@code-yeongyu/senpi 2026.11.6-2 → 2026.11.9-2

package/dist/core/external-admission.js

@@ -1,4 +1,5 @@
 import { isSessionControlDeliveryDetails, SESSION_CONTROL_DELIVERY_TYPE, } from "./extensions/session-control-types.js";
+import { markInputTurnOrigin } from "./turn-origin.js";
 export class ExternalAdmission {
     constructor(port) {
         this.turnEpochValue = 0;
@@ -81,7 +82,7 @@ export class ExternalAdmission {
             ? { can_admit: true, ...base }
             : { can_admit: false, hold_reason: editor.hold_reason, ...base };
     }
-    admit(input) {
+    admit(input, stamp = {}) {
         if (this.closedReason !== undefined)
             throw new Error(this.closedReason);
         const turn_epoch = this.turnEpochValue;
@@ -95,7 +96,7 @@ export class ExternalAdmission {
         if (input.expected_turn_id !== undefined && input.expected_turn_id !== turn_epoch) {
             return { kind: "turn_conflict", turn_epoch };
         }
-        const message = deliveryMessage(input);
+        const message = deliveryMessage(input, stamp);
         if (!this.isBusy() && input.whenIdle !== "queue") {
             this.pending.set(id, "start");
             // A start that settles without writing the entry left it queued for later (the runtime's
@@ -188,8 +189,8 @@ export class ExternalAdmission {
         return false;
     }
 }
-function deliveryMessage(input) {
-    return {
+function deliveryMessage(input, stamp) {
+    const message = {
         role: "custom",
         customType: SESSION_CONTROL_DELIVERY_TYPE,
         content: input.text,
@@ -200,10 +201,27 @@ function deliveryMessage(input) {
             deliverAs: input.deliverAs,
             ...(input.sender === undefined ? {} : { sender: input.sender }),
             ...(input.display_text === undefined ? {} : { display_text: input.display_text }),
+            ...(stamp.remoteOrigin === undefined ? {} : { remote_origin: stamp.remoteOrigin }),
+            ...(stamp.chainCount === undefined ? {} : { chain_count: stamp.chainCount }),
         },
         timestamp: Date.now(),
     };
+    // The mark rides the message into the run, where the turn that consumes it takes its origin (turn-origin.ts).
+    if (stamp.turnMark !== undefined)
+        markInputTurnOrigin(message, stamp.turnMark);
+    return message;
 }
+/** Every delivery id the transcript holds an entry for: what answers for the process-lifetime ledger after a restart. */
+export const writtenDeliveryIds = {
+    initial: () => new Set(),
+    add: (ids, entry) => {
+        if (entry.type === "custom_message" &&
+            entry.customType === SESSION_CONTROL_DELIVERY_TYPE &&
+            isSessionControlDeliveryDetails(entry.details))
+            ids.add(entry.details.delivery_id);
+        return ids;
+    },
+};
 export function deliveryIdOf(message) {
     if (message.role !== "custom" || message.customType !== SESSION_CONTROL_DELIVERY_TYPE)
         return undefined;

package/dist/core/permission-decision.d.ts

@@ -0,0 +1,22 @@
+import type { SessionManager } from "./session-manager.ts";
+type DecisionSessionManager = Pick<SessionManager, "getEntries" | "getHeader" | "getSessionId">;
+export interface DecisionSession {
+    readonly sessionManager: DecisionSessionManager;
+    readonly namedPreset: () => string | undefined;
+    readonly launchFlagNamed: () => boolean;
+    readonly recordedPreset: () => string | undefined;
+}
+/**
+ * Binds the remote approval-mode rule to one live session, evaluated at EACH gated decision:
+ * 1. a preset a client named for the session wins (no override);
+ * 2. delegated-origin work asks, or uses the mode a client recorded in the session file when the operator named none.
+ *    It is decided before any `spawnedBy` inheritance, because `spawnedBy` is a client-supplied claim: naming a
+ *    parent, real or made up, can never take a remote device's turn off this rule;
+ * 3. a child (`spawnedBy`) follows its live parent's mode for the parent's current turn; a child whose parent is not
+ *    live in this process asks, unless the operator named a preset for it with the launch flag;
+ * 4. anything else keeps the host's own default (no override).
+ */
+export declare function bindDecisionPreset(session: DecisionSession): void;
+export declare function releaseDecisionPreset(sessionManager: DecisionSessionManager): void;
+export {};
+//# sourceMappingURL=permission-decision.d.ts.map

package/dist/core/permission-decision.js

@@ -0,0 +1,53 @@
+import { parsePermissionPresetName } from "./extensions/builtin/permission-system/cli.js";
+import { registerDecisionPresetOverride } from "./extensions/builtin/permission-system/preset-registry.js";
+import { decidingTurnIsDelegated } from "./turn-origin.js";
+const liveSessions = new Map();
+/**
+ * Binds the remote approval-mode rule to one live session, evaluated at EACH gated decision:
+ * 1. a preset a client named for the session wins (no override);
+ * 2. delegated-origin work asks, or uses the mode a client recorded in the session file when the operator named none.
+ *    It is decided before any `spawnedBy` inheritance, because `spawnedBy` is a client-supplied claim: naming a
+ *    parent, real or made up, can never take a remote device's turn off this rule;
+ * 3. a child (`spawnedBy`) follows its live parent's mode for the parent's current turn; a child whose parent is not
+ *    live in this process asks, unless the operator named a preset for it with the launch flag;
+ * 4. anything else keeps the host's own default (no override).
+ */
+export function bindDecisionPreset(session) {
+    liveSessions.set(session.sessionManager.getSessionId(), session);
+    registerDecisionPresetOverride(session.sessionManager, () => decisionPreset(session, new Set()));
+}
+export function releaseDecisionPreset(sessionManager) {
+    const id = sessionManager.getSessionId();
+    if (liveSessions.get(id)?.sessionManager === sessionManager)
+        liveSessions.delete(id);
+}
+function decisionPreset(session, visited) {
+    if (session.namedPreset() !== undefined)
+        return undefined;
+    if (decidingTurnIsDelegated(session.sessionManager))
+        return delegatedPreset(session);
+    const parentId = session.sessionManager.getHeader()?.spawnedBy?.parentSessionId;
+    if (parentId === undefined)
+        return undefined;
+    const parent = liveSessions.get(parentId);
+    if (parent === undefined)
+        return session.launchFlagNamed() ? undefined : "ask";
+    // A `spawnedBy` loop (only a crafted session file can make one) has no parent to follow: it asks.
+    if (visited.has(parent) || parent === session)
+        return "ask";
+    visited.add(session);
+    return effectivePresetOf(parent, visited);
+}
+function effectivePresetOf(session, visited) {
+    const named = session.namedPreset();
+    if (named !== undefined)
+        return parsePermissionPresetName(named);
+    return decisionPreset(session, visited);
+}
+function delegatedPreset(session) {
+    if (session.launchFlagNamed())
+        return "ask";
+    const recorded = session.recordedPreset();
+    return (recorded === undefined ? undefined : parsePermissionPresetName(recorded)) ?? "ask";
+}
+//# sourceMappingURL=permission-decision.js.map

package/dist/core/permission-mode.d.ts

@@ -0,0 +1,56 @@
+import type { PermissionPresetName } from "./extensions/builtin/permission-system/types.ts";
+import type { SessionManager } from "./session-manager.ts";
+import type { SettingsManager } from "./settings-manager.ts";
+/** `client`: a client named a valid preset for this session. `host_default`: the host's own default applies. */
+export type PermissionPresetSource = "client" | "host_default";
+/** `invalid`: the named preset (or the host's settings) cannot be parsed; every gated tool call is refused. */
+export type PermissionPresetStatus = "applied" | "invalid";
+/** The approval mode a session enforces, as `get_state`, the open reply and `set_permission_preset` report it. */
+export interface PermissionMode {
+    readonly permissionPreset: string;
+    readonly permissionPresetSource: PermissionPresetSource;
+    readonly permissionPresetStatus: PermissionPresetStatus;
+    /** What the next gated decision uses; `null` while the setup is invalid (every gated call is refused). */
+    readonly effectivePermissionPreset: PermissionPresetName | null;
+}
+/** The mode fields `set_permission_preset` and the open reply confirm a requested preset by. */
+export type PermissionModeReply = Pick<PermissionMode, "permissionPreset" | "permissionPresetSource" | "permissionPresetStatus">;
+type ModeSession = Parameters<typeof permissionModeOf>[0] & {
+    readonly sessionManager: Pick<SessionManager, "getEntries" | "appendCustomEntry" | "getHeader" | "getSessionId">;
+    readonly extensionRunner: {
+        emitBusEvent(channel: string, data: unknown): void;
+    };
+};
+export declare function markHostDefaultPresetFlag(session: object, profile: {
+    readonly permissionPresetSource?: "host_default";
+} | undefined): void;
+export declare function permissionModeOf(session: {
+    readonly sessionManager: object;
+    readonly settingsManager: SettingsManager;
+    readonly extensionRunner: {
+        getFlagValues(): ReadonlyMap<string, boolean | string>;
+    };
+}): PermissionMode;
+/** The preset a launch profile names as a client's choice; an embedder's host default is not one. */
+export declare function clientNamedPreset(profile: {
+    readonly permissionPreset?: string;
+    readonly permissionPresetSource?: "host_default";
+} | undefined): string | undefined;
+/** A profile whose preset a client just named: the host-default marker no longer applies. */
+export declare function withClientPreset<P extends {
+    readonly permissionPreset?: string;
+    readonly permissionPresetSource?: "host_default";
+}>(profile: P, preset: string): Readonly<P>;
+export declare function permissionModeReply(mode: PermissionMode): PermissionModeReply;
+export declare function openReplyPermissionMode(state: Partial<PermissionMode>): Partial<PermissionModeReply>;
+/**
+ * Binds the preset a client named to the live session: reported as `client`, persisted to its file, and, for a change
+ * to a running session (`announce`), published on the session's `permission_preset_changed` bus channel.
+ */
+/** Binds the per-decision approval-mode rule to a session, wherever it was created (runtime, SDK, in-process child). */
+export declare function bindPermissionDecision(session: ModeSession): void;
+export declare function applyClientPermissionMode(session: ModeSession, preset: string | undefined, options: {
+    readonly announce: boolean;
+}): void;
+export {};
+//# sourceMappingURL=permission-mode.d.ts.map

package/dist/core/permission-mode.js

@@ -0,0 +1,133 @@
+import { parsePermissionPresetName } from "./extensions/builtin/permission-system/cli.js";
+import { readPermissionPreset } from "./extensions/builtin/permission-system/preset-registry.js";
+import { resolvePermissionPreset } from "./extensions/builtin/permission-system/settings.js";
+import { bindDecisionPreset } from "./permission-decision.js";
+const PERMISSION_PRESET_FLAG = "permission-preset";
+const PERMISSION_PRESET_CHANGED_CHANNEL = "permission_preset_changed";
+const PERMISSION_MODE_ENTRY = "permission_mode";
+const clientPresets = new WeakMap();
+// Sessions whose `permission-preset` flag holds the host's own default (an embedder's host option), not an operator flag.
+const hostDefaultFlagSessions = new WeakSet();
+export function markHostDefaultPresetFlag(session, profile) {
+    if (profile?.permissionPresetSource === "host_default")
+        hostDefaultFlagSessions.add(session);
+    else
+        hostDefaultFlagSessions.delete(session);
+}
+function markClientPermissionPreset(session, preset) {
+    if (preset === undefined)
+        clientPresets.delete(session);
+    else
+        clientPresets.set(session, preset);
+}
+export function permissionModeOf(session) {
+    const named = clientPresets.get(session);
+    const namedPreset = named === undefined ? undefined : parsePermissionPresetName(named);
+    if (namedPreset !== undefined)
+        return clientMode(namedPreset, readPermissionPreset(session.sessionManager));
+    const hostFlag = named === undefined ? session.extensionRunner.getFlagValues().get(PERMISSION_PRESET_FLAG) : named;
+    const hostPreset = typeof hostFlag === "string" ? parsePermissionPresetName(hostFlag) : undefined;
+    if (typeof hostFlag === "string" && hostPreset === undefined)
+        return invalidMode(hostFlag);
+    let preset;
+    try {
+        preset = resolvePermissionPreset(session.settingsManager, hostPreset);
+    }
+    catch {
+        return invalidMode(typeof hostFlag === "string" ? hostFlag : "");
+    }
+    return {
+        permissionPreset: preset,
+        permissionPresetSource: "host_default",
+        permissionPresetStatus: "applied",
+        effectivePermissionPreset: readPermissionPreset(session.sessionManager) ?? preset,
+    };
+}
+// The live permission system is the authority on what it enforces; the named preset stands in only while no
+// permission system has registered for the session yet (it loads with the session's extensions).
+function clientMode(preset, enforced) {
+    return {
+        permissionPreset: preset,
+        permissionPresetSource: "client",
+        permissionPresetStatus: "applied",
+        effectivePermissionPreset: enforced ?? preset,
+    };
+}
+// An invalid preset never counts as one a client set: rule 1 of the delegated-default design must never select an
+// unusable preset, so the source stays the host's while every gated call is refused (#2617).
+function invalidMode(preset) {
+    return {
+        permissionPreset: preset,
+        permissionPresetSource: "host_default",
+        permissionPresetStatus: "invalid",
+        effectivePermissionPreset: null,
+    };
+}
+/** The preset a launch profile names as a client's choice; an embedder's host default is not one. */
+export function clientNamedPreset(profile) {
+    return profile?.permissionPresetSource === "host_default" ? undefined : profile?.permissionPreset;
+}
+/** A profile whose preset a client just named: the host-default marker no longer applies. */
+export function withClientPreset(profile, preset) {
+    const { permissionPresetSource: _hostDefault, ...rest } = profile;
+    return Object.freeze({ ...rest, permissionPreset: preset });
+}
+export function permissionModeReply(mode) {
+    return {
+        permissionPreset: mode.permissionPreset,
+        permissionPresetSource: mode.permissionPresetSource,
+        permissionPresetStatus: mode.permissionPresetStatus,
+    };
+}
+function persistedClientPreset(sessionManager) {
+    const entries = sessionManager.getEntries();
+    for (let index = entries.length - 1; index >= 0; index--) {
+        const entry = entries[index];
+        if (entry?.type !== "custom" || entry.customType !== PERMISSION_MODE_ENTRY)
+            continue;
+        const data = entry.data;
+        if (typeof data !== "object" || data === null || !("preset" in data))
+            return undefined;
+        return typeof data.preset === "string" && parsePermissionPresetName(data.preset) ? data.preset : undefined;
+    }
+    return undefined;
+}
+export function openReplyPermissionMode(state) {
+    const { permissionPreset, permissionPresetSource, permissionPresetStatus } = state;
+    if (permissionPreset === undefined || permissionPresetSource === undefined || permissionPresetStatus === undefined)
+        return {};
+    return { permissionPreset, permissionPresetSource, permissionPresetStatus };
+}
+/**
+ * Binds the preset a client named to the live session: reported as `client`, persisted to its file, and, for a change
+ * to a running session (`announce`), published on the session's `permission_preset_changed` bus channel.
+ */
+/** Binds the per-decision approval-mode rule to a session, wherever it was created (runtime, SDK, in-process child). */
+export function bindPermissionDecision(session) {
+    bindDecisionPreset({
+        sessionManager: session.sessionManager,
+        namedPreset: () => clientPresets.get(session),
+        launchFlagNamed: () => !hostDefaultFlagSessions.has(session) &&
+            typeof session.extensionRunner.getFlagValues().get(PERMISSION_PRESET_FLAG) === "string",
+        recordedPreset: () => persistedClientPreset(session.sessionManager),
+    });
+}
+export function applyClientPermissionMode(session, preset, options) {
+    markClientPermissionPreset(session, preset);
+    persistClientPreset(session.sessionManager, preset);
+    bindPermissionDecision(session);
+    if (options.announce)
+        session.extensionRunner.emitBusEvent(PERMISSION_PRESET_CHANGED_CHANNEL, permissionModeOf(session));
+}
+/**
+ * Records a valid client-named preset as a `permission_mode` custom entry (bookkeeping only: nothing restores it
+ * on a later open). Writes only on a change; an invalid preset is never recorded.
+ */
+function persistClientPreset(sessionManager, preset) {
+    if (preset === undefined || parsePermissionPresetName(preset) === undefined)
+        return;
+    if (persistedClientPreset(sessionManager) === preset)
+        return;
+    sessionManager.appendCustomEntry(PERMISSION_MODE_ENTRY, { preset, source: "client" }, { startupBookkeeping: true });
+}
+//# sourceMappingURL=permission-mode.js.map

package/dist/core/retry-fallback/controller-types.d.ts

@@ -65,6 +65,12 @@ export interface RetryFallbackControllerDeps {
         from: string;
         to: string;
         cause?: FallbackRevertCause;
+    } | {
+        type: "usage_limit_scope_probe";
+        provider: string;
+        heldFamily: string;
+        probeFamily: string;
+        outcome: "served" | "widened";
     }): void;
     getCurrentSelector(): {
         model: Model<Api>;

package/dist/core/retry-fallback/controller.d.ts

@@ -19,11 +19,19 @@ export declare class RetryFallbackController {
     constructor(deps: RetryFallbackControllerDeps);
     get activeState(): Readonly<ActiveFallbackState> | undefined;
     get exhaustedChainKey(): string | undefined;
+    /** The weekly-limit family hold on `model`, while it lasts (senpi#5596). */
+    heldFamily(model: Model<Api>): {
+        readonly family: string;
+        readonly errorMessage: string;
+    } | undefined;
+    /** The families a no-family limit was confirmed on before it held the whole provider (senpi#5596). */
+    widenedFamiliesOf(provider: string): readonly string[] | undefined;
     get turnRefusals(): readonly FallbackRungRefusal[];
     isProviderSpent(provider: string): boolean;
     accountError(provider: string): string | undefined;
     accountResetAt(provider: string): number | undefined;
     releaseGuessedAccountHold(provider: string): boolean;
+    releaseAccountHold(provider: string): boolean;
     resetTurn(): void;
     clear(): void;
     private canonicalChains;
@@ -77,6 +85,7 @@ export declare class RetryFallbackController {
     noteProviderAccountsChanged(provider: string): void;
     /** A response this session got from `selector` succeeded: the entry serves it again (senpi#3467). */
     noteServed(selector: string): void;
+    private emitScopeProbe;
     /**
      * Records a failure that makes the entry unusable for every session - billing
      * or quota exhaustion, or a transient failure that spent its budget or failed a

package/dist/core/retry-fallback/controller.js

@@ -32,6 +32,14 @@ export class RetryFallbackController {
     get exhaustedChainKey() {
         return this.lastExhaustedChainKey;
     }
+    /** The weekly-limit family hold on `model`, while it lasts (senpi#5596). */
+    heldFamily(model) {
+        return this.unusable.heldFamily(model);
+    }
+    /** The families a no-family limit was confirmed on before it held the whole provider (senpi#5596). */
+    widenedFamiliesOf(provider) {
+        return this.unusable.widenedFamiliesOf(provider);
+    }
     get turnRefusals() {
         return [...this.refusals];
     }
@@ -47,6 +55,9 @@ export class RetryFallbackController {
     releaseGuessedAccountHold(provider) {
         return this.unusable.releaseGuessedAccountHold(provider);
     }
+    releaseAccountHold(provider) {
+        return this.unusable.releaseAccountHold(provider);
+    }
     resetTurn() {
         this.triedSelectors.clear();
         this.refusedProviders.clear();
@@ -209,6 +220,18 @@ export class RetryFallbackController {
     noteServed(selector) {
         this.ownFailures.delete(selector);
         this.probes.accept(selector);
+        const slash = selector.indexOf("/");
+        if (slash > 0)
+            this.emitScopeProbe(this.unusable.noteServed({
+                provider: selector.slice(0, slash),
+                id: selector.slice(slash + 1).split(":")[0] ?? "",
+            }));
+    }
+    emitScopeProbe(probe) {
+        if (probe === undefined)
+            return;
+        this.deps.logger.info("usage_limit_scope_probe", { ...probe });
+        this.deps.emit({ type: "usage_limit_scope_probe", ...probe });
     }
     /**
      * Records a failure that makes the entry unusable for every session - billing
@@ -216,7 +239,7 @@ export class RetryFallbackController {
      * half-open probe - independent of whether a fallback candidate remains.
      */
     noteHealthFailure(model, thinkingLevel, failure) {
-        this.unusable.note(model, failure);
+        this.emitScopeProbe(this.unusable.note(model, failure));
         if (!this.managedChainKey({ model, thinkingLevel }))
             return;
         // A pure network fault is the transport's, not the model's: it never opens the shared circuit (senpi#3306).
@@ -275,9 +298,17 @@ export class RetryFallbackController {
         // noteHealthFailure) so the final chain entry opens too.
         if (failureObserved && current && reason === "transient")
             this.noteHealthFailure(current.model, current.thinkingLevel, failure);
-        const limit = usageLimitScope(failure.errorMessage);
         if (failureObserved && current)
-            this.unusable.note(current.model, failure);
+            this.emitScopeProbe(this.unusable.note(current.model, failure));
+        // A weekly limit that named no family held only the failing family (senpi#5596): report it as that model's
+        // limit, so the switch never claims the account's other models were skipped.
+        const scopeOfText = usageLimitScope(failure.errorMessage);
+        const limit = scopeOfText === "account" &&
+            current &&
+            !this.unusable.isProviderSpent(current.model.provider) &&
+            this.unusable.heldFamily(current.model)
+            ? "model"
+            : scopeOfText;
         // A model-wide park (transient, billing) can rule out the current model's other rungs, so the
         // walk re-scans after noting it; the first scan logs only when no re-scan follows.
         const modelWidePark = !networkBlip && failureObserved && (reason === "transient" || reason === "billing");

package/dist/core/retry-fallback/unusable.d.ts

@@ -1,6 +1,13 @@
 import type { Api, Model } from "@earendil-works/pi-ai";
 import type { CircuitFailure } from "./controller-types.ts";
 import type { SelectorCooldowns } from "./cooldown.ts";
+/** A once-per-provider check of a limit that named no family (senpi#5596). */
+export type UsageLimitScopeProbe = {
+    readonly provider: string;
+    readonly heldFamily: string;
+    readonly probeFamily: string;
+    readonly outcome: "served" | "widened";
+};
 /**
  * Chain entries this session has seen refuse to serve for a reason retrying cannot
  * fix within the cooldown: an account-wide usage limit or billing failure (every
@@ -11,8 +18,21 @@ import type { SelectorCooldowns } from "./cooldown.ts";
 export declare class UnusableEntries {
     private readonly cooldowns;
     private readonly accountErrors;
+    /** Providers whose limit named no family: the family it hit, awaiting one request on another family. */
+    private readonly pendingProbes;
+    private readonly widenedFamilies;
+    private readonly familyErrors;
     constructor(cooldowns: SelectorCooldowns);
-    note(model: Model<Api>, failure: CircuitFailure): void;
+    note(model: Model<Api>, failure: CircuitFailure): UsageLimitScopeProbe | undefined;
+    /** A response served on `model`: a pending family probe on another family resolves as served. */
+    noteServed(model: Pick<Model<Api>, "provider" | "id">): UsageLimitScopeProbe | undefined;
+    /** The weekly-limit family hold on `model`, while it lasts (senpi#5596). */
+    heldFamily(model: Model<Api>): {
+        readonly family: string;
+        readonly errorMessage: string;
+    } | undefined;
+    /** The two families a no-family limit was confirmed on before it widened to the account. */
+    widenedFamiliesOf(provider: string): readonly string[] | undefined;
     isProviderSpent(provider: string): boolean;
     accountError(provider: string): string | undefined;
     /** Wall-clock time the provider said its account limit resets; undefined when the hold is a guessed default. */
@@ -22,9 +42,13 @@ export declare class UnusableEntries {
      * (senpi#5568). A hold with a reset the provider stated is kept. Returns whether a hold was dropped.
      */
     releaseGuessedAccountHold(provider: string): boolean;
+    /** Drops the provider's account hold, whatever its length; returns whether one was held (senpi#5590). */
+    releaseAccountHold(provider: string): boolean;
     isUnusable(model: Model<Api>): boolean;
     clear(model: Model<Api>): void;
     /** The provider's accounts changed (a login, an added or re-authorized account): every hold it earned is stale. */
     clearProvider(provider: string, models: readonly Model<Api>[]): void;
+    /** A family hold and its pending probe go wherever the provider's own holds go (senpi#5596). */
+    private clearFamilyHolds;
 }
 //# sourceMappingURL=unusable.d.ts.map

package/dist/core/retry-fallback/unusable.js

@@ -1,6 +1,15 @@
 import { formatSelector } from "./chains.js";
 import { isHealthExhaustionFailure } from "./circuit-probes.js";
+import { rateLimitModelFamily } from "../credential-pool/model-scope.js";
+import { isBillingErrorMessage } from "./billing.js";
 import { usageLimitScope } from "./usage-limit.js";
+// A weekly window binds the account (seven_day) or one family (seven_day_opus/...); the text alone cannot tell.
+const WEEKLY_LIMIT = /\bweekly\b[^.]*\blimit\b/i;
+const MODEL_FAMILY = /(?:^|[^a-z])(opus|sonnet|haiku|fable|mythos)(?:[^a-z]|$)/i;
+/** The model family a model id belongs to, when it names one. */
+function modelFamilyOf(modelId) {
+    return MODEL_FAMILY.exec(modelId)?.[1]?.toLowerCase();
+}
 /**
  * Chain entries this session has seen refuse to serve for a reason retrying cannot
  * fix within the cooldown: an account-wide usage limit or billing failure (every
@@ -11,10 +20,36 @@ import { usageLimitScope } from "./usage-limit.js";
 export class UnusableEntries {
     constructor(cooldowns) {
         this.accountErrors = new Map();
+        /** Providers whose limit named no family: the family it hit, awaiting one request on another family. */
+        this.pendingProbes = new Map();
+        this.widenedFamilies = new Map();
+        this.familyErrors = new Map();
         this.cooldowns = cooldowns;
     }
     note(model, failure) {
         const scope = usageLimitScope(failure.errorMessage);
+        const family = modelFamilyOf(model.id);
+        // A subscription limit that names no family may bind only this family: hold it and let one request on
+        // another family decide, instead of marking every model of the account spent (senpi#5596).
+        if (scope === "account" &&
+            family !== undefined &&
+            failure.errorMessage !== undefined &&
+            WEEKLY_LIMIT.test(failure.errorMessage) &&
+            !isBillingErrorMessage(failure.errorMessage) &&
+            rateLimitModelFamily(failure.errorMessage) === undefined) {
+            const held = this.pendingProbes.get(model.provider);
+            if (held === undefined || held === family) {
+                this.pendingProbes.set(model.provider, family);
+                this.cooldowns.note(familyKey(model.provider, family), failure);
+                this.familyErrors.set(familyKey(model.provider, family), failure.errorMessage);
+                return undefined;
+            }
+            this.pendingProbes.delete(model.provider);
+            this.widenedFamilies.set(model.provider, [held, family]);
+            this.cooldowns.note(accountKey(model.provider), failure);
+            this.accountErrors.set(model.provider, failure.errorMessage);
+            return { provider: model.provider, heldFamily: held, probeFamily: family, outcome: "widened" };
+        }
         if (scope === "account") {
             this.cooldowns.note(accountKey(model.provider), failure);
             if (failure.errorMessage)
@@ -23,6 +58,29 @@ export class UnusableEntries {
         else if (scope === "model" || isHealthExhaustionFailure(failure.errorMessage)) {
             this.cooldowns.note(entryKey(model), failure);
         }
+        return undefined;
+    }
+    /** A response served on `model`: a pending family probe on another family resolves as served. */
+    noteServed(model) {
+        const held = this.pendingProbes.get(model.provider);
+        const family = modelFamilyOf(model.id);
+        if (held === undefined || family === undefined || family === held)
+            return undefined;
+        this.pendingProbes.delete(model.provider);
+        return { provider: model.provider, heldFamily: held, probeFamily: family, outcome: "served" };
+    }
+    /** The weekly-limit family hold on `model`, while it lasts (senpi#5596). */
+    heldFamily(model) {
+        const family = modelFamilyOf(model.id);
+        if (family === undefined)
+            return undefined;
+        const key = familyKey(model.provider, family);
+        const errorMessage = this.familyErrors.get(key);
+        return errorMessage !== undefined && this.cooldowns.isSuppressed(key) ? { family, errorMessage } : undefined;
+    }
+    /** The two families a no-family limit was confirmed on before it widened to the account. */
+    widenedFamiliesOf(provider) {
+        return this.isProviderSpent(provider) ? this.widenedFamilies.get(provider) : undefined;
     }
     isProviderSpent(provider) {
         return this.cooldowns.isSuppressed(accountKey(provider));
@@ -39,20 +97,31 @@ export class UnusableEntries {
      * (senpi#5568). A hold with a reset the provider stated is kept. Returns whether a hold was dropped.
      */
     releaseGuessedAccountHold(provider) {
-        if (!this.isProviderSpent(provider) || this.accountResetAt(provider) !== undefined)
+        if (this.accountResetAt(provider) !== undefined)
+            return false;
+        return this.releaseAccountHold(provider);
+    }
+    /** Drops the provider's account hold, whatever its length; returns whether one was held (senpi#5590). */
+    releaseAccountHold(provider) {
+        if (!this.isProviderSpent(provider))
             return false;
         this.cooldowns.clear(accountKey(provider));
         this.accountErrors.delete(provider);
+        this.clearFamilyHolds(provider);
         return true;
     }
     isUnusable(model) {
-        return this.isProviderSpent(model.provider) || this.cooldowns.isSuppressed(entryKey(model));
+        const family = modelFamilyOf(model.id);
+        return (this.isProviderSpent(model.provider) ||
+            this.cooldowns.isSuppressed(entryKey(model)) ||
+            (family !== undefined && this.cooldowns.isSuppressed(familyKey(model.provider, family))));
     }
     clear(model) {
         // A deliberate model selection allows the user to probe after reauth/reset.
         this.cooldowns.clear(entryKey(model));
         this.cooldowns.clear(accountKey(model.provider));
         this.accountErrors.delete(model.provider);
+        this.clearFamilyHolds(model.provider);
     }
     /** The provider's accounts changed (a login, an added or re-authorized account): every hold it earned is stale. */
     clearProvider(provider, models) {
@@ -62,6 +131,19 @@ export class UnusableEntries {
             if (model.provider === provider)
                 this.cooldowns.clear(entryKey(model));
         }
+        this.clearFamilyHolds(provider);
+    }
+    /** A family hold and its pending probe go wherever the provider's own holds go (senpi#5596). */
+    clearFamilyHolds(provider) {
+        const prefix = familyKey(provider, "");
+        for (const key of [...this.familyErrors.keys()]) {
+            if (!key.startsWith(prefix))
+                continue;
+            this.cooldowns.clear(key);
+            this.familyErrors.delete(key);
+        }
+        this.pendingProbes.delete(provider);
+        this.widenedFamilies.delete(provider);
     }
 }
 function accountKey(provider) {
@@ -70,6 +152,9 @@ function accountKey(provider) {
     // than the last surfaced account error. Explicit /model selection permits a probe.
     return `account:${provider}`;
 }
+function familyKey(provider, family) {
+    return `family:${provider}:${family}`;
+}
 function entryKey(model) {
     return `exhausted:${formatSelector(model)}`;
 }

package/dist/core/retry-fallback/usage-limit.d.ts

@@ -10,8 +10,13 @@ import type { SessionEntry } from "../session-manager.ts";
  */
 export type UsageLimitScope = "model" | "account";
 export declare class AccountUsageLimitError extends Error {
-    constructor(provider: string, raw?: string, resetsAt?: number);
+    /**
+     * `families`: a no-family weekly limit confirmed on these families before it held the provider (senpi#5596).
+     * `accountsOut`: a pooled provider's accounts, each with why it cannot serve (senpi#5590).
+     */
+    constructor(provider: string, raw?: string, resetsAt?: number, families?: readonly string[], accountsOut?: string);
 }
+export declare function formatResetTime(epochMs: number): string;
 export declare function usageLimitScope(failure: string | undefined | Pick<AssistantMessage, "errorMessage" | "errorCause">): UsageLimitScope | undefined;
 /** Project advice without mutating the diagnostic-bearing engine message. */
 export declare function describeUsageLimitMessage(message: AssistantMessage): AssistantMessage;