@oh-my-pi/pi-coding-agent 16.5.0 → 16.5.1

package/src/cli/dry-balance-cli.ts

@@ -214,8 +214,15 @@ function extractAccount(access: {
 	accountId?: string;
 	projectId?: string;
 	enterpriseUrl?: string;
+	orgId?: string;
+	orgName?: string;
 }): string {
-	return access.email ?? access.accountId ?? access.projectId ?? access.enterpriseUrl ?? "(unknown oauth account)";
+	const base =
+		access.email ?? access.accountId ?? access.projectId ?? access.enterpriseUrl ?? "(unknown oauth account)";
+	// Two subscriptions (orgs) can share one email — name the org so per-account
+	// bench rows stay tellable apart.
+	const org = access.orgName ?? access.orgId;
+	return org ? `${base} (${org})` : base;
 }
 
 function getBenchTargetKey(access: {
@@ -225,15 +232,18 @@ function getBenchTargetKey(access: {
 	projectId?: string;
 	enterpriseUrl?: string;
 	accessToken?: string;
+	orgId?: string;
 }): string {
-	return (
+	const base =
 		access.email ??
 		access.accountId ??
 		access.projectId ??
 		access.enterpriseUrl ??
 		(access.credentialId === undefined ? access.accessToken : `credential:${access.credentialId}`) ??
-		"(unknown oauth account)"
-	);
+		"(unknown oauth account)";
+	// Org-qualify: two org-scoped credentials under one email are two distinct
+	// benchmark targets, not duplicates.
+	return access.orgId ? `${base}|org:${access.orgId}` : base;
 }
 
 function sanitizeBenchText(text: string, width: number): string {

package/src/cli/flag-tables.ts

@@ -32,6 +32,7 @@
 
 import type { ConfiguredThinkingLevel } from "../thinking";
 import type { Args } from "./args";
+import { CliUsageError } from "./usage-error";
 
 /**
  * Runtime dependencies injected into setters that need to validate input or
@@ -85,6 +86,24 @@ const setResume: OptionalSetter = (result, value) => {
 	result.resume = value !== undefined ? value : true;
 };
 
+const MAX_TIME_DURATION_RE = /^(\d+(?:\.\d+)?)([smh])$/;
+
+function maxTimeMultiplier(unit: string | undefined): number {
+	if (unit === "h") return 3600;
+	if (unit === "m") return 60;
+	return 1;
+}
+
+function parseMaxTimeSeconds(value: string): number {
+	const trimmed = value.trim();
+	const duration = MAX_TIME_DURATION_RE.exec(trimmed);
+	const seconds = duration ? Number(duration[1]) * maxTimeMultiplier(duration[2]) : Number(trimmed);
+	if (Number.isFinite(seconds) && seconds > 0) return seconds;
+	throw new CliUsageError(
+		`Invalid --max-time value: ${JSON.stringify(value)}. Expected a positive number of seconds or duration like "5s", "10m", "1h".`,
+	);
+}
+
 /**
  * Setters for flags with string values. Most built-ins consume the next argv
  * token even when it starts with `-`; flags listed in
@@ -127,13 +146,8 @@ export const STRING_SETTERS: Record<string, StringSetter> = {
 	"--plan-yolo-into": (result, value) => {
 		result.planYoloInto = value;
 	},
-	"--max-time": (result, value, deps) => {
-		const seconds = Number(value);
-		if (Number.isFinite(seconds) && seconds > 0) {
-			result.maxTime = seconds;
-		} else {
-			deps.logger.warn("Invalid seconds passed to --max-time", { value });
-		}
+	"--max-time": (result, value) => {
+		result.maxTime = parseMaxTimeSeconds(value);
 	},
 	"--api-key": (result, value) => {
 		result.apiKey = value;

package/src/cli/update-cli.ts

@@ -109,6 +109,19 @@ async function getBunGlobalBinDir(): Promise<string | undefined> {
 	}
 }
 
+async function getNpmGlobalBinDir(): Promise<string | undefined> {
+	if (!$which("npm")) return undefined;
+	try {
+		const result = await $`npm prefix -g`.quiet().nothrow();
+		if (result.exitCode !== 0) return undefined;
+		const prefix = result.text().trim();
+		if (prefix.length === 0) return undefined;
+		return process.platform === "win32" ? prefix : path.join(prefix, "bin");
+	} catch {
+		return undefined;
+	}
+}
+
 async function getHomebrewFormulaPrefix(): Promise<string | undefined> {
 	if (!$which("brew")) return undefined;
 	for (const formula of [HOMEBREW_FORMULA, APP_NAME]) {
@@ -189,26 +202,36 @@ function isPathInDirectory(filePath: string, directoryPath: string): boolean {
 	return isPathInDirectoryLexical(resolvedFile, dirReal);
 }
 
-type UpdateMethod = "brew" | "mise" | "bun" | "binary";
+type UpdateMethod = "brew" | "mise" | "bun" | "npm" | "binary";
 
 interface UpdateMethodResolutionOptions {
 	homebrewPrefix?: string;
 	miseBinDirs?: readonly string[];
 	miseDataDir?: string;
+	npmBinDir?: string;
 }
 
-type UpdateTarget = { method: "brew" } | { method: "mise" } | { method: "bun" } | { method: "binary"; path: string };
+type UpdateTarget =
+	| { method: "brew" }
+	| { method: "mise" }
+	| { method: "bun" }
+	| { method: "npm" }
+	| { method: "binary"; path: string };
 
 function resolveUpdateMethod(
 	ompPath: string,
 	bunBinDir: string | undefined,
 	options: UpdateMethodResolutionOptions = {},
 ): UpdateMethod {
-	const { homebrewPrefix, miseBinDirs = [], miseDataDir } = options;
+	const { homebrewPrefix, miseBinDirs = [], miseDataDir, npmBinDir } = options;
+	const launcherExtension = path.extname(ompPath).toLowerCase();
+	const isWindowsScriptLauncher =
+		launcherExtension === ".cmd" || launcherExtension === ".ps1" || launcherExtension === ".bat";
 	if (homebrewPrefix && isPathInDirectory(ompPath, path.join(homebrewPrefix, "bin"))) return "brew";
 	if (miseBinDirs.some(dir => isPathInDirectory(ompPath, dir))) return "mise";
 	if (miseDataDir && isPathInDirectory(ompPath, path.join(miseDataDir, "shims"))) return "mise";
 	if (bunBinDir && isPathInDirectory(ompPath, bunBinDir)) return "bun";
+	if ((npmBinDir && isPathInDirectory(ompPath, npmBinDir)) || isWindowsScriptLauncher) return "npm";
 	return "binary";
 }
 
@@ -221,6 +244,7 @@ export function resolveUpdateMethodForTest(
 }
 async function resolveUpdateTarget(): Promise<UpdateTarget> {
 	const bunBinDir = await getBunGlobalBinDir();
+	const npmBinDir = await getNpmGlobalBinDir();
 	const homebrewPrefix = await getHomebrewFormulaPrefix();
 	const miseAvailable = $which("mise") !== undefined;
 	const miseBinDirs = miseAvailable ? await getMiseBinDirs() : [];
@@ -228,7 +252,7 @@ async function resolveUpdateTarget(): Promise<UpdateTarget> {
 	const ompPath = resolveOmpPath();
 
 	if (ompPath) {
-		const method = resolveUpdateMethod(ompPath, bunBinDir, { homebrewPrefix, miseBinDirs, miseDataDir });
+		const method = resolveUpdateMethod(ompPath, bunBinDir, { homebrewPrefix, miseBinDirs, miseDataDir, npmBinDir });
 		if (method === "binary") return { method, path: ompPath };
 		return { method };
 	}
@@ -715,6 +739,14 @@ export async function replaceBinaryForUpdate(options: BinaryReplacementOptions):
 	}
 }
 
+function buildVersionedPackageInstallArgs(expectedVersion: string, nativeTag: string): string[] {
+	const args = [`${PACKAGE}@${expectedVersion}`, `${NATIVES_PACKAGE}@${expectedVersion}`];
+	if (SUPPORTED_NATIVE_TAGS.has(nativeTag)) {
+		args.push(`${NATIVES_PACKAGE}-${nativeTag}@${expectedVersion}`);
+	}
+	return args;
+}
+
 /**
  * Build the bun argv used to globally install a specific omp version.
  *
@@ -746,17 +778,23 @@ export async function replaceBinaryForUpdate(options: BinaryReplacementOptions):
  * See #1824.
  */
 export function buildBunInstallArgs(expectedVersion: string, nativeTag: string = currentNativeTag()): string[] {
-	const args = [
+	return [
 		"install",
 		"-g",
 		"--no-cache",
 		`--registry=${NPM_REGISTRY}`,
-		`${PACKAGE}@${expectedVersion}`,
-		`${NATIVES_PACKAGE}@${expectedVersion}`,
+		...buildVersionedPackageInstallArgs(expectedVersion, nativeTag),
+	];
+}
+
+/** Build the npm argv used to update npm-managed global installs. */
+export function buildNpmInstallArgs(expectedVersion: string, nativeTag: string = currentNativeTag()): string[] {
+	const args = [
+		"install",
+		"-g",
+		`--registry=${NPM_REGISTRY}`,
+		...buildVersionedPackageInstallArgs(expectedVersion, nativeTag),
 	];
-	if (SUPPORTED_NATIVE_TAGS.has(nativeTag)) {
-		args.push(`${NATIVES_PACKAGE}-${nativeTag}@${expectedVersion}`);
-	}
 	return args;
 }
 
@@ -773,7 +811,7 @@ export function buildMiseForceInstallArgs(expectedVersion: string): string[] {
 }
 
 /**
- * Update via bun package manager.
+ * Update via package manager.
  */
 async function updateViaBun(expectedVersion: string): Promise<void> {
 	console.log(chalk.dim("Updating via bun..."));
@@ -794,6 +832,17 @@ async function updateViaBun(expectedVersion: string): Promise<void> {
 	}
 }
 
+async function updateViaNpm(expectedVersion: string): Promise<void> {
+	console.log(chalk.dim("Updating via npm..."));
+	const args = buildNpmInstallArgs(expectedVersion);
+	const result = await $`npm ${args}`.nothrow();
+	if (result.exitCode !== 0) {
+		throw new Error(`npm install failed with exit code ${result.exitCode}`);
+	}
+
+	await printVerification(expectedVersion);
+}
+
 async function updateViaHomebrew(expectedVersion: string, force: boolean): Promise<void> {
 	console.log(chalk.dim("Updating Homebrew formulae..."));
 	const update = await $`brew update`.nothrow();
@@ -920,6 +969,8 @@ export async function runUpdateCommand(opts: { force: boolean; check: boolean })
 			await updateViaMise(release.version, opts.force);
 		} else if (target.method === "bun") {
 			await updateViaBun(release.version);
+		} else if (target.method === "npm") {
+			await updateViaNpm(release.version);
 		} else {
 			await updateViaBinaryAt(target.path, release.version);
 		}

package/src/cli/usage-cli.ts

@@ -41,6 +41,9 @@ export interface UsageAccountIdentity {
 	accountId?: string;
 	projectId?: string;
 	enterpriseUrl?: string;
+	/** Organization/workspace the credential is scoped to (Anthropic multi-subscription). */
+	orgId?: string;
+	orgName?: string;
 }
 
 /**
@@ -134,6 +137,7 @@ function collectIdentityStrings(reports: UsageReport[], accounts: UsageAccountId
 		add(meta.accountId);
 		add(meta.projectId);
 		add(meta.orgId);
+		add(meta.orgName);
 		for (const limit of report.limits) {
 			add(limit.scope.accountId);
 			add(limit.scope.projectId);
@@ -144,6 +148,8 @@ function collectIdentityStrings(reports: UsageReport[], accounts: UsageAccountId
 		add(account.email);
 		add(account.accountId);
 		add(account.projectId);
+		add(account.orgId);
+		add(account.orgName);
 		add(account.enterpriseUrl);
 	}
 	return values;
@@ -293,9 +299,38 @@ export function collectUnreportedAccounts(
 		const providerReports = byProvider.get(account.provider) ?? [];
 		if (providerReports.length === 0) return true;
 		if (account.type === "api_key") return false;
+		// Org-decisive attribution when EITHER side carries an org (Anthropic
+		// multi-subscription): two orgs share every other identifier, so an
+		// org-scoped account is covered only by its own org's report, and an
+		// org-less legacy account is never covered by an org-attributed sibling
+		// report — its own fetch failing must surface as "no usage data". The
+		// shared org is a GATE, not a match: two Team members share the org id
+		// while drawing on per-user pools, so coverage also requires the
+		// account's own base identity inside the same-org subset (an org-only
+		// account, with no base identifiers, is covered by any same-org
+		// report). The email/account fallback below applies only when both
+		// sides are org-less.
+		const accountOrg = account.orgId?.toLowerCase();
 		const ids = [account.email, account.accountId, account.projectId]
 			.filter((value): value is string => typeof value === "string" && value.length > 0)
 			.map(value => value.toLowerCase());
+		const sameOrgReports: UsageReport[] = [];
+		let sawReportOrg = false;
+		for (const report of providerReports) {
+			const metaOrg = report.metadata?.orgId;
+			if (typeof metaOrg === "string" && metaOrg) {
+				sawReportOrg = true;
+				if (accountOrg !== undefined && metaOrg.toLowerCase() === accountOrg) sameOrgReports.push(report);
+			}
+		}
+		if (accountOrg || sawReportOrg) {
+			if (!accountOrg || sameOrgReports.length === 0) return true;
+			if (ids.length === 0) return false;
+			return !sameOrgReports.some(report => {
+				const identifiers = reportIdentifiers(report);
+				return ids.some(id => identifiers.has(id));
+			});
+		}
 		if (ids.length === 0) return false;
 		const reported = new Set<string>();
 		let anyIdentified = false;
@@ -309,9 +344,17 @@ export function collectUnreportedAccounts(
 	});
 }
 
-function accountIdentityLabel(account: UsageAccountIdentity): string {
+/** Compose the account label from parts, masking each part individually so `--redact` cannot be bypassed by the composite string. */
+function accountIdentityLabel(account: UsageAccountIdentity, redaction?: Map<string, string>): string {
 	if (account.type === "api_key") return "API key";
-	return account.email ?? account.accountId ?? account.projectId ?? account.enterpriseUrl ?? "OAuth account";
+	const base = account.email ?? account.accountId ?? account.projectId ?? account.enterpriseUrl ?? "OAuth account";
+	const masked = redaction?.get(base) ?? base;
+	// orgId fallback: the uuid is the actual scoped identity; a token response
+	// can carry it without a display name, and two same-email rows must still
+	// be tellable apart.
+	const org = account.orgName ?? account.orgId;
+	if (!org || org === base) return masked;
+	return `${masked} · ${redaction?.get(org) ?? org}`;
 }
 
 function formatAccountHeader(
@@ -324,6 +367,12 @@ function formatAccountHeader(
 	const icon = STATUS_COLOR[status]("●");
 	const label = reportAccountLabel(report, index);
 	let header = `${icon} ${chalk.bold(redaction?.get(label) ?? label)}`;
+	const metaOrgName = report.metadata?.orgName;
+	const metaOrgId = report.metadata?.orgId;
+	const org = typeof metaOrgName === "string" && metaOrgName ? metaOrgName : metaOrgId;
+	if (typeof org === "string" && org && org !== label) {
+		header += chalk.dim(` · ${redaction?.get(org) ?? org}`);
+	}
 	const planType = report.metadata?.planType;
 	if (typeof planType === "string" && planType) header += chalk.dim(` · plan: ${planType}`);
 	const savedResets = report.resetCredits?.availableCount ?? 0;
@@ -520,8 +569,8 @@ export function formatUsageBreakdown(
 		});
 
 		for (const account of providerUnreported) {
-			const label = accountIdentityLabel(account);
-			lines.push(`  ${chalk.dim("○")} ${chalk.dim(`${redaction?.get(label) ?? label} — no usage data`)}`);
+			const label = accountIdentityLabel(account, redaction);
+			lines.push(`  ${chalk.dim("○")} ${chalk.dim(`${label} — no usage data`)}`);
 		}
 
 		const stats = computeProviderWindowStats(providerReports);
@@ -690,6 +739,8 @@ function collectStoredAccounts(authStorage: AuthStorage): UsageAccountIdentity[]
 					accountId: credential.accountId,
 					projectId: credential.projectId,
 					enterpriseUrl: credential.enterpriseUrl,
+					orgId: credential.orgId,
+					orgName: credential.orgName,
 				});
 			} else {
 				accounts.push({ provider, type: "api_key" });
@@ -726,7 +777,7 @@ function maskIdentity(redaction: Map<string, string>, value: string | undefined)
 	return value === undefined ? undefined : (redaction.get(value) ?? value);
 }
 
-const IDENTITY_METADATA_KEYS = ["email", "accountId", "projectId", "orgId"] as const;
+const IDENTITY_METADATA_KEYS = ["email", "accountId", "projectId", "orgId", "orgName"] as const;
 
 /** Mask identity fields in a raw-stripped report for `--redact --json`. */
 function redactReportForJson(
@@ -830,6 +881,8 @@ export async function runUsageCommand(cmd: UsageCommandArgs): Promise<void> {
 					accountId: maskIdentity(redaction, account.accountId),
 					projectId: maskIdentity(redaction, account.projectId),
 					enterpriseUrl: maskIdentity(redaction, account.enterpriseUrl),
+					orgId: maskIdentity(redaction, account.orgId),
+					orgName: maskIdentity(redaction, account.orgName),
 				}));
 			}
 			const capacity: Record<string, ProviderWindowStat[]> = {};

package/src/cli/usage-error.ts

@@ -0,0 +1,7 @@
+/** Command-line input error that should be rendered without a stack trace. */
+export class CliUsageError extends Error {
+	constructor(message: string) {
+		super(message);
+		this.name = "CliUsageError";
+	}
+}

package/src/cli.ts

@@ -108,6 +108,7 @@ const TINY_WORKER_ARG = "__omp_worker_tiny_inference";
 const STATS_SYNC_WORKER_ARG = "__omp_worker_stats_sync";
 const TAB_WORKER_ARG = "__omp_worker_tab";
 const JS_EVAL_WORKER_ARG = "__omp_worker_js_eval";
+const JS_EVAL_PROCESS_ARG = "__omp_worker_js_eval_process";
 const STT_WORKER_ARG = "__omp_worker_stt";
 const TTS_WORKER_ARG = "__omp_worker_tts";
 const MNEMOPI_EMBED_WORKER_ARG = "__omp_worker_mnemopi_embed";
@@ -156,6 +157,14 @@ async function runWorkerEntrypoint(arg: string | undefined): Promise<boolean> {
 		await import("./eval/js/worker-entry");
 		return true;
 	}
+	if (arg === JS_EVAL_PROCESS_ARG) {
+		const { startJsEvalProcess } = await import("./eval/js/process-entry");
+		// The JS evaluator forwards user-controlled payloads (tool-call args,
+		// display outputs); a non-serializable one must fail that cell, not
+		// SIGKILL the kernel and erase the eval session's state.
+		await runIpcSubprocessWorker(startJsEvalProcess, { rethrowConnectedSendErrors: true });
+		return true;
+	}
 	if (arg === STT_WORKER_ARG) {
 		const { startSttWorker } = await import("./stt/asr-worker");
 		await runIpcSubprocessWorker(startSttWorker);
@@ -196,6 +205,18 @@ async function runIpcSubprocessWorker<In, Out>(
 		sendAndFlush(message: Out): Promise<void>;
 		onMessage(handler: (message: In) => void): () => void;
 	}) => void,
+	options?: {
+		/**
+		 * Rethrow send failures while the IPC channel is still connected instead
+		 * of shutting down. A connected-channel failure means this particular
+		 * message could not be serialized (e.g. a JS eval cell passed a function
+		 * into tool args, a DataCloneError under advanced serialization) — the
+		 * caller must see that error, exactly as Worker `postMessage` would
+		 * deliver it, rather than losing the whole worker and its state.
+		 * Channel-gone failures still shut down.
+		 */
+		rethrowConnectedSendErrors?: boolean;
+	},
 ): Promise<void> {
 	const { promise: shuttingDown, resolve: shutdown } = Promise.withResolvers<void>();
 	type IpcSend = (this: NodeJS.Process, message: unknown, callback?: (error: Error | null) => void) => boolean;
@@ -211,7 +232,8 @@ async function runIpcSubprocessWorker<In, Out>(
 		}
 		try {
 			sender.call(process, message);
-		} catch {
+		} catch (error) {
+			if (options?.rethrowConnectedSendErrors && process.connected) throw error;
 			shutdown();
 		}
 	};

package/src/commands/acp.ts

@@ -5,7 +5,7 @@
  * ACP terminal-auth flag asks the same command to open the interactive TUI.
  */
 import { Command } from "@oh-my-pi/pi-utils/cli";
-import { parseArgs } from "../cli/args";
+import { type Args as ParsedArgs, parseArgs, reportCliUsageError } from "../cli/args";
 import { runRootCommand } from "../main";
 import { prepareAcpTerminalAuthArgs } from "../modes/acp/terminal-auth";
 
@@ -15,7 +15,16 @@ export default class Acp extends Command {
 
 	async run(): Promise<void> {
 		const { args, terminalAuth } = prepareAcpTerminalAuthArgs(this.argv);
-		const parsed = parseArgs(args);
+		let parsed: ParsedArgs;
+		try {
+			parsed = parseArgs(args);
+		} catch (error) {
+			if (reportCliUsageError(error)) {
+				process.exitCode = 2;
+				return;
+			}
+			throw error;
+		}
 		if (!terminalAuth) {
 			parsed.mode = "acp";
 		}

package/src/commands/launch.ts

@@ -4,7 +4,7 @@
 
 import { APP_NAME } from "@oh-my-pi/pi-utils";
 import { Args, Command, Flags } from "@oh-my-pi/pi-utils/cli";
-import { parseArgs } from "../cli/args";
+import { type Args as ParsedArgs, parseArgs, reportCliUsageError } from "../cli/args";
 import { runRootCommand } from "../main";
 import { prepareAcpTerminalAuthArgs } from "../modes/acp/terminal-auth";
 import { CLI_THINKING_LEVELS } from "../thinking";
@@ -157,7 +157,7 @@ export default class Index extends Command {
 			description: "Include thinking blocks in print mode text output",
 		}),
 		"max-time": Flags.string({
-			description: "Stop the session after this many seconds",
+			description: "Stop the session after this duration (e.g., 600, 10m, 1h)",
 		}),
 		// `--auto-approve` / `--yolo`: declared here so oclif's auto-generated `--help` lists it.
 		// Runtime parsing happens in `cli/args.ts parseArgs` (line 176 in that file) — `runRootCommand`
@@ -193,7 +193,16 @@ export default class Index extends Command {
 
 	async run(): Promise<void> {
 		const { args } = prepareAcpTerminalAuthArgs(this.argv);
-		const parsed = parseArgs(args);
+		let parsed: ParsedArgs;
+		try {
+			parsed = parseArgs(args);
+		} catch (error) {
+			if (reportCliUsageError(error)) {
+				process.exitCode = 2;
+				return;
+			}
+			throw error;
+		}
 		await runRootCommand(parsed, args);
 	}
 }

package/src/commands/token.ts

@@ -64,12 +64,14 @@ export default class Token extends Command {
 				}
 				if (flags.list) {
 					for (const acct of accounts) {
-						const label =
+						const base =
 							acct.email ??
 							acct.accountId ??
 							acct.projectId ??
 							acct.enterpriseUrl ??
 							`credential #${acct.credentialId}`;
+						const org = acct.orgName ?? acct.orgId;
+						const label = org && org !== base ? `${base} (${org})` : base;
 						process.stdout.write(`${acct.position + 1}. ${label}\n`);
 					}
 					return;

package/src/config/api-key-resolver.ts

@@ -1,4 +1,5 @@
-import type { Api, ApiKeyResolver, AuthStorage, Model } from "@oh-my-pi/pi-ai";
+import { type Api, type ApiKeyResolver, type AuthStorage, isUsageLimitOutcome, type Model } from "@oh-my-pi/pi-ai";
+import * as AIError from "@oh-my-pi/pi-ai/error";
 
 /** Model slice accepted by the model-form `resolver(model, sessionId)` overload. */
 export type ApiKeyResolverModel = Pick<Model<Api>, "provider" | "baseUrl" | "id">;
@@ -27,7 +28,7 @@ export interface ApiKeyResolverRegistry {
 	/**
 	 * Build an {@link ApiKeyResolver} implementing the central a/b/c auth-retry
 	 * policy: initial → resolve; step (b) → force-refresh same account; step (c)
-	 * → rotate to a sibling credential, then re-resolve.
+	 * → rotate to a sibling and re-resolve, unless quota exhaustion has no sibling.
 	 *
 	 * Two call forms: `resolver(provider, options?)` for provider-scoped keys,
 	 * and `resolver(model, sessionId?)` which derives `baseUrl`/`modelId` from
@@ -59,12 +60,20 @@ export function createApiKeyResolver(
 			// sibling exists we switch immediately; the precise no-sibling backoff
 			// is owned by `markUsageLimitReached` (default + server usage-report
 			// reset) and the outer whole-turn retry layer.
-			await registry.authStorage.rotateSessionCredential(provider, sessionId, {
+			const switched = await registry.authStorage.rotateSessionCredential(provider, sessionId, {
 				error,
 				modelId,
 				signal,
 				apiKey: previousKey,
 			});
+			if (!switched) {
+				const status = AIError.status(error);
+				const message = error instanceof Error ? error.message : typeof error === "string" ? error : undefined;
+				// No sibling for an account-quota failure: stop so the outer
+				// whole-turn retry layer can honor the recorded backoff. A hard
+				// auth decline can instead mean a peer refreshed the bearer.
+				if (AIError.isUsageLimit(error) || isUsageLimitOutcome(status, message)) return undefined;
+			}
 			return registry.getApiKeyForProvider(provider, sessionId, { baseUrl, modelId });
 		}
 		return registry.getApiKeyForProvider(provider, sessionId, { baseUrl, modelId, forceRefresh: true, signal });

package/src/config/config-file.ts

@@ -11,9 +11,9 @@ interface ConfigSchemaError {
 }
 
 /**
- * Module-private cache of (jsonPath, ymlPath) pairs we already migrated this
- * process. Prevents `ConfigFile.relocate()` / repeated `tryLoad()` calls from
- * re-running the migration over and over on the boot path.
+ * Module-private cache of JSON → YAML migrations this process already ran.
+ * Prevents `ConfigFile.relocate()` / repeated `tryLoad()` calls from re-running
+ * the migration over and over on the boot path.
  */
 const migratedPaths = new Set<string>();
 
@@ -123,6 +123,7 @@ export type LoadResult<T> =
 
 export class ConfigFile<T> implements IConfigFile<T> {
 	readonly #basePath: string;
+	readonly #yamlFallbackPath: string | null;
 	readonly #jsonMigrationPath: string | null;
 	#cache?: LoadResult<T>;
 	#auxValidate?: (value: T) => void;
@@ -134,13 +135,17 @@ export class ConfigFile<T> implements IConfigFile<T> {
 	) {
 		this.#basePath = configPath;
 		if (configPath.endsWith(".yml")) {
+			this.#yamlFallbackPath = `${configPath.slice(0, -4)}.yaml`;
 			this.#jsonMigrationPath = `${configPath.slice(0, -4)}.json`;
 		} else if (configPath.endsWith(".yaml")) {
+			this.#yamlFallbackPath = null;
 			this.#jsonMigrationPath = `${configPath.slice(0, -5)}.json`;
 		} else if (configPath.endsWith(".json") || configPath.endsWith(".jsonc")) {
+			this.#yamlFallbackPath = null;
 			// JSON configs are still supported without migration.
 			this.#jsonMigrationPath = null;
 		} else {
+			this.#yamlFallbackPath = null;
 			throw new Error(`Invalid config file path: ${configPath}`);
 		}
 	}
@@ -150,9 +155,11 @@ export class ConfigFile<T> implements IConfigFile<T> {
 	 * Sync callers (tests, settings init) hit this implicitly via {@link tryLoad}.
 	 */
 	#ensureMigrated(): void {
-		if (this.#jsonMigrationPath) {
-			migrateJsonToYml(this.#jsonMigrationPath, this.#basePath);
+		if (!this.#jsonMigrationPath) return;
+		if (this.#yamlFallbackPath && !fs.existsSync(this.#basePath) && fs.existsSync(this.#yamlFallbackPath)) {
+			return;
 		}
+		migrateJsonToYml(this.#jsonMigrationPath, this.#basePath);
 	}
 
 	relocate(configPath?: string): ConfigFile<T> {
@@ -163,9 +170,19 @@ export class ConfigFile<T> implements IConfigFile<T> {
 		return result;
 	}
 
+	#resolveReadPath(): string {
+		if (fs.existsSync(this.#basePath)) {
+			return this.#basePath;
+		}
+		if (this.#yamlFallbackPath && fs.existsSync(this.#yamlFallbackPath)) {
+			return this.#yamlFallbackPath;
+		}
+		return this.#basePath;
+	}
+
 	getMtimeMs(): number | null {
 		try {
-			return fs.statSync(this.path()).mtimeMs;
+			return fs.statSync(this.#resolveReadPath()).mtimeMs;
 		} catch (err) {
 			if (isEnoent(err)) return null;
 			throw err;
@@ -211,12 +228,13 @@ export class ConfigFile<T> implements IConfigFile<T> {
 	#parseContent(content: string): LoadResult<T> {
 		try {
 			let parsed: unknown;
-			if (this.#basePath.endsWith(".json") || this.#basePath.endsWith(".jsonc")) {
+			const readPath = this.#resolveReadPath();
+			if (readPath.endsWith(".json") || readPath.endsWith(".jsonc")) {
 				parsed = JSONC.parse(content);
-			} else if (this.#basePath.endsWith(".yml") || this.#basePath.endsWith(".yaml")) {
+			} else if (readPath.endsWith(".yml") || readPath.endsWith(".yaml")) {
 				parsed = YAML.parse(content);
 			} else {
-				throw new Error(`Invalid config file path: ${this.#basePath}`);
+				throw new Error(`Invalid config file path: ${readPath}`);
 			}
 
 			const checked = this.schema(parsed);
@@ -255,7 +273,7 @@ export class ConfigFile<T> implements IConfigFile<T> {
 
 		let content: string;
 		try {
-			content = fs.readFileSync(this.path(), "utf-8").trim();
+			content = fs.readFileSync(this.#resolveReadPath(), "utf-8").trim();
 		} catch (error) {
 			if (isEnoent(error)) {
 				return this.#storeCache({ status: "not-found" });
@@ -275,7 +293,7 @@ export class ConfigFile<T> implements IConfigFile<T> {
 
 		let content: string;
 		try {
-			content = (await Bun.file(this.path()).text()).trim();
+			content = (await Bun.file(this.#resolveReadPath()).text()).trim();
 		} catch (error) {
 			if (isEnoent(error)) {
 				return this.#storeCache({ status: "not-found" });
@@ -306,7 +324,7 @@ export class ConfigFile<T> implements IConfigFile<T> {
 	}
 
 	path(): string {
-		return this.#basePath;
+		return this.#resolveReadPath();
 	}
 
 	invalidate() {