@code-yeongyu/senpi 2026.7.25 → 2026.7.26

package/dist/core/agent-session.js

@@ -16,7 +16,7 @@ import { randomUUID } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, dirname } from "node:path";
 import { prepareAgentToolCall } from "@earendil-works/pi-agent-core";
-import { contentText } from "@earendil-works/pi-ai";
+import { contentText, SERVER_FALLBACK_ABORTED_DIAGNOSTIC } from "@earendil-works/pi-ai";
 import { cleanupSessionResources, isClassifierRefusal, isContextOverflow, isRetryableAssistantError, modelsAreEqual, resetApiProviders, streamSimple, } from "@earendil-works/pi-ai/compat";
 import { getAgentDir } from "../config.js";
 import { getThemeByName, theme } from "../modes/interactive/theme/theme.js";
@@ -46,6 +46,7 @@ import { generateSessionTitle, shouldSkipSessionTitle } from "./session-title-ge
 import { SessionWorkBarrier } from "./session-work-barrier.js";
 import { createSyntheticSourceInfo } from "./source-info.js";
 import { getSupportedThinkingLevels, supportsMax, supportsXhigh } from "./thinking-levels.js";
+import { resetTimings, time } from "./timings.js";
 import { createLocalBashOperations } from "./tools/bash.js";
 import { createAllToolDefinitions } from "./tools/index.js";
 import { createToolDefinitionFromAgentTool } from "./tools/tool-definition-wrapper.js";
@@ -169,6 +170,8 @@ function isSameOverflowSource(message, model, upstreamModelId) {
 // ============================================================================
 /** Thinking levels including native max (Opus 4.6 legacy / Opus 4.7 native). */
 const THINKING_LEVELS_WITH_MAX = ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
+/** Caps explicit skill expansion so one prompt cannot consume unbounded context. */
+export const MAX_SKILL_EXPANSIONS_PER_PROMPT = 5;
 // ============================================================================
 // AgentSession Class
 // ============================================================================
@@ -221,6 +224,7 @@ export class AgentSession {
         this._retryPromise = undefined;
         this._retryResolve = undefined;
         this._userAbortPromise = undefined;
+        this._agentAbortSource = undefined;
         this._suppressQueuedContinuationAfterUserAbort = false;
         this._extensionEventSignal = undefined;
         // Bash execution state
@@ -265,6 +269,9 @@ export class AgentSession {
             // The message object is already in agent.state.messages when message_end
             // fires; track its exact identity until this event's queued processing
             // settles so compaction can distinguish pending persistence from stale state.
+            if (event.type === "message_end" && event.message.role === "assistant") {
+                this._emitServerFallbackAborted(event.message);
+            }
             const pendingMessage = event.type === "message_end" ? event.message : undefined;
             if (pendingMessage !== undefined) {
                 this._messageEndsAwaitingPersistence.add(pendingMessage);
@@ -282,6 +289,7 @@ export class AgentSession {
         this.agent = config.agent;
         this.sessionManager = config.sessionManager;
         this.settingsManager = config.settingsManager;
+        this.agent.abortServerSideFallback = this.settingsManager.getAbortServerSideFallback();
         const noModelFallback = config.resourceLoader.getExtensions().runtime.flagValues.get("no-model-fallback") === true ||
             process.env.SENPI_NO_FALLBACK === "1";
         if (noModelFallback) {
@@ -410,6 +418,24 @@ export class AgentSession {
      * registered tool execution to the extension context. Tool call and tool result interception now
      * happens here instead of in wrappers.
      */
+    /**
+     * Surface a provider-level server-fallback abort before retry handling runs so
+     * the UI can explain the switch. Emitted synchronously here because retry work
+     * for the following agent_end starts before queued message_end processing
+     * drains. `chainConfigured` is required because the no-chain refusal path
+     * emits no retry_fallback_exhausted, leaving the UI no other signal.
+     */
+    _emitServerFallbackAborted(message) {
+        const details = message.diagnostics?.find((entry) => entry.type === SERVER_FALLBACK_ABORTED_DIAGNOSTIC)?.details;
+        if (details === undefined)
+            return;
+        this._emit({
+            type: "server_fallback_aborted",
+            from: typeof details.from === "string" ? details.from : message.model,
+            to: typeof details.to === "string" ? details.to : message.model,
+            chainConfigured: this._retryFallback.hasConfiguredChain(),
+        });
+    }
     _installAgentToolHooks() {
         this.agent.beforeToolCall = async ({ toolCall, args }) => {
             return this._emitBeforeToolCallHooks(toolCall, args);
@@ -832,7 +858,10 @@ export class AgentSession {
         if (providerDelayMs === undefined) {
             return true;
         }
-        return providerDelayMs <= this.settingsManager.getProviderRetrySettings().maxRetryDelayMs;
+        if (providerDelayMs <= this.settingsManager.getProviderRetrySettings().maxRetryDelayMs) {
+            return true;
+        }
+        return this._retryFallback.canTryFallback();
     }
     async _processAgentEvent(event, signal) {
         // When a user message starts, check if it's from either queue and remove it BEFORE emitting
@@ -1071,7 +1100,19 @@ export class AgentSession {
             await this._extensionRunner.emit({ type: "agent_start" });
         }
         else if (event.type === "agent_end") {
-            await this._extensionRunner.emit({ type: "agent_end", messages: event.messages });
+            const abortSource = this._agentAbortSource;
+            const aborted = abortSource !== undefined || this._findLastAssistantInMessages(event.messages)?.stopReason === "aborted";
+            try {
+                await this._extensionRunner.emit({
+                    type: "agent_end",
+                    messages: event.messages,
+                    ...(aborted ? { aborted: true } : {}),
+                    ...(abortSource === undefined ? {} : { abortSource }),
+                });
+            }
+            finally {
+                this._agentAbortSource = undefined;
+            }
         }
         else if (event.type === "turn_start") {
             const extensionEvent = {
@@ -1809,34 +1850,63 @@ export class AgentSession {
         }
     }
     /**
-     * Expand skill commands (/skill:name args) to their full content.
-     * Returns the expanded text, or the original text if not a skill command or skill not found.
-     * Emits errors via extension runner if file read fails.
+     * Expand a leading run of skill commands (/skill:name /skill:other args) to their full content.
+     * Returns the expanded text, or the original text if the first skill command is not found.
+     * Emits errors via extension runner if file reads fail or the expansion cap is reached.
      */
     _expandSkillCommand(text) {
         if (!text.startsWith("/skill:"))
             return text;
-        const spaceIndex = text.indexOf(" ");
-        const skillName = spaceIndex === -1 ? text.slice(7) : text.slice(7, spaceIndex);
-        const args = spaceIndex === -1 ? "" : text.slice(spaceIndex + 1).trim();
-        const skill = this.resourceLoader.getSkills().skills.find((s) => s.name === skillName);
-        if (!skill)
-            return text; // Unknown skill, pass through
-        try {
-            const content = readFileSync(skill.filePath, "utf-8");
-            const body = stripFrontmatter(content).trim();
-            const skillBlock = `<skill name="${skill.name}" location="${skill.filePath}">\nReferences are relative to ${skill.baseDir}.\n\n${body}\n</skill>`;
-            return args ? `${skillBlock}\n\n${args}` : skillBlock;
-        }
-        catch (err) {
-            // Emit error like extension commands do
-            this._extensionRunner.emitError({
-                extensionPath: skill.filePath,
-                event: "skill_expansion",
-                error: err instanceof Error ? err.message : String(err),
-            });
-            return text; // Return original on error
+        const skills = this.resourceLoader.getSkills().skills;
+        const expandedSkillNames = new Set();
+        const skillBlocks = [];
+        let tokenStart = 0;
+        while (tokenStart < text.length) {
+            let tokenEnd = tokenStart;
+            while (tokenEnd < text.length && !/\s/.test(text[tokenEnd])) {
+                tokenEnd += 1;
+            }
+            const token = text.slice(tokenStart, tokenEnd);
+            if (!token.startsWith("/skill:"))
+                break;
+            const skillName = token.slice(7);
+            const skill = skills.find((candidate) => candidate.name === skillName);
+            if (!skill)
+                break; // Unknown skills and everything after them remain literal text.
+            if (!expandedSkillNames.has(skill.name)) {
+                if (skillBlocks.length >= MAX_SKILL_EXPANSIONS_PER_PROMPT) {
+                    this._extensionRunner.emitError({
+                        extensionPath: "skill:expansion",
+                        event: "skill_expansion",
+                        error: `Expanded at most ${MAX_SKILL_EXPANSIONS_PER_PROMPT} skills; remaining skill commands were left as literal text.`,
+                    });
+                    break;
+                }
+                try {
+                    const content = readFileSync(skill.filePath, "utf-8");
+                    const body = stripFrontmatter(content).trim();
+                    skillBlocks.push(`<skill name="${skill.name}" location="${skill.filePath}">\nReferences are relative to ${skill.baseDir}.\n\n${body}\n</skill>`);
+                    expandedSkillNames.add(skill.name);
+                }
+                catch (err) {
+                    this._extensionRunner.emitError({
+                        extensionPath: skill.filePath,
+                        event: "skill_expansion",
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                    return text; // Return the original prompt when any skill file cannot be read.
+                }
+            }
+            tokenStart = tokenEnd;
+            while (tokenStart < text.length && /\s/.test(text[tokenStart])) {
+                tokenStart += 1;
+            }
         }
+        if (skillBlocks.length === 0)
+            return text;
+        const args = text.slice(tokenStart).trim();
+        const expandedSkills = skillBlocks.join("\n\n");
+        return args ? `${expandedSkills}\n\n${args}` : expandedSkills;
     }
     /**
      * Queue a steering message while the agent is running.
@@ -2073,6 +2143,9 @@ export class AgentSession {
     /**
      * Send a user message to the agent. Always triggers a turn.
      * When the agent is streaming, use deliverAs to specify how to queue the message.
+     * If the prompt path rejects before the message reaches a queue or a turn
+     * (e.g. a required compaction that cannot complete), the message is retained
+     * in the steering/followUp queue for later delivery and the error still propagates.
      *
      * @param content User message content (string or content array)
      * @param options.deliverAs Delivery mode when streaming: "steer" or "followUp"
@@ -2112,6 +2185,7 @@ export class AgentSession {
         // settles so callers observing session idle cannot race its provider turn.
         const waitForExistingSessionWork = this._sessionWorkBarrier.hasActiveWork;
         let finishSessionWork;
+        let disposition;
         try {
             // Use prompt() with expandPromptTemplates: false to skip command handling and template expansion
             await this.prompt(text, {
@@ -2119,7 +2193,10 @@ export class AgentSession {
                 streamingBehavior: options?.deliverAs,
                 images,
                 source: "extension",
-                promptDisposition: () => resolveBindingPromptReadiness?.(),
+                promptDisposition: (nextDisposition) => {
+                    disposition = nextDisposition;
+                    resolveBindingPromptReadiness?.();
+                },
                 onSessionWorkReady: waitForExistingSessionWork
                     ? () => {
                         finishSessionWork ??= this._sessionWorkBarrier.begin();
@@ -2128,6 +2205,19 @@ export class AgentSession {
                 sessionTitlePrompt: false,
             });
         }
+        catch (error) {
+            // Extension bindings invoke this method fire-and-forget, so a rejection
+            // before prompt() accepted the message must not silently drop it.
+            if (disposition === undefined) {
+                if (options?.deliverAs === "steer") {
+                    await this._queueSteer(text, images);
+                }
+                else {
+                    await this._queueFollowUp(text, images);
+                }
+            }
+            throw error;
+        }
         finally {
             resolveBindingPromptReadiness?.();
             finishSessionWork?.();
@@ -2172,7 +2262,7 @@ export class AgentSession {
      */
     async abort() {
         this.abortCompaction();
-        await this._abortActiveAgentAndRetry();
+        await this._abortActiveAgentAndRetry("user");
     }
     async waitForIdle() {
         if (this.isIdle) {
@@ -2540,7 +2630,7 @@ export class AgentSession {
         this._pendingCompactionAdmission = undefined;
         admission.finishSessionWork();
     }
-    async _abortActiveAgentAndRetry() {
+    async _abortActiveAgentAndRetry(source) {
         this.abortRetry();
         this.abortBranchSummary();
         if (this._userAbortPromise) {
@@ -2550,6 +2640,7 @@ export class AgentSession {
         }
         if (this.isStreaming) {
             this._suppressQueuedContinuationAfterUserAbort = true;
+            this._agentAbortSource = source;
         }
         const abortPromise = (async () => {
             this.agent.abort();
@@ -2579,7 +2670,7 @@ export class AgentSession {
             // Keep the session subscriber attached until the aborted run emits
             // agent_end. That event clears the active-run and retry state that
             // waitForIdle() depends on.
-            await this._abortActiveAgentAndRetry();
+            await this._abortActiveAgentAndRetry("system");
             this._disconnectFromAgent();
             disconnected = true;
             this._emit({ type: "compaction_start", reason: "manual" });
@@ -3352,13 +3443,21 @@ export class AgentSession {
         this._claimCompactionController(autoCompactionController, "auto");
         const endBeforeExecution = () => {
             this._emit({ type: "compaction_start", reason });
-            if (reason === "overflow")
+            if (reason === "overflow" && this._autoCompactionAbortController === autoCompactionController) {
                 this._overflowRecoveryAttempted = false;
+            }
+            // A synchronous compaction_start listener can supersede this controller with a new
+            // operation, which then owns its own start/end lifecycle; publishing another terminal
+            // event here would be stale. A listener can instead abort this very controller, and
+            // that still needs a terminal event: consumers open UI state on compaction_start and
+            // close it only on compaction_end.
+            if (this._autoCompactionAbortController !== autoCompactionController)
+                return false;
             this._emit({
                 type: "compaction_end",
                 reason,
                 result: undefined,
-                aborted: false,
+                aborted: autoCompactionController.signal.aborted,
                 willRetry: false,
             });
             return false;
@@ -3624,6 +3723,9 @@ export class AgentSession {
             getAllTools: () => this.getAllTools(),
             setActiveTools: (toolNames) => this.setActiveToolsByName(toolNames),
             refreshTools: () => this._refreshToolRegistry(),
+            registerRemovedToolHint: (name, hint) => {
+                this.agent.removedToolHints[name] = hint;
+            },
             getCommands,
             setModel: async (model) => {
                 if (!this._modelRuntime.hasConfiguredAuth(model.provider))
@@ -3703,7 +3805,7 @@ export class AgentSession {
                     let outcome = "failed";
                     let disconnected = false;
                     try {
-                        await this._abortActiveAgentAndRetry();
+                        await this._abortActiveAgentAndRetry("system");
                         this._disconnectFromAgent();
                         disconnected = true;
                         this._emit({ type: "compaction_start", reason: "extension" });
@@ -3901,22 +4003,49 @@ export class AgentSession {
         });
     }
     async reload(options) {
-        const previousFlagValues = this._extensionRunner.getFlagValues();
-        await emitSessionShutdownEvent(this._extensionRunner, { type: "session_shutdown", reason: "reload" });
+        resetTimings("reload");
+        const oldExtensionRunner = this._extensionRunner;
+        const oldExtensionIdentities = oldExtensionRunner.getExtensionIdentities();
+        const previousFlagValues = oldExtensionRunner.getFlagValues();
+        await emitSessionShutdownEvent(oldExtensionRunner, { type: "session_shutdown", reason: "reload" });
+        time("shutdown", "reload");
         await this.settingsManager.reload();
         this.syncQueueModesFromSettings();
         resetApiProviders();
+        time("settings", "reload");
         await this._modelRuntime.reloadConfig();
+        // Resolving both scopes from the completed refresh avoids two extra availability
+        // scans, but only a snapshot from a SUCCESSFUL refresh may be trusted: refresh()
+        // swallows availability errors, so a failed scan must fall back to the runtime and
+        // keep the previous refresh-and-surface-the-error behavior.
+        const refreshedModels = this._modelRuntime.hasFreshAvailabilitySnapshot()
+            ? { getAvailable: async () => this._modelRuntime.getAvailableSnapshot() }
+            : this._modelRuntime;
         this.setScopedModels(await resolveModelScope(getModelNarrowingPatterns({
             legacyEnabledPatterns: this.settingsManager.getEnabledModels(),
-        }), this._modelRuntime));
-        this.setFavoriteModels(await resolveModelScope(this.settingsManager.getFavoriteModels() ?? [], this._modelRuntime));
-        await this._resourceLoader.reload();
-        this._buildRuntime({
-            activeToolNames: this.getActiveToolNames(),
-            flagValues: previousFlagValues,
-            includeAllExtensionTools: true,
-        });
+        }), refreshedModels));
+        this.setFavoriteModels(await resolveModelScope(this.settingsManager.getFavoriteModels() ?? [], refreshedModels));
+        time("models", "reload");
+        await this._resourceLoader.reload({ settingsAlreadyReloadedFor: this.settingsManager });
+        time("resources", "reload");
+        try {
+            this._buildRuntime({
+                activeToolNames: this.getActiveToolNames(),
+                flagValues: previousFlagValues,
+                includeAllExtensionTools: true,
+            });
+        }
+        finally {
+            // An extension removed by this reload must be told even if the rebuild throws
+            // (e.g. _refreshToolRegistry rejecting an extension's tool metadata): the new
+            // runner is already installed without it, so nothing else would dispose it.
+            const newExtensionResolvedPaths = new Set(this._extensionRunner.getExtensionIdentities().map((extension) => extension.resolvedPath));
+            const removed = oldExtensionIdentities.filter((extension) => !newExtensionResolvedPaths.has(extension.resolvedPath));
+            if (removed.length > 0) {
+                await oldExtensionRunner.emit({ type: "session_extensions_removed", reason: "reload", removed });
+            }
+            time("runtime", "reload");
+        }
         const hasBindings = this._extensionUIContext ||
             this._extensionCommandContextActions ||
             this._extensionShutdownHandler ||
@@ -3926,6 +4055,7 @@ export class AgentSession {
             await this._extensionRunner.emit({ type: "session_start", reason: "reload" });
             await this.extendResourcesFromExtensions("reload");
         }
+        time("lifecycle", "reload");
     }
     // =========================================================================
     // Auto-Retry
@@ -4094,22 +4224,36 @@ export class AgentSession {
         const providerDelayMs = isRefusal || hardErrorFallback ? undefined : this._getProviderRetryDelayMs(errorMessage);
         const maxRetryDelayMs = this.settingsManager.getProviderRetrySettings().maxRetryDelayMs;
         if (providerDelayMs !== undefined && providerDelayMs > maxRetryDelayMs) {
-            this._emit({
-                type: "auto_retry_end",
-                success: false,
-                attempt: this._retryAttempt,
-                finalError: `Provider requested retry delay ${providerDelayMs}ms, exceeding configured maximum ${maxRetryDelayMs}ms`,
-            });
-            this._retryAttempt = 0;
-            this._resolveRetry();
-            return "not-handled";
-        }
-        if (!switchedFallback) {
-            switchedFallback = await this._retryFallback.tryFallback("transient", {
-                errorMessage,
-                retryAfterMs: providerDelayMs,
-            });
+            // A wait this long means the model is unavailable rather than busy, so the
+            // configured chain beats failing the turn. The switch is gated: the over-budget
+            // branch above may have already switched on this same error, and hopping again
+            // here would skip that candidate's own retry budget.
+            if (!switchedFallback) {
+                switchedFallback = await this._retryFallback.tryFallback("transient", {
+                    errorMessage,
+                    retryAfterMs: providerDelayMs,
+                });
+                if (switchedFallback) {
+                    this._retryAttempt = 1;
+                }
+            }
+            if (!switchedFallback) {
+                this._emit({
+                    type: "auto_retry_end",
+                    success: false,
+                    attempt: this._retryAttempt,
+                    finalError: `Provider requested retry delay ${providerDelayMs}ms, exceeding configured maximum ${maxRetryDelayMs}ms`,
+                });
+                this._retryAttempt = 0;
+                this._resolveRetry();
+                return "not-handled";
+            }
         }
+        // Transient failures stay on the same model until the retry budget is spent;
+        // only the over-budget branch above switches the chain. Both branches that can
+        // reach this point with a fallback already applied (hard-error, refusal) set
+        // switchedFallback first and force providerDelayMs undefined, so no branch may
+        // be reordered to fall through here expecting an implicit switch.
         const delayMs = switchedFallback ? 0 : (providerDelayMs ?? settings.baseDelayMs * 2 ** (this._retryAttempt - 1));
         // Prepare before auto_retry_start so an immediate Esc can cancel the retry sleep.
         this._retryAbortController = new AbortController();