@code-yeongyu/senpi 2026.9.27-4 → 2026.9.28

package/docs/rpc.md

@@ -166,6 +166,9 @@ parsing a version string:
   `core.extensions` (absolute roots, deduplicated and sorted). `profile_id` is the sha256 of the canonical JSON
   of `core` with its keys in that sorted order (`extensions`, `multi_session`, `session_runtime`), so any client
   can recompute it and compare two hosts without comparing paths.
+- `memory_pressure` - multi-session hosts only: `true` while this host's memory sampler reads its RSS above
+  `SENPI_RPC_HOST_RSS_WARN_MB`, else `false`. Not identity and never an admission signal; `senpi host status`
+  reports it per endpoint. Classic hosts and hosts released before the field omit it.
 
 Compatibility is decided from `protocolVersion` + `capabilities`, and "is my build newer?" from `engineOrdinal`.
 A `serverVersion` string comparison is never a compatibility test: two hosts with different version strings can
@@ -306,6 +309,7 @@ directory can never read each other's state:
 <agentDir>/rpc-host-daemon/                    flat directory (shared; also a legacy host's own state)
   layout.json                                  { "layout": 2, "dir": "<sha256(canonical socket)[:16]>" }
   <sha256(canonical socket)[:16]>/             0700
+    endpoint.json                              { layout: 2, socket, created_at } - durable identity
     host.pid                                   POINTER: { layout, instance_id, generation_dir, writer }
     settings.json                              what the supervisor reads at boot
     daemon.lock  stderr.log
@@ -317,9 +321,15 @@ directory can never read each other's state:
     reservations/                              cross-generation session-path claims
 ```
 
-Directories are `0700` and every state file is `0600`. The canonical socket is the socket path on POSIX
-and the normalized lower-cased path on win32, so a client recomputes the directory name from the socket
-alone. `generation_dir` is relative to the directory holding the pointer (`generations/<instanceId>`), and
+Directories are `0700` and every state file is `0600`. The canonical socket is, on POSIX, the socket path
+with its directory resolved through its deepest existing ancestor (`realpath`; a missing tail is kept
+verbatim) - the same identity the ensure lock is keyed by - and on win32 the normalized lower-cased path, so
+a client recomputes the directory name from the socket alone and every spelling of one socket (`/tmp` vs
+`/private/tmp`, a path through a symlinked directory) shares one directory, one registration and one lock.
+A socket already spelled canonically hashes exactly as it did when the name was taken from the spelling
+itself, so an existing endpoint keeps its directory. A directory an older build named after a
+non-canonical spelling is still listed by `status --all` and collected by `gc`, but new state goes to the
+canonical directory. `generation_dir` is relative to the directory holding the pointer (`generations/<instanceId>`), and
 `instance_id` is the same id the host reports as `instanceId` in `get_protocol_info` - so a pointer that
 names a different id than the socket answers describes a generation that is no longer serving.
 
@@ -335,7 +345,20 @@ names is alive an ensure refuses (`legacy_host`) rather than starting a second h
 `ensureHost` fails with a typed `HostDaemonStateError` naming the directory it could not create or write,
 and starts no host in that case.
 
-The directory is PRUNED of what is no longer running on every registration write and on every `host status`:
+`endpoint.json` names the socket the directory serves, in the spelling its first ensure used (its name
+is the hash of that spelling's canonical form). It is
+written `0600` when the directory is created and re-asserted under the ensure lock. It is written whole to a
+temporary name and linked into place, so no reader ever sees half a file, and a valid one is never rewritten, so
+`created_at` is the endpoint's first ensure. Under the lock the ensure does replace a file that does not name a
+socket hashing to this directory (torn by a crash of an older build, or foreign): left alone, such a file would
+leave the endpoint listed as `socket: null` and kept by `gc` as `unknown_identity` forever. It is the one file a generation's release
+leaves behind: a supervisor that exits (idle, drained, or after its host child crashed) removes the pointer,
+`settings.json` and its generation directory, and without `endpoint.json` such an endpoint could not even be
+enumerated. `stderr.log` and `crashes.jsonl` stay too. The only thing that ever removes an endpoint directory
+(`endpoint.json` included) is the explicit `senpi host gc` below, and only on proof that nothing runs behind it.
+
+The directory is PRUNED of what is no longer running on every registration write and on every single-socket
+`host status` (never by `host status --all`):
 a `generations/<instanceId>/` whose record names a pid nobody is running is removed, the pointer goes with it
 while it still names one, and claims in `reservations/` whose owner is gone are removed too. A record that
 cannot be parsed is left alone - an ensure writing one right now must not be mistaken for a generation that
@@ -370,10 +393,12 @@ Everything above is reachable from one command, so a terminal, a desktop and a t
 daemon the same way instead of each re-implementing the decision:
 
 ```
-senpi host ensure  [--json] [--launch-spec <file>] [--policy upgrade|fallback|never] [--socket <path>]
-senpi host status  [--json] [--include-workers] [--socket <path>]
-senpi host stop    [--json] [--drain] [--force] [--socket <path>]
-senpi host handoff [--json] [--launch-spec <file>] [--socket <path>]
+senpi host ensure     [--json] [--launch-spec <file>] [--policy upgrade|fallback|never] [--socket <path>]
+senpi host status     [--json] [--include-workers] [--all] [--socket <path>]
+senpi host stop       [--json] [--drain] [--force] [--socket <path>]
+senpi host handoff    [--json] [--launch-spec <file>] [--socket <path>]
+senpi host shard-path --kind <p|i> --owner <id> [--root <dir>] [--json]
+senpi host gc         [--json] [--agent-dir <dir>]
 ```
 
 The contract is machine-first: EXACTLY ONE JSON line on stdout and nothing else, diagnostics on stderr,
@@ -388,7 +413,8 @@ and an exit code that classifies the outcome without parsing the line.
 | `4` | fallback: `{ action: "fallback", reason, host }` - under `--policy fallback`, no host is better than this one |
 
 The socket is `--socket`, else `SENPI_RPC_SOCKET`, else `<agentDir>/rpc/rpc.sock`. `--json` is accepted for
-symmetry with other commands; the answer is always JSON.
+symmetry with other commands; the answer is always JSON (the one exception is `shard-path` without `--json`,
+which prints the bare socket path).
 
 - `ensure` prints `{ action, socket, pid, instanceId, generation, engineVersion, engineOrdinal,
   capabilities, launchProfileId, reused, upgradeable }`. `--policy upgrade` (the default) allows a
@@ -400,7 +426,8 @@ symmetry with other commands; the answer is always JSON.
   `senpi host handoff` command.
 - `status` prints `{ reachable, socket, pid, instanceId, generation, engineVersion, capabilities,
   launchProfile, sessions: { total, interactive, worker, retained, foreign_attached, foreign_retained },
-  zombies, rss_mb, host_rss_mb, open_fds, env_keys, generations }` and exits 3 when nothing answers - with the same
+  zombies, rss_mb, host_rss_mb, open_fds, memory_pressure, env_keys, generations, crashes, shard, session_rows,
+  claims_live, claims }` and exits 3 when nothing answers - with the same
   field set, so a caller parses one shape and branches on one boolean. `sessions` is what `list_sessions`
   reports under the same flag, so `worker` stays `0` without `--include-workers`; `foreign_*` is the same
   count from the point of view of a client holding none of those sessions itself. `rss_mb`, `open_fds` and
@@ -413,12 +440,100 @@ symmetry with other commands; the answer is always JSON.
   still claims in `reservations/` - the one occupancy number that is observable for a generation which no
   longer answers on the socket. Records of generations that ended are pruned by the read itself, so a status
   never lists a dead pid.
+
+  The last five fields and `memory_pressure` are additive (a client that does not know them ignores them):
+  - `memory_pressure`: whether the ANSWERING generation's memory sampler currently reads its RSS above
+    `SENPI_RPC_HOST_RSS_WARN_MB` (the state its `host_memory_pressure` records announce), read from its
+    `get_protocol_info`; `null` when nothing answers or the host predates the field. It lives in the host process
+    alone, so a draining predecessor's state is not reported, and it is observability only: a pressured endpoint
+    admits every open.
+  - `crashes`: records in the endpoint's `crashes.jsonl` - supervised host children that died rather than
+    stopped; `0` when the file is absent.
+  - `shard`: `{ kind: "p" | "i", key }` when the socket's basename is `<kind>-<16 hex>.sock` (the naming
+    contract below), else `null`.
+  - `session_rows`: under `--include-workers` only (else `[]`), every row of that same `list_sessions
+    { include_workers: true }` reply as `{ id, kind, session_path, attachments, context }`. `session_path` is
+    the host's canonical path, the key a client matches a session by; `context` is the published labels
+    including the host's own `host_socket`/`host_instance`, `null` where none were published.
+  - `claims_live`: session-path claims in `reservations/` whose owner process is still running, `0` when the
+    directory is absent.
+  - `claims`: under `--include-workers` only (else `[]`), every claim in `reservations/` whichever generation
+    wrote it, as `{ session_path, owner_pid, instance_id, generation, attached, live }` - so a path a
+    draining predecessor still holds is visible although the answering generation no longer lists it.
+    `generation` is the owner's ordinal while its generation record exists, else `null`; `attached` is `null`
+    for a claim written before that flag existed.
+- `status --all` reports every endpoint the agent directory holds state for and ignores `--socket`:
+  `{ endpoints: [<status row>, ...] }`, each row the single-socket report above plus `dir` (the endpoint's
+  daemon directory) and `identity` (what named its socket: `endpoint` = `endpoint.json`, `settings` = the
+  boot `settings.json`, `generation-settings` = a generation's own `settings.json`; each accepted only when
+  that socket hashes to the directory it was found in). A directory none of them names is still listed with
+  `socket: null` and `identity: "unknown"`, built from the directory alone - the ensure lock is keyed by a
+  longer hash of the socket's transport address and cannot be rebuilt from the 16-hex name, so it can be
+  shown but never addressed. Before layout 2 (no `layout.json`) the answer is `{ "endpoints": [] }`. Unlike
+  the single-socket form, `--all` REMOVES NOTHING: a dead generation is a row with `alive: false`, an endpoint
+  whose host exited stays listed through its `endpoint.json` with `reachable: false` and `generations: []`,
+  and reclaiming what ended is left to the explicit, evidence-gated `gc`. Every endpoint is read at
+  once, each under its own budget (10 s per read), and a socket that does not answer the identity probe is
+  not asked for its session listing, so hung hosts cost about one budget in total; rows stay in directory order. Exit `0` while at least one endpoint answers, `3` when none does or none exists.
+- `shard-path` computes a shard socket without contacting any host, so a client that does not link senpi
+  can check its own copy of the naming contract against the engine: `{ kind, key, socket }` under `--json`,
+  the socket path otherwise. `--root` defaults to `<agentDir>/rpc/shards`.
+- `gc` removes the state of endpoints whose host is PROVABLY gone, in the agent directory (`--agent-dir`, else
+  the current one; `--socket` is ignored), and answers `{ removed: [{ socket, dir, reason }], kept: [{ socket,
+  dir, reason }] }` with exit `0` whatever it found (`2` for a bad flag). It never signals a process and never
+  runs implicitly - not inside `ensure`, not inside `status`. For each endpoint whose socket is known it takes
+  that socket's ENSURE lock (`<tmp>/senpi-rpc-host-locks/<sha256(transport address)[:32]>.lock`, the one
+  `ensureHost` serializes on - not `daemon.lock`; on POSIX the address is the socket path with its directory
+  realpath-canonicalized, so every spelling of one socket shares one lock) for at most 2 s, and inside it requires all three: (a) no
+  `generations/*/host.pid` names a live process (pid live and start time matching; a live pid whose identity
+  cannot be read counts as live; the generation the pointer names is one of them), (b) no claim in
+  `reservations/` has a live owner, and (c) connecting to the socket fails with `ENOENT`, or with `ECONNREFUSED`
+  on an entry that is a socket (a regular file where the socket should be is kept as `reachable`) - and so does
+  every `<socket>.next-*` successor bind beside it. Only then does it unlink the `<socket>.next-*` /
+  `<socket>.shield-*` siblings, then the socket, then remove the endpoint directory LAST, still under the lock;
+  `reason` is `socket_refused` or `socket_absent`. A sibling that is a directory is not unlinked: it stays and
+  the removed entry lists it as `skipped: [{ path, type: "directory" }]`. Because the directory goes last, a
+  removal that fails part-way leaves the endpoint listed for the next gc. Everything else is kept with its
+  reason: `live_generation`, `live_claim`, `reachable`, `locked` (an ensure held the lock for 2 s),
+  `legacy_layout` (a flat directory without `layout.json` - a legacy host's, never touched), `unknown_identity`
+  (nothing names the socket, so its lock cannot be taken), or `failed` (reading the evidence or removing threw;
+  the entry carries `error`) - and a `failed` endpoint never stops gc from going on to the others.
+  An `unknown_identity` directory is never removed by gc; remove it by hand only after checking that no pid in
+  its `generations/*/host.pid` or `reservations/*.json` is running and that no process holds files under it.
+  An ensure that raced a gc simply re-creates `endpoint.json` under the lock after gc released it.
 - `stop` is the I1 carve-out: a plain stop needs a validated pidfile AND `foreign_attached +
   foreign_retained == 0`, or it refuses with exit 3 and prints the counts it refused on; `--force`
   overrides after printing the same counts; `--drain` (SIGUSR1) is always permitted, because it ends no
   work.
 - `handoff` forces a generation handoff from THIS binary. A host that cannot drain and a platform that
-  cannot rename answer alike: exit 3 `{ reason: "upgrade_unsupported", detail }`.
+  cannot rename answer alike: exit 3 `{ reason: "upgrade_unsupported", detail }`. The handoff runs inside the
+  endpoint's ensure lock (the one `ensure` and `gc` take), so an `ensure` arriving while the successor comes up
+  waits and then attaches to the successor, and `gc` reports the endpoint `locked` rather than judging it
+  halfway. An `ensure` waits for the lock as long as the longest holder can keep it: a probe plus either a
+  stop-and-restart or a handoff (probe, successor start, 30 s readiness). A REFUSED handoff leaves the endpoint
+  as it found it: the successor it started is killed and, once it has exited (up to 5 s), its generation record
+  and directory are released, so `status --all` never lists it; the boot `settings.json` it rewrote before
+  spawning is restored byte for byte. A cleanup that fails is reported in the refusal's `detail`.
+
+#### Shard naming contract (`shardKey`, `shardSocketPath`)
+
+A client may run many endpoints under one agent directory - omo one per parent session (`p`), the Desktop
+one per thread (`i`), under `<agentDir>/rpc/shards/`. Every client derives the socket identically:
+
+```
+key    = sha256("<kind>:<ownerId>") in hex, first 16 characters
+socket = <root>/<kind>-<key>.sock
+```
+
+`packages/coding-agent/src/modes/rpc/host-daemon-paths.ts` exports `shardKey(kind, ownerId)`,
+`shardSocketPathForKey(root, kind, key)` (no hashing) and `shardSocketPath(root, kind, ownerId)`. Fixed
+vectors every implementation must reproduce:
+
+| kind | owner | key | socket under `/r` |
+|---|---|---|---|
+| `p` | `01a0e28d-40e4-7402-bac7-8de6e76ad84c` | `6d410ba846ba1550` | `/r/p-6d410ba846ba1550.sock` |
+| `i` | `thread-0001` | `da99f196e11b1cf9` | `/r/i-da99f196e11b1cf9.sock` |
+| `p` | (empty) | `3ba7290d74188485` | `/r/p-3ba7290d74188485.sock` |
 
 #### Launch spec (`--launch-spec <file>`)
 
@@ -547,6 +662,15 @@ auth, model, extension or resource resolution, and they are never merged into th
   `^[a-z][a-z0-9_]*$`, every value at most 16 KiB, and at most 32 KiB of JSON in total. Anything else is refused with
   `invalid_session_context: <detail>`, where the detail names the cap that was broken.
 
+A socket host also stamps its own identity into every session's context, overwriting any client-supplied
+value for the same keys, because the host is the authority: `host_socket` is the PUBLIC endpoint clients
+address (the supervisor's path for a supervised host, the bound path for a bare one), realpath-canonicalized
+through the deepest existing ancestor of its directory (so the first generation of a shard, which starts before
+`rpc/shards/` exists, and every successor stamp the same string), and stays the same across a generation handoff; `host_instance` is the answering generation's `instanceId`
+(`get_protocol_info`) and changes with every handoff. So an extension can tell which endpoint and generation
+it runs behind without an environment variable. `host_socket` is omitted where no public path exists (an
+abstract socket, a supervised win32 host); a stdio host adds neither key.
+
 One shared host therefore loads ONE extension set and still lets an extension recognize the session it was loaded for
 (`pi.sessionKind`, `pi.sessionContext` - see
 [ExtensionAPI session identity](extensions.md#pisessionkind--pisessioncontext--pisharedhostenabled)). Probe
@@ -614,17 +738,34 @@ Environment overrides beat the file, and invalid values fall through to the next
 (`transient`|`persistent`) and `SENPI_RPC_HOST_IDLE_EXIT_MS` (positive integer milliseconds).
 
 The host exits only after the window elapses with NO attached client connections and NO active turns — continuously.
-Any connection or agent turn resets the window, so a busy host never exits. The supervisor learns about turns through
+Any attached connection or agent turn resets the window, so a busy host never exits. A connection attaches with its
+first request line, unless that line is an OBSERVING read: `get_protocol_info` or `list_sessions` carrying
+`"observe": true`. A connection that only ever sends observing reads never counts and never resets the window, so a
+poller (`senpi host status [--all]`, which marks both of its reads, a doctor loop, a runtime panel) can look at every
+endpoint as often as it likes without keeping any of them alive; the first request that is anything else attaches the
+connection from then on, and `observe` on any other command is ignored. While a connection has not sent its first
+line yet the host does not exit, and the window keeps running. Hosts that predate the field ignore it, so a marked read
+works against every generation. The supervisor learns about turns through
 its observer connection to the host; while that connection is unhealthy it cannot see turns, so it treats activity as
 unknown and keeps the host open as if a turn were running — but only for one idle window, during which it keeps
 reconnecting. An observer that stays unhealthy for longer than the window stops counting as busy, and the connection
 count alone decides from there. A `persistent` host has an infinite window and so keeps its infinite benefit of the
 doubt. The exit itself is clean: the RPC host
-receives SIGTERM first, flushes pending output, removes its socket, and the supervisor then removes `host.pid` and
-`settings.json` (the stderr log stays for diagnostics). After an idle exit, the next `ensureHost()` transparently
+receives SIGTERM first, flushes pending output, removes its socket, and the supervisor then removes `settings.json`,
+its generation directory and, last, the registration pointer (`host.pid`); the stderr log stays for diagnostics. The
+crash-path cleanup the host runs when its supervisor dies uses the same order, so a missing pointer always means the
+teardown is complete. After an idle exit, the next `ensureHost()` transparently
 starts a fresh host. `get_protocol_info` over the public socket behaves exactly as before; the supervisor is
 wire-transparent.
 
+`ensureHost()` hands its caller an attach hold: the connection its readiness answer arrived on stays open and counts
+as an attached client, so the idle window cannot close between the ensure and the caller's own attach, however slow
+that attach is. Every caller must call `release()` on the returned `EnsuredHost` once its own client is
+attached, or right away when it attaches later on its own connections; the idle window starts from there. Until then
+the host counts the calling process as an attached client, so a transient host whose ensuring process is still running
+never starts its idle window: a long-lived caller that ensures and never releases keeps the host up for its whole
+lifetime. The hold never keeps the calling process alive, and the operating system ends it when that process exits.
+
 The RPC host can never outlive its supervisor. It is spawned with an extra inherited pipe on fd 3 whose write end the
 supervisor holds and never writes to; the kernel closes that end whenever the supervisor dies — including `SIGKILL`, an
 OOM kill, or a crash, where no signal handler runs — so the host reads EOF, shuts down cleanly and removes its private
@@ -729,7 +870,9 @@ What the host does enforce are lifecycle windows, and they only ever return memo
 - **Empty-host exit**: when the registry holds zero sessions AND no client is connected, continuously for
   `SENPI_RPC_HOST_EMPTY_EXIT_MS` (default 15 minutes), the host exits through its clean shutdown path (flush, socket
   removal), for stdio and `--listen` hosts alike. A connected client counts as occupancy even with no session open,
-  so the host never drops a live socket under itself. Supervised hosts stay clean either way: a supervisor reads a
+  so the host never drops a live socket under itself - except a connection whose every request so far was an
+  observing read (`"observe": true`, the same rule as the idle-exit window above), which never holds the host open.
+  A connection that has not sent its first request yet still counts. Supervised hosts stay clean either way: a supervisor reads a
   child exit of 0 without a signal as an intentional idle stop and exits 0 with the same cleanup, not as a crash.
 
 Values are positive integers; invalid values fall through to the defaults. These lifecycle windows run inside the host process,
@@ -754,7 +897,11 @@ REPORT: nothing here aborts a turn, kills a session, or refuses an `open_session
   deadline (a busy host was measured answering after 57 s), and a timeout after it names the
   queue position instead of a bare deadline. A lost transport still rejects at once.
   `SENPI_RPC_LOOP_LAG_ERROR_MS` (default 5000) additionally broadcasts a `host_stalled` record
-  (`{ type, driftMs, sessionId?, tool? }`) to every connection, like the other content-free lifecycle records.
+  (`{ type, driftMs, sessionId?, tool?, processCpuMs?, heapDeltaMb? }`) to every connection, like the other content-free lifecycle records.
+  `processCpuMs` is the process CPU time spent during the stalled window and `heapDeltaMb` the JS heap change across it, so a
+  stall explains itself: CPU close to `driftMs` means the host was busy (a large heap drop in the same window points at a
+  collection), and CPU close to zero means the process did not run at all (the machine starved it, or it sat in a blocking
+  wait). The stderr line carries the same two numbers as `cpu=<ms> heap=<+/-MB>`.
 - **Stall attribution**: each routed command is dispatched inside an `AsyncLocalStorage` scope carrying its routing
   `sessionId`, and an in-process session's tool executions open a span carrying `{ sessionId, tool }` for as long as
   the tool runs. A stall is blamed on the synchronous work that finished inside the measured window, or on the tool
@@ -766,7 +913,15 @@ REPORT: nothing here aborts a turn, kills a session, or refuses an `open_session
   minutes, and HALVES the idle-eviction window above while the host stays above the threshold, so idle sessions return
   their memory sooner. It is released as soon as RSS falls back under the threshold. Memory never refuses an open: the
   shared host has no resource caps, so every `open_session` is admitted whatever the host holds (#2207). Hosts released
-  before #2207 refused NEW worker sessions above `SENPI_RPC_HOST_RSS_REFUSE_MB`; that variable is no longer read.
+  before #2207 had a second admission watermark; current hosts have no such admission path.
+- **Per-endpoint pressure under sharding**: an agent directory may contain many independent hosts, so each endpoint
+  samples and reports its own memory pressure. `host_memory_pressure` describes only the host that emitted it; pressure
+  on one `p-*` or `i-*` endpoint does not gate opens on another endpoint. In `host status --all`, `rss_mb` is the
+  endpoint generation's whole process tree, `host_rss_mb` is the supervisor plus host processes, and `memory_pressure`
+  is whether the answering generation is above the threshold right now. Read them on the endpoint row (and the RSS
+  pair on its generation rows) rather than treating an aggregate agent-directory number as an admission
+  signal. The warning threshold remains observability-only: every endpoint continues to admit worker `open_session`
+  requests while pressured.
 - **Stall-proof dead-peer detection**: the socket dead-peer budget (30 s, `socket-event-fanout.ts`) counts only time
   the host loop actually SERVED. The loop-lag watchdog deposits each measured drift into a process-wide ledger
   (`loop-blocked-time.ts`) and the deadline re-arms for whatever blocked time landed inside its window, so a host that
@@ -798,7 +953,7 @@ absolute: **no blocking primitive, and no unbounded synchronous filesystem read.
   sleeps synchronously, or reads a large file synchronously inside an event handler freezes every other client's
   session on that host. Use the async API, and give genuinely CPU-bound work its own worker or child process.
 - The rule is observable rather than enforced at runtime: the stall watchdog above is what names the offender.
-  `host_stalled { driftMs, sessionId, tool }` and the matching stderr line are how a blocking call in a session or a
+  `host_stalled { driftMs, sessionId, tool, processCpuMs, heapDeltaMb }` and the matching stderr line are how a blocking call in a session or a
   tool becomes a report instead of an unexplained freeze.
 
 ### Worker ownership and flow control
@@ -889,7 +1044,7 @@ containment, or containment of arbitrary native code. They are not an extension
 
 | Command | Params | Success data | Notes |
 | --- | --- | --- | --- |
-| `get_protocol_info` | - | `{ protocolVersion: 1, serverVersion: string, capabilities: string[], mode: "classic"\|"multi", instanceId: string, generation: number, engineVersion: string, engineOrdinal: [y, m, d, n, epoch], launch_profile: { profile_id, core } }` | Answered in BOTH modes; side-effect-free; the capability probe. Multi-session hosts include `multi_session`, `retain_on_disconnect`, `session_kind`, `session_context` and `auto_title_per_session` plus the negotiated launch capabilities. Those are HOST capabilities (a client never sends them) and are advertised only in multi-session mode, where the host owns the attachment refcount and the per-session launch profile. The identity fields are described under "Host identity" above; compatibility is decided from `protocolVersion`, `capabilities` and `engineOrdinal`, NEVER from `serverVersion`. |
+| `get_protocol_info` | - | `{ protocolVersion: 1, serverVersion: string, capabilities: string[], mode: "classic"\|"multi", instanceId: string, generation: number, engineVersion: string, engineOrdinal: [y, m, d, n, epoch], launch_profile: { profile_id, core }, memory_pressure?: boolean }` | Answered in BOTH modes; side-effect-free; the capability probe. Multi-session hosts include `multi_session`, `retain_on_disconnect`, `session_kind`, `session_context` and `auto_title_per_session` plus the negotiated launch capabilities. Those are HOST capabilities (a client never sends them) and are advertised only in multi-session mode, where the host owns the attachment refcount and the per-session launch profile. The identity fields are described under "Host identity" above; compatibility is decided from `protocolVersion`, `capabilities` and `engineOrdinal`, NEVER from `serverVersion`. |
 | `open_session` | `sessionPath?`, `cwd?`, `provider?`, `modelId?`, `thinkingLevel?`, `permissionPreset?`, `retain_on_disconnect?`, `kind?`, `context?`, `auto_title?` (all optional; paths MUST be absolute) | `{ sessionId, state: RpcSessionState, attached?: true }` | `sessionPath` = today's `--session` semantics (open-if-exists else create persisting there, `session-manager.ts:926-940`); `provider`/`modelId` applied only on create (resume restores the session's model — mirrors `SenpiSessionRuntime.ts:198-200`); params form the immutable launch profile (D8). When the path is already held by a fully-open session, the open ATTACHES to it: same routing handle, `attached: true`, one more attachment counted; the runtime is torn down only when the last attachment closes. Idle sessions past the eviction window are closed by the host itself. `retain_on_disconnect: true` (default false) makes a dropped connection DETACH from this session instead of closing it — see "Retained sessions" below. `kind` (default `interactive`) and the opaque `context` map are described under "Session kind and context" above; both are stored frozen for the session's life and never influence auth, model or resource resolution. |
 | `close_session` | `sessionId` | `{}` | Refused with `unknown_session` when the requesting connection never attached to that handle (a close releases the CALLER's attachment, and `list_sessions` publishes every handle). Otherwise aborts active work, awaits agent idle + settled persistence for up to the host grace window (default 10s), then quarantines any worker that has not exited without releasing its path reservation; its response is the LAST record tagged with that handle for the first closer — no events after (test-pinned). An admitted concurrent close joins the same teardown and receives its own successful response; output saturation rejects admission with the bounded close-overflow/resync notice described above. |
 | `list_sessions` | `include_workers?` (default false) | `{ sessions: [{ sessionId, durableSessionId, sessionPath, cwd, name, status, attachments, kind, context? }] }` | Includes `opening`/`closing` entries. Internally quarantined workers remain externally `closing` until exit. `attachments` is the session's live client attachment count; `0` on an `open` row is a retained session with no client attached. Every row carries `kind`. Rows with `kind: "worker"` are omitted unless `include_workers: true`, and `context` is published ONLY on that listing — a default listing carries no `context` at all. |
@@ -1638,11 +1793,23 @@ Response:
       "tokens": 60000,
       "contextWindow": 200000,
       "percent": 30
+    },
+    "failures": {
+      "requests": 6,
+      "erroredRequests": 1,
+      "abortedRequests": 0,
+      "failureShare": 0.16666666666666666,
+      "failedDurationMs": 4200,
+      "postFailureRequests": 1,
+      "postFailureFullMissRequests": 1,
+      "postFailureFullMissInputTokens": 48000
     }
   }
 }
 ```
 
+`failures` reports what failed provider requests cost the session. Every assistant response is one request; `erroredRequests` and `abortedRequests` count responses that ended with stop reason `error` or `aborted`, and `failedDurationMs` sums their time from request start to the recorded response. `postFailureRequests` counts the first successful response after one or more failed ones within the same user turn (a user message resets it); `postFailureFullMissRequests` counts those that read nothing from the prompt cache on a prompt of at least 2048 tokens, and `postFailureFullMissInputTokens` sums their uncached prompt tokens (input plus cache writes). The token counts are the provider's usage report; attributing the cache miss to the preceding failure is an inference from the turn's sequence. Hosts older than this field omit it.
+
 `tokens` and `cost` include assistant messages, usage reported by tools, and compaction/branch-summary generation across the full session. `contextUsage` contains the actual current context-window estimate used for compaction and footer display.
 
 `contextUsage` is omitted when no model or context window is available. `contextUsage.tokens` and `contextUsage.percent` are `null` immediately after compaction until a fresh post-compaction assistant response provides valid usage data.

package/docs/settings.md

@@ -254,6 +254,8 @@ See [compaction.md](compaction.md) for trigger and summarization behavior.
 | `retry.fallbackChains` | `Record<string, string[]>` | `{}` | Ordered exact model-selector to fallback-selector chains |
 | `retry.fallbackRevertPolicy` | `"cooldown-expiry"` \| `"never"` | `"cooldown-expiry"` | Automatic primary-model restoration policy |
 | `retry.abortServerSideFallback` | boolean | `true` | Abort a turn when the provider substitutes a different model after a classifier decline |
+| `fallback.circuitCooldownMs` | number | `60000` | First circuit-breaker cooldown for a chain entry that failed out of its chain; doubles on each consecutive failure; `0` disables the breaker |
+| `fallback.circuitMaxCooldownMs` | number | `1800000` | Ceiling for the doubled circuit-breaker cooldown (30 minutes) |
 | `retry.maxAgentDelayMs` | number | `60000` | Hard ceiling on agent-level retry delay (60s), applied after the retry profile and jitter |
 | `retry.provider.timeoutMs` | number | `300000` | Provider/SDK request timeout and stream idle timeout in milliseconds |
 | `retry.provider.streamStartTimeoutMs` | number | `300000` | Maximum wait for the first provider stream event; `0` disables |
@@ -319,6 +321,28 @@ Billing-class failures — Anthropic's 400 *credit balance is too low*, OpenAI's
 
 Anthropic streaming refusals are identified from typed `stopDetails`. A configured candidate receives an immediate **pinned** fallback switch with a user-visible fallback notice: Senpi does not retry the refusing model and a pinned fallback never auto-reverts. Set `retry.fallbackRevertPolicy` to `"cooldown-expiry"` (the default) to return an unpinned fallback to its primary after the primary's cooldown expires, or `"never"` to keep the fallback until you change models.
 
+#### Fallback circuit breaker
+
+When a chain entry fails with a provider-health failure, Senpi opens a circuit for that entry: a transient failure (timeout, overload, 429, 5xx, transport drop) once its retry budget is spent, or a billing, credit, quota, or budget exhaustion at once, including on the last entry of the chain. Authentication (401/403) and request-shape rejections do not open a circuit. The circuit is shared by every session in the process that uses the same agent directory - sessions started with `/new`, `/resume`, or `/fork`, and in-process subagents - so they skip the entry without sending it a request or spending its retry budget:
+
+- A session whose current model has an open circuit moves to the next chain entry with a closed circuit at the turn boundary (shown as a `transient` model fallback). Mid-turn fallbacks skip open entries the same way.
+- The cooldown starts at `fallback.circuitCooldownMs` and doubles on each consecutive failure, up to `fallback.circuitMaxCooldownMs`. A provider `Retry-After` (seconds or HTTP-date, on 429 and 503 responses) keeps the circuit open until that time when it is longer, and a later failure without a hint never shortens it. An accepted response from the entry closes the circuit and resets the escalation.
+- After the cooldown the circuit is half-open: the first request to use the entry again - a session's turn or a background 429 probe-back - holds its only probe until the probe settles, and every other request keeps skipping it, including the other request lane of the same session. While the circuit tracks an entry, its clock (monotonic, like every cooldown) decides when a fallback returns to it. The probe closes the circuit as soon as the entry streams a response; its first provider-health failure re-opens the circuit with the doubled cooldown and falls back immediately, without same-model retries. A user abort, a request-shaped error, or disposal hands the probe back. A probe that never answers is aborted as a provider failure after the stream-start guard (5 minutes when `retry.provider.streamStartTimeoutMs` is 0).
+- 429 probe-back probes of a demoted primary respect the circuit: none is sent before the provider's retry-after or the cooldown elapses, or while another session holds the probe.
+- The chain never refuses a turn: if every remaining entry is open, the request still goes to the current entry (or the first open candidate) as a probe.
+- Refusals and request-shaped hard errors do not open circuits. Selecting a model yourself closes its circuit.
+
+Circuits are process-local like the rest of the fallback state and are never persisted. Set `fallback.circuitCooldownMs` to `0` to turn the breaker off:
+
+```json
+{
+  "fallback": {
+    "circuitCooldownMs": 60000,
+    "circuitMaxCooldownMs": 1800000
+  }
+}
+```
+
 #### Provider-substituted models
 
 Anthropic's server-side fallback betas can retry a classifier-declined request on a substitute model *inside the same response*, marking the handoff with a `fallback` content block; a gateway may enable this on your behalf. Honoring that response means paying for a model you did not select, and after the first handoff Anthropic routes later turns of the conversation straight to the substitute with no marker at all — reported only as a `fallback_message` entry in `usage.iterations`.
@@ -331,7 +355,7 @@ Set it to `false` to keep the substituted response instead. If a gateway in fron
 
 Fallback decisions are process-local. A `senpi-task` or subagent child process reads its own settings and maintains its own in-memory suppression state; it does not affect its parent process. Disable fallback for one run without changing settings with `--no-model-fallback` or `SENPI_NO_FALLBACK=1`.
 
-For diagnostics, Senpi writes sanitized NDJSON records for candidate skips, cooldowns, switches, reverts, manual clears, and validation warnings to `<agentDir>/logs/fallback.log`. The file is mode `0600` and rotates at 5 MB (`fallback.log.1`).
+For diagnostics, Senpi writes sanitized NDJSON records for candidate skips, cooldowns, circuit opens (`circuit_opened`) and turn-boundary circuit skips (`circuit_open_skip`), switches, reverts, manual clears, and validation warnings to `<agentDir>/logs/fallback.log`. `/session` reports what failed requests cost the session: failed-request counts and share, time spent in failed requests, and retries that succeeded after a failure in the same user turn but read nothing from the prompt cache, with their uncached input tokens. Prompts under 2,048 tokens are never counted as cache misses, because providers do not cache prompts that small; the token counts come from the provider's usage report, while tying the miss to the failure is the report's reading of the turn. The file is mode `0600` and rotates at 5 MB (`fallback.log.1`).
 
 ### Message Delivery
 

package/docs/usage.md

@@ -43,13 +43,13 @@ Type `/` in the editor to open command completion. Extensions can register custo
 | `/login`, `/logout` | Manage OAuth or API-key credentials |
 | [`/llama`](llama-cpp.md) | Download, load, and unload llama.cpp router models |
 | `/model` | Switch models; Ctrl+S in the picker saves the startup default |
-| `/thinking` | Switch thinking level; Ctrl+S in the picker saves the startup default |
+| `/thinking [level]` | Set the thinking level for this session (`/thinking high`), or open the picker with no argument; Ctrl+S in the picker saves it as the startup default |
 | `/scoped-models` | Enable/disable models for Ctrl+P cycling |
 | `/reasoning [on\|off]` | Show or toggle reasoning for the current model |
 | `/efforts [level]` | Show or set reasoning effort (graded models only) |
 | `/fast [on\|off]` | Toggle fast mode (ChatGPT Subscription models, persisted per model) |
 | `/settings` | Theme, message delivery, transport, and other preferences |
-| `/resume` | Pick from previous sessions |
+| `/resume`, `/sessions` | Pick from previous sessions (`/sessions` is an alias) |
 | `/new` | Start a new session |
 | `/rename [name]` | Rename the current session (`/name` is an alias) |
 | `/session` | Show session file, ID, messages, tokens, and cost |
@@ -71,6 +71,8 @@ Type `/` in the editor to open command completion. Extensions can register custo
 
 ### Reasoning and Fast Mode Commands
 
+**Changing the thinking level.** `/thinking <level>` sets it for this session and `/thinking` alone opens a picker. Shift+Tab cycles through the levels the model supports, and `/efforts <level>` sets the reasoning effort for graded models; both remember the level for the current model. The footer shows the active level after the model name.
+
 **`/reasoning [on|off]`** shows or toggles reasoning. Behavior adapts to the active model:
 
 - Models without reasoning support are told plainly.
@@ -113,6 +115,7 @@ senpi --fork <path|id>    # Fork a session into a new session file
 
 Useful session commands:
 
+- `/resume` (or its alias `/sessions`) opens the same picker as `senpi -r` without leaving the TUI.
 - `/session` shows the current session file and ID.
 - `/tree` navigates the in-file session tree and can summarize abandoned branches. Ctrl+E on an assistant entry edits that response in place of the original (the original stays in the file on an abandoned branch; tool calls in the edited response are dropped).
 - `/fork` creates a new session from an earlier user message.

package/node_modules/@code-yeongyu/senpi-codemode/CHANGELOG.md

@@ -12,6 +12,18 @@
 
 ### Removed
 
+## [2026.9.28] - 2026-09-28
+
+### Breaking Changes
+
+### Added
+
+### Changed
+
+### Fixed
+
+### Removed
+
 ## [2026.9.27-4] - 2026-09-27
 
 ### Breaking Changes

package/node_modules/@code-yeongyu/senpi-codemode/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi-codemode",
-	"version": "2026.9.27-4",
+	"version": "2026.9.28",
 	"private": true,
 	"description": "Source-only senpi extension package for codemode evaluation tools",
 	"type": "module",
@@ -31,14 +31,14 @@
 	},
 	"dependencies": {
 		"@babel/parser": "8.0.4",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.9.27-4",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.9.28",
 		"typebox": "1.3.34"
 	},
 	"peerDependencies": {
-		"@code-yeongyu/senpi": "2026.9.27-4"
+		"@code-yeongyu/senpi": "2026.9.28"
 	},
 	"devDependencies": {
-		"@code-yeongyu/senpi": "2026.9.27-4"
+		"@code-yeongyu/senpi": "2026.9.28"
 	},
 	"keywords": [
 		"senpi",

package/node_modules/@earendil-works/pi-agent-core/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@earendil-works/pi-agent-core",
-	"version": "2026.9.27-4",
+	"version": "2026.9.28",
 	"description": "General-purpose agent with transport abstraction, state management, and attachment support",
 	"type": "module",
 	"main": "./dist/index.js",
@@ -57,8 +57,8 @@
 	},
 	"dependencies": {
 		"@earendil-works/chord": "0.85.1",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.9.27-4",
-		"@earendil-works/pi-telemetry": "npm:@code-yeongyu/senpi-telemetry@2026.9.27-4",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.9.28",
+		"@earendil-works/pi-telemetry": "npm:@code-yeongyu/senpi-telemetry@2026.9.28",
 		"diff": "9.0.0",
 		"ignore": "7.0.9",
 		"typebox": "1.3.34",

package/node_modules/@earendil-works/pi-ai/dist/providers/data/.manifest.json

@@ -1 +1 @@
-{"schemaVersion":3,"generatedAt":"2026-09-27T17:38:10.496Z","structureHash":"de13fd32a0f46b302e3edd0d4d50c72e20019642cf25e876b706b4edc97089e5","files":{"alibaba-token-plan.json":"3a9c1be76d47459371e9fa2feeffc31e7edbbfec65fa9cc41236988efc4cf6d9","amazon-bedrock.json":"848e38fd1ade9c6e94c3037c1c6104ac515809a6f190d264eafd9f48ab0ae1ae","ant-ling.json":"4979fe79d99ed97382d7ce40170c6132e932e77906de1eb54464c042e7d63633","anthropic.json":"f9db437d92449fb860a2d457a6019cdfd51c11180c08df2b5f14d75ade773953","azure-openai-responses.json":"d70ff10410e6dd8eacb4a53b9fe887be836562cbb4b74eaee4f28bdbc4ac0732","bai.json":"2b12b15bd43462e60711944dd7283db8676611d9d76c82c2a01f64913e16a67e","baseten.json":"d155c434294b5167244cffb6dea6793f9669e91e8ab65b564f9510d81b330e37","cerebras.json":"3be228c613905c215c9da3d0b3535e10cc594ff2351b05390744c7c34de89b6c","chatgpt-subscription.json":"421c6ad932de4259c8f0c08589da278bed99ec80c042f2490d8ffd2a86f4da99","cloudflare-ai-gateway.json":"b64cc5c7c0df4bfce0c3c2b14fe5290636553914b09718634668ad98276a9bc5","cloudflare-workers-ai.json":"8ee15540a01cf79d0e4063c493ae3c436af2fc1d456f9faf1b066418247183e9","deepseek.json":"b5f9693ec641e9a957dc5f7a22042b3bb928bac3d7268406619b6f18e21c4b83","fireworks.json":"bbb8149854a2658f221afa47ae8e2617e6b58a8e2784aa822faaf54f0c0f18c3","github-copilot.json":"5c9fc5b1b553a26aa7bc843a3e36fa14cf220d528ecd89528c601c5090c88a2d","google-vertex.json":"97d80ac909d256cc1bf19ac54d9d8131c492e7c0c102ad89f68ade528544e0ad","google.json":"68f6cf6283cc0d69b77b0fa79e9c94774e96524f61ebba616319f05d5c9db56c","groq.json":"e4728fd72e358cd8f25e9a518e9b49a521ef44523d3debe38a7db9e0663c4077","huggingface.json":"2f93082144a7b2a1cbf79148244ce7559e0428d6310c5eb0648bca89b15a8b4b","minimax-cn.json":"4f636b47b28a507ad33b5eaba33fc4889e5956504d10f2a0d9c61167ae01ff1d","minimax.json":"9fd1764ffeefebded8579039cf0c48854a43e4c5b724f62361fc2ac54f705aa1","mistral.json":"be522597b22bceeb0bb9a0ba1781647649ffd19637d0c8e67b056d7b0ec33d52","moonshotai-cn.json":"326de79b46f6fdbf0879f005b3040d1b14049e81fa678de407b73ed1bd3bce9c","moonshotai.json":"4b917a375e9c880b903927cf5fe1ae1052c74b64d5027a007bb1e67ad0410755","nvidia.json":"6493e09b5db8b8fe9c8fae5bc15dc287645f37f83a4ed3a1ad1181e5830b5ff7","openai.json":"4c18b28b168f56d621670866a62d2d435da3a8eee55a204bdbabe02c48e6513e","opencode-go.json":"00b2c0154285829e8db1e7b9ad492771b098cb88a61b036e51a6861b2f2f6dc1","opencode.json":"1655e248e76f919fd14ca4b8a6201d1dd89b2190b295028c5d7a4a2a03809946","opengateway.json":"121f544154757cfbccd3bc3d7344986a5822886c12e1c00b39ebf20ef609f239","openrouter.json":"bc12e53c9a86bc315a076a78aa605a520b51cee7214846afe9db77236a703251","qwen-token-plan-cn.json":"4bf520ed38e5c3045680d2ec2816fa8a69079dbe97f7b929767a63172288da6b","qwen-token-plan-individual.json":"eb040e78595853e980011308b1bf9caacae6dc8a91abbac5ffebd402515dd2a6","qwen-token-plan.json":"a5c67213745329ec3ba79f712f31c1c32a781d7ffb8c04f9819f36c27672531f","together.json":"200fa2cc0b4666e3818c260e41b9925b925180e2d0931d7c900e16494b2314b4","venice.json":"d34b566ee6e7a2ed31abd9099a1c0448f1d521fc696382d03d86c90634270cf1","vercel-ai-gateway.json":"95a697cd6f9eba46972dbfa301e80f18f45c701e6068c0326d2f36da10b7ce7e","xai.json":"9b23faa5218e966a17108c05d2498a617ade1eae9b0d0684284c77d67949a3f1","xiaomi-token-plan-ams.json":"7df74a255259fc1d5be8e682c3ffb0908eaaf0af711f6433dedcf345ce3e8393","xiaomi-token-plan-cn.json":"7dc672723d5b37e5b92605752f74f46f44eba10be2b0cb959790260b9e0c2a4e","xiaomi-token-plan-sgp.json":"69b333b158be038459a511a673f4536a5b03d4931c3119339f1ac741bc03d502","xiaomi.json":"333299657f211ad9edac0f3d4298b7e5776626914c9c80e22305a87533f23966","zai-coding-cn.json":"69c572aa75104f16ccbddbaace60c267f4bcc74f86d34891ca43110d312fb1ad","zai.json":"15c8182a88e58bdc1b1c3eb0603c690475342c8a826ceddfe9af1b36b28345ee"}}
+{"schemaVersion":3,"generatedAt":"2026-09-28T01:49:01.161Z","structureHash":"de13fd32a0f46b302e3edd0d4d50c72e20019642cf25e876b706b4edc97089e5","files":{"alibaba-token-plan.json":"3a9c1be76d47459371e9fa2feeffc31e7edbbfec65fa9cc41236988efc4cf6d9","amazon-bedrock.json":"848e38fd1ade9c6e94c3037c1c6104ac515809a6f190d264eafd9f48ab0ae1ae","ant-ling.json":"4979fe79d99ed97382d7ce40170c6132e932e77906de1eb54464c042e7d63633","anthropic.json":"f9db437d92449fb860a2d457a6019cdfd51c11180c08df2b5f14d75ade773953","azure-openai-responses.json":"d70ff10410e6dd8eacb4a53b9fe887be836562cbb4b74eaee4f28bdbc4ac0732","bai.json":"2b12b15bd43462e60711944dd7283db8676611d9d76c82c2a01f64913e16a67e","baseten.json":"d155c434294b5167244cffb6dea6793f9669e91e8ab65b564f9510d81b330e37","cerebras.json":"3be228c613905c215c9da3d0b3535e10cc594ff2351b05390744c7c34de89b6c","chatgpt-subscription.json":"421c6ad932de4259c8f0c08589da278bed99ec80c042f2490d8ffd2a86f4da99","cloudflare-ai-gateway.json":"b64cc5c7c0df4bfce0c3c2b14fe5290636553914b09718634668ad98276a9bc5","cloudflare-workers-ai.json":"8ee15540a01cf79d0e4063c493ae3c436af2fc1d456f9faf1b066418247183e9","deepseek.json":"b5f9693ec641e9a957dc5f7a22042b3bb928bac3d7268406619b6f18e21c4b83","fireworks.json":"bbb8149854a2658f221afa47ae8e2617e6b58a8e2784aa822faaf54f0c0f18c3","github-copilot.json":"5c9fc5b1b553a26aa7bc843a3e36fa14cf220d528ecd89528c601c5090c88a2d","google-vertex.json":"97d80ac909d256cc1bf19ac54d9d8131c492e7c0c102ad89f68ade528544e0ad","google.json":"68f6cf6283cc0d69b77b0fa79e9c94774e96524f61ebba616319f05d5c9db56c","groq.json":"e4728fd72e358cd8f25e9a518e9b49a521ef44523d3debe38a7db9e0663c4077","huggingface.json":"2f93082144a7b2a1cbf79148244ce7559e0428d6310c5eb0648bca89b15a8b4b","minimax-cn.json":"4f636b47b28a507ad33b5eaba33fc4889e5956504d10f2a0d9c61167ae01ff1d","minimax.json":"9fd1764ffeefebded8579039cf0c48854a43e4c5b724f62361fc2ac54f705aa1","mistral.json":"be522597b22bceeb0bb9a0ba1781647649ffd19637d0c8e67b056d7b0ec33d52","moonshotai-cn.json":"326de79b46f6fdbf0879f005b3040d1b14049e81fa678de407b73ed1bd3bce9c","moonshotai.json":"4b917a375e9c880b903927cf5fe1ae1052c74b64d5027a007bb1e67ad0410755","nvidia.json":"6493e09b5db8b8fe9c8fae5bc15dc287645f37f83a4ed3a1ad1181e5830b5ff7","openai.json":"4c18b28b168f56d621670866a62d2d435da3a8eee55a204bdbabe02c48e6513e","opencode-go.json":"00b2c0154285829e8db1e7b9ad492771b098cb88a61b036e51a6861b2f2f6dc1","opencode.json":"1655e248e76f919fd14ca4b8a6201d1dd89b2190b295028c5d7a4a2a03809946","opengateway.json":"121f544154757cfbccd3bc3d7344986a5822886c12e1c00b39ebf20ef609f239","openrouter.json":"ac1c0d449b1fbaa6cd36c55408789ac6e91a861af525045ab0168214f18c8164","qwen-token-plan-cn.json":"4bf520ed38e5c3045680d2ec2816fa8a69079dbe97f7b929767a63172288da6b","qwen-token-plan-individual.json":"eb040e78595853e980011308b1bf9caacae6dc8a91abbac5ffebd402515dd2a6","qwen-token-plan.json":"a5c67213745329ec3ba79f712f31c1c32a781d7ffb8c04f9819f36c27672531f","together.json":"200fa2cc0b4666e3818c260e41b9925b925180e2d0931d7c900e16494b2314b4","venice.json":"d34b566ee6e7a2ed31abd9099a1c0448f1d521fc696382d03d86c90634270cf1","vercel-ai-gateway.json":"95a697cd6f9eba46972dbfa301e80f18f45c701e6068c0326d2f36da10b7ce7e","xai.json":"9b23faa5218e966a17108c05d2498a617ade1eae9b0d0684284c77d67949a3f1","xiaomi-token-plan-ams.json":"7df74a255259fc1d5be8e682c3ffb0908eaaf0af711f6433dedcf345ce3e8393","xiaomi-token-plan-cn.json":"7dc672723d5b37e5b92605752f74f46f44eba10be2b0cb959790260b9e0c2a4e","xiaomi-token-plan-sgp.json":"69b333b158be038459a511a673f4536a5b03d4931c3119339f1ac741bc03d502","xiaomi.json":"333299657f211ad9edac0f3d4298b7e5776626914c9c80e22305a87533f23966","zai-coding-cn.json":"69c572aa75104f16ccbddbaace60c267f4bcc74f86d34891ca43110d312fb1ad","zai.json":"15c8182a88e58bdc1b1c3eb0603c690475342c8a826ceddfe9af1b36b28345ee"}}