@selesai/code 0.13.1 → 0.13.3

package/dist/extensions/pi-rewind-hook/README.md

@@ -12,7 +12,7 @@ Rewind metadata lives in the session itself as hidden entries, so rewind history
 
 ## Requirements
 
-- Pi agent v0.65.0+
+- Pi agent v0.74.0+
 - Node.js (for installation)
 - Git repository
 
@@ -181,6 +181,8 @@ Rewind restores the exact file state for the snapshot domain it owns:
 
 Before restoring target contents, it deletes paths present in the current snapshot but absent from the target snapshot, then restores the target snapshot into the worktree only.
 
+Submodules are supported only when their paths stay unchanged, their worktrees are clean and initialized, and each target commit is already available locally. Rewind checks out those target commits without fetching. Exact restore is refused with a clear error for dirty or unavailable submodule state, added or removed submodule paths, and nested submodules; uncommitted files inside submodules are not part of snapshots.
+
 Out of scope:
 
 - ignored files
@@ -240,6 +242,7 @@ grep '"customType":"rewind-' ~/.pi/agent/sessions/**/*.jsonl
 ## Limitations
 
 - Only works in git repositories
+- Submodule snapshots contain gitlink commits, not uncommitted nested files; unsupported submodule states are refused instead of reported as exact restores
 - Session metadata grows append-only; retention only trims git reachability
 - Discovery for retention is best-effort across discovered Pi session roots and explicit `parentSession` ancestors
 - Ignored files and empty directories are outside the snapshot model

package/dist/extensions/pi-rewind-hook/index.ts

@@ -17,6 +17,8 @@ const RETENTION_SWEEP_THRESHOLD = 50;
 const RETENTION_VERSION = 2;
 const EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
 
+class UnsupportedSubmoduleStateError extends Error {}
+
 type ExecFn = (cmd: string, args: string[]) => Promise<{ stdout: string; stderr: string; code: number }>;
 
 type GitExecResult = Awaited<ReturnType<ExecFn>>;
@@ -70,6 +72,11 @@ interface ExactState {
   treeSha: string;
 }
 
+interface GitlinkEntry {
+  path: string;
+  commitSha: string;
+}
+
 interface ActiveBranchState {
   currentCommitSha?: string;
   currentTreeSha?: string;
@@ -387,7 +394,7 @@ export default function rewindExtension(pi: ExtensionAPI) {
   let pendingTreeState: PendingResultingState | null = null;
   let activePromptText: string | null = null;
   let newSnapshotsSinceSweep = 0;
-  let sweepRunning = false;
+  let retentionSweep: Promise<void> | undefined;
   let sweepCompletedThisSession = false;
   let forceConversationOnlyOnNextFork = false;
   let forceConversationOnlySource: string | null = null;
@@ -461,6 +468,87 @@ export default function rewindExtension(pi: ExtensionAPI) {
     return repoRoot;
   }
 
+  async function getGitlinkEntries(treeSha: string, gitPrefix: string[] = []): Promise<GitlinkEntry[]> {
+    const result = await execGitChecked([...gitPrefix, "ls-tree", "-r", "-z", treeSha, "--"]);
+    return parseGitlinkEntries(result.stdout);
+  }
+
+  function parseGitlinkEntries(output: string): GitlinkEntry[] {
+    return output.split("\0").flatMap((record) => {
+      const separator = record.indexOf("\t");
+      if (separator < 0) return [];
+
+      const [mode, type, commitSha] = record.slice(0, separator).split(/\s+/);
+      if (mode !== "160000" || type !== "commit" || !commitSha) return [];
+      return [{ path: record.slice(separator + 1), commitSha }];
+    });
+  }
+
+  async function getIndexedGitlinkEntries(): Promise<GitlinkEntry[]> {
+    const result = await execGitChecked(["ls-files", "--stage", "-z"]);
+    return parseGitlinkEntries(result.stdout);
+  }
+
+  async function assertSubmoduleWorktreesClean(root: string, entries: GitlinkEntry[], action: string) {
+    for (const entry of entries) {
+      const submodulePath = resolve(root, entry.path);
+      if (!isInsidePath(submodulePath, root)) {
+        throw new UnsupportedSubmoduleStateError(`refusing ${action} for submodule path outside repo root: ${entry.path}`);
+      }
+
+      const status = await pi.exec("git", ["-C", submodulePath, "status", "--porcelain", "--untracked-files=all"]);
+      if (status.code !== 0) {
+        throw new UnsupportedSubmoduleStateError(`cannot ${action} with uninitialized submodule: ${entry.path}`);
+      }
+      if (status.stdout.trim()) {
+        throw new UnsupportedSubmoduleStateError(`cannot ${action} with dirty submodule: ${entry.path}`);
+      }
+    }
+  }
+
+  async function prepareSubmoduleRestore(root: string, currentEntries: GitlinkEntry[], targetEntries: GitlinkEntry[]) {
+    const currentPaths = new Set(currentEntries.map((entry) => entry.path));
+    const targetPaths = new Set(targetEntries.map((entry) => entry.path));
+    const changedPaths = [...new Set([...currentPaths, ...targetPaths])]
+      .filter((entryPath) => !currentPaths.has(entryPath) || !targetPaths.has(entryPath));
+    if (changedPaths.length > 0) {
+      throw new UnsupportedSubmoduleStateError(
+        `exact rewind does not support adding or removing submodules: ${changedPaths.join(", ")}`,
+      );
+    }
+
+    await assertSubmoduleWorktreesClean(root, currentEntries, "restore exact files");
+
+    const commitsToInspect = new Map<string, GitlinkEntry>();
+    for (const entry of [...currentEntries, ...targetEntries]) {
+      commitsToInspect.set(`${entry.path}\0${entry.commitSha}`, entry);
+    }
+
+    for (const entry of commitsToInspect.values()) {
+      const entryPath = entry.path;
+      const commitSha = entry.commitSha;
+      const submodulePath = resolve(root, entryPath);
+      const commit = await pi.exec("git", ["-C", submodulePath, "cat-file", "-e", `${commitSha}^{commit}`]);
+      if (commit.code !== 0) {
+        throw new UnsupportedSubmoduleStateError(
+          `cannot inspect submodule ${entryPath}: commit ${commitSha.slice(0, 12)} is unavailable locally`,
+        );
+      }
+
+      const targetTreeSha = (await execGitChecked(["-C", submodulePath, "show", "-s", "--format=%T", commitSha])).stdout.trim();
+      const nestedEntries = await getGitlinkEntries(targetTreeSha, ["-C", submodulePath]);
+      if (nestedEntries.length > 0) {
+        throw new UnsupportedSubmoduleStateError(`cannot restore nested submodules: ${entryPath}`);
+      }
+    }
+  }
+
+  async function restoreSubmodules(root: string, entries: GitlinkEntry[]) {
+    for (const entry of entries) {
+      await execGitChecked(["-C", resolve(root, entry.path), "checkout", "--detach", entry.commitSha]);
+    }
+  }
+
   async function captureWorktreeTree(): Promise<{ treeSha: string }> {
     const root = await getRepoRoot(pi.exec);
     const tempDir = await mkdtemp(join(tmpdir(), "pi-rewind-"));
@@ -470,7 +558,12 @@ export default function rewindExtension(pi: ExtensionAPI) {
       const env = { ...process.env, GIT_INDEX_FILE: tempIndex };
       await execAsync("git add -A", { cwd: root, env });
       const { stdout } = await execAsync("git write-tree", { cwd: root, env });
-      return { treeSha: stdout.trim() };
+      const treeSha = stdout.trim();
+      const entriesByPath = new Map<string, GitlinkEntry>();
+      for (const entry of await getIndexedGitlinkEntries()) entriesByPath.set(entry.path, entry);
+      for (const entry of await getGitlinkEntries(treeSha)) entriesByPath.set(entry.path, entry);
+      await assertSubmoduleWorktreesClean(root, [...entriesByPath.values()], "capture exact files");
+      return { treeSha };
     } finally {
       await rm(tempDir, { recursive: true, force: true }).catch(() => {
         // Best effort cleanup for temporary index directory.
@@ -542,19 +635,38 @@ export default function rewindExtension(pi: ExtensionAPI) {
       return "preserved-empty";
     }
 
-    let head: string | undefined;
-    for (const commitSha of uniqueLiveCommits) {
-      head = await createStoreKeepaliveCommit(commitSha, head);
-    }
+    let attempts = 0;
+    let lastError: unknown;
+    let preserveConcurrentHead = false;
+
+    while (attempts < 5) {
+      attempts += 1;
+      const oldHead = await getStoreHead();
+      // A failed compare-and-swap means another session added snapshots while
+      // this sweep was running. Preserve that new reachability and let a later
+      // uncontended sweep prune anything no longer retained.
+      let head = preserveConcurrentHead ? oldHead : undefined;
+      for (const commitSha of uniqueLiveCommits) {
+        head = await createStoreKeepaliveCommit(commitSha, head);
+      }
 
-    const oldHead = await getStoreHead();
-    if (oldHead) {
-      await execGitChecked(["update-ref", STORE_REF, head!, oldHead]);
-      return "rewritten";
+      try {
+        if (oldHead) {
+          await execGitChecked(["update-ref", STORE_REF, head!, oldHead]);
+        } else {
+          await execGitChecked(["update-ref", STORE_REF, head!, LEGACY_ZERO_SHA]);
+        }
+        return "rewritten";
+      } catch (error) {
+        // Retry if another process updated the store ref concurrently.
+        // Keep the most recent error for actionable failure context.
+        lastError = error;
+        preserveConcurrentHead = true;
+      }
     }
 
-    await execGitChecked(["update-ref", STORE_REF, head!, LEGACY_ZERO_SHA]);
-    return "rewritten";
+    const detail = lastError instanceof Error ? lastError.message : String(lastError);
+    throw new Error(`failed to rewrite rewind store ref: ${detail}`);
   }
 
   async function ensureSnapshotForTree(treeSha: string): Promise<string> {
@@ -606,6 +718,12 @@ export default function rewindExtension(pi: ExtensionAPI) {
     const { treeSha: currentTreeSha } = await captureWorktreeTree();
     const targetTreeSha = await getCommitTreeSha(targetCommitSha);
 
+    const currentSubmodules = await getGitlinkEntries(currentTreeSha);
+    const targetSubmodules = await getGitlinkEntries(targetTreeSha);
+    if (currentSubmodules.length > 0 || targetSubmodules.length > 0) {
+      await prepareSubmoduleRestore(repoRoot!, currentSubmodules, targetSubmodules);
+    }
+
     if (currentTreeSha === targetTreeSha) {
       lastExact = { commitSha: targetCommitSha, treeSha: targetTreeSha };
       return { changed: false, targetTreeSha };
@@ -615,6 +733,13 @@ export default function rewindExtension(pi: ExtensionAPI) {
     const pathsToDelete = await getDeletedPaths(currentTreeSha, targetTreeSha);
     await deletePathsFromWorkingTree(pathsToDelete);
     await execGitChecked(["restore", `--source=${targetCommitSha}`, "--worktree", "--", "."]);
+    if (targetSubmodules.length > 0) {
+      await restoreSubmodules(repoRoot!, targetSubmodules);
+      const { treeSha: restoredTreeSha } = await captureWorktreeTree();
+      if (restoredTreeSha !== targetTreeSha) {
+        throw new Error(`submodule restore did not produce target tree ${targetTreeSha}`);
+      }
+    }
     lastExact = { commitSha: targetCommitSha, treeSha: targetTreeSha };
     return { changed: true, undoCommitSha, targetTreeSha };
   }
@@ -964,13 +1089,13 @@ export default function rewindExtension(pi: ExtensionAPI) {
     if (reason === "new-snapshots" && newSnapshotsSinceSweep < RETENTION_SWEEP_THRESHOLD) return;
     if (reason === "shutdown" && sweepCompletedThisSession && newSnapshotsSinceSweep < RETENTION_SWEEP_THRESHOLD) return;
     if (!repoRoot) return;
-    if (sweepRunning) return;
-    sweepRunning = true;
-    try {
-      await runRetentionSweep(ctx, reason);
-    } finally {
-      sweepRunning = false;
-    }
+    // Session replacement invalidates ctx after session_shutdown resolves, so reuse
+    // the in-flight startup sweep and let shutdown await it before returning.
+    if (retentionSweep) return retentionSweep;
+    retentionSweep = runRetentionSweep(ctx, reason).finally(() => {
+      retentionSweep = undefined;
+    });
+    return retentionSweep;
   }
 
   async function runRetentionSweep(ctx: ExtensionContext, reason: "startup" | "new-snapshots" | "shutdown") {
@@ -1127,7 +1252,12 @@ export default function rewindExtension(pi: ExtensionAPI) {
     }
 
     await getRepoRoot(pi.exec);
-    await reconstructState(ctx);
+    try {
+      await reconstructState(ctx);
+    } catch (error) {
+      if (!(error instanceof UnsupportedSubmoduleStateError)) throw error;
+      notify(ctx, `Rewind unavailable: ${error.message}`, "warning");
+    }
     updateStatus(ctx);
     maybeSweepRetention(ctx, "startup").catch((error) => {
       notify(ctx, `Rewind retention startup sweep failed: ${error instanceof Error ? error.message : String(error)}`, "warning");
@@ -1151,7 +1281,7 @@ export default function rewindExtension(pi: ExtensionAPI) {
     const ctx = activeContext;
     if (!ctx) return;
 
-    checkpointEntry(ctx, data.entryId).catch((error) => {
+    return checkpointEntry(ctx, data.entryId).catch((error) => {
       notify(ctx, `Rewind: failed to checkpoint ${data.entryId} (${error instanceof Error ? error.message : String(error)})`, "warning");
     });
   });

package/dist/extensions/pi-rewind-hook/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-rewind-hook",
-  "version": "1.8.4",
+  "version": "1.8.6",
   "description": "Rewind extension for Pi agent - automatic git checkpoints with file/conversation restore",
   "repository": {
     "type": "git",
@@ -18,12 +18,14 @@
   "author": "nicobailon",
   "license": "MIT",
   "pi": {
-    "extensions": ["./index.ts"]
+    "extensions": [
+      "./index.ts"
+    ]
   },
   "scripts": {
     "test": "npx --yes tsx --tsconfig tsconfig.test.json --test index.test.ts"
   },
-  "devDependencies": {
+  "peerDependencies": {
     "@selesai/code": "*"
   }
 }

package/dist/extensions/pi-subagents/src/integrations/herdr-status.ts

@@ -205,8 +205,6 @@ export function registerHerdrStatusBridge(options: HerdrStatusBridgeOptions): He
 			enqueue([
 				"pane", "report-metadata", paneId,
 				"--source", DEFAULT_SOURCE,
-				"--agent", "pi",
-				"--applies-to-source", "herdr:pi",
 				"--clear-state-labels",
 				"--clear-token", "summary",
 				"--clear-token", "title-suffix",
@@ -220,8 +218,6 @@ export function registerHerdrStatusBridge(options: HerdrStatusBridgeOptions): He
 		enqueue([
 			"pane", "report-metadata", paneId,
 			"--source", DEFAULT_SOURCE,
-			"--agent", "pi",
-			"--applies-to-source", "herdr:pi",
 			"--state-label", `idle=${text}`,
 			"--state-label", `done=${text}`,
 			"--state-label", `working=${text}`,

package/dist/extensions/pi-subagents/test/unit/herdr-status-bridge.test.ts

@@ -159,17 +159,15 @@ describe("Herdr status bridge", () => {
 			label: "⏳ 1 subagent (worker)",
 		}]);
 		assert.equal(commands.length, 1);
-		assert.deepEqual(commands[0]?.slice(0, 8), [
+		assert.deepEqual(commands[0]?.slice(0, 4), [
 			"pane",
 			"report-metadata",
 			"w1:p1",
 			"--source",
-			"pi-subagents:herdr",
-			"--agent",
-			"pi",
-			"--applies-to-source",
 		]);
-		assert.ok(commands[0]?.includes("herdr:pi"));
+		assert.ok(commands[0]?.includes("pi-subagents:herdr"));
+		assert.ok(!commands[0]?.includes("--agent"));
+		assert.ok(!commands[0]?.includes("--applies-to-source"));
 		assert.ok(commands[0]?.includes("--state-label"));
 		assert.ok(commands[0]?.includes("working=⏳ 1 subagent (worker)"));
 		assert.ok(commands[0]?.includes("idle=⏳ 1 subagent (worker)"));

package/dist/extensions/tokenin-onboarding.ts

@@ -13,6 +13,16 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "n
 import { dirname, join } from "node:path";
 import { getAgentDir, getModelsPath } from "@selesai/code";
 import type { AuthStorage, ExtensionAPI, ExtensionCommandContext, ExtensionContext, SessionStartEvent } from "@selesai/code";
+import {
+	createAssistantMessageEventStream,
+	lazyStream,
+	type AssistantMessageEvent,
+	type AssistantMessageEventStream,
+	type Context,
+	type Model,
+	type SimpleStreamOptions,
+} from "@earendil-works/pi-ai";
+import { getApiProvider } from "@earendil-works/pi-ai/compat";
 
 export const TOKEN_IN_PROVIDER = "tokenin";
 export const TOKEN_IN_DASHBOARD_URL = "https://token.selesai.in/dashboard/tokens";
@@ -216,6 +226,291 @@ function isOnboardingComplete(agentDir: string = getAgentDir()): boolean {
 	return existsSync(getOnboardingMarkerPath(agentDir));
 }
 
+// ---------------------------------------------------------------------------
+// Multi-key load balancing / auto-failover
+// ---------------------------------------------------------------------------
+
+export const DEFAULT_TOKENIN_COOLDOWN_MS = 5 * 60 * 1000; // 5 minutes
+
+/** In-memory cooldown tracker mapping token/accountId -> cooldown expires timestamp (ms). */
+const tokenCooldowns = new Map<string, number>();
+
+/** Clear all in-memory cooldowns. Exported for tests. */
+export function clearTokenInCooldowns(): void {
+	tokenCooldowns.clear();
+}
+
+/** Check if a token/account is currently on cooldown. */
+export function isTokenInOnCooldown(tokenId: string, now: number = Date.now()): boolean {
+	const expires = tokenCooldowns.get(tokenId);
+	if (expires === undefined) return false;
+	if (now >= expires) {
+		tokenCooldowns.delete(tokenId);
+		return false;
+	}
+	return true;
+}
+
+/** Put a token/account on cooldown for a given duration. */
+export function setTokenInCooldown(tokenId: string, durationMs: number = DEFAULT_TOKENIN_COOLDOWN_MS, now: number = Date.now()): void {
+	tokenCooldowns.set(tokenId, now + durationMs);
+}
+
+/** Detect if an error message or AssistantMessage stop indicates an auth/quota failure eligible for failover. */
+export function isRotateableTokenInError(error: unknown): boolean {
+	if (!error) return false;
+	let text = "";
+	if (typeof error === "string") {
+		text = error;
+	} else if (error instanceof Error) {
+		text = `${error.name}: ${error.message}`;
+	} else if (typeof error === "object" && error !== null) {
+		const obj = error as Record<string, unknown>;
+		if (typeof obj.errorMessage === "string") {
+			text = obj.errorMessage;
+		} else if (typeof obj.message === "string") {
+			text = obj.message;
+		} else if (Array.isArray(obj.content)) {
+			// AssistantMessage with content blocks containing error text or errorMessage
+			for (const block of obj.content) {
+				if (typeof block === "object" && block !== null) {
+					const b = block as Record<string, unknown>;
+					if (typeof b.errorMessage === "string") text += ` ${b.errorMessage}`;
+					if (typeof b.text === "string") text += ` ${b.text}`;
+				}
+			}
+		}
+		if (!text) text = JSON.stringify(error);
+	} else {
+		text = JSON.stringify(error);
+	}
+
+	const lower = text.toLowerCase();
+	// HTTP 401 / Invalid Key
+	if (lower.includes("401") || lower.includes("unauthorized") || lower.includes("invalid_api_key") || lower.includes("invalid api key") || lower.includes("authentication_error")) {
+		return true;
+	}
+	// HTTP 429 / Rate limit
+	if (lower.includes("429") || lower.includes("rate_limit") || lower.includes("rate limit") || lower.includes("too many requests")) {
+		return true;
+	}
+	// Budget / Quota / Credits
+	if (
+		lower.includes("budget has been exceeded") ||
+		lower.includes("budget_exceeded") ||
+		lower.includes("max_budget") ||
+		lower.includes("insufficient_quota") ||
+		lower.includes("quota exceeded") ||
+		lower.includes("exceeds max_budget") ||
+		lower.includes("credit limit") ||
+		lower.includes("out of credits")
+	) {
+		return true;
+	}
+	return false;
+}
+
+/** Helper to persist active credential to auth.json and tokenin-auth.json without needing AuthStorage instance. */
+function persistActiveTokenInAccount(account: TokenInAccount, authPath: string = getTokenInAuthPath()): void {
+	try {
+		// Update tokenin-auth.json
+		const auth = readTokenInAuth(authPath);
+		auth.activeId = account.id;
+		writeTokenInAuth(auth, authPath);
+
+		// Update auth.json
+		const agentDir = dirname(authPath);
+		const globalAuthPath = join(agentDir, "auth.json");
+		const current = existsSync(globalAuthPath) ? JSON.parse(readFileSync(globalAuthPath, "utf-8")) as Record<string, unknown> : {};
+		current[TOKEN_IN_PROVIDER] = { type: "api_key", key: account.apiKey };
+		mkdirSync(dirname(globalAuthPath), { recursive: true, mode: 0o700 });
+		writeFileSync(globalAuthPath, `${JSON.stringify(current, null, 2)}\n`, { encoding: "utf-8", mode: 0o600 });
+		try {
+			chmodSync(globalAuthPath, 0o600);
+		} catch {
+			// best-effort
+		}
+	} catch {
+		// best-effort sync
+	}
+}
+
+/**
+ * Custom streamSimple implementation for tokenin provider that wraps OpenAI completions
+ * and automatically rotates to alternative saved keys on 401/429/budget exceeded errors.
+ */
+export function createTokenInStreamSimple(options?: {
+	authPath?: string;
+	getAuthStorage?: () => AuthStorage | undefined;
+	onRotate?: (failedAccount: TokenInAccount, nextAccount: TokenInAccount, reason: string) => void;
+	streamSimple?: (model: Model<any>, context: Context, options?: SimpleStreamOptions) => AssistantMessageEventStream;
+}) {
+	const authPath = options?.authPath ?? getTokenInAuthPath();
+	const baseApi = options?.streamSimple ? undefined : getApiProvider("openai-completions");
+	const streamSimple = options?.streamSimple ?? baseApi!.streamSimple.bind(baseApi!);
+
+	const activate = (account: TokenInAccount): void => {
+		const authStorage = options?.getAuthStorage?.();
+		if (authStorage) {
+			applyTokenInAccountToAuth(account, authStorage, authPath);
+		} else {
+			persistActiveTokenInAccount(account, authPath);
+		}
+	};
+
+	const withAccountAuthorization = (streamOptions: SimpleStreamOptions | undefined, account: TokenInAccount): SimpleStreamOptions => {
+		const headers = Object.fromEntries(
+			Object.entries(streamOptions?.headers ?? {}).filter(([name]) => name.toLowerCase() !== "authorization"),
+		);
+		return {
+			...streamOptions,
+			apiKey: account.apiKey,
+			headers: { ...headers, Authorization: `Bearer ${account.apiKey}` },
+		};
+	};
+
+	return function tokenInStreamSimple(
+		model: Model<any>,
+		context: Context,
+		streamOptions?: SimpleStreamOptions,
+	): AssistantMessageEventStream {
+		return lazyStream(model, async () => {
+			const auth = readTokenInAuth(authPath);
+			const accounts = auth.accounts;
+
+			// If no accounts saved, fall back directly to base implementation
+			if (accounts.length === 0) {
+				return streamSimple(model, context, streamOptions);
+			}
+
+			// Order accounts: active account first, followed by remaining accounts
+			const activeIndex = accounts.findIndex((a) => a.id === auth.activeId || a.apiKey === streamOptions?.apiKey);
+			const orderedAccounts: TokenInAccount[] = [];
+			if (activeIndex >= 0) {
+				orderedAccounts.push(accounts[activeIndex]!);
+				for (let i = 0; i < accounts.length; i++) {
+					if (i !== activeIndex) orderedAccounts.push(accounts[i]!);
+				}
+			} else {
+				orderedAccounts.push(...accounts);
+			}
+
+			// Filter/order candidates: prioritize those not currently on cooldown
+			const availableAccounts = orderedAccounts.filter((a) => !isTokenInOnCooldown(a.id));
+			const candidateAccounts = (availableAccounts.length > 0 ? availableAccounts : orderedAccounts).map((account) => ({ ...account }));
+
+			let lastErrorEvent: AssistantMessageEvent | undefined;
+			let lastThrownError: unknown;
+
+			for (let i = 0; i < candidateAccounts.length; i++) {
+				const currentAccount = candidateAccounts[i]!;
+
+				const requestOptions = withAccountAuthorization(streamOptions, currentAccount);
+
+				let underlyingStream: AssistantMessageEventStream;
+				try {
+					underlyingStream = streamSimple(model, context, requestOptions);
+				} catch (err) {
+					lastThrownError = err;
+					if (isRotateableTokenInError(err) && i + 1 < candidateAccounts.length) {
+						setTokenInCooldown(currentAccount.id);
+						const nextAccount = candidateAccounts[i + 1]!;
+						activate(nextAccount);
+						options?.onRotate?.(currentAccount, nextAccount, String(err));
+						continue;
+					}
+					throw err;
+				}
+
+				// Hold a leading start event until the request proves it produced output. This
+				// permits an immediate upstream error to be retried without exposing two starts.
+				const iterator = underlyingStream[Symbol.asyncIterator]();
+				let firstResult: IteratorResult<AssistantMessageEvent>;
+				try {
+					firstResult = await iterator.next();
+				} catch (err) {
+					lastThrownError = err;
+					if (isRotateableTokenInError(err) && i + 1 < candidateAccounts.length) {
+						setTokenInCooldown(currentAccount.id);
+						const nextAccount = candidateAccounts[i + 1]!;
+						activate(nextAccount);
+						options?.onRotate?.(currentAccount, nextAccount, String(err));
+						continue;
+					}
+					throw err;
+				}
+
+				if (firstResult.done) {
+					const passthrough = createAssistantMessageEventStream();
+					passthrough.end();
+					return passthrough;
+				}
+
+				const bufferedEvents = [firstResult.value];
+				if (bufferedEvents[0].type === "start") {
+					try {
+						const next = await iterator.next();
+						if (!next.done) bufferedEvents.push(next.value);
+					} catch (err) {
+						lastThrownError = err;
+						if (isRotateableTokenInError(err) && i + 1 < candidateAccounts.length) {
+							setTokenInCooldown(currentAccount.id);
+							const nextAccount = candidateAccounts[i + 1]!;
+							activate(nextAccount);
+							options?.onRotate?.(currentAccount, nextAccount, String(err));
+							continue;
+						}
+						throw err;
+					}
+				}
+
+				const immediateError = bufferedEvents.find((event) => event.type === "error");
+				if (immediateError?.type === "error" && isRotateableTokenInError(immediateError.error)) {
+					lastErrorEvent = immediateError;
+					setTokenInCooldown(currentAccount.id);
+					if (i + 1 < candidateAccounts.length) {
+						const nextAccount = candidateAccounts[i + 1]!;
+						activate(nextAccount);
+						options?.onRotate?.(currentAccount, nextAccount, immediateError.error.errorMessage ?? "Error");
+						continue;
+					}
+				}
+
+				const outputStream = createAssistantMessageEventStream();
+				(async () => {
+					try {
+						for (const event of bufferedEvents) outputStream.push(event);
+						while (true) {
+							const next = await iterator.next();
+							if (next.done) break;
+							outputStream.push(next.value);
+						}
+						outputStream.end();
+					} catch {
+						outputStream.end();
+					}
+				})();
+
+				return outputStream;
+			}
+
+			// If loop exhausted with a rotateable error event, return a stream with that error
+			if (lastErrorEvent) {
+				const errorStream = createAssistantMessageEventStream();
+				errorStream.push(lastErrorEvent);
+				errorStream.end();
+				return errorStream;
+			}
+
+			if (lastThrownError) {
+				throw lastThrownError;
+			}
+
+			return streamSimple(model, context, streamOptions);
+		});
+	};
+}
+
 async function openDashboard(pi: ExtensionAPI): Promise<void> {
 	const url = TOKEN_IN_DASHBOARD_URL;
 	let command: string;
@@ -537,7 +832,14 @@ async function runOnboarding(pi: ExtensionAPI, ctx: ExtensionContext): Promise<v
 }
 
 export default function tokenInOnboardingExtension(pi: ExtensionAPI): void {
+	let authStorage: AuthStorage | undefined;
+	pi.registerProvider("tokenin", {
+		api: "openai-completions",
+		streamSimple: createTokenInStreamSimple({ getAuthStorage: () => authStorage }),
+	});
+
 	pi.on("session_start", async (event: SessionStartEvent, ctx: ExtensionContext) => {
+		authStorage = ctx.modelRegistry.authStorage;
 		if (event.reason !== "startup") return;
 		if (isOnboardingComplete()) return;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selesai/code",
-  "version": "0.13.1",
+  "version": "0.13.3",
   "description": "Maintained, extension-first Pi coding agent with built-in workflows, subagents, web research, questions, skills, and an enhanced terminal UI.",
   "type": "module",
   "repository": {

package/dist/extensions/ascii.txt

@@ -1,9 +0,0 @@
- ____    ____    __       ____    ____        ______  ______     
-/\  _`\ /\  _`\ /\ \     /\  _`\ /\  _`\     /\  _  \/\__  _\    
-\ \,\L\_\ \ \L\_\ \ \    \ \ \L\_\ \,\L\_\   \ \ \L\ \/_/\ \/    
- \/_\__ \\ \  _\L\ \ \  __\ \  _\L\/_\__ \    \ \  __ \ \ \ \    
-   /\ \L\ \ \ \L\ \ \ \L\ \\ \ \L\ \/\ \L\ \   \ \ \/\ \ \_\ \__ 
-   \ `\____\ \____/\ \____/ \ \____/\ `\____\   \ \_\ \_\/\_____\
-    \/_____/\/___/  \/___/   \/___/  \/_____/    \/_/\/_/\/_____/
-                                                                 
-