@north-light/crouter 0.3.192 → 0.3.193

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/__tests__/serial/provider-rotation.test.ts

@@ -138,8 +138,11 @@ test("brick-repro: concurrent refreshes of the same expired pool token serialize
   assert.equal(poolEntry.label, "anthropic");
 
   let refreshCalls = 0;
-  rotationModule.__setRefreshForProviderForTest(async (_providerId, refreshToken) => {
+  const requestController = new AbortController();
+  const refreshSignals: (AbortSignal | undefined)[] = [];
+  rotationModule.__setRefreshForProviderForTest(async (_providerId, refreshToken, signal) => {
     refreshCalls += 1;
+    refreshSignals.push(signal);
     if (refreshCalls === 1) {
       return { refresh: "shared-refresh-rotated", access: "access-fresh", expires: Date.now() + 60_000 };
     }
@@ -150,11 +153,12 @@ test("brick-repro: concurrent refreshes of the same expired pool token serialize
 
   try {
     const [a, b] = await Promise.all([
-      rotationModule.__refreshCredentialIfNeededForTest("anthropic", poolEntry),
-      rotationModule.__refreshCredentialIfNeededForTest("anthropic", poolEntry),
+      rotationModule.__refreshCredentialIfNeededForTest("anthropic", poolEntry, requestController.signal),
+      rotationModule.__refreshCredentialIfNeededForTest("anthropic", poolEntry, requestController.signal),
     ]);
 
     assert.equal(refreshCalls, 1);
+    assert.deepEqual(refreshSignals, [requestController.signal], 'the request abort signal reaches the serialized token exchange');
     assert.equal(a.access, "access-fresh");
     assert.equal(b.access, "access-fresh");
 
@@ -1192,6 +1196,100 @@ test("surfaces the underlying transient error without reporting a rate limit whe
   }
 });
 
+// Regression: a transport-poisoned process (a corrupted TLS upload leaves undici's H2
+// session destroyed, so EVERY request fails with no HTTP response while fresh processes
+// succeed) must self-terminate after consecutive transport-only exhausted passes so the
+// daemon respawns the broker fresh — and any pass that saw a real HTTP status must reset
+// the counter so ordinary provider blips never kill a healthy process.
+test("self-terminates after consecutive transport-only exhausted passes; an HTTP status resets the counter", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+
+  const { ctx, providers, events, pi } = makeRotationCtx(undefined);
+  rotationModule.__setSleepForTest(async () => {});
+  let mode: "success" | "transport" | "http503" = "success";
+  rotationModule.__setStreamForProviderForTest(() => {
+    const current = mode;
+    return (async function* () {
+      if (current === "success") {
+        yield { type: "text_delta", text: "ok" };
+        return;
+      }
+      if (current === "http503") {
+        // Transient by status — but an HTTP response nonetheless: proof the
+        // process can still reach the provider.
+        yield { type: "error", error: Object.assign(new Error("Service Unavailable"), { status: 503 }) };
+        return;
+      }
+      // No status at all — the poisoned-transport signature.
+      yield {
+        type: "error",
+        error: Object.assign(new Error("fetch failed: The session has been destroyed"), {
+          errorMessage: "fetch failed: The session has been destroyed",
+        }),
+      };
+    })() as any;
+  });
+  const terminateCalls: string[] = [];
+  let resolveTerminated: (tried: string) => void;
+  const terminated = new Promise<string>((resolve) => { resolveTerminated = resolve; });
+  rotationModule.__setTerminatePoisonedProcessForTest((tried) => {
+    terminateCalls.push(tried);
+    resolveTerminated(tried);
+    return true;
+  });
+
+  const runPass = async () => {
+    const stream = providers["openai-codex"].streamSimple(
+      { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" },
+      ctx,
+    );
+    const emitted: any[] = [];
+    for await (const event of stream) emitted.push(event);
+    return emitted;
+  };
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+
+    // Baseline success pass: the cross-turn counter starts at zero.
+    assert.ok((await runPass()).some((e) => e.type === "text_delta"));
+
+    // First transport-only exhaustion: ordinary terminal error, no termination.
+    mode = "transport";
+    assert.ok((await runPass()).some((e) => e.type === "error"));
+    assert.equal(terminateCalls.length, 0);
+
+    // An exhausted pass WITH an HTTP status resets the counter.
+    mode = "http503";
+    assert.ok((await runPass()).some((e) => e.type === "error"));
+
+    // One transport-only pass after the reset: still below the limit.
+    mode = "transport";
+    assert.ok((await runPass()).some((e) => e.type === "error"));
+    assert.equal(terminateCalls.length, 0);
+
+    // Second consecutive transport-only pass: terminate fires and the stream is
+    // deliberately left open (no terminal error), so the SIGTERM abort path owns
+    // how this turn settles. Don't await the never-ending stream.
+    const stream = providers["openai-codex"].streamSimple(
+      { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" },
+      ctx,
+    );
+    const emitted: any[] = [];
+    void (async () => { for await (const event of stream) emitted.push(event); })();
+    await within(terminated, 5_000, "poisoned-process termination never fired");
+    assert.equal(terminateCalls.length, 1);
+    assert.equal(emitted.length, 0);
+  } finally {
+    rotationModule.__setTerminatePoisonedProcessForTest(undefined);
+    rotationModule.__setStreamForProviderForTest(undefined);
+    rotationModule.__setSleepForTest(undefined);
+  }
+});
+
 // Regression: a genuine rate limit (HTTP 429) must never get the transient in-place
 // retry treatment -- it cools the credential down and rotates on the FIRST failure. The
 // cooldown duration must reflect a real Retry-After header (5s here) rather than always

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.d.ts

@@ -9,6 +9,10 @@ export interface ProviderRotationOptions {
 declare function defaultSleep(ms: number): Promise<void>;
 /** Test-only seam: override the sleep implementation used for in-place/wait-out retries. Pass undefined to restore the default. */
 export declare function __setSleepForTest(fn: typeof defaultSleep | undefined): void;
+export declare const POISONED_TRANSPORT_PASS_LIMIT = 2;
+declare function defaultTerminatePoisonedProcess(tried: string): boolean;
+/** Test-only seam: override poisoned-process self-termination. Pass undefined to restore the default. */
+export declare function __setTerminatePoisonedProcessForTest(fn: typeof defaultTerminatePoisonedProcess | undefined): void;
 /** Test-only seam for the bounded, non-fatal subscription bookkeeping path. */
 export declare function __recordSubscriptionMutationForTest(description: string, mutate: () => Promise<unknown>): Promise<boolean>;
 type RefreshedCredential = {
@@ -25,12 +29,12 @@ type LoginCredential = {
 type ResolvedCredential = SubscriptionCredential & {
     access: string;
 };
-type RefreshForProvider = (providerId: ManagedProviderId, refreshToken: string) => Promise<RefreshedCredential>;
+type RefreshForProvider = (providerId: ManagedProviderId, refreshToken: string, signal?: AbortSignal) => Promise<RefreshedCredential>;
 /** Test-only seam: override the per-provider refresh function. Pass undefined to restore the default. */
 export declare function __setRefreshForProviderForTest(fn: RefreshForProvider | undefined): void;
 /** Test-only seam: exercises the real `refreshCredentialIfNeeded` (including its locked refresh
  * transaction) without duplicating its logic. */
-export declare function __refreshCredentialIfNeededForTest(providerId: ManagedProviderId, credential: SubscriptionCredential): Promise<ResolvedCredential>;
+export declare function __refreshCredentialIfNeededForTest(providerId: ManagedProviderId, credential: SubscriptionCredential, signal?: AbortSignal): Promise<ResolvedCredential>;
 declare function defaultLoginForProvider(providerId: ManagedProviderId, ctx: ExtensionContext): Promise<LoginCredential>;
 /** Test-only seam: override the per-provider login function. Pass undefined to restore the default. */
 export declare function __setLoginForProviderForTest(fn: typeof defaultLoginForProvider | undefined): void;

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.js

@@ -24,7 +24,7 @@ const TRANSIENT_ROTATE_COOLDOWN_MS = 60 * 1000;
 // healthy model response into a fatal generation fault.
 const SUBSCRIPTION_LOCK_RETRY_BACKOFFS_MS = [25, 75, 150];
 function createProviderRotationState(options) {
-    return { delegatedProviderStreams: new Map(), ...(options === undefined ? {} : { options: { ...options } }) };
+    return { delegatedProviderStreams: new Map(), transportOnlyExhaustedPasses: 0, ...(options === undefined ? {} : { options: { ...options } }) };
 }
 function configuredValue(state, key, envName) {
     return state.options === undefined ? process.env[envName] : state.options[key];
@@ -83,6 +83,33 @@ let activeSleep = defaultSleep;
 export function __setSleepForTest(fn) {
     activeSleep = fn ?? defaultSleep;
 }
+// After this many CONSECUTIVE route-queue passes in which every failure was
+// transport-level (no HTTP status and no Retry-After header — the provider was
+// never reached at all), the broker process itself is presumed poisoned: a
+// corrupted large TLS upload can leave Node/undici's HTTP/2 session permanently
+// destroyed, after which EVERY provider request from this process fails while
+// curl and fresh processes on the same host succeed. There is no clean in-process
+// heal (the dispatcher cannot be safely re-instantiated), so the recovery is a
+// fresh process: self-terminate via SIGTERM and let the daemon's exit policy
+// respawn this broker against the same session. A genuine full network outage
+// also trips this — harmlessly: the respawned broker fails the same way and the
+// daemon's respawn backoff paces the loop.
+export const POISONED_TRANSPORT_PASS_LIMIT = 2;
+function defaultTerminatePoisonedProcess(tried) {
+    // Only the broker process itself may self-terminate: runBroker stamps
+    // CRTR_BROKER_PID with its own pid at boot. Any other host (tests, tooling)
+    // keeps the ordinary terminal-error path.
+    if (process.env["CRTR_BROKER_PID"] !== String(process.pid))
+        return false;
+    logRotation(`process transport poisoned: ${POISONED_TRANSPORT_PASS_LIMIT} consecutive route-queue passes failed with no HTTP response (tried ${tried}); exiting so the daemon respawns this broker fresh`);
+    process.kill(process.pid, "SIGTERM");
+    return true;
+}
+let activeTerminatePoisonedProcess = defaultTerminatePoisonedProcess;
+/** Test-only seam: override poisoned-process self-termination. Pass undefined to restore the default. */
+export function __setTerminatePoisonedProcessForTest(fn) {
+    activeTerminatePoisonedProcess = fn ?? defaultTerminatePoisonedProcess;
+}
 function isSubscriptionLockContention(error) {
     const value = error;
     return value?.code === "ELOCKED" || (typeof value?.message === "string" && /lock file is already being held/i.test(value.message));
@@ -188,8 +215,15 @@ function oauthFlow(providerId, ctx) {
 }
 // `refresh` is a pure token exchange that reads only `credential.refresh` and persists
 // nothing; crouter records the rotated token in the selected pool row.
-async function defaultRefreshForProvider(state, providerId, refreshToken) {
-    return oauthFlow(providerId, state.runtimeContext).refresh({ type: "oauth", refresh: refreshToken, access: "", expires: 0 });
+async function defaultRefreshForProvider(state, providerId, refreshToken, parentSignal) {
+    const localController = parentSignal === undefined ? new AbortController() : undefined;
+    const signal = parentSignal ?? localController.signal;
+    try {
+        return await oauthFlow(providerId, state.runtimeContext).refresh({ type: "oauth", refresh: refreshToken, access: "", expires: 0 }, signal);
+    }
+    finally {
+        localController?.abort();
+    }
 }
 // Indirection so tests can inject refresh failures without real network calls.
 let activeRefreshForProvider;
@@ -220,19 +254,19 @@ function openBrowser(url) {
 // `getApiKey`, which wraps pi-ai's `getOAuthApiKey` and collapses a refresh failure into a
 // generic message; calling `activeRefreshForProvider` directly keeps the real error intact so
 // `isInvalidRefreshTokenError` can classify it (cooldown -> reauth -> cross-provider-fallback).
-async function refreshCredentialIfNeeded(state, providerId, credential) {
+async function refreshCredentialIfNeeded(state, providerId, credential, signal) {
     if (!credential.refresh || !credential.access || credential.expires === undefined) {
         throw new Error(`${getProviderLabel(providerId)} subscription "${credential.label}" is missing its credential value`);
     }
     if (credential.expires > Date.now())
         return credential;
-    const refreshed = await refreshSubscriptionCredential(providerId, credential.label, (token) => activeRefreshForProvider?.(providerId, token) ?? defaultRefreshForProvider(state, providerId, token));
+    const refreshed = await refreshSubscriptionCredential(providerId, credential.label, (token) => activeRefreshForProvider?.(providerId, token, signal) ?? defaultRefreshForProvider(state, providerId, token, signal));
     return { ...credential, ...refreshed };
 }
 /** Test-only seam: exercises the real `refreshCredentialIfNeeded` (including its locked refresh
  * transaction) without duplicating its logic. */
-export async function __refreshCredentialIfNeededForTest(providerId, credential) {
-    return refreshCredentialIfNeeded(createProviderRotationState(), providerId, credential);
+export async function __refreshCredentialIfNeededForTest(providerId, credential, signal) {
+    return refreshCredentialIfNeeded(createProviderRotationState(), providerId, credential, signal);
 }
 async function defaultLoginForProvider(providerId, ctx) {
     return loginProvider(providerId, ctx);
@@ -535,6 +569,10 @@ async function runManagedProvider(state, model, context, options, stream) {
     const cooldownAttempts = new Map();
     let terminalModel = model;
     let lastTransientFailure;
+    // Any HTTP response observed this pass (a status, a Retry-After header, or a
+    // rate-limit classification) proves this process can still reach a provider,
+    // clearing the poisoned-transport suspicion.
+    let sawHttpEvidence = false;
     for (let candidate = candidates.shift(); candidate !== undefined; candidate = candidates.shift()) {
         const { routeId, providerId, model: candidateModel } = candidate;
         queuedRouteIds.delete(routeId);
@@ -547,14 +585,13 @@ async function runManagedProvider(state, model, context, options, stream) {
         }
         if (!isManagedProvider(providerId)) {
             const result = await streamProviderAttempt(state, providerId, candidateModel, context, options, undefined, stream);
-            if (result.result === 'success') {
-                stream.end();
-                return;
-            }
-            if (result.result === 'fatal') {
+            if (result.result === 'success' || result.result === 'fatal') {
+                state.transportOnlyExhaustedPasses = 0;
                 stream.end();
                 return;
             }
+            if (result.result === 'rate_limited' || result.classification?.status !== undefined || result.classification?.hadRetryAfterHeader === true)
+                sawHttpEvidence = true;
             const cooldownMs = result.result === 'rate_limited' ? result.retryAfterMs ?? DEFAULT_RATE_LIMIT_BACKOFF_MS : TRANSIENT_ROTATE_COOLDOWN_MS;
             if (result.result === 'transient_exhausted')
                 lastTransientFailure = result;
@@ -575,7 +612,7 @@ async function runManagedProvider(state, model, context, options, stream) {
         for (const credential of available) {
             let freshCredential;
             try {
-                freshCredential = await refreshCredentialIfNeeded(state, providerId, credential);
+                freshCredential = await refreshCredentialIfNeeded(state, providerId, credential, options?.signal);
             }
             catch (error) {
                 if (!isInvalidRefreshTokenError(error))
@@ -597,15 +634,19 @@ async function runManagedProvider(state, model, context, options, stream) {
             }
             const result = await streamProviderAttempt(state, providerId, candidateModel, context, options, freshCredential, stream);
             if (result.result === 'success') {
+                state.transportOnlyExhaustedPasses = 0;
                 if (freshCredential.rateLimitedUntil || freshCredential.authFailure)
                     await recordSubscriptionMutation(`recording ${getProviderLabel(providerId)} success`, () => markSubscriptionSuccess(providerId, freshCredential.label, result.attemptAt));
                 stream.end();
                 return;
             }
             if (result.result === 'fatal') {
+                state.transportOnlyExhaustedPasses = 0;
                 stream.end();
                 return;
             }
+            if (result.result === 'rate_limited' || result.classification?.status !== undefined || result.classification?.hadRetryAfterHeader === true)
+                sawHttpEvidence = true;
             const cooldownMs = result.result === 'rate_limited' ? result.retryAfterMs ?? DEFAULT_RATE_LIMIT_BACKOFF_MS : TRANSIENT_ROTATE_COOLDOWN_MS;
             if (result.result === 'transient_exhausted')
                 lastTransientFailure = result;
@@ -628,10 +669,21 @@ async function runManagedProvider(state, model, context, options, stream) {
     const coolingDeadline = earliestCoolingDeadline([...knownRoutes.values()], localCoolingDeadlines);
     const tried = [...attemptedRoutes].join(', ');
     if (lastTransientFailure !== undefined) {
+        state.transportOnlyExhaustedPasses = sawHttpEvidence ? 0 : state.transportOnlyExhaustedPasses + 1;
+        if (state.transportOnlyExhaustedPasses >= POISONED_TRANSPORT_PASS_LIMIT && activeTerminatePoisonedProcess(tried)) {
+            // The stream is deliberately left OPEN: the SIGTERM handler sees a live
+            // turn, so it either certifies a clean abort (→ the daemon respawns and
+            // resumes with a continuation prompt) or marks the turn dirty (→ the
+            // respawn re-cycles the turn). Ending the stream first could settle the
+            // turn idle before the signal lands, leaving the respawned node parked
+            // with a terminal error and nothing to re-drive it.
+            return;
+        }
         const detail = lastTransientFailure.failureMessage ?? lastTransientFailure.classification?.reason ?? 'unknown connection failure';
         emitTerminalError(stream, terminalModel, `Provider routes failed after transient retries: ${detail} (tried ${tried})`);
         return;
     }
+    state.transportOnlyExhaustedPasses = 0;
     if (coolingDeadline !== undefined) {
         emitCoolingError(stream, terminalModel, new ManagedProviderCoolingError(`All provider routes are rate limited (cooling down ~${Math.ceil((coolingDeadline - Date.now()) / 1000)}s; tried ${tried})`, coolingDeadline));
         return;
@@ -803,8 +855,10 @@ const MANUAL_CODE_DIALOG = {
 async function loginProvider(providerId, ctx) {
     const oauth = oauthFlow(providerId, ctx);
     const manual = MANUAL_CODE_DIALOG[providerId];
+    const controller = new AbortController();
     let authorizeUrl;
     return loginWithManualInputCleanup(ctx, (readCode, dismissManual) => oauth.login({
+        signal: controller.signal,
         notify: (event) => {
             switch (event.type) {
                 case "auth_url":
@@ -843,7 +897,7 @@ async function loginProvider(providerId, ctx) {
             }
             return (await ctx.ui.input(prompt.message, prompt.placeholder ?? "")) ?? "";
         },
-    }));
+    })).finally(() => controller.abort());
 }
 export function createProviderRotationExtension(options) {
     const state = createProviderRotationState(options);

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.ts

@@ -77,10 +77,13 @@ type ProviderRotationState = {
   extensionAPI?: ExtensionAPI;
   delegatedProviderStreams: Map<string, ProviderStream>;
   options?: Readonly<ProviderRotationOptions>;
+  /** Consecutive route-queue passes that exhausted every route without a single
+   * HTTP response — the poisoned-process signature counted across turns. */
+  transportOnlyExhaustedPasses: number;
 };
 
 function createProviderRotationState(options?: ProviderRotationOptions): ProviderRotationState {
-  return { delegatedProviderStreams: new Map(), ...(options === undefined ? {} : { options: { ...options } }) };
+  return { delegatedProviderStreams: new Map(), transportOnlyExhaustedPasses: 0, ...(options === undefined ? {} : { options: { ...options } }) };
 }
 
 function configuredValue(state: ProviderRotationState, key: keyof ProviderRotationOptions, envName: string): string | undefined {
@@ -169,6 +172,38 @@ export function __setSleepForTest(fn: typeof defaultSleep | undefined): void {
   activeSleep = fn ?? defaultSleep;
 }
 
+// After this many CONSECUTIVE route-queue passes in which every failure was
+// transport-level (no HTTP status and no Retry-After header — the provider was
+// never reached at all), the broker process itself is presumed poisoned: a
+// corrupted large TLS upload can leave Node/undici's HTTP/2 session permanently
+// destroyed, after which EVERY provider request from this process fails while
+// curl and fresh processes on the same host succeed. There is no clean in-process
+// heal (the dispatcher cannot be safely re-instantiated), so the recovery is a
+// fresh process: self-terminate via SIGTERM and let the daemon's exit policy
+// respawn this broker against the same session. A genuine full network outage
+// also trips this — harmlessly: the respawned broker fails the same way and the
+// daemon's respawn backoff paces the loop.
+export const POISONED_TRANSPORT_PASS_LIMIT = 2;
+
+function defaultTerminatePoisonedProcess(tried: string): boolean {
+  // Only the broker process itself may self-terminate: runBroker stamps
+  // CRTR_BROKER_PID with its own pid at boot. Any other host (tests, tooling)
+  // keeps the ordinary terminal-error path.
+  if (process.env["CRTR_BROKER_PID"] !== String(process.pid)) return false;
+  logRotation(
+    `process transport poisoned: ${POISONED_TRANSPORT_PASS_LIMIT} consecutive route-queue passes failed with no HTTP response (tried ${tried}); exiting so the daemon respawns this broker fresh`,
+  );
+  process.kill(process.pid, "SIGTERM");
+  return true;
+}
+
+let activeTerminatePoisonedProcess = defaultTerminatePoisonedProcess;
+
+/** Test-only seam: override poisoned-process self-termination. Pass undefined to restore the default. */
+export function __setTerminatePoisonedProcessForTest(fn: typeof defaultTerminatePoisonedProcess | undefined): void {
+  activeTerminatePoisonedProcess = fn ?? defaultTerminatePoisonedProcess;
+}
+
 function isSubscriptionLockContention(error: unknown): boolean {
   const value = error as { code?: unknown; message?: unknown } | undefined;
   return value?.code === "ELOCKED" || (typeof value?.message === "string" && /lock file is already being held/i.test(value.message));
@@ -290,11 +325,22 @@ function oauthFlow(providerId: ManagedProviderId, ctx: ExtensionContext | undefi
 
 // `refresh` is a pure token exchange that reads only `credential.refresh` and persists
 // nothing; crouter records the rotated token in the selected pool row.
-async function defaultRefreshForProvider(state: ProviderRotationState, providerId: ManagedProviderId, refreshToken: string): Promise<RefreshedCredential> {
-  return oauthFlow(providerId, state.runtimeContext).refresh({ type: "oauth", refresh: refreshToken, access: "", expires: 0 });
+async function defaultRefreshForProvider(
+  state: ProviderRotationState,
+  providerId: ManagedProviderId,
+  refreshToken: string,
+  parentSignal?: AbortSignal,
+): Promise<RefreshedCredential> {
+  const localController = parentSignal === undefined ? new AbortController() : undefined;
+  const signal = parentSignal ?? localController!.signal;
+  try {
+    return await oauthFlow(providerId, state.runtimeContext).refresh({ type: "oauth", refresh: refreshToken, access: "", expires: 0 }, signal);
+  } finally {
+    localController?.abort();
+  }
 }
 
-type RefreshForProvider = (providerId: ManagedProviderId, refreshToken: string) => Promise<RefreshedCredential>;
+type RefreshForProvider = (providerId: ManagedProviderId, refreshToken: string, signal?: AbortSignal) => Promise<RefreshedCredential>;
 
 // Indirection so tests can inject refresh failures without real network calls.
 let activeRefreshForProvider: RefreshForProvider | undefined;
@@ -328,21 +374,30 @@ function openBrowser(url: string): void {
 // `getApiKey`, which wraps pi-ai's `getOAuthApiKey` and collapses a refresh failure into a
 // generic message; calling `activeRefreshForProvider` directly keeps the real error intact so
 // `isInvalidRefreshTokenError` can classify it (cooldown -> reauth -> cross-provider-fallback).
-async function refreshCredentialIfNeeded(state: ProviderRotationState, providerId: ManagedProviderId, credential: SubscriptionCredential): Promise<ResolvedCredential> {
+async function refreshCredentialIfNeeded(
+  state: ProviderRotationState,
+  providerId: ManagedProviderId,
+  credential: SubscriptionCredential,
+  signal?: AbortSignal,
+): Promise<ResolvedCredential> {
   if (!credential.refresh || !credential.access || credential.expires === undefined) {
     throw new Error(`${getProviderLabel(providerId)} subscription "${credential.label}" is missing its credential value`);
   }
   if (credential.expires > Date.now()) return credential as ResolvedCredential;
   const refreshed = await refreshSubscriptionCredential(providerId, credential.label, (token) =>
-    activeRefreshForProvider?.(providerId, token) ?? defaultRefreshForProvider(state, providerId, token),
+    activeRefreshForProvider?.(providerId, token, signal) ?? defaultRefreshForProvider(state, providerId, token, signal),
   );
   return { ...credential, ...refreshed } as ResolvedCredential;
 }
 
 /** Test-only seam: exercises the real `refreshCredentialIfNeeded` (including its locked refresh
  * transaction) without duplicating its logic. */
-export async function __refreshCredentialIfNeededForTest(providerId: ManagedProviderId, credential: SubscriptionCredential): Promise<ResolvedCredential> {
-  return refreshCredentialIfNeeded(createProviderRotationState(), providerId, credential);
+export async function __refreshCredentialIfNeededForTest(
+  providerId: ManagedProviderId,
+  credential: SubscriptionCredential,
+  signal?: AbortSignal,
+): Promise<ResolvedCredential> {
+  return refreshCredentialIfNeeded(createProviderRotationState(), providerId, credential, signal);
 }
 
 async function defaultLoginForProvider(providerId: ManagedProviderId, ctx: ExtensionContext): Promise<LoginCredential> {
@@ -706,6 +761,10 @@ async function runManagedProvider(
   const cooldownAttempts = new Map<string, number>();
   let terminalModel = model;
   let lastTransientFailure: AttemptResult | undefined;
+  // Any HTTP response observed this pass (a status, a Retry-After header, or a
+  // rate-limit classification) proves this process can still reach a provider,
+  // clearing the poisoned-transport suspicion.
+  let sawHttpEvidence = false;
 
   for (let candidate = candidates.shift(); candidate !== undefined; candidate = candidates.shift()) {
     const { routeId, providerId, model: candidateModel } = candidate;
@@ -721,8 +780,8 @@ async function runManagedProvider(
 
     if (!isManagedProvider(providerId)) {
       const result = await streamProviderAttempt(state, providerId, candidateModel, context, options, undefined, stream);
-      if (result.result === 'success') { stream.end(); return; }
-      if (result.result === 'fatal') { stream.end(); return; }
+      if (result.result === 'success' || result.result === 'fatal') { state.transportOnlyExhaustedPasses = 0; stream.end(); return; }
+      if (result.result === 'rate_limited' || result.classification?.status !== undefined || result.classification?.hadRetryAfterHeader === true) sawHttpEvidence = true;
       const cooldownMs = result.result === 'rate_limited' ? result.retryAfterMs ?? DEFAULT_RATE_LIMIT_BACKOFF_MS : TRANSIENT_ROTATE_COOLDOWN_MS;
       if (result.result === 'transient_exhausted') lastTransientFailure = result;
       localCoolingDeadlines.set(routeId, Math.max(localCoolingDeadlines.get(routeId) ?? 0, Date.now() + cooldownMs));
@@ -741,7 +800,7 @@ async function runManagedProvider(
     for (const credential of available) {
       let freshCredential: ResolvedCredential;
       try {
-        freshCredential = await refreshCredentialIfNeeded(state, providerId, credential);
+        freshCredential = await refreshCredentialIfNeeded(state, providerId, credential, options?.signal);
       } catch (error) {
         if (!isInvalidRefreshTokenError(error)) throw error;
         let reauthenticated: ResolvedCredential | undefined;
@@ -758,11 +817,13 @@ async function runManagedProvider(
       }
       const result = await streamProviderAttempt(state, providerId, candidateModel, context, options, freshCredential, stream);
       if (result.result === 'success') {
+        state.transportOnlyExhaustedPasses = 0;
         if (freshCredential.rateLimitedUntil || freshCredential.authFailure) await recordSubscriptionMutation(`recording ${getProviderLabel(providerId)} success`, () => markSubscriptionSuccess(providerId, freshCredential.label, result.attemptAt));
         stream.end();
         return;
       }
-      if (result.result === 'fatal') { stream.end(); return; }
+      if (result.result === 'fatal') { state.transportOnlyExhaustedPasses = 0; stream.end(); return; }
+      if (result.result === 'rate_limited' || result.classification?.status !== undefined || result.classification?.hadRetryAfterHeader === true) sawHttpEvidence = true;
       const cooldownMs = result.result === 'rate_limited' ? result.retryAfterMs ?? DEFAULT_RATE_LIMIT_BACKOFF_MS : TRANSIENT_ROTATE_COOLDOWN_MS;
       if (result.result === 'transient_exhausted') lastTransientFailure = result;
       if (result.result === 'rate_limited' && result.retryAfterMs !== undefined) {
@@ -782,10 +843,21 @@ async function runManagedProvider(
   const coolingDeadline = earliestCoolingDeadline([...knownRoutes.values()], localCoolingDeadlines);
   const tried = [...attemptedRoutes].join(', ');
   if (lastTransientFailure !== undefined) {
+    state.transportOnlyExhaustedPasses = sawHttpEvidence ? 0 : state.transportOnlyExhaustedPasses + 1;
+    if (state.transportOnlyExhaustedPasses >= POISONED_TRANSPORT_PASS_LIMIT && activeTerminatePoisonedProcess(tried)) {
+      // The stream is deliberately left OPEN: the SIGTERM handler sees a live
+      // turn, so it either certifies a clean abort (→ the daemon respawns and
+      // resumes with a continuation prompt) or marks the turn dirty (→ the
+      // respawn re-cycles the turn). Ending the stream first could settle the
+      // turn idle before the signal lands, leaving the respawned node parked
+      // with a terminal error and nothing to re-drive it.
+      return;
+    }
     const detail = lastTransientFailure.failureMessage ?? lastTransientFailure.classification?.reason ?? 'unknown connection failure';
     emitTerminalError(stream, terminalModel, `Provider routes failed after transient retries: ${detail} (tried ${tried})`);
     return;
   }
+  state.transportOnlyExhaustedPasses = 0;
   if (coolingDeadline !== undefined) {
     emitCoolingError(stream, terminalModel, new ManagedProviderCoolingError(`All provider routes are rate limited (cooling down ~${Math.ceil((coolingDeadline - Date.now()) / 1000)}s; tried ${tried})`, coolingDeadline));
     return;
@@ -971,9 +1043,11 @@ const MANUAL_CODE_DIALOG: Record<ManagedProviderId, { title: (url: string | unde
 async function loginProvider(providerId: ManagedProviderId, ctx: ExtensionContext): Promise<LoginCredential> {
   const oauth = oauthFlow(providerId, ctx);
   const manual = MANUAL_CODE_DIALOG[providerId];
+  const controller = new AbortController();
   let authorizeUrl: string | undefined;
   return loginWithManualInputCleanup(ctx, (readCode, dismissManual) =>
     oauth.login({
+      signal: controller.signal,
       notify: (event: AuthEvent): void => {
         switch (event.type) {
           case "auth_url":
@@ -1010,7 +1084,7 @@ async function loginProvider(providerId: ManagedProviderId, ctx: ExtensionContex
         return (await ctx.ui.input(prompt.message, prompt.placeholder ?? "")) ?? "";
       },
     }),
-  );
+  ).finally(() => controller.abort());
 }
 
 export function createProviderRotationExtension(options?: ProviderRotationOptions): (pi: ExtensionAPI) => Promise<void> {

package/dist/clients/attach/__tests__/chat-view-snapshot-ordering.test.js

@@ -17,7 +17,7 @@
 //      otherwise its unmounted Loader keeps requesting renders every 80 ms.
 import assert from 'node:assert/strict';
 import test from 'node:test';
-import { Container, TUI } from '@earendil-works/pi-tui';
+import { Container, TuiMainScreen } from '@earendil-works/pi-tui';
 import { AssistantMessageComponent, UserMessageComponent, initTheme, } from '@earendil-works/pi-coding-agent';
 import { ChatView } from '../render/chat-view.js';
 /** A headless terminal so TUI.requestRender's scheduled writes are no-ops (the
@@ -42,7 +42,7 @@ function fakeTerminal() {
     };
 }
 function makeChatView() {
-    const tui = new TUI(fakeTerminal());
+    const tui = new TuiMainScreen(fakeTerminal());
     const container = new Container();
     const view = new ChatView(tui, container);
     const internals = view;

package/dist/clients/attach/__tests__/group-activity.test.js

@@ -7,7 +7,7 @@
 //      must never leak into it.
 import assert from 'node:assert/strict';
 import test from 'node:test';
-import { Container, TUI } from '@earendil-works/pi-tui';
+import { Container, TuiMainScreen } from '@earendil-works/pi-tui';
 import { initTheme } from '@earendil-works/pi-coding-agent';
 import { ChatView } from '../render/chat-view.js';
 import { GroupActivityRecorder } from '../render/group-activity.js';
@@ -21,7 +21,7 @@ function fakeTerminal() {
 }
 initTheme(undefined, false);
 async function summarizedGroup(messages, key) {
-    const view = new ChatView(new TUI(fakeTerminal()), new Container());
+    const view = new ChatView(new TuiMainScreen(fakeTerminal()), new Container());
     const internals = view;
     internals.foldSettledTools = true;
     internals.showGroupSummaries = true;

package/dist/clients/attach/chrome/canvas-panels.d.ts

@@ -35,7 +35,7 @@ export interface CanvasPanelLines {
     items: CanvasPanelItem[];
 }
 /** Build the BASE panel line stacks for `nodeId`. `asks` is the per-node
- *  pending human-ticket count map the caller polls (deck/review/notify); pass
+ *  pending human-ticket count map the caller polls (page/review); pass
  *  `{}` to omit the ⚑ badges. `crons` are this node's armed schedules.
  *  `palette`
  *  drives the headers + dim cells; omit it and the panels render uncolored. */

package/dist/clients/attach/chrome/canvas-panels.js

@@ -39,7 +39,7 @@ function padStartVisible(s, w) {
     return s.length >= w ? s.slice(0, w) : ' '.repeat(w - s.length) + s;
 }
 /** Build the BASE panel line stacks for `nodeId`. `asks` is the per-node
- *  pending human-ticket count map the caller polls (deck/review/notify); pass
+ *  pending human-ticket count map the caller polls (page/review); pass
  *  `{}` to omit the ⚑ badges. `crons` are this node's armed schedules.
  *  `palette`
  *  drives the headers + dim cells; omit it and the panels render uncolored. */

package/dist/clients/attach/input/overlay-owner.js

@@ -67,7 +67,7 @@ export class InputOverlayOwner {
         return this.openPicker({ type: 'get_tree' }, 'get_tree', 'fork', (data, close) => buildForkPicker(data, this.hooks.send, close));
     }
     openSettingsPicker() {
-        return this.openPicker({ type: 'get_settings' }, 'get_settings', 'settings', (data, close) => buildSettingsPicker(data, this.hooks.send, close, this.hooks.notify));
+        return this.openPicker({ type: 'get_settings' }, 'get_settings', 'settings', (data, close) => buildSettingsPicker(data, this.hooks.send, close));
     }
     openScopedModelsPicker() {
         return this.openPicker({ type: 'list_scoped_models' }, 'list_scoped_models', 'scoped-models', (data, close) => buildScopedModelsPicker(data, close, this.hooks.notify));