@code-yeongyu/senpi 2026.11.6-2 → 2026.11.9

package/dist/core/agent-session.js

@@ -56,6 +56,7 @@ import { CompactionLifecycleCoordinator } from "./compaction/lifecycle.js";
 import { isTurnStuckOnContextOverflow } from "./compaction/stuck-overflow.js";
 import { isWarmSummaryAnchorValid } from "./compaction/warm-anchor.js";
 import { CONTINUE_FROM_LEAF_CUSTOM_TYPE, CONTINUE_FROM_LEAF_DIRECTIVE, ContinueFromLeafError, trackTurnAdmission, } from "./continue-from-leaf.js";
+import { getCredentialAccounts } from "./credential-accounts.js";
 import { credentialRecoveryRevision } from "./credential-recovery-revision.js";
 import { admitCursorHistory, cursorAdmissionBudgetBytes } from "./cursor-history-admission.js";
 import { DEFAULT_THINKING_LEVEL } from "./defaults.js";
@@ -95,6 +96,8 @@ import { deliveryIdOf, ExternalAdmission } from "./external-admission.js";
 import { HELD_INPUT_ENTRY, HeldInputs, heldInputHistory } from "./held-inputs.js";
 import { shouldWarnHighReasoning } from "./high-reasoning-warning.js";
 import { customTurnOrigin, inputAttributionOf, inputOriginOf } from "./input-origin.js";
+import { copyInputTurnMark, hasInputTurnMark, inputTurnMark, markInputTurnOrigin, noteRunStart, noteUserMessageStart, } from "./turn-origin.js";
+import { releaseDecisionPreset } from "./permission-decision.js";
 import { markInterrupted } from "./interrupted-tool-result.js";
 import { deliveredReceipts, itemNoticeMessage, QueuedDeliveryCleared, } from "./itemized-send.js";
 import { LazyToolActivation } from "./lazy-tool-activation.js";
@@ -134,7 +137,7 @@ import { createFallbackLogger } from "./retry-fallback/log.js";
 import { createModelConfigErrorReporter, isModelConfigFailure, } from "./retry-fallback/model-config-error.js";
 import { ProbeBackScheduler } from "./retry-fallback/probe-scheduler.js";
 import { REQUEST_SHAPE_FAILURE_TEXT, REQUEST_SHAPE_RECOVERY_ENTRY_TYPE, REQUEST_SHAPE_RECOVERY_NOTE, RequestShapeRecovery, } from "./retry-fallback/request-shape.js";
-import { AccountUsageLimitError, describeUsageLimitEntry, describeUsageLimitMessage, usageLimitScope, } from "./retry-fallback/usage-limit.js";
+import { AccountUsageLimitError, formatResetTime, describeUsageLimitEntry, describeUsageLimitMessage, usageLimitScope, } from "./retry-fallback/usage-limit.js";
 import { recordRungFailure } from "./retry-fallback/exhaustion.js";
 import { limitResetAt } from "./retry-fallback/limit-reset.js";
 import { validateFallbackChains } from "./retry-fallback/validate.js";
@@ -156,6 +159,7 @@ import { formatSkillInvocationPrompt, formatSkillReferenceBody, parseSkillInvoca
 import { BUILTIN_SLASH_COMMANDS } from "./slash-commands.js";
 import { bootstrapRuntime, buildToolRegistry, isBuiltinExtensionPath, } from "./runtime/bootstrap.js";
 import { toolInfoOf } from "./tool-info.js";
+import { PendingQueueLedger, queueEntryLabel, STALL_WARNING_MS, watchForStall, } from "./stall-warning.js";
 import { stopResumeDirective } from "./stop-resume-directive.js";
 import { StructuredSessionLane } from "./structured-session-lane.js";
 import { clampThinkingSelection, getSupportedThinkingLevels, getThinkingClampNotice, supportsMax, supportsXhigh, } from "./thinking-levels.js";
@@ -436,6 +440,8 @@ export class AgentSession {
         this._unregisterMemoryReport = () => { };
         this._eventListeners = [];
         this._agentEventQueue = Promise.resolve();
+        /** What `_agentEventQueue` still holds, so a tool call stalled behind it can say what it waits on (senpi#6189). */
+        this._agentEventQueueLedger = new PendingQueueLedger();
         this._lifecycleEvents = new LifecycleEventSequencer();
         /**
          * Exact message objects whose message_end persistence is still queued.
@@ -669,7 +675,10 @@ export class AgentSession {
                 if (event.type === "agent_start") {
                     this._lifecycleBinding.startRun();
                     this._requestSelectedModel = undefined;
+                    noteRunStart(this.sessionManager);
                 }
+                if (event.type === "message_start" && (event.message.role === "user" || hasInputTurnMark(event.message)))
+                    noteUserMessageStart(this.sessionManager, event.message);
                 // Bind now: the core can start another run before this event's asynchronous delivery.
                 const bound = event.type === "agent_start" ? { ...event, runId: this._lifecycleBinding.controller.ledger.runId } : event;
                 queuedEvent = bound;
@@ -758,7 +767,8 @@ export class AgentSession {
                 this._lifecycleEvents.release(heldLifecycle, (held) => this._emit(held));
                 return this._processAgentEvent(queuedEvent, signal);
             };
-            const processing = this._agentEventQueue.then(deliverThenProcess, deliverThenProcess);
+            const tracked = this._agentEventQueueLedger.track(queueEntryLabel(queuedEvent), deliverThenProcess);
+            const processing = this._agentEventQueue.then(tracked, tracked);
             this._agentEventQueue =
                 pendingEnd !== undefined
                     ? processing.finally(() => {
@@ -780,7 +790,8 @@ export class AgentSession {
         this._structuredLane = new StructuredSessionLane(config.internalChannel, (deliver) => {
             if (!this._unsubscribeAgent)
                 return;
-            this._agentEventQueue = this._agentEventQueue.then(deliver, deliver);
+            const tracked = this._agentEventQueueLedger.track("structured_record", deliver);
+            this._agentEventQueue = this._agentEventQueue.then(tracked, tracked);
         }, (control) => this._recoveryIdentity?.own(control));
         this.sessionManager = config.sessionManager;
         this._unsubscribeRecovery = this.sessionManager.onRecovery((recovery) => {
@@ -1147,7 +1158,7 @@ export class AgentSession {
             this._modelRuntime.hasConfiguredAuth(model.provider));
         if (available)
             return available;
-        throw new AccountUsageLimitError(sessionModel.provider, this._retryFallback.accountError(sessionModel.provider), this._retryFallback.accountResetAt(sessionModel.provider));
+        throw new AccountUsageLimitError(sessionModel.provider, this._retryFallback.accountError(sessionModel.provider), this._retryFallback.accountResetAt(sessionModel.provider), this._retryFallback.widenedFamiliesOf(sessionModel.provider));
     }
     _logCompactionModelFallback(override, reason, sessionModel) {
         const notice = `${override}\u0000${reason}`;
@@ -1290,33 +1301,56 @@ export class AgentSession {
         };
     }
     async preflightToolCall(toolCall, args, options = {}) {
+        // Neither wait below has a deadline of its own: one that never settles is logged once, never cut short (senpi#6189).
+        // The call's own `timeout` bounds its execution, not this phase, which includes a human permission decision.
+        const thresholdMs = STALL_WARNING_MS;
+        const warnStalled = (event, elapsedMs, queue) => this._sessionLogger.warn(event, {
+            toolCallId: toolCall.id,
+            toolName: toolCall.name,
+            ...(options.parentToolCallId ? { parentToolCallId: options.parentToolCallId } : {}),
+            thresholdMs,
+            elapsedMs,
+            ...queue,
+        });
         if (options.waitForEventQueue !== false) {
-            await this._agentEventQueue;
-        }
-        const signal = options.signal ?? this.agent.signal;
-        // A call released by Stop never runs: block it without asking its hooks (a permission prompt) about it.
-        // Callers such as executeTool only honor an explicit block, so returning nothing here would let it run.
-        if ((await this._waitForToolBarrier(toolCall, signal)) && signal?.aborted) {
-            return { block: true, reason: "Operation aborted" };
-        }
-        const runner = this._extensionRunner;
-        if (!runner.hasHandlers("tool_call")) {
-            return undefined;
+            const queueWatch = watchForStall(thresholdMs, (elapsedMs) => warnStalled("tool_call_event_queue_stalled", elapsedMs, this._agentEventQueueLedger.snapshot()));
+            try {
+                await this._agentEventQueue;
+            }
+            finally {
+                queueWatch.stop();
+            }
         }
+        const preflightWatch = watchForStall(thresholdMs, (elapsedMs) => warnStalled("tool_call_preflight_stalled", elapsedMs));
         try {
-            return await runner.emitToolCall({
-                type: "tool_call",
-                toolName: toolCall.name,
-                toolCallId: toolCall.id,
-                ...(options.parentToolCallId ? { parentToolCallId: options.parentToolCallId } : {}),
-                input: args,
-            });
-        }
-        catch (err) {
-            if (err instanceof Error) {
-                throw err;
+            const signal = options.signal ?? this.agent.signal;
+            // A call released by Stop never runs: block it without asking its hooks (a permission prompt) about it.
+            // Callers such as executeTool only honor an explicit block, so returning nothing here would let it run.
+            if ((await this._waitForToolBarrier(toolCall, signal)) && signal?.aborted) {
+                return { block: true, reason: "Operation aborted" };
+            }
+            const runner = this._extensionRunner;
+            if (!runner.hasHandlers("tool_call")) {
+                return undefined;
             }
-            throw new Error(`Extension failed, blocking execution: ${String(err)}`);
+            try {
+                return await runner.emitToolCall({
+                    type: "tool_call",
+                    toolName: toolCall.name,
+                    toolCallId: toolCall.id,
+                    ...(options.parentToolCallId ? { parentToolCallId: options.parentToolCallId } : {}),
+                    input: args,
+                });
+            }
+            catch (err) {
+                if (err instanceof Error) {
+                    throw err;
+                }
+                throw new Error(`Extension failed, blocking execution: ${String(err)}`);
+            }
+        }
+        finally {
+            preflightWatch.stop();
         }
     }
     async _emitAfterToolCallHooks(toolCall, args, result, isError, parentToolCallId) {
@@ -3448,6 +3482,7 @@ export class AgentSession {
      */
     dispose() {
         this._disposed = true;
+        releaseDecisionPreset(this.sessionManager);
         this._unsubscribeSecurityNotices?.();
         this._unfollowProviderAccountChanges();
         this.securityNotices.dispose();
@@ -3717,6 +3752,19 @@ export class AgentSession {
     _warnDeadline(event, detail) {
         this._sessionLogger.warn(event, { detail });
     }
+    /**
+     * End the running turn because the process hosting this session is stopping (an RPC host shutting down or
+     * restarting): a system abort whose `agent_end` carries `abortCause: { kind: "host_shutdown" }`, never a user abort.
+     */
+    async abortForHostShutdown() {
+        if (!this.isStreaming)
+            return;
+        if (this._abortCause === undefined)
+            this._abortCause = { kind: "host_shutdown" };
+        await this._abortActiveAgentAndRetry("system");
+        if (!this.isIdle)
+            await this._waitForIdleAfterAbort();
+    }
     /** Adapter for the deadline owner interface: end the turn through the normal system abort. */
     async abortTurnForDeadline() {
         await this._abortActiveAgentAndRetry("system");
@@ -4302,6 +4350,42 @@ export class AgentSession {
      * @throws Error if streaming and no streamingBehavior specified
      * @throws Error if no model selected or no API key available (when not streaming)
      */
+    /**
+     * A provider whose stored credential pools two or more accounts: whether any of them can serve `modelId` now
+     * (no live block, and no live block on that model), and the accounts with why each is out. A cooling account is
+     * not usable until its cooldown ends, so an automated loop never probes a spent pool turn after turn (senpi#3131).
+     * Undefined for a single-credential provider, or when pool health cannot be read (the hold then stays).
+     * Reads pool health only, never key material.
+     */
+    async _pooledAccountHealth(provider, modelId) {
+        const storage = this._modelRuntime.authStorage;
+        if (storage === undefined)
+            return undefined;
+        let summaries;
+        try {
+            summaries = await getCredentialAccounts(storage, provider);
+        }
+        catch {
+            return undefined;
+        }
+        const accounts = summaries.filter((account) => account.unused !== true);
+        if (accounts.length < 2)
+            return undefined;
+        const now = Date.now();
+        const blocksModel = (blocked) => blocked.until > now &&
+            (blocked.model === modelId ||
+                new RegExp(`(?:^|[^a-z])${blocked.model}(?:[^a-z]|$)`, "i").test(modelId));
+        const usable = accounts.some((account) => !account.blocked && !(account.blockedModels ?? []).some(blocksModel));
+        const accountsOut = accounts
+            .map((account) => {
+            const reason = account.blockedReason ?? "blocked";
+            return account.blockedUntil === undefined
+                ? `${account.name} (${reason})`
+                : `${account.name} (${reason} until ${formatResetTime(account.blockedUntil)})`;
+        })
+            .join(", ");
+        return { usable, accountsOut };
+    }
     async prompt(text, options) {
         this._standingRecovery = undefined;
         const barrierError = options?.toolBarrier === undefined ? undefined : toolBarrierSpecError(options.toolBarrier);
@@ -4586,6 +4670,13 @@ export class AgentSession {
                 const model = this.model;
                 // A turn the user started asks the provider again unless it stated when the limit resets (senpi#5568);
                 // automated turns keep the remembered hold so a loop never hammers a spent account (senpi#3131).
+                // A pooled provider is out only when no account can serve: one account's billing or limit is that
+                // account's, and the pool's own block already routes around it (senpi#5590).
+                const pool = model && !this._pendingModelSwitch && this._retryFallback.isProviderSpent(model.provider)
+                    ? await this._pooledAccountHealth(model.provider, model.id)
+                    : undefined;
+                if (model && pool?.usable)
+                    this._retryFallback.releaseAccountHold(model.provider);
                 if (model &&
                     !this._pendingModelSwitch &&
                     this._retryFallback.isProviderSpent(model.provider) &&
@@ -4595,7 +4686,21 @@ export class AgentSession {
                     const errorMessage = this._retryFallback.accountError(model.provider);
                     // Routing around a remembered failure did not observe another provider failure.
                     if (!(await this._retryFallback.tryFallback("transient", { errorMessage }, false))) {
-                        throw new AccountUsageLimitError(model.provider, errorMessage, this._retryFallback.accountResetAt(model.provider));
+                        throw new AccountUsageLimitError(model.provider, errorMessage, this._retryFallback.accountResetAt(model.provider), this._retryFallback.widenedFamiliesOf(model.provider), pool?.accountsOut);
+                    }
+                }
+                // A family held by a weekly limit that named no family binds automated turns the same way, so a loop
+                // moves to another family or stops instead of hammering the held one (senpi#5596, senpi#3131).
+                const heldFamily = this.model && !this._pendingModelSwitch && attributionOf(options) !== "user"
+                    ? this._retryFallback.heldFamily(this.model)
+                    : undefined;
+                if (this.model && heldFamily) {
+                    this._retryFallback.resetTurn();
+                    this._fallbackTurnFailures = [];
+                    if (!(await this._retryFallback.tryFallback("transient", { errorMessage: heldFamily.errorMessage }, false))) {
+                        throw new AccountUsageLimitError(this.model.provider, heldFamily.errorMessage, undefined, [
+                            heldFamily.family,
+                        ]);
                     }
                 }
             }
@@ -4890,6 +4995,7 @@ export class AgentSession {
                 ...clientMessageIdentity(options),
             };
             this._userInputSources.set(userMessage, options?.source ?? "interactive");
+            markInputTurnOrigin(userMessage, inputTurnMark(options ?? {}));
             messages.push(userMessage);
             // Consume next-turn messages transactionally: a final admission rejection
             // restores them in their original order rather than dropping or duplicating
@@ -5402,6 +5508,9 @@ export class AgentSession {
         // stays unstamped: unknown origin, never defaulted to a trusted source.
         if (input.source !== undefined)
             this._userInputSources.set(message, input.source);
+        // Restored input with no source keeps no mark: an unmarked turn is engine work, never a trusted origin.
+        if (input.source !== undefined)
+            markInputTurnOrigin(message, inputTurnMark(input));
         if (input.inputId !== undefined)
             this._queuedInputDispositions.track(message, input.inputId);
         this._queuedMessages.set(queuedId, message);
@@ -5575,6 +5684,7 @@ export class AgentSession {
     async sendCustomMessage(message, options, deferredTurnClaim, releasedWake, itemized, onQueued) {
         // Normalize the legacy untyped content boundary before persisting a retry payload.
         const deliveryMessage = { ...message, content: message.content ?? [] };
+        copyInputTurnMark(message, deliveryMessage);
         if (this._sizesOnlyStartup && options?.triggerTurn === true) {
             // Size inspection makes no model call (#3483) and owes no work: no ticket, custody record or session file.
             this._pendingNextTurnMessages.push({ role: "custom", ...deliveryMessage, timestamp: Date.now() });
@@ -5789,6 +5899,8 @@ export class AgentSession {
                 : message.details,
             timestamp: Date.now(),
         };
+        // A delivery that found a run already streaming becomes a steer or follow-up: it keeps the origin it was admitted with.
+        copyInputTurnMark(message, appMessage);
         if (this._sizesOnlyStartup && options?.triggerTurn === true) {
             // Size inspection makes no model call (#3483): keep the message for a turn that never starts.
             this._pendingNextTurnMessages.push(appMessage);
@@ -6376,7 +6488,8 @@ export class AgentSession {
                 return id;
             },
             emit: (event) => this._lifecycleEvents.emit(event, (lifecycle) => this._emit(lifecycle), (run) => {
-                this._agentEventQueue = this._agentEventQueue.then(run, run);
+                const tracked = this._agentEventQueueLedger.track(queueEntryLabel(event), run);
+                this._agentEventQueue = this._agentEventQueue.then(tracked, tracked);
                 void this._agentEventQueue.catch(() => { });
             }),
             holdInterruptedRun: () => {

package/dist/core/credential-pool/rotation-slots.d.ts

@@ -1,11 +1,11 @@
 import type { Credential } from "@earendil-works/pi-ai";
 import { type ConfigValue } from "@earendil-works/pi-ai/utils/config-reference";
+import type { PoolState } from "../egress/pool-state.ts";
 import type { RunSlot } from "./failover.ts";
 import type { AccountStrategy } from "./selection-order.ts";
-import { type CredentialSlotRepository } from "./state-store.ts";
 export type RotationLane = "stored" | "env";
 /** Hands a half-open probe lease back, if the slot still holds that exact lease. */
-export declare function releaseProbeLease(repository: CredentialSlotRepository, providerId: string, lane: RotationLane, slotName: string, leaseId: string): Promise<void>;
+export declare function releaseProbeLease(repository: PoolState, providerId: string, lane: RotationLane, slotName: string, leaseId: string): Promise<void>;
 export type RotationSlot = RunSlot & {
     lane: RotationLane;
     /** Env-lane key material for the attempt; never serialized or persisted. */
@@ -25,7 +25,7 @@ export type RotationSources = {
     providerId: string;
     credential: Credential | undefined;
     env: (name: string) => string | undefined;
-    repository: CredentialSlotRepository;
+    repository: PoolState;
     policy?: {
         affinity?: boolean;
         accountStrategy?: AccountStrategy;

package/dist/core/credential-pool/state-store.d.ts

@@ -149,7 +149,7 @@ export type HalfOpenLease = {
  * wins the probe lease; everyone else keeps treating the slot as unavailable
  * until the lease expires or the probe settles the block.
  */
-export declare function acquireHalfOpenLease(repository: CredentialSlotRepository, providerId: string, laneId: string, slotId: string, options?: {
+export declare function acquireHalfOpenLease(repository: Pick<CredentialSlotRepository, "mutateSlotState">, providerId: string, laneId: string, slotId: string, options?: {
     now?: number;
     leaseTtlMs?: number;
 }): Promise<HalfOpenLease | undefined>;

package/dist/core/egress/classify.d.ts

@@ -12,8 +12,13 @@ export type FieldClass = "public" | "sealed" | "device-only" | "endpoint" | "for
 export type Custody = "sealed" | "device";
 export type ProviderCapability = "cloud" | "local-only" | "ambient-credential" | "callback-stream";
 /** models.json, keyed by schema path: `.` nests, `[]` is an array item, `.{key}` a record key, `.*` a record value. */
-export declare const MODELS_JSON_FIELD_CLASSES: Readonly<Record<string, FieldClass>>;
+export declare function modelsJsonFieldClasses(): Readonly<Record<string, FieldClass>>;
 /** Fields the runtime types add on top of the models.json schema (`model-config.ts`). */
-export declare const MODELS_JSON_TYPE_ONLY_FIELDS: Readonly<Record<string, FieldClass>>;
-export declare function classifyModelsJsonField(path: string): FieldClass | undefined;
+export declare const MODELS_JSON_TYPE_ONLY_FIELDS: {
+    readonly "providers.*.models[].samplingParams.{key}": "public";
+    readonly "providers.*.models[].samplingParams.*": "forces-device";
+    readonly "providers.*.modelOverrides.*.samplingParams.{key}": "public";
+    readonly "providers.*.modelOverrides.*.samplingParams.*": "forces-device";
+};
+export declare function classifyModelsJsonField(path: string, classes?: Readonly<Record<string, FieldClass>>): FieldClass | undefined;
 //# sourceMappingURL=classify.d.ts.map