@herbertgao/pi-extensions 2026.9.12 → 2026.9.13

package/node_modules/pi-multi-account/index.ts

@@ -474,6 +474,7 @@ import {
 	formatUsageCompact,
 	formatUsageDetails,
 	parseCodexUsageHeaders,
+	mergeUsageSnapshot,
 	providerUsageLabel,
 	remainingPercent,
 	usageColor,
@@ -530,6 +531,12 @@ type AnthropicOAuthAliasConfig = {
 type ProviderFailoverConfig = {
 	enabled?: boolean;
 	autoContinue?: boolean;
+	/**
+	 * Keep quota-blocked work armed when every compatible account is cooling, then resume in the
+	 * same live session as soon as any account is genuinely usable. Independent of the immediate
+	 * post-switch `autoContinue` setting. Default: true.
+	 */
+	resumeAfterAllAccountsRecover?: boolean;
 	autoDiscover?: boolean;
 	autoDiscoverModels?: boolean;
 	maxAccountsPerProvider?: number;
@@ -556,7 +563,8 @@ type ProviderFailoverConfig = {
 	 */
 	onlyActive?: boolean;
 	/**
-	 * Provider ids this extension must never fail away from, even on an actionable error.
+	 * Provider ids whose foreground route this extension must not automatically change,
+	 * including preflight with stale cooldowns and actionable response errors.
 	 *
 	 * For providers we do not manage (no cooldown/refresh lifecycle of ours) that run their own
 	 * retry logic — typically a companion extension that owns retries for that provider. Failing
@@ -655,6 +663,7 @@ type RuntimeConfig = Required<
 		ProviderFailoverConfig,
 		| "enabled"
 		| "autoContinue"
+		| "resumeAfterAllAccountsRecover"
 		| "autoDiscover"
 		| "autoDiscoverModels"
 		| "maxAccountsPerProvider"
@@ -1186,7 +1195,7 @@ const ANTI_PINGPONG_MS = 60 * 1000; // don't switch straight back to the account
 // Bumped on every release. Printed at startup and in `/multi-account status` so you can verify
 // which version Pi actually loaded (a running Pi keeps the version it started with — /login and
 // /reload do NOT reload extension code; only a full restart does).
-const VERSION = "1.22.0";
+const VERSION = "1.23.0";
 function sourceFingerprint(): string {
 	try {
 		const root = dirname(fileURLToPath(import.meta.url));
@@ -1766,6 +1775,7 @@ const DEFAULT_CURSOR_MODELS = ["cursor-grok-4.6", "grok-4.6", "composer-2.5"];
 const DEFAULT_CONFIG: ProviderFailoverConfig = {
 	enabled: true,
 	autoContinue: true,
+	resumeAfterAllAccountsRecover: true,
 	autoDiscover: true,
 	autoDiscoverModels: true,
 	maxAccountsPerProvider: 10,
@@ -1915,6 +1925,8 @@ function normalizeConfig(raw: ProviderFailoverConfig): RuntimeConfig {
 	return {
 		enabled: raw.enabled ?? true,
 		autoContinue: raw.autoContinue ?? true,
+		resumeAfterAllAccountsRecover:
+			raw.resumeAfterAllAccountsRecover ?? true,
 		autoDiscover: raw.autoDiscover ?? true,
 		autoDiscoverModels: raw.autoDiscoverModels ?? true,
 		maxAccountsPerProvider: Math.max(
@@ -3032,7 +3044,7 @@ function registerCodexSlot(
 	pi: ExtensionAPI,
 	id: string,
 	models: Array<Record<string, unknown>> = DEFAULT_CODEX_MODELS.map(codexModelDef),
-	baseUrl = "https://chatgpt.com/backend-api",
+	baseUrl: string,
 ) {
 	if (id === CODEX_BASE) return; // base provider is native until live catalog sync enriches it
 	pi.registerProvider(id, {
@@ -3049,7 +3061,7 @@ function registerCodexCatalog(
 	pi: ExtensionAPI,
 	id: string,
 	models: Array<Record<string, unknown>>,
-	baseUrl = "https://chatgpt.com/backend-api",
+	baseUrl: string,
 ) {
 	const name =
 		id === CODEX_BASE
@@ -3536,7 +3548,7 @@ const MINIMAL_ANTHROPIC_OAUTH_PROMPT = [
 ].join("\n");
 const CLAUDE_CODE_IDENTITY_PREFIX =
 	"You are Claude Code, Anthropic's official CLI";
-const CLAUDE_CODE_VERSION = "2.1.274";
+const CLAUDE_CODE_VERSION = "2.1.280";
 const BILLING_HEADER_SALT = "59cf53e54c78";
 const BILLING_HEADER_POSITIONS = [4, 7, 20] as const;
 const CLAUDE_CODE_ENTRYPOINT = "sdk-cli";
@@ -4264,8 +4276,15 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 	let usageStatusTimer: ReturnType<typeof setInterval> | undefined;
 	// Pending work is session-local. The shared state file may contain another Pi window's marker;
 	// using that marker as this window's runtime state makes two unrelated tasks resume each other.
+	type PendingResumeMode = "auto-continue" | "quota-recovery";
 	let pendingResume:
-		| { from: ModelRef; reason: string; since: number; retryAt?: number }
+		| {
+				from: ModelRef;
+				reason: string;
+				since: number;
+				retryAt?: number;
+				mode: PendingResumeMode;
+			}
 		| undefined;
 
 	// ----- the governor ----------------------------------------------------
@@ -5026,7 +5045,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 				pi,
 				provider,
 				ranked,
-				numberedSlotBaseUrl(provider, "anthropic"),
+				numberedAnthropicBaseUrl(provider),
 			);
 		}
 	}
@@ -5053,7 +5072,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 				pi,
 				provider,
 				merged as Array<Record<string, unknown>>,
-				numberedSlotBaseUrl(provider, "codex"),
+				numberedCodexBaseUrl(provider),
 			);
 		}
 	}
@@ -5149,7 +5168,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 				models as Array<Record<string, unknown>>,
 				provider === CODEX_BASE
 					? "https://chatgpt.com/backend-api"
-					: numberedSlotBaseUrl(provider, "codex"),
+					: numberedCodexBaseUrl(provider),
 			);
 		}
 		// Also keep unauthenticated spare login slots current so a newly logged-in account can select
@@ -5161,7 +5180,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 				pi,
 				provider,
 				allKnown as Array<Record<string, unknown>>,
-				numberedSlotBaseUrl(provider, "codex"),
+				numberedCodexBaseUrl(provider),
 			);
 		}
 		if (changed) persist();
@@ -5374,6 +5393,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 
 	function storeUsage(ctx: any, snapshot: UsageSnapshot): boolean {
 		if (!usageSnapshotIsCurrent(snapshot)) return false;
+		snapshot = mergeUsageSnapshot(usageByProvider.get(snapshot.provider), snapshot);
 		usageByProvider.set(snapshot.provider, snapshot);
 		usageErrors.delete(snapshot.provider);
 		// AUTHORITATIVE PROACTIVE BENCH. If the account's own usage endpoint reports a hard block (a
@@ -6110,14 +6130,32 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 	 * enabled) and acts only on a FRESH cached snapshot, so resume is never stalled on a slow probe
 	 * and a stale pre-limit reading can never clear a cooldown prematurely.
 	 */
-	function reconcileCooldownsFromUsage(ctx: any) {
+	function reconcileCooldownsFromUsage(
+		ctx: any,
+		options: { allowWhenHidden?: boolean } = {},
+	) {
 		const now = Date.now();
 		for (const [provider, until] of [...exhaustedUntilByProvider.entries()]) {
 			if (until <= now || isInvalidated(provider) || !usageFamily(provider))
 				continue;
-			runBackground("cooldown reconcile usage", ctx, () =>
-				refreshUsage(ctx, provider, true),
-			);
+			runBackground("cooldown reconcile usage", ctx, async () => {
+				const snapshot = await refreshUsage(
+					ctx,
+					provider,
+					true,
+					options.allowWhenHidden ?? false,
+				);
+				// A provider's fresh "usable now" verdict should shorten an already-armed
+				// multi-hour timer immediately. Schedule through the single owned timer rather
+				// than calling the resume body concurrently for every recovered account.
+				if (
+					snapshot &&
+					pendingResume?.mode === "quota-recovery" &&
+					providerRecoveryAt(provider) <= Date.now()
+				) {
+					schedulePendingWake(ctx);
+				}
+			});
 			const cached = usageByProvider.get(provider);
 			if (cached && now - cached.fetchedAt < usageCacheTtl(provider))
 				applyUsageToCooldown(provider, cached, now);
@@ -6389,7 +6427,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 						pi,
 						id,
 						DEFAULT_ANTHROPIC_MODELS,
-						numberedSlotBaseUrl(id, "anthropic"),
+						numberedAnthropicBaseUrl(id),
 					);
 				} else if (family === "openai-codex") {
 					const cached = codexModelCatalogByProvider.get(id)?.models;
@@ -6399,21 +6437,16 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 						config.autoDiscoverModels && cached?.length
 							? (cached as Array<Record<string, unknown>>)
 							: undefined,
-						numberedSlotBaseUrl(id, "codex"),
+						numberedCodexBaseUrl(id),
 					);
 				} else if (family === "kimi-coding") {
 					const kimiModels = [
 						...new Set([...DEFAULT_KIMI_MODELS, ...hostModelIdsFor(ctx, KIMI_BASE)]),
 					];
 					registerKimiSlot(pi, id, kimiModels);
-					// Provision into Pi's native registry so an extension-free child can RESOLVE the
-					// slot by name. That is all this buys: measured 2026-08-24, such a child then
-					// fails with "No API key found", because Pi honours an OAuth credential only
-					// for a provider definition that declares the flow and a models.json entry
-					// declares none. Making the slot genuinely usable needs the Cursor pattern — a
-					// parent-owned loopback route with a non-secret placeholder — which Kimi does
-					// not have yet. See child-usability.ts.
-					if (ownsSharedChildPublication()) {
+					// An in-memory OAuth spare belongs in /login, not in models.json. Kimi has
+					// no child OAuth proxy, so only a real API-key slot is usable by a bare child.
+					if (ownsSharedChildPublication() && auth[id]?.type === "api_key" && isEntryUsable(auth[id])) {
 						provisionNativeSlot(id, {
 							api: "anthropic-messages",
 							baseUrl: KIMI_BASE_URL,
@@ -6438,8 +6471,10 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 	 */
 	function publishOwnedNativeAliases(ctx?: any): void {
 		if (!ownsSharedChildPublication()) return;
+		const auth = readAuthFile();
 		for (const id of registeredSlots) {
 			if (classifyProvider(id, config.qwenProvider) !== "kimi-coding") continue;
+			if (auth[id]?.type !== "api_key" || !isEntryUsable(auth[id])) continue;
 			const kimiModels = [
 				...new Set([...DEFAULT_KIMI_MODELS, ...hostModelIdsFor(ctx, KIMI_BASE)]),
 			];
@@ -6914,6 +6949,12 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		);
 	}
 
+	function isFailoverExempt(provider: string | undefined): boolean {
+		return !!provider &&
+			!classifyProvider(provider, config.qwenProvider) &&
+			config.neverFailoverProviders.includes(provider);
+	}
+
 	async function activateFallback(
 		ctx: any,
 		sourceModel: any,
@@ -6921,6 +6962,9 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		reason: string,
 		options: { armContinuation?: boolean; manual?: boolean } = {},
 	) {
+		// All automatic foreground switches share this boundary. Explicit user switches
+		// remain allowed; an opted-out route belongs to Pi/the provider, not this router.
+		if (!options.manual && (isFailoverExempt(sourceModel?.provider) || isFailoverExempt(ctx.model?.provider))) return false;
 		const activationEpoch = chainEpoch;
 		const stale = () => sessionClosed || activationEpoch !== chainEpoch || (!options.manual && (userAbortedChain || ctx.signal?.aborted));
 		// A switch the user asked for is not an automatic step: it is never refused, and it clears
@@ -7030,8 +7074,11 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 			scope?: "provider" | "model";
 			excludeProviders?: Iterable<string>;
 			allowFailedRouteResume?: boolean;
+			/** This failure is real quota evidence; if no route is ready, use the separate wait option. */
+			waitForQuotaRecovery?: boolean;
 		} = {},
 	) {
+		if (!options.manual && (isFailoverExempt(failedModel?.provider) || isFailoverExempt(ctx.model?.provider))) return false;
 		const switchEpoch = chainEpoch;
 		if (!automaticFailoverEnabled() || !failedModel?.provider || !failedModel?.id)
 			return false;
@@ -7096,12 +7143,19 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 				`Provider failover: no immediately available fallback after ${failedModel.provider}/${failedModel.id}. ${availability || "All known accounts may be unauthenticated, invalidated, or duplicate slots."}`,
 				"warning",
 			);
+			const shouldWait = options.waitForQuotaRecovery
+				? config.resumeAfterAllAccountsRecover
+				: config.autoContinue;
 			if (
 				!options.manual &&
-				config.autoContinue &&
+				shouldWait &&
 				options.allowFailedRouteResume !== false
 			)
-				setPendingContinuation(ctx, failedModel, reason);
+				setPendingContinuation(ctx, failedModel, reason, {
+					mode: options.waitForQuotaRecovery
+						? "quota-recovery"
+						: "auto-continue",
+				});
 			return false;
 		}
 
@@ -7287,7 +7341,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		// The launch candidate is authoritative in a pi-subagents child. Let the
 		// request produce its real error so the parent runner can advance its own
 		// fallbackModels chain instead of starting a competing router here.
-		if (subagentChild) return true;
+		if (subagentChild || isFailoverExempt(ctx.model?.provider)) return true;
 		refreshDiscovery(false, ctx);
 		pruneCooldowns();
 		const intended = intendedStartupModel();
@@ -7301,7 +7355,9 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		if (!hostOwnsSessionModel && intended && !onIntended) {
 			await restoreRememberedModel(ctx);
 		}
-		if (isCurrentModelReady(ctx)) return true;
+		// Restoration can change the provider on legacy hosts. Opt-out means pass the
+		// request to Pi even when our cached cooldown/auth forecast says unavailable.
+		if (isFailoverExempt(ctx.model?.provider) || isCurrentModelReady(ctx)) return true;
 		// The user chose this account by hand and has not spent the attempt yet. Let the request
 		// through: our reason for believing it unusable is a forecast, and this is the only way
 		// anyone finds out the forecast was stale. Merely being asked about it never spends it —
@@ -7331,6 +7387,15 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		return !!pendingResume;
 	}
 
+	function pendingResumeEnabled(
+		pending = pendingResume,
+	): boolean {
+		if (!pending) return false;
+		return pending.mode === "quota-recovery"
+			? config.resumeAfterAllAccountsRecover
+			: config.autoContinue;
+	}
+
 	// Reject a promise that does not settle within `ms`. Used to bound every network-bound
 	// hand-off (compaction summary) so a wedged provider call can never hang the session.
 	// `onTimeout` MUST abort the underlying work — otherwise the timed-out compact() keeps
@@ -7876,10 +7941,14 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 	// continueAgent() cannot pick up. Inject the continuation prompt as a fresh USER turn so the
 	// session keeps moving on the account we just switched to, WITHOUT the user re-typing anything.
 	// Bounded by maxAutoContinuesPerPrompt. Returns true when it started a continuation turn.
-	function injectContinuationPrompt(
+	async function injectContinuationPrompt(
 		ctx: any,
-		resumeFrom?: { from?: ModelRef; reason?: string },
-	): boolean {
+		resumeFrom?: {
+			from?: ModelRef;
+			reason?: string;
+			allowWhenAutoContinueDisabled?: boolean;
+		},
+	): Promise<boolean> {
 		// `currentPromptSwitch` is set ONLY when we actually rotated accounts. The pending-resume
 		// path (transient overload, or a cooldown that expired on the same account) deliberately
 		// returns to the SAME account, so it never has a switch record. Requiring one here meant
@@ -7889,7 +7958,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		const source = currentPromptSwitch ?? resumeFrom;
 		const blocked = !source
 			? "no switch or resume context"
-			: !config.autoContinue
+			: !config.autoContinue && !resumeFrom?.allowWhenAutoContinueDisabled
 				? "autoContinue disabled"
 				: userAbortedChain
 					? "user aborted the chain"
@@ -7913,7 +7982,9 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 				: "the active account");
 		const sameModelRetry = source?.from === to;
 		const prompt = sameModelRetry
-			? `Provider retry activated: retrying ${to} after a temporary failure; no account or model switch occurred. Continue the interrupted task from where it stopped. The interrupted turn is preserved verbatim in this session as a [handoff:interrupted-turn] record — read it before acting and do not restart the task from the beginning.`
+			? resumeFrom?.allowWhenAutoContinueDisabled
+				? `Provider quota recovery activated: ${to} is usable again after every compatible account was limited. Continue the interrupted task from where it stopped. The interrupted turn is preserved verbatim in this session as a [handoff:interrupted-turn] record — read it before acting and do not restart the task from the beginning.`
+				: `Provider retry activated: retrying ${to} after a temporary failure; no account or model switch occurred. Continue the interrupted task from where it stopped. The interrupted turn is preserved verbatim in this session as a [handoff:interrupted-turn] record — read it before acting and do not restart the task from the beginning.`
 			: config.continuationPrompt
 					.replaceAll("{from}", String(source?.from ?? "the previous account"))
 					.replaceAll("{to}", String(to))
@@ -7928,21 +7999,11 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 			// current turn settles instead of being rejected; the host ignores it when not streaming.
 			// `sendUserMessage` is async on the host: a rejected promise would otherwise escape this
 			// synchronous try/catch as an unhandled rejection AND still report success here.
-			const dispatched = pi.sendUserMessage(prompt, {
-				deliverAs: "followUp",
-			}) as unknown;
-			if (
-				dispatched &&
-				typeof (dispatched as Promise<void>).catch === "function"
-			) {
-				(dispatched as Promise<void>).catch((error) => {
-					expectingInjectedContinuation = false;
-					logEvent("continuation_injection_failed", {
-						error: String(error).slice(0, 200),
-					});
-					reportExtensionError("continuation injection", error, ctx);
-				});
-			}
+			await Promise.resolve(
+				pi.sendUserMessage(prompt, {
+					deliverAs: "followUp",
+				}),
+			);
 			logEvent("continuation_injected", {
 				session: sessionInstanceId,
 				from: source?.from,
@@ -7964,7 +8025,11 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		ctx: any,
 		// Set by the pending-resume path, which returns to the SAME account and therefore has no
 		// `currentPromptSwitch`. Without it the prompt-injection fallback refuses to fire.
-		resumeFrom?: { from?: ModelRef; reason?: string },
+		resumeFrom?: {
+			from?: ModelRef;
+			reason?: string;
+			allowWhenAutoContinueDisabled?: boolean;
+		},
 	): Promise<boolean> {
 		const resumeEpoch = chainEpoch;
 		if (sessionClosed || userAbortedChain || ctx.signal?.aborted) return false;
@@ -7984,7 +8049,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 			// @earendil-works/pi-coding-agent). Do NOT dead-end the failover with a red error that
 			// leaves the user reloading by hand: fall back to injecting the continuation prompt so the
 			// work resumes by itself on the account we just switched to.
-			if (injectContinuationPrompt(ctx, resumeFrom)) return true;
+			if (await injectContinuationPrompt(ctx, resumeFrom)) return true;
 			// Reaching here means the injection fallback ALSO declined — the reason is in the
 			// debug log as continuation_injection_blocked/_failed. Do not blame the Pi build:
 			// the missing pi.continueAgent is only why we took the fallback path, never why the
@@ -8061,10 +8126,10 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 				// continuation prompt as a user message instead. That always starts a turn, so the
 				// session keeps moving by itself (this is how auto-recovery after a watchdog abort
 				// continues without the user re-typing anything). Bounded by maxAutoContinuesPerPrompt.
-				if (injectContinuationPrompt(ctx, resumeFrom)) return true;
-				// Nothing to continue (spurious) or injection unavailable — drop stale state quietly.
-				currentPromptSwitch = undefined;
-				clearPendingContinuation();
+				if (await injectContinuationPrompt(ctx, resumeFrom)) return true;
+				// Keep the selected route/context available to the caller. A host can reject a
+				// follow-up during a narrow busy race; dropping the switch here turns that transient
+				// rejection into a permanently stopped task.
 				return false;
 			}
 			noteRecoveryFailure(ctx);
@@ -8078,15 +8143,24 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		}
 	}
 
-	async function maybeDispatchContinuation(ctx: any): Promise<boolean> {
+	async function maybeDispatchContinuation(
+		ctx: any,
+		options: {
+			allowWhenAutoContinueDisabled?: boolean;
+			pendingMode?: PendingResumeMode;
+		} = {},
+	): Promise<boolean> {
+		const allowRecoveryResume =
+			options.allowWhenAutoContinueDisabled === true;
 		if (
-			!config.autoContinue ||
+			(!config.autoContinue && !allowRecoveryResume) ||
 			userAbortedChain ||
 			ctx.signal?.aborted ||
 			!currentPromptSwitch ||
 			autoContinuesThisPrompt >= config.maxAutoContinuesPerPrompt
 		)
 			return false;
+		const dispatchSwitch = currentPromptSwitch;
 		// Circuit breaker open → advisory mode. The account switch already happened (useful);
 		// we just don't attempt the auto-resume that has been failing. The user's next message
 		// runs on the fresh account. This is the floor: never worse than switching by hand.
@@ -8107,18 +8181,46 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		if (!isCurrentModelReady(ctx)) {
 			const failed =
 				ctx.model?.provider && ctx.model?.id ? ctx.model : undefined;
-			if (failed && config.autoContinue) {
+			if (failed && (config.autoContinue || allowRecoveryResume)) {
 				setPendingContinuation(
 					ctx,
 					failed,
-					currentPromptSwitch?.reason ?? "account is cooling down",
+					dispatchSwitch.reason || "account is cooling down",
+					{ mode: options.pendingMode ?? "auto-continue" },
 				);
 			}
 			return false;
 		}
-		const resumed = await resumeWithExistingContext(ctx);
-		if (resumed) continuationDispatchedForAgentTurn = true;
-		return resumed;
+		const resumed = await resumeWithExistingContext(ctx, {
+			from: dispatchSwitch.from,
+			reason: dispatchSwitch.reason,
+			allowWhenAutoContinueDisabled: allowRecoveryResume,
+		});
+		if (resumed) {
+			continuationDispatchedForAgentTurn = true;
+			return true;
+		}
+		// `sendUserMessage(..., followUp)` can reject asynchronously if the host is still
+		// crossing a turn boundary. Preserve the selected fallback and retry there instead of
+		// reporting a switch whose task never actually continued.
+		if (
+			!hasPendingResume() &&
+			currentPromptSwitch === dispatchSwitch &&
+			!sessionClosed &&
+			!userAbortedChain &&
+			!ctx.signal?.aborted
+		) {
+			const failed =
+				ctx.model?.provider && ctx.model?.id ? ctx.model : undefined;
+			if (failed)
+				setPendingContinuation(
+					ctx,
+					failed,
+					`${SELECTED_FALLBACK_PENDING_PREFIX} ${dispatchSwitch.reason}`,
+					{ mode: options.pendingMode ?? "auto-continue" },
+				);
+		}
+		return false;
 	}
 
 	// ----- the governor, continued -----------------------------------------
@@ -8366,7 +8468,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 			!hasPendingResume() ||
 			userAbortedChain ||
 			!automaticFailoverEnabled() ||
-			!config.autoContinue
+			!pendingResumeEnabled()
 		)
 			return;
 		const delay = nextPendingWakeDelayMs();
@@ -8395,7 +8497,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 			isBreakerOpen() ||
 			userAbortedChain ||
 			!automaticFailoverEnabled() ||
-			!config.autoContinue
+			!pendingResumeEnabled()
 		)
 			return;
 		if (!ctx.isIdle()) {
@@ -8428,10 +8530,15 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		}
 
 		refreshDiscovery();
-		reconcileCooldownsFromUsage(ctx);
+		reconcileCooldownsFromUsage(ctx, {
+			allowWhenHidden: pendingResume?.mode === "quota-recovery",
+		});
 		pruneCooldowns();
-		const parsedFrom = pendingResume?.from
-			? parseTarget(pendingResume.from)
+		const pendingSnapshot = pendingResume;
+		const pendingMode = pendingSnapshot?.mode ?? "auto-continue";
+		const allowRecoveryResume = pendingMode === "quota-recovery";
+		const parsedFrom = pendingSnapshot?.from
+			? parseTarget(pendingSnapshot.from)
 			: undefined;
 		const sourceModel = parsedFrom
 			? {
@@ -8439,7 +8546,8 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 					id: parsedFrom.modelId ?? ctx.model?.id,
 				}
 			: ctx.model;
-		if (!sourceModel?.provider || !sourceModel?.id) {
+		if (!sourceModel?.provider || !sourceModel?.id ||
+			isFailoverExempt(sourceModel.provider) || isFailoverExempt(ctx.model?.provider)) {
 			clearPendingContinuation();
 			return;
 		}
@@ -8448,10 +8556,10 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		// NOT account/model failures: retry the SAME account/model after any brief cooldown —
 		// never rotate to a sibling model (which would silently downgrade e.g. gpt-5.5 → gpt-5.4
 		// on the same account, whose quota is shared, so the downgrade escapes nothing).
-		if (isSameModelResumeReason(pendingResume?.reason ?? "")) {
+		if (isSameModelResumeReason(pendingSnapshot?.reason ?? "")) {
 			const now = Date.now();
-			if (providerRecoveryAt(sourceModel.provider, now) <= now && (pendingResume?.retryAt ?? now) <= now) {
-				const resumeReason = pendingResume?.reason;
+			if (providerRecoveryAt(sourceModel.provider, now) <= now && (pendingSnapshot?.retryAt ?? now) <= now) {
+				const resumeReason = pendingSnapshot?.reason;
 				clearPendingContinuation();
 				const same = ref(sourceModel.provider, sourceModel.id);
 				// Deliberately NOT routed through the governor: this is not a rotation, it is
@@ -8482,17 +8590,32 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 				// Pass the context explicitly or the injection fallback declines and the user has
 				// to re-send the prompt by hand.
 				if (epoch !== chainEpoch || sessionClosed) return;
-				await resumeWithExistingContext(ctx, {
+				const resumed = await resumeWithExistingContext(ctx, {
 					from: same,
 					reason: resumeReason,
+					allowWhenAutoContinueDisabled: allowRecoveryResume,
 				});
+				if (
+					!resumed &&
+					!hasPendingResume() &&
+					epoch === chainEpoch &&
+					!sessionClosed &&
+					!userAbortedChain
+				) {
+					setPendingContinuation(
+						ctx,
+						sourceModel,
+						`${SELECTED_FALLBACK_PENDING_PREFIX} ${resumeReason ?? "retry continuation"}`,
+						{ mode: pendingMode },
+					);
+				}
 				return;
 			}
 			schedulePendingWake(ctx);
 			return;
 		}
 
-		const pendingReason = pendingResume?.reason ?? "";
+		const pendingReason = pendingSnapshot?.reason ?? "";
 		const now = Date.now();
 		const sourceRef = ref(sourceModel.provider, sourceModel.id);
 		const sourceRecovered =
@@ -8531,10 +8654,25 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 				// The original account came back and there is no alternative: this is also a
 				// same-account resume with no switch record.
 				if (epoch !== chainEpoch || sessionClosed) return;
-				await resumeWithExistingContext(ctx, {
+				const resumed = await resumeWithExistingContext(ctx, {
 					from: sourceRef,
-					reason: pendingResume?.reason,
+					reason: pendingReason,
+					allowWhenAutoContinueDisabled: allowRecoveryResume,
 				});
+				if (
+					!resumed &&
+					!hasPendingResume() &&
+					epoch === chainEpoch &&
+					!sessionClosed &&
+					!userAbortedChain
+				) {
+					setPendingContinuation(
+						ctx,
+						sourceModel,
+						`${SELECTED_FALLBACK_PENDING_PREFIX} ${pendingReason || "quota recovery"}`,
+						{ mode: pendingMode },
+					);
+				}
 				return;
 			}
 			// Nothing to move to. The wait itself achieved nothing, so slow it down before the
@@ -8544,7 +8682,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 			return;
 		}
 
-		const reason = pendingResume?.reason ?? "account cooldown expired";
+		const reason = pendingReason || "account cooldown expired";
 		const switched = await activateFallback(
 			ctx,
 			sourceModel,
@@ -8562,30 +8700,46 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		// precisely the move that used to be free and therefore unbounded.
 		pendingResumeHops++;
 		clearPendingContinuation();
-		const dispatched = await maybeDispatchContinuation(ctx);
+		const dispatched = await maybeDispatchContinuation(ctx, {
+			allowWhenAutoContinueDisabled: allowRecoveryResume,
+			pendingMode,
+		});
 		if (epoch !== chainEpoch) return;
 		if (dispatched) resetPendingWakeBackoff();
 		else growPendingWakeBackoff();
 	}
 
-	function setPendingContinuation(ctx: any, failedModel: any, reason: string) {
+	function setPendingContinuation(
+		ctx: any,
+		failedModel: any,
+		reason: string,
+		options: {
+			mode?: PendingResumeMode;
+			retryDelayMs?: number;
+		} = {},
+	) {
 		// A stop that leaves an armed resume behind in the state file is not a stop: the next
 		// session reads it, `status` reports work pending, and the user is told something is
 		// waiting to continue when nothing is.
-		if (governorStopped() || isBreakerOpen()) return;
+		if (governorStopped() || isBreakerOpen() || userAbortedChain) return;
 		const from = ref(failedModel.provider, failedModel.id);
 		const alreadyPending = hasPendingResume();
+		const mode = options.mode ?? "auto-continue";
 		pendingResume = {
 			from,
 			reason,
+			mode,
 			since: pendingResume?.since ?? Date.now(),
 			// Backoff belongs to this attempt, never shared account/quota health.
-			retryAt: isTransientPendingReason(reason) ? Date.now() + config.transientCooldownMs : undefined,
+			retryAt: isTransientPendingReason(reason)
+				? Date.now() + (options.retryDelayMs ?? config.transientCooldownMs)
+				: undefined,
 		};
 		logEvent("pending_resume_set", {
 			session: sessionInstanceId,
 			from,
 			reason,
+			mode,
 		});
 		persistedState = {
 			...persistedState,
@@ -8624,7 +8778,12 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 
 	// A failed Run is not a failed subscription. Retry the exact route; neither
 	// repeated 5xx nor a watchdog proves that another provider is authorized.
-	function retryTemporaryFailure(ctx: any, failedModel: { provider: string; id: string }, errorText: string) {
+	function retryTemporaryFailure(
+		ctx: any,
+		failedModel: { provider: string; id: string },
+		errorText: string,
+		retryDelayMs = config.transientCooldownMs,
+	) {
 		const cursorStall = isCursorProviderId(failedModel.provider) && isCursorUpstreamStall(errorText);
 		const failures = cursorStall ? noteCursorStallFailure(failedModel) : noteTransientFailure(failedModel);
 		if (continuationDispatchedForAgentTurn || activeResumeWatch) noteRecoveryFailure(ctx);
@@ -8648,7 +8807,12 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 			ctx.ui.notify(`Provider retry: temporary error on ${failedModel.provider}/${failedModel.id}; automatic retry is disabled. Provider and model were NOT changed.`, "warning");
 			return;
 		}
-		setPendingContinuation(ctx, failedModel, `${TRANSIENT_PENDING_PREFIX} ${errorText.slice(0, 120)}`);
+		setPendingContinuation(
+			ctx,
+			failedModel,
+			`${TRANSIENT_PENDING_PREFIX} ${errorText.slice(0, 120)}`,
+			{ retryDelayMs },
+		);
 	}
 
 	// ----- cold-start input hold -------------------------------------------
@@ -8930,6 +9094,63 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 			return;
 		}
 
+		if (command === "pick") {
+			if (!ctx.hasUI || !ctx.model || !ctx.isIdle() || subagentChild || sessionClosed) {
+				ctx.ui.notify("pi-multi-account: model picker needs an idle interactive session with an active model", "warning");
+				return;
+			}
+			const provider = ctx.model.provider;
+			const epoch = chainEpoch;
+			const models = ctx.modelRegistry.getAvailable().filter((model: any) => model.provider === provider);
+			const choices = [...new Set<string>(models.map((model: any) => model.id))].sort();
+			if (!choices.length) {
+				ctx.ui.notify(`pi-multi-account: no available models for ${provider}`, "warning");
+				return;
+			}
+			const choice = await ctx.ui.select(`Models — ${provider}`, choices);
+			if (!choice || sessionClosed || epoch !== chainEpoch || !ctx.isIdle() || ctx.model?.provider !== provider) return;
+			const model = models.find((candidate: any) => candidate.id === choice);
+			if (!model) return;
+			// Use the native manual-selection path: it applies this model's thinking default
+			// and emits model_select. Do not restore the previous model's effort as failover does.
+			if (await setModelEnsuringVisible(model, ctx)) {
+				ctx.ui.notify(`pi-multi-account: selected ${provider}/${choice}; use /multi-account save-default to keep this model and thinking for new sessions`, "info");
+			}
+			return;
+		}
+
+		if (command === "save-default") {
+			if (!ctx.model || !ctx.isIdle() || subagentChild || sessionClosed) {
+				ctx.ui.notify("pi-multi-account: save defaults from an idle parent session with an active model", "warning");
+				return;
+			}
+			const { provider, id } = ctx.model;
+			const epoch = chainEpoch;
+			const level = readThinkingLevel();
+			if (!level) {
+				ctx.ui.notify("pi-multi-account: host cannot report the active thinking level; defaults were not changed", "warning");
+				return;
+			}
+			// Public, lock-backed settings API merges only changed fields. Never persist on
+			// automatic failover or shutdown, where another session may own the defaults.
+			const { SettingsManager } = await import("@earendil-works/pi-coding-agent");
+			if (sessionClosed || epoch !== chainEpoch || !ctx.isIdle() ||
+				ctx.model?.provider !== provider || ctx.model?.id !== id || readThinkingLevel() !== level) return;
+			const settings = SettingsManager.create(ctx.cwd, AGENT_DIR, {
+				projectTrusted: ctx.isProjectTrusted?.() ?? false,
+			});
+			settings.setDefaultModelAndProvider(provider, id);
+			settings.setModelThinkingLevel(provider, id, level);
+			await settings.flush();
+			if (settings.drainErrors().length) {
+				ctx.ui.notify("pi-multi-account: could not save all startup settings; check settings.json permissions and syntax", "error");
+				return;
+			}
+			const overridden = settings.getDefaultProvider() !== provider || settings.getDefaultModel() !== id || settings.getModelThinkingLevel(provider, id) !== level;
+			ctx.ui.notify(`pi-multi-account: saved global startup default ${provider}/${id} • ${level}.${overridden ? " Project settings override this choice in this workspace." : " Applies to new sessions; explicit CLI options and resumed sessions keep their own settings."}`, overridden ? "warning" : "info");
+			return;
+		}
+
 		if (command === "models" || command === "model") {
 			// Show, per account in the rotation, the model order this extension would use
 			// (★ = the one that would be selected). Lets you SEE whether the latest model is
@@ -8982,6 +9203,10 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 			}
 			refreshDiscovery(true, ctx);
 			startUsageStatusTimer(ctx);
+			if (hasPendingResume()) {
+				if (pendingResumeEnabled()) schedulePendingWake(ctx);
+				else clearPendingContinuation();
+			}
 			runBackground("reload account metadata refresh", ctx, async () => {
 				await refreshRotationUsage(ctx);
 				await syncCodexModelCatalog(ctx, true);
@@ -9507,7 +9732,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 			else clearOnlyActiveFilter();
 			ctx.ui.notify(
 				next2
-					? "pi-multi-account: only-active ON preference saved; Pi has no separate picker filter, so all registered models remain available"
+					? "pi-multi-account: only-active ON preference saved; use /multi-account pick for current-account models. The built-in /model and shared registry remain complete"
 					: "pi-multi-account: only-active OFF — every provider's models restored",
 				"info",
 			);
@@ -9695,7 +9920,8 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 				`Cooldowns: ${cooldowns.length ? cooldowns.join(", ") : "none"}`,
 				`Next recovery: ${nextRecoveryStatus(ctx)}`,
 				`Invalidated (need re-login): ${invalids.length ? invalids.join(", ") : "none"}`,
-				`Pending auto-resume: ${hasPendingResume() ? `yes (reason: ${pendingResume?.reason ?? "unknown"})` : "none"}`,
+				`Continuation: immediate ${config.autoContinue ? "ON" : "OFF"} · after all-account quota recovery ${config.resumeAfterAllAccountsRecover ? "ON" : "OFF"}`,
+				`Pending auto-resume: ${hasPendingResume() ? `yes (${pendingResume?.mode ?? "unknown"}; reason: ${pendingResume?.reason ?? "unknown"})` : "none"}`,
 				`Queued user messages: ${queuedUserInputs.length}`,
 				`Resume watchdog: ${activeResumeWatch ? `watching${toolInFlight ? " · tool running" : ""}` : "idle"} · auto-recover ${config.autoRecoverStuck ? "ON" : "OFF"}`,
 				`Compaction routing: ${config.routeCompactionToHealthyAccount ? "to healthy account" : "off"}${compactionRoutedNote ? ` (last: ${compactionRoutedNote})` : ""}${lastContextOverflowAt ? ` · last overflow ${formatUntil(lastContextOverflowAt)}` : ""}`,
@@ -9740,7 +9966,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 				// list below, `switch` was effectively undiscoverable and `next` pressed repeatedly
 				// was the only way anyone found to reach a chosen account.
 				`Switch accounts: /multi-account best — jump straight to an account that can work now · /multi-account switch <provider> — e.g. /multi-account switch ${rotation.find((p) => p !== ctx.model?.provider) ?? rotation[0] ?? "<provider>"} · /multi-account next steps through the rotation in order`,
-				`Other commands: status | accounts [refresh] | best | priority [...] | limits [refresh] | models | log [N|on|off] | only-active [on|off] | rediscover | add [anthropic|codex|kimi|cursor|ollama|qwen] | remove [anthropic|codex|kimi|cursor|ollama|qwen|<provider-id>] | revive <provider|all> | clear | stop | reset | reload | enable | disable`,
+				`Other commands: status | accounts [refresh] | best | priority [...] | limits [refresh] | models | pick | save-default | log [N|on|off] | only-active [on|off] | rediscover | add [anthropic|codex|kimi|cursor|ollama|qwen] | remove [anthropic|codex|kimi|cursor|ollama|qwen|<provider-id>] | revive <provider|all> | clear | stop | reset | reload | enable | disable`,
 			].join("\n"),
 			"info",
 		);
@@ -10457,11 +10683,37 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		return proxyFamilyFor(slotId);
 	}
 
-	function numberedSlotBaseUrl(id: string, family: ProxyFamily): string {
+	//
+	// Behavior is unchanged from the single helper this replaced: a numbered Anthropic alias
+	// falls back to the public API when this process has no loopback route yet.
+	//
+	function numberedAnthropicBaseUrl(id: string): string {
+		if (typeof slotProxyPort === "number") return publishedRouteFor(slotProxyPort, id);
+		return "https://api.anthropic.com";
+	}
+
+	/**
+	 * Route for a numbered Codex alias.
+	 *
+	 * With `config.childProxy` enabled this extension publishes a child-facing placeholder into
+	 * auth.json. That placeholder is meaningless to ChatGPT: it is only ever valid against the
+	 * loopback route this extension serves, which swaps in the real OAuth credential. Sending
+	 * it to the public upstream is what produces "Could not parse your authentication token".
+	 *
+	 * So a numbered alias NEVER gets the public upstream while the proxy is enabled — not even
+	 * before the listener exists. The published route is deterministic (the canonical port is
+	 * the ownership token for it), so pointing there keeps the alias registered and resolvable
+	 * from the moment the extension loads, and whoever ends up owning that port serves the
+	 * slot. If the port is never served the request fails to connect, which is loud and
+	 * harmless — unlike a credential that reaches a provider that cannot read it.
+	 *
+	 * With the proxy disabled no placeholder is ever published: the real credential is what Pi
+	 * presents, so the public upstream is the correct destination.
+	 */
+	function numberedCodexBaseUrl(id: string): string {
 		if (typeof slotProxyPort === "number") return publishedRouteFor(slotProxyPort, id);
-		return family === "anthropic"
-			? "https://api.anthropic.com"
-			: "https://chatgpt.com/backend-api";
+		if (!config.childProxy) return "https://chatgpt.com/backend-api";
+		return publishedRouteFor(SLOT_PROXY_PORT, id);
 	}
 
 	function restoreChildFacingAuth(): void {
@@ -11140,7 +11392,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 	// the summary on a healthy account instead. If that cannot finish, we CANCEL — never return
 	// undefined onto a spent account, because Pi's default has no timeout of its own.
 	safeOn("session_before_compact", async (event: any, ctx: any) => {
-		if (!automaticFailoverEnabled()) return undefined;
+		if (!automaticFailoverEnabled() || isFailoverExempt(ctx.model?.provider)) return undefined;
 		if (event?.reason === "overflow") lastContextOverflowAt = Date.now();
 		const result = await runHealthyCompaction(event, ctx);
 		if (result !== undefined) return result;
@@ -11293,7 +11545,9 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 				model: ctx.model?.id,
 			});
 			ctx.ui.notify(
-				`pi-multi-account: no account is ready right now. Your message stays in Pi's transcript; if this request is refused, it will resume automatically when a compatible account recovers (next check in ~${formatDelay(delay)}).`,
+				config.resumeAfterAllAccountsRecover
+					? `pi-multi-account: no account is ready right now. Your message stays in Pi's transcript; if this request is refused, it will resume automatically when a compatible account recovers (next check in ~${formatDelay(delay)}).`
+					: `pi-multi-account: no account is ready right now. Your message stays in Pi's transcript, but resumeAfterAllAccountsRecover is off, so a refused request will not be resumed automatically.`,
 				"warning",
 			);
 			return { action: "continue" as const };
@@ -11543,9 +11797,13 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 			return;
 		}
 		if ((status === 429 || status === 402 || status === 403) && ctx.model) {
-			// Only set cooldown hints for providers this extension manages.
-			// Without this guard, a 429 on any provider pollutes cooldown state.
-			if (!classifyProvider(ctx.model.provider, config.qwenProvider)) return;
+			// Managed providers use these hints for every limit response. For unmanaged
+			// providers retain only 429 hints: they let a bodyless rate limit use the
+			// server's Retry-After instead of the six-hour quota cooldown.
+			if (
+				status !== 429 &&
+				!classifyProvider(ctx.model.provider, config.qwenProvider)
+			) return;
 			const cooldownMs = cooldownFromHeaders((event as any).headers ?? {});
 			if (cooldownMs !== undefined) {
 				responseCooldownHints.set(
@@ -11631,7 +11889,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 			// Opt-out for unmanaged providers that run their own retry logic (usually a companion
 			// extension owning retries for that provider). Switching accounts underneath it would
 			// fight those retries, so leave the turn alone entirely.
-			if (config.neverFailoverProviders.includes(provider)) {
+			if (isFailoverExempt(provider)) {
 				logEvent("failover_suppressed", {
 					provider,
 					model: modelId,
@@ -11643,6 +11901,16 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 				retryTemporaryFailure(ctx, failedModel, errorText);
 				return;
 			}
+			// A bodyless 429 proves throttling, not account-level credit exhaustion.
+			// Retry the same route after Retry-After (or the normal transient minute)
+			// instead of poisoning the whole provider for six hours.
+			if (/^429 status code \(no body\)$/i.test(errorText.trim())) {
+				const retryDelayMs =
+					responseCooldownHints.get(provider) ?? config.transientCooldownMs;
+				responseCooldownHints.delete(provider);
+				retryTemporaryFailure(ctx, failedModel, errorText, retryDelayMs);
+				return;
+			}
 			// A quota or authorization refusal is about the ACCOUNT, not the model, and it does not
 			// clear in a minute: an unmanaged account out of credits refuses everything until it is
 			// topped up. Benching only the model for `transientCooldownMs` let the very next switch
@@ -11657,7 +11925,10 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 					failedModel,
 					`external provider out of quota: ${errorText.slice(0, 100)}`,
 					accountLevel ? config.cooldownMs : config.transientCooldownMs,
-					{ scope: accountLevel ? "provider" : "model" },
+					{
+						scope: accountLevel ? "provider" : "model",
+						waitForQuotaRecovery: failureKind === "limit",
+					},
 				);
 			}
 			return;
@@ -11742,6 +12013,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 				failedModel,
 				`assistant error: ${errorText.slice(0, 120)}`,
 				cooldownMs,
+				{ waitForQuotaRecovery: true },
 			);
 			return;
 		}
@@ -11811,7 +12083,10 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		}
 		if (continuationDispatchedForAgentTurn) {
 			continuationDispatchedForAgentTurn = false;
-			return;
+			// The continuation itself may have hit quota and message_end may already have
+			// selected another account. Suppress only a duplicate end for the same attempt;
+			// never suppress the new switch that now needs its own continuation.
+			if (!currentPromptSwitch) return;
 		}
 		if (!config.enabled || !config.autoContinue || userAbortedChain) return;
 		await maybeDispatchContinuation(ctx);