@oh-my-pi/pi-ai 17.2.7 → 17.2.9

package/src/usage/openai-codex.ts

@@ -263,11 +263,10 @@ function buildUsageAmount(window: ParsedUsageWindow): UsageAmount {
 	};
 }
 
-function buildUsageStatus(usedFraction?: number, limitReached?: boolean): UsageLimit["status"] {
-	if (limitReached) return "exhausted";
-	if (usedFraction === undefined) return "unknown";
-	if (usedFraction >= 1) return "exhausted";
-	if (usedFraction >= 0.9) return "warning";
+function buildUsageStatus(args: { usedFraction?: number; explicitlyAllowed: boolean }): UsageLimit["status"] {
+	if (args.usedFraction === undefined) return "unknown";
+	if (args.usedFraction >= 1) return args.explicitlyAllowed ? "warning" : "exhausted";
+	if (args.usedFraction >= 0.9) return "warning";
 	return "ok";
 }
 
@@ -276,6 +275,8 @@ function buildUsageLimit(args: {
 	window: ParsedUsageWindow;
 	accountId?: string;
 	planType?: string;
+	allowed?: boolean;
+	limitReached?: boolean;
 	nowMs: number;
 }): UsageLimit {
 	const usageWindow = buildUsageWindow(args.window, args.key, args.nowMs);
@@ -290,16 +291,14 @@ function buildUsageLimit(args: {
 		},
 		window: usageWindow,
 		amount,
-		// Each chat window's status reflects ONLY its own usage. The account-level
-		// `rate_limit.limit_reached` flag is intentionally not applied here: Codex
-		// returns a single shared flag for the whole account, so threading it into
-		// both the primary (5h) and secondary (weekly) windows marked a window with
-		// real headroom `exhausted` purely because a different window (or a separate
-		// metered feature) was at its limit, which over-blocked sibling accounts
-		// during credential selection. `usedFraction >= 1` already marks a window
-		// that is genuinely full; a real enforced limit not reflected in
-		// `used_percent` is caught when the live request returns usage_limit_reached.
-		status: buildUsageStatus(amount.usedFraction),
+		// The shared account-level rejection flag cannot identify which window
+		// is binding, but an explicit positive verdict applies to both windows.
+		// Preserve 100% as a warning when Codex still allows requests; live
+		// usage_limit_reached responses remain authoritative for blocking.
+		status: buildUsageStatus({
+			usedFraction: amount.usedFraction,
+			explicitlyAllowed: args.allowed === true && args.limitReached === false,
+		}),
 	};
 }
 function additionalLimitSlug(args: { limitName?: string; meteredFeature?: string }): string {
@@ -331,6 +330,8 @@ function buildAdditionalUsageLimit(args: {
 	accountId?: string;
 	limitName?: string;
 	meteredFeature?: string;
+	allowed?: boolean;
+	limitReached?: boolean;
 	nowMs: number;
 }): UsageLimit {
 	const usageWindow = buildUsageWindow(args.window, args.key, args.nowMs);
@@ -348,10 +349,12 @@ function buildAdditionalUsageLimit(args: {
 		},
 		window: usageWindow,
 		amount,
-		// The additional meter exposes one account-level flag for both windows.
-		// Status must follow this window's own usage or a full weekly meter marks
-		// the shorter window exhausted and schedules a premature retry.
-		status: buildUsageStatus(amount.usedFraction),
+		// A positive meter verdict is authoritative even when the advisory
+		// percentage rounds to 100; negative shared verdicts remain window-local.
+		status: buildUsageStatus({
+			usedFraction: amount.usedFraction,
+			explicitlyAllowed: args.allowed === true && args.limitReached === false,
+		}),
 	};
 }
 
@@ -449,6 +452,8 @@ export const openaiCodexUsageProvider: UsageProvider = {
 					window: parsed.primary,
 					accountId,
 					planType,
+					allowed: parsed.allowed,
+					limitReached: parsed.limitReached,
 					nowMs,
 				}),
 			);
@@ -460,6 +465,8 @@ export const openaiCodexUsageProvider: UsageProvider = {
 					window: parsed.secondary,
 					accountId,
 					planType,
+					allowed: parsed.allowed,
+					limitReached: parsed.limitReached,
 					nowMs,
 				}),
 			);
@@ -478,6 +485,8 @@ export const openaiCodexUsageProvider: UsageProvider = {
 						accountId,
 						limitName: extra.limitName,
 						meteredFeature: extra.meteredFeature,
+						allowed: extra.allowed,
+						limitReached: extra.limitReached,
 						nowMs,
 					}),
 				);
@@ -492,6 +501,8 @@ export const openaiCodexUsageProvider: UsageProvider = {
 						accountId,
 						limitName: extra.limitName,
 						meteredFeature: extra.meteredFeature,
+						allowed: extra.allowed,
+						limitReached: extra.limitReached,
 						nowMs,
 					}),
 				);

package/src/utils/http-inspector.ts

@@ -95,10 +95,11 @@ export async function finalizeErrorMessage(
  * Rewrite error message for GitHub Copilot request failures.
  * Must run AFTER finalizeErrorMessage since it replaces the message entirely.
  *
- * 400 `model_not_supported` = Copilot routing rollout gap for our OAuth client.
- *        A preview model (gpt-5.3-codex, gpt-5.4*, ...) flaps between 200 and
- *        400 because only some of Copilot's backends have the model. After the
- *        in-request retry exhausts, surface guidance rather than the raw error.
+ * 400 model-unavailable = Copilot fleet skew. A model that `/models` advertises
+ *        (claude-sonnet-4.6, claude-opus-4.6, gpt-5.4, gpt-5.3-codex, ...)
+ *        flaps between 200 and 400 because only part of Copilot's fleet has it
+ *        in the integrator allowlist. After the in-request retry exhausts,
+ *        surface guidance rather than the raw error.
  * 401 = token invalid/expired → credential removal is safe, prompt re-login.
  * 403 = token valid but access denied (plan, model policy, org restriction) →
  *       do NOT reuse the auth-failed string (which triggers credential removal).
@@ -113,7 +114,7 @@ export function rewriteCopilotError(errorMessage: string, error: unknown, provid
 		return `GitHub Copilot access denied (HTTP 403). Your account may not have access to this model or feature. Check your Copilot plan or model policy settings.`;
 	}
 	if (isCopilotTransientModelError(error)) {
-		return `GitHub Copilot rejected this model (HTTP 400 model_not_supported) after retries. This is a known intermittent rollout gap for preview models on OAuth clients other than VS Code. Try again in a few seconds, switch to a GA model (gpt-5-mini, gpt-5.2), or run this model from VS Code.`;
+		return `GitHub Copilot rejected this model (HTTP 400) after retries: only part of its fleet currently serves this model id, even though /models advertises it. Try again in a few seconds or switch to a model Copilot serves fleet-wide (claude-opus-4.7, claude-sonnet-4.5, gpt-4.1).`;
 	}
 	return errorMessage;
 }

package/src/utils/retry.ts

@@ -7,14 +7,25 @@ import { getHeadersFromError, getRetryAfterMsFromHeaders } from "./retry-after";
 // home). Re-exported here so existing `../utils/retry` importers keep working.
 export { isCopilotTransientModelError };
 
-const COPILOT_MODEL_RETRY_MAX_ATTEMPTS = 3;
+// Copilot's model-availability flap is a per-request coin flip across fleet
+// replicas, not backpressure. Measured per-attempt rejection rates for models
+// mid-rollout reach ~70% (gpt-5.4, 2026-08-04), and a live 10-turn run needed 6
+// attempts on one turn — so a small budget just pushes the failure up to the
+// agent-level retry, which restarts the whole turn. Eight attempts on a flat
+// delay keep the residual near 5% at p=0.7 and under 1% at p=0.5, bounded at
+// ~2.8s of dead time in the pathological case.
+const COPILOT_MODEL_RETRY_MAX_ATTEMPTS = 8;
+// Transport blips and status-bearing failures keep the pre-flap budget: they are
+// not coin flips, so a longer ramp only delays surfacing a persistent fault.
+const COPILOT_GENERIC_RETRY_MAX_ATTEMPTS = 3;
 const COPILOT_MODEL_RETRY_BASE_DELAY_MS = 400;
 /** Longest server-requested backoff we are willing to sit out before giving up. */
 const COPILOT_RETRY_AFTER_MAX_WAIT_MS = 30_000;
 
 /**
- * Wrap an initial Copilot request so transient `model_not_supported` 400s are
- * retried a small number of times. No-op for non-Copilot providers.
+ * Wrap an initial Copilot request so transient model-availability 400s
+ * (`model_not_supported`, `model_not_available_for_integrator`) are retried a
+ * small number of times. No-op for non-Copilot providers.
  *
  * The callback **MUST** create a fresh in-flight request each invocation — a
  * once-consumed AsyncIterable cannot be re-iterated.
@@ -38,8 +49,16 @@ export async function callWithCopilotModelRetry<T>(
 			if (options.signal?.aborted) throw error;
 			const transientModelError = isCopilotTransientModelError(error);
 			if (!transientModelError && !isRetryableError(error)) throw error;
-			if (attempt === COPILOT_MODEL_RETRY_MAX_ATTEMPTS - 1) break;
-			let delayMs = retryBaseDelayMs * (attempt + 1);
+			// Budget is per failure kind, counted over attempts already spent: the
+			// eight-attempt allowance only covers the cheap model-availability reroll.
+			const maxAttempts = transientModelError
+				? COPILOT_MODEL_RETRY_MAX_ATTEMPTS
+				: COPILOT_GENERIC_RETRY_MAX_ATTEMPTS;
+			if (attempt >= maxAttempts - 1) break;
+			// Reroll the model flap on a flat delay: a ramp only adds dead time to a
+			// coin flip the next attempt is equally likely to win. Generic retryable
+			// failures (429/5xx/transport) keep the linear backoff below.
+			let delayMs = transientModelError ? retryBaseDelayMs : retryBaseDelayMs * (attempt + 1);
 			if (!transientModelError) {
 				const errorStatus = status(error);
 				if (errorStatus !== undefined) {