@crouton-kit/crouter 0.3.32 → 0.3.34

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/__tests__/provider-rotation.test.ts

@@ -0,0 +1,663 @@
+import { before, after, test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { tmpdir } from "node:os";
+
+let home: string;
+let helpers: typeof import("../../lib/subscription-state.ts");
+let rotationModule: typeof import("../provider-rotation.ts");
+let providerRotationExtension: typeof import("../provider-rotation.ts").default;
+const previousHome = process.env.HOME;
+
+function writeLadderConfig() {
+  const configPath = join(home, ".crouter", "config.json");
+  mkdirSync(dirname(configPath), { recursive: true });
+  writeFileSync(
+    configPath,
+    `${JSON.stringify(
+      {
+        modelLadders: {
+          anthropic: {
+            ultra: "anthropic/claude-fable-5:high",
+            strong: "anthropic/claude-opus-4-8:high",
+            medium: "anthropic/claude-sonnet-4-6:high",
+            light: "anthropic/custom-light-x",
+          },
+          openai: {
+            ultra: "openai-codex/gpt-5.5:xhigh",
+            strong: "openai-codex/gpt-5.5:high",
+            medium: "openai-codex/gpt-5.4-mini:medium",
+            light: "openai-codex/gpt-5.3-codex-spark",
+          },
+        },
+      },
+      null,
+      2,
+    )}\n`,
+    "utf8",
+  );
+}
+
+function credential(label: string, overrides: Partial<helpers.SubscriptionCredential> = {}): helpers.SubscriptionCredential {
+  return {
+    label,
+    refresh: `refresh-${label}`,
+    access: `access-${label}`,
+    expires: Date.now() + 60_000,
+    rateLimitedUntil: 0,
+    lastAttemptAt: 0,
+    lastRateLimitedAt: 0,
+    ...overrides,
+  };
+}
+
+function resetRotationState() {
+  rmSync(join(home, ".pi", "agent", "auth.json"), { force: true });
+  helpers.writeSubscriptionPool("anthropic", []);
+  helpers.writeSubscriptionPool("openai-codex", []);
+  helpers.clearPreferredModel();
+}
+
+before(async () => {
+  home = mkdtempSync(join(tmpdir(), "pi-provider-rotation-"));
+  process.env.HOME = home;
+  helpers = await import("../../lib/subscription-state.ts");
+  rotationModule = await import("../provider-rotation.ts");
+  providerRotationExtension = rotationModule.default;
+});
+
+after(() => {
+  if (previousHome === undefined) delete process.env.HOME;
+  else process.env.HOME = previousHome;
+  rmSync(home, { recursive: true, force: true });
+});
+
+test("normalizes provider subscription pool files", () => {
+  resetRotationState();
+  helpers.writeSubscriptionPool("anthropic", [
+    {
+      label: " personal ",
+      refresh: " refresh-token ",
+      access: " access-token ",
+      expires: 123,
+      rateLimitedUntil: Number.NaN,
+      lastAttemptAt: Number.NaN,
+      lastRateLimitedAt: Number.NaN,
+    },
+  ]);
+
+  assert.deepEqual(helpers.readSubscriptionPool("anthropic"), [
+    {
+      label: "personal",
+      refresh: "refresh-token",
+      access: "access-token",
+      expires: 123,
+      rateLimitedUntil: 0,
+      lastAttemptAt: 0,
+      lastRateLimitedAt: 0,
+    },
+  ]);
+});
+
+test("empty provider pool reseeds from OAuth auth", () => {
+  resetRotationState();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({
+      "openai-codex": {
+        type: "oauth",
+        refresh: "refresh-codex-auth",
+        access: "access-codex-auth",
+        expires: 123456,
+      },
+    })}\n`,
+    "utf8",
+  );
+
+  assert.deepEqual(helpers.readSubscriptionPool("openai-codex"), [
+    {
+      label: "openai-codex",
+      refresh: "refresh-codex-auth",
+      access: "access-codex-auth",
+      expires: 123456,
+      rateLimitedUntil: 0,
+      lastAttemptAt: 0,
+      lastRateLimitedAt: 0,
+    },
+  ]);
+});
+
+test("default provider subscription syncs when OAuth auth is refreshed elsewhere", () => {
+  resetRotationState();
+  helpers.writeSubscriptionPool("anthropic", [
+    credential("anthropic", {
+      refresh: "refresh-same",
+      access: "access-stale",
+      expires: 1,
+      rateLimitedUntil: Date.now() + 60_000,
+    }),
+  ]);
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({
+      anthropic: {
+        type: "oauth",
+        refresh: "refresh-same",
+        access: "access-fresh",
+        expires: 123456,
+      },
+    })}\n`,
+    "utf8",
+  );
+
+  assert.deepEqual(helpers.readSubscriptionPool("anthropic"), [
+    {
+      label: "anthropic",
+      refresh: "refresh-same",
+      access: "access-fresh",
+      expires: 123456,
+      rateLimitedUntil: 0,
+      lastAttemptAt: 0,
+      lastRateLimitedAt: 0,
+    },
+  ]);
+});
+
+// Regression: ambient /login auth sync used to append a brand-new pool entry whenever
+// the freshly authenticated tokens didn't match an existing entry by refresh/access
+// (e.g. a re-login that rotated both tokens), silently duplicating the default account
+// instead of updating it. It must update the selected/default slot (index 0) in place;
+// adding a genuinely additional account stays an explicit `/provider-sub add` action.
+test("/login with non-matching tokens replaces the default provider subscription slot", () => {
+  resetRotationState();
+  helpers.writeSubscriptionPool("anthropic", [credential("anthropic", { refresh: "refresh-first", access: "access-first" })]);
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({
+      anthropic: {
+        type: "oauth",
+        refresh: "refresh-second",
+        access: "access-second",
+        expires: 123456,
+      },
+    })}\n`,
+    "utf8",
+  );
+
+  assert.deepEqual(helpers.readSubscriptionPool("anthropic").map((entry) => ({ label: entry.label, refresh: entry.refresh, access: entry.access })), [
+    { label: "anthropic", refresh: "refresh-second", access: "access-second" },
+  ]);
+});
+
+test("/provider-sub add still adds an explicit additional subscription alongside the default slot", () => {
+  resetRotationState();
+  helpers.writeSubscriptionPool("anthropic", [credential("anthropic", { refresh: "refresh-first", access: "access-first" })]);
+
+  helpers.upsertSubscription("anthropic", credential("work", { refresh: "refresh-work", access: "access-work" }));
+
+  assert.deepEqual(helpers.readSubscriptionPool("anthropic").map((entry) => entry.label), ["anthropic", "work"]);
+});
+
+test("resolves Anthropic to strength-matched OpenAI Codex fallback", () => {
+  resetRotationState();
+  writeLadderConfig();
+
+  assert.deepEqual(helpers.resolveFallbackTarget("anthropic", "anthropic/claude-opus-4-8:high"), {
+    providerId: "openai-codex",
+    modelId: "gpt-5.5",
+    label: "openai-codex/gpt-5.5:high",
+    strength: "strong",
+    thinkingLevel: "high",
+  });
+});
+
+test("resolves OpenAI Codex to strength-matched Anthropic fallback", () => {
+  writeLadderConfig();
+
+  assert.deepEqual(helpers.resolveFallbackTarget("openai-codex", "openai-codex/gpt-5.4-mini:medium"), {
+    providerId: "anthropic",
+    modelId: "claude-sonnet-4-6",
+    label: "anthropic/claude-sonnet-4-6:high",
+    strength: "medium",
+    thinkingLevel: "high",
+  });
+});
+
+// Regression: ultra (gpt-5.5:xhigh) and strong (gpt-5.5:high) share the bare model id
+// `gpt-5.5`. The strength matcher used to collapse both to `strong`, so an ultra run fell
+// back to opus instead of the ultra Anthropic model. The live thinking level disambiguates.
+test("disambiguates colliding ladder rungs by the live thinking level", () => {
+  resetRotationState();
+  writeLadderConfig();
+  const config = helpers.readRotationConfig();
+
+  // xhigh -> ultra rung -> Anthropic ultra (claude-fable-5)
+  assert.deepEqual(helpers.resolveFallbackTarget("openai-codex", "gpt-5.5", config, "xhigh"), {
+    providerId: "anthropic",
+    modelId: "claude-fable-5",
+    label: "anthropic/claude-fable-5:high",
+    strength: "ultra",
+    thinkingLevel: "high",
+  });
+
+  // high -> strong rung -> Anthropic strong (claude-opus-4-8)
+  assert.equal(helpers.resolveFallbackTarget("openai-codex", "gpt-5.5", config, "high").modelId, "claude-opus-4-8");
+
+  // No thinking level: preserves the legacy default-strength tie-break (strong -> opus).
+  assert.equal(helpers.resolveFallbackTarget("openai-codex", "gpt-5.5", config).modelId, "claude-opus-4-8");
+});
+
+test("parses Retry-After seconds and HTTP dates", () => {
+  const now = Date.UTC(2026, 5, 16, 18, 30, 0);
+  assert.equal(helpers.parseRetryAfterHeader("1.5", now), 1500);
+
+  const retryAt = new Date(now + 15_000).toUTCString();
+  const parsed = helpers.parseRetryAfterHeader(retryAt, now);
+  assert.ok(parsed !== undefined && parsed >= 14_000 && parsed <= 15_000);
+  assert.equal(helpers.parseRetryAfterHeader("", now), undefined);
+  assert.equal(helpers.parseRetryAfterHeader("not-a-delay", now), undefined);
+});
+
+test("restores preferred model when its provider pool frees up", async () => {
+  resetRotationState();
+  writeLadderConfig();
+  helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+  helpers.writeRotationConfig({ preferredModel: { providerId: "openai-codex", modelId: "gpt-5.5" } });
+
+  const setModelCalls: any[] = [];
+  const ctx = {
+    model: { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+    modelRegistry: {
+      find(provider: string, id: string) {
+        return { provider, id, api: provider === "openai-codex" ? "openai-codex-responses" : "anthropic-messages" };
+      },
+    },
+  } as any;
+  const pi = {
+    async setModel(model: any) {
+      setModelCalls.push(model);
+      ctx.model = model;
+      return true;
+    },
+  } as any;
+
+  const restored = await helpers.restorePreferredModelIfPossible(pi, ctx);
+
+  assert.equal(restored, true);
+  assert.deepEqual(setModelCalls[0], {
+    provider: "openai-codex",
+    id: "gpt-5.5",
+    api: "openai-codex-responses",
+  });
+  assert.equal(helpers.readRotationConfig().preferredModel, undefined);
+});
+
+test("keeps newest Retry-After cooldown across overlapping attempts", () => {
+  resetRotationState();
+  helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
+
+  helpers.markSubscriptionAttempt("anthropic", "personal", 100);
+  helpers.markSubscriptionAttempt("anthropic", "personal", 200);
+  helpers.markSubscriptionRateLimited("anthropic", "personal", 60_000, 100, 150);
+  helpers.markSubscriptionRateLimited("anthropic", "personal", 5_000, 200, 205);
+  helpers.markSubscriptionRateLimited("anthropic", "personal", 10_000, 100, 300);
+
+  const [entry] = helpers.readSubscriptionPool("anthropic");
+  assert.deepEqual(
+    { lastAttemptAt: entry.lastAttemptAt, lastRateLimitedAt: entry.lastRateLimitedAt, rateLimitedUntil: entry.rateLimitedUntil },
+    { lastAttemptAt: 200, lastRateLimitedAt: 300, rateLimitedUntil: 10300 },
+  );
+
+  helpers.markSubscriptionSuccess("anthropic", "personal", 250);
+  assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 10300);
+  helpers.markSubscriptionSuccess("anthropic", "personal", 400);
+  assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 0);
+});
+
+test("treats numeric subscription refs as 1-based indexes", () => {
+  resetRotationState();
+  const pool = [credential("alpha"), credential("beta")];
+
+  helpers.writeSubscriptionPool("openai-codex", pool);
+  assert.deepEqual(
+    helpers.removeSubscription("openai-codex", "1").map((entry) => entry.label),
+    ["beta"],
+  );
+
+  helpers.writeSubscriptionPool("openai-codex", pool);
+  assert.deepEqual(
+    helpers.promoteSubscription("openai-codex", "2").map((entry) => entry.label),
+    ["beta", "alpha"],
+  );
+});
+
+test("switches exhausted Anthropic sessions to OpenAI Codex fallback", async () => {
+  resetRotationState();
+  writeLadderConfig();
+
+  const ctx = {
+    model: { provider: "anthropic", id: "claude-sonnet-4-6", api: "anthropic-messages" },
+    modelRegistry: {
+      find(provider: string, id: string) {
+        return provider === "openai-codex" && id === "gpt-5.4-mini" ? { provider, id, api: "openai-codex-responses" } : undefined;
+      },
+    },
+  } as any;
+  let switchedTo: any;
+  let thinkingLevel: string | undefined;
+  const piApi = {
+    async setModel(model: any) {
+      switchedTo = model;
+      ctx.model = model;
+      return true;
+    },
+    setThinkingLevel(level: string) {
+      thinkingLevel = level;
+    },
+  } as any;
+
+  const target = await helpers.switchToFallbackIfPossible(piApi, ctx);
+
+  assert.deepEqual(target, {
+    providerId: "openai-codex",
+    modelId: "gpt-5.4-mini",
+    label: "openai-codex/gpt-5.4-mini:medium",
+    strength: "medium",
+    thinkingLevel: "medium",
+  });
+  assert.deepEqual(switchedTo, {
+    provider: "openai-codex",
+    id: "gpt-5.4-mini",
+    api: "openai-codex-responses",
+  });
+  assert.equal(thinkingLevel, "medium");
+  assert.deepEqual(helpers.readRotationConfig().preferredModel, {
+    providerId: "anthropic",
+    modelId: "claude-sonnet-4-6",
+  });
+});
+
+test("switches exhausted OpenAI Codex sessions to Anthropic fallback", async () => {
+  resetRotationState();
+  writeLadderConfig();
+
+  const ctx = {
+    model: { provider: "openai-codex", id: "gpt-5.5", api: "openai-codex-responses" },
+    modelRegistry: {
+      find(provider: string, id: string) {
+        return provider === "anthropic" && id === "claude-opus-4-8" ? { provider, id, api: "anthropic-messages" } : undefined;
+      },
+    },
+  } as any;
+  let switchedTo: any;
+  let thinkingLevel: string | undefined;
+  const piApi = {
+    async setModel(model: any) {
+      switchedTo = model;
+      ctx.model = model;
+      return true;
+    },
+    setThinkingLevel(level: string) {
+      thinkingLevel = level;
+    },
+  } as any;
+
+  const target = await helpers.switchToFallbackIfPossible(piApi, ctx);
+
+  assert.deepEqual(target, {
+    providerId: "anthropic",
+    modelId: "claude-opus-4-8",
+    label: "anthropic/claude-opus-4-8:high",
+    strength: "strong",
+    thinkingLevel: "high",
+  });
+  assert.deepEqual(switchedTo, {
+    provider: "anthropic",
+    id: "claude-opus-4-8",
+    api: "anthropic-messages",
+  });
+  assert.equal(thinkingLevel, "high");
+  assert.deepEqual(helpers.readRotationConfig().preferredModel, {
+    providerId: "openai-codex",
+    modelId: "gpt-5.5",
+  });
+});
+
+function makeRotationCtx() {
+  const ctx = {
+    model: { provider: "openai-codex", id: "gpt-5.5", api: "openai-codex-responses" },
+    ui: { setStatus() {} },
+    modelRegistry: {
+      find(provider: string, id: string) {
+        if (provider === "anthropic" && id === "claude-opus-4-8") return { provider, id, api: "anthropic-messages" };
+        if (provider === "openai-codex" && id === "gpt-5.5") return { provider, id, api: "openai-codex-responses" };
+        return undefined;
+      },
+    },
+  } as any;
+  const setModelCalls: any[] = [];
+  const providers: Record<string, { streamSimple: (...args: any[]) => AsyncIterable<any> }> = {};
+  const events: Record<string, (...args: any[]) => unknown> = {};
+  const pi = {
+    registerProvider(name: string, provider: { streamSimple: (...args: any[]) => AsyncIterable<any> }) {
+      providers[name] = provider;
+    },
+    registerCommand() {},
+    on(eventName: string, handler: (...args: any[]) => unknown) {
+      events[eventName] = handler;
+    },
+    async setModel(model: any) {
+      setModelCalls.push(model);
+      ctx.model = model;
+      return true;
+    },
+    setThinkingLevel() {},
+  } as any;
+  return { ctx, setModelCalls, providers, events, pi };
+}
+
+// Regression: Codex-exhausted fallback used to switch the model and then FAIL the turn
+// with a "retry on fallback" error, stranding autonomous nodes. It must now switch AND
+// transparently serve the same turn on the fallback provider.
+test("falls back transparently and serves the turn on Anthropic when Codex is exhausted", async () => {
+  resetRotationState();
+  writeLadderConfig();
+  helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  const streamedModels: any[] = [];
+  rotationModule.__setStreamForProviderForTest((model) => {
+    streamedModels.push(model);
+    return (async function* () {
+      yield { type: "text_delta", text: "hello from anthropic" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["openai-codex"].streamSimple(
+      { provider: "openai-codex", id: "gpt-5.5", api: "openai-codex-responses" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    // Session model was switched to the Anthropic fallback...
+    assert.deepEqual(setModelCalls.map((m) => m.provider), ["anthropic"]);
+    // ...and the turn was actually STREAMED on the Anthropic model (not the codex one).
+    assert.equal(streamedModels.length, 1);
+    assert.equal(streamedModels[0].provider, "anthropic");
+    // The turn was served with content, never failed with an error.
+    assert.ok(emitted.some((e) => e.type === "text_delta"));
+    assert.ok(!emitted.some((e) => e.type === "error"));
+  } finally {
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+test("treats request timeouts as fallback-like and serves the turn on the fallback provider", async () => {
+  resetRotationState();
+  writeLadderConfig();
+  helpers.writeSubscriptionPool("anthropic", [credential("anthropic")]);
+  helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  const streamedModels: any[] = [];
+  rotationModule.__setStreamForProviderForTest((model) => {
+    streamedModels.push(model);
+    return (async function* () {
+      if (model.provider === "anthropic") {
+        yield { type: "error", error: Object.assign(new Error("Request timed out."), { errorMessage: "Request timed out." }) };
+        return;
+      }
+      yield { type: "text_delta", text: "hello from codex" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.deepEqual(setModelCalls.map((m) => m.provider), ["openai-codex"]);
+    assert.deepEqual(streamedModels.map((m) => m.provider), ["anthropic", "openai-codex"]);
+    assert.ok(emitted.some((e) => e.type === "text_delta"));
+    assert.ok(!emitted.some((e) => e.type === "error"));
+    assert.ok(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil > Date.now());
+  } finally {
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+test("skips invalid refresh tokens and serves the turn on the fallback provider", async () => {
+  resetRotationState();
+  writeLadderConfig();
+  helpers.writeSubscriptionPool("anthropic", [credential("stale", { expires: 1 })]);
+  helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  const streamedModels: any[] = [];
+  rotationModule.__setRefreshForProviderForTest(async (providerId) => {
+    if (providerId === "anthropic") {
+      throw Object.assign(new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}'), { status: 400 });
+    }
+    throw new Error("unexpected refresh");
+  });
+  rotationModule.__setStreamForProviderForTest((model) => {
+    streamedModels.push(model);
+    return (async function* () {
+      yield { type: "text_delta", text: "hello from codex" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.deepEqual(setModelCalls.map((m) => m.provider), ["openai-codex"]);
+    assert.equal(streamedModels.length, 1);
+    assert.equal(streamedModels[0].provider, "openai-codex");
+    assert.ok(emitted.some((e) => e.type === "text_delta"));
+    assert.ok(!emitted.some((e) => e.type === "error"));
+    assert.ok(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil > Date.now() + 29 * 24 * 60 * 60 * 1000);
+  } finally {
+    rotationModule.__setRefreshForProviderForTest(undefined);
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+test("automatically reauthenticates invalid refresh tokens when UI is available", async () => {
+  resetRotationState();
+  writeLadderConfig();
+  helpers.writeSubscriptionPool("anthropic", [credential("stale", { expires: 1 })]);
+  helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.hasUI = true;
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  ctx.ui.notify = () => {};
+  const loginCalls: string[] = [];
+  const streamedOptions: any[] = [];
+  rotationModule.__setRefreshForProviderForTest(async (providerId) => {
+    if (providerId === "anthropic") {
+      throw Object.assign(new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}'), { status: 400 });
+    }
+    throw new Error("unexpected refresh");
+  });
+  rotationModule.__setLoginForProviderForTest(async (providerId) => {
+    loginCalls.push(providerId);
+    return { refresh: "refresh-fresh", access: "access-fresh", expires: Date.now() + 60_000 };
+  });
+  rotationModule.__setStreamForProviderForTest((_model, _context, options) => {
+    streamedOptions.push(options);
+    return (async function* () {
+      yield { type: "text_delta", text: "hello after reauth" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.deepEqual(loginCalls, ["anthropic"]);
+    assert.deepEqual(setModelCalls, []);
+    assert.equal(streamedOptions[0].apiKey, "access-fresh");
+    assert.ok(emitted.some((e) => e.type === "text_delta"));
+    const [stored] = helpers.readSubscriptionPool("anthropic");
+    assert.equal(stored.label, "stale");
+    assert.equal(stored.refresh, "refresh-fresh");
+    assert.equal(stored.access, "access-fresh");
+    assert.equal(stored.rateLimitedUntil, 0);
+  } finally {
+    rotationModule.__setRefreshForProviderForTest(undefined);
+    rotationModule.__setLoginForProviderForTest(undefined);
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+test("emits a single terminal error only when BOTH provider pools are exhausted", async () => {
+  resetRotationState();
+  writeLadderConfig();
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+
+  await providerRotationExtension(pi);
+  await events.session_start?.({}, ctx);
+  const stream = providers["openai-codex"].streamSimple(ctx.model, ctx);
+  const emitted = [] as any[];
+  for await (const event of stream) emitted.push(event);
+
+  // It still switches the session model toward the fallback before giving up.
+  assert.deepEqual(setModelCalls.map((m) => m.provider), ["anthropic"]);
+  // No ping-pong: a single terminal error naming both exhausted providers.
+  assert.equal(emitted.length, 1);
+  assert.equal(emitted[0].type, "error");
+  assert.equal(emitted[0].error.errorMessage, "All managed provider pools exhausted (tried openai-codex, anthropic)");
+});