@jameslovespancakes/pi-plus 1.0.12 → 1.0.14

package/src/domains/subscriptions/providers/oauth-pool.ts

@@ -1,28 +1,51 @@
 import { randomUUID } from "node:crypto";
-import type { ModelAuth, OAuthAuth, OAuthCredential, Provider } from "@earendil-works/pi-ai";
+import type { Api, ModelAuth, OAuthAuth, OAuthCredential, Provider } from "@earendil-works/pi-ai";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import type { AccountContext, AccountProvider, ManagedAccount, RoutingMode } from "../../../core/accounts/registry.ts";
-import { quotaStateFromHeaders, selectRoutingCandidate, type AccountQuotaState } from "../../../core/accounts/routing.ts";
 import {
-  loadOAuthPool,
+  quotaStateFromHeaders,
+  refreshAbortSignal,
+  selectRoutingCandidate,
+} from "../../../core/accounts/routing.ts";
+import {
   oauthIdentity,
-  saveOAuthAccount,
-  saveOAuthPool,
-  setOAuthPoolMode,
+  setPrimaryQuota,
+  sharedOAuthPoolStore,
   type PooledOAuthAccount,
+  type PooledOAuthStore,
 } from "../../../core/accounts/oauth-pool.ts";
 
-export interface PooledOAuthProviderSpec {
+export interface PooledOAuthProviderSpec<TApi extends Api> {
   id: string;
   label: string;
-  createProvider(): Provider;
+  createProvider(): Provider<TApi>;
+  /** Backing storage. Defaults to the shared pi-plus OAuth pool file. */
+  store?: PooledOAuthStore;
+  /** Confirmation shown before an interactive `add`. */
+  addPrompt?: string;
+  /** Display label for an account. */
+  describeAccount?(account: PooledOAuthAccount): string;
+  /** Stable identity used to reject a duplicate login. Defaults to JWT claims. */
+  identityOf?(access: string): string | undefined;
+  /**
+   * Records a response's quota signal against an account. Defaults to the
+   * generic `x-ratelimit-*` reader; providers with their own headers (Codex
+   * sends `x-codex-*`) override it. Must never throw: it runs inside the
+   * awaited `onResponse`, so a rejection would kill an in-flight stream.
+   */
+  recordQuota?(accountId: string, status: number, headers: Record<string, string>): void;
 }
 
+const MAIN = "main";
+
 const lastUsed = new Map<string, number>();
-const primaryQuota = new Map<string, AccountQuotaState>();
 const refreshes = new Map<string, Promise<PooledOAuthAccount>>();
 
-function oauthFor(spec: PooledOAuthProviderSpec): OAuthAuth {
+function storeFor<TApi extends Api>(spec: PooledOAuthProviderSpec<TApi>): PooledOAuthStore {
+  return spec.store ?? sharedOAuthPoolStore(spec.id);
+}
+
+function oauthFor<TApi extends Api>(spec: PooledOAuthProviderSpec<TApi>): OAuthAuth {
   const oauth = spec.createProvider().auth.oauth;
   if (!oauth) throw new Error(`${spec.label} does not expose subscription OAuth.`);
   return oauth;
@@ -44,7 +67,7 @@ async function notifyAuthEvent(ctx: AccountContext, event: any): Promise<void> {
   if (typeof event?.message === "string") ctx.ui.notify(event.message, "info");
 }
 
-async function authenticate(spec: PooledOAuthProviderSpec, ctx: AccountContext): Promise<OAuthCredential> {
+async function authenticate<TApi extends Api>(spec: PooledOAuthProviderSpec<TApi>, ctx: AccountContext): Promise<OAuthCredential> {
   const signal = ctx.signal ?? new AbortController().signal;
   return oauthFor(spec).login({
     signal,
@@ -64,111 +87,123 @@ async function authenticate(spec: PooledOAuthProviderSpec, ctx: AccountContext):
   });
 }
 
-function accountLabel(account: PooledOAuthAccount): string {
-  return account.label || account.identity || account.id.slice(0, 8);
+function accountLabel<TApi extends Api>(spec: PooledOAuthProviderSpec<TApi>, account: PooledOAuthAccount): string {
+  return spec.describeAccount?.(account) ?? (account.label || account.identity || account.id.slice(0, 8));
 }
 
-function duplicateAccount(spec: PooledOAuthProviderSpec, credential: OAuthCredential, excludeId?: string): PooledOAuthAccount | undefined {
-  const identity = oauthIdentity(credential.access);
-  return loadOAuthPool(spec.id).accounts.find((account) =>
+function identityFor<TApi extends Api>(spec: PooledOAuthProviderSpec<TApi>, access: string): string | undefined {
+  return (spec.identityOf ?? oauthIdentity)(access);
+}
+
+function duplicateAccount<TApi extends Api>(
+  spec: PooledOAuthProviderSpec<TApi>,
+  credential: OAuthCredential,
+  excludeId?: string,
+): PooledOAuthAccount | undefined {
+  const identity = identityFor(spec, credential.access);
+  return storeFor(spec).load().accounts.find((account) =>
     account.id !== excludeId && (identity ? account.identity === identity : account.access === credential.access));
 }
 
-export function createPooledOAuthAdapter(spec: PooledOAuthProviderSpec): AccountProvider {
+export function createPooledOAuthAdapter<TApi extends Api>(spec: PooledOAuthProviderSpec<TApi>): AccountProvider {
+  const store = () => storeFor(spec);
+
   return {
     id: spec.id,
     label: spec.label,
 
     async list(): Promise<ManagedAccount[]> {
-      return loadOAuthPool(spec.id).accounts.map((account) => ({
-        id: account.id,
-        label: accountLabel(account),
-        enabled: account.enabled !== false,
-        expiresAt: account.expires,
-      }));
+      return store().load().accounts.map((account) => {
+        const identity = account.identity ?? identityFor(spec, account.access);
+        return {
+          id: account.id,
+          label: accountLabel(spec, account),
+          enabled: account.enabled !== false,
+          expiresAt: account.expires,
+          ...(identity && { identity }),
+        };
+      });
     },
 
+    identify: (accessToken) => identityFor(spec, accessToken),
+
     async add(ctx, label): Promise<string | undefined> {
-      if (!await ctx.ui.confirm(`Add ${spec.label} account`, `Sign in with another ${spec.label} subscription?`)) {
-        return undefined;
-      }
+      const prompt = spec.addPrompt ?? `Sign in with another ${spec.label} subscription?`;
+      if (!await ctx.ui.confirm(`Add ${spec.label} account`, prompt)) return undefined;
+
       const credential = await authenticate(spec, ctx);
       const duplicate = duplicateAccount(spec, credential);
-      if (duplicate) throw new Error(`That account is already saved as “${accountLabel(duplicate)}”.`);
+      if (duplicate) throw new Error(`That account is already saved as “${accountLabel(spec, duplicate)}”.`);
 
-      saveOAuthAccount(spec.id, {
+      store().saveAccount({
         ...credential,
         id: randomUUID(),
         label,
         enabled: true,
-        identity: oauthIdentity(credential.access),
+        identity: identityFor(spec, credential.access),
         addedAt: Date.now(),
       });
       return label;
     },
 
     async reauth(ctx, accountId): Promise<string | undefined> {
-      const account = loadOAuthPool(spec.id).accounts.find(
+      const account = store().load().accounts.find(
         (candidate) => candidate.id === accountId || candidate.label === accountId,
       );
       if (!account) throw new Error(`${spec.label} account “${accountId}” not found.`);
 
       const credential = await authenticate(spec, ctx);
       const duplicate = duplicateAccount(spec, credential, account.id);
-      if (duplicate) throw new Error(`That account is already saved as “${accountLabel(duplicate)}”.`);
-      saveOAuthAccount(spec.id, {
+      if (duplicate) throw new Error(`That account is already saved as “${accountLabel(spec, duplicate)}”.`);
+      store().saveAccount({
         ...account,
         ...credential,
-        identity: oauthIdentity(credential.access),
+        identity: identityFor(spec, credential.access),
       });
       return account.label;
     },
 
     async setEnabled(accountId, enabled): Promise<void> {
-      const pool = loadOAuthPool(spec.id);
-      const account = pool.accounts.find((candidate) => candidate.id === accountId);
+      const account = store().load().accounts.find((candidate) => candidate.id === accountId);
       if (!account) throw new Error(`${spec.label} account “${accountId}” not found.`);
-      account.enabled = enabled;
-      saveOAuthPool(spec.id, pool);
+      store().saveAccount({ ...account, enabled });
     },
 
     async rename(accountId, label): Promise<void> {
-      const pool = loadOAuthPool(spec.id);
-      const account = pool.accounts.find((candidate) => candidate.id === accountId);
+      const account = store().load().accounts.find((candidate) => candidate.id === accountId);
       if (!account) throw new Error(`${spec.label} account “${accountId}” not found.`);
-      account.label = label;
-      saveOAuthPool(spec.id, pool);
+      store().saveAccount({ ...account, label });
     },
 
     routing: {
       async get(): Promise<RoutingMode> {
-        return loadOAuthPool(spec.id).mode;
+        return store().load().mode;
       },
       async set(mode): Promise<RoutingMode> {
-        setOAuthPoolMode(spec.id, mode);
+        store().saveMode(mode);
         return mode;
       },
       describe(mode): string {
         return mode === "quota-aware"
-          ? `Uses ${spec.label} quota headers when available, otherwise rotates fairly.`
-          : `Uses ${spec.label} accounts in order, moving on when one is rate-limited.`;
+          ? `Uses the ${spec.label} subscription with the most remaining quota.`
+          : `Uses ${spec.label} subscriptions in order, moving on when one is exhausted.`;
       },
     },
   };
 }
 
-function chooseCredential(
-  spec: PooledOAuthProviderSpec,
+export function chooseCredential<TApi extends Api>(
+  spec: PooledOAuthProviderSpec<TApi>,
   primary: OAuthCredential,
 ): { id: string; credential: OAuthCredential; account?: PooledOAuthAccount } {
-  const pool = loadOAuthPool(spec.id);
+  const pool = storeFor(spec).load();
   const candidates = [
     {
-      id: "main",
+      id: MAIN,
       order: 0,
-      lastUsed: lastUsed.get(`${spec.id}:main`) ?? 0,
-      quota: primaryQuota.get(spec.id),
-      value: { id: "main", credential: primary },
+      lastUsed: lastUsed.get(`${spec.id}:${MAIN}`) ?? 0,
+      quota: storeFor(spec).primaryQuota(),
+      value: { id: MAIN, credential: primary },
     },
     ...pool.accounts
       .filter((account) => account.enabled !== false && account.access)
@@ -180,45 +215,47 @@ function chooseCredential(
         value: { id: account.id, credential: account, account },
       })),
   ];
-  return selectRoutingCandidate(candidates, pool.mode)?.value ?? { id: "main", credential: primary };
+  return selectRoutingCandidate(candidates, pool.mode)?.value ?? { id: MAIN, credential: primary };
 }
 
-async function freshCredential(spec: PooledOAuthProviderSpec, account: PooledOAuthAccount, signal: AbortSignal): Promise<PooledOAuthAccount> {
+async function freshCredential<TApi extends Api>(
+  spec: PooledOAuthProviderSpec<TApi>,
+  account: PooledOAuthAccount,
+): Promise<PooledOAuthAccount> {
   if (account.expires > Date.now() + 60_000) return account;
 
   const key = `${spec.id}:${account.id}`;
   const active = refreshes.get(key);
   if (active) return active;
 
-  const refresh = oauthFor(spec).refresh(account, signal).then((credential) => {
+  // Bounded: nothing upstream constrains this call, and a hung refresh would be
+  // shared by every later request for the account through the map above.
+  const refresh = oauthFor(spec).refresh(account, refreshAbortSignal()).then((credential) => {
     const updated = { ...account, ...credential };
-    saveOAuthAccount(spec.id, updated);
+    storeFor(spec).saveAccount(updated);
     return updated;
   }).finally(() => refreshes.delete(key));
   refreshes.set(key, refresh);
   return refresh;
 }
 
-async function routedAuth(
-  spec: PooledOAuthProviderSpec,
+async function routedAuth<TApi extends Api>(
+  spec: PooledOAuthProviderSpec<TApi>,
   oauth: OAuthAuth,
   primary: OAuthCredential,
 ): Promise<ModelAuth> {
   const selected = chooseCredential(spec, primary);
-  const signal = new AbortController().signal;
-  const credential = selected.account
-    ? await freshCredential(spec, selected.account, signal)
-    : primary;
+  const credential = selected.account ? await freshCredential(spec, selected.account) : primary;
   const now = Date.now();
   lastUsed.set(`${spec.id}:${selected.id}`, now);
 
   if (selected.account && now - (selected.account.lastUsed ?? 0) >= 60_000) {
-    saveOAuthAccount(spec.id, { ...selected.account, ...credential, lastUsed: now });
+    storeFor(spec).saveAccount({ ...selected.account, ...credential, lastUsed: now });
   }
   return oauth.toAuth(credential);
 }
 
-export function registerPooledOAuthProvider(pi: ExtensionAPI, spec: PooledOAuthProviderSpec): void {
+export function registerPooledOAuthProvider<TApi extends Api>(pi: ExtensionAPI, spec: PooledOAuthProviderSpec<TApi>): void {
   const provider = spec.createProvider();
   const oauth = provider.auth.oauth;
   if (!oauth) return;
@@ -226,7 +263,11 @@ export function registerPooledOAuthProvider(pi: ExtensionAPI, spec: PooledOAuthP
   const withQuotaObserver = (options: any) => ({
     ...options,
     onResponse: async (response: { status: number; headers: Record<string, string> }, model: unknown) => {
-      recordQuotaResponse(spec, requestAccessToken(options), response.status, response.headers);
+      try {
+        recordQuotaResponse(spec, requestAccessToken(options), response.status, response.headers);
+      } catch {
+        // Quota accounting is telemetry; it must never fail the response.
+      }
       await options?.onResponse?.(response, model);
     },
   });
@@ -255,19 +296,30 @@ function requestAccessToken(options: any): string | undefined {
   return match?.[1];
 }
 
-function recordQuotaResponse(
-  spec: PooledOAuthProviderSpec,
+/** Resolves which pooled account served a request, falling back to the primary. */
+function accountIdForToken<TApi extends Api>(spec: PooledOAuthProviderSpec<TApi>, access: string | undefined): string {
+  if (!access) return MAIN;
+  return storeFor(spec).load().accounts.find((candidate) => candidate.access === access)?.id ?? MAIN;
+}
+
+function recordQuotaResponse<TApi extends Api>(
+  spec: PooledOAuthProviderSpec<TApi>,
   access: string | undefined,
   status: number,
   headers: Record<string, string>,
 ): void {
+  if (spec.recordQuota) {
+    spec.recordQuota(accountIdForToken(spec, access), status, headers);
+    return;
+  }
+
   if (!access) return;
-  const pool = loadOAuthPool(spec.id);
-  const account = pool.accounts.find((candidate) => candidate.access === access);
-  const previous = account?.quota ?? primaryQuota.get(spec.id);
+  const store = storeFor(spec);
+  const account = store.load().accounts.find((candidate) => candidate.access === access);
+  const previous = account?.quota ?? store.primaryQuota();
   const quota = quotaStateFromHeaders(status, headers, previous);
   if (!quota || quota === previous) return;
 
-  if (account) saveOAuthAccount(spec.id, { ...account, quota });
-  else primaryQuota.set(spec.id, quota);
+  if (account) store.saveAccount({ ...account, quota });
+  else setPrimaryQuota(spec.id, quota);
 }

package/src/domains/workflows/index.ts

@@ -646,7 +646,7 @@ function registerWorkflowTool(
       "Inline scripts may compose registered workflows in-process via `api.workflow(\"<name>\", args)` (e.g. `await api.workflow(\"code-review\", \"HEAD~3\")`); it returns the sub-workflow's result and nests one level only.",
       "Subagents receive no skills by default. In inline workflows, pass `skills: [\"skill-name\"]` per `agent()` call when the user asks for a skill or a stage should use one; grant only the needed skills.",
       "Always pass a plain string as the first `api.agent()` argument; build prompts with template strings before calling agent().",
-      "When using `isolation: \"worktree\"`, `api.agent()` returns `{ result, patch, changed }`; use `.result` for the answer and `.patch` for the isolated diff.",
+      "When using `isolation: \"worktree\"`, `api.agent()` returns `{ result, patch, changed }`; use `.result` for the answer and `.patch` for the isolated diff. Successful runs clean up the worktree; failed runs retain recoverable work and report its path.",
       "If an inline subagent needs grep/find/code-search helpers, use `tools: [\"read\", \"bash\", \"grep\", \"find\", \"ls\"]` plus `toolHints: [\"search\"]` so installed tools such as ast-grep, mgrep, ffgrep, or fffind are discovered dynamically.",
       "`api.budget` exposes `{ total, spent(), remaining() }` (output tokens). When the run is budgeted, scale fleets from `budget.total` and guard loops with `while (budget.total && budget.remaining() > N) { await api.agent(...) }`; `api.agent()` throws once the ceiling is reached.",
       ADAPTIVE_WORKFLOW_GUIDANCE,

package/src/domains/workflows/runtime/agent-attempt.ts

@@ -1,5 +1,7 @@
 import type { Api, Model } from "@earendil-works/pi-ai";
 import { assertWorkflowBudgetAvailable } from "./budget.ts";
+import { isWorkflowPauseError } from "./cancellation.ts";
+import type { WorkflowAgentReservation } from "./agent-limits.ts";
 import {
   type AgentExecutionOptions,
   type AgentRunTags,
@@ -20,13 +22,13 @@ import {
 import { openAgentSession, promptAgentSession, type AgentSessionHandle } from "./agent-session.ts";
 import {
   createAgentWorkspace,
-  disposeAgentWorkspace,
   type AgentWorkspace,
 } from "./agent-workspace.ts";
 import type { AgentResumeBaseContext, AgentResumeContext, RepositoryResumeContext } from "./resume-context.ts";
 import { captureRepositoryMutationGuard } from "./resume-context.ts";
+import { unknownErrorMessage } from "./unknown-error.ts";
 
-/** Execute one fully bracketed workspace/session attempt. Cleanup always precedes settlement. */
+/** Execute one agent attempt. Sessions close immediately; worktrees settle at the workflow boundary. */
 export async function executeAgentAttempt(input: {
   readonly rc: RunContext;
   readonly prompt: string;
@@ -37,9 +39,9 @@ export async function executeAgentAttempt(input: {
   readonly label: string;
   readonly rowId: number;
   readonly tags: AgentRunTags;
-  readonly admitLiveAgent: () => void;
+  readonly reserveLiveAgent: () => WorkflowAgentReservation;
 }): Promise<AgentAttemptResult> {
-  const { rc, prompt, opts, resumeBaseContext, model, replay, label, rowId, tags, admitLiveAgent } = input;
+  const { rc, prompt, opts, resumeBaseContext, model, replay, label, rowId, tags, reserveLiveAgent } = input;
   let repositoryBefore: RepositoryResumeContext | undefined;
   let evidence: AgentReplayEvidence | undefined;
   if (isReplayEnabled(replay)) {
@@ -57,8 +59,17 @@ export async function executeAgentAttempt(input: {
   }
   let workspace: AgentWorkspace | undefined;
   let handle: AgentSessionHandle | undefined;
+  let admission: WorkflowAgentReservation | undefined;
+  let liveStarted = false;
 
   try {
+    // Calls with no replay path cannot become cache hits. Reserve their live
+    // slot before creating a disposable worktree or model session so a limit
+    // error cannot leave behind a fresh, untouched workspace.
+    if (!isReplayEnabled(replay)) {
+      assertWorkflowBudgetAvailable(rc.budget);
+      admission = reserveLiveAgent();
+    }
     workspace = await createAgentWorkspace(rc, opts, label);
     if (replay.kind === "isolated" && evidence?.kind === "isolated") {
       if (workspace.kind !== "isolated") throw new Error("Isolated replay created a shared workspace.");
@@ -104,8 +115,13 @@ export async function executeAgentAttempt(input: {
       }
     }
 
-    assertWorkflowBudgetAvailable(rc.budget);
-    admitLiveAgent();
+    if (!admission) {
+      assertWorkflowBudgetAvailable(rc.budget);
+      admission = reserveLiveAgent();
+    }
+    admission.commit();
+    liveStarted = true;
+    if (workspace.kind === "isolated") rc.worktrees.markRecoverable(workspace.cwd);
     const rawResult = await promptAgentSession({
       rc,
       handle,
@@ -136,12 +152,26 @@ export async function executeAgentAttempt(input: {
     }
     rc.progress.log(`${label}: read-only resume contract was not recorded (${validation.reason})`);
     return { kind: "live-unrecordable", result };
+  } catch (error) {
+    if (
+      workspace?.kind === "isolated"
+      && liveStarted
+      && !rc.signal?.aborted
+      && !isWorkflowPauseError(error)
+    ) {
+      rc.worktrees.preserve(workspace.cwd);
+      rc.progress.log(`${label}: retained failed worktree ${workspace.cwd}`);
+    }
+    throw error;
   } finally {
-    try {
-      const session = handle?.session;
-      if (session) rc.perf.timeSync("agent.dispose_ms", () => session.dispose(), tags);
-    } finally {
-      await disposeAgentWorkspace(rc, label, workspace);
+    admission?.release();
+    const session = handle?.session;
+    if (session) {
+      try {
+        rc.perf.timeSync("agent.dispose_ms", () => session.dispose(), tags);
+      } catch (error) {
+        rc.progress.log(`${label}: session cleanup failed (${unknownErrorMessage(error)})`);
+      }
     }
   }
 }

package/src/domains/workflows/runtime/agent-failure.ts

@@ -0,0 +1,14 @@
+import { unknownErrorMessage } from "./unknown-error.ts";
+
+/** Retains every failed attempt when a later retry is blocked or also fails. */
+export function combinedAgentAttemptError(
+  label: string,
+  prior: readonly unknown[],
+  finalError: unknown,
+): AggregateError {
+  const earlier = prior.map(unknownErrorMessage).join("; ");
+  return new AggregateError(
+    [...prior, finalError],
+    `Workflow agent "${label}" could not complete. Earlier attempt: ${earlier}. Final failure: ${unknownErrorMessage(finalError)}`,
+  );
+}

package/src/domains/workflows/runtime/agent-limits.ts

@@ -25,6 +25,13 @@ export class WorkflowAgentTimeoutError extends Error {
 }
 
 /** Shared run-level admission counter. Cache hits do not call admit(). */
+export interface WorkflowAgentReservation {
+  /** Permanently count this reservation as a live model attempt. */
+  commit(): void;
+  /** Return an uncommitted reservation after setup or replay succeeds/fails. */
+  release(): void;
+}
+
 export class WorkflowAgentLimiter {
   readonly maxAgents: number | null;
   private admitted = 0;
@@ -33,11 +40,27 @@ export class WorkflowAgentLimiter {
     this.maxAgents = maxAgents;
   }
 
-  admit(signal: AbortSignal | undefined): void {
+  reserve(signal: AbortSignal | undefined): WorkflowAgentReservation {
     throwIfAborted(signal);
     if (this.maxAgents !== null && this.admitted >= this.maxAgents) {
       throw new WorkflowAgentLimitError(this.maxAgents);
     }
     this.admitted++;
+    let state: "pending" | "committed" | "released" = "pending";
+    return {
+      commit() {
+        if (state === "released") throw new Error("Cannot commit a released workflow agent reservation.");
+        state = "committed";
+      },
+      release: () => {
+        if (state !== "pending") return;
+        state = "released";
+        this.admitted--;
+      },
+    };
+  }
+
+  admit(signal: AbortSignal | undefined): void {
+    this.reserve(signal).commit();
   }
 }

package/src/domains/workflows/runtime/agent-retry.ts

@@ -8,6 +8,7 @@ import {
 export const AGENT_RETRY_BASE_DELAY_MS = 1_000;
 export const AGENT_RETRY_MAX_DELAY_MS = 30_000;
 export const WORKFLOW_PROVIDER_ERROR_CODE = "WORKFLOW_PROVIDER_ERROR";
+const CODEX_ACCESS_VERIFICATION_ERROR = /Unable to verify\s+[^.\r\n]{1,120}\s+access\.\s*Please try again\.?/i;
 
 export interface AgentRetryScheduler {
   sleep(delayMs: number, signal: AbortSignal | undefined): Promise<void>;
@@ -25,12 +26,11 @@ export interface ProviderErrorDetails {
 export class WorkflowProviderError extends Error {
   override readonly name = "WorkflowProviderError";
   readonly code = WORKFLOW_PROVIDER_ERROR_CODE;
+  readonly details: ProviderErrorDetails;
 
-  constructor(
-    message: string,
-    readonly details: ProviderErrorDetails,
-  ) {
+  constructor(message: string, details: ProviderErrorDetails) {
     super(message);
+    this.details = details;
   }
 
   get retryable(): boolean {
@@ -79,13 +79,18 @@ export function providerErrorFromMessages(
   if (usageLimit && options.pauseOnUsageLimit) return usageLimit;
   const message = messages.findLast(isAssistantMessage);
   if (!message || message.stopReason !== "error") return undefined;
-  const errorMessage = typeof message.errorMessage === "string" && message.errorMessage.length > 0
+  const providerMessage = typeof message.errorMessage === "string" && message.errorMessage.length > 0
     ? message.errorMessage
     : "Provider session ended with an unspecified error.";
-  const retryable = isRetryableAssistantError(message as AssistantMessage);
   const provider = stringDetail(message.provider);
   const model = stringDetail(message.model);
   const api = stringDetail(message.api);
+  const codexAccessVerification = provider === "openai-codex"
+    && CODEX_ACCESS_VERIFICATION_ERROR.test(providerMessage);
+  const retryable = isRetryableAssistantError(message as AssistantMessage) || codexAccessVerification;
+  const errorMessage = codexAccessVerification && model
+    ? `Codex temporarily could not verify access for the selected model ${provider}/${model}. No alternate model was requested. Provider response: ${providerMessage}`
+    : providerMessage;
   return new WorkflowProviderError(errorMessage, {
     stopReason: "error",
     retryable,

package/src/domains/workflows/runtime/agent-runner.ts

@@ -1,4 +1,5 @@
 import { assertWorkflowBudgetAvailable } from "./budget.ts";
+import { combinedAgentAttemptError } from "./agent-failure.ts";
 import { WorkflowAgentTimeoutError } from "./agent-limits.ts";
 import { abortReason, linkAbortSignal, throwIfAborted } from "./cancellation.ts";
 import { executeAgentAttempt } from "./agent-attempt.ts";
@@ -82,6 +83,7 @@ export async function runAgent(
 
           let attemptPlan: AgentReplayPlan = replay;
           let providerRetries = 0;
+          const priorAttemptFailures: unknown[] = [];
           while (true) {
             let outcome: AgentAttemptResult;
             try {
@@ -95,25 +97,36 @@ export async function runAgent(
                 label,
                 rowId,
                 tags,
-                admitLiveAgent: liveScope.admit,
+                reserveLiveAgent: liveScope.reserve,
               });
             } catch (error) {
-              if (!(error instanceof WorkflowProviderError) || !error.retryable) throw error;
+              if (!(error instanceof WorkflowProviderError) || !error.retryable) {
+                throw priorAttemptFailures.length > 0
+                  ? combinedAgentAttemptError(label, priorAttemptFailures, error)
+                  : error;
+              }
               if (providerRetries >= agentRc.agentRetries) {
                 if (agentRc.agentRetries > 0) {
                   rc.progress.log(`${label}: transient provider failure after ${providerRetries} retries; giving up`);
                 }
-                throw error;
+                throw priorAttemptFailures.length > 0
+                  ? combinedAgentAttemptError(label, priorAttemptFailures, error)
+                  : error;
               }
 
-              assertWorkflowBudgetAvailable(agentRc.budget);
-              providerRetries++;
-              const delayMs = agentRetryDelayMs(providerRetries);
-              rc.progress.log(`${label}: transient provider failure; retry ${providerRetries}/${agentRc.agentRetries} in ${delayMs}ms`);
-              rc.perf.counter("agent.provider_retry", 1, tags);
-              rc.perf.observe("agent.provider_retry_delay_ms", delayMs, tags);
-              attemptPlan = { kind: "off" };
-              await agentRc.retryScheduler.sleep(delayMs, agentRc.signal);
+              priorAttemptFailures.push(error);
+              try {
+                assertWorkflowBudgetAvailable(agentRc.budget);
+                providerRetries++;
+                const delayMs = agentRetryDelayMs(providerRetries);
+                rc.progress.log(`${label}: transient provider failure; retry ${providerRetries}/${agentRc.agentRetries} in ${delayMs}ms`);
+                rc.perf.counter("agent.provider_retry", 1, tags);
+                rc.perf.observe("agent.provider_retry_delay_ms", delayMs, tags);
+                attemptPlan = { kind: "off" };
+                await agentRc.retryScheduler.sleep(delayMs, agentRc.signal);
+              } catch (retryError) {
+                throw combinedAgentAttemptError(label, priorAttemptFailures, retryError);
+              }
               continue;
             }
             const settlement = await settleAgentAttempt({ rc: agentRc, label, tags, replay: attemptPlan, outcome });
@@ -151,15 +164,24 @@ function createAgentLiveScope(rc: RunContext, label: string) {
 
   return {
     signal: controller.signal,
-    admit() {
-      rc.agentLimiter.admit(controller.signal);
-      if (timerStarted || rc.agentTimeoutMs === null) return;
-      timerStarted = true;
-      const timeoutMs = rc.agentTimeoutMs;
-      timer = setTimeout(
-        () => controller.abort(new WorkflowAgentTimeoutError(label, timeoutMs)),
-        timeoutMs,
-      );
+    reserve() {
+      const reservation = rc.agentLimiter.reserve(controller.signal);
+      let committed = false;
+      return {
+        commit() {
+          if (committed) return;
+          reservation.commit();
+          committed = true;
+          if (timerStarted || rc.agentTimeoutMs === null) return;
+          timerStarted = true;
+          const timeoutMs = rc.agentTimeoutMs;
+          timer = setTimeout(
+            () => controller.abort(new WorkflowAgentTimeoutError(label, timeoutMs)),
+            timeoutMs,
+          );
+        },
+        release: () => reservation.release(),
+      };
     },
     dispose() {
       if (timer) clearTimeout(timer);