@crouton-kit/crouter 0.3.70 → 0.3.79

package/dist/builtin-pi-packages/pi-crtr-extensions/lib/subscription-state.ts

@@ -1,516 +1,2 @@
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-import type { ThinkingLevel } from "@earendil-works/pi-ai";
-import { FileAuthStorageBackend } from "@earendil-works/pi-coding-agent";
-import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-
-export const ANTHROPIC_PROVIDER_ID = "anthropic";
-export const OPENAI_CODEX_PROVIDER_ID = "openai-codex";
-
-export type ManagedProviderId = typeof ANTHROPIC_PROVIDER_ID | typeof OPENAI_CODEX_PROVIDER_ID;
-export type LadderProviderId = "anthropic" | "openai";
-export type ModelStrength = "ultra" | "strong" | "medium" | "light";
-
-// The default label's slot (`label === providerId`) is the OAuth-login-linked credential --
-// its live value (`refresh`/`access`/`expires`) is owned exclusively by pi's auth.json (see
-// provider-rotation.ts's `refreshDefaultSlotCredential`/`reauthenticateCredential`), so those
-// fields are absent on that entry. Any OTHER explicitly-added account (`/provider-sub add`,
-// label !== providerId) keeps the full value here, unchanged.
-export type SubscriptionCredential = {
-  label: string;
-  refresh?: string;
-  access?: string;
-  expires?: number;
-  rateLimitedUntil: number;
-  lastAttemptAt: number;
-  lastRateLimitedAt: number;
-};
-
-export type ModelRef = {
-  providerId: ManagedProviderId;
-  modelId: string;
-};
-
-export type RotationConfig = {
-  defaultFallbackStrength?: ModelStrength;
-  revertWhenAvailable?: boolean;
-  preferredModel?: ModelRef;
-};
-
-type RotationConfigUpdate = {
-  defaultFallbackStrength?: ModelStrength;
-  revertWhenAvailable?: boolean;
-  preferredModel?: ModelRef | null;
-};
-
-export type FallbackTarget = {
-  providerId: ManagedProviderId;
-  modelId: string;
-  label: string;
-  strength: ModelStrength;
-  thinkingLevel?: ThinkingLevel;
-};
-
-type ModelLadderConfig = Partial<Record<ModelStrength, string>>;
-type ModelLaddersConfig = Partial<Record<LadderProviderId, ModelLadderConfig>>;
-const AGENT_DIR = join(homedir(), ".pi", "agent");
-const ROTATION_CONFIG_FILE = join(AGENT_DIR, "provider-rotation.json");
-const CROUTER_CONFIG_FILE = join(homedir(), ".crouter", "config.json");
-const DEFAULT_FALLBACK_STRENGTH: ModelStrength = "strong";
-
-const PROVIDERS: Record<
-  ManagedProviderId,
-  {
-    label: string;
-    ladderProviderId: LadderProviderId;
-    poolFile: string;
-  }
-> = {
-  [ANTHROPIC_PROVIDER_ID]: {
-    label: "Claude",
-    ladderProviderId: "anthropic",
-    poolFile: join(AGENT_DIR, "anthropic-subscriptions.json"),
-  },
-  [OPENAI_CODEX_PROVIDER_ID]: {
-    label: "OpenAI Codex",
-    ladderProviderId: "openai",
-    poolFile: join(AGENT_DIR, "openai-codex-subscriptions.json"),
-  },
-};
-
-function readJsonFile<T>(path: string): T | undefined {
-  if (!existsSync(path)) return undefined;
-  try {
-    const raw = readFileSync(path, "utf8").trim();
-    if (!raw) return undefined;
-    return JSON.parse(raw) as T;
-  } catch {
-    return undefined;
-  }
-}
-
-function writeJsonFile(path: string, value: unknown): void {
-  mkdirSync(dirname(path), { recursive: true });
-  const tmp = `${path}.${process.pid}.tmp`;
-  writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, "utf8");
-  renameSync(tmp, path);
-}
-
-function normalizeStrength(value: unknown): ModelStrength | undefined {
-  return value === "ultra" || value === "strong" || value === "medium" || value === "light" ? value : undefined;
-}
-
-function normalizeTiming(value: unknown): number {
-  const numeric = Number(value);
-  return Number.isFinite(numeric) ? numeric : 0;
-}
-
-function normalizeCredential(value: Partial<SubscriptionCredential> & { label?: string }): SubscriptionCredential | undefined {
-  const label = typeof value.label === "string" ? value.label.trim() : "";
-  if (!label) return undefined;
-  const refresh = typeof value.refresh === "string" ? value.refresh.trim() : "";
-  const access = typeof value.access === "string" ? value.access.trim() : "";
-  const expires = Number(value.expires);
-  const rateLimitedUntil = Number(value.rateLimitedUntil);
-  return {
-    label,
-    ...(refresh && access ? { refresh, access, expires: Number.isFinite(expires) ? expires : 0 } : {}),
-    rateLimitedUntil: Number.isFinite(rateLimitedUntil) ? rateLimitedUntil : 0,
-    lastAttemptAt: normalizeTiming(value.lastAttemptAt),
-    lastRateLimitedAt: normalizeTiming(value.lastRateLimitedAt),
-  };
-}
-
-function normalizeCredentials(values: unknown): SubscriptionCredential[] {
-  if (!Array.isArray(values)) return [];
-  return values.map((entry) => normalizeCredential(entry as Partial<SubscriptionCredential> & { label?: string })).filter((entry): entry is SubscriptionCredential => Boolean(entry));
-}
-
-function getCurrentModelRef(model?: { provider: string; id: string }): ModelRef | undefined {
-  return isManagedProvider(model?.provider) ? { providerId: model.provider, modelId: model.id } : undefined;
-}
-
-type AuthFileData = Record<string, { type?: string }>;
-
-function readAuthCredential(providerId: ManagedProviderId): { type?: string } | undefined {
-  return new FileAuthStorageBackend().withLock((current) => {
-    if (!current) return { result: undefined };
-    const data = JSON.parse(current) as AuthFileData;
-    return { result: data[providerId] };
-  });
-}
-
-// Seeds a METADATA-ONLY pool entry for the default label (`label === providerId`)
-// whenever an OAuth-login-linked credential exists for it in auth.json, regardless of
-// whether the pool already holds OTHER explicit accounts. The auth.json seed read goes
-// through FileAuthStorageBackend's real lock so a held auth.json lock or parse failure is
-// surfaced instead of silently pretending the default credential is absent. Gated
-// specifically on an OAUTH auth.json record (`type === "oauth"`) rather than the presence
-// of any credential, because an api_key credential has no refresh token -- a
-// metadata-only "default" slot seeded for one would be a slot `refreshDefaultSlotCredential`
-// can never actually refresh. No token is ever copied into the pool: the value lives
-// exclusively in auth.json.
-function ensureDefaultSubscriptionMetadata(providerId: ManagedProviderId, pool: SubscriptionCredential[]): SubscriptionCredential[] {
-  if (pool.some((entry) => entry.label === providerId)) return pool;
-  const authCred = readAuthCredential(providerId);
-  if (authCred?.type !== "oauth") return pool;
-  const seeded = normalizeCredential({ label: providerId, rateLimitedUntil: 0, lastAttemptAt: 0, lastRateLimitedAt: 0 });
-  return seeded ? [...pool, seeded] : pool;
-}
-
-// The default label's value lives exclusively in auth.json, so its pool entry must never
-// carry `refresh`/`access`/`expires`; this strips those fields on every read and write,
-// self-healing any pool file that has them physically present on disk. `changed` tells
-// the caller whether anything was actually stripped, so `readSubscriptionPool` can
-// persist the metadata-only result immediately rather than leaving a stale copy on disk
-// until some unrelated write.
-function scrubDefaultValue(providerId: ManagedProviderId, pool: SubscriptionCredential[]): { pool: SubscriptionCredential[]; changed: boolean } {
-  let changed = false;
-  const next = pool.map((entry) => {
-    if (entry.label !== providerId || (entry.refresh === undefined && entry.access === undefined && entry.expires === undefined)) return entry;
-    changed = true;
-    const { refresh: _refresh, access: _access, expires: _expires, ...meta } = entry;
-    return meta;
-  });
-  return { pool: next, changed };
-}
-
-export function isManagedProvider(providerId: string | undefined): providerId is ManagedProviderId {
-  return providerId === ANTHROPIC_PROVIDER_ID || providerId === OPENAI_CODEX_PROVIDER_ID;
-}
-
-export function getProviderLabel(providerId: ManagedProviderId): string {
-  return PROVIDERS[providerId].label;
-}
-
-export function readSubscriptionPool(providerId: ManagedProviderId): SubscriptionCredential[] {
-  const poolFile = PROVIDERS[providerId].poolFile;
-  const raw = normalizeCredentials(readJsonFile<unknown>(poolFile));
-  const { pool: scrubbed, changed: wasScrubbed } = scrubDefaultValue(providerId, raw);
-  const withDefaultSlot = ensureDefaultSubscriptionMetadata(providerId, scrubbed);
-  if (wasScrubbed || withDefaultSlot !== scrubbed) return writeSubscriptionPool(providerId, withDefaultSlot);
-  return withDefaultSlot;
-}
-
-export function writeSubscriptionPool(providerId: ManagedProviderId, next: SubscriptionCredential[]): SubscriptionCredential[] {
-  const normalized = scrubDefaultValue(providerId, normalizeCredentials(next)).pool;
-  writeJsonFile(PROVIDERS[providerId].poolFile, normalized);
-  return normalized;
-}
-
-function resolveCredentialIndex(pool: SubscriptionCredential[], ref: string): number {
-  const needle = ref.trim().toLowerCase();
-  const numeric = Number.parseInt(needle, 10);
-  if (Number.isFinite(numeric) && String(numeric) === needle && numeric >= 1 && numeric <= pool.length) {
-    return numeric - 1;
-  }
-  return pool.findIndex((entry) => entry.label.toLowerCase() === needle);
-}
-
-export function upsertSubscription(providerId: ManagedProviderId, next: SubscriptionCredential): SubscriptionCredential[] {
-  const pool = readSubscriptionPool(providerId);
-  const index = pool.findIndex((entry) => entry.label.toLowerCase() === next.label.toLowerCase());
-  if (index === -1) pool.push(next);
-  else pool[index] = next;
-  return writeSubscriptionPool(providerId, pool);
-}
-
-export function removeSubscription(providerId: ManagedProviderId, ref: string): SubscriptionCredential[] {
-  const pool = readSubscriptionPool(providerId);
-  const index = resolveCredentialIndex(pool, ref);
-  if (index === -1) throw new Error(`Unknown ${getProviderLabel(providerId)} subscription: ${ref}`);
-  pool.splice(index, 1);
-  return writeSubscriptionPool(providerId, pool);
-}
-
-export function promoteSubscription(providerId: ManagedProviderId, ref: string): SubscriptionCredential[] {
-  const pool = readSubscriptionPool(providerId);
-  const index = resolveCredentialIndex(pool, ref);
-  if (index === -1) throw new Error(`Unknown ${getProviderLabel(providerId)} subscription: ${ref}`);
-  if (index > 0) pool.unshift(pool.splice(index, 1)[0]);
-  return writeSubscriptionPool(providerId, pool);
-}
-
-export function markSubscriptionAttempt(providerId: ManagedProviderId, ref: string, attemptAt = Date.now()): SubscriptionCredential[] {
-  const pool = readSubscriptionPool(providerId);
-  const index = resolveCredentialIndex(pool, ref);
-  if (index === -1) throw new Error(`Unknown ${getProviderLabel(providerId)} subscription: ${ref}`);
-  pool[index] = {
-    ...pool[index],
-    lastAttemptAt: Math.max(pool[index].lastAttemptAt, attemptAt),
-  };
-  return writeSubscriptionPool(providerId, pool);
-}
-
-export function markSubscriptionRateLimited(
-  providerId: ManagedProviderId,
-  ref: string,
-  retryAfterMs: number,
-  attemptAt = Date.now(),
-  rateLimitedAt = Date.now(),
-): SubscriptionCredential[] {
-  const pool = readSubscriptionPool(providerId);
-  const index = resolveCredentialIndex(pool, ref);
-  if (index === -1) throw new Error(`Unknown ${getProviderLabel(providerId)} subscription: ${ref}`);
-  if (rateLimitedAt < pool[index].lastRateLimitedAt) return pool;
-  pool[index] = {
-    ...pool[index],
-    lastAttemptAt: Math.max(pool[index].lastAttemptAt, attemptAt),
-    lastRateLimitedAt: Math.max(pool[index].lastRateLimitedAt, rateLimitedAt),
-    rateLimitedUntil: rateLimitedAt + Math.max(0, retryAfterMs),
-  };
-  return writeSubscriptionPool(providerId, pool);
-}
-
-export function markSubscriptionSuccess(providerId: ManagedProviderId, ref: string, attemptAt = Date.now()): SubscriptionCredential[] {
-  const pool = readSubscriptionPool(providerId);
-  const index = resolveCredentialIndex(pool, ref);
-  if (index === -1) throw new Error(`Unknown ${getProviderLabel(providerId)} subscription: ${ref}`);
-  if (attemptAt < pool[index].lastRateLimitedAt) return pool;
-  pool[index] = {
-    ...pool[index],
-    lastAttemptAt: Math.max(pool[index].lastAttemptAt, attemptAt),
-    rateLimitedUntil: 0,
-  };
-  return writeSubscriptionPool(providerId, pool);
-}
-
-export function findAvailableSubscription(providerId: ManagedProviderId, now = Date.now()): SubscriptionCredential | undefined {
-  return readSubscriptionPool(providerId).find((entry) => !entry.rateLimitedUntil || entry.rateLimitedUntil <= now);
-}
-
-export function parseRetryAfterHeader(value: string | undefined, now = Date.now()): number | undefined {
-  if (!value) return undefined;
-  const trimmed = value.trim();
-  if (!trimmed) return undefined;
-  const seconds = Number(trimmed);
-  if (Number.isFinite(seconds)) return Math.max(0, Math.round(seconds * 1000));
-  const parsed = Date.parse(trimmed);
-  return Number.isFinite(parsed) ? Math.max(0, parsed - now) : undefined;
-}
-
-function thinkingLevelOfRef(ref: string): ThinkingLevel | undefined {
-  const match = ref.trim().match(/:(thinking|off|minimal|low|medium|high|xhigh|max)$/i);
-  if (!match) return undefined;
-  const level = match[1].toLowerCase();
-  return level === "off" || level === "thinking" ? undefined : (level as ThinkingLevel);
-}
-
-function normalizeModelRef(ref: string): string {
-  return ref
-    .trim()
-    .replace(/^[^/]+\//, "")
-    .replace(/:(?:thinking|off|minimal|low|medium|high|xhigh|max)$/i, "")
-    .toLowerCase();
-}
-
-function splitModelRef(ref: string): FallbackTarget {
-  const trimmed = ref.trim();
-  const slash = trimmed.indexOf("/");
-  const providerId = slash === -1 ? OPENAI_CODEX_PROVIDER_ID : trimmed.slice(0, slash).trim();
-  if (!isManagedProvider(providerId)) {
-    throw new Error(`Unsupported fallback provider: ${providerId}`);
-  }
-  const rawModelId = slash === -1 ? trimmed : trimmed.slice(slash + 1).trim();
-  const thinkingMatch = rawModelId.match(/^(.*?)(?::(thinking|off|minimal|low|medium|high|xhigh|max))$/i);
-  return {
-    providerId,
-    modelId: thinkingMatch ? thinkingMatch[1] : rawModelId,
-    label: `${providerId}/${thinkingMatch ? thinkingMatch[1] : rawModelId}${thinkingMatch?.[2] ? `:${thinkingMatch[2].toLowerCase()}` : ""}`,
-    strength: DEFAULT_FALLBACK_STRENGTH,
-    thinkingLevel: thinkingMatch?.[2] && thinkingMatch[2].toLowerCase() !== "off" && thinkingMatch[2].toLowerCase() !== "thinking"
-      ? (thinkingMatch[2].toLowerCase() as ThinkingLevel)
-      : undefined,
-  };
-}
-
-// Vendored copy of crouter's `defaultModelLaddersConfig()` (src/types.ts).
-// This package is synced from a standalone repo (pi-personal-extensions) and
-// has no runtime import path into crouter's compiled internals, so the
-// builtin rungs are duplicated here rather than imported; keep the two in
-// sync by hand if either changes.
-const BUILTIN_MODEL_LADDERS: Record<LadderProviderId, ModelLadderConfig> = {
-  anthropic: {
-    ultra: "anthropic/claude-fable-5:high",
-    strong: "anthropic/claude-fable-5:medium",
-    medium: "anthropic/claude-opus-4-8:high",
-    light: "anthropic/claude-sonnet-5:high",
-  },
-  openai: {
-    ultra: "openai-codex/gpt-5.6-sol:max",
-    strong: "openai-codex/gpt-5.6-sol:high",
-    medium: "openai-codex/gpt-5.6-terra:medium",
-    light: "openai-codex/gpt-5.6-luna:low",
-  },
-};
-
-// Layers ~/.crouter/config.json's `modelLadders` (if any) OVER the builtin
-// defaults above, per provider/strength — mirroring crouter's own
-// `mergeModelLadders` (src/core/config.ts), which is what a node's launcher
-// actually resolves models from. Without this fallback, a config-less user
-// (the common case: fresh install, no ~/.crouter/config.json) saw an EMPTY
-// ladder here while crtr itself launched them on the builtin defaults —
-// rotation could then never resolve a strength tier or a cross-provider
-// fallback for a model it was already running. Always returns a fully
-// populated ladder for both providers; a config.json override only replaces
-// the specific strengths it sets.
-function readModelLadders(): ModelLaddersConfig {
-  const config = readJsonFile<{ modelLadders?: Partial<Record<LadderProviderId, Partial<ModelLadderConfig>>> }>(CROUTER_CONFIG_FILE);
-  const overrides = config?.modelLadders;
-  const result: ModelLaddersConfig = {};
-  for (const provider of ["anthropic", "openai"] as const) {
-    const normalized: ModelLadderConfig = { ...BUILTIN_MODEL_LADDERS[provider] };
-    const override = overrides?.[provider];
-    if (override) {
-      for (const strength of ["ultra", "strong", "medium", "light"] as const) {
-        const value = typeof override[strength] === "string" ? override[strength]?.trim() : "";
-        if (value) normalized[strength] = value;
-      }
-    }
-    result[provider] = normalized;
-  }
-  return result;
-}
-
-function findStrengthForModelId(
-  providerId: ManagedProviderId,
-  modelId: string | undefined,
-  defaultStrength: ModelStrength,
-  ladders = readModelLadders(),
-  currentThinkingLevel?: string,
-): ModelStrength | undefined {
-  const source = ladders?.[PROVIDERS[providerId].ladderProviderId];
-  const bareId = modelId ? normalizeModelRef(modelId) : undefined;
-  if (!source || !bareId) return undefined;
-  const matches: ModelStrength[] = [];
-  for (const strength of ["ultra", "strong", "medium", "light"] as const) {
-    const ref = source[strength];
-    if (ref && normalizeModelRef(ref) === bareId) matches.push(strength);
-  }
-  if (matches.length === 0) return undefined;
-  // Rungs that share a bare model id (e.g. gpt-5.6-sol:max vs gpt-5.6-sol:high) are
-  // disambiguated by the live reasoning level so an ultra run doesn't collapse to strong.
-  if (matches.length > 1 && currentThinkingLevel) {
-    const exact = matches.find((strength) => thinkingLevelOfRef(source[strength]!) === currentThinkingLevel);
-    if (exact) return exact;
-  }
-  return matches.includes(defaultStrength) ? defaultStrength : matches[0];
-}
-
-export function readRotationConfig(): RotationConfig {
-  const raw = readJsonFile<RotationConfig>(ROTATION_CONFIG_FILE) ?? {};
-  const preferredModel =
-    raw.preferredModel && isManagedProvider(raw.preferredModel.providerId) && typeof raw.preferredModel.modelId === "string"
-      ? { providerId: raw.preferredModel.providerId, modelId: raw.preferredModel.modelId.trim() }
-      : undefined;
-  return {
-    defaultFallbackStrength: normalizeStrength(raw.defaultFallbackStrength) ?? DEFAULT_FALLBACK_STRENGTH,
-    revertWhenAvailable: raw.revertWhenAvailable ?? true,
-    preferredModel,
-  };
-}
-
-export function writeRotationConfig(next: RotationConfigUpdate): RotationConfig {
-  const current = readRotationConfig();
-  const merged: RotationConfig = {
-    defaultFallbackStrength: normalizeStrength(next.defaultFallbackStrength) ?? current.defaultFallbackStrength ?? DEFAULT_FALLBACK_STRENGTH,
-    revertWhenAvailable: next.revertWhenAvailable ?? current.revertWhenAvailable ?? true,
-    preferredModel: Object.prototype.hasOwnProperty.call(next, "preferredModel")
-      ? next.preferredModel || undefined
-      : current.preferredModel,
-  };
-  writeJsonFile(ROTATION_CONFIG_FILE, merged);
-  return merged;
-}
-
-export function clearPreferredModel(): RotationConfig {
-  return writeRotationConfig({ preferredModel: null });
-}
-
-export function rememberPreferredModel(model: ModelRef): RotationConfig {
-  return writeRotationConfig({ preferredModel: model });
-}
-
-// `readModelLadders()` always fills both providers from the builtin defaults, so this
-// only returns undefined (never throws) in the defensive case where a rung is still
-// genuinely missing; callers must treat that as a graceful "no fallback available" case
-// rather than a config error to surface mid-turn.
-export function resolveFallbackTarget(
-  currentProviderId: ManagedProviderId,
-  currentModelId?: string,
-  config = readRotationConfig(),
-  currentThinkingLevel?: string,
-): FallbackTarget | undefined {
-  const ladders = readModelLadders();
-  const defaultStrength = config.defaultFallbackStrength ?? DEFAULT_FALLBACK_STRENGTH;
-  const sourceStrength = findStrengthForModelId(currentProviderId, currentModelId, defaultStrength, ladders, currentThinkingLevel);
-  const strength = sourceStrength ?? defaultStrength;
-  const targetProvider = currentProviderId === ANTHROPIC_PROVIDER_ID ? OPENAI_CODEX_PROVIDER_ID : ANTHROPIC_PROVIDER_ID;
-  const targetLadder = ladders?.[PROVIDERS[targetProvider].ladderProviderId];
-  const candidates = strength === defaultStrength ? [strength] : [strength, defaultStrength];
-  const fallbackRef = candidates.map((candidate) => targetLadder?.[candidate]).find((ref): ref is string => typeof ref === "string" && ref.trim().length > 0);
-  if (!fallbackRef) {
-    return undefined;
-  }
-  const parsed = splitModelRef(fallbackRef);
-  const resolvedStrength = candidates.find((candidate) => targetLadder?.[candidate] === fallbackRef) ?? strength;
-  return { ...parsed, strength: resolvedStrength };
-}
-
-export function shouldRestorePreferredModel(config = readRotationConfig(), now = Date.now()): boolean {
-  if (!config.revertWhenAvailable || !config.preferredModel) return false;
-  return Boolean(findAvailableSubscription(config.preferredModel.providerId, now));
-}
-
-export async function restorePreferredModelIfPossible(
-  piApi: ExtensionAPI,
-  ctx: Pick<ExtensionContext, "model" | "modelRegistry">,
-): Promise<boolean> {
-  const config = readRotationConfig();
-  if (!shouldRestorePreferredModel(config, Date.now())) return false;
-  const preferred = config.preferredModel;
-  if (!preferred) return false;
-  const current = getCurrentModelRef(ctx.model);
-  if (current?.providerId === preferred.providerId && current.modelId === preferred.modelId) {
-    clearPreferredModel();
-    return true;
-  }
-  const model = ctx.modelRegistry.find(preferred.providerId, preferred.modelId);
-  if (!model) return false;
-  const switched = await piApi.setModel(model);
-  if (switched) clearPreferredModel();
-  return switched;
-}
-
-export async function switchToFallbackIfPossible(
-  piApi: ExtensionAPI,
-  ctx: Pick<ExtensionContext, "model" | "modelRegistry">,
-  preferredModel = getCurrentModelRef(ctx.model),
-): Promise<FallbackTarget | undefined> {
-  if (!preferredModel) return undefined;
-  rememberPreferredModel(preferredModel);
-  const currentThinkingLevel = piApi.getThinkingLevel?.();
-  const target = resolveFallbackTarget(preferredModel.providerId, preferredModel.modelId, readRotationConfig(), currentThinkingLevel);
-  if (!target) return undefined;
-  const current = getCurrentModelRef(ctx.model);
-  const model = ctx.modelRegistry.find(target.providerId, target.modelId);
-  if (!model) return undefined;
-  if (current?.providerId !== target.providerId || current.modelId !== target.modelId) {
-    const switched = await piApi.setModel(model);
-    if (!switched) return undefined;
-  }
-  if (target.thinkingLevel) piApi.setThinkingLevel(target.thinkingLevel);
-  return target;
-}
-
-export function formatStatusLine(providerId: ManagedProviderId, now = Date.now()): string {
-  const pool = readSubscriptionPool(providerId);
-  const ready = pool.filter((entry) => !entry.rateLimitedUntil || entry.rateLimitedUntil <= now);
-  const label = getProviderLabel(providerId);
-  if (ready.length === 0) {
-    const fallback = resolveFallbackTarget(providerId, undefined, readRotationConfig());
-    return fallback ? `${label} pool exhausted -> ${fallback.label}` : `${label} pool exhausted (no fallback configured)`;
-  }
-  return `${label} ${ready[0]?.label ?? providerId} (${ready.length}/${pool.length} ready)`;
-}
+// Provider pool state belongs to crouter core so every human surface and the rotation runtime share one invariant-preserving implementation.
+export * from "../../../core/subscription-state.js";

package/dist/builtin-pi-packages/pi-crtr-extensions/package-lock.json

@@ -1,11 +1,11 @@
 {
-  "name": "pi-personal-extensions",
+  "name": "pi-crtr-extensions",
   "version": "0.1.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "pi-personal-extensions",
+      "name": "pi-crtr-extensions",
       "version": "0.1.0",
       "license": "MIT",
       "dependencies": {

package/dist/builtin-pi-packages/pi-mode-switch/README.md

@@ -1,8 +1,6 @@
 # pi-mode-switch
 
-Press **Alt+M** to cycle between operating modes — the way Claude's Shift+Tab
-cycles plan / accept-edits. Whenever the mode changes, the new mode's operating
-instructions are injected (invisibly) before your next message.
+Cycle between operating modes with crouter's configurable **Cycle mode** binding (default **Alt+M**) — the way Claude's Shift+Tab cycles plan / accept-edits. Whenever the mode changes, the new mode's operating instructions are injected invisibly before your next message.
 
 ## Modes
 
@@ -14,51 +12,25 @@ instructions are injected (invisibly) before your next message.
 
 ## Usage
 
-- `Alt+M` — cycle `normal → spec → plan → normal`
-- `/mode` — same as Alt+M
+- the configured `crtr.mode.cycle` binding (default `Alt+M`) — cycle `normal → spec → plan → normal`
+- `/mode` — cycle without using the shortcut
 - `/mode <normal\|spec\|plan>` — jump to a specific mode
-- the agent can switch its own mode by running the bundled `bin/mode` CLI through
-  its bash tool — e.g. `bash <plugin>/bin/mode normal` after a spec/plan is
-  approved. The command prints that mode's guidance, so the text only enters
-  context at the moment of the switch (no always-on tool)
+- the agent can switch its own mode by running the bundled `bin/mode` CLI through its bash tool — e.g. `bash <plugin>/bin/mode normal` after a spec/plan is approved. The command prints that mode's guidance, so the text only enters context at the moment of the switch (no always-on tool)
 
-The current mode renders as a badge on the **bottom-right of the input box**,
-diagonally opposite the session-name badge (top-left). Mode persists across
-`--resume`.
+The current mode renders as a badge on the **bottom-right of the input box**, diagonally opposite the session-name badge (top-left). Mode persists across `--resume`.
 
 ## How it works
 
-The extension tracks the active mode and the mode whose guidance was last
-injected. On `before_agent_start` it compares the two: if they differ, it
-prepends that mode's guidance to the turn (as a hidden `mode-switch-context`
-message) and records the injection. Stay in the same mode and nothing extra is
-added. Returning to `normal` also strips stale guidance from context.
+The extension tracks the active mode and the mode whose guidance was last injected. On `before_agent_start` it compares the two: if they differ, it prepends that mode's guidance to the turn as a hidden `mode-switch-context` message and records the injection. Stay in the same mode and nothing extra is added. Returning to `normal` also strips stale guidance from context.
 
-The agent can also switch its own mode without a permanent tool. The bundled
-`bin/mode` CLI, run through the normal bash tool, writes the requested mode to
-`<artifact-root>/mode-switch/request.json` and prints that mode's operating
-instructions to stdout. The extension mirrors each mode's guidance to
-`mode-switch/guidance/<mode>.txt` at session start (single source of truth stays
-in the extension), watches the request file to keep the badge and session state in
-sync, and consumes each request on read so a later Alt+M isn't clobbered. The
-guidance reaches the agent through the command's own output, so it only enters
-context at the moment of the switch — no tool sits in the context window, and
-there's no coupling to any external runtime, just files.
+The agent can also switch its own mode without a permanent tool. The bundled `bin/mode` CLI, run through the normal bash tool, writes the requested mode to `<artifact-root>/mode-switch/request.json` and prints that mode's operating instructions to stdout. The extension mirrors each mode's guidance to `mode-switch/guidance/<mode>.txt` at session start, watches the request file to keep the badge and session state in sync, and applies each tokenized request once. The guidance reaches the agent through the command's own output, so it only enters context at the moment of the switch — no tool sits in the context window, and there's no coupling to an external runtime beyond the shared files.
 
-This is guidance-only — it does not hard-restrict tools. The instructions tell
-the agent not to edit in spec/plan mode; combine with a tool gate if you want
-enforcement.
+This is guidance-only — it does not hard-restrict tools. The instructions tell the agent not to edit in spec/plan mode; combine with a tool gate if you want enforcement.
 
-The input badge is drawn by wrapping whatever editor is already installed (e.g. a
-session-name badge extension) in a transparent Proxy that overrides only
-`render()`. It composes instead of replacing, so other editor decorations keep
-working.
+The input badge is drawn by wrapping whatever editor is already installed (for example, a session-name badge extension) in a transparent Proxy that overrides only `render()`. It composes instead of replacing, so other editor decorations keep working.
 
 ## Install
 
-```bash
-pi install /Users/silasrhyneer/Code/cli/pi-mode-switch          # user scope
-pi install -l /Users/silasrhyneer/Code/cli/pi-mode-switch       # project scope
-```
+This package ships inside crouter. `crtr sys setup` registers its built package path with pi; there is no separate repository or package to install.
 
-Run `/reload` in pi after install, then press Alt+M.
+Run `/reload` in pi after setup. The extension resolves `crtr.mode.cycle` from the sparse `keybindings` object in `~/.crouter/config.json`; missing overrides use Alt+M, multiple gestures all register, and an empty list disables the shortcut. `/mode` remains available when the shortcut is disabled. Pi's stock actions and `~/.pi/agent/keybindings.json` remain untouched.