@orion-agents/orion-code 0.3.2 → 0.3.7

package/dist/services/auth/aws.js

@@ -87,14 +87,16 @@ async function verifyAwsCredentials(auth) {
     if (credentialContext.error)
         return { success: false, error: credentialContext.error };
     // 尝试调用 AWS CLI
-    return new Promise((resolve) => {
+    return new Promise(resolve => {
         const region = auth.region || 'us-east-1';
         (0, child_process_1.execFile)('aws', [
             'sts',
             'get-caller-identity',
             ...credentialContext.profileArgs,
-            '--region', region,
-            '--output', 'json',
+            '--region',
+            region,
+            '--output',
+            'json',
         ], {
             timeout: 10000,
             env: credentialContext.env,
@@ -136,15 +138,18 @@ async function getStsToken(auth, durationSeconds = 3600) {
     const credentialContext = resolveCredentialContext(auth);
     if (credentialContext.error)
         return { success: false, error: credentialContext.error };
-    return new Promise((resolve) => {
+    return new Promise(resolve => {
         const region = auth.region || 'us-east-1';
         (0, child_process_1.execFile)('aws', [
             'sts',
             'get-session-token',
             ...credentialContext.profileArgs,
-            '--region', region,
-            '--duration-seconds', String(durationSeconds),
-            '--output', 'json',
+            '--region',
+            region,
+            '--duration-seconds',
+            String(durationSeconds),
+            '--output',
+            'json',
         ], {
             timeout: 15000,
             env: credentialContext.env,
@@ -183,13 +188,18 @@ async function assumeAwsRole(auth, roleArn, durationSeconds = 3600) {
         (0, child_process_1.execFile)('aws', [
             'sts',
             'assume-role',
-            '--role-arn', roleArn,
-            '--role-session-name', sessionName,
+            '--role-arn',
+            roleArn,
+            '--role-session-name',
+            sessionName,
             ...externalIdArgs,
             ...credentialContext.profileArgs,
-            '--region', region,
-            '--duration-seconds', String(durationSeconds),
-            '--output', 'json',
+            '--region',
+            region,
+            '--duration-seconds',
+            String(durationSeconds),
+            '--output',
+            'json',
         ], {
             timeout: 15000,
             env: credentialContext.env,
@@ -212,10 +222,10 @@ async function assumeAwsRole(auth, roleArn, durationSeconds = 3600) {
  * 检测 AWS CLI 是否可用
  */
 async function checkAwsCliAvailable() {
-    return new Promise((resolve) => {
+    return new Promise(resolve => {
         (0, child_process_1.execFile)('aws', ['--version'], {
             timeout: 5000,
-        }, (error) => {
+        }, error => {
             resolve(!error);
         });
     });

package/dist/services/auto-fix/autoFixRunner.js

@@ -104,7 +104,7 @@ class AutoFixRunner {
     // 内部方法
     // ============================================================================
     async runCommand(command) {
-        return new Promise((resolve) => {
+        return new Promise(resolve => {
             const [cmd, ...args] = command.split(' ');
             (0, child_process_1.execFile)(cmd, args, {
                 cwd: this.projectPath,

package/dist/services/auto-fix/index.d.ts

@@ -3,5 +3,5 @@
  */
 export { AutoFixRunner, getAutoFixRunner, resetAutoFixRunner, type AutoFixResult, type AutoFixError, type AutoFixContext, } from './autoFixRunner';
 export { DEFAULT_AUTOFIX_CONFIG, detectAutoFixConfig, type AutoFixConfig, type AutoFixTrigger, } from './autoFixConfig';
-export { autoFixHook, shouldTriggerAutoFix, } from './autoFixHook';
+export { autoFixHook, shouldTriggerAutoFix } from './autoFixHook';
 //# sourceMappingURL=index.d.ts.map

package/dist/services/diagnostic-tracking/diagnosticTracking.js

@@ -105,8 +105,10 @@ class DiagnosticTracker {
             currentCount: this.currentDiagnostics.length,
             newCount: this.newDiagnostics.length,
             resolvedCount: this.resolvedDiagnostics.length,
-            errorCount: this.currentDiagnostics.filter(d => d.severity === types_1.DiagnosticSeverity.Error).length,
-            warningCount: this.currentDiagnostics.filter(d => d.severity === types_1.DiagnosticSeverity.Warning).length,
+            errorCount: this.currentDiagnostics.filter(d => d.severity === types_1.DiagnosticSeverity.Error)
+                .length,
+            warningCount: this.currentDiagnostics.filter(d => d.severity === types_1.DiagnosticSeverity.Warning)
+                .length,
         };
     }
     /**

package/dist/services/diagnostic-tracking/index.d.ts

@@ -3,5 +3,5 @@
  */
 export { DiagnosticTracker, getDiagnosticTracker, resetDiagnosticTracker, } from './diagnosticTracking';
 export { Diagnostic, DiagnosticBaseline, DiagnosticSeverity, NewDiagnosticsResult, diagnosticKey, isDiagnosticEqual, } from './types';
-export { formatDiagnostic, formatDiagnostics, formatDiagnosticSummary, } from './formatter';
+export { formatDiagnostic, formatDiagnostics, formatDiagnosticSummary } from './formatter';
 //# sourceMappingURL=index.d.ts.map

package/dist/services/effort.js

@@ -5,15 +5,7 @@ exports.isEffortPreference = isEffortPreference;
 exports.resolveEffort = resolveEffort;
 exports.buildProviderEffortParams = buildProviderEffortParams;
 exports.resolveProfileEffort = resolveProfileEffort;
-exports.EFFORT_LEVELS = [
-    'none',
-    'minimal',
-    'low',
-    'medium',
-    'high',
-    'xhigh',
-    'max',
-];
+exports.EFFORT_LEVELS = ['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'];
 function isEffortPreference(value) {
     return value === 'auto' || exports.EFFORT_LEVELS.includes(value);
 }

package/dist/services/file-glob.js

@@ -24,7 +24,8 @@ function parseGitignore(cwd) {
     if ((0, fs_1.existsSync)(gitignorePath)) {
         try {
             const content = (0, fs_1.readFileSync)(gitignorePath, 'utf-8');
-            const lines = content.split('\n')
+            const lines = content
+                .split('\n')
                 .map(line => line.trim())
                 .filter(line => line && !line.startsWith('#'));
             patterns.push(...lines);
@@ -88,9 +89,7 @@ function matchFiles(query, cwd, options = {}) {
         }
         const entries = (0, fs_1.readdirSync)(dirPath);
         for (const entry of entries) {
-            const entryPath = parts.length > 1
-                ? parts.slice(0, -1).join('/') + '/' + entry
-                : entry;
+            const entryPath = parts.length > 1 ? parts.slice(0, -1).join('/') + '/' + entry : entry;
             // 过滤
             const comparableEntry = caseSensitive ? entry : entry.toLowerCase();
             if (normalizedFilter && !comparableEntry.startsWith(normalizedFilter)) {

package/dist/services/global-config.d.ts

@@ -33,7 +33,9 @@ export interface ProjectConfig {
 /** How to handle tool permission checks that request interactive confirmation. */
 export type ToolConfirmationPolicy = 'ask' | 'allow' | 'deny';
 /** Browser appearance preferences persisted in the canonical global document. */
+export type WebUiStylePreferenceV1 = 'classic' | 'orion-blocksmith';
 export interface WebAppearanceConfigV1 {
+    style?: WebUiStylePreferenceV1;
     theme?: 'system' | 'light' | 'dark';
     motion?: 'system' | 'reduced';
 }

package/dist/services/global-config.js

@@ -165,7 +165,10 @@ function validateGlobalConfigDocumentStrict(value) {
         if (value.web.appearance !== undefined) {
             if (!isRecord(value.web.appearance))
                 invalidField('web.appearance');
-            const { theme, motion } = value.web.appearance;
+            const { style, theme, motion } = value.web.appearance;
+            if (style !== undefined && style !== 'classic' && style !== 'orion-blocksmith') {
+                invalidField('web.appearance.style');
+            }
             if (theme !== undefined && theme !== 'system' && theme !== 'light' && theme !== 'dark') {
                 invalidField('web.appearance.theme');
             }
@@ -442,6 +445,9 @@ function sanitizeWebConfig(value) {
     const sanitized = { ...raw };
     if (raw.appearance && typeof raw.appearance === 'object' && !Array.isArray(raw.appearance)) {
         const appearance = { ...raw.appearance };
+        if (appearance.style !== 'classic' && appearance.style !== 'orion-blocksmith') {
+            delete appearance.style;
+        }
         if (appearance.theme !== 'system' &&
             appearance.theme !== 'light' &&
             appearance.theme !== 'dark') {

package/dist/services/mcp/transports.js

@@ -68,7 +68,7 @@ class SseTransport extends BaseTransport {
             this.reconnectAttempts = 0;
             this.emitConnected();
         };
-        this.eventSource.onmessage = (event) => {
+        this.eventSource.onmessage = event => {
             try {
                 const msg = JSON.parse(event.data);
                 this.emitMessage(msg);
@@ -159,7 +159,7 @@ class WebSocketTransport extends BaseTransport {
                 this.emitConnected();
                 resolve();
             };
-            this.ws.onmessage = (event) => {
+            this.ws.onmessage = event => {
                 try {
                     const msg = JSON.parse(event.data);
                     this.emitMessage(msg);
@@ -168,7 +168,7 @@ class WebSocketTransport extends BaseTransport {
                     this.emitError(new Error(`Failed to parse WebSocket message: ${err}`));
                 }
             };
-            this.ws.onerror = (err) => {
+            this.ws.onerror = err => {
                 this.emitError(new Error('WebSocket error'));
                 reject(err);
             };
@@ -274,7 +274,7 @@ class HttpTransport extends BaseTransport {
             if (!response.ok) {
                 throw new Error(`HTTP ${response.status}: ${response.statusText}`);
             }
-            const data = await response.json();
+            const data = (await response.json());
             this.emitMessage(data);
         }
         catch (err) {

package/dist/services/model-catalog.js

@@ -7,31 +7,181 @@ exports.getModelCatalogAliases = getModelCatalogAliases;
 exports.getModelCatalogDiagnostics = getModelCatalogDiagnostics;
 const model_context_1 = require("./model-context");
 const MODEL_CATALOG = [
-    { name: 'claude-opus-4-8', alias: 'opus', provider: 'Anthropic', contextWindow: 200000, maxOutputTokens: 32000 },
-    { name: 'claude-sonnet-4-6', alias: 'sonnet', provider: 'Anthropic', contextWindow: 200000, maxOutputTokens: 16000 },
-    { name: 'claude-haiku-4-5-20251001', alias: 'haiku', provider: 'Anthropic', contextWindow: 200000, maxOutputTokens: 8192 },
-    { name: 'gpt-4o', alias: 'gpt4o', provider: 'OpenAI', contextWindow: 128000, maxOutputTokens: 16384 },
-    { name: 'gpt-4o-mini', alias: 'gpt4omin', provider: 'OpenAI', contextWindow: 128000, maxOutputTokens: 16384 },
-    { name: 'gpt-3.5-turbo', alias: 'gpt35', provider: 'OpenAI', contextWindow: 16385, maxOutputTokens: 4096 },
-    { name: 'glm-5', alias: 'glm', provider: 'Bailian (Zhipu)', contextWindow: 202752, maxOutputTokens: 8192 },
-    { name: 'glm-4.7', alias: 'glm47', provider: 'Bailian (Zhipu)', contextWindow: 131072, maxOutputTokens: 8192 },
-    { name: 'glm-5.2', alias: 'glm52', provider: 'Huoshan (Volcengine)', contextWindow: 1024000, maxOutputTokens: 128000 },
-    { name: 'qwen3.7-plus', alias: 'qwen', provider: 'Bailian (Alibaba)', contextWindow: 131072, maxOutputTokens: 8192 },
-    { name: 'qwen3.6-plus', alias: 'qwen36', provider: 'Bailian (Alibaba)', contextWindow: 131072, maxOutputTokens: 8192 },
-    { name: 'qwen3.5-plus', alias: 'qwen35', provider: 'Bailian (Alibaba)', contextWindow: 131072, maxOutputTokens: 8192 },
-    { name: 'qwen3-max-2026-01-23', alias: 'qwenmax', provider: 'Bailian (Alibaba)', contextWindow: 131072, maxOutputTokens: 8192 },
-    { name: 'qwen3-coder-plus', alias: 'coder', provider: 'Bailian (Alibaba)', contextWindow: 131072, maxOutputTokens: 8192 },
-    { name: 'qwen3-coder-next', alias: 'codernext', provider: 'Bailian (Alibaba)', contextWindow: 131072, maxOutputTokens: 8192 },
-    { name: 'kimi-k2.5', alias: 'kimi', provider: 'Bailian (Moonshot)', contextWindow: 131072, maxOutputTokens: 8192 },
-    { name: 'kimi-k2.7-code', alias: 'kimicode', provider: 'Huoshan (Volcengine)', contextWindow: 256000, maxOutputTokens: 32768 },
-    { name: 'MiniMax-M2.5', alias: 'minimax', provider: 'Bailian (MiniMax)', contextWindow: 131072, maxOutputTokens: 8192 },
-    { name: 'ark-code-latest', alias: 'ark', provider: 'Huoshan (Volcengine)', contextWindow: 1024000, maxOutputTokens: 128000 },
-    { name: 'deepseek-v4-pro', alias: 'dsv4pro', provider: 'Huoshan (Volcengine)', contextWindow: 1000000, maxOutputTokens: 384000 },
-    { name: 'xopdeepseekv4pro', alias: 'xdsv4pro', provider: 'XF MAAS (xf-yun)', contextWindow: 1000000, maxOutputTokens: 16384 },
-    { name: 'xopglm51', alias: 'xglm51', provider: 'XF MAAS (xf-yun)', contextWindow: 204800, maxOutputTokens: 16384 },
-    { name: 'astron-code-latest', alias: 'astron', provider: 'XF MAAS (xf-yun)', contextWindow: 92160, maxOutputTokens: 32768 },
-    { name: 'deepseek-chat', alias: 'dschat', provider: 'DeepSeek', contextWindow: 64000, maxOutputTokens: 8192 },
-    { name: 'deepseek-coder', alias: 'dscoder', provider: 'DeepSeek', contextWindow: 64000, maxOutputTokens: 8192 },
+    {
+        name: 'claude-opus-4-8',
+        alias: 'opus',
+        provider: 'Anthropic',
+        contextWindow: 200000,
+        maxOutputTokens: 32000,
+    },
+    {
+        name: 'claude-sonnet-4-6',
+        alias: 'sonnet',
+        provider: 'Anthropic',
+        contextWindow: 200000,
+        maxOutputTokens: 16000,
+    },
+    {
+        name: 'claude-haiku-4-5-20251001',
+        alias: 'haiku',
+        provider: 'Anthropic',
+        contextWindow: 200000,
+        maxOutputTokens: 8192,
+    },
+    {
+        name: 'gpt-4o',
+        alias: 'gpt4o',
+        provider: 'OpenAI',
+        contextWindow: 128000,
+        maxOutputTokens: 16384,
+    },
+    {
+        name: 'gpt-4o-mini',
+        alias: 'gpt4omin',
+        provider: 'OpenAI',
+        contextWindow: 128000,
+        maxOutputTokens: 16384,
+    },
+    {
+        name: 'gpt-3.5-turbo',
+        alias: 'gpt35',
+        provider: 'OpenAI',
+        contextWindow: 16385,
+        maxOutputTokens: 4096,
+    },
+    {
+        name: 'glm-5',
+        alias: 'glm',
+        provider: 'Bailian (Zhipu)',
+        contextWindow: 202752,
+        maxOutputTokens: 8192,
+    },
+    {
+        name: 'glm-4.7',
+        alias: 'glm47',
+        provider: 'Bailian (Zhipu)',
+        contextWindow: 131072,
+        maxOutputTokens: 8192,
+    },
+    {
+        name: 'glm-5.2',
+        alias: 'glm52',
+        provider: 'Huoshan (Volcengine)',
+        contextWindow: 1024000,
+        maxOutputTokens: 128000,
+    },
+    {
+        name: 'qwen3.7-plus',
+        alias: 'qwen',
+        provider: 'Bailian (Alibaba)',
+        contextWindow: 131072,
+        maxOutputTokens: 8192,
+    },
+    {
+        name: 'qwen3.6-plus',
+        alias: 'qwen36',
+        provider: 'Bailian (Alibaba)',
+        contextWindow: 131072,
+        maxOutputTokens: 8192,
+    },
+    {
+        name: 'qwen3.5-plus',
+        alias: 'qwen35',
+        provider: 'Bailian (Alibaba)',
+        contextWindow: 131072,
+        maxOutputTokens: 8192,
+    },
+    {
+        name: 'qwen3-max-2026-01-23',
+        alias: 'qwenmax',
+        provider: 'Bailian (Alibaba)',
+        contextWindow: 131072,
+        maxOutputTokens: 8192,
+    },
+    {
+        name: 'qwen3-coder-plus',
+        alias: 'coder',
+        provider: 'Bailian (Alibaba)',
+        contextWindow: 131072,
+        maxOutputTokens: 8192,
+    },
+    {
+        name: 'qwen3-coder-next',
+        alias: 'codernext',
+        provider: 'Bailian (Alibaba)',
+        contextWindow: 131072,
+        maxOutputTokens: 8192,
+    },
+    {
+        name: 'kimi-k2.5',
+        alias: 'kimi',
+        provider: 'Bailian (Moonshot)',
+        contextWindow: 131072,
+        maxOutputTokens: 8192,
+    },
+    {
+        name: 'kimi-k2.7-code',
+        alias: 'kimicode',
+        provider: 'Huoshan (Volcengine)',
+        contextWindow: 256000,
+        maxOutputTokens: 32768,
+    },
+    {
+        name: 'MiniMax-M2.5',
+        alias: 'minimax',
+        provider: 'Bailian (MiniMax)',
+        contextWindow: 131072,
+        maxOutputTokens: 8192,
+    },
+    {
+        name: 'ark-code-latest',
+        alias: 'ark',
+        provider: 'Huoshan (Volcengine)',
+        contextWindow: 1024000,
+        maxOutputTokens: 128000,
+    },
+    {
+        name: 'deepseek-v4-pro',
+        alias: 'dsv4pro',
+        provider: 'Huoshan (Volcengine)',
+        contextWindow: 1000000,
+        maxOutputTokens: 384000,
+    },
+    {
+        name: 'xopdeepseekv4pro',
+        alias: 'xdsv4pro',
+        provider: 'XF MAAS (xf-yun)',
+        contextWindow: 1000000,
+        maxOutputTokens: 16384,
+    },
+    {
+        name: 'xopglm51',
+        alias: 'xglm51',
+        provider: 'XF MAAS (xf-yun)',
+        contextWindow: 204800,
+        maxOutputTokens: 16384,
+    },
+    {
+        name: 'astron-code-latest',
+        alias: 'astron',
+        provider: 'XF MAAS (xf-yun)',
+        contextWindow: 92160,
+        maxOutputTokens: 32768,
+    },
+    {
+        name: 'deepseek-chat',
+        alias: 'dschat',
+        provider: 'DeepSeek',
+        contextWindow: 64000,
+        maxOutputTokens: 8192,
+    },
+    {
+        name: 'deepseek-coder',
+        alias: 'dscoder',
+        provider: 'DeepSeek',
+        contextWindow: 64000,
+        maxOutputTokens: 8192,
+    },
 ];
 const EXTRA_ALIASES = {
     claude: 'claude-sonnet-4-6',
@@ -46,7 +196,8 @@ function listModelCatalogEntries() {
 }
 function getModelCatalogEntry(modelIdOrAlias) {
     const normalized = normalizeCatalogKey(modelIdOrAlias);
-    return MODEL_CATALOG.find(entry => normalizeCatalogKey(entry.name) === normalized || normalizeCatalogKey(entry.alias) === normalized);
+    return MODEL_CATALOG.find(entry => normalizeCatalogKey(entry.name) === normalized ||
+        normalizeCatalogKey(entry.alias) === normalized);
 }
 function resolveModelAlias(modelIdOrAlias) {
     const normalized = normalizeCatalogKey(modelIdOrAlias);
@@ -66,12 +217,10 @@ function getModelCatalogAliases() {
     return { ...aliases, ...EXTRA_ALIASES };
 }
 function getModelCatalogDiagnostics() {
-    const unknownCatalogModels = MODEL_CATALOG
-        .filter(entry => {
+    const unknownCatalogModels = MODEL_CATALOG.filter(entry => {
         const source = (0, model_context_1.resolveModelContext)(entry.name).source;
         return source === 'default' || source === 'fuzzy';
-    })
-        .map(entry => entry.name);
+    }).map(entry => entry.name);
     const unknownAliases = Object.entries(getModelCatalogAliases())
         .filter(([, modelId]) => {
         const source = (0, model_context_1.resolveModelContext)(modelId).source;

package/dist/services/model-context.js

@@ -474,7 +474,7 @@ function resolveContextBudget(modelId, requestedOutputTokens) {
     const model = resolveModelContext(modelId);
     const requested = Number.isFinite(requestedOutputTokens)
         ? Math.max(0, Math.round(requestedOutputTokens ?? 0))
-        : model.maxOutputTokens ?? 8192;
+        : (model.maxOutputTokens ?? 8192);
     // 输出预留最多占上下文窗口的一半：某些条目的 maxOutputTokens 等于（甚至接近）
     // contextWindow，直接相减会把可用输入预算打到 0/负数。
     const reservedCeiling = Math.max(1, Math.floor(model.contextWindow * exports.MAX_OUTPUT_RESERVE_RATIO));

package/dist/services/provider-resilience/coordinator.d.ts

@@ -6,9 +6,11 @@
  * through this coordinator.
  */
 import type { ProviderRequestContext, ProviderRequestDiagnosticsV2, ProviderResilienceConfig, ProviderAttemptReporter } from './types';
+import type { ProviderRequestGate } from './request-gate';
 export declare class ProviderResilienceCoordinator {
+    private readonly requestGate?;
     private readonly config;
-    constructor(config?: Partial<ProviderResilienceConfig>);
+    constructor(config?: Partial<ProviderResilienceConfig>, requestGate?: ProviderRequestGate | undefined);
     /** Execute a logical request with full retry/fallback/recovery logic. */
     execute<T>(ctx: ProviderRequestContext, transport: (attempt: number, signal?: AbortSignal, model?: string, reporter?: ProviderAttemptReporter) => Promise<{
         response: T;

package/dist/services/provider-resilience/coordinator.js

@@ -14,7 +14,8 @@ const types_1 = require("./types");
 const error_classifier_1 = require("./error-classifier");
 const observability_1 = require("../../utils/observability");
 class ProviderResilienceCoordinator {
-    constructor(config) {
+    constructor(config, requestGate) {
+        this.requestGate = requestGate;
         this.config = { ...types_1.DEFAULT_PROVIDER_RESILIENCE_CONFIG, ...config };
     }
     /** Execute a logical request with full retry/fallback/recovery logic. */
@@ -51,7 +52,13 @@ class ProviderResilienceCoordinator {
             }
             const attemptRecord = this.startAttempt(ctx, attempt, diagnostics, currentModel);
             diagnostics.attempts.push(attemptRecord);
+            let gateLease;
             try {
+                gateLease = await this.requestGate?.acquire({
+                    priority: 0,
+                    providerKey: ctx.providerKey,
+                    ...(ctx.abortSignal ? { abortSignal: ctx.abortSignal } : {}),
+                });
                 const result = await transport(attempt, ctx.abortSignal, currentModel, this.createAttemptReporter(attemptRecord));
                 attemptRecord.outcome = 'succeeded';
                 attemptRecord.endedAt = Date.now();
@@ -73,6 +80,18 @@ class ProviderResilienceCoordinator {
                 attemptRecord.endedAt = Date.now();
                 attemptRecord.outcome = 'failed';
                 const classification = (0, error_classifier_1.classifyProviderError)(error, attemptRecord.semanticDeltaSeen);
+                if (classification.kind === 'aborted') {
+                    attemptRecord.outcome = 'aborted';
+                    attemptRecord.failureKind = 'aborted';
+                    attemptRecord.retryDisposition = 'fail_fast';
+                    diagnostics.finalState = 'aborted';
+                    (0, observability_1.incrementDiagnosticMetric)('provider.failure.aborted');
+                    (0, observability_1.incrementDiagnosticMetric)('provider.request.aborted');
+                    throw new ProviderRetryExhaustedError(diagnostics, 'aborted by signal', error);
+                }
+                if (classification.kind === 'rate_limit' && classification.retryAfterMs) {
+                    this.requestGate?.enterCooldown(ctx.providerKey, Date.now() + classification.retryAfterMs, `Provider rate limit; retry-after ${classification.retryAfterMs}ms`);
+                }
                 attemptRecord.failureKind = classification.kind;
                 if (attemptRecord.semanticDeltaSeen && !attemptRecord.usage) {
                     diagnostics.unknownBilledAttemptCount++;
@@ -138,6 +157,9 @@ class ProviderResilienceCoordinator {
                         throw new ProviderRetryExhaustedError(diagnostics, 'provider cooldown active', error);
                 }
             }
+            finally {
+                gateLease?.release();
+            }
         }
         diagnostics.finalState = 'retry_exhausted';
         throw new ProviderRetryExhaustedError(diagnostics, `max attempts exhausted: ${String(lastError)}`, lastError);

package/dist/services/provider-resilience/request-gate.js

@@ -8,6 +8,11 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ProviderRequestGate = void 0;
+function createGateAbortError() {
+    const error = new Error('Provider request gate acquisition aborted.');
+    error.name = 'AbortError';
+    return error;
+}
 class ProviderRequestGate {
     constructor(options = {}) {
         this.activeCount = 0;
@@ -26,7 +31,7 @@ class ProviderRequestGate {
      */
     acquire(request) {
         if (request.abortSignal?.aborted) {
-            return Promise.reject(new Error('aborted'));
+            return Promise.reject(createGateAbortError());
         }
         return new Promise((resolve, reject) => {
             const waiter = { request, resolve, reject };
@@ -35,7 +40,7 @@ class ProviderRequestGate {
                     const idx = this.waiters.indexOf(waiter);
                     if (idx >= 0) {
                         this.waiters.splice(idx, 1);
-                        reject(new Error('aborted'));
+                        reject(createGateAbortError());
                         this.tryDispatch();
                     }
                     request.abortSignal?.removeEventListener('abort', onAbort);

package/dist/services/provider-resilience/stream-recovery.js

@@ -24,9 +24,7 @@ function reconcileStreamOverlap(previousText, recoveryText, maxWindow = 2048) {
         return { suffix: recoveryText, overlapFound: false, overlapText: '' };
     }
     // Only look at the tail of previousText within maxWindow.
-    const tail = previousText.length > maxWindow
-        ? previousText.slice(-maxWindow)
-        : previousText;
+    const tail = previousText.length > maxWindow ? previousText.slice(-maxWindow) : previousText;
     // Find longest suffix-prefix match.
     let bestLen = 0;
     for (let len = Math.min(tail.length, recoveryText.length); len > 0; len--) {

package/dist/services/redaction.js

@@ -13,6 +13,10 @@ exports.redactTraceText = redactTraceText;
  * table-driven test is what stops the next format from silently leaking.
  */
 const SECRET_PATTERNS = [
+    // Redact URL userinfo before generic `token:` / `secret:` rules can consume
+    // only the password tail and make the complete credential boundary
+    // unrecognizable (issue #234).
+    [/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi, '$1[REDACTED_CREDENTIAL]@'],
     [
         /\b((?:GH_TOKEN|GITHUB_TOKEN|AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN)\s*=\s*)(["']?)[^\s"',;]+/gi,
         '$1$2[REDACTED_SECRET]',
@@ -46,7 +50,6 @@ const SECRET_PATTERNS = [
         /(["'](?:token|client[_-]?secret|private[_-]?key|secret[_-]?key|signing[_-]?key|encryption[_-]?key|session[_-]?key|db[_-]?password|credential[_-]?value|account[_-]?key|connection[_-]?string|database[_-]?url|dsn|pwd|auth)["']\s*:\s*)(["'])(?:[^"']+)(["'])/gi,
         '$1$2[REDACTED_SECRET]$3',
     ],
-    [/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/:@]+:[^\s/@]+@/gi, '$1[REDACTED_CREDENTIAL]@'],
     [
         /\b((?:OPENAI_API_KEY|DASHSCOPE_API_KEY|ANTHROPIC_API_KEY|XAI_API_KEY)\s*=\s*)(["']?)[^\s"',;]+/g,
         '$1$2[REDACTED_SECRET]',
@@ -121,6 +124,20 @@ function isSensitiveFilePath(path) {
     });
 }
 function redactTraceText(text) {
-    return SECRET_PATTERNS.reduce((current, [pattern, replacement]) => current.replace(pattern, replacement), text);
+    const labelRedacted = SECRET_PATTERNS.reduce((current, [pattern, replacement]) => current.replace(pattern, replacement), text);
+    return redactStructuredSecretFields(labelRedacted);
+}
+function redactStructuredSecretFields(text) {
+    const doubleQuoted = text.replace(/("((?:\\.|[^"\\])*)"\s*:\s*)"(?:\\.|[^"\\])*"/gu, (match, prefix, encodedKey) => {
+        let key = encodedKey;
+        try {
+            key = JSON.parse(`"${encodedKey}"`);
+        }
+        catch {
+            // Keep the literal key for JSON-like diagnostic output.
+        }
+        return isSensitiveFieldName(key) ? `${prefix}"[REDACTED_SECRET]"` : match;
+    });
+    return doubleQuoted.replace(/('((?:\\.|[^'\\])*)'\s*:\s*)'(?:\\.|[^'\\])*'/gu, (match, prefix, key) => isSensitiveFieldName(key) ? `${prefix}'[REDACTED_SECRET]'` : match);
 }
 //# sourceMappingURL=redaction.js.map