */
@@ -64,5 +66,10 @@ export interface RetryFallbackControllerDeps {
         thinkingLevel?: ThinkingLevel;
     } | undefined;
     isAuthAvailable(provider: string): boolean;
+    /**
+     * The `loginId` the last sign-in stored for `provider` ("" when none did), never key material;
+     * `undefined` when it cannot be read. Only a sign-in writes a new id; a token refresh keeps it or drops it to "" (senpi#4099).
+     */
+    recoveryRevision?(provider: string): Promise<string | undefined>;
 }
 //# sourceMappingURL=controller-types.d.ts.map

package/dist/core/retry-fallback/controller.d.ts

@@ -41,6 +41,8 @@ export declare class RetryFallbackController {
      * original is not is never where the session rests (senpi#2376). An original that is
      * itself still held (an account usage limit with the reset it named, which can outlast
      * the circuit's 30-minute ceiling) is not restored before that hold ends (senpi#3347).
+     * At a turn boundary, a changed credential on the original's provider first releases
+     * its billing pin and parks (senpi#4099).
      */
     maybeRestorePrimary(revertPolicy: "cooldown-expiry" | "never", boundary?: "turn" | "continuation"): Promise<boolean>;
     private originalRecovered;

package/dist/core/retry-fallback/controller.js

@@ -4,6 +4,7 @@ import { firstUsableCandidate } from "./candidates.js";
 import { baseSelector, canonicalizeFallbackChains, formatSelector, parseFallbackSelector, resolveChainKey, rungSelector, } from "./chains.js";
 import { subscribeProviderAccountEvents } from "../extensions/builtin/anthropic-subscription/account-events.js";
 import { CircuitProbes } from "./circuit-probes.js";
+import { releaseOnCredentialChange } from "./credential-recovery.js";
 import { pinAfterSwitch } from "./pin.js";
 import { isPureNetworkTransient } from "./transient-network.js";
 import { UnusableEntries } from "./unusable.js";
@@ -81,6 +82,8 @@ export class RetryFallbackController {
      * original is not is never where the session rests (senpi#2376). An original that is
      * itself still held (an account usage limit with the reset it named, which can outlast
      * the circuit's 30-minute ceiling) is not restored before that hold ends (senpi#3347).
+     * At a turn boundary, a changed credential on the original's provider first releases
+     * its billing pin and parks (senpi#4099).
      */
     async maybeRestorePrimary(revertPolicy, boundary = "turn") {
         const heldForNetworkBlip = this.heldForNetworkBlip && boundary === "continuation";
@@ -88,14 +91,16 @@ export class RetryFallbackController {
             this.heldForNetworkBlip = false;
         const state = this.state;
         const current = this.deps.getCurrentSelector();
-        if (!state || state.pinned || !current)
+        if (!state || !current)
             return false;
         const selector = parseFallbackSelector(state.originalSelector, this.deps.registry);
-        if (!selector || !this.deps.isAuthAvailable(selector.provider))
-            return false;
-        const model = this.deps.registry.find(selector.provider, selector.id);
+        const model = selector && this.deps.registry.find(selector.provider, selector.id);
         if (!model)
             return false;
+        if (boundary === "turn")
+            await releaseOnCredentialChange(state, model, this.deps, this.unusable);
+        if (state.pinned || !this.deps.isAuthAvailable(model.provider))
+            return false;
         const stranded = this.unusable.isUnusable(current.model) && !this.unusable.isUnusable(model);
         if (!stranded &&
             (heldForNetworkBlip || this.unusable.isUnusable(model) || !this.originalRecovered(state, revertPolicy)))
@@ -313,7 +318,11 @@ export class RetryFallbackController {
         const from = formatSelector(current.model);
         const to = formatSelector(candidate.model);
         const prior = this.state;
+        const recoveryRevision = prior
+            ? prior.recoveryRevision
+            : await this.deps.recoveryRevision?.(current.model.provider);
         this.state = {
+            ...(recoveryRevision === undefined ? {} : { recoveryRevision }),
             chainKey: candidate.chainKey,
             originalThinkingLevel: prior?.originalThinkingLevel ?? current.thinkingLevel,
             lastAppliedThinkingLevel: thinking,

package/dist/core/retry-fallback/credential-recovery.d.ts

@@ -0,0 +1,18 @@
+import type { Api, Model } from "@earendil-works/pi-ai";
+import type { ActiveFallbackState, RetryFallbackControllerDeps } from "./controller-types.ts";
+import type { UnusableEntries } from "./unusable.ts";
+type RecoveryDeps = Pick<RetryFallbackControllerDeps, "recoveryRevision" | "cooldowns" | "circuits" | "logger">;
+/**
+ * A billing pin assumes the original's account cannot recover by retrying it. A sign-in changes
+ * that account, so when the original provider's login id moved since the episode began, the
+ * billing pin and the original's cooldown, unusable mark and circuit are released and the
+ * existing revert path tries it once. A still-dead original falls back again and pins with the
+ * fresh id. This step reads the store at a turn boundary only while a billing pin holds; the
+ * other read is `applyCandidate` (controller.ts), once when an episode begins at its first
+ * fallback switch, to record the starting id. A token refresh keeps the id or drops it to "", and
+ * an id that is gone ("") is no sign-in, so neither releases. Refusal pins hold: a new credential
+ * does not change the context that was refused (senpi#4099).
+ */
+export declare function releaseOnCredentialChange(state: ActiveFallbackState, original: Model<Api>, deps: RecoveryDeps, unusable: UnusableEntries): Promise<void>;
+export {};
+//# sourceMappingURL=credential-recovery.d.ts.map

package/dist/core/retry-fallback/credential-recovery.js

@@ -0,0 +1,32 @@
+import { formatSelector } from "./chains.js";
+/**
+ * A billing pin assumes the original's account cannot recover by retrying it. A sign-in changes
+ * that account, so when the original provider's login id moved since the episode began, the
+ * billing pin and the original's cooldown, unusable mark and circuit are released and the
+ * existing revert path tries it once. A still-dead original falls back again and pins with the
+ * fresh id. This step reads the store at a turn boundary only while a billing pin holds; the
+ * other read is `applyCandidate` (controller.ts), once when an episode begins at its first
+ * fallback switch, to record the starting id. A token refresh keeps the id or drops it to "", and
+ * an id that is gone ("") is no sign-in, so neither releases. Refusal pins hold: a new credential
+ * does not change the context that was refused (senpi#4099).
+ */
+export async function releaseOnCredentialChange(state, original, deps, unusable) {
+    if (!state.pinnedByBilling || state.recoveryRevision === undefined || !deps.recoveryRevision)
+        return;
+    const revision = await deps.recoveryRevision(original.provider);
+    if (!revision || revision === state.recoveryRevision)
+        return;
+    state.recoveryRevision = revision;
+    state.pinnedByBilling = false;
+    state.pinned = state.pinnedByRefusal;
+    const selector = formatSelector(original);
+    deps.cooldowns.clearModel(selector);
+    unusable.clear(original);
+    deps.circuits?.close(selector);
+    deps.logger.info("credential_recovery_released", {
+        chainKey: state.chainKey,
+        originalSelector: state.originalSelector,
+        trigger: "sign-in",
+    });
+}
+//# sourceMappingURL=credential-recovery.js.map