@north-light/crouter 0.3.170 → 0.3.172

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.ts

@@ -59,15 +59,32 @@ const TRANSIENT_ROTATE_COOLDOWN_MS = 60 * 1000;
 // healthy model response into a fatal generation fault.
 const SUBSCRIPTION_LOCK_RETRY_BACKOFFS_MS = [25, 75, 150];
 
-let runtimeContext: ExtensionContext | undefined;
-let extensionAPI: ExtensionAPI | undefined;
-
 // A declared non-managed provider is re-registered with the route driver at
 // session start, after its owning extension has registered its real transport.
 // Keep that composed transport here: calling the registry after our wrapper is
 // installed would recurse back into the route driver.
 type ProviderStream = (model: Model<any>, context: Context, options?: SimpleStreamOptions) => AssistantMessageEventStream;
-const delegatedProviderStreams = new Map<string, ProviderStream>();
+
+export interface ProviderRotationOptions {
+  modelIntent?: string;
+  nodeCwd?: string;
+  profileId?: string;
+}
+
+type ProviderRotationState = {
+  runtimeContext?: ExtensionContext;
+  extensionAPI?: ExtensionAPI;
+  delegatedProviderStreams: Map<string, ProviderStream>;
+  options?: Readonly<ProviderRotationOptions>;
+};
+
+function createProviderRotationState(options?: ProviderRotationOptions): ProviderRotationState {
+  return { delegatedProviderStreams: new Map(), ...(options === undefined ? {} : { options: { ...options } }) };
+}
+
+function configuredValue(state: ProviderRotationState, key: keyof ProviderRotationOptions, envName: string): string | undefined {
+  return state.options === undefined ? process.env[envName] : state.options[key];
+}
 
 type AttemptResult = {
   result: "success" | "rate_limited" | "transient_exhausted" | "fatal";
@@ -75,6 +92,7 @@ type AttemptResult = {
   attemptAt: number;
   attempts?: number;
   classification?: ProviderErrorClassification;
+  failureMessage?: string;
 };
 
 // A genuine rate limit (HTTP 429, or 503 with a real Retry-After header) must
@@ -126,6 +144,18 @@ function classifyProviderError(error: unknown, observed: { status?: number; retr
   return { kind: "fatal", status, reason: "unclassified", hadRetryAfterHeader };
 }
 
+function providerErrorMessage(error: unknown): string | undefined {
+  const value = error as { errorMessage?: unknown; message?: unknown } | undefined;
+  const message = typeof value?.errorMessage === "string" && value.errorMessage.trim()
+    ? value.errorMessage.trim()
+    : typeof value?.message === "string" && value.message.trim()
+      ? value.message.trim()
+      : error instanceof Error && error.message.trim()
+        ? error.message.trim()
+        : undefined;
+  return message;
+}
+
 async function defaultSleep(ms: number): Promise<void> {
   await new Promise<void>((resolve) => setTimeout(resolve, ms));
 }
@@ -186,8 +216,8 @@ function isUserAbortError(error: unknown, signal: AbortSignal | undefined): bool
   return (error instanceof Error && /abort/i.test(error.name)) || /request was aborted|operation was aborted|the user aborted/i.test(message);
 }
 
-function setStatus(text: string): void {
-  runtimeContext?.ui.setStatus("provider-rotation", text);
+function setStatus(state: ProviderRotationState, text: string): void {
+  state.runtimeContext?.ui.setStatus("provider-rotation", text);
 }
 
 function logRotation(message: string): void {
@@ -251,24 +281,26 @@ type ResolvedCredential = SubscriptionCredential & { access: string };
 
 // The registered provider exposes its OAuth flow through `provider.auth.oauth`. Composed managed
 // providers retain that flow, so the session registry supplies the Anthropic and Codex flows.
-function oauthFlow(providerId: ManagedProviderId, ctx?: ExtensionContext): OAuthAuth {
-  const oauth = (ctx ?? runtimeContext)?.modelRegistry.getProvider(providerId)?.auth.oauth;
+function oauthFlow(providerId: ManagedProviderId, ctx: ExtensionContext | undefined): OAuthAuth {
+  const oauth = ctx?.modelRegistry.getProvider(providerId)?.auth.oauth;
   if (!oauth) throw new Error(`${getProviderLabel(providerId)} has no OAuth flow registered`);
   return oauth;
 }
 
 // `refresh` is a pure token exchange that reads only `credential.refresh` and persists
 // nothing; crouter records the rotated token in the selected pool row.
-async function defaultRefreshForProvider(providerId: ManagedProviderId, refreshToken: string): Promise<RefreshedCredential> {
-  return oauthFlow(providerId).refresh({ type: "oauth", refresh: refreshToken, access: "", expires: 0 });
+async function defaultRefreshForProvider(state: ProviderRotationState, providerId: ManagedProviderId, refreshToken: string): Promise<RefreshedCredential> {
+  return oauthFlow(providerId, state.runtimeContext).refresh({ type: "oauth", refresh: refreshToken, access: "", expires: 0 });
 }
 
+type RefreshForProvider = (providerId: ManagedProviderId, refreshToken: string) => Promise<RefreshedCredential>;
+
 // Indirection so tests can inject refresh failures without real network calls.
-let activeRefreshForProvider: typeof defaultRefreshForProvider = defaultRefreshForProvider;
+let activeRefreshForProvider: RefreshForProvider | undefined;
 
 /** Test-only seam: override the per-provider refresh function. Pass undefined to restore the default. */
-export function __setRefreshForProviderForTest(fn: typeof defaultRefreshForProvider | undefined): void {
-  activeRefreshForProvider = fn ?? defaultRefreshForProvider;
+export function __setRefreshForProviderForTest(fn: RefreshForProvider | undefined): void {
+  activeRefreshForProvider = fn;
 }
 
 function openBrowser(url: string): void {
@@ -295,19 +327,21 @@ function openBrowser(url: string): void {
 // `getApiKey`, which wraps pi-ai's `getOAuthApiKey` and collapses a refresh failure into a
 // generic message; calling `activeRefreshForProvider` directly keeps the real error intact so
 // `isInvalidRefreshTokenError` can classify it (cooldown -> reauth -> cross-provider-fallback).
-async function refreshCredentialIfNeeded(providerId: ManagedProviderId, credential: SubscriptionCredential): Promise<ResolvedCredential> {
+async function refreshCredentialIfNeeded(state: ProviderRotationState, providerId: ManagedProviderId, credential: SubscriptionCredential): Promise<ResolvedCredential> {
   if (!credential.refresh || !credential.access || credential.expires === undefined) {
     throw new Error(`${getProviderLabel(providerId)} subscription "${credential.label}" is missing its credential value`);
   }
   if (credential.expires > Date.now()) return credential as ResolvedCredential;
-  const refreshed = await refreshSubscriptionCredential(providerId, credential.label, (token) => activeRefreshForProvider(providerId, token));
+  const refreshed = await refreshSubscriptionCredential(providerId, credential.label, (token) =>
+    activeRefreshForProvider?.(providerId, token) ?? defaultRefreshForProvider(state, providerId, token),
+  );
   return { ...credential, ...refreshed } as ResolvedCredential;
 }
 
 /** Test-only seam: exercises the real `refreshCredentialIfNeeded` (including its locked refresh
  * transaction) without duplicating its logic. */
 export async function __refreshCredentialIfNeededForTest(providerId: ManagedProviderId, credential: SubscriptionCredential): Promise<ResolvedCredential> {
-  return refreshCredentialIfNeeded(providerId, credential);
+  return refreshCredentialIfNeeded(createProviderRotationState(), providerId, credential);
 }
 
 async function defaultLoginForProvider(providerId: ManagedProviderId, ctx: ExtensionContext): Promise<LoginCredential> {
@@ -321,8 +355,8 @@ export function __setLoginForProviderForTest(fn: typeof defaultLoginForProvider
   activeLoginForProvider = fn ?? defaultLoginForProvider;
 }
 
-async function reauthenticateCredential(providerId: ManagedProviderId, credential: SubscriptionCredential): Promise<ResolvedCredential | undefined> {
-  const ctx = runtimeContext;
+async function reauthenticateCredential(state: ProviderRotationState, providerId: ManagedProviderId, credential: SubscriptionCredential): Promise<ResolvedCredential | undefined> {
+  const ctx = state.runtimeContext;
   if (!ctx?.hasUI) return undefined;
   ctx.ui.notify(`${getProviderLabel(providerId)} subscription "${credential.label}" needs re-authentication. Opening OAuth login...`, "warning");
   const authenticated = await activeLoginForProvider(providerId, ctx);
@@ -375,6 +409,7 @@ export function __setStreamForProviderForTest(fn: typeof defaultStreamForProvide
 // A genuine rate limit ends the attempt immediately (the caller cools the credential down
 // and rotates); a transient blip gets a short in-place retry budget before giving up.
 async function streamProviderAttempt(
+  state: ProviderRotationState,
   providerId: string,
   model: Model<any>,
   context: Context,
@@ -397,10 +432,10 @@ async function streamProviderAttempt(
         await options?.onResponse?.(response as any, responseModel);
       },
     };
-    const provider = runtimeContext?.modelRegistry.getProvider?.(model.provider);
+    const provider = state.runtimeContext?.modelRegistry.getProvider?.(model.provider);
     const inner = credential
       ? streamForProvider(model, context, streamOptions)
-      : delegatedProviderStreams.get(providerId)?.(model, context, streamOptions)
+      : state.delegatedProviderStreams.get(providerId)?.(model, context, streamOptions)
         ?? provider?.streamSimple(model, context, streamOptions)
         ?? streamForProvider(model, context, streamOptions);
 
@@ -408,6 +443,7 @@ async function streamProviderAttempt(
     let sawContent = false;
     let committed = false;
     let classification: ProviderErrorClassification | undefined;
+    let failureMessage: string | undefined;
 
     // Events are buffered ONLY until this attempt commits to the provider -- i.e. until the
     // first real content event (thinking/text/toolcall) arrives, after which rotating away is
@@ -433,6 +469,7 @@ async function streamProviderAttempt(
             flush();
             return { result: "fatal", attemptAt };
           }
+          failureMessage = providerErrorMessage(event.error);
           classification = classifyProviderError(event.error, { status: observedStatus, retryAfterMs: requestedRetryAfterMs });
           if (classification.kind === "fatal" || sawContent) {
             emit(event);
@@ -457,6 +494,7 @@ async function streamProviderAttempt(
         flush();
         return { result: "fatal", attemptAt };
       }
+      failureMessage = providerErrorMessage(error);
       classification = classifyProviderError(error, { status: observedStatus, retryAfterMs: requestedRetryAfterMs });
       if (classification.kind === "fatal" || sawContent) {
         emit({
@@ -493,7 +531,7 @@ async function streamProviderAttempt(
       // to another credential / fallback provider. Nothing is emitted into the stream here:
       // the buffered (pre-content) events are discarded exactly like the rate-limit path, so
       // the rotation target streams a clean turn.
-      return { result: "transient_exhausted", attemptAt, classification, attempts: attempt };
+      return { result: "transient_exhausted", attemptAt, classification, attempts: attempt, failureMessage };
     }
     logRotation(
       `${credential ? `${getProviderLabel(providerId as ManagedProviderId)} subscription "${credential.label}"` : providerId} hit a transient error (${classification.reason}, status=${classification.status ?? "n/a"}); retrying same route in ${backoffMs}ms (attempt ${attempt + 1})`,
@@ -560,20 +598,29 @@ function logRouteQueueAdvance(from: RouteCandidate, to: RouteCandidate | undefin
 // Drive the deterministic route queue from the live rank. Managed routes walk
 // their pool rows; every other declared route is one configured credential.
 async function runManagedProvider(
+  state: ProviderRotationState,
   model: Model<any>,
   context: Context,
   options: SimpleStreamOptions | undefined,
   stream: AssistantMessageEventStream,
 ): Promise<void> {
-  const liveThinking = runtimeContext?.thinkingLevel === undefined || runtimeContext?.thinkingLevel === 'off'
+  const liveThinking = state.runtimeContext?.thinkingLevel === undefined || state.runtimeContext?.thinkingLevel === 'off'
     ? undefined
-    : runtimeContext.thinkingLevel;
-  const request = modelRequestFromConfig(`${model.provider}/${model.id}${liveThinking ? `:${liveThinking}` : ''}`, process.env['CRTR_MODEL_INTENT'], false);
-  const expanded = request ? expandModelCandidates(request, process.env['CRTR_NODE_CWD'], process.env['CRTR_PROFILE_ID']) : [];
+    : state.runtimeContext.thinkingLevel;
+  const request = modelRequestFromConfig(
+    `${model.provider}/${model.id}${liveThinking ? `:${liveThinking}` : ''}`,
+    configuredValue(state, 'modelIntent', 'CRTR_MODEL_INTENT'),
+    false,
+  );
+  const expanded = request ? expandModelCandidates(
+    request,
+    configuredValue(state, 'nodeCwd', 'CRTR_NODE_CWD'),
+    configuredValue(state, 'profileId', 'CRTR_PROFILE_ID'),
+  ) : [];
   const liveRank = expanded.find((candidate) => candidate.providerId === model.provider && candidate.modelId === model.id && candidate.thinkingLevel === liveThinking)?.rank ?? 0;
   const routeCandidates: RouteCandidate[] = expanded.slice(liveRank)
     .map((route) => {
-      const registry = runtimeContext?.modelRegistry;
+      const registry = state.runtimeContext?.modelRegistry;
       const routeModel = registry?.find(route.providerId, route.modelId);
       if (!registry || !routeModel) return undefined;
       const availability = probeRouteAvailability(route, registry);
@@ -598,6 +645,7 @@ async function runManagedProvider(
   const seenReadyLabels = new Map<string, Set<string>>();
   const cooldownAttempts = new Map<string, number>();
   let terminalModel = model;
+  let lastTransientFailure: AttemptResult | undefined;
 
   for (let candidate = candidates.shift(); candidate !== undefined; candidate = candidates.shift()) {
     const { routeId, providerId, model: candidateModel } = candidate;
@@ -606,16 +654,17 @@ async function runManagedProvider(
     attemptedRoutes.add(routeId);
     terminalModel = candidateModel;
 
-    if (!await switchToRoute(extensionAPI!, runtimeContext!, candidate)) {
+    if (!await switchToRoute(state.extensionAPI!, state.runtimeContext!, candidate)) {
       emitTerminalError(stream, candidateModel, `Provider route ${routeId} is unavailable: failed to select ${providerId}/${candidateModel.id}`);
       return;
     }
 
     if (!isManagedProvider(providerId)) {
-      const result = await streamProviderAttempt(providerId, candidateModel, context, options, undefined, stream);
+      const result = await streamProviderAttempt(state, providerId, candidateModel, context, options, undefined, stream);
       if (result.result === 'success') { stream.end(); return; }
       if (result.result === 'fatal') { stream.end(); return; }
       const cooldownMs = result.result === 'rate_limited' ? result.retryAfterMs ?? DEFAULT_RATE_LIMIT_BACKOFF_MS : TRANSIENT_ROTATE_COOLDOWN_MS;
+      if (result.result === 'transient_exhausted') lastTransientFailure = result;
       localCoolingDeadlines.set(routeId, Math.max(localCoolingDeadlines.get(routeId) ?? 0, Date.now() + cooldownMs));
       logRouteQueueAdvance(candidate, candidates[0], result);
       continue;
@@ -632,12 +681,12 @@ async function runManagedProvider(
     for (const credential of available) {
       let freshCredential: ResolvedCredential;
       try {
-        freshCredential = await refreshCredentialIfNeeded(providerId, credential);
+        freshCredential = await refreshCredentialIfNeeded(state, providerId, credential);
       } catch (error) {
         if (!isInvalidRefreshTokenError(error)) throw error;
         let reauthenticated: ResolvedCredential | undefined;
-        try { reauthenticated = await reauthenticateCredential(providerId, credential); } catch (loginError) {
-          runtimeContext?.ui.notify(`${getProviderLabel(providerId)} re-authentication failed: ${loginError instanceof Error ? loginError.message : String(loginError)}`, 'error');
+        try { reauthenticated = await reauthenticateCredential(state, providerId, credential); } catch (loginError) {
+          state.runtimeContext?.ui.notify(`${getProviderLabel(providerId)} re-authentication failed: ${loginError instanceof Error ? loginError.message : String(loginError)}`, 'error');
         }
         if (!reauthenticated) {
           const attemptAt = Date.now();
@@ -647,7 +696,7 @@ async function runManagedProvider(
         }
         freshCredential = reauthenticated;
       }
-      const result = await streamProviderAttempt(providerId, candidateModel, context, options, freshCredential, stream);
+      const result = await streamProviderAttempt(state, providerId, candidateModel, context, options, freshCredential, stream);
       if (result.result === 'success') {
         if (freshCredential.rateLimitedUntil || freshCredential.authFailure) await recordSubscriptionMutation(`recording ${getProviderLabel(providerId)} success`, () => markSubscriptionSuccess(providerId, freshCredential.label, result.attemptAt));
         stream.end();
@@ -655,9 +704,9 @@ async function runManagedProvider(
       }
       if (result.result === 'fatal') { stream.end(); return; }
       const cooldownMs = result.result === 'rate_limited' ? result.retryAfterMs ?? DEFAULT_RATE_LIMIT_BACKOFF_MS : TRANSIENT_ROTATE_COOLDOWN_MS;
-      if ((result.result === 'rate_limited' && result.retryAfterMs !== undefined) || result.result === 'transient_exhausted') {
-        const source = result.result === 'transient_exhausted' ? 'transient cooldown' : 'server cooldown';
-        const persisted = await recordSubscriptionMutation(`recording ${getProviderLabel(providerId)} ${source}`, () => markSubscriptionRateLimited(providerId, freshCredential.label, cooldownMs, result.attemptAt));
+      if (result.result === 'transient_exhausted') lastTransientFailure = result;
+      if (result.result === 'rate_limited' && result.retryAfterMs !== undefined) {
+        const persisted = await recordSubscriptionMutation(`recording ${getProviderLabel(providerId)} server cooldown`, () => markSubscriptionRateLimited(providerId, freshCredential.label, cooldownMs, result.attemptAt));
         if (persisted) cooldownAttempts.set(`${routeId}/${freshCredential.label}`, result.attemptAt);
         else localCoolingDeadlines.set(routeId, Math.max(localCoolingDeadlines.get(routeId) ?? 0, Date.now() + cooldownMs));
       } else {
@@ -672,6 +721,11 @@ async function runManagedProvider(
 
   const coolingDeadline = earliestCoolingDeadline([...knownRoutes.values()], localCoolingDeadlines);
   const tried = [...attemptedRoutes].join(', ');
+  if (lastTransientFailure !== undefined) {
+    const detail = lastTransientFailure.failureMessage ?? lastTransientFailure.classification?.reason ?? 'unknown connection failure';
+    emitTerminalError(stream, terminalModel, `Provider routes failed after transient retries: ${detail} (tried ${tried})`);
+    return;
+  }
   if (coolingDeadline !== undefined) {
     emitCoolingError(stream, terminalModel, new ManagedProviderCoolingError(`All provider routes are rate limited (cooling down ~${Math.ceil((coolingDeadline - Date.now()) / 1000)}s; tried ${tried})`, coolingDeadline));
     return;
@@ -720,10 +774,10 @@ function emitCoolingError(stream: AssistantMessageEventStream, model: Model<any>
   stream.end();
 }
 
-function streamManagedProvider(model: Model<any>, context: Context, options?: SimpleStreamOptions): AssistantMessageEventStream {
+function streamManagedProvider(state: ProviderRotationState, model: Model<any>, context: Context, options?: SimpleStreamOptions): AssistantMessageEventStream {
   const stream = createAssistantMessageEventStream();
 
-  runManagedProvider(model, context, options, stream).catch((error) => {
+  runManagedProvider(state, model, context, options, stream).catch((error) => {
     stream.push({
       type: "error",
       reason: "error",
@@ -747,39 +801,43 @@ function parseProvider(value: string | undefined): ManagedProviderId | undefined
   return isManagedProvider(value) ? value : undefined;
 }
 
-function installDeclaredRouteProviders(pi: ExtensionAPI, ctx: ExtensionContext): void {
-  const config = readMergedLaunchConfig(ctx.cwd, process.env['CRTR_PROFILE_ID'] || null);
+function installDeclaredRouteProviders(state: ProviderRotationState, pi: ExtensionAPI, ctx: ExtensionContext): void {
+  const config = readMergedLaunchConfig(ctx.cwd, configuredValue(state, 'profileId', 'CRTR_PROFILE_ID') || null);
   const providerIds = new Set(Object.values(config.modelRoutes ?? {}).map((route) => route.providerId));
   for (const providerId of providerIds) {
-    if (isManagedProvider(providerId) || delegatedProviderStreams.has(providerId)) continue;
+    if (isManagedProvider(providerId) || state.delegatedProviderStreams.has(providerId)) continue;
     const provider = ctx.modelRegistry.getProvider?.(providerId);
     const model = ctx.modelRegistry.getAll?.().find((entry) => entry.provider === providerId);
     if (!provider || !model) continue;
-    delegatedProviderStreams.set(providerId, provider.streamSimple.bind(provider));
+    state.delegatedProviderStreams.set(providerId, provider.streamSimple.bind(provider));
     // `api` is required by pi whenever a registration supplies streamSimple.
     // Re-registration merges this wrapper over the existing declaration, so the
     // provider's models, auth, and captured composed transport remain intact.
-    pi.registerProvider(providerId, { api: model.api, streamSimple: streamManagedProvider });
+    pi.registerProvider(providerId, { api: model.api, streamSimple: (model, context, options) => streamManagedProvider(state, model, context, options) });
   }
 }
 
-function updateRotationStatus(ctx: ExtensionContext): void {
+function updateRotationStatus(state: ProviderRotationState, ctx: ExtensionContext): void {
   const current = getCurrentModelRef(ctx.model);
-  if (current && isManagedProvider(current.providerId)) setStatus(formatStatusLine(current.providerId));
+  if (current && isManagedProvider(current.providerId)) setStatus(state, formatStatusLine(current.providerId));
 }
 
 /** Restore only when the deterministic route rank improves; no shared-home
  * preferred-model state is needed or consulted. */
-async function restoreHigherRankIfAvailable(pi: ExtensionAPI, ctx: ExtensionContext): Promise<boolean> {
+async function restoreHigherRankIfAvailable(state: ProviderRotationState, pi: ExtensionAPI, ctx: ExtensionContext): Promise<boolean> {
   if (!readRotationConfig().revertWhenAvailable) return false;
   const liveThinking = ctx.thinkingLevel === undefined || ctx.thinkingLevel === 'off' ? undefined : ctx.thinkingLevel;
   const request = modelRequestFromConfig(
     `${ctx.model?.provider ?? ''}/${ctx.model?.id ?? ''}${liveThinking ? `:${liveThinking}` : ''}`,
-    process.env['CRTR_MODEL_INTENT'],
+    configuredValue(state, 'modelIntent', 'CRTR_MODEL_INTENT'),
     false,
   );
   if (!request || !ctx.model) return false;
-  const candidates = expandModelCandidates(request, process.env['CRTR_NODE_CWD'], process.env['CRTR_PROFILE_ID']);
+  const candidates = expandModelCandidates(
+    request,
+    configuredValue(state, 'nodeCwd', 'CRTR_NODE_CWD'),
+    configuredValue(state, 'profileId', 'CRTR_PROFILE_ID'),
+  );
   const liveRank = candidates.find((candidate) => candidate.providerId === ctx.model?.provider && candidate.modelId === ctx.model?.id && candidate.thinkingLevel === liveThinking)?.rank;
   if (liveRank === undefined) return false;
   const preferred = candidates.find((candidate) => candidate.rank < liveRank && resolveProviderCandidates([{
@@ -895,134 +953,141 @@ async function loginProvider(providerId: ManagedProviderId, ctx: ExtensionContex
   );
 }
 
-export default async function (pi: ExtensionAPI): Promise<void> {
-  extensionAPI = pi;
+export function createProviderRotationExtension(options?: ProviderRotationOptions): (pi: ExtensionAPI) => Promise<void> {
+  const state = createProviderRotationState(options);
 
-  pi.registerProvider(ANTHROPIC_PROVIDER_ID, {
-    api: "anthropic-messages",
-    streamSimple: streamManagedProvider,
-  });
-
-  pi.registerProvider(OPENAI_CODEX_PROVIDER_ID, {
-    api: "openai-codex-responses",
-    streamSimple: streamManagedProvider,
-  });
+  return async (pi: ExtensionAPI): Promise<void> => {
+    state.extensionAPI = pi;
 
-  pi.on("session_start", async (_event, ctx) => {
-    runtimeContext = ctx;
-    installDeclaredRouteProviders(pi, ctx);
-    updateRotationStatus(ctx);
-  });
+    pi.registerProvider(ANTHROPIC_PROVIDER_ID, {
+      api: "anthropic-messages",
+      streamSimple: (model, context, streamOptions) => streamManagedProvider(state, model, context, streamOptions),
+    });
 
-  pi.on("before_agent_start", async (_event, ctx) => {
-    runtimeContext = ctx;
-    const restored = await restoreHigherRankIfAvailable(pi, ctx);
-    if (restored && ctx.model && isManagedProvider(ctx.model.provider)) {
-      logRotation(`restored higher-ranked route ${ctx.model.provider}/${ctx.model.id}`);
-      setStatus(formatStatusLine(ctx.model.provider));
-    }
-  });
+    pi.registerProvider(OPENAI_CODEX_PROVIDER_ID, {
+      api: "openai-codex-responses",
+      streamSimple: (model, context, streamOptions) => streamManagedProvider(state, model, context, streamOptions),
+    });
 
-  pi.on("model_select", async (_event, ctx) => {
-    runtimeContext = ctx;
-    updateRotationStatus(ctx);
-  });
+    pi.on("session_start", async (_event, ctx) => {
+      state.runtimeContext = ctx;
+      installDeclaredRouteProviders(state, pi, ctx);
+      updateRotationStatus(state, ctx);
+    });
 
-  pi.registerCommand("provider-sub", {
-    description: "Manage subscription credential pools for provider rotation",
-    handler: async (args, ctx) => {
-      const [providerArg, verb, ...rest] = parseCommand(args);
-      const providerId = parseProvider(providerArg);
-      if (!providerId) {
-        ctx.ui.notify("Usage: /provider-sub <anthropic|openai-codex> <list|add|select|rm>", "error");
-        return;
+    pi.on("before_agent_start", async (_event, ctx) => {
+      state.runtimeContext = ctx;
+      const restored = await restoreHigherRankIfAvailable(state, pi, ctx);
+      if (restored && ctx.model && isManagedProvider(ctx.model.provider)) {
+        logRotation(`restored higher-ranked route ${ctx.model.provider}/${ctx.model.id}`);
+        setStatus(state, formatStatusLine(ctx.model.provider));
       }
+    });
 
-      const action = verb === "rm" ? "remove" : verb || "list";
+    pi.on("model_select", async (_event, ctx) => {
+      state.runtimeContext = ctx;
+      updateRotationStatus(state, ctx);
+    });
 
-      if (action === "status" || action === "list") {
-        const pool = readSubscriptionPool(providerId);
-        const lines = [formatStatusLine(providerId), ""];
-        for (const [index, entry] of pool.entries()) {
-          const cooldown = entry.rateLimitedUntil > Date.now() ? ` cooldown=${Math.ceil((entry.rateLimitedUntil - Date.now()) / 1000)}s` : "";
-          const account = entry.accountId ? ` account=${shortAccountId(entry.accountId)}` : "";
-          lines.push(`${index + 1}. ${entry.label}${account}${cooldown}`);
+    pi.registerCommand("provider-sub", {
+      description: "Manage subscription credential pools for provider rotation",
+      handler: async (args, ctx) => {
+        const [providerArg, verb, ...rest] = parseCommand(args);
+        const providerId = parseProvider(providerArg);
+        if (!providerId) {
+          ctx.ui.notify("Usage: /provider-sub <anthropic|openai-codex> <list|add|select|rm>", "error");
+          return;
         }
-        ctx.ui.notify(lines.join("\n"), "info");
-        return;
-      }
 
-      if (action === "add") {
-        if (!ctx.hasUI) {
-          ctx.ui.notify(`${getProviderLabel(providerId)} login requires an interactive UI.`, "error");
+        const action = verb === "rm" ? "remove" : verb || "list";
+
+        if (action === "status" || action === "list") {
+          const pool = readSubscriptionPool(providerId);
+          const lines = [formatStatusLine(providerId), ""];
+          for (const [index, entry] of pool.entries()) {
+            const cooldown = entry.rateLimitedUntil > Date.now() ? ` cooldown=${Math.ceil((entry.rateLimitedUntil - Date.now()) / 1000)}s` : "";
+            const account = entry.accountId ? ` account=${shortAccountId(entry.accountId)}` : "";
+            lines.push(`${index + 1}. ${entry.label}${account}${cooldown}`);
+          }
+          ctx.ui.notify(lines.join("\n"), "info");
           return;
         }
-        const pool = readSubscriptionPool(providerId);
-        const label = (rest.join(" ") || (await ctx.ui.input(`${getProviderLabel(providerId)} subscription label`, "")) || "").trim();
-        if (!label) return;
-        if (pool.some((entry) => entry.label.toLowerCase() === label.toLowerCase())) {
-          ctx.ui.notify(`${getProviderLabel(providerId)} subscription already exists: ${label}`, "error");
+
+        if (action === "add") {
+          if (!ctx.hasUI) {
+            ctx.ui.notify(`${getProviderLabel(providerId)} login requires an interactive UI.`, "error");
+            return;
+          }
+          const pool = readSubscriptionPool(providerId);
+          const label = (rest.join(" ") || (await ctx.ui.input(`${getProviderLabel(providerId)} subscription label`, "")) || "").trim();
+          if (!label) return;
+          if (pool.some((entry) => entry.label.toLowerCase() === label.toLowerCase())) {
+            ctx.ui.notify(`${getProviderLabel(providerId)} subscription already exists: ${label}`, "error");
+            return;
+          }
+          try {
+            const cred = await activeLoginForProvider(providerId, ctx);
+            const identity = await enrichManagedLoginIdentity(providerId, cred);
+            // Explicit add always creates a new label, so a matching real account is rejected by
+            // the locked uniqueness gate rather than creating a second quota slot.
+            await addSubscription(providerId, {
+              label,
+              refresh: cred.refresh,
+              access: cred.access,
+              expires: cred.expires,
+              ...(identity.accountId ? { accountId: identity.accountId } : {}),
+              rateLimitedUntil: 0,
+              lastAttemptAt: 0,
+              lastRateLimitedAt: 0,
+            });
+            logRotation(`added ${getProviderLabel(providerId)} subscription "${label}"`);
+            ctx.ui.notify(`Added ${getProviderLabel(providerId)} subscription: ${label}`, "info");
+            updateRotationStatus(state, ctx);
+          } catch (error) {
+            ctx.ui.notify(error instanceof Error ? error.message : String(error), "error");
+          }
           return;
         }
-        try {
-          const cred = await activeLoginForProvider(providerId, ctx);
-          const identity = await enrichManagedLoginIdentity(providerId, cred);
-          // Explicit add always creates a new label, so a matching real account is rejected by
-          // the locked uniqueness gate rather than creating a second quota slot.
-          await addSubscription(providerId, {
-            label,
-            refresh: cred.refresh,
-            access: cred.access,
-            expires: cred.expires,
-            ...(identity.accountId ? { accountId: identity.accountId } : {}),
-            rateLimitedUntil: 0,
-            lastAttemptAt: 0,
-            lastRateLimitedAt: 0,
-          });
-          logRotation(`added ${getProviderLabel(providerId)} subscription "${label}"`);
-          ctx.ui.notify(`Added ${getProviderLabel(providerId)} subscription: ${label}`, "info");
-          updateRotationStatus(ctx);
-        } catch (error) {
-          ctx.ui.notify(error instanceof Error ? error.message : String(error), "error");
-        }
-        return;
-      }
 
-      if (action === "select") {
-        const ref = rest.join(" ");
-        if (!ref) {
-          ctx.ui.notify(`Usage: /provider-sub ${providerId} select <label|index>`, "error");
+        if (action === "select") {
+          const ref = rest.join(" ");
+          if (!ref) {
+            ctx.ui.notify(`Usage: /provider-sub ${providerId} select <label|index>`, "error");
+            return;
+          }
+          try {
+            await promoteSubscription(providerId, ref);
+            logRotation(`selected ${getProviderLabel(providerId)} subscription "${ref}"`);
+            ctx.ui.notify(`Preferred ${getProviderLabel(providerId)} subscription: ${ref}`, "info");
+            updateRotationStatus(state, ctx);
+          } catch (error) {
+            ctx.ui.notify(error instanceof Error ? error.message : String(error), "error");
+          }
           return;
         }
-        try {
-          await promoteSubscription(providerId, ref);
-          logRotation(`selected ${getProviderLabel(providerId)} subscription "${ref}"`);
-          ctx.ui.notify(`Preferred ${getProviderLabel(providerId)} subscription: ${ref}`, "info");
-          updateRotationStatus(ctx);
-        } catch (error) {
-          ctx.ui.notify(error instanceof Error ? error.message : String(error), "error");
-        }
-        return;
-      }
 
-      if (action === "remove") {
-        const ref = rest.join(" ");
-        if (!ref) {
-          ctx.ui.notify(`Usage: /provider-sub ${providerId} rm <label|index>`, "error");
+        if (action === "remove") {
+          const ref = rest.join(" ");
+          if (!ref) {
+            ctx.ui.notify(`Usage: /provider-sub ${providerId} rm <label|index>`, "error");
+            return;
+          }
+          try {
+            await removeManagedAccount(providerId, ref);
+            logRotation(`removed ${getProviderLabel(providerId)} subscription "${ref}"`);
+            ctx.ui.notify(`Removed ${getProviderLabel(providerId)} subscription: ${ref}`, "info");
+            updateRotationStatus(state, ctx);
+          } catch (error) {
+            ctx.ui.notify(error instanceof Error ? error.message : String(error), "error");
+          }
           return;
         }
-        try {
-          await removeManagedAccount(providerId, ref);
-          logRotation(`removed ${getProviderLabel(providerId)} subscription "${ref}"`);
-          ctx.ui.notify(`Removed ${getProviderLabel(providerId)} subscription: ${ref}`, "info");
-          updateRotationStatus(ctx);
-        } catch (error) {
-          ctx.ui.notify(error instanceof Error ? error.message : String(error), "error");
-        }
-        return;
-      }
 
-      ctx.ui.notify(`Unknown /provider-sub verb: ${verb}`, "error");
-    },
-  });
+        ctx.ui.notify(`Unknown /provider-sub verb: ${verb}`, "error");
+      },
+    });
+  };
 }
+
+const defaultProviderRotationExtension = createProviderRotationExtension();
+export default defaultProviderRotationExtension;

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/statusline.ts

@@ -218,11 +218,10 @@ export default function (pi: ExtensionAPI) {
 		});
 
 		// --- Input bar border: session-name badge with solid background ---
-		// Compose with whatever editor is already installed (e.g. the mode-switch
-		// badge on the bottom border) instead of replacing it: wrap the previous
-		// factory in a Proxy that overrides only render (session-name badge on the
-		// top border). Other editor decorations keep working regardless of load
-		// order.
+		// Compose with whatever editor is already installed instead of replacing it:
+		// wrap the previous factory in a Proxy that overrides only render
+		// (session-name badge on the top border). Other editor decorations keep
+		// working regardless of load order.
 		const previousEditorFactory = ctx.ui.getEditorComponent();
 		ctx.ui.setEditorComponent((tui, theme, keybindings) => {
 			const base = (