@maxiaochao/pi-toolkit 0.11.9 → 0.11.11

package/packages/openai-account-pool/src/lease.ts

@@ -1,128 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { readPoolState, withPoolStateTransaction, type EnrollmentLeaseRecord, type PoolStateFile } from "./store.ts";
-
-/**
- * Membership changes hold a lease instead of the credential lock, because adding an account
- * waits for a browser. The lease keeps two pi processes from running wizards or an off at the
- * same time, and it expires so a crashed command recovers without manual cleanup.
- */
-
-export const DEFAULT_ENROLLMENT_TTL_MS = 120_000;
-const RENEW_SAFETY_MS = 5_000;
-
-export class EnrollmentInProgressError extends Error {
-	constructor(record: EnrollmentLeaseRecord) {
-		super(`Another pi process is changing the openai-codex account pool (${record.purpose}, pid ${record.processId}). Finish or close it first.`);
-		this.name = "EnrollmentInProgressError";
-	}
-}
-
-export class EnrollmentLeaseLostError extends Error {
-	constructor() {
-		super("This pool operation lost its lease, so it must not change accounts. Run the command again.");
-		this.name = "EnrollmentLeaseLostError";
-	}
-}
-
-export interface EnrollmentLease {
-	record: EnrollmentLeaseRecord;
-	/** Extend while a long step such as a browser authorization is still running. */
-	renew(): Promise<void>;
-	release(): Promise<void>;
-}
-
-export function isProcessAlive(processId: number): boolean {
-	if (!Number.isInteger(processId) || processId <= 0) return false;
-	try {
-		process.kill(processId, 0);
-		return true;
-	} catch (error) {
-		// EPERM means the process exists but belongs to someone else.
-		return (error as NodeJS.ErrnoException).code === "EPERM";
-	}
-}
-
-export function activeEnrollment(state: PoolStateFile, now: number): EnrollmentLeaseRecord | undefined {
-	const record = state.enrollment;
-	if (!record) return undefined;
-	if (record.expiresAtMs <= now) return undefined;
-	if (record.processId !== process.pid && !isProcessAlive(record.processId)) return undefined;
-	return record;
-}
-
-export async function assertNoActiveEnrollment(input: { statePath: string; now?: number }): Promise<void> {
-	const record = activeEnrollment(await readPoolState(input.statePath), input.now ?? Date.now());
-	if (record) throw new EnrollmentInProgressError(record);
-}
-
-export async function acquireEnrollmentLease(input: {
-	statePath: string;
-	purpose: string;
-	ttlMs?: number;
-	now?: () => number;
-	signal?: AbortSignal;
-}): Promise<EnrollmentLease> {
-	const now = input.now ?? (() => Date.now());
-	const ttlMs = input.ttlMs ?? DEFAULT_ENROLLMENT_TTL_MS;
-	const owner = randomUUID();
-
-	const record = await withPoolStateTransaction(input.statePath, (state) => {
-		const held = activeEnrollment(state, now());
-		if (held) throw new EnrollmentInProgressError(held);
-		const mine: EnrollmentLeaseRecord = {
-			owner,
-			processId: process.pid,
-			purpose: input.purpose,
-			startedAtMs: now(),
-			expiresAtMs: now() + ttlMs,
-		};
-		return { value: { ...state, enrollment: mine }, result: mine };
-	}, { signal: input.signal });
-
-	let current = record;
-	let released = false;
-
-	return {
-		get record() {
-			return current;
-		},
-		async renew() {
-			if (released) throw new EnrollmentLeaseLostError();
-			current = await withPoolStateTransaction(input.statePath, (state) => {
-				if (state.enrollment?.owner !== owner) throw new EnrollmentLeaseLostError();
-				const renewed: EnrollmentLeaseRecord = { ...state.enrollment, expiresAtMs: now() + ttlMs };
-				return { value: { ...state, enrollment: renewed }, result: renewed };
-			});
-		},
-		async release() {
-			if (released) return;
-			released = true;
-			await withPoolStateTransaction(input.statePath, (state) => {
-				// Only the holder clears it; a reclaimed lease now belongs to another process.
-				if (state.enrollment?.owner !== owner) return { result: undefined };
-				const next = { ...state };
-				delete next.enrollment;
-				return { value: next, result: undefined };
-			});
-		},
-	};
-}
-
-/** Run one membership change under a lease, renewing it while the body is still working. */
-export async function withEnrollmentLease<T>(
-	input: { statePath: string; purpose: string; ttlMs?: number; signal?: AbortSignal },
-	run: (lease: EnrollmentLease) => Promise<T>,
-): Promise<T> {
-	const lease = await acquireEnrollmentLease(input);
-	const ttlMs = input.ttlMs ?? DEFAULT_ENROLLMENT_TTL_MS;
-	const timer = setInterval(() => {
-		void lease.renew().catch(() => { /* The next write fails visibly through assertHeld/renew. */ });
-	}, Math.max(ttlMs - RENEW_SAFETY_MS, RENEW_SAFETY_MS));
-	timer.unref?.();
-	try {
-		return await run(lease);
-	} finally {
-		clearInterval(timer);
-		await lease.release();
-	}
-}

package/packages/openai-account-pool/src/lock.ts

@@ -1,171 +0,0 @@
-import { rmdirSync } from "node:fs";
-import { mkdir, rmdir, stat, utimes } from "node:fs/promises";
-import { resolve } from "node:path";
-
-/**
- * Directory lock using the on-disk protocol of `proper-lockfile`, the library pi's own auth
- * backend locks `auth.json` with: `<file>.lock` is a directory, its mtime is the holder's
- * heartbeat, and a heartbeat older than the stale window may be reclaimed. Sharing the
- * protocol is what makes pool writes mutually exclusive with pi's own credential writes.
- */
-
-/** Reclaim window for a holder that stopped heart-beating. Matches pi's auth-lock wait window. */
-const DEFAULT_STALE_MS = 30_000;
-const DEFAULT_WAIT_MS = 30_000;
-/** Well inside proper-lockfile's 10s default stale window, so pi never reclaims a lock we hold. */
-const HEARTBEAT_MS = 2_000;
-const MAX_BACKOFF_MS = 500;
-
-/**
- * Stamps the heartbeat with a unique sub-millisecond time, so a directory another holder
- * recreated is recognised even when it reuses our inode and lands in the same millisecond.
- * Filesystems that only keep whole milliseconds degrade to proper-lockfile's own mtime check.
- */
-async function stampHeartbeat(directory: string): Promise<bigint> {
-	const seconds = (Date.now() + Math.random()) / 1000;
-	await utimes(directory, seconds, seconds);
-	return (await stat(directory, { bigint: true })).mtimeNs;
-}
-
-export class LockTimeoutError extends Error {
-	constructor(path: string) {
-		super(`Timed out waiting for ${path}. Another pi process is writing credentials.`);
-		this.name = "LockTimeoutError";
-	}
-}
-
-export class LockCompromisedError extends Error {
-	constructor(path: string, options?: { cause?: unknown }) {
-		super(`Lost the lock on ${path} before the write completed.`, options);
-		this.name = "LockCompromisedError";
-	}
-}
-
-export interface HeldLock {
-	/** Throws when the lock was reclaimed or released, so a caller never writes unprotected. */
-	assertHeld(): void;
-	/** Re-reads the directory, so ownership is checked at write time rather than at the last heartbeat. */
-	verifyHeld(): Promise<void>;
-	release(): Promise<void>;
-}
-
-export interface FileLockOptions {
-	staleMs?: number;
-	waitMs?: number;
-	signal?: AbortSignal;
-}
-
-const heldDirectories = new Set<string>();
-let exitHookInstalled = false;
-
-function installExitHook(): void {
-	if (exitHookInstalled) return;
-	exitHookInstalled = true;
-	process.on("exit", () => {
-		for (const directory of heldDirectories) {
-			try { rmdirSync(directory); } catch { /* Nothing to clean up when the directory is already gone. */ }
-		}
-	});
-}
-
-export function lockDirectoryFor(targetPath: string): string {
-	return `${resolve(targetPath)}.lock`;
-}
-
-const delay = (milliseconds: number, signal?: AbortSignal) => new Promise<void>((resolveDelay, reject) => {
-	const onAbort = () => { clearTimeout(timer); reject(signal?.reason ?? new Error("Lock wait aborted.")); };
-	const timer = setTimeout(() => { signal?.removeEventListener("abort", onAbort); resolveDelay(); }, milliseconds);
-	if (signal?.aborted) onAbort();
-	else signal?.addEventListener("abort", onAbort, { once: true });
-});
-
-/** True when the caller should retry `mkdir`, either because the directory is gone or it was stale. */
-async function reclaimIfStale(directory: string, staleMs: number): Promise<boolean> {
-	let identity;
-	try { identity = await stat(directory); }
-	catch (error) {
-		if ((error as NodeJS.ErrnoException).code === "ENOENT") return true;
-		throw error;
-	}
-	if (identity.mtimeMs >= Date.now() - staleMs) return false;
-	try { await rmdir(directory); }
-	catch (error) {
-		if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
-	}
-	return true;
-}
-
-function holdLock(directory: string, stamp: bigint): HeldLock {
-	installExitHook();
-	heldDirectories.add(directory);
-	let ownStamp = stamp;
-	let compromised: Error | undefined;
-	let released = false;
-	let timer: ReturnType<typeof setTimeout> | undefined;
-
-	const scheduleHeartbeat = () => {
-		timer = setTimeout(() => { void heartbeat(); }, HEARTBEAT_MS);
-		timer.unref?.();
-	};
-	/** Any other holder's mkdir or heartbeat replaces our stamp. */
-	const assertOwnStamp = async (): Promise<void> => {
-		if ((await stat(directory, { bigint: true })).mtimeNs !== ownStamp) throw new LockCompromisedError(directory);
-	};
-	const heartbeat = async () => {
-		if (released) return;
-		try {
-			await assertOwnStamp();
-			ownStamp = await stampHeartbeat(directory);
-		} catch (error) {
-			compromised = error instanceof LockCompromisedError ? error : new LockCompromisedError(directory, { cause: error });
-			return;
-		}
-		if (!released) scheduleHeartbeat();
-	};
-	scheduleHeartbeat();
-
-	return {
-		assertHeld() {
-			if (compromised) throw compromised;
-			if (released) throw new LockCompromisedError(directory);
-		},
-		async verifyHeld() {
-			this.assertHeld();
-			try { await assertOwnStamp(); }
-			catch (error) {
-				compromised = error instanceof LockCompromisedError ? error : new LockCompromisedError(directory, { cause: error });
-				throw compromised;
-			}
-		},
-		async release() {
-			if (released) return;
-			released = true;
-			if (timer) clearTimeout(timer);
-			heldDirectories.delete(directory);
-			// A reclaimed directory belongs to another holder; removing it would break their lock.
-			if (compromised) return;
-			try { await rmdir(directory); }
-			catch (error) {
-				if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
-			}
-		},
-	};
-}
-
-export async function acquireFileLock(targetPath: string, options: FileLockOptions = {}): Promise<HeldLock> {
-	const directory = lockDirectoryFor(targetPath);
-	const staleMs = options.staleMs ?? DEFAULT_STALE_MS;
-	const deadline = Date.now() + (options.waitMs ?? DEFAULT_WAIT_MS);
-	for (let attempt = 0; ; attempt++) {
-		options.signal?.throwIfAborted();
-		try {
-			await mkdir(directory, { mode: 0o700 });
-			return holdLock(directory, await stampHeartbeat(directory));
-		} catch (error) {
-			if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
-		}
-		if (await reclaimIfStale(directory, staleMs)) continue;
-		if (Date.now() >= deadline) throw new LockTimeoutError(directory);
-		await delay(Math.round(Math.min(10 * 2 ** attempt, MAX_BACKOFF_MS) * (1 + Math.random())), options.signal);
-	}
-}

package/packages/openai-account-pool/src/login-slot.ts

@@ -1,158 +0,0 @@
-import type { AuthEvent, AuthInfoLink, AuthPrompt, OAuthDeviceCodeInfo, ProviderAuthInteraction } from "@earendil-works/pi-ai";
-
-/**
- * One OAuth login inside pi's single editor slot.
- *
- * pi hands extensions one slot below the chat: `ui.select` puts the editor back when it closes,
- * so a selector opened while the login dialog is mounted takes the dialog down with it, and every
- * later auth step renders into a component nobody can see. The Codex flow hits exactly that, as it
- * asks for the login method first and shows the sign-in URL and the manual-code input afterwards.
- *
- * The slot therefore mounts the dialog lazily and steps out of it around every selector, and keeps
- * auth events in the order the provider emitted them.
- */
-
-/** The part of pi's login dialog this module drives. */
-export interface LoginDialog {
-	/** Aborts when the user cancels inside the dialog. */
-	readonly signal: AbortSignal;
-	showAuth(url: string, instructions?: string): void;
-	showDeviceCode(info: OAuthDeviceCodeInfo): void;
-	showInfo(message: string, links?: readonly AuthInfoLink[]): void;
-	showProgress(message: string): void;
-	showWaiting(message: string): void;
-	showManualInput(message: string): Promise<string>;
-	showPrompt(message: string, placeholder?: string): Promise<string>;
-}
-
-export interface LoginSlotUi {
-	/**
-	 * Mounts a login dialog in the slot and reports it together with the callback that takes it
-	 * down again. Resolves once the slot has been handed back.
-	 */
-	mount(register: (dialog: LoginDialog, close: () => void) => void): Promise<unknown>;
-	/** Shows a selector in the same slot. Resolves to undefined when the user cancels. */
-	select(message: string, options: readonly string[], signal?: AbortSignal): Promise<string | undefined>;
-}
-
-const CANCELLED = "Login cancelled";
-
-/** A prompt can lose its race, e.g. a manual code while the callback server wins. */
-function withCancellation<T>(answer: Promise<T>, signal: AbortSignal | undefined): Promise<T> {
-	if (!signal) return answer;
-	if (signal.aborted) return Promise.reject(new Error(CANCELLED));
-	let onAbort: (() => void) | undefined;
-	const aborted = new Promise<never>((_resolve, reject) => {
-		onAbort = () => reject(new Error(CANCELLED));
-		signal.addEventListener("abort", onAbort, { once: true });
-	});
-	return Promise.race([answer, aborted]).finally(() => {
-		if (onAbort) signal.removeEventListener("abort", onAbort);
-	});
-}
-
-export class LoginSlot {
-	private readonly aborter = new AbortController();
-	private dialog: LoginDialog | undefined;
-	private opening: Promise<LoginDialog> | undefined;
-	private hide: (() => void) | undefined;
-	private dismissed: Promise<unknown> = Promise.resolve();
-	/** Serializes everything that needs the slot to itself. Never rejects. */
-	private queue: Promise<void> = Promise.resolve();
-	private readonly ui: LoginSlotUi;
-
-	constructor(ui: LoginSlotUi) {
-		this.ui = ui;
-	}
-
-	/** What `oauth.login()` is called with. */
-	get interaction(): ProviderAuthInteraction {
-		return {
-			signal: this.aborter.signal,
-			prompt: (request) => this.prompt(request),
-			notify: (event) => this.notify(event),
-		};
-	}
-
-	/** Gives the slot back once the login is over. */
-	async close(): Promise<void> {
-		await this.queue;
-		await this.unmount();
-	}
-
-	private enqueue<T>(task: () => Promise<T>): Promise<T> {
-		const running = this.queue.then(task);
-		this.queue = running.then(
-			() => undefined,
-			() => undefined,
-		);
-		return running;
-	}
-
-	private open(): Promise<LoginDialog> {
-		if (this.opening) return this.opening;
-		let ready: (dialog: LoginDialog) => void = () => {};
-		let failed: (error: unknown) => void = () => {};
-		const shown = new Promise<LoginDialog>((resolve, reject) => {
-			ready = resolve;
-			failed = reject;
-		});
-		this.dismissed = this.ui
-			.mount((dialog, close) => {
-				// Cancelling inside the dialog cancels the login, the same key `/login` honours.
-				dialog.signal.addEventListener("abort", () => this.aborter.abort(), { once: true });
-				this.dialog = dialog;
-				this.hide = close;
-				ready(dialog);
-			})
-			.catch((error: unknown) => {
-				failed(error);
-			});
-		this.opening = shown;
-		return shown;
-	}
-
-	private async unmount(): Promise<void> {
-		const hide = this.hide;
-		const dismissed = this.dismissed;
-		this.dialog = undefined;
-		this.opening = undefined;
-		this.hide = undefined;
-		this.dismissed = Promise.resolve();
-		hide?.();
-		await dismissed;
-	}
-
-	private async prompt(request: AuthPrompt): Promise<string> {
-		if (request.type === "select") return withCancellation(this.select(request), request.signal);
-		// Wait for the events that arrived before this prompt, so the dialog reads in order.
-		await this.queue;
-		const dialog = await this.open();
-		const answer =
-			request.type === "manual_code" ? dialog.showManualInput(request.message) : dialog.showPrompt(request.message, request.placeholder);
-		return withCancellation(answer, request.signal);
-	}
-
-	private select(request: AuthPrompt & { type: "select" }): Promise<string> {
-		return this.enqueue(async () => {
-			await this.unmount();
-			const labels = request.options.map((option) => option.label);
-			const chosen = await this.ui.select(request.message, labels, request.signal);
-			const index = chosen === undefined ? -1 : labels.indexOf(chosen);
-			if (index < 0) throw new Error(CANCELLED);
-			return request.options[index].id;
-		});
-	}
-
-	private notify(event: AuthEvent): void {
-		void this.enqueue(async () => {
-			const dialog = await this.open();
-			if (event.type === "auth_url") dialog.showAuth(event.url, event.instructions);
-			else if (event.type === "device_code") {
-				dialog.showDeviceCode(event);
-				dialog.showWaiting("等待浏览器完成授权…");
-			} else if (event.type === "info") dialog.showInfo(event.message, event.links);
-			else dialog.showProgress(event.message);
-		}).catch(() => undefined);
-	}
-}

package/packages/openai-account-pool/src/policy.ts

@@ -1,176 +0,0 @@
-/**
- * Pure decisions: what a failure proves, which account to use next, and whether this request may
- * still switch accounts. Nothing here reads files or the network, so every rule is testable.
- *
- * Classification reads structured evidence only. pi's Codex adapter formats a plain HTTP 429 with
- * the same "You have hit your ChatGPT usage limit" text as a real subscription limit, so matching
- * the user-facing message would switch accounts on ordinary rate limiting.
- */
-
-export type FailureKind =
-	/** The subscription's own limit is reached: the only automatic quota switch. */
-	| "quota"
-	/** The stored authorization is proven invalid; the account needs re-authorizing. */
-	| "auth_invalid"
-	/** Authentication was rejected once; the same account may be repaired first. */
-	| "auth_retry"
-	/** Rate limiting, network trouble or a server-side blip: retry the same account. */
-	| "transient"
-	| "cancelled"
-	/** A definite error that another account would not fix. */
-	| "fatal"
-	| "unknown";
-
-export interface ProviderErrorBody {
-	code?: unknown;
-	type?: unknown;
-	message?: unknown;
-	plan_type?: unknown;
-	resets_at?: unknown;
-	resets_in_seconds?: unknown;
-}
-
-export interface FailureEvidence {
-	status?: number;
-	body?: ProviderErrorBody;
-	cancelled?: boolean;
-	/** Set when the failure came from the OAuth token exchange rather than the model request. */
-	oauthRefresh?: { invalidGrant: boolean };
-	/** Transport-level failure such as DNS, reset connection or timeout. */
-	networkFailure?: boolean;
-	/** Model the request was for; quota without plan-level evidence is scoped to it. */
-	modelId?: string;
-}
-
-export interface Classification {
-	kind: FailureKind;
-	/** Short, non-secret reason for status output and state records. */
-	reason: string;
-	/** Cooldown scope: the whole account, or `model:<id>` when the evidence is not plan-level. */
-	scope: string;
-	/** Server-stated reset time in epoch ms, or null when the server stated none. */
-	serverResetAtMs: number | null;
-}
-
-export const ACCOUNT_SCOPE = "account";
-const MAX_RESET_HORIZON_MS = 30 * 24 * 60 * 60 * 1_000;
-
-function errorCode(body: ProviderErrorBody | undefined): string {
-	const code = typeof body?.code === "string" ? body.code : "";
-	if (code) return code.toLowerCase();
-	return typeof body?.type === "string" ? body.type.toLowerCase() : "";
-}
-
-/** Only a field that is finite and lands in a plausible window counts as a reset time. */
-export function serverResetAtMs(body: ProviderErrorBody | undefined, now: number): number | null {
-	const inWindow = (value: number) => value > now - 24 * 60 * 60 * 1_000 && value < now + MAX_RESET_HORIZON_MS;
-	if (typeof body?.resets_at === "number" && Number.isFinite(body.resets_at)) {
-		// The Codex error reports epoch seconds.
-		const candidate = body.resets_at * 1_000;
-		if (inWindow(candidate)) return candidate;
-	}
-	if (typeof body?.resets_in_seconds === "number" && Number.isFinite(body.resets_in_seconds) && body.resets_in_seconds >= 0) {
-		const candidate = now + body.resets_in_seconds * 1_000;
-		if (inWindow(candidate)) return candidate;
-	}
-	return null;
-}
-
-export function classifyFailure(evidence: FailureEvidence, now: number): Classification {
-	const scopeForModel = evidence.modelId ? `model:${evidence.modelId}` : ACCOUNT_SCOPE;
-	const plain = (kind: FailureKind, reason: string): Classification => ({ kind, reason, scope: scopeForModel, serverResetAtMs: null });
-
-	if (evidence.cancelled) return plain("cancelled", "cancelled");
-
-	if (evidence.oauthRefresh) {
-		// A network problem during the token exchange says nothing about the authorization.
-		return evidence.oauthRefresh.invalidGrant ? plain("auth_invalid", "invalid_grant") : plain("transient", "oauth_refresh_unavailable");
-	}
-	if (evidence.networkFailure) return plain("transient", "network_failure");
-
-	const code = errorCode(evidence.body);
-	const status = evidence.status;
-
-	if (code === "usage_limit_reached") {
-		// A plan-level limit is shared by every model; without that evidence stay model-scoped.
-		const planLevel = typeof evidence.body?.plan_type === "string" && evidence.body.plan_type.length > 0;
-		return {
-			kind: "quota",
-			reason: "usage_limit_reached",
-			scope: planLevel ? ACCOUNT_SCOPE : scopeForModel,
-			serverResetAtMs: serverResetAtMs(evidence.body, now),
-		};
-	}
-	if (code === "invalid_grant" || code === "invalid_token" || code === "token_revoked") return plain("auth_invalid", code);
-	if (code === "rate_limit_exceeded") return plain("transient", "rate_limit_exceeded");
-	// usage_not_included means the plan does not cover this model at all; another account is a guess.
-	if (code === "usage_not_included") return plain("fatal", "usage_not_included");
-	if (code === "context_length_exceeded") return plain("fatal", "context_length_exceeded");
-
-	if (status === 401) return plain("auth_retry", "unauthorized");
-	if (status === 429) return plain("transient", "http_429");
-	if (status !== undefined && status >= 500) return plain("transient", `http_${status}`);
-	if (status === 403) return plain("fatal", "http_403");
-	if (status !== undefined && status >= 400) return plain("fatal", `http_${status}`);
-
-	return plain("unknown", "unknown_error");
-}
-
-export interface AccountAvailability {
-	id: string;
-	ordinal: number;
-	/** Why the account cannot be used now; undefined means usable. */
-	unavailable?: { reason: string; untilMs: number | null; serverResetAtMs: number | null };
-	/** The account is usable but should be probed under a lease, after a cooldown ended. */
-	needsProbe: boolean;
-	authInvalid: boolean;
-}
-
-export interface SelectionInput {
-	accounts: AccountAvailability[];
-	/** Sticky preference of this process: keep using the account that currently works. */
-	preferredId?: string;
-	/** Accounts this logical request already tried, so no account is tried twice. */
-	attemptedIds: readonly string[];
-}
-
-/**
- * Sticky selection: stay on the preferred account while it works, otherwise take the next usable
- * account in the order they were added. Recovered accounts become candidates again.
- */
-export function selectAccount(input: SelectionInput): AccountAvailability | undefined {
-	const attempted = new Set(input.attemptedIds);
-	const usable = input.accounts.filter((account) => !attempted.has(account.id) && !account.unavailable && !account.authInvalid);
-	const preferred = usable.find((account) => account.id === input.preferredId);
-	if (preferred) return preferred;
-	return [...usable].sort((left, right) => left.ordinal - right.ordinal)[0];
-}
-
-export type FailoverAction =
-	/** Try the next account for this same request. */
-	| "failover"
-	/** Re-read and refresh the current account once, then retry it. */
-	| "repair"
-	/** Finish the request with the provider's error. */
-	| "stop";
-
-export interface FailoverInput {
-	classification: Classification;
-	/** Text, thinking or a tool call already reached the caller, so nothing may be replayed. */
-	emittedOutput: boolean;
-	/** Another untried, usable account exists for this request. */
-	hasRemainingCandidate: boolean;
-	/** The current account already used its one authentication repair. */
-	repairUsed: boolean;
-}
-
-export function decideFailover(input: FailoverInput): { action: FailoverAction; reason: string } {
-	const { kind } = input.classification;
-	if (kind === "cancelled") return { action: "stop", reason: "cancelled" };
-	if (kind === "transient" || kind === "fatal" || kind === "unknown") return { action: "stop", reason: kind };
-	if (kind === "auth_retry" && !input.repairUsed) return { action: "repair", reason: "authentication_repair" };
-	// Everything below is quota or a proven authorization problem.
-	if (input.emittedOutput) return { action: "stop", reason: "output_already_delivered" };
-	if (!input.hasRemainingCandidate) return { action: "stop", reason: "pool_exhausted" };
-	return { action: "failover", reason: input.classification.reason };
-}