@danypops/jittor 0.9.0 → 0.11.0

package/README.md

@@ -39,7 +39,7 @@ Provider adapters currently include official OpenRouter key/usage/model telemetr
 
 The third-party `anthropic-vertex` provider (Anthropic Claude models served through Google Vertex, e.g. via `@twogiants/pi-anthropic-vertex`) is tracked separately from both of the above: it reuses Pi's own Anthropic Messages stream implementation with Anthropic's official `@anthropic-ai/vertex-sdk` client, so its wire shape is Anthropic's, but its quota accounting is Google's. Jittor applies Google Vertex's failure classification to it (real-world reports confirm its 429s still carry GCP's own quota-exceeded shape even through Anthropic's own SDK) and, best-effort, also checks for genuine Anthropic rate-limit response headers on it, since it is unverified whether this specific passthrough ever forwards them. Either way, every metric is tagged `anthropic-vertex`, never blended into direct Anthropic's `anthropic` source or Pi's unrelated native `google-vertex` provider, since each represents a different account/quota pool. Its footer budget (labeled `vtok`/`vreq` when headers are observed) stays `null` (may still resolve) rather than `undefined` (provably impossible) until it's confirmed one way or the other.
 
-The native Pi extension preflights input and every provider turn, applies model/thinking decisions, records response headers and finalized usage through the daemon, and blocks requests when required telemetry is unsafe. It follows Pi's current authenticated model/provider and synchronizes Pi's available models before every decision, so unavailable catalog routes are never selected. Its responsive integrated footer groups repository and model identity with cumulative usage, a color-coded context-window bar, and current-provider budget telemetry. Codex shows the active model's bounded quota as a draining remaining-budget bar with reset and freshness information. OpenRouter uses the same drain semantics when its official key telemetry exposes a configured limit and remaining balance; keys without a limit remain honest text-only spend and never receive a fabricated denominator. Anthropic shows the same drain semantics from its most-restrictive-in-effect token bucket, falling back to the request bucket when no token telemetry has been observed yet. During Pi compaction, the context bar drains against a learned median duration estimated from the last few completed compactions (bounded to the most recent 20 samples, requiring at least 3 before trusting it), in exact sync with a countdown ("compact ~Ns left") — never a count-up, never a fabricated total. Until enough evidence exists, the bar does not drain at all (there is no real rate to drain against) and no timer text is shown; the bar itself simply blinks in place at its starting fill once per render tick so compaction never looks stalled without claiming knowledge it doesn't have. Run `jittor compaction estimate [--json]` to inspect the current estimate and its confidence directly. Unknown and stale telemetry are marked explicitly. Run `/jittor` for the consolidated Settings TUI (its default action), or `/jittor status` for detailed burn pressure, freshness, route state, and confirmed emergency-halt/override controls.
+The native Pi extension preflights input and every provider turn, applies model/thinking decisions, records response headers and finalized usage through the daemon, and blocks requests when required telemetry is unsafe. It follows Pi's current authenticated model/provider and synchronizes Pi's available models before every decision, so unavailable catalog routes are never selected. Mutable route state is scoped by Pi session, so concurrent sessions cannot replace each other's active provider or footer budget selection. Each session registers an opaque secret with the daemon at `session_start` (best-effort; a registration failure leaves that session unarmored rather than blocked) and presents it on every router-mutating call for the rest of its lifetime; an unregistered `session_id` continues to mutate exactly as before, so this is additive armor, not a breaking change for other callers of the same API. A configured required budget source still fails closed; a provider with no enforceable budget window continues explicitly monitor-only. Its responsive integrated footer groups repository and model identity with cumulative usage, a color-coded context-window bar, and current-provider budget telemetry. Codex shows the active model's bounded quota as a draining remaining-budget bar with reset and freshness information. OpenRouter uses the same drain semantics when its official key telemetry exposes a configured limit and remaining balance; keys without a limit remain honest text-only spend and never receive a fabricated denominator. Anthropic shows the same drain semantics from its most-restrictive-in-effect token bucket, falling back to the request bucket when no token telemetry has been observed yet. During Pi compaction, the context bar drains from its captured fill against a learned median duration estimated from the last few completed compactions (bounded to the most recent 20 samples, requiring at least 3 before trusting it). It never renders a timer. Until enough evidence exists, the bar does not drain; it blinks in place at its captured fill. Run `jittor compaction estimate [--json]` to inspect the current estimate and its confidence directly. Unknown and stale telemetry are marked explicitly. Run `/jittor` for the consolidated Settings TUI (its default action), or `/jittor status` for detailed burn pressure, freshness, route state, and confirmed emergency-halt/override controls.
 
 Jittor currently registers no model-callable native tools, so Pi's native model `content` versus renderer `details` contract is explicitly not applicable. Daemon JSON, CLI `--json`, human CLI output, command notifications, panels, and the footer remain separate bounded channels. See [`docs/OUTPUT_CHANNELS.md`](docs/OUTPUT_CHANNELS.md) for the conformance matrix and the requirements that apply if a native tool is introduced later.
 
@@ -72,7 +72,7 @@ The graph fetches metrics per distinct provider/model scope (`jittor metrics dis
 
 ### Cost per Papyrus task
 
-Jittor observes Papyrus's task-focus lifecycle in real time over a shared Pi extension event bus (`papyrus.task-focus.v1`) -- Papyrus never depends on Jittor, it only broadcasts which task is currently focused. Every token/cost metric Jittor already records on a finalized Pi assistant message is tagged with the currently focused task's id the moment it is recorded (no time-window estimation, no new instrumentation). A paused or cleared focus stops tagging; spend recorded with nothing focused is reported separately as unattributed, never dropped or folded into an invented task. Run `jittor metrics cost-by-task --since <ms> --until <ms> [--json]` for a bounded per-task breakdown of cost and input/output/cache tokens.
+Jittor observes Papyrus's task-focus lifecycle in real time over a shared Pi extension event bus (`papyrus.task-focus.v1`) -- Papyrus never depends on Jittor, it only broadcasts which task is currently focused. Every token/cost metric Jittor already records on a finalized Pi assistant message is tagged with the currently focused task's id, and the provider/model/thinking level active at that moment, the instant it is recorded (no time-window estimation, no new instrumentation). A paused or cleared focus stops tagging; spend recorded with nothing focused is reported separately as unattributed, never dropped or folded into an invented task. Run `jittor metrics cost-by-task --since <ms> --until <ms> [--json]` for a bounded per-task breakdown of cost and input/output/cache tokens, broken down further by which provider/model/thinking combination each task actually spent on.
 
 Series are colored with a categorical palette chosen to avoid this UI's own status colors ("success"/"warning"/"error" already mean something specific elsewhere in this panel, so reusing them for arbitrary model identity would make a model's bar segment look like a warning or a failure) and instead reuses the theme's syntax-highlighting roles, which are already tuned by theme authors to stay mutually distinguishable on screen — the same design problem as a categorical data palette. Once more series are active than there are hues, a series reuses a hue in bold rather than repeating an indistinguishable color. Multiple models active within the same cumulative time frame are rendered as one bar stacked by color, not separate bars.
 
@@ -112,6 +112,7 @@ Every daemon operation is reachable from the CLI through the authenticated typed
 
 ```text
 jittor metrics record --source <s> --scope <s> --metric <s> --value <number|null> --unit <unit> [--observed-at <ms>] [--attributes <json>] [--json]
+jittor metrics record-batch --observations <json-array, max 100> [--json]
 jittor metrics query [--source <s>] [--scope <s>] [--metric <s>] [--since <ms>] [--until <ms>] [--limit <n>] [--order asc|desc] [--json]
 jittor metrics prune --before <ms> [--json]
 jittor metrics distinct-scopes --source <s> --since <ms> --until <ms> [--limit 1..40] [--json]
@@ -120,10 +121,12 @@ jittor metrics prune --before <ms> [--force] [--json]  # force required if befor
 jittor service checkpoint [--json]
 jittor telemetry poll [--json]
 jittor compaction estimate [--json]
-jittor router status|decide|pause|resume|clear-override [--json]
-jittor router override --route <provider/model@thinking> [--expires-at <ms>] [--json]
-jittor router current-route --route <provider/model@thinking> [--json]
-jittor router available-routes [--route <provider/model@thinking> ...] [--json]
+jittor session register --session-id <id> [--json]
+jittor session release --session-id <id> [--session-secret <secret>] [--json]
+jittor router status|decide|pause|resume|clear-override [--session-id <id>] [--session-secret <secret>] [--json]
+jittor router override --route <provider/model@thinking> [--expires-at <ms>] [--session-id <id>] [--session-secret <secret>] [--json]
+jittor router current-route --route <provider/model@thinking> [--session-id <id>] [--session-secret <secret>] [--json]
+jittor router available-routes [--route <provider/model@thinking> ...] [--session-id <id>] [--session-secret <secret>] [--json]
 jittor op <operation> [--input <json>]
 ```
 

package/extension/src/benchmark-tui.ts

@@ -11,6 +11,7 @@ import {
 } from "../../src/constants.ts";
 import type { ModelTaskDomain, ModelTaskType } from "../../src/domain/model-observation.ts";
 import type { ModelCandidate, ModelRankingResult, RankedModel, UtilityComponentName } from "../../src/domain/model-ranking.ts";
+import { sessionSecretField } from "./session-identity.ts";
 
 export interface BenchmarkPanelClient {
 	call(operation: string, input: unknown): Promise<any>;
@@ -72,8 +73,11 @@ export async function showBenchmarkPanel(
 	type: ModelTaskType,
 ): Promise<void> {
 	for (;;) {
+		const session_id = ctx.sessionManager.getSessionId();
 		const result = await client.call("models.rank", {
 			candidates,
+			session_id,
+			...sessionSecretField(session_id),
 			scopeAuthority: "available-models",
 			domain,
 			type,

package/extension/src/capabilities/codex-recovery.ts

@@ -0,0 +1,127 @@
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import {
+	CODEX_RECOVERY_ATTEMPT_WINDOW_MS,
+	CODEX_RECOVERY_BASE_DELAY_MS,
+	CODEX_RECOVERY_JITTER_RATIO,
+	CODEX_RECOVERY_MAX_ATTEMPTS,
+	CODEX_RECOVERY_MAX_DELAY_MS,
+	MILLISECONDS_PER_MINUTE,
+	MILLISECONDS_PER_SECOND,
+} from "../../../src/constants.ts";
+import { CodexRecoveryPolicy, classifyCodexFailure, type CodexFailureKind, type CodexFailureMetadata } from "../../../src/domain/codex-recovery.ts";
+import type { CodexRecoveryControl } from "../settings.ts";
+import { headerValue } from "./http-headers.ts";
+
+export interface CodexRecoveryRuntime {
+	now(): number;
+	random(): number;
+	setTimeout(callback: () => void | Promise<void>, delayMs: number): unknown;
+	clearTimeout(handle: unknown): void;
+}
+
+export const SYSTEM_RECOVERY_RUNTIME: CodexRecoveryRuntime = {
+	now: Date.now,
+	random: Math.random,
+	setTimeout(callback, delayMs) { return setTimeout(() => { void callback(); }, delayMs); },
+	clearTimeout(handle) { clearTimeout(handle as ReturnType<typeof setTimeout>); },
+};
+
+/**
+ * Codex's settled-turn hidden-retry recovery, as its own capability: tracks the most recent
+ * Codex response (status/retry-after) across the current turn, classifies a finalized failure,
+ * and schedules at most one bounded, jittered follow-up once Pi's own turn has genuinely
+ * settled. Fully self-contained -- the only external dependencies are Pi's own message-send API,
+ * the persisted on/off control, and a runtime the tests can fake (timers, randomness, clock).
+ */
+export class CodexRecoveryCapability {
+	private readonly policy: CodexRecoveryPolicy;
+	private lastResponse: CodexFailureMetadata = {};
+	private timer: unknown;
+	private cooldown: { until: number; attempt: number; failureKind: CodexFailureKind } | undefined;
+
+	constructor(
+		private readonly pi: ExtensionAPI,
+		private readonly control: CodexRecoveryControl,
+		private readonly runtime: CodexRecoveryRuntime,
+	) {
+		this.policy = new CodexRecoveryPolicy({
+			baseDelayMs: CODEX_RECOVERY_BASE_DELAY_MS,
+			maxDelayMs: CODEX_RECOVERY_MAX_DELAY_MS,
+			maxAttempts: CODEX_RECOVERY_MAX_ATTEMPTS,
+			attemptWindowMs: CODEX_RECOVERY_ATTEMPT_WINDOW_MS,
+			jitterRatio: CODEX_RECOVERY_JITTER_RATIO,
+		}, runtime.random);
+	}
+
+	/** Clears the tracked response at the start of every new turn, before any Codex response for it has arrived. */
+	resetTurn(): void {
+		this.lastResponse = {};
+	}
+
+	notifyResponse(status: number, headers: Record<string, string>): void {
+		this.lastResponse = { status, ...(headerValue(headers, "retry-after") ? { retryAfter: headerValue(headers, "retry-after") } : {}) };
+	}
+
+	notifyMessageEnd(stopReason: string, errorMessage: string | undefined): void {
+		if (stopReason === "error") {
+			const failure = classifyCodexFailure(errorMessage, this.lastResponse);
+			if (this.control.isCodexRecoveryEnabled() && failure.transient) this.policy.observeFailure(failure, this.runtime.now());
+			else this.cancel(true);
+		} else if (stopReason !== "aborted") {
+			this.cancel(true);
+		}
+		this.lastResponse = {};
+	}
+
+	cancel(resetPolicy: boolean): void {
+		if (this.timer !== undefined) this.runtime.clearTimeout(this.timer);
+		this.timer = undefined;
+		this.cooldown = undefined;
+		if (resetPolicy) this.policy.cancel();
+	}
+
+	statusText(): string {
+		const now = this.runtime.now();
+		const state = this.policy.state(now);
+		const enabled = this.control.isCodexRecoveryEnabled();
+		const attempt = this.cooldown?.attempt ?? (state.pending ? state.attempts + 1 : state.attempts);
+		const phase = this.cooldown
+			? `cooldown ${Math.ceil(Math.max(0, this.cooldown.until - now) / MILLISECONDS_PER_SECOND)}s`
+			: state.pending ? "pending"
+				: state.attempts >= CODEX_RECOVERY_MAX_ATTEMPTS ? "exhausted"
+					: state.attempts > 0 ? "waiting" : "idle";
+		const failureKind = this.cooldown?.failureKind ?? state.lastFailureKind;
+		return [
+			`Codex recovery: ${enabled ? "on" : "off"}`,
+			phase,
+			`attempt ${attempt}/${CODEX_RECOVERY_MAX_ATTEMPTS}`,
+			`window ${CODEX_RECOVERY_ATTEMPT_WINDOW_MS / MILLISECONDS_PER_MINUTE}m`,
+			...(failureKind ? [failureKind] : []),
+		].join(" · ");
+	}
+
+	scheduleIfIdle(ctx: ExtensionContext): void {
+		if (!this.control.isCodexRecoveryEnabled() || this.timer !== undefined || !ctx.isIdle() || ctx.hasPendingMessages()) return;
+		const plan = this.policy.plan(this.runtime.now());
+		if (plan.action === "exhausted") {
+			this.policy.abandonFailure();
+			if (ctx.hasUI) ctx.ui.notify(`Jittor Codex recovery stopped: ${plan.reason}.`, "warning");
+			return;
+		}
+		if (plan.action !== "schedule") return;
+		this.cooldown = { until: this.runtime.now() + plan.delayMs, attempt: plan.attempt, failureKind: plan.failureKind };
+		this.timer = this.runtime.setTimeout(async () => {
+			this.timer = undefined;
+			this.cooldown = undefined;
+			if (!ctx.isIdle() || ctx.hasPendingMessages()) return;
+			const attempt = this.policy.recordAttempt(this.runtime.now());
+			if (!attempt) return;
+			this.pi.sendMessage({
+				customType: "jittor-codex-recovery",
+				content: `Retry the previous Codex request after a transient ${attempt.failureKind} failure. Automatic recovery attempt ${attempt.attempt} of ${CODEX_RECOVERY_MAX_ATTEMPTS}.`,
+				display: false,
+				details: { attempt: attempt.attempt, failureKind: attempt.failureKind },
+			}, { triggerTurn: true, deliverAs: "followUp" });
+		}, plan.delayMs);
+	}
+}

package/extension/src/capabilities/http-headers.ts

@@ -0,0 +1,5 @@
+/** Case-insensitive header lookup -- Pi's provider-response event headers are a plain Record, not a Headers instance. */
+export function headerValue(headers: Record<string, string>, name: string): string | undefined {
+	const expected = name.toLowerCase();
+	return Object.entries(headers).find(([key]) => key.toLowerCase() === expected)?.[1];
+}

package/extension/src/capabilities/local-run-telemetry.ts

@@ -0,0 +1,104 @@
+import { classifyTaskFromTools, modelRunMetrics, type ModelRunObservation } from "../../../src/domain/model-observation.ts";
+import type { MetricObservation } from "../../../src/domain/metric.ts";
+
+export interface ActiveLocalModelRun {
+	runId: string;
+	startedAt: number;
+	firstTokenAt: number | null;
+	providerResponses: number;
+	toolNames: string[];
+	toolCalls: number;
+	toolFailures: number;
+}
+
+/**
+ * Content-free local model observations derived only from Pi's public lifecycle: TTFT, wall
+ * latency, tool-loop counts and failures, and a bounded tool-name list used only to derive
+ * domain/type classification -- never prompts, responses, tool arguments/results, or project
+ * paths. Owns the one in-flight run plus the most recently completed one (for `/jittor outcome`).
+ */
+export class LocalRunTelemetry {
+	private active: ActiveLocalModelRun | undefined;
+	private lastCompleted: ModelRunObservation | undefined;
+	private sequence = 0;
+
+	beginTurn(timestamp: number): void {
+		this.active = {
+			runId: `local-${timestamp}-${++this.sequence}`,
+			startedAt: timestamp,
+			firstTokenAt: null,
+			providerResponses: 0,
+			toolNames: [],
+			toolCalls: 0,
+			toolFailures: 0,
+		};
+	}
+
+	discardTurn(): void {
+		this.active = undefined;
+	}
+
+	onMessageUpdate(assistantMessageEventType: string): void {
+		if (!this.active || this.active.firstTokenAt !== null) return;
+		if (["text_delta", "thinking_delta", "toolcall_delta"].includes(assistantMessageEventType)) this.active.firstTokenAt = Date.now();
+	}
+
+	onToolExecutionEnd(toolName: string, isError: boolean): void {
+		if (!this.active) return;
+		this.active.toolCalls += 1;
+		if (isError) this.active.toolFailures += 1;
+		if (this.active.toolNames.length < 100) this.active.toolNames.push(toolName);
+	}
+
+	onProviderResponse(): void {
+		if (this.active) this.active.providerResponses += 1;
+	}
+
+	/** Finalizes the active run against a completed assistant turn_end message, returning metrics to record (empty if the message shape doesn't match a completed assistant turn). */
+	completeTurn(message: unknown, thinkingLevel: string): MetricObservation[] {
+		const active = this.active;
+		this.active = undefined;
+		if (!active || typeof message !== "object" || message === null || Array.isArray(message)) return [];
+		const value = message as Record<string, unknown>;
+		if (value["role"] !== "assistant" || typeof value["provider"] !== "string" || typeof value["model"] !== "string") return [];
+		const usage = typeof value["usage"] === "object" && value["usage"] !== null ? value["usage"] as Record<string, unknown> : {};
+		const amount = (name: string): number => typeof usage[name] === "number" && Number.isFinite(usage[name]) ? usage[name] as number : 0;
+		const cost = typeof usage["cost"] === "object" && usage["cost"] !== null && typeof (usage["cost"] as Record<string, unknown>)["total"] === "number"
+			? (usage["cost"] as Record<string, number>)["total"] ?? 0 : 0;
+		const stopReason = ["stop", "length", "toolUse", "error", "aborted"].includes(String(value["stopReason"]))
+			? value["stopReason"] as ModelRunObservation["stopReason"] : "unknown";
+		const completedAt = Math.max(Date.now(), active.firstTokenAt ?? active.startedAt, active.startedAt);
+		this.lastCompleted = {
+			runId: active.runId,
+			provider: value["provider"],
+			model: value["model"],
+			thinking: thinkingLevel,
+			...classifyTaskFromTools(active.toolNames),
+			startedAt: active.startedAt,
+			firstTokenAt: active.firstTokenAt,
+			completedAt,
+			inputTokens: amount("input"),
+			outputTokens: amount("output"),
+			cacheReadTokens: amount("cacheRead"),
+			cacheWriteTokens: amount("cacheWrite"),
+			costUsd: Number.isFinite(cost) && cost >= 0 ? cost : 0,
+			providerResponses: Math.max(1, active.providerResponses),
+			toolCalls: active.toolCalls,
+			toolFailures: active.toolFailures,
+			stopReason,
+			explicitOutcome: "unknown",
+		};
+		return modelRunMetrics(this.lastCompleted);
+	}
+
+	/** Builds the single outcome-accepted/outcome-accepted=0 metric for the most recently completed run, or null if none exists yet. */
+	explicitOutcomeMetric(explicitOutcome: "accepted" | "rejected"): MetricObservation | null {
+		if (!this.lastCompleted) return null;
+		return modelRunMetrics({ ...this.lastCompleted, explicitOutcome }).find((metric) => metric.metric === "outcome-accepted") ?? null;
+	}
+
+	reset(): void {
+		this.active = undefined;
+		this.lastCompleted = undefined;
+	}
+}

package/extension/src/capabilities/provider-response-telemetry.ts

@@ -0,0 +1,96 @@
+import type { MetricObservation } from "../../../src/domain/metric.ts";
+import { hasAnthropicRateLimitHeaders, parseAnthropicRateLimitHeaders } from "../../../src/providers/anthropic-contracts.ts";
+import { parseCodexRateLimitHeaders } from "../../../src/providers/codex.ts";
+import { classifyGoogleVertexFailure, googleVertexFailureMetrics, type GoogleVertexFailureMetadata } from "../../../src/providers/google-vertex-contracts.ts";
+import { headerValue } from "./http-headers.ts";
+
+export interface ProviderTelemetryClient {
+	call(operation: string, input: unknown): Promise<any>;
+}
+
+async function recordMetrics(client: ProviderTelemetryClient, metrics: MetricObservation[]): Promise<void> {
+	if (metrics.length === 0) return;
+	await client.call("metrics.record_batch", { observations: metrics });
+}
+
+/**
+ * Bounded telemetry derived directly from provider HTTP responses and finalized messages, for
+ * every provider except Codex (whose response tracking is settled-turn-recovery's own concern --
+ * see codex-recovery.ts). Anthropic and anthropic-vertex official rate-limit headers become
+ * budget metrics; Google Vertex and anthropic-vertex failures become bounded, content-free
+ * failure-count metrics classified from GCP's own `google.rpc.Status` shape. anthropic-vertex is
+ * tracked distinctly from both google-vertex (different code path, different quota pool) and
+ * direct anthropic (different transport), never conflated with either.
+ */
+export class ProviderResponseTelemetry {
+	private lastGoogleVertexResponse: GoogleVertexFailureMetadata = {};
+	private lastAnthropicVertexResponse: GoogleVertexFailureMetadata = {};
+
+	resetTurn(): void {
+		this.lastGoogleVertexResponse = {};
+		this.lastAnthropicVertexResponse = {};
+	}
+
+	async handleProviderResponse(
+		client: ProviderTelemetryClient,
+		provider: string | undefined,
+		status: number,
+		headers: Record<string, string>,
+		notifySchemaDrift: (message: string) => void,
+	): Promise<void> {
+		if (provider === "anthropic") {
+			const parsedHeaders = new Headers(headers);
+			if (hasAnthropicRateLimitHeaders(parsedHeaders)) {
+				try {
+					await recordMetrics(client, parseAnthropicRateLimitHeaders(parsedHeaders, Date.now()).metrics);
+				} catch {
+					notifySchemaDrift("Anthropic telemetry schema drift");
+				}
+			}
+		}
+		if (provider === "anthropic-vertex") {
+			// Best-effort only: unverified whether this passthrough ever forwards Anthropic's own
+			// rate-limit headers. If it doesn't, hasAnthropicRateLimitHeaders is false and nothing is
+			// recorded -- the same honest default as every other unconfirmed signal in this module.
+			const parsedHeaders = new Headers(headers);
+			if (hasAnthropicRateLimitHeaders(parsedHeaders)) {
+				try {
+					await recordMetrics(client, parseAnthropicRateLimitHeaders(parsedHeaders, Date.now(), "anthropic-vertex").metrics);
+				} catch {
+					notifySchemaDrift("Anthropic-on-Vertex telemetry schema drift");
+				}
+			}
+			// Well-evidenced regardless of headers: GCP's own quota system fronts this transport, so the
+			// same failure classification as google-vertex applies below.
+			this.lastAnthropicVertexResponse = { status, ...(headerValue(headers, "retry-after") ? { retryAfter: headerValue(headers, "retry-after") } : {}) };
+		}
+		if (provider === "google-vertex") {
+			this.lastGoogleVertexResponse = { status, ...(headerValue(headers, "retry-after") ? { retryAfter: headerValue(headers, "retry-after") } : {}) };
+		}
+		if (Object.keys(headers).some((name) => name.toLowerCase().startsWith("x-codex-"))) {
+			try {
+				const updates = parseCodexRateLimitHeaders(new Headers(headers), Date.now());
+				await recordMetrics(client, updates.flatMap((update) => update.metrics));
+			} catch {
+				notifySchemaDrift("Codex telemetry schema drift");
+			}
+		}
+	}
+
+	async handleMessageEnd(client: ProviderTelemetryClient, provider: string | undefined, stopReason: string | undefined, errorMessage: string | undefined): Promise<void> {
+		if (provider === "google-vertex") {
+			if (stopReason === "error") {
+				const failure = classifyGoogleVertexFailure(errorMessage, this.lastGoogleVertexResponse);
+				await recordMetrics(client, googleVertexFailureMetrics(failure, Date.now())).catch(() => undefined);
+			}
+			this.lastGoogleVertexResponse = {};
+		}
+		if (provider === "anthropic-vertex") {
+			if (stopReason === "error") {
+				const failure = classifyGoogleVertexFailure(errorMessage, this.lastAnthropicVertexResponse);
+				await recordMetrics(client, googleVertexFailureMetrics(failure, Date.now(), "anthropic-vertex")).catch(() => undefined);
+			}
+			this.lastAnthropicVertexResponse = {};
+		}
+	}
+}

package/extension/src/footer.ts

@@ -12,7 +12,6 @@ import {
 	MILLISECONDS_PER_DAY,
 	MILLISECONDS_PER_HOUR,
 	MILLISECONDS_PER_MINUTE,
-	MILLISECONDS_PER_SECOND,
 	TELEMETRY_STALE_AFTER_MS,
 } from "../../src/constants.ts";
 
@@ -102,7 +101,7 @@ function sanitize(value: string): string {
 }
 
 function usageTotals(context: FooterContext): UsageTotals {
-	let input = 0, output = 0, cacheRead = 0, cacheWrite = 0, cost = 0, cacheHit: number | undefined;
+	let input = 0, output = 0, cacheRead = 0, cacheWrite = 0, cost = 0;
 	for (const entry of context.sessionManager.getEntries()) {
 		if (entry.type !== "message" || entry.message?.role !== "assistant") continue;
 		const usage = entry.message.usage;
@@ -111,10 +110,9 @@ function usageTotals(context: FooterContext): UsageTotals {
 		cacheRead += usage?.cacheRead ?? 0;
 		cacheWrite += usage?.cacheWrite ?? 0;
 		cost += usage?.cost?.total ?? 0;
-		const prompt = (usage?.input ?? 0) + (usage?.cacheRead ?? 0) + (usage?.cacheWrite ?? 0);
-		if (prompt > 0) cacheHit = (usage.cacheRead ?? 0) / prompt * 100;
 	}
-	return { input, output, cacheRead, cacheWrite, cost, ...(cacheHit === undefined ? {} : { cacheHit }) };
+	const prompt = input + cacheRead + cacheWrite;
+	return { input, output, cacheRead, cacheWrite, cost, ...(prompt > 0 ? { cacheHit: cacheRead / prompt * 100 } : {}) };
 }
 
 function barWidth(width: number): number {
@@ -136,58 +134,21 @@ function fillColor(fraction: number | null): FooterColor {
 	return "dim";
 }
 
-/**
- * Once a learned median duration is available (see estimateCompactionDuration / the
- * `compaction.estimate` daemon operation), the bar drains against that real estimate: fraction
- * counts down linearly from 1 to 0 over estimatedMs, exactly in step with the countdown shown in
- * compactionStatusText — same elapsed/estimatedMs ratio drives both. Until then — cold start, or
- * the estimate fetch has not resolved yet — there is no real duration to drain against, so the
- * fill holds steady at the fraction observed when compaction started; the blink alone (see
- * compactionBarGlyph) communicates liveness without fabricating a rate.
- */
-function compactionFraction(progress: CompactionProgress, width: number, now: number): number {
-	if (progress.confidence === "learned" && typeof progress.estimatedMs === "number" && progress.estimatedMs > 0) {
-		const elapsed = Math.max(0, now - progress.startedAt);
-		return Math.max(0, Math.min(1, 1 - (elapsed / progress.estimatedMs)));
-	}
-	return Math.min(1, Math.max(0, progress.initialFraction));
+function compactionFraction(progress: CompactionProgress, now: number): number {
+	const initial = Math.min(1, Math.max(0, progress.initialFraction));
+	if (progress.confidence !== "learned" || typeof progress.estimatedMs !== "number" || progress.estimatedMs <= 0) return initial;
+	const elapsedFraction = Math.max(0, Math.min(1, (now - progress.startedAt) / progress.estimatedMs));
+	return initial * (1 - elapsedFraction);
 }
 
-/**
- * Liveness blink independent of whether the drain bar reflects a learned estimate or the
- * fixed-rate cold-start fallback: it does not claim to know how long compaction will take, only
- * that it has not stalled. It toggles once per render tick so a single owned interval (installed
- * in beginCompactionUi) drives both the drain and the blink — no extra timer is created here.
- */
 export function compactionBlinkOn(startedAt: number, now: number, halfPeriodMs = FOOTER_COMPACTION_BLINK_HALF_PERIOD_MS): boolean {
 	const elapsed = Math.max(0, now - startedAt);
 	return Math.floor(elapsed / halfPeriodMs) % 2 === 0;
 }
 
-/**
- * The compaction signal lives in the bar itself: it blinks between its normal draining fill and a
- * blank track of the same width, rather than a separate indicator glyph next to it. Off-phase
- * intentionally renders identically to the "no data" empty track (dim, all "░") so the bar reads
- * as a single blinking element, not a bar plus a decoration.
- */
 function compactionBarGlyph(progress: CompactionProgress, theme: FooterTheme, width: number, now: number): string {
 	if (!compactionBlinkOn(progress.startedAt, now)) return theme.fg("dim", "░".repeat(width));
-	const fraction = compactionFraction(progress, width, now);
-	return theme.fg("accent", progressBar(fraction, width));
-}
-
-/**
- * A countdown, never a count-up: once a learned estimate exists it reports seconds remaining,
- * ticking down toward zero in step with the draining bar. Before that (cold start, no estimate
- * yet) there is nothing true to count down from, so this reports nothing at all rather than a
- * fabricated elapsed count or a guessed total — the blinking, non-draining bar is the only signal.
- */
-function compactionStatusText(progress: CompactionProgress, now: number): string | undefined {
-	if (progress.confidence === "learned" && typeof progress.estimatedMs === "number" && progress.estimatedMs > 0) {
-		const remainingSeconds = Math.max(0, Math.ceil((progress.estimatedMs - (now - progress.startedAt)) / MILLISECONDS_PER_SECOND));
-		return `compact ~${remainingSeconds}s left`;
-	}
-	return undefined;
+	return theme.fg("accent", progressBar(compactionFraction(progress, now), width));
 }
 
 function contextSegment(
@@ -199,11 +160,7 @@ function contextSegment(
 	compaction?: CompactionProgress,
 ): string {
 	const w = barWidth(width);
-	if (compaction) {
-		const bar = compactionBarGlyph(compaction, theme, w, now);
-		const statusText = compactionStatusText(compaction, now);
-		return statusText === undefined ? `ctx ${bar}` : `ctx ${bar} ${statusText}`;
-	}
+	if (compaction) return `ctx ${compactionBarGlyph(compaction, theme, w, now)}`;
 	const usage = context.getContextUsage();
 	const window = usage?.contextWindow ?? context.model?.contextWindow ?? 0;
 	const fraction = usage?.percent === null || usage?.percent === undefined ? null : usage.percent / 100;