@mehdisadeghi/pi-retry 0.11.2 → 0.12.0

package/README.md

@@ -25,15 +25,17 @@ Run `bun run test:host` for the offline real-host load, native codemode/nested-c
 
 ## Overview
 
-This extension automatically detects and retries **all** errors by default, with only a tiny blacklist of known permanent failures (invalid API key, missing model, etc.).
+This extension automatically detects and retries **all** errors, forever, until you abort. There is no error blacklist and no failure cap: invalid API keys, missing models, quota/budget exhaustion and context overflow are retried like a socket hiccup.
 
 | Error Type | Retry Behavior | Use Case |
 |------------|----------------|----------|
-| **Any retryable error** (catch-all) | **Capped exponential retry** | Everything else — provider hiccups, stream exhaustion, credit issues, unknown errors |
-| HTTP 400/413 | **Capped** with exponential backoff, NO compaction | Transient context overflow that might resolve |
-| Credit / payment errors | **Capped** with exponential backoff | "Not Enough Credits", insufficient balance, 402 — top up and the retry loop auto-resumes |
-| **Quota / session-limit / budget exhaustion** | **Not retried** — notify + stop | "You've hit your limit", `insufficient_quota`, "out of budget", suspended accounts |
-| Connection errors | **Capped** with exponential backoff | Network hiccups, connection drops, socket errors, stream exhaustion |
+| **Any error** (catch-all) | **Uncapped** exponential retry | Everything, including unknown errors |
+| HTTP 400/413 | **Uncapped** with exponential backoff | Transient context overflow that might resolve |
+| Credit / payment errors | **Uncapped** with exponential backoff | "Not Enough Credits", insufficient balance, 402 — top up and the retry loop auto-resumes |
+| **Quota / session-limit / budget exhaustion** | **Retried** — labelled in `/retry status` | "You've hit your limit", `insufficient_quota`, "out of budget", suspended accounts |
+| Invalid API key / unknown model | **Retried** — no exception | The key or model may be fixed mid-loop |
+| Context overflow | **Retried** alongside SDK compaction | Oversized payload; either path can recover the turn |
+| Connection errors | **Uncapped** with exponential backoff | Network hiccups, connection drops, socket errors, stream exhaustion |
 | Max tokens (`stopReason: "length"`) | **Auto-continue** indefinitely with hidden continuation turns | Model hits output token limit mid-generation |
 | Empty / think-only stop (`stopReason: "stop"` with no text or tool calls) | **Nudge once** with a hidden continuation, then give up | Model ends its turn with no usable output (Anthropic empty responses with end_turn, thinking-only turns) |
 
@@ -51,20 +53,18 @@ By default, pi has built-in retry for some errors (rate limits, 5xx, overloaded)
 
 ## The Solution
 
-This extension provides automatic retry for all errors with configurable exponential backoff and a maximum-delay failure limit (2s → 4s → 8s → ... → 60s by default).
+This extension provides automatic retry for all errors with configurable exponential backoff (2s → 4s → 8s → ... → 60s by default) and keeps retrying at the maximum delay forever.
 
-**Philosophy: retry EVERYTHING by default.** The only things we skip are a tiny blacklist of known permanent failures (invalid API key, model not found, unsupported model, etc.).
+**Philosophy: retry EVERYTHING, forever.** Nothing is excluded — not an invalid API key, not a missing model, not an exhausted quota. Only a user abort (ESC), fresh input, or a session change stops the loop.
 
 **Features:**
 - **Catch-all retry** — Any `stopReason: "error"` is retried, regardless of error message
 - Automatic detection of 400/413, connection, credit, and stream exhaustion errors
 - **Auto-continuation** when the model hits its max output tokens (`stopReason: "length"`) — indefinite, no cap, hidden from the TUI
-- **Retry cutoff** — Keeps retrying until success, abort, or the configured number of failures at the maximum delay
-- **Auto-stop on quota/budget exhaustion** — Session limits, plan quotas, and budget caps ("You've hit your limit", "out of budget", `insufficient_quota`, suspended accounts) are detected and **not** retried, with a notification explaining why
-- Exponential backoff with configurable base delay, cap, multiplier, and maximum-delay failure count
+- **No cutoff** — Keeps retrying at the maximum backoff until success, abort, or session change, with a notification explaining why
+- Exponential backoff with configurable base delay, cap, and multiplier
 - **Hidden triggers** — provider-valid custom messages use `display: false`, so retries do not add TUI clutter
 - Manual controls via unified `/retry` command
-- Non-retryable errors are explicitly logged so you know why we didn't retry
 
 ---
 
@@ -139,20 +139,18 @@ The extension reads a `piRetry` object from Pi's settings files:
   "piRetry": {
     "baseDelayMs": 10000,
     "maxDelayMs": 3600000,
-    "multiplier": 2,
-    "maxRetriesAtMaxDelay": 3
+    "multiplier": 2
   }
 }
 ```
 
-The example above waits 10 seconds before the first retry, doubles each delay, caps the delay at one hour, and stops after three failed retries at that cap. Supported values are:
+The example above waits 10 seconds before the first retry, doubles each delay, caps the delay at one hour, and keeps retrying at that cap until you abort. Supported values are:
 
 | Setting | Default | Description |
 |---------|---------|-------------|
 | `baseDelayMs` | `2000` | Delay before the first retry, in milliseconds |
 | `maxDelayMs` | `60000` | Maximum delay between retries, in milliseconds |
 | `multiplier` | `2` | Exponential backoff multiplier; must be at least `1` |
-| `maxRetriesAtMaxDelay` | `3` | Failed ordinary retries allowed after the delay reaches `maxDelayMs` |
 | `messageFreeRetries` | `false` | Retry errors without a hidden retry message (see below) |
 
 `piRetry` is separate from Pi's built-in `retry` object so the two retry policies do not share ambiguous settings. The extension disables Pi's native retry scheduler while it is loaded, while preserving Pi's compaction handling, so only one retry loop owns the backoff schedule.
@@ -184,12 +182,11 @@ the raw session history.
 
 1. **Listen to `agent_end` event** — Fires after each agent turn completes
 2. **Check for any error** — Examine the last assistant message for `stopReason === "error"`
-3. **Blacklist check** — Skip known permanent failures (invalid API key, model not found, quota/session-limit/budget exhaustion, suspended accounts, etc.)
-4. **Categorize for messaging** — Classify into 400/413, credit, connection, or other for nice UI notifications
-5. **Retry or continue with hidden turns** — Wait with exponential backoff, then trigger a provider-valid custom user turn via `pi.sendMessage()` with `display: false` and `triggerTurn: true` (with `messageFreeRetries`, error retries omit the failed response and continue instead)
-6. **Valid provider context** — Hidden retry and continuation messages remain in context so providers never receive a trailing assistant message
-7. **Indefinite continuation** — Max_tokens auto-continues are uncapped; repeated `length` stops keep producing continuation turns until the model terminates normally
-8. **Empty-stop recovery** — A `stop` turn with no usable output (only thinking, or nothing at all) gets exactly one hidden "nudge" continuation, then gives up. Matches Anthropic's documented "empty responses with `end_turn`" remedy (continuation prompt in a new user message) — retrying an empty response in place doesn't help because the model has already decided it's done.
+3. **Categorize for messaging** — Classify into 400/413, credit, connection, quota, or other for `/retry status` diagnostics (labelling only; it never gates retrying)
+4. **Retry or continue with hidden turns** — Wait with exponential backoff, then trigger a provider-valid custom user turn via `pi.sendMessage()` with `display: false` and `triggerTurn: true` (with `messageFreeRetries`, error retries omit the failed response and continue instead)
+5. **Valid provider context** — Hidden retry and continuation messages remain in context so providers never receive a trailing assistant message
+6. **Indefinite continuation** — Max_tokens auto-continues are uncapped; repeated `length` stops keep producing continuation turns until the model terminates normally
+7. **Empty-stop recovery** — A `stop` turn with no usable output (only thinking, or nothing at all) gets exactly one hidden "nudge" continuation, then gives up. Matches Anthropic's documented "empty responses with `end_turn`" remedy (continuation prompt in a new user message) — retrying an empty response in place doesn't help because the model has already decided it's done.
 8. **Lifecycle exposure** — Emits `pi-retry:started`, `pi-retry:completed`, and `pi-retry:cancelled` on Pi's shared extension event bus with a matching `retryId`, allowing status integrations to suppress intermediate completion signals
 
 The pi's built-in `transform-messages` already strips aborted/errored assistant messages from the LLM context, so the model never sees the failed attempts.
@@ -199,27 +196,17 @@ The pi's built-in `transform-messages` already strips aborted/errored assistant
 ## Detected Error Patterns
 
 ### Catch-All (Any Error)
-- **Any** assistant message with `stopReason === "error"` is retried by default
+- **Any** assistant message with `stopReason === "error"` is retried — nothing is excluded
 - Unknown provider errors, stream errors, unexpected failures — all handled automatically
-- Only skipped if it matches a known permanent failure (invalid API key, missing model, etc.)
-
-### Non-Retryable (Permanent Failures)
-These are explicitly **not** retried:
-- Invalid API key / invalid authentication
-- API key not found / missing / revoked
-- Model not found / unknown model / no such model / model does not exist
-- Unsupported model
-
-### Non-Retryable (Quota / Session Limit / Budget)
-Exhausted quotas, session limits, and budgets are auto-detected and stop the retry loop (with an explanatory notification), because retrying is pointless until you act or the reset window passes:
-- **Usage / session limits with reset windows** — "You've hit your limit · resets …" and "5-hour limit reached" (Claude Code), "You've hit your usage limit" / "You've exceeded your usage limit" (Codex), "You have hit your ChatGPT usage limit (plus plan)" (ChatGPT subscription caps via the Codex backend, also `usage_limit_reached`)
-- **Plan / billing quotas** — OpenAI `insufficient_quota`, "You exceeded your current quota, please check your plan and billing details" (OpenAI, Gemini — reached only after pi's built-in 429 retry gives up)
-- **Google subscription caps** — "You have exhausted your capacity on this model. Your quota will reset after …" (Gemini Code Assist), "You have reached the quota limit for …" / "You can resume using this model at …" (Antigravity)
-- **Hard allotments** — OpenRouter `free-models-per-day`, Alibaba Coding Plan window quotas "hour/week/month allocated quota exceeded" and free-quota exhaustion "free allocated quota exceeded" (the bare "Allocated quota exceeded" is TPM rate limiting and stays retryable), GitHub Copilot "premium request allowance", z.ai GLM Coding Plan "Usage limit reached for 5 hour" / "no resource package"
-- **Budget exhaustion** — "out of budget", "Budget has been exceeded" (LiteLLM-style proxies), max/spending/monthly limits
-- **Suspended accounts** — "Your account … is suspended" (Kimi `exceeded_current_quota_error`)
-
-Deliberate distinction: plain pay-as-you-go **balance** errors stay retryable — DeepSeek 402 "Insufficient Balance", OpenRouter 402 "Insufficient credits", Kimi "exceeded your current token quota". A mid-session top-up lets the retry loop auto-resume, whereas session limits and budgets do not self-resolve for hours.
+
+### Retried Like Everything Else
+These used to be treated as permanent. They are now retried too, because the cause can disappear mid-loop (a key gets refreshed, a quota window rolls over, the context gets compacted):
+- Invalid API key / invalid authentication / revoked or missing key
+- Model not found / unknown model / unsupported model
+- **Quota, session-limit and budget exhaustion** — "You've hit your limit · resets …" (Claude Code, Codex, ChatGPT plans), `insufficient_quota` (OpenAI), "You have exhausted your capacity on this model" (Gemini Code Assist), `free-models-per-day` (OpenRouter), "out of budget" (LiteLLM-style proxies), suspended accounts (Kimi)
+- **Context overflow** — "prompt is too long", "exceeds the context window", and friends
+
+These messages are still labelled `quota` in `/retry status`, so an endless retry loop tells you whether you are waiting on billing or on the network.
 
 ### Max Tokens (stopReason: "length")
 - The model hit its `max_tokens` / output token limit
@@ -324,7 +311,7 @@ Use the status command to diagnose:
 
 ### Want to see what's happening?
 
-The extensions send notifications on retry attempts. Look at the footer status line for retry status updates. Non-retryable errors are logged as errors so you know why we stopped.
+The extensions send notifications on retry attempts. Look at the footer status line for retry status updates, and `/retry status` for the per-category attempt counters and the last error text.
 
 ### Too many retries?
 
@@ -354,9 +341,9 @@ pi install npm:@georgebashi/pi-retry
 
 - Pi's native retry scheduler is disabled while this extension is loaded so native and extension retries cannot interleave; Pi's compaction check still runs normally
 - Error messages remain in the session history (but are invisible to the LLM)
-- May hit the same error repeatedly if the issue is persistent (use `Ctrl+C` to abort)
-- **Warning**: Retrying 400/413 without reducing context may fail repeatedly if the payload is genuinely too large
-- Non-retryable errors (invalid API key, missing model, quota/session-limit/budget exhaustion) are logged but not retried — you'll need to fix the underlying issue, then use `/retry`
+- Every error class is retried, so a permanent-looking failure (invalid API key, exhausted quota, genuinely oversized context) keeps firing at the maximum backoff until the cause is fixed
+- Escape aborts the loop; fresh input or `/new` also stops it
+- **Warning**: Retrying 400/413 without reducing context may fail repeatedly if the payload is genuinely too large — run `/compact`
 
 ---
 
@@ -390,8 +377,7 @@ no built-in marker or identity check for any specific subagent tool.
         ]
       },
       "baseDelayMs": 1000,
-      "maxDelayMs": 10000,
-      "maxRetriesAtMaxDelay": 2
+      "maxDelayMs": 10000
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mehdisadeghi/pi-retry",
-  "version": "0.11.2",
+  "version": "0.12.0",
   "description": "Extension suite for pi coding agent that handles 400/413 errors and connection errors with automatic retry",
   "type": "module",
   "author": "Tom X Nguyen",
@@ -42,13 +42,13 @@
   },
   "peerDependencies": {
     "@earendil-works/pi-agent-core": "*",
+    "@earendil-works/pi-ai": "*",
     "@earendil-works/pi-coding-agent": "*",
-    "@earendil-works/pi-tui": "*",
-    "@earendil-works/pi-ai": "*"
+    "@earendil-works/pi-tui": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "1.3.0",
     "@earendil-works/pi-agent-core": "1.3.0",
+    "@earendil-works/pi-ai": "1.3.0",
     "@earendil-works/pi-coding-agent": "1.3.0",
     "@earendil-works/pi-tui": "1.3.0",
     "@types/node": "25.9.1",

package/retry.ts

@@ -6,18 +6,13 @@ import {
   hasCreditError,
   hasConnectionError,
   hasRetryableError,
-  isNonRetryableError,
-  isSilencedError,
-  hasQuotaExhaustedError,
   hasMaxTokensStop,
   hasEmptyStop,
-  isContextOverflowError,
   isAssistantMessage,
   getLastAssistantMessage,
   calculateDelay,
   DEFAULT_RETRY_CONFIG,
   loadPiRetrySettings,
-  formatDuration,
   formatRetryCountdown,
   getErrorCategory,
   RETRY_STATUS_KEY,
@@ -49,10 +44,9 @@ const sdkHooksSupported = installRetrySdkHooks();
  * Unified retry extension — retries EVERY error by default.
  *
  * Philosophy: any assistant message with stopReason === "error" is retried
- * with exponential backoff capped by settings, then stops after the configured
- * number of failures at the maximum delay, except a small blacklist of known
- * permanent failures and hard-stop conditions (invalid API key, model not
- * found, quota/session-limit/budget exhaustion, suspended accounts, etc.).
+ * with exponential backoff and retried again forever, with no error blacklist
+ * and no failure cap. Only a user abort (ESC) or a session change stops the
+ * loop; the delay stays pinned at the configured maxDelayMs meanwhile.
  *
  * Specific categories (400/413, credit, connection, stream exhaustion, etc.)
  * are tracked for diagnostics but all share the same retry mechanism.
@@ -243,6 +237,8 @@ export default function (pi: ExtensionAPI) {
   let _notifyFn: ((message: string, level: "info" | "warning" | "error") => void) | null = null;
   let _setStatusFn: ((text: string | undefined) => void) | null = null;
   let retryConfig = { ...DEFAULT_RETRY_CONFIG };
+  // SAFETY: the extension API object is only ever used as a stable WeakMap
+  // / identity key for per-session ownership; pi's own type does not say so.
   const owner = pi as unknown as object;
   // Policy source of each inline controller, so a session reclassified between
   // session_start and before_agent_start never keeps the other policy.
@@ -446,7 +442,7 @@ export default function (pi: ExtensionAPI) {
   // Instead, the handler detects errors and kicks off
   // triggerInvisibleContinue(), which owns the retry loop with backoff
   // sleeps that happen AFTER processEvents returns (outside the agent run).
-  pi.on("agent_end", async (event, ctx) => {
+  pi.on("agent_end", async (_event, ctx) => {
     const binding = getRetrySession(ctx.sessionManager);
     if (binding && binding.owner !== owner) return;
     if (binding?.isChild) {
@@ -512,39 +508,24 @@ export default function (pi: ExtensionAPI) {
       return;
     }
 
-    // Context overflow: defer to compaction. Do NOT retry here.
-    //
-    // Retrying the same oversized context before compaction would produce an
-    // uncapped overflow loop. Leave _continueInProgress false so Pi can run
-    // its normal compaction and retry path with the reduced context.
-    if (isContextOverflowError(lastAssistant)) {
-      ctx.ui.notify(
-        "Context overflow — deferring to compaction (auto-retry after compact).",
-        "info",
-      );
-      return;
-    }
-
-    // Catch-all: retry ANY error except known permanent failures
+    // Catch-all: retry EVERY error. Invalid API keys, missing models,
+    // quota/budget exhaustion and context overflow are retried too — pi-core
+    // may compact in parallel, and a hidden turn on the reduced context is
+    // exactly what recovers the turn.
     if (hasRetryableError(lastAssistant)) {
       const errorMsg = lastAssistant.errorMessage || "Unknown error";
       const category = getErrorCategory(errorMsg);
 
       // Pick the right state tracker for diagnostics
       let state: RetryState;
-      let label: string;
       if (category === "400-413") {
         state = state400;
-        label = "400/413";
       } else if (category === "credit") {
         state = stateCredit;
-        label = "Credit";
       } else if (category === "connection") {
         state = stateConnection;
-        label = "Connection";
       } else {
         state = stateOther;
-        label = category === "builtin" ? "Server" : "Other";
       }
 
       if (state.getIsRetrying()) return;
@@ -557,18 +538,6 @@ export default function (pi: ExtensionAPI) {
       triggerForContext("retry", ctx);
       return;
     }
-
-    // Log non-retryable errors so the user knows why we didn't retry
-    // (silenced errors are neither retried nor shown)
-    if (isNonRetryableError(lastAssistant) && !isSilencedError(lastAssistant)) {
-      const errorMsg = lastAssistant.errorMessage || "Unknown error";
-      ctx.ui.notify(
-        hasQuotaExhaustedError(lastAssistant)
-          ? `Quota/limit exhausted — not retrying (fix plan/billing or wait for the reset window, then /retry): ${errorMsg.substring(0, 100)}`
-          : `Non-retryable error (not retried): ${errorMsg.substring(0, 100)}`,
-        "error",
-      );
-    }
   });
 
 
@@ -652,8 +621,7 @@ export default function (pi: ExtensionAPI) {
         status += `  Base delay: ${retryConfig.baseDelayMs}ms\n`;
         status += `  Max delay: ${retryConfig.maxDelayMs}ms\n`;
         status += `  Backoff multiplier: ${retryConfig.multiplier}\n`;
-        status += `  Max-delay failures: ${retryConfig.maxRetriesAtMaxDelay}\n`;
-        status += "  Retry loop: until success, abort, or the max-delay failure limit\n\n";
+        status += "  Retry loop: until success, abort, or session change (uncapped)\n\n";
 
         // Last assistant info
         if (lastAssistant && isAssistantMessage(lastAssistant)) {
@@ -709,29 +677,8 @@ export default function (pi: ExtensionAPI) {
         return;
       }
 
-      // Context overflow: don't retry in place — reducing context is required.
-      // Compaction (pi-vcc / /compact) handles it and auto-retries. Retrying
-      // without compaction loops forever on a genuinely oversized payload.
-      if (isContextOverflowError(lastAssistant)) {
-        ctx.ui.notify(
-          "Context overflow — use /compact (or /pi-vcc) to reduce context. Compaction auto-retries.",
-          "info",
-        );
-        return;
-      }
-
-      // Non-retryable errors (permanent failures + quota/budget
-      // exhaustion): report clearly instead of the generic fallback.
-      if (isNonRetryableError(lastAssistant)) {
-        const errorMsg = lastAssistant.errorMessage || "Unknown error";
-        ctx.ui.notify(
-          hasQuotaExhaustedError(lastAssistant)
-            ? `Quota/limit exhausted — resolve the plan/billing issue or wait for the reset window first: ${errorMsg.substring(0, 100)}`
-            : `Non-retryable error (fix the underlying issue first, then /retry): ${errorMsg.substring(0, 100)}`,
-          "warning",
-        );
-        return;
-      }
+      // Every error is retryable, including quota/budget exhaustion and
+      // context overflow — no gate here, the same as the automatic path.
 
       // Auto-detect error type and trigger appropriate retry
       if (has400or413Error(lastAssistant)) {
@@ -910,9 +857,6 @@ export default function (pi: ExtensionAPI) {
       // and answers the nudge with another empty turn is decided, not stalled.
       // Stop after MAX_EMPTY_CONTINUATIONS rather than looping forever.
       let emptyNudges = 0;
-      // Only ordinary retries count toward the maximum-delay cutoff; token
-      // continuations intentionally remain uncapped.
-      let maxDelayRetries = 0;
 
       // Loop until success, abort, or session change.
       while (true) {
@@ -949,10 +893,6 @@ export default function (pi: ExtensionAPI) {
           ? ++retryAttempt
           : Math.max(1, retryAttempt + 1);
         const delay = calculateDelay(delayAttempt, retryConfig);
-        const isMaxDelay = delay >= retryConfig.maxDelayMs;
-        if (hiddenTurnKind === "retry" && isMaxDelay) {
-          maxDelayRetries++;
-        }
 
         // Interruptible sleep with backoff BEFORE the retry attempt. The
         // helper emits the initial frame and replaces it every 100ms instead
@@ -1005,25 +945,14 @@ export default function (pi: ExtensionAPI) {
 
         // The hidden AgentSession turn completed. Both errors and output
         // length stops need another turn; all other terminal states are done.
+        // Loop until success, abort, or session change. No failure cap: an
+        // error that never resolves keeps retrying at the maximum backoff
+        // until the user aborts with ESC or replaces the session.
         hiddenTurnKind = getHiddenTurnKind(myAgent);
         if (!hiddenTurnKind) {
           didRetryComplete = true;
           return;
         }
-
-        // Stop ordinary retries after the configured number of failures at
-        // the cap. The failed capped turns have already been delivered; this
-        // check prevents scheduling one more capped request.
-        if (
-          hiddenTurnKind === "retry" &&
-          maxDelayRetries >= retryConfig.maxRetriesAtMaxDelay
-        ) {
-          notifySafely(
-            `Retry failed ${retryConfig.maxRetriesAtMaxDelay} times at the maximum backoff (${formatDuration(retryConfig.maxDelayMs)}); giving up.`,
-            "warning",
-          );
-          return;
-        }
       }
     } finally {
       // Always remove the mutable countdown row when the loop completes,

package/src/child-retry.ts

@@ -11,12 +11,8 @@ import {
   getLastAssistantMessage,
   hasEmptyStop,
   hasMaxTokensStop,
-  hasQuotaExhaustedError,
   hasRetryableError,
   isAssistantMessage,
-  isContextOverflowError,
-  isNonRetryableError,
-  isSilencedError,
   RETRY_TRIGGER_CUSTOM_TYPE,
 } from "./error-patterns.js";
 import {
@@ -74,8 +70,6 @@ export class ChildRetryController {
   private readonly continuationState = new ContinuationState();
   /** Empty-stop continuation counter, bounded to one nudge. */
   private emptyNudges = 0;
-  /** Number of ordinary attempts whose delay reached the configured cap. */
-  private maxDelayRetries = 0;
   /** Number of ordinary retry turns scheduled from this original prompt. */
   private retryAttempt = 0;
   /** Prevents duplicate scheduling if an event and manual command race. */
@@ -132,15 +126,6 @@ export class ChildRetryController {
     if (!lastAssistant || !isAssistantMessage(lastAssistant)) return;
     if (this.driving) return;
 
-    // Compaction owns context overflow. The child controller must not queue a
-    // same-context retry that races the SDK's compaction recovery.
-    if (isContextOverflowError(lastAssistant)) {
-      this.notify(ctx, "Context overflow - deferring to compaction.", "info");
-      this.resetCounters();
-      this.finishLifecycle(false);
-      return;
-    }
-
     if (hasMaxTokensStop(lastAssistant)) {
       if (this.continuationState.getIsContinuing()) return;
       this.continuationState.startContinuation();
@@ -170,24 +155,8 @@ export class ChildRetryController {
       return;
     }
 
-    // Re-evaluate permanent and quota errors for every attempt, including a
-    // provider that changes its error category after a transient failure.
-    if (isNonRetryableError(lastAssistant)) {
-      const errorMsg = lastAssistant.errorMessage || "Unknown error";
-      if (!isSilencedError(lastAssistant)) {
-        this.notify(
-          ctx,
-          hasQuotaExhaustedError(lastAssistant)
-            ? `Quota/limit exhausted - not retrying: ${errorMsg.substring(0, 100)}`
-            : `Non-retryable error (not retried): ${errorMsg.substring(0, 100)}`,
-          "warning",
-        );
-      }
-      this.resetCounters();
-      this.finishLifecycle(false);
-      return;
-    }
-
+    // Every error is retryable — invalid API keys, missing models,
+    // quota/budget exhaustion and context overflow included.
     if (!hasRetryableError(lastAssistant)) return;
 
     const errorMsg = lastAssistant.errorMessage || "Unknown error";
@@ -291,7 +260,6 @@ export class ChildRetryController {
     for (const state of Object.values(this.states)) state.reset();
     this.continuationState.reset();
     this.emptyNudges = 0;
-    this.maxDelayRetries = 0;
     this.retryAttempt = 0;
     this.finishLifecycle(false);
   }
@@ -359,21 +327,8 @@ export class ChildRetryController {
       if (kind === "retry") {
         this.retryAttempt++;
       }
-      if (kind === "retry" && this.maxDelayRetries >= this.config.maxRetriesAtMaxDelay) {
-        this.notify(
-          ctx,
-          `Retry failed ${this.config.maxRetriesAtMaxDelay} times at the maximum backoff; giving up.`,
-          "warning",
-        );
-        this.resetCounters();
-        this.finishLifecycle(false);
-        return;
-      }
       const attempt = kind === "retry" ? this.retryAttempt : this.retryAttempt + 1;
       const delay = calculateDelay(attempt, this.config);
-      if (kind === "retry" && delay >= this.config.maxDelayMs) {
-        this.maxDelayRetries++;
-      }
 
       // An automatic error retry can continue the active run without a message;
       // a manual retry starts from idle, where only a queued message can.
@@ -550,7 +505,6 @@ export class ChildRetryController {
     for (const state of Object.values(this.states)) state.succeed();
     this.continuationState.complete();
     this.emptyNudges = 0;
-    this.maxDelayRetries = 0;
     this.retryAttempt = 0;
   }
 

package/src/config.ts

@@ -14,8 +14,6 @@ import {
  * Complete retry configuration used by the extension.
  */
 export interface PiRetryConfig extends BackoffConfig {
-  /** Number of failed retries allowed after the delay reaches maxDelayMs. */
-  maxRetriesAtMaxDelay: number;
   /**
    * Retry errors by omitting the failed response and continuing the same
    * request, instead of queueing a hidden retry message. Opt-in.
@@ -35,8 +33,6 @@ export interface PiRetrySubagentsOverride {
   maxDelayMs?: number;
   /** Child retry exponential multiplier. */
   multiplier?: number;
-  /** Failed child retries allowed at the maximum delay. */
-  maxRetriesAtMaxDelay?: number;
   /** Child override for message-free error retries. */
   messageFreeRetries?: boolean;
   /** Optional policy-selection rules for effective system prompts. */
@@ -80,7 +76,6 @@ export interface PiRetrySettings {
  */
 export const DEFAULT_RETRY_CONFIG: PiRetryConfig = {
   ...DEFAULT_BACKOFF_CONFIG,
-  maxRetriesAtMaxDelay: 3,
   messageFreeRetries: false,
 };
 
@@ -338,12 +333,6 @@ function resolveMainRetryConfig(
       DEFAULT_RETRY_CONFIG.multiplier,
       value => value >= 1,
     ),
-    maxRetriesAtMaxDelay: readNumberSetting(
-      mergedSettings,
-      "maxRetriesAtMaxDelay",
-      DEFAULT_RETRY_CONFIG.maxRetriesAtMaxDelay,
-      value => Number.isInteger(value) && value >= 1,
-    ),
     messageFreeRetries: readBooleanSetting(
       mergedSettings,
       "messageFreeRetries",
@@ -417,13 +406,6 @@ export function resolvePiRetrySettings(
         value => value >= 1,
         `${PI_RETRY_SETTINGS_KEY}.subagents.multiplier`,
       ),
-      maxRetriesAtMaxDelay: readNumberSetting(
-        mergedSubagents,
-        "maxRetriesAtMaxDelay",
-        main.maxRetriesAtMaxDelay,
-        value => Number.isInteger(value) && value >= 1,
-        `${PI_RETRY_SETTINGS_KEY}.subagents.maxRetriesAtMaxDelay`,
-      ),
       messageFreeRetries: readBooleanSetting(
         mergedSubagents,
         "messageFreeRetries",
@@ -494,6 +476,8 @@ export function loadPiRetryConfig(
  * @returns Decoded JSON contents, or an empty object when unavailable.
  */
 function readSettingsFile(filePath: string): unknown {
+  // SAFETY: contents come from an arbitrary user settings file, so the honest
+  // type is unknown; every caller validates through isSettingsObject first.
   try {
     return JSON.parse(readFileSync(filePath, "utf8")) as unknown;
   } catch (error) {

package/src/error-patterns.ts

@@ -1,10 +1,11 @@
 /**
  * Error pattern matching utilities for retry extensions
  *
- * Philosophy: retry EVERY error by default.  The only things we skip are a
- * tiny blacklist of known permanent failures (e.g. invalid API key, model
- * does not exist).  Everything else — 400s, connection issues, credit errors,
- * stream exhaustion, provider hiccups, unknown errors — is retried.
+ * Philosophy: retry EVERY error. There is no blacklist and no cap — invalid
+ * API keys, missing models, quota/budget exhaustion, context overflow,
+ * 400s, connection issues, stream exhaustion, unknown errors are all retried
+ * with backoff until the user aborts. The pattern groups below exist only to
+ * label errors in `/retry status`; none of them gate retrying.
  */
 
 import type { AgentMessage } from "@earendil-works/pi-agent-core";
@@ -67,72 +68,9 @@ const BUILTIN_HANDLED_PATTERNS = [
   /retry\s*delay/i,
 ];
 
-// Context-overflow error patterns. Mirrors pi-core's OVERFLOW_PATTERNS in
-// @earendil-works/pi-ai/dist/utils/overflow.js so that pi-retry defers to
-// compaction exactly when pi-core's _checkCompaction will detect overflow and
-// compact + retry. kept in sync manually — pi-ai is not a direct dependency.
-//
-// Why these are NOT retried by pi-retry: a hidden retry turn would re-send
-// the same oversized context, so it overflows again → infinite loop
-// (pi-retry's loop is uncapped for errors). pi-core instead compacts and
-// retries once via agent.continue(); with static compaction (pi-vcc) that
-// reliably reduces context, so the single retry succeeds.
-const OVERFLOW_ERROR_PATTERNS = [
-  /prompt is too long/i,
-  /request_too_large/i,
-  /input is too long for requested model/i,
-  /exceeds the context window/i,
-  /exceeds (?:the )?(?:model'?s )?maximum context length(?: of [\d,]+ tokens?|\s*\([\d,]+\))/i,
-  /input token count.*exceeds the maximum/i,
-  /maximum prompt length is \d+/i,
-  /reduce the length of the messages/i,
-  /maximum context length is \d+ tokens/i,
-  /exceeds (?:the )?maximum allowed input length of [\d,]+ tokens?/i,
-  /input \(\d+ tokens\) is longer than the model'?s context length \(\d+ tokens\)/i,
-  /exceeds the limit of \d+/i,
-  /exceeds the available context size/i,
-  /greater than the context length/i,
-  /context window exceeds limit/i,
-  /exceeded model token limit/i,
-  /too large for model with \d+ maximum context length/i,
-  /model_context_window_exceeded/i,
-  /prompt too long; exceeded (?:max )?context length/i,
-  /context[_ ]length[_ ]exceeded/i,
-  /too many tokens/i,
-  /token limit exceeded/i,
-  /^4(?:00|13)\s*(?:status code)?\s*\(no body\)/i,
-];
-
-// Patterns that look like overflow but are actually rate limiting / throttling.
-// Mirrors pi-core's NON_OVERFLOW_PATTERNS. Excluded from overflow detection so
-// throttling errors are still retried (they are not context-size problems).
-const NON_OVERFLOW_PATTERNS = [
-  /^(Throttling error|Service unavailable):/i,
-  /rate limit/i,
-  /too many requests/i,
-];
-
-// ── Blacklist: errors that are truly permanent and should NOT be retried ──
-
-const NON_RETRYABLE_PATTERNS = [
-  /invalid\s*api\s*key/i,
-  /invalid\s*authentication/i,
-  /api\s*key\s*(not\s*found|missing|revoked)/i,
-  /model\s*not\s*found/i,
-  /unknown\s*model/i,
-  /no\s*such\s*model/i,
-  /model\s*does\s*not\s*exist/i,
-  /unsupported\s*model/i,
-  /cannot continue from message role/i,
-];
-
-// Errors that are non-retryable AND should be silently ignored (no notification)
-const SILENCED_PATTERNS = [/cannot continue from message role/i];
-
-// Quota / session-limit / budget exhaustion — hard stops:
-// retrying is pointless until the user upgrades, tops up a budget, or waits
-// out a reset window measured in hours/days. Distinct from per-minute rate
-// limits and pay-as-you-go balance errors, which stay retryable.
+// Quota / session-limit / budget exhaustion — labelled in `/retry status` so
+// a user staring at an endless retry loop can see the cause is billing, not
+// the network. Retried like every other error.
 //
 // Evidence (real provider messages):
 // - Claude Code:  "You've hit your limit · resets 4pm (Asia/Kuala_Lumpur)"
@@ -174,7 +112,7 @@ const SILENCED_PATTERNS = [/cannot continue from message role/i];
 // Balance" and 429 "Rate Limit Reached" (concurrency), Kimi TPD org limits
 // and "exceeded your current token quota" (balance), Alibaba "Allocated quota
 // exceeded" (429 Throttling.AllocationQuota — TPM rate limiting, recovers in
-// minutes). See the note on hasQuotaExhaustedError below.
+// minutes). Retried like every other error.
 export const QUOTA_EXHAUSTED_PATTERNS = [
   // Session / usage limits with reset windows (Claude, Codex, ChatGPT plans)
   /hit your (?:[a-z]+ )?usage limit/i, // "…hit your usage limit", "…hit your ChatGPT usage limit (plus plan)" — the optional word is the provider name; "hit your rate limit" intentionally NOT matched (burst limit stays retryable)
@@ -246,74 +184,18 @@ export function hasConnectionError(message: AgentMessage): boolean {
   return CONNECTION_ERROR_PATTERNS.some((p) => p.test(message.errorMessage!));
 }
 
-/**
- * Returns true for an error assistant message whose errorMessage indicates a
- * context-overflow (input exceeded the model's context window).
- *
- * Mirrors pi-core's isContextOverflow Case 1 (error-message patterns). The
- * silent-overflow cases (stopReason "stop"/"length") are not errors and are
- * never seen here — pi-core handles those in _checkCompaction directly.
- *
- * Callers should treat a true result as "defer to compaction, do NOT retry" —
- * see OVERFLOW_ERROR_PATTERNS for rationale.
- */
-export function isContextOverflowError(message: AgentMessage): boolean {
-  if (!isAssistantMessage(message)) return false;
-  if (message.stopReason !== "error" || !message.errorMessage) return false;
-  if (NON_OVERFLOW_PATTERNS.some((p) => p.test(message.errorMessage!)))
-    return false;
-  return OVERFLOW_ERROR_PATTERNS.some((p) => p.test(message.errorMessage!));
-}
-
 // ── Universal retry check ──
 
 /**
- * Returns true for ANY assistant message with stopReason === "error"
- * except a tiny blacklist of known permanent failures.
- */
-export function hasRetryableError(message: AgentMessage): boolean {
-  if (!isAssistantMessage(message)) return false;
-  if (message.stopReason !== "error" || !message.errorMessage) return false;
-  return !isNonRetryableError(message);
-}
-
-/**
- * Returns true only for known permanent failures (invalid API key, missing model, etc.)
- */
-export function isNonRetryableError(message: AgentMessage): boolean {
-  if (!isAssistantMessage(message)) return false;
-  if (message.stopReason !== "error" || !message.errorMessage) return false;
-  return (
-    NON_RETRYABLE_PATTERNS.some((p) => p.test(message.errorMessage!)) ||
-    QUOTA_EXHAUSTED_PATTERNS.some((p) => p.test(message.errorMessage!))
-  );
-}
-
-/**
- * Returns true for quota / session-limit / budget exhaustion errors where
- * retrying is pointless until the user acts (upgrade, top up a budget) or a
- * long reset window passes (hours/days). Treated as non-retryable.
+ * Returns true for ANY assistant message with stopReason === "error".
  *
- * Deliberately NOT matched: per-minute rate limits (429s) and pay-as-you-go
- * balance errors (DeepSeek "Insufficient Balance", OpenRouter "Insufficient
- * credits", Kimi "exceeded your current token quota") — those stay retryable
- * so a mid-session top-up auto-resumes.
+ * Nothing is excluded: invalid API keys, missing models, quota/budget
+ * exhaustion and context overflow are retried like every other error. The
+ * caller is only allowed to stop on a user abort or a session change.
  */
-export function hasQuotaExhaustedError(message: AgentMessage): boolean {
-  if (!isAssistantMessage(message)) return false;
-  if (message.stopReason !== "error" || !message.errorMessage) return false;
-  return QUOTA_EXHAUSTED_PATTERNS.some((p) => p.test(message.errorMessage!));
-}
-
-/**
- * Returns true for errors that are non-retryable and should be silently
- * ignored (no UI notification). These are provider-level refusals that
- * the user cannot act on and that would only add noise.
- */
-export function isSilencedError(message: AgentMessage): boolean {
+export function hasRetryableError(message: AgentMessage): boolean {
   if (!isAssistantMessage(message)) return false;
-  if (message.stopReason !== "error" || !message.errorMessage) return false;
-  return SILENCED_PATTERNS.some((p) => p.test(message.errorMessage!));
+  return message.stopReason === "error" && Boolean(message.errorMessage);
 }
 
 // ── Categorisation (for UI messages) ──