@oh-my-pi/pi-ai 18.2.0 → 18.2.2

package/src/error/body-error.ts

@@ -0,0 +1,310 @@
+/**
+ * In-band provider failures: upstream 429/5xx payloads that arrive inside an
+ * HTTP 200 response body, or mid-stream after the SSE headers were already sent.
+ *
+ * Providers that front a retry/queue layer — Azure OpenAI, LiteLLM-style
+ * aggregators, Bedrock-compatible shims — answer a throttled request with
+ * `200 OK` + `text/event-stream` and put the real status in the payload:
+ * `data: {"error":{"type":"rate_limit_error"}}`, `data: {"code":429}`, or a bare
+ * non-JSON frame such as `data: 429 Too Many Requests` / an nginx throttle page.
+ * Those bodies used to be either dropped silently (the stream then looked like a
+ * successful empty completion) or surfaced as an unclassified
+ * {@link ProviderResponseError} whose `errorId` stayed 0 — so `AIError.retriable`
+ * answered "terminal" and `retry.fallbackChains` never advanced, pinning the
+ * session on a provider that was merely busy.
+ *
+ * Both probes hand the classifier the structured signal it already trusts for an
+ * out-of-band failure: a {@link ProviderHttpError} carrying a status the upstream
+ * *reported*, so the two routes reach one code path. The invariants that make
+ * that safe, and that callers rely on:
+ *
+ *  - **No invented HTTP metadata.** A status is taken only from an error
+ *    `status`/`code` *field* (numeric, or a 3-digit string as compat hosts send)
+ *    or from {@link RETRYABLE_STATUS_BY_CODE}, and only for `429`/`5xx`. A status
+ *    mentioned inside error prose is never promoted to a status: 401/403 wording
+ *    stays text and cannot route the failure into the auth-retry lane.
+ *  - **No credential rotation on an unreadable body.** A `429` whose body is
+ *    empty, `{}`, or framing-only is opaque, and an opaque 429 is the conservative
+ *    rotate-to-a-sibling-credential signal. That verdict belongs to a body the
+ *    server actually sent, not to a payload we synthesised, so
+ *    {@link formatInBandMessage} substitutes {@link IN_BAND_DETAIL_PLACEHOLDER}
+ *    and the composed message always stays informative.
+ *  - **Unknown envelopes fall through.** Anything without a retryable status
+ *    field, a retryable code, or unambiguous throttle wording returns
+ *    `undefined` and keeps its pre-existing handling and message.
+ *
+ * Where no numeric status exists, the returned error keeps the upstream wording
+ * and code visible in its message instead of asserting HTTP metadata the provider
+ * never sent, and carries {@link Flag.Transient} directly: throttle spellings like
+ * `Throttled` / `Please retry` are what this probe recognises but the transport
+ * text pattern is not required to match, so the retry decision is stated rather
+ * than hoped for.
+ */
+import { ProviderHttpError } from "./classes";
+import { attach, create, Flag } from "./flags";
+import { isOpaqueStatusBody } from "./rate-limit";
+import { ProviderResponseError } from "./provider";
+
+/** Cap on synthesized message length, mirroring the transport-level `MAX_DETAIL_CHARS`. */
+const MAX_IN_BAND_DETAIL_CHARS = 4096;
+
+/**
+ * Filler used when an in-band failure frame carries no readable detail. It has
+ * to be informative prose on purpose: an opaque message on a `429` is read as
+ * "the server gave us nothing" and rotates a credential, and that judgement must
+ * never be triggered by wording of ours.
+ */
+const IN_BAND_DETAIL_PLACEHOLDER = "Provider returned an in-band provider error";
+
+/**
+ * Machine error codes that mean "shed this request and back off", mapped to the
+ * HTTP status the upstream would have used had it not wrapped the failure in a
+ * 200. Keys are compared after lower-casing, splitting camel/Pascal word
+ * boundaries, and collapsing `_`/`-`/`.`/spaces, so `Throttling.AllocationQuota`
+ * and `ThrottlingAllocationQuota` both resolve. The list is deliberately limited
+ * to throttle/overload spellings so an unlisted code keeps its pre-existing
+ * classification: request-validation failures (`invalid_request_error`) and
+ * account caps (`insufficient_quota`, `usage_limit_reached`) are never
+ * reinterpreted as retries.
+ */
+const RETRYABLE_STATUS_BY_CODE: Record<string, number> = {
+	rate_limit_error: 429,
+	rate_limit_exceeded: 429,
+	rate_limit: 429,
+	rate_limit_reached: 429,
+	rate_limited: 429,
+	ratelimit: 429,
+	too_many_requests: 429,
+	request_throttled: 429,
+	throttled: 429,
+	throttling: 429,
+	throttling_error: 429,
+	throttling_exception: 429,
+	throttling_allocation_quota: 429,
+	request_limit_exceeded: 429,
+	retry_later: 429,
+	overloaded_error: 503,
+	server_overloaded: 503,
+	model_overloaded: 503,
+	overloaded: 503,
+	service_unavailable: 503,
+	server_busy: 503,
+	high_demand: 503,
+	capacity_exceeded: 503,
+};
+
+/**
+ * Wording that identifies a throttle/overload in an error code or body. Kept as
+ * an explicit list rather than reusing the classifier's pattern, so this probe
+ * stays independent of the text rules it feeds.
+ */
+const IN_BAND_RETRYABLE_TEXT_PATTERN =
+	/\brate.?limit|too many requests|too\s+many\s+concurren|service.{0,20}unavailable|temporarily\s+unavailable|server.?error|internal.?error|overloaded|capacity|throttl|retry\s+(?:your\s+)?request|please\s+retry/i;
+
+/**
+ * A status in the position a proxy error page puts it: the very first token,
+ * optionally after an `HTTP/1.1 ` prefix. Delimited by a word boundary so
+ * identifiers (`chatcmpl-500321`, `gpt-500x`, `req500502`) cannot fabricate a
+ * status — the same hazard `error-transient-status-boundary.test.ts` guards.
+ * Prose that merely *mentions* a number (`Too many requests (401 from …)`) is
+ * deliberately not read as status metadata.
+ */
+const LEADING_STATUS_PATTERN = /^\s*(?:HTTP[/.]\d(?:\.\d)?\s+)?([45]\d{2})(?:\b|$)/i;
+
+/** Codes that mean a persistent account/billing cap or a bad request; never shed-and-retry. */
+const NON_RETRYABLE_CODE_PATTERN =
+	/insufficient.?quota|usage.?limit|quota.?(?:exceeded|reached|insufficient)|invalid_request|content_filter|context_length|context_window|billing|balance/i;
+
+/** Flags this module asserts for a body it has itself recognised as shed-and-retry. */
+const IN_BAND_FLAGS = create(Flag.Transient);
+
+function normalizeCodeToken(value: unknown): string | undefined {
+	if (typeof value === "number" && Number.isFinite(value)) return String(value);
+	if (typeof value !== "string") return undefined;
+	const spaced = value.trim().replace(/([a-z0-9])([A-Z])/g, "$1_$2");
+	const collapsed = spaced
+		.toLowerCase()
+		.replace(/[-.\s]+/g, "_")
+		.replace(/_+/g, "_");
+	return collapsed.length > 0 ? collapsed : undefined;
+}
+
+function readInBandDetail(value: unknown): string | undefined {
+	if (typeof value !== "string") return undefined;
+	// SSE joins multi-line `data:` values with `\n`, and proxy failures arrive as
+	// HTML: flatten to one line of visible text so a synthesized message cannot
+	// smuggle markup or framing into the classifier or the terminal.
+	const flattened = value
+		.replace(/<[^>]*>/g, " ")
+		.replace(/[\u0000-\u001f\u007f]+/g, " ")
+		.replace(/\s+/g, " ")
+		.trim();
+	if (flattened.length === 0) return undefined;
+	return flattened.length > MAX_IN_BAND_DETAIL_CHARS ? flattened.slice(0, MAX_IN_BAND_DETAIL_CHARS) : flattened;
+}
+
+/** A numeric HTTP status field, accepting the `"429"` string form compat hosts emit. */
+function readStatusField(value: unknown): number | undefined {
+	if (typeof value === "number" && Number.isInteger(value) && value >= 100 && value <= 599) return value;
+	if (typeof value === "string" && /^\d{3}$/.test(value.trim())) {
+		const parsed = Number(value.trim());
+		return Number.isInteger(parsed) && parsed >= 100 && parsed <= 599 ? parsed : undefined;
+	}
+	return undefined;
+}
+
+/** Only `429` and genuine server faults are shed-and-retry; 4xx of any other kind is not. */
+function isRetryableStatus(status: number | undefined): status is number {
+	return status === 429 || (status !== undefined && status >= 500 && status <= 599);
+}
+
+function readLeadingStatus(text: string | undefined): number | undefined {
+	if (text === undefined) return undefined;
+	const match = LEADING_STATUS_PATTERN.exec(text);
+	return match?.[1] ? Number(match[1]) : undefined;
+}
+
+interface InBandSignal {
+	/** Numeric HTTP status the upstream reported, or implied by its error code. */
+	status?: number;
+	/** Machine code from the body (`error.code` preferred over `error.type`). */
+	code?: string;
+	/** Human-readable detail from the body. */
+	detail?: string;
+}
+
+/**
+ * Pull the failure signal out of an OpenAI-wire frame. Accepts the nested
+ * `{ error: { code, type, status, message } }` shape, the `response.error`
+ * position of Responses-API terminal events, the flat `{ code, status, message }`
+ * bodies compat hosts emit, and string envelopes (`{ error: "..." }`).
+ *
+ * `undefined` means "not an in-band failure worth retrying". The probe is
+ * intentionally narrow: a bare `type` is present on every Responses event and so
+ * never counts as a signal by itself, statuses come only from fields (never from
+ * prose), and a frame with neither a retryable status nor throttle wording is
+ * left to the caller's existing handling.
+ */
+function readInBandSignal(frame: unknown): InBandSignal | undefined {
+	if (typeof frame !== "object" || frame === null || Array.isArray(frame)) return undefined;
+	const root = frame as Record<string, unknown>;
+	const nested = root.error ?? (root.response as Record<string, unknown> | undefined)?.error;
+	// Azure-compatible gates double-wrap (`{ error: { error: { code, message } } }`).
+	// Walk at most two levels so a deep payload cannot extend the parse.
+	let error: Record<string, unknown> | undefined;
+	if (typeof nested === "object" && nested !== null) {
+		error = nested as Record<string, unknown>;
+		for (let depth = 0; depth < 2; depth++) {
+			const inner = error.error;
+			if (typeof inner !== "object" || inner === null) break;
+			error = inner as Record<string, unknown>;
+		}
+	}
+	const code = normalizeCodeToken(error?.code ?? root.code) ?? normalizeCodeToken(error?.type ?? root.type);
+	if (code !== undefined && NON_RETRYABLE_CODE_PATTERN.test(code)) return undefined;
+	// A flat retryable code/type is itself an in-band failure: Responses-API
+	// `error` events expose `{ type: "rate_limit_error" }` with no `error` member,
+	// and their handler passes the inner error object (not the whole event).
+	const retryableCode = code !== undefined && IN_BAND_RETRYABLE_TEXT_PATTERN.test(code);
+	// Only an explicit error member, a top-level status/code/message field, or a
+	// standalone throttle type can qualify a frame as a failure; ordinary chunks
+	// carry none of these. A bare `type` is present on every Responses event, so
+	// it only counts when it is itself retryable wording.
+	if (
+		!retryableCode &&
+		nested === undefined &&
+		root.status === undefined &&
+		root.code === undefined &&
+		root.message === undefined
+	) {
+		return undefined;
+	}
+	const detail =
+		readInBandDetail(error?.message) ??
+		readInBandDetail(root.message) ??
+		(typeof nested === "string" ? readInBandDetail(nested) : undefined);
+	const holder = error ?? root;
+	// Reported statuses come from fields only: the error member's `status`, its
+	// numeric `code`, then the same on the root (the flat `{ code: 429 }` /
+	// `{ status: 429 }` bodies compat hosts emit). Anything outside 429/5xx is
+	// ignored outright — an in-band `400`/`401`/`403` field must not become a
+	// synthetic HTTP contract, or a body that merely names an auth problem would
+	// route into the credential lane.
+	const reported = holder === root ? [root.status, root.code] : [holder.status, holder.code, root.status, root.code];
+	const status =
+		reported.map(readStatusField).find(isRetryableStatus) ??
+		(code !== undefined && Object.hasOwn(RETRYABLE_STATUS_BY_CODE, code)
+			? readStatusField(RETRYABLE_STATUS_BY_CODE[code])
+			: undefined);
+	if (status !== undefined) return { status, code, detail };
+	// No reported status: classify only when the upstream *message* is itself
+	// unambiguous throttle wording. A generic code alone must not qualify —
+	// Azure uses `server_error` for terminal backend failures whose
+	// `"<code>: <message>"` envelope the caller already reports (and whose text
+	// the shared transient rule already matches), so intercepting it would
+	// change an established error format without adding retry information.
+	if (detail === undefined || !IN_BAND_RETRYABLE_TEXT_PATTERN.test(detail)) return undefined;
+	return { code, detail };
+}
+
+/**
+ * Compose the message for a status-bearing in-band failure. The numeric status
+ * leads (matching `captureOpenAIHttpError`'s `"<status> <detail>"` phrasing)
+ * unless the detail already carries it as its leading token; the machine code is
+ * appended only when it adds information the text classifier or a human reader
+ * can use. A detail that leaves the whole line opaque is replaced by the
+ * placeholder, so a body we generated can never be read as "the server said
+ * nothing".
+ */
+function formatInBandMessage(status: number, detail: string | undefined, code: string | undefined): string {
+	const body = detail ?? IN_BAND_DETAIL_PLACEHOLDER;
+	const suffix =
+		code !== undefined && !/^\d+$/.test(code) && !body.toLowerCase().includes(code.toLowerCase()) ? ` (${code})` : "";
+	let message = readLeadingStatus(body) === status ? body : `${status} ${body}`;
+	if (isOpaqueStatusBody(message)) message = `${status} ${IN_BAND_DETAIL_PLACEHOLDER}`;
+	return `${message}${suffix}`;
+}
+
+/**
+ * Build the classified error for an in-band failure frame, or `undefined` when
+ * the frame is not a retryable in-band failure (in which case the caller keeps
+ * its existing handling and message).
+ *
+ * @param frame decoded SSE `data:` payload, or the `{ error, response }` subset of one
+ */
+export function createInBandProviderError(frame: unknown): Error | undefined {
+	const signal = readInBandSignal(frame);
+	if (!signal) return undefined;
+	const { status, code, detail } = signal;
+	if (isRetryableStatus(status)) {
+		return attach(new ProviderHttpError(formatInBandMessage(status, detail, code), status, { code }), IN_BAND_FLAGS);
+	}
+	if (detail === undefined && code === undefined) return undefined;
+	// Keep the upstream code visible (`(<code>)`) — it is real provider data and
+	// the same convention the Anthropic provider already uses for its
+	// `(<errorType>)` suffix.
+	return attach(
+		new ProviderResponseError(`${detail ?? IN_BAND_DETAIL_PLACEHOLDER}${code ? ` (${code})` : ""}`, {
+			kind: "runtime",
+		}),
+		IN_BAND_FLAGS,
+	);
+}
+
+/**
+ * Build the classified error for a non-JSON SSE frame: gateways and reverse
+ * proxies that answer `data: 429 Too Many Requests` or an HTML throttle page
+ * instead of an OpenAI envelope. `undefined` when the text is not recognisable
+ * as a throttle, so genuinely malformed payloads keep failing loudly.
+ */
+export function createInBandProviderErrorFromText(text: string): Error | undefined {
+	const detail = readInBandDetail(text);
+	if (detail === undefined || !IN_BAND_RETRYABLE_TEXT_PATTERN.test(detail)) return undefined;
+	const status = readLeadingStatus(detail);
+	if (isRetryableStatus(status)) {
+		return attach(new ProviderHttpError(formatInBandMessage(status, detail, undefined), status), IN_BAND_FLAGS);
+	}
+	// A proxy status line with no machine code to preserve: report the upstream
+	// text verbatim rather than padding it with wording of ours.
+	return attach(new ProviderResponseError(detail, { kind: "runtime" }), IN_BAND_FLAGS);
+}

package/src/error/flags.ts

@@ -163,6 +163,28 @@ export const PYTHON_HTTP_INCOMPLETE_CHUNK_PATTERN =
 	/peer closed connection without sending complete message body \(incomplete chunked read\)/;
 /** reqwest body-frame failures forwarded by the Codex HTTP proxy. */
 export const CODEX_HTTP_BODY_READ_ERROR_PATTERN = /\btransport error reading codex response body\b/i;
+
+const RESPONSES_REQUEST_BODY_READ_TIMEOUT_PATTERN = /\btimed out reading request body\b/i;
+
+/** Exact HTTP request-body-read timeout diagnostic. */
+export function isRequestBodyReadTimeout(status: number | undefined, message: string | undefined): boolean {
+	return status === 408 && RESPONSES_REQUEST_BODY_READ_TIMEOUT_PATTERN.test(message ?? "");
+}
+
+/** Exact pre-output Responses 408 that needs a changed-request recovery path. */
+export function isResponsesRequestBodyReadTimeout(message: {
+	api?: Api;
+	errorStatus?: number;
+	errorMessage?: string;
+	requestBodyReadTimeoutFullReplay?: boolean;
+}): boolean {
+	return (
+		message.api === "openai-responses" &&
+		message.requestBodyReadTimeoutFullReplay === true &&
+		isRequestBodyReadTimeout(message.errorStatus, message.errorMessage)
+	);
+}
+
 export const TRANSIENT_TRANSPORT_PATTERN =
 	/\b(?:no[_ -]?capacity|(?:high|peak)[ _-]?demand|(?:at|over|insufficient)[ _-]?capacity|capacity[ _-]?(?:exceeded|exhausted)|peak[ _-]?load)\b|overloaded|provider.?returned.?error|rate.?limit|too many requests|auth-gateway\s+5\d{2}(?=[:\s]|$)|\b(?:429|500|502|503|504)\b|service.?unavailable|server.?error|internal.?error|retry your request|network.?error|connection.?error|connection.?refused|unable.?to.?connect\.\s*is the computer able to access the url\?|other side closed|fetch failed|upstream.?connect|upstream.?request.?failed|reset before headers|socket hang up|timed? out|timeout|terminated|retry delay|stream stall|no error details in response|HTTP2(?:StreamReset|RefusedStream|EnhanceYourCalm)|nghttp2_(?:internal_error|refused_stream)|stream closed with error code nghttp2_(?:internal_error|refused_stream)|malformed.?function.?call/i;
 const AUTH_FAILURE_PATTERN =
@@ -503,21 +525,24 @@ function classifyText(
 		}
 		if (isTimeoutText(errorMessage)) kinds |= Flag.Transient | Flag.Timeout;
 		else if (isTransientErrorText(errorMessage)) kinds |= Flag.Transient;
-		// A stream truncation or forwarded Codex HTTP body-read failure may not
-		// match TRANSIENT_TRANSPORT_PATTERN. Flag it explicitly so AIError.retriable and
-		// the turn-recovery layer treat it as retryable, matching the provider
-		// retry path (isProviderRetryableError). Separate `if` (not chained onto
-		// the else-if) so a timeout whose text also reads as a truncation keeps
-		// Flag.Timeout alongside Flag.Transient. The string arm applies the strict
-		// STREAM_PARSE_DIAGNOSTIC_PATTERN, per the rationale on isTransientStreamParseError.
-		// Skip a truncation phrase that rides on a terminal 4xx (e.g. a malformed
-		// request rejected as "400 unexpected EOF"): that is a deterministic client
-		// error that replays identically, so keep it terminal. classify() carries
-		// the outer terminal status down the cause chain so a wrapped truncation
-		// (ProviderHttpError 400 → cause "unexpected EOF") is caught here too.
+		// A stream truncation, transport-level stream drop, or forwarded Codex HTTP
+		// body-read failure may not match TRANSIENT_TRANSPORT_PATTERN. Flag it
+		// explicitly so AIError.retriable and the turn-recovery layer treat it as
+		// retryable, matching the provider retry path (isProviderRetryableError).
+		// Separate `if` (not chained onto the else-if) so a timeout whose text also
+		// reads as a truncation keeps Flag.Timeout alongside Flag.Transient. The
+		// string arm applies the strict STREAM_PARSE_DIAGNOSTIC_PATTERN, per the
+		// rationale on isTransientStreamParseError. Skip a phrase that rides on a
+		// terminal 4xx (e.g. a malformed request rejected as "400 unexpected EOF"):
+		// that is a deterministic client error that replays identically, so keep it
+		// terminal. classify() carries the outer terminal status down the cause
+		// chain so a wrapped truncation (ProviderHttpError 400 → cause "unexpected
+		// EOF") is caught here too.
 		if (
 			!isTerminalClientErrorStatus(statusClean) &&
-			(isTransientStreamParseError(errorMessage) || CODEX_HTTP_BODY_READ_ERROR_PATTERN.test(errorMessage))
+			(isTransientStreamParseError(errorMessage) ||
+				isTransientStreamDropError(errorMessage) ||
+				CODEX_HTTP_BODY_READ_ERROR_PATTERN.test(errorMessage))
 		) {
 			kinds |= Flag.Transient;
 		}
@@ -871,6 +896,31 @@ export function isTransientStreamParseError(error: unknown): boolean {
 	return error instanceof Error && STREAM_PARSE_TRUNCATION_PATTERN.test(error.message);
 }
 
+/**
+ * Transport-level stream drops: the connection or upstream stream ended before a
+ * terminal event, with no JSON-parse signal and no retryable status attached.
+ *
+ * Distinct from {@link STREAM_PARSE_TRUNCATION_PATTERN} (mid-body JSON
+ * truncation) — these name the transport itself dropping (proxy/gateway closing
+ * the SSE stream, socket dying before the TLS handshake completes). The wording
+ * is the statusless twin of a `408 stream disconnected`, which the status path
+ * already retries; an identical replay recovers it, so callers under a
+ * non-terminal status treat it as transient (#11805).
+ */
+const STREAM_DROP_PATTERN =
+	/stream disconnected before completion|stream closed before response\.completed|stream was interrupted|stream ended before terminal (?:chunk|completion event)|socket disconnected before secure tls connection/i;
+
+/**
+ * Transport stream-drop diagnostic (see {@link STREAM_DROP_PATTERN}). Unlike
+ * {@link isTransientStreamParseError}, one pattern serves both the live `Error`
+ * and the persisted-string forms: the phrasings are high-signal enough to trust
+ * detached from a transport `Error`.
+ */
+export function isTransientStreamDropError(error: unknown): boolean {
+	if (typeof error === "string") return STREAM_DROP_PATTERN.test(error);
+	return error instanceof Error && STREAM_DROP_PATTERN.test(error.message);
+}
+
 /** Any malformed stream-envelope error (prefix-tagged or out-of-order events). */
 export function isStreamEnvelopeError(error: unknown): boolean {
 	return (

package/src/error/index.ts

@@ -2,6 +2,7 @@ export * from "./abort";
 export * from "./auth";
 export * from "./auth-classify";
 export * from "./aws";
+export * from "./body-error";
 export * from "./classes";
 export * from "./finalize";
 export * from "./flags";

package/src/error/retryable.ts

@@ -2,6 +2,7 @@ import { isRetryableError, isUnexpectedSocketCloseMessage } from "@oh-my-pi/pi-u
 import {
 	CODEX_HTTP_BODY_READ_ERROR_PATTERN,
 	isRetryableStreamEnvelopeError,
+	isTransientStreamDropError,
 	isTransientStreamParseError,
 	isUsageLimit,
 	status,
@@ -55,6 +56,7 @@ export function isProviderRetryableError(error: unknown): boolean {
 		CODEX_HTTP_BODY_READ_ERROR_PATTERN.test(msg) ||
 		PROVIDER_TRANSIENT_EXTRA_PATTERN.test(msg) ||
 		isTransientStreamParseError(error) ||
+		isTransientStreamDropError(error) ||
 		isRetryableStreamEnvelopeError(error)
 	) {
 		return true;

package/src/index.ts

@@ -8,6 +8,7 @@ export * from "./auth-storage";
 export * from "./error/rate-limit";
 export * from "./oneshot-retry";
 export * from "./provider-details";
+export * from "./provider-session-state";
 export * from "./providers/anthropic";
 export * from "./providers/anthropic-client";
 export * from "./providers/azure-openai-responses";

package/src/oneshot-retry.ts

@@ -1,7 +1,11 @@
-import { extractRetryHint } from "@oh-my-pi/pi-utils";
 import * as AIError from "./error";
 import type { AssistantMessage } from "./types";
-import { getHeadersFromError, getRetryAfterMsFromHeaders, type HeadersLike } from "./utils/retry-after";
+import {
+	extractProviderRetryHint,
+	getHeadersFromError,
+	getRetryAfterMsFromHeaders,
+	type HeadersLike,
+} from "./utils/retry-after";
 
 /**
  * Transient-failure retry for **oneshot** (non-agent-loop) completions.
@@ -66,6 +70,12 @@ export interface OneshotRetryOptions {
 	 * Thrown errors need no wiring — headers are recovered from the error itself.
 	 */
 	getResponseHeaders?: () => HeadersLike;
+	/**
+	 * Provider id of the model being retried. Selects the catalog-declared
+	 * timezone for a timezone-naive absolute reset stamp (Z.AI/Zhipu report
+	 * Beijing time), so an over-cap wait is not misread as UTC and discarded.
+	 */
+	provider?: string;
 	/** Observability hook. Fires immediately before sleeping. */
 	onRetry?: (info: OneshotRetryInfo) => void;
 }
@@ -195,7 +205,7 @@ export async function retryTransientCompletion(
 		// errors (e.g. AnthropicApiError) carry their own headers.
 		const headers: HeadersLike = thrown !== undefined ? getHeadersFromError(thrown) : options?.getResponseHeaders?.();
 		const headerHintMs = getRetryAfterMsFromHeaders(headers);
-		const extractedTextHintMs = extractRetryHint(undefined, errorMessage);
+		const extractedTextHintMs = extractProviderRetryHint(options?.provider, errorMessage);
 		const suffixValue = RETRY_AFTER_MS_SUFFIX.exec(errorMessage)?.[1];
 		const parsedSuffixMs = suffixValue === undefined ? undefined : Number(suffixValue);
 		const suffixHintMs =

package/src/provider-session-state.ts

@@ -0,0 +1,56 @@
+/**
+ * Credential-rotation handling for a retained `providerSessionState` map.
+ *
+ * A host that keeps one provider-session map per logical conversation (the
+ * auth-gateway's server-owned store, an in-process omp session) can outlive the
+ * credential that filled it: `AuthStorage.markUsageLimitReached` and the
+ * auth-retry resolver both switch a session to a sibling account mid-flight.
+ * Most of what a provider learns is a property of the *endpoint*, so rebuilding
+ * the whole map on a switch would re-pay every rejected round-trip the map
+ * exists to avoid. A minority is a property of the *account*, and keeping that
+ * across a switch is a bug.
+ *
+ * Audit of what the retained records hold, per provider:
+ *
+ * - **Anthropic** — `fastModeDisabled` is account-scoped: the rejection reads
+ *   "this model does not support fast mode for your account", i.e. a plan
+ *   entitlement, so a switch to an entitled sibling must re-probe. Its
+ *   siblings are endpoint-scoped and stay: `strictToolsDisabled`
+ *   (grammar-too-large 400 for the model's tool schema),
+ *   `replayUnsignedThinkingDisabled` / `thinkingReplayDisabled` (the endpoint
+ *   is a signing proxy), `prefixDroppedThinkingBlocks` (blocks the API itself
+ *   dropped), `controlStates` (per-conversation control baselines).
+ * - **OpenAI Responses** — the `previous_response_id` chain baselines are
+ *   account-scoped: a stored response belongs to the account that created it.
+ *   Strict-tools / reasoning-effort fallbacks, replay warmup and the chaining
+ *   circuit breaker are endpoint-scoped and stay.
+ * - **OpenAI Completions** — strict-tools and reasoning-effort fallbacks only;
+ *   both endpoint-scoped. Nothing to reset.
+ * - **Codex** — already sub-keys its WebSocket sessions by account id AND
+ *   bearer (`getCodexWebSocketSessionKey`), so a switch naturally lands on a
+ *   fresh transport session while the old one stays reachable for teardown.
+ *   Resetting from the outside would close a socket a retry may still be on.
+ * - **Antigravity** — `lastGoodEndpoint` is endpoint-scoped; the agent /
+ *   conversation ids are conversation-scoped. Neither depends on the account.
+ * - **GitLab Duo** — the active workflow is account-bound, but it is a live
+ *   server-side workflow plus socket, and the switch happens *inside* the
+ *   request that may still be resuming it. Tearing it down here would abort the
+ *   very turn that rotated; it stays on its existing session-close path.
+ */
+
+import { clearAnthropicFastModeFallback } from "./providers/anthropic";
+import { resetOpenAIResponsesAccountScopedState } from "./providers/openai-responses";
+import type { ProviderSessionState } from "./types";
+
+/**
+ * Reset the account-dependent lessons in `states`, keeping everything a
+ * provider learned about the endpoint. Call when a retained map is about to be
+ * reused for a session whose credential now resolves to a different account.
+ */
+export function resetAccountScopedProviderSessionState(states: Map<string, ProviderSessionState>): void {
+	if (states.size === 0) return;
+	// Fast mode is the account-scoped half of the Anthropic record; the helper
+	// the `/fast on` re-arm path already uses clears exactly that flag.
+	clearAnthropicFastModeFallback(states);
+	resetOpenAIResponsesAccountScopedState(states);
+}

package/src/providers/amazon-bedrock.ts

@@ -5,6 +5,9 @@
  * SigV4 signing and decodes the `application/vnd.amazon.eventstream` response.
  * No `@aws-sdk/*`, no `@smithy/*`, no `proxy-agent`. Proxies are honored via
  * Bun's native `HTTPS_PROXY` support.
+ *
+ * A `models.yml` `baseUrl` is the request origin verbatim (VPC endpoint, gateway, …);
+ * only AWS's own regional host is re-pointed at the resolved region. SigV4 unaffected.
  */
 
 import type { Effort } from "@oh-my-pi/pi-catalog/effort";
@@ -145,6 +148,13 @@ const INFERENCE_PROFILE_GEO_DEFAULT_REGION: Record<string, string> = {
 	jp: "ap-northeast-1",
 };
 
+/**
+ * AWS's own regional host, which every bundled catalog entry carries as a required
+ * placeholder `baseUrl` — no routing info, so its region segment is re-derived.
+ * FIPS, VPC-endpoint and gateway hosts don't match and are used as configured.
+ */
+const AWS_REGIONAL_BEDROCK_HOST = /^bedrock-runtime\.[a-z0-9-]+\.amazonaws\.com$/;
+
 /** Geo prefix of a cross-region inference-profile id, e.g. `eu.anthropic.…` → `eu`. */
 function inferenceProfileGeo(modelId: string): string | undefined {
 	const dot = modelId.indexOf(".");
@@ -453,9 +463,15 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 			// raw dump so the inspector shows exactly what was sent.
 			commandInput = { ...commandInput, requestMetadata: sanitizeRequestMetadata(commandInput.requestMetadata) };
 
-			const host = `bedrock-runtime.${region}.amazonaws.com`;
-			const url = `https://${host}/model/${encodeURIComponent(model.id)}/converse-stream`;
-			const urlPath = `/model/${encodeURIComponent(model.id)}/converse-stream`;
+			// `baseUrl` is the origin verbatim, path prefix (and query, for gateways
+			// that authenticate via a query parameter) included, so a gateway mounted
+			// under a path works. AWS's own host is re-pointed: the catalog can't know the region.
+			const base = new URL(model.baseUrl || `https://bedrock-runtime.${region}.amazonaws.com`);
+			if (AWS_REGIONAL_BEDROCK_HOST.test(base.host)) base.host = `bedrock-runtime.${region}.amazonaws.com`;
+			const host = base.host;
+			const urlPath = `${base.pathname.replace(/\/+$/, "")}/model/${encodeURIComponent(model.id)}/converse-stream`;
+			const query = base.search.slice(1) || undefined;
+			const url = `${base.origin}${urlPath}${base.search}`;
 			rawRequestDump = {
 				provider: model.provider,
 				api: output.api,
@@ -527,6 +543,7 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 					method: "POST",
 					host,
 					path: urlPath,
+					query,
 					body,
 					region,
 					service: "bedrock",