@code-yeongyu/senpi 2026.11.6-2 → 2026.11.6-3

package/dist/core/permission-decision.js

@@ -0,0 +1,53 @@
+import { parsePermissionPresetName } from "./extensions/builtin/permission-system/cli.js";
+import { registerDecisionPresetOverride } from "./extensions/builtin/permission-system/preset-registry.js";
+import { decidingTurnIsDelegated } from "./turn-origin.js";
+const liveSessions = new Map();
+/**
+ * Binds the remote approval-mode rule to one live session, evaluated at EACH gated decision:
+ * 1. a preset a client named for the session wins (no override);
+ * 2. delegated-origin work asks, or uses the mode a client recorded in the session file when the operator named none.
+ *    It is decided before any `spawnedBy` inheritance, because `spawnedBy` is a client-supplied claim: naming a
+ *    parent, real or made up, can never take a remote device's turn off this rule;
+ * 3. a child (`spawnedBy`) follows its live parent's mode for the parent's current turn; a child whose parent is not
+ *    live in this process asks, unless the operator named a preset for it with the launch flag;
+ * 4. anything else keeps the host's own default (no override).
+ */
+export function bindDecisionPreset(session) {
+    liveSessions.set(session.sessionManager.getSessionId(), session);
+    registerDecisionPresetOverride(session.sessionManager, () => decisionPreset(session, new Set()));
+}
+export function releaseDecisionPreset(sessionManager) {
+    const id = sessionManager.getSessionId();
+    if (liveSessions.get(id)?.sessionManager === sessionManager)
+        liveSessions.delete(id);
+}
+function decisionPreset(session, visited) {
+    if (session.namedPreset() !== undefined)
+        return undefined;
+    if (decidingTurnIsDelegated(session.sessionManager))
+        return delegatedPreset(session);
+    const parentId = session.sessionManager.getHeader()?.spawnedBy?.parentSessionId;
+    if (parentId === undefined)
+        return undefined;
+    const parent = liveSessions.get(parentId);
+    if (parent === undefined)
+        return session.launchFlagNamed() ? undefined : "ask";
+    // A `spawnedBy` loop (only a crafted session file can make one) has no parent to follow: it asks.
+    if (visited.has(parent) || parent === session)
+        return "ask";
+    visited.add(session);
+    return effectivePresetOf(parent, visited);
+}
+function effectivePresetOf(session, visited) {
+    const named = session.namedPreset();
+    if (named !== undefined)
+        return parsePermissionPresetName(named);
+    return decisionPreset(session, visited);
+}
+function delegatedPreset(session) {
+    if (session.launchFlagNamed())
+        return "ask";
+    const recorded = session.recordedPreset();
+    return (recorded === undefined ? undefined : parsePermissionPresetName(recorded)) ?? "ask";
+}
+//# sourceMappingURL=permission-decision.js.map

package/dist/core/permission-mode.d.ts

@@ -0,0 +1,56 @@
+import type { PermissionPresetName } from "./extensions/builtin/permission-system/types.ts";
+import type { SessionManager } from "./session-manager.ts";
+import type { SettingsManager } from "./settings-manager.ts";
+/** `client`: a client named a valid preset for this session. `host_default`: the host's own default applies. */
+export type PermissionPresetSource = "client" | "host_default";
+/** `invalid`: the named preset (or the host's settings) cannot be parsed; every gated tool call is refused. */
+export type PermissionPresetStatus = "applied" | "invalid";
+/** The approval mode a session enforces, as `get_state`, the open reply and `set_permission_preset` report it. */
+export interface PermissionMode {
+    readonly permissionPreset: string;
+    readonly permissionPresetSource: PermissionPresetSource;
+    readonly permissionPresetStatus: PermissionPresetStatus;
+    /** What the next gated decision uses; `null` while the setup is invalid (every gated call is refused). */
+    readonly effectivePermissionPreset: PermissionPresetName | null;
+}
+/** The mode fields `set_permission_preset` and the open reply confirm a requested preset by. */
+export type PermissionModeReply = Pick<PermissionMode, "permissionPreset" | "permissionPresetSource" | "permissionPresetStatus">;
+type ModeSession = Parameters<typeof permissionModeOf>[0] & {
+    readonly sessionManager: Pick<SessionManager, "getEntries" | "appendCustomEntry" | "getHeader" | "getSessionId">;
+    readonly extensionRunner: {
+        emitBusEvent(channel: string, data: unknown): void;
+    };
+};
+export declare function markHostDefaultPresetFlag(session: object, profile: {
+    readonly permissionPresetSource?: "host_default";
+} | undefined): void;
+export declare function permissionModeOf(session: {
+    readonly sessionManager: object;
+    readonly settingsManager: SettingsManager;
+    readonly extensionRunner: {
+        getFlagValues(): ReadonlyMap<string, boolean | string>;
+    };
+}): PermissionMode;
+/** The preset a launch profile names as a client's choice; an embedder's host default is not one. */
+export declare function clientNamedPreset(profile: {
+    readonly permissionPreset?: string;
+    readonly permissionPresetSource?: "host_default";
+} | undefined): string | undefined;
+/** A profile whose preset a client just named: the host-default marker no longer applies. */
+export declare function withClientPreset<P extends {
+    readonly permissionPreset?: string;
+    readonly permissionPresetSource?: "host_default";
+}>(profile: P, preset: string): Readonly<P>;
+export declare function permissionModeReply(mode: PermissionMode): PermissionModeReply;
+export declare function openReplyPermissionMode(state: Partial<PermissionMode>): Partial<PermissionModeReply>;
+/**
+ * Binds the preset a client named to the live session: reported as `client`, persisted to its file, and, for a change
+ * to a running session (`announce`), published on the session's `permission_preset_changed` bus channel.
+ */
+/** Binds the per-decision approval-mode rule to a session, wherever it was created (runtime, SDK, in-process child). */
+export declare function bindPermissionDecision(session: ModeSession): void;
+export declare function applyClientPermissionMode(session: ModeSession, preset: string | undefined, options: {
+    readonly announce: boolean;
+}): void;
+export {};
+//# sourceMappingURL=permission-mode.d.ts.map

package/dist/core/permission-mode.js

@@ -0,0 +1,133 @@
+import { parsePermissionPresetName } from "./extensions/builtin/permission-system/cli.js";
+import { readPermissionPreset } from "./extensions/builtin/permission-system/preset-registry.js";
+import { resolvePermissionPreset } from "./extensions/builtin/permission-system/settings.js";
+import { bindDecisionPreset } from "./permission-decision.js";
+const PERMISSION_PRESET_FLAG = "permission-preset";
+const PERMISSION_PRESET_CHANGED_CHANNEL = "permission_preset_changed";
+const PERMISSION_MODE_ENTRY = "permission_mode";
+const clientPresets = new WeakMap();
+// Sessions whose `permission-preset` flag holds the host's own default (an embedder's host option), not an operator flag.
+const hostDefaultFlagSessions = new WeakSet();
+export function markHostDefaultPresetFlag(session, profile) {
+    if (profile?.permissionPresetSource === "host_default")
+        hostDefaultFlagSessions.add(session);
+    else
+        hostDefaultFlagSessions.delete(session);
+}
+function markClientPermissionPreset(session, preset) {
+    if (preset === undefined)
+        clientPresets.delete(session);
+    else
+        clientPresets.set(session, preset);
+}
+export function permissionModeOf(session) {
+    const named = clientPresets.get(session);
+    const namedPreset = named === undefined ? undefined : parsePermissionPresetName(named);
+    if (namedPreset !== undefined)
+        return clientMode(namedPreset, readPermissionPreset(session.sessionManager));
+    const hostFlag = named === undefined ? session.extensionRunner.getFlagValues().get(PERMISSION_PRESET_FLAG) : named;
+    const hostPreset = typeof hostFlag === "string" ? parsePermissionPresetName(hostFlag) : undefined;
+    if (typeof hostFlag === "string" && hostPreset === undefined)
+        return invalidMode(hostFlag);
+    let preset;
+    try {
+        preset = resolvePermissionPreset(session.settingsManager, hostPreset);
+    }
+    catch {
+        return invalidMode(typeof hostFlag === "string" ? hostFlag : "");
+    }
+    return {
+        permissionPreset: preset,
+        permissionPresetSource: "host_default",
+        permissionPresetStatus: "applied",
+        effectivePermissionPreset: readPermissionPreset(session.sessionManager) ?? preset,
+    };
+}
+// The live permission system is the authority on what it enforces; the named preset stands in only while no
+// permission system has registered for the session yet (it loads with the session's extensions).
+function clientMode(preset, enforced) {
+    return {
+        permissionPreset: preset,
+        permissionPresetSource: "client",
+        permissionPresetStatus: "applied",
+        effectivePermissionPreset: enforced ?? preset,
+    };
+}
+// An invalid preset never counts as one a client set: rule 1 of the delegated-default design must never select an
+// unusable preset, so the source stays the host's while every gated call is refused (#2617).
+function invalidMode(preset) {
+    return {
+        permissionPreset: preset,
+        permissionPresetSource: "host_default",
+        permissionPresetStatus: "invalid",
+        effectivePermissionPreset: null,
+    };
+}
+/** The preset a launch profile names as a client's choice; an embedder's host default is not one. */
+export function clientNamedPreset(profile) {
+    return profile?.permissionPresetSource === "host_default" ? undefined : profile?.permissionPreset;
+}
+/** A profile whose preset a client just named: the host-default marker no longer applies. */
+export function withClientPreset(profile, preset) {
+    const { permissionPresetSource: _hostDefault, ...rest } = profile;
+    return Object.freeze({ ...rest, permissionPreset: preset });
+}
+export function permissionModeReply(mode) {
+    return {
+        permissionPreset: mode.permissionPreset,
+        permissionPresetSource: mode.permissionPresetSource,
+        permissionPresetStatus: mode.permissionPresetStatus,
+    };
+}
+function persistedClientPreset(sessionManager) {
+    const entries = sessionManager.getEntries();
+    for (let index = entries.length - 1; index >= 0; index--) {
+        const entry = entries[index];
+        if (entry?.type !== "custom" || entry.customType !== PERMISSION_MODE_ENTRY)
+            continue;
+        const data = entry.data;
+        if (typeof data !== "object" || data === null || !("preset" in data))
+            return undefined;
+        return typeof data.preset === "string" && parsePermissionPresetName(data.preset) ? data.preset : undefined;
+    }
+    return undefined;
+}
+export function openReplyPermissionMode(state) {
+    const { permissionPreset, permissionPresetSource, permissionPresetStatus } = state;
+    if (permissionPreset === undefined || permissionPresetSource === undefined || permissionPresetStatus === undefined)
+        return {};
+    return { permissionPreset, permissionPresetSource, permissionPresetStatus };
+}
+/**
+ * Binds the preset a client named to the live session: reported as `client`, persisted to its file, and, for a change
+ * to a running session (`announce`), published on the session's `permission_preset_changed` bus channel.
+ */
+/** Binds the per-decision approval-mode rule to a session, wherever it was created (runtime, SDK, in-process child). */
+export function bindPermissionDecision(session) {
+    bindDecisionPreset({
+        sessionManager: session.sessionManager,
+        namedPreset: () => clientPresets.get(session),
+        launchFlagNamed: () => !hostDefaultFlagSessions.has(session) &&
+            typeof session.extensionRunner.getFlagValues().get(PERMISSION_PRESET_FLAG) === "string",
+        recordedPreset: () => persistedClientPreset(session.sessionManager),
+    });
+}
+export function applyClientPermissionMode(session, preset, options) {
+    markClientPermissionPreset(session, preset);
+    persistClientPreset(session.sessionManager, preset);
+    bindPermissionDecision(session);
+    if (options.announce)
+        session.extensionRunner.emitBusEvent(PERMISSION_PRESET_CHANGED_CHANNEL, permissionModeOf(session));
+}
+/**
+ * Records a valid client-named preset as a `permission_mode` custom entry (bookkeeping only: nothing restores it
+ * on a later open). Writes only on a change; an invalid preset is never recorded.
+ */
+function persistClientPreset(sessionManager, preset) {
+    if (preset === undefined || parsePermissionPresetName(preset) === undefined)
+        return;
+    if (persistedClientPreset(sessionManager) === preset)
+        return;
+    sessionManager.appendCustomEntry(PERMISSION_MODE_ENTRY, { preset, source: "client" }, { startupBookkeeping: true });
+}
+//# sourceMappingURL=permission-mode.js.map

package/dist/core/retry-fallback/controller-types.d.ts

@@ -65,6 +65,12 @@ export interface RetryFallbackControllerDeps {
         from: string;
         to: string;
         cause?: FallbackRevertCause;
+    } | {
+        type: "usage_limit_scope_probe";
+        provider: string;
+        heldFamily: string;
+        probeFamily: string;
+        outcome: "served" | "widened";
     }): void;
     getCurrentSelector(): {
         model: Model<Api>;

package/dist/core/retry-fallback/controller.d.ts

@@ -19,6 +19,13 @@ export declare class RetryFallbackController {
     constructor(deps: RetryFallbackControllerDeps);
     get activeState(): Readonly<ActiveFallbackState> | undefined;
     get exhaustedChainKey(): string | undefined;
+    /** The weekly-limit family hold on `model`, while it lasts (senpi#5596). */
+    heldFamily(model: Model<Api>): {
+        readonly family: string;
+        readonly errorMessage: string;
+    } | undefined;
+    /** The families a no-family limit was confirmed on before it held the whole provider (senpi#5596). */
+    widenedFamiliesOf(provider: string): readonly string[] | undefined;
     get turnRefusals(): readonly FallbackRungRefusal[];
     isProviderSpent(provider: string): boolean;
     accountError(provider: string): string | undefined;
@@ -77,6 +84,7 @@ export declare class RetryFallbackController {
     noteProviderAccountsChanged(provider: string): void;
     /** A response this session got from `selector` succeeded: the entry serves it again (senpi#3467). */
     noteServed(selector: string): void;
+    private emitScopeProbe;
     /**
      * Records a failure that makes the entry unusable for every session - billing
      * or quota exhaustion, or a transient failure that spent its budget or failed a

package/dist/core/retry-fallback/controller.js

@@ -32,6 +32,14 @@ export class RetryFallbackController {
     get exhaustedChainKey() {
         return this.lastExhaustedChainKey;
     }
+    /** The weekly-limit family hold on `model`, while it lasts (senpi#5596). */
+    heldFamily(model) {
+        return this.unusable.heldFamily(model);
+    }
+    /** The families a no-family limit was confirmed on before it held the whole provider (senpi#5596). */
+    widenedFamiliesOf(provider) {
+        return this.unusable.widenedFamiliesOf(provider);
+    }
     get turnRefusals() {
         return [...this.refusals];
     }
@@ -209,6 +217,18 @@ export class RetryFallbackController {
     noteServed(selector) {
         this.ownFailures.delete(selector);
         this.probes.accept(selector);
+        const slash = selector.indexOf("/");
+        if (slash > 0)
+            this.emitScopeProbe(this.unusable.noteServed({
+                provider: selector.slice(0, slash),
+                id: selector.slice(slash + 1).split(":")[0] ?? "",
+            }));
+    }
+    emitScopeProbe(probe) {
+        if (probe === undefined)
+            return;
+        this.deps.logger.info("usage_limit_scope_probe", { ...probe });
+        this.deps.emit({ type: "usage_limit_scope_probe", ...probe });
     }
     /**
      * Records a failure that makes the entry unusable for every session - billing
@@ -216,7 +236,7 @@ export class RetryFallbackController {
      * half-open probe - independent of whether a fallback candidate remains.
      */
     noteHealthFailure(model, thinkingLevel, failure) {
-        this.unusable.note(model, failure);
+        this.emitScopeProbe(this.unusable.note(model, failure));
         if (!this.managedChainKey({ model, thinkingLevel }))
             return;
         // A pure network fault is the transport's, not the model's: it never opens the shared circuit (senpi#3306).
@@ -275,9 +295,17 @@ export class RetryFallbackController {
         // noteHealthFailure) so the final chain entry opens too.
         if (failureObserved && current && reason === "transient")
             this.noteHealthFailure(current.model, current.thinkingLevel, failure);
-        const limit = usageLimitScope(failure.errorMessage);
         if (failureObserved && current)
-            this.unusable.note(current.model, failure);
+            this.emitScopeProbe(this.unusable.note(current.model, failure));
+        // A weekly limit that named no family held only the failing family (senpi#5596): report it as that model's
+        // limit, so the switch never claims the account's other models were skipped.
+        const scopeOfText = usageLimitScope(failure.errorMessage);
+        const limit = scopeOfText === "account" &&
+            current &&
+            !this.unusable.isProviderSpent(current.model.provider) &&
+            this.unusable.heldFamily(current.model)
+            ? "model"
+            : scopeOfText;
         // A model-wide park (transient, billing) can rule out the current model's other rungs, so the
         // walk re-scans after noting it; the first scan logs only when no re-scan follows.
         const modelWidePark = !networkBlip && failureObserved && (reason === "transient" || reason === "billing");

package/dist/core/retry-fallback/unusable.d.ts

@@ -1,6 +1,13 @@
 import type { Api, Model } from "@earendil-works/pi-ai";
 import type { CircuitFailure } from "./controller-types.ts";
 import type { SelectorCooldowns } from "./cooldown.ts";
+/** A once-per-provider check of a limit that named no family (senpi#5596). */
+export type UsageLimitScopeProbe = {
+    readonly provider: string;
+    readonly heldFamily: string;
+    readonly probeFamily: string;
+    readonly outcome: "served" | "widened";
+};
 /**
  * Chain entries this session has seen refuse to serve for a reason retrying cannot
  * fix within the cooldown: an account-wide usage limit or billing failure (every
@@ -11,8 +18,21 @@ import type { SelectorCooldowns } from "./cooldown.ts";
 export declare class UnusableEntries {
     private readonly cooldowns;
     private readonly accountErrors;
+    /** Providers whose limit named no family: the family it hit, awaiting one request on another family. */
+    private readonly pendingProbes;
+    private readonly widenedFamilies;
+    private readonly familyErrors;
     constructor(cooldowns: SelectorCooldowns);
-    note(model: Model<Api>, failure: CircuitFailure): void;
+    note(model: Model<Api>, failure: CircuitFailure): UsageLimitScopeProbe | undefined;
+    /** A response served on `model`: a pending family probe on another family resolves as served. */
+    noteServed(model: Pick<Model<Api>, "provider" | "id">): UsageLimitScopeProbe | undefined;
+    /** The weekly-limit family hold on `model`, while it lasts (senpi#5596). */
+    heldFamily(model: Model<Api>): {
+        readonly family: string;
+        readonly errorMessage: string;
+    } | undefined;
+    /** The two families a no-family limit was confirmed on before it widened to the account. */
+    widenedFamiliesOf(provider: string): readonly string[] | undefined;
     isProviderSpent(provider: string): boolean;
     accountError(provider: string): string | undefined;
     /** Wall-clock time the provider said its account limit resets; undefined when the hold is a guessed default. */
@@ -26,5 +46,7 @@ export declare class UnusableEntries {
     clear(model: Model<Api>): void;
     /** The provider's accounts changed (a login, an added or re-authorized account): every hold it earned is stale. */
     clearProvider(provider: string, models: readonly Model<Api>[]): void;
+    /** A family hold and its pending probe go wherever the provider's own holds go (senpi#5596). */
+    private clearFamilyHolds;
 }
 //# sourceMappingURL=unusable.d.ts.map

package/dist/core/retry-fallback/unusable.js

@@ -1,6 +1,15 @@
 import { formatSelector } from "./chains.js";
 import { isHealthExhaustionFailure } from "./circuit-probes.js";
+import { rateLimitModelFamily } from "../credential-pool/model-scope.js";
+import { isBillingErrorMessage } from "./billing.js";
 import { usageLimitScope } from "./usage-limit.js";
+// A weekly window binds the account (seven_day) or one family (seven_day_opus/...); the text alone cannot tell.
+const WEEKLY_LIMIT = /\bweekly\b[^.]*\blimit\b/i;
+const MODEL_FAMILY = /(?:^|[^a-z])(opus|sonnet|haiku|fable|mythos)(?:[^a-z]|$)/i;
+/** The model family a model id belongs to, when it names one. */
+function modelFamilyOf(modelId) {
+    return MODEL_FAMILY.exec(modelId)?.[1]?.toLowerCase();
+}
 /**
  * Chain entries this session has seen refuse to serve for a reason retrying cannot
  * fix within the cooldown: an account-wide usage limit or billing failure (every
@@ -11,10 +20,36 @@ import { usageLimitScope } from "./usage-limit.js";
 export class UnusableEntries {
     constructor(cooldowns) {
         this.accountErrors = new Map();
+        /** Providers whose limit named no family: the family it hit, awaiting one request on another family. */
+        this.pendingProbes = new Map();
+        this.widenedFamilies = new Map();
+        this.familyErrors = new Map();
         this.cooldowns = cooldowns;
     }
     note(model, failure) {
         const scope = usageLimitScope(failure.errorMessage);
+        const family = modelFamilyOf(model.id);
+        // A subscription limit that names no family may bind only this family: hold it and let one request on
+        // another family decide, instead of marking every model of the account spent (senpi#5596).
+        if (scope === "account" &&
+            family !== undefined &&
+            failure.errorMessage !== undefined &&
+            WEEKLY_LIMIT.test(failure.errorMessage) &&
+            !isBillingErrorMessage(failure.errorMessage) &&
+            rateLimitModelFamily(failure.errorMessage) === undefined) {
+            const held = this.pendingProbes.get(model.provider);
+            if (held === undefined || held === family) {
+                this.pendingProbes.set(model.provider, family);
+                this.cooldowns.note(familyKey(model.provider, family), failure);
+                this.familyErrors.set(familyKey(model.provider, family), failure.errorMessage);
+                return undefined;
+            }
+            this.pendingProbes.delete(model.provider);
+            this.widenedFamilies.set(model.provider, [held, family]);
+            this.cooldowns.note(accountKey(model.provider), failure);
+            this.accountErrors.set(model.provider, failure.errorMessage);
+            return { provider: model.provider, heldFamily: held, probeFamily: family, outcome: "widened" };
+        }
         if (scope === "account") {
             this.cooldowns.note(accountKey(model.provider), failure);
             if (failure.errorMessage)
@@ -23,6 +58,29 @@ export class UnusableEntries {
         else if (scope === "model" || isHealthExhaustionFailure(failure.errorMessage)) {
             this.cooldowns.note(entryKey(model), failure);
         }
+        return undefined;
+    }
+    /** A response served on `model`: a pending family probe on another family resolves as served. */
+    noteServed(model) {
+        const held = this.pendingProbes.get(model.provider);
+        const family = modelFamilyOf(model.id);
+        if (held === undefined || family === undefined || family === held)
+            return undefined;
+        this.pendingProbes.delete(model.provider);
+        return { provider: model.provider, heldFamily: held, probeFamily: family, outcome: "served" };
+    }
+    /** The weekly-limit family hold on `model`, while it lasts (senpi#5596). */
+    heldFamily(model) {
+        const family = modelFamilyOf(model.id);
+        if (family === undefined)
+            return undefined;
+        const key = familyKey(model.provider, family);
+        const errorMessage = this.familyErrors.get(key);
+        return errorMessage !== undefined && this.cooldowns.isSuppressed(key) ? { family, errorMessage } : undefined;
+    }
+    /** The two families a no-family limit was confirmed on before it widened to the account. */
+    widenedFamiliesOf(provider) {
+        return this.isProviderSpent(provider) ? this.widenedFamilies.get(provider) : undefined;
     }
     isProviderSpent(provider) {
         return this.cooldowns.isSuppressed(accountKey(provider));
@@ -43,16 +101,21 @@ export class UnusableEntries {
             return false;
         this.cooldowns.clear(accountKey(provider));
         this.accountErrors.delete(provider);
+        this.clearFamilyHolds(provider);
         return true;
     }
     isUnusable(model) {
-        return this.isProviderSpent(model.provider) || this.cooldowns.isSuppressed(entryKey(model));
+        const family = modelFamilyOf(model.id);
+        return (this.isProviderSpent(model.provider) ||
+            this.cooldowns.isSuppressed(entryKey(model)) ||
+            (family !== undefined && this.cooldowns.isSuppressed(familyKey(model.provider, family))));
     }
     clear(model) {
         // A deliberate model selection allows the user to probe after reauth/reset.
         this.cooldowns.clear(entryKey(model));
         this.cooldowns.clear(accountKey(model.provider));
         this.accountErrors.delete(model.provider);
+        this.clearFamilyHolds(model.provider);
     }
     /** The provider's accounts changed (a login, an added or re-authorized account): every hold it earned is stale. */
     clearProvider(provider, models) {
@@ -62,6 +125,19 @@ export class UnusableEntries {
             if (model.provider === provider)
                 this.cooldowns.clear(entryKey(model));
         }
+        this.clearFamilyHolds(provider);
+    }
+    /** A family hold and its pending probe go wherever the provider's own holds go (senpi#5596). */
+    clearFamilyHolds(provider) {
+        const prefix = familyKey(provider, "");
+        for (const key of [...this.familyErrors.keys()]) {
+            if (!key.startsWith(prefix))
+                continue;
+            this.cooldowns.clear(key);
+            this.familyErrors.delete(key);
+        }
+        this.pendingProbes.delete(provider);
+        this.widenedFamilies.delete(provider);
     }
 }
 function accountKey(provider) {
@@ -70,6 +146,9 @@ function accountKey(provider) {
     // than the last surfaced account error. Explicit /model selection permits a probe.
     return `account:${provider}`;
 }
+function familyKey(provider, family) {
+    return `family:${provider}:${family}`;
+}
 function entryKey(model) {
     return `exhausted:${formatSelector(model)}`;
 }

package/dist/core/retry-fallback/usage-limit.d.ts

@@ -10,7 +10,7 @@ import type { SessionEntry } from "../session-manager.ts";
  */
 export type UsageLimitScope = "model" | "account";
 export declare class AccountUsageLimitError extends Error {
-    constructor(provider: string, raw?: string, resetsAt?: number);
+    constructor(provider: string, raw?: string, resetsAt?: number, families?: readonly string[]);
 }
 export declare function usageLimitScope(failure: string | undefined | Pick<AssistantMessage, "errorMessage" | "errorCause">): UsageLimitScope | undefined;
 /** Project advice without mutating the diagnostic-bearing engine message. */

package/dist/core/retry-fallback/usage-limit.js

@@ -2,12 +2,15 @@ import { describeProviderFailureForUser, isQuotaExhaustionMessage } from "@earen
 import { rateLimitModelFamily } from "../credential-pool/model-scope.js";
 import { isBillingErrorMessage } from "./billing.js";
 export class AccountUsageLimitError extends Error {
-    constructor(provider, raw = "usage limit reached", resetsAt) {
-        super(describeProviderFailureForUser(raw, {
+    constructor(provider, raw = "usage limit reached", resetsAt, families) {
+        const message = describeProviderFailureForUser(raw, {
             model: provider,
             usageLimit: "account",
             ...(resetsAt === undefined ? {} : { resetsAt: formatResetTime(resetsAt) }),
-        }));
+        });
+        super(families === undefined || families.length === 0
+            ? message
+            : `${message} The limit named no model family; it was confirmed on ${families.join(" and ")}.`);
         this.name = "AccountUsageLimitError";
     }
 }

package/dist/core/sdk.js

@@ -1,4 +1,5 @@
 import { join } from "node:path";
+import { bindPermissionDecision } from "./permission-mode.js";
 import { Agent, createInternalAgentChannel, setDefaultStreamFn, } from "@earendil-works/pi-agent-core";
 import { modelsAreEqual, streamSimple } from "@earendil-works/pi-ai/compat";
 import { getAgentDir } from "../config.js";
@@ -486,6 +487,7 @@ export async function createAgentSession(options = {}) {
         sessionManager.appendThinkingLevelChange(thinkingLevel, thinkingSelection, undefined, model);
     }
     sessionRef.current = session;
+    bindPermissionDecision(session);
     const extensionsResult = resourceLoader.getExtensions();
     return {
         session,

package/dist/core/session-log.js

@@ -7,7 +7,7 @@ const DEFAULT_MAX_BYTES = 5 * 1024 * 1024;
 const MAX_STRING_LENGTH = 200;
 const DEBUG_PREFIX = `[${APP_NAME}-session]`;
 const BLOCKED_KEY = /^(?:__proto__|constructor|prototype|headers?|env(?:ironment)?|authorization|credential(?:s)?|password|secret|token|api_?key|client_?secret)$/i;
-const ALLOWED_DATA_KEY = /^(?:action|attemptId|disposition|stage|error|mode|count|willRetry|deferAdmission|delivered|restored|cause|accepted|skipped|rejectionCause|reason|durationMs|kind|retryable|phase|op|bytes|generation|requestId|tokens|tokensBefore|tokensAfter|contextWindow|attempt|aborted|sessionId|role|provider|model|source|actor|from|to|duringTurn|persistDefault|extension|handlerEvent|queuedId|ageMs|seat|until|shared)$/;
+const ALLOWED_DATA_KEY = /^(?:action|attemptId|disposition|stage|error|mode|count|willRetry|deferAdmission|delivered|restored|cause|accepted|skipped|rejectionCause|reason|durationMs|kind|retryable|phase|op|bytes|generation|requestId|tokens|tokensBefore|tokensAfter|contextWindow|attempt|aborted|sessionId|role|provider|model|source|actor|from|to|duringTurn|persistDefault|extension|handlerEvent|queuedId|ageMs|seat|until|shared|toolCallId|parentToolCallId|toolName|thresholdMs|elapsedMs|queueDepth|queueHead)$/;
 const SENSITIVE_TEXT = /((?:authorization\s*[:=]\s*(?:bearer|basic)\s+)|(?:bearer\s+)|(?:[?&](?:api[_-]?key|token|secret|password|auth(?:orization)?)=))[^\s&,"'}\]]+/gi;
 export function createSessionLogger(agentDir, options = {}) {
     if (typeof agentDir !== "string" || agentDir.length === 0) {

package/dist/core/stall-warning.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Deadline-bounded warnings for waits that have no deadline of their own (senpi#6189).
+ *
+ * A wait that never settles leaves no trace: no timer fires, no result is written, and the
+ * session just idles. These helpers only observe such a wait. They log once when it outlives
+ * its threshold and never resolve, reject, abort or delay anything themselves.
+ */
+/** A wait still pending after this long is logged once. A bash spawn's own shorter timeout lowers it. */
+export declare const STALL_WARNING_MS = 30000;
+/** The warning threshold for a bash spawn whose own `timeout` (in seconds) may be shorter than {@link STALL_WARNING_MS}. */
+export declare function stallThresholdMs(timeoutSeconds: unknown): number;
+export declare function queueEntryLabel(event: {
+    readonly type: string;
+}): string;
+export interface StallWatch {
+    stop(): void;
+}
+/**
+ * Call `onStall` once if `stop` has not run within `thresholdMs`. The caller keeps its own `await`, so the
+ * watched wait's outcome and ordering are unchanged. The timer is unref'd: it never keeps the process alive.
+ */
+export declare function watchForStall(thresholdMs: number, onStall: (elapsedMs: number) => void): StallWatch;
+export interface PendingQueueSnapshot {
+    readonly queueDepth: number;
+    /** Label of the oldest unsettled entry: the one every later entry waits behind. */
+    readonly queueHead?: string;
+    readonly ageMs?: number;
+}
+/** The unsettled entries of a promise chain, oldest first, so a stalled wait on the chain can name what it waits behind. */
+export declare class PendingQueueLedger {
+    private nextId;
+    private readonly entries;
+    /**
+     * Record `run` as an entry from now until it settles, and return it wrapped for the chain. The wrapper returns
+     * exactly what `run` returns or throws, and releases the entry from that result. It never attaches a handler to
+     * the chain itself, so a rejection on the chain is exactly as visible (or unhandled) as before.
+     */
+    track<A extends unknown[], R>(label: string, run: (...args: A) => R): (...args: A) => R;
+    snapshot(): PendingQueueSnapshot;
+}
+//# sourceMappingURL=stall-warning.d.ts.map