@desplega.ai/agent-swarm 1.158.0 → 1.160.0

package/src/utils/context-window.ts

@@ -4,7 +4,10 @@
  * This module is safe for both API and worker code — it has NO database imports.
  *
  * Phase 4 + Phase 9 of the cost-tracking plan:
- *   - `getContextWindowSize` now resolves shortnames, family-versioned ids
+ *   - Model-catalog phase 4: windows come from the model catalog (no
+ *     per-model table). A new model gets the right window as soon as it
+ *     lands in `model_catalog`.
+ *   - `getContextWindowSize` resolves shortnames, family-versioned ids
  *     (`claude-sonnet-4-6`), AND dated full ids (`claude-sonnet-4-6-20251004`)
  *     by stripping the trailing date suffix. Previously the dated form fell
  *     to the 200k default — wildly wrong for sonnet/opus 4.x.
@@ -17,6 +20,9 @@
  *     deprecated; new code should use `computeContextUsedUnified`.
  */
 
+import { buildClaudeShortnameMap } from "@desplega/model-catalog";
+import { runtimeCatalogModel, runtimeCatalogSection } from "./runtime-model-catalog";
+
 /**
  * Phase 9: stamp this onto every `context_usage` event the adapter emits.
  * Callers that compute their own number for legacy reasons (e.g. pi-mono
@@ -25,43 +31,6 @@
  */
 export const CONTEXT_FORMULA = "input-cache-output" as const;
 
-const CONTEXT_WINDOW_DEFAULTS: Record<string, number> = {
-  // Anthropic Fable / Mythos tier
-  "claude-fable-5-1": 1_000_000,
-  "claude-mythos-5-1": 1_000_000,
-  "claude-opus-5-5": 1_000_000,
-  "claude-opus-5": 1_000_000,
-  "claude-fable-5": 1_000_000,
-  "claude-mythos-5": 1_000_000,
-  "claude-sonnet-5-5": 1_000_000,
-  "claude-sonnet-5": 1_000_000,
-  // Anthropic 4.x family
-  "claude-opus-4-8": 1_000_000,
-  "claude-opus-4-7": 1_000_000,
-  "claude-opus-4-6": 1_000_000,
-  "claude-opus-4-5": 1_000_000,
-  "claude-opus-4-1": 200_000,
-  "claude-opus-4-0": 200_000,
-  "claude-sonnet-4-6": 1_000_000,
-  "claude-sonnet-4-5": 1_000_000,
-  "claude-sonnet-4-0": 200_000,
-  "claude-haiku-4-5": 200_000,
-  // Anthropic 3.x family (legacy)
-  "claude-3-7-sonnet": 200_000,
-  "claude-3-5-sonnet": 200_000,
-  "claude-3-5-haiku": 200_000,
-  "claude-3-opus": 200_000,
-  "claude-3-sonnet": 200_000,
-  "claude-3-haiku": 200_000,
-  // Shortnames used by the local-CLI adapter and pi-mono OpenRouter mirror.
-  fable: 1_000_000,
-  mythos: 1_000_000,
-  opus: 1_000_000,
-  sonnet: 1_000_000,
-  haiku: 200_000,
-  default: 200_000,
-};
-
 const DEFAULT_CONTEXT_WINDOW = 200_000;
 
 /**
@@ -69,30 +38,55 @@ const DEFAULT_CONTEXT_WINDOW = 200_000;
  * resolve to the same window as the family-versioned id.
  *
  * `claude-sonnet-4-6-20251004` → `claude-sonnet-4-6`
- * `claude-haiku-4-5-20251001`  → `claude-haiku-4-5`
- *
- * Anthropic's dated full ids are always `${family}-${major}-${minor}-${YYYYMMDD}`,
- * so an 8-digit trailing date is a reliable signal.
  */
 function stripAnthropicDateSuffix(model: string): string {
   return model.replace(/-(\d{8})$/, "");
 }
 
+let shortnameMap: { section: Record<string, unknown>; map: Record<string, string> } | null = null;
+
+/** Claude CLI shortnames (`opus`, `sonnet`, ...) → newest catalog id. */
+function resolveClaudeShortname(model: string): string | undefined {
+  const section = runtimeCatalogSection("anthropic");
+  if (!shortnameMap || shortnameMap.section !== section) {
+    shortnameMap = { section, map: buildClaudeShortnameMap(section) };
+  }
+  return shortnameMap.map[model.trim().toLowerCase()];
+}
+
+function catalogContext(provider: string, model: string): number | undefined {
+  const context = runtimeCatalogModel(provider, model)?.limit?.context;
+  return typeof context === "number" && context > 0 ? context : undefined;
+}
+
+/**
+ * Context window (tokens) for a model id, read from the model catalog
+ * (`src/utils/runtime-model-catalog.ts`: live `model_catalog` + overlay,
+ * vendored models.dev snapshot offline). Accepts Anthropic ids (dated or
+ * not), Claude CLI shortnames, OpenAI/Codex ids and `provider/model` ids.
+ * Unknown models get a conservative 200k so percent math stays finite.
+ */
 export function getContextWindowSize(model: string): number {
-  // Fast path: exact match (shortname or family-versioned id).
-  if (CONTEXT_WINDOW_DEFAULTS[model] !== undefined) {
-    return CONTEXT_WINDOW_DEFAULTS[model];
+  if (!model) return DEFAULT_CONTEXT_WINDOW;
+  const slash = model.indexOf("/");
+  if (slash > 0) {
+    const scoped = catalogContext(model.slice(0, slash), model.slice(slash + 1));
+    if (scoped) return scoped;
+  }
+  for (const provider of ["anthropic", "openai"]) {
+    const exact = catalogContext(provider, model);
+    if (exact) return exact;
   }
-  // Dated full id → strip suffix and retry.
   const stripped = stripAnthropicDateSuffix(model);
-  if (stripped !== model && CONTEXT_WINDOW_DEFAULTS[stripped] !== undefined) {
-    return CONTEXT_WINDOW_DEFAULTS[stripped];
+  if (stripped !== model) {
+    const dated = catalogContext("anthropic", stripped);
+    if (dated) return dated;
+  }
+  const shortname = resolveClaudeShortname(model);
+  if (shortname) {
+    const resolved = catalogContext("anthropic", shortname);
+    if (resolved) return resolved;
   }
-  // OpenAI / GPT family — most reasoning models have 200k+; we keep this
-  // conservative and let callers override via models.dev rates if they want.
-  // Specific gpt-5.x context windows are >1M but the local-CLI adapter
-  // generally doesn't surface those; the API recompute path uses the rate
-  // table, not the window. The 200k default keeps the math safe.
   return DEFAULT_CONTEXT_WINDOW;
 }
 

package/src/utils/credentials.ts

@@ -113,8 +113,12 @@ export interface CredentialSelection {
   modelBlockedIndices?: number[];
   /** ISO of the earliest reset among modelBlockedIndices, or null/undefined when none. */
   earliestModelResetAt?: string | null;
+  /** Indices excluded because the key's subscription plan cannot run the requested model. */
+  seatBlockedIndices?: number[];
   /** Subscription plan id detected on the credential (`SUBSCRIPTION_PLANS`), reported with its usage. */
   plan?: string | null;
+  /** `authFailureFence` from `GET /api/keys/available`, read before the task (Codex pool only). */
+  authFailureFence?: number;
 }
 
 const MODEL_LABELS: Record<ModelFamily, string> = {
@@ -126,33 +130,49 @@ const MODEL_LABELS: Record<ModelFamily, string> = {
 
 /**
  * Thrown by `resolveCredentialPools` at task admission (`enforceModelCapacity`)
- * when every key for a pool is either key-wide rate-limited or blocked by the
- * requested model's weekly window, and `MODEL_WINDOW_EXHAUSTED_POLICY` is
- * `fail` (the default). The caller must not spawn the CLI on this error — see
- * `spawnProviderProcess` in `src/commands/runner.ts`. Taskless configuration
- * loads never throw it.
+ * when no key for a pool can run the requested model: every key is key-wide
+ * rate-limited, blocked by the model's weekly window, or on a subscription
+ * seat that cannot run the model (`seatBlockedCount`). A window block throws
+ * only when `MODEL_WINDOW_EXHAUSTED_POLICY` is `fail` (the default); a seat
+ * block never resets, so it throws under every policy. The caller must not
+ * spawn the CLI on this error — see `spawnProviderProcess` in
+ * `src/commands/runner.ts`. Taskless configuration loads never throw it.
  */
 export class ModelWindowExhaustedError extends Error {
   readonly model: ModelFamily;
   readonly window: string;
   readonly earliestResetAt: string | null;
   readonly keyType: string;
+  readonly seatBlockedCount: number;
+  readonly modelBlockedCount: number;
 
   constructor(opts: {
     model: ModelFamily;
     window: string;
     earliestResetAt: string | null;
     keyType: string;
+    seatBlockedCount?: number;
+    modelBlockedCount?: number;
   }) {
     const modelLabel = MODEL_LABELS[opts.model];
+    const seatBlockedCount = opts.seatBlockedCount ?? 0;
+    const modelBlockedCount = opts.modelBlockedCount ?? 0;
+    const windowClause =
+      modelBlockedCount > 0 && opts.earliestResetAt
+        ? `${modelBlockedCount} keys have the ${modelLabel} window exhausted until ${opts.earliestResetAt}`
+        : `${modelBlockedCount} keys have the ${modelLabel} window exhausted`;
     super(
-      `No ${opts.keyType} key has ${modelLabel} capacity until ${opts.earliestResetAt ?? "unknown"}. Re-dispatch with another model or modelTier.`,
+      seatBlockedCount > 0
+        ? `No ${opts.keyType} key can run ${modelLabel}: ${seatBlockedCount} keys are on a seat without ${modelLabel}, ${windowClause}. Re-dispatch with another model or modelTier.`
+        : `No ${opts.keyType} key has ${modelLabel} capacity until ${opts.earliestResetAt ?? "unknown"}. Re-dispatch with another model or modelTier.`,
     );
     this.name = "ModelWindowExhaustedError";
     this.model = opts.model;
     this.window = opts.window;
     this.earliestResetAt = opts.earliestResetAt;
     this.keyType = opts.keyType;
+    this.seatBlockedCount = seatBlockedCount;
+    this.modelBlockedCount = modelBlockedCount;
   }
 }
 
@@ -173,6 +193,15 @@ function isJsonObject(value: string): boolean {
  * Falls back to random selection from all credentials if no available indices match.
  * A JSON object value (the CODEX_OAUTH blob) is always one credential.
  */
+function splitCredentialPool(value: string): string[] {
+  return isJsonObject(value)
+    ? [value.trim()]
+    : value
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+
 export function selectCredential(
   value: string,
   availableIndices?: number[],
@@ -183,12 +212,7 @@ export function selectCredential(
   // handed out fragments such as `"accountId":"..."}` as the selected credential
   // and stamped `965"}` as the key suffix on task records. Codex pools live in
   // config-store slots (codex_oauth_<n>), resolved by the runner instead.
-  const credentials = isJsonObject(value)
-    ? [value.trim()]
-    : value
-        .split(",")
-        .map((s) => s.trim())
-        .filter(Boolean);
+  const credentials = splitCredentialPool(value);
   if (credentials.length <= 1) {
     const selected = value.trim();
     const isRateLimitFallback = availableIndices !== undefined && availableIndices.length === 0;
@@ -283,6 +307,8 @@ export interface AvailabilityInfo {
   availableIndices: number[];
   modelBlockedIndices?: number[];
   earliestModelResetAt?: string | null;
+  /** Indices excluded because the key's subscription plan cannot run the model. */
+  seatBlockedIndices?: number[];
 }
 
 /**
@@ -315,11 +341,13 @@ async function fetchAvailableIndices(
             availableIndices: number[];
             modelBlockedIndices?: number[];
             earliestModelResetAt?: string | null;
+            seatBlockedIndices?: number[];
           };
           availableIndicesMap[envVar] = {
             availableIndices: data.availableIndices,
             modelBlockedIndices: data.modelBlockedIndices,
             earliestModelResetAt: data.earliestModelResetAt,
+            seatBlockedIndices: data.seatBlockedIndices,
           };
           if (data.availableIndices.length < totalKeys) {
             console.log(
@@ -374,7 +402,9 @@ export async function resolveCredentialPools(
     localBlocks?: Map<string, number>;
     /**
      * Set only at task admission (`spawnProviderProcess`). When true, an
-     * exhausted model window fails fast with `ModelWindowExhaustedError`.
+     * exhausted model window, or a pool where every remaining key is on a
+     * seat that cannot run the model, fails fast with
+     * `ModelWindowExhaustedError`.
      * Taskless configuration loads (worker boot, credential recovery,
      * periodic reconciliation) leave it unset: they still pick a key, so an
      * exhausted default model never blocks boot or config refresh, and the
@@ -413,32 +443,43 @@ export async function resolveCredentialPools(
         modelBlockedCount += beforeCount - available.length;
       }
 
-      // Every key is either key-wide rate-limited or blocked by this
-      // model's weekly window, and at least one is blocked specifically by
-      // the model (not just legacy key-wide rate limiting) — the picker
-      // can't make progress for this model on this pool. Default policy
-      // fails fast instead of looping the worker through the same
-      // exhausted key every few minutes.
-      if (
-        opts?.enforceModelCapacity &&
-        window &&
-        modelFamily &&
-        available &&
-        available.length === 0 &&
-        modelBlockedCount > 0
-      ) {
+      const seatBlockedIndices = info?.seatBlockedIndices ?? [];
+      const seatBlockedCount = seatBlockedIndices.length;
+      let seatFallbackIndices: number[] | undefined;
+
+      // Every key is key-wide rate-limited, blocked by this model's weekly
+      // window, or on a seat that cannot run the model, and at least one is
+      // blocked specifically for the model (not just legacy key-wide rate
+      // limiting) — the picker can't make progress for this model on this
+      // pool. Default policy fails fast instead of looping the worker
+      // through the same exhausted key every few minutes. A seat block is a
+      // plan fact with no window and no reset, so the fallback pick excludes
+      // seat-blocked keys: a pick from them is a guaranteed failure. It fails
+      // only when every key is seat-blocked.
+      if (opts?.enforceModelCapacity && modelFamily && available && available.length === 0) {
         const policy = (env.MODEL_WINDOW_EXHAUSTED_POLICY ?? "fail").trim().toLowerCase();
-        if (policy !== "fallback") {
+        const windowExhausted =
+          window !== undefined && modelBlockedCount > 0 && policy !== "fallback";
+        if (seatBlockedCount > 0) {
+          seatFallbackIndices = splitCredentialPool(val)
+            .map((_, i) => i)
+            .filter((i) => !seatBlockedIndices.includes(i));
+        }
+        if (windowExhausted || seatFallbackIndices?.length === 0) {
           throw new ModelWindowExhaustedError({
             model: modelFamily,
-            window,
+            window: window ?? "",
             earliestResetAt: info?.earliestModelResetAt ?? null,
             keyType: envVar,
+            seatBlockedCount,
+            modelBlockedCount,
           });
         }
       }
 
-      const result = selectCredential(val, available, envVar);
+      const result = seatFallbackIndices
+        ? { ...selectCredential(val, seatFallbackIndices, envVar), isRateLimitFallback: true }
+        : selectCredential(val, available, envVar);
       env[envVar] = result.selected;
       const availInfo = available ? ` (${available.length} available of ${result.total})` : "";
       console.log(
@@ -448,6 +489,7 @@ export async function resolveCredentialPools(
         ...result,
         modelBlockedIndices: info?.modelBlockedIndices,
         earliestModelResetAt: info?.earliestModelResetAt,
+        seatBlockedIndices: info?.seatBlockedIndices,
       });
     }
   }

package/src/utils/error-tracker.ts

@@ -95,6 +95,51 @@ export function parseRateLimitWindowTelemetry(
   }
 }
 
+/**
+ * `rate_limit_info` fields that describe the seat's billing state (the
+ * `credits_required` payload). `scrubSecrets` does not match them, so they
+ * are dropped structurally before a log egress.
+ */
+const SEAT_PAYLOAD_FIELDS = [
+  "overageDisabledReason",
+  "canUserPurchaseCredits",
+  "hasChargeableSavedPaymentMethod",
+] as const;
+
+/**
+ * Returns a `rate_limit_event` message without the seat billing fields of
+ * its `rate_limit_info`. Any other message is returned unchanged. Error
+ * tracking reads the original message; only log egress uses the result.
+ */
+export function redactRateLimitEvent<T>(message: T): T {
+  if (!message || typeof message !== "object") return message;
+  const json = message as Record<string, unknown>;
+  if (json.type !== "rate_limit_event") return message;
+  const info = json.rate_limit_info;
+  if (!info || typeof info !== "object") return message;
+  if (!SEAT_PAYLOAD_FIELDS.some((field) => field in info)) return message;
+  const redactedInfo = { ...(info as Record<string, unknown>) };
+  for (const field of SEAT_PAYLOAD_FIELDS) delete redactedInfo[field];
+  return { ...json, rate_limit_info: redactedInfo } as T;
+}
+
+/**
+ * Line form of `redactRateLimitEvent` for the CLI's stream-json output. A
+ * line that is not a `rate_limit_event` with seat billing fields is returned
+ * byte for byte.
+ */
+export function redactRateLimitEventLine(line: string): string {
+  if (!line.includes('"rate_limit_event"')) return line;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return line;
+  }
+  const redacted = redactRateLimitEvent(parsed);
+  return redacted === parsed ? line : JSON.stringify(redacted);
+}
+
 /**
  * Maximum cooldown horizon for a rate-limit reset. A weekly OAuth limit resets
  * up to ~7 days out, so the cap must be at least that or a weekly-limited key
@@ -186,6 +231,14 @@ export class SessionErrorTracker {
   private modelRateLimit:
     | { window: string; model: ModelFamily; resetAtMs: number; observedAt: string }
     | undefined;
+  /**
+   * Stashed `credits_required` rejection: the key's seat cannot run the
+   * session's model (e.g. "Fable 5.1 requires usage credits"). A seat fact,
+   * not a rate limit, so it never lands in `keyWideRejections`.
+   */
+  private creditsRequired:
+    | { observedAt: string; resetsAtMs?: number; overageDisabledReason?: string }
+    | undefined;
   private rateLimitWindows: RateLimitWindowTelemetry = {};
 
   /** Record an error from an assistant message with message.error field */
@@ -265,6 +318,21 @@ export class SessionErrorTracker {
         return;
       }
 
+      // Checked before the resetsAt validation: the observed event carries a
+      // resetsAt, but this branch must not depend on it.
+      if (info.errorCode === "credits_required") {
+        this.creditsRequired = {
+          observedAt,
+          resetsAtMs:
+            typeof info.resetsAt === "number" && Number.isFinite(info.resetsAt)
+              ? info.resetsAt * 1000
+              : undefined,
+          overageDisabledReason:
+            typeof info.overageDisabledReason === "string" ? info.overageDisabledReason : undefined,
+        };
+        return;
+      }
+
       const resetsAtSec = info.resetsAt;
       if (typeof resetsAtSec !== "number" || !Number.isFinite(resetsAtSec) || resetsAtSec <= 0) {
         console.warn(
@@ -344,6 +412,18 @@ export class SessionErrorTracker {
     };
   }
 
+  /**
+   * Returns the stashed `credits_required` rejection, or undefined if none was
+   * seen in this session. It never sets the key-wide reset time.
+   */
+  getCreditsRequired(): { observedAt: string; overageDisabledReason?: string } | undefined {
+    if (!this.creditsRequired) return undefined;
+    return {
+      observedAt: this.creditsRequired.observedAt,
+      overageDisabledReason: this.creditsRequired.overageDisabledReason,
+    };
+  }
+
   hasErrors(): boolean {
     return this.errors.length > 0;
   }

package/src/utils/harness-cli-version.ts

@@ -0,0 +1,115 @@
+/**
+ * The worker's harness CLI version (`claude --version` / `codex --version`),
+ * reported on register and used to key harness_model_support rows. Worker-safe
+ * (no DB). Probed once per process; null when the CLI is missing or silent.
+ */
+import { isUnknownModelError } from "./harness-model-error";
+import { scrubSecrets } from "./secret-scrubber";
+
+const CLI_BINARY: Record<string, string> = { claude: "claude", codex: "codex" };
+const PROBE_TIMEOUT_MS = 10_000;
+const VERSION_RE = /\d+\.\d+\.\d+(?:[-+][\w.]+)?/;
+
+const probed = new Map<string, Promise<string | null>>();
+
+export function parseCliVersion(output: string): string | null {
+  return VERSION_RE.exec(output)?.[0] ?? null;
+}
+
+export function probeHarnessCliVersion(harness: string): Promise<string | null> {
+  const binary = CLI_BINARY[harness];
+  if (!binary) return Promise.resolve(null);
+  let pending = probed.get(harness);
+  if (!pending) {
+    pending = (async () => {
+      try {
+        const proc = Bun.spawn([binary, "--version"], {
+          stdin: "ignore",
+          stdout: "pipe",
+          stderr: "pipe",
+          timeout: PROBE_TIMEOUT_MS,
+          killSignal: "SIGKILL",
+        });
+        const [stdout, exitCode] = await Promise.all([
+          new Response(proc.stdout).text(),
+          proc.exited,
+        ]);
+        return exitCode === 0 ? parseCliVersion(stdout) : null;
+      } catch {
+        return null;
+      }
+    })();
+    probed.set(harness, pending);
+  }
+  return pending;
+}
+
+/** Last probed version, without waiting; null until the probe finished. */
+export async function cachedHarnessCliVersion(harness: string): Promise<string | null> {
+  return (await probed.get(harness)) ?? null;
+}
+
+const reported = new Set<string>();
+
+/**
+ * Record a model's run outcome on this worker's CLI. `ok` is sent once per
+ * model per process; `unsupported` whenever the CLI rejects the id. Other
+ * failures say nothing about support and are not sent. Never throws.
+ */
+export async function reportHarnessModelOutcome(opts: {
+  apiUrl: string;
+  apiKey?: string;
+  agentId: string;
+  harness: string;
+  model: string | undefined;
+  exitCode: number;
+  failureReason?: string;
+  fetchImpl?: typeof fetch;
+}): Promise<void> {
+  if (!opts.model || !CLI_BINARY[opts.harness]) return;
+  const cliVersion = await cachedHarnessCliVersion(opts.harness);
+  if (!cliVersion) return;
+  const status =
+    opts.exitCode === 0
+      ? "ok"
+      : isUnknownModelError(opts.failureReason, opts.model)
+        ? "unsupported"
+        : null;
+  if (!status) return;
+  const key = `${opts.harness}|${cliVersion}|${opts.model}`;
+  if (status === "ok" && reported.has(key)) return;
+  try {
+    const headers: Record<string, string> = {
+      "Content-Type": "application/json",
+      "X-Agent-ID": opts.agentId,
+    };
+    if (opts.apiKey) headers.Authorization = `Bearer ${opts.apiKey}`;
+    const res = await (opts.fetchImpl ?? fetch)(
+      `${opts.apiUrl}/api/models-catalog/harness-support`,
+      {
+        method: "PUT",
+        headers,
+        body: JSON.stringify({
+          harness: opts.harness,
+          cliVersion,
+          modelId: opts.model,
+          status,
+          ...(status === "unsupported" && opts.failureReason
+            ? { error: scrubSecrets(opts.failureReason).slice(0, 2000) }
+            : {}),
+        }),
+      },
+    );
+    if (res.ok && status === "ok") reported.add(key);
+  } catch {
+    // Best effort: the next run reports again.
+  }
+}
+
+export function resetHarnessCliVersionForTests(seed?: Record<string, string | null>): void {
+  probed.clear();
+  reported.clear();
+  for (const [harness, version] of Object.entries(seed ?? {})) {
+    probed.set(harness, Promise.resolve(version));
+  }
+}

package/src/utils/harness-model-error.ts

@@ -0,0 +1,33 @@
+/**
+ * Recognizes a harness CLI rejecting a model id. Worker-safe (no DB).
+ *
+ * Claude Code: "There's an issue with the selected model (x). It may not exist
+ * or you may not have access to it", or the API's `not_found_error` "model: x".
+ * Codex: "The model `x` does not exist or you do not have access to it",
+ * "model is not supported", "unknown model".
+ *
+ * A model-rejection phrase can also appear in an unrelated failure ("invalid model output"),
+ * and a false positive marks the model unsupported for the whole (harness, CLI version). So
+ * when `modelId` is given, the rejection line must name that model.
+ */
+const UNKNOWN_MODEL_PATTERNS: RegExp[] = [
+  /issue with the selected model/i,
+  /model[`'" ]*[\w.:/-]*[`'" ]*(?:does not exist|not found)/i,
+  /not_found_error[^\n]*model/i,
+  /model[^\n]{0,80}is not supported/i,
+  /unsupported model/i,
+  /unknown model/i,
+  /invalid model/i,
+];
+
+export function isUnknownModelError(
+  text: string | null | undefined,
+  modelId?: string | null,
+): boolean {
+  if (!text) return false;
+  const id = modelId?.trim().toLowerCase();
+  return text.split("\n").some((line) => {
+    if (!UNKNOWN_MODEL_PATTERNS.some((re) => re.test(line))) return false;
+    return !id || line.toLowerCase().includes(id);
+  });
+}

package/src/utils/model-rate-limit-windows.ts

@@ -73,6 +73,18 @@ export function parseModelLimitMessage(text: string): ModelFamily | undefined {
   return match[1]!.toLowerCase() as ModelFamily;
 }
 
+/**
+ * Text signal for a seat that cannot run the model. Matches the CLI's failure
+ * text for a `credits_required` rejection, e.g. "Fable 5.1 requires usage
+ * credits. Switch to another model to continue." A dot followed by a digit
+ * is allowed so a version number ("5.1") does not end the match.
+ */
+export function parseCreditsRequiredMessage(text: string): ModelFamily | undefined {
+  const match = text.match(/(Fable|Opus|Sonnet)(?:[^.]|\.(?=\d)){0,40}requires usage credits/i);
+  if (!match) return undefined;
+  return match[1]!.toLowerCase() as ModelFamily;
+}
+
 interface RateLimitWindowLike {
   status: string;
   resetsAt?: number;