@skydiveai/pi-server 0.1.0 → 0.1.251-beta.0

package/dist/index.mjs

@@ -259,7 +259,7 @@ function parseShellEnv(request) {
 		const env = {};
 		for (const [k, v] of Object.entries(parsed)) if (typeof v === "string") env[k] = v;
 		return Object.keys(env).length > 0 ? env : null;
-	} catch {
+	} catch (_err) {
 		return null;
 	}
 }
@@ -283,12 +283,12 @@ function createSSEResponse(handler) {
 		write(chunk) {
 			try {
 				controller.enqueue(encoder.encode(chunk));
-			} catch {}
+			} catch (_err) {}
 		},
 		close() {
 			try {
 				controller.close();
-			} catch {}
+			} catch (_err) {}
 		}
 	};
 	const keepalive = setInterval(() => {
@@ -298,13 +298,13 @@ function createSSEResponse(handler) {
 		clearInterval(keepalive);
 		try {
 			controller.close();
-		} catch {}
+		} catch (_err) {}
 	}, (err) => {
 		logger.error({ err }, "SSE handler crashed — stream closed without response");
 		clearInterval(keepalive);
 		try {
 			controller.close();
-		} catch {}
+		} catch (_err) {}
 	});
 	return new Response(stream, {
 		status: 200,
@@ -373,6 +373,57 @@ async function runConversation({ session, prompt, images, log, postPrompt }) {
 	});
 }
 /**
+* Track the agent session's built-in model-call auto-retry so it leaves a
+* trace.
+*
+* `AgentSession` already restarts a failed assistant turn in place (via
+* `agent.continue()`, so no prompt is replayed and no tool re-executes) for the
+* transient provider/transport failures pi classifies as retryable -- dropped
+* streams, `terminated`, 5xx, overloaded, rate limits. It is on by default,
+* with its own budget and backoff, and it emits `auto_retry_start` /
+* `auto_retry_end` around each attempt.
+*
+* Nothing consumed those events, so a retry left no trace anywhere: a call that
+* succeeded first try and one that burned the whole budget before failing
+* produced the same terminal error, and the fleet-wide retry rate was
+* unmeasurable. That gap is why a 2026-08-16 investigation into three runs lost
+* to `provider_error: terminated` could not tell whether the budget had run out
+* (ANY-7101).
+*
+* Exposed as a handler rather than its own `session.subscribe` call so each
+* protocol feeds it from the single subscription it already owns -- one
+* subscriber, explicit ordering.
+*
+* `attempts()` reports what has been spent so far, so a terminal error can
+* carry the count to the worker, where it lands in a log group we can query
+* fleet-wide (the sandbox's own logs are not).
+*/
+function createAutoRetryObserver(log) {
+	let attempts = 0;
+	return {
+		observe(event) {
+			if (event.type === "auto_retry_start") {
+				attempts = typeof event.attempt === "number" ? event.attempt : attempts + 1;
+				log.warn({
+					event: "model_call_auto_retry",
+					attempt: event.attempt,
+					max_attempts: event.maxAttempts,
+					delay_ms: event.delayMs,
+					error_message: event.errorMessage
+				}, "retrying failed model call in place");
+				return;
+			}
+			if (event.type === "auto_retry_end") log.warn({
+				event: "model_call_auto_retry_end",
+				attempt: event.attempt,
+				success: event.success,
+				final_error: event.finalError
+			}, event.success ? "model call recovered after retry" : "model call retries exhausted");
+		},
+		attempts: () => attempts
+	};
+}
+/**
 * Hard-stop the in-flight turn for a session. Shared by every protocol's
 * `/:id/abort` route: a cancel signals the stop explicitly instead of relying
 * on a dropped connection. `session.abort()` interrupts the turn and resolves
@@ -419,7 +470,10 @@ async function extractParts(parts, log) {
 		}
 		if (part.url != null && part.mediaType?.startsWith("image/")) {
 			try {
-				images.push(await fetchImageAsBase64({ url: part.url }));
+				images.push(await fetchImageAsBase64({
+					url: part.url,
+					userAgent: null
+				}));
 			} catch (err) {
 				log.warn({
 					event: "a2a_image_fetch_failed",
@@ -687,6 +741,7 @@ const thinkingLevelMapSchema = z.object({
 */
 const openaiCompletionsCompatSchema = z.object({
 	supportsReasoningEffort: z.boolean().optional(),
+	supportsStore: z.boolean().optional(),
 	requiresThinkingAsText: z.boolean().optional(),
 	thinkingFormat: z.enum([
 		"openai",
@@ -726,15 +781,26 @@ const baseSpecShape = {
 	*/
 	apiKey: z.string().min(1).optional()
 };
-const modelSpecSchema = z.discriminatedUnion("api", [z.object({
-	...baseSpecShape,
-	api: z.literal("openai-completions"),
-	compat: openaiCompletionsCompatSchema.optional()
-}), z.object({
-	...baseSpecShape,
-	api: z.literal("anthropic-messages"),
-	compat: anthropicMessagesCompatSchema.optional()
-})]);
+const modelSpecSchema = z.discriminatedUnion("api", [
+	z.object({
+		...baseSpecShape,
+		api: z.literal("openai-completions"),
+		compat: openaiCompletionsCompatSchema.optional()
+	}),
+	z.object({
+		...baseSpecShape,
+		api: z.literal("anthropic-messages"),
+		compat: anthropicMessagesCompatSchema.optional()
+	}),
+	z.object({
+		...baseSpecShape,
+		api: z.literal("openai-responses")
+	}),
+	z.object({
+		...baseSpecShape,
+		api: z.literal("openai-codex-responses")
+	}).omit({ apiKey: true })
+]);
 /**
 * Parse a request-body `x_model`. Null when absent or invalid — never a
 * request rejection, so a malformed spec degrades to the legacy body-model
@@ -781,6 +847,14 @@ function buildModelFromSpec(spec) {
 			api: spec.api,
 			...spec.compat ? { compat: spec.compat } : {}
 		};
+		case "openai-responses": return {
+			...base,
+			api: spec.api
+		};
+		case "openai-codex-responses": return {
+			...base,
+			api: spec.api
+		};
 		default: throw new Error(`Unhandled x_model api: ${String(spec)}`);
 	}
 }
@@ -802,7 +876,7 @@ function resolveRequestModel({ modelInput, modelSpecInput, defaultModel, log })
 * always wins.
 */
 function withSpecApiKey(keys, modelSpec) {
-	if (!modelSpec?.apiKey || keys[modelSpec.provider]) return keys;
+	if (!modelSpec || !("apiKey" in modelSpec) || !modelSpec.apiKey || keys[modelSpec.provider]) return keys;
 	return {
 		...keys,
 		[modelSpec.provider]: modelSpec.apiKey
@@ -865,6 +939,18 @@ function providerId(err, message) {
 */
 const CONTEXT_OVERFLOW_MESSAGE = /prompt is too long|context[_ ]length[_ ]exceeded|maximum context length|exceeds maximum token limit|input token count|too many tokens|exceeds the maximum/i;
 /**
+* A content-filter / model-safety termination message from any provider.
+* Used by BOTH the classifyCode message fallback and isModelProviderError's
+* gate (a shape recognized there must pass this gate or it never gets
+* classified), so it lives in one place rather than two copies kept "in
+* sync" by comment. Verified shapes (see classifyCode):
+*   - "Provider finish_reason: content_filter" (Anthropic/gateway 200 stream)
+*   - "This request triggered restrictions on violative cyber content ..."
+*   - "This request triggered cyber-related safeguards. ..."
+*   - "This content was flagged for possible cybersecurity risk. ..."
+*/
+const CONTENT_FILTER_MESSAGE = /finish_reason:\s*content_filter|content[_ ]filter|content[_ ]management[_ ]policy|violative cyber content|cyber[- ]related safeguards|cybersecurity risk|cyber verification program/i;
+/**
 * Map a provider error to a stable code. Prefers the provider's machine code
 * (OpenAI `error.code`, OpenRouter `error.metadata.error_type`) over message
 * text, then falls back to status + message regex for providers that don't
@@ -877,6 +963,7 @@ function classifyCode(status, message, code) {
 	if (status === 429 || code === "rate_limit_exceeded" || /rate[_ ]limit|too many requests|resource[_ ]exhausted/i.test(message)) return "rate_limited";
 	if (status === 529 || code === "provider_overloaded" || /overloaded/i.test(message)) return "provider_overloaded";
 	if (status === 503 || status === 504 || code === "provider_unavailable" || /no healthy upstream|upstream request timeout|stream timeout|service unavailable|unavailable|gateway/i.test(message)) return "provider_unavailable";
+	if (code === "content_filter" || CONTENT_FILTER_MESSAGE.test(message)) return "content_filter";
 	return "provider_error";
 }
 /**
@@ -891,7 +978,7 @@ function isModelProviderError(err) {
 	if (numericStatus(e) !== null) return true;
 	if (e.error && typeof e.error === "object") return true;
 	const msg = messageText(err);
-	return /prompt is too long|context[_ ]length[_ ]exceeded|exceeds maximum token limit|input token count|rate[_ ]limit|overloaded|no healthy upstream|upstream request timeout|insufficient credits|requires more credits|credit balance is too low|payment required|purchase more credits/i.test(msg);
+	return /prompt is too long|context[_ ]length[_ ]exceeded|exceeds maximum token limit|input token count|rate[_ ]limit|overloaded|no healthy upstream|upstream request timeout|insufficient credits|requires more credits|credit balance is too low|payment required|purchase more credits/i.test(msg) || CONTENT_FILTER_MESSAGE.test(msg);
 }
 /** Build the structured, forwardable error from a thrown model-provider error. */
 function toModelProviderError(err) {
@@ -947,7 +1034,10 @@ async function extractContent$1(content, log) {
 				data: src.data
 			});
 			else if (src?.type === "url" && src.url) try {
-				images.push(await fetchImageAsBase64({ url: src.url }));
+				images.push(await fetchImageAsBase64({
+					url: src.url,
+					userAgent: null
+				}));
 			} catch (err) {
 				log.warn({
 					event: "image_fetch_failed",
@@ -1036,7 +1126,7 @@ async function handleMessages(request, ctx, registry) {
 	let parsed;
 	try {
 		parsed = JSON.parse(await request.text());
-	} catch {
+	} catch (_err) {
 		return jsonError(400, "invalid json");
 	}
 	const { messages, stream = false, model: modelInput, system, x_model: modelSpecInput } = parsed ?? {};
@@ -1059,7 +1149,7 @@ async function handleMessages(request, ctx, registry) {
 	const baseSystemPrompt = extractSystemPrompt(system);
 	const { sessionId } = parseSessionId(request);
 	const shellEnv = parseShellEnv(request);
-	const { session, sessionManager: sm } = await ctx.createSession({
+	const { session } = await ctx.createSession({
 		cwd: ctx.cwd,
 		sessionId,
 		perRequestApiKeys: withSpecApiKey(resolvePerRequestApiKeys(request), modelSpec),
@@ -1082,7 +1172,6 @@ async function handleMessages(request, ctx, registry) {
 	if (stream) {
 		const response = runStream$2({
 			session,
-			sm,
 			prompt,
 			images,
 			id,
@@ -1098,7 +1187,6 @@ async function handleMessages(request, ctx, registry) {
 	}
 	const response = await runBlocking$2({
 		session,
-		sm,
 		prompt,
 		images,
 		id,
@@ -1112,7 +1200,7 @@ async function handleMessages(request, ctx, registry) {
 	if (traceId) response.headers.set("x-trace-id", traceId);
 	return response;
 }
-function runStream$2({ session, sm, prompt, images, id, sessionId, modelName, log, postPrompt, registry }) {
+function runStream$2({ session, prompt, images, id, sessionId, modelName, log, postPrompt, registry }) {
 	return createSSEResponse(async (writer) => {
 		let contentBlockIndex = 0;
 		let textBlockOpen = false;
@@ -1158,12 +1246,15 @@ function runStream$2({ session, sm, prompt, images, id, sessionId, modelName, lo
 			textBlockOpen = false;
 		};
 		let capturedModelError = null;
+		let sawModelErrorStop = false;
+		const autoRetry = createAutoRetryObserver(log);
 		const emitProviderError = (providerError) => {
 			log.warn({
 				event: "model_provider_error",
 				code: providerError.code,
 				upstream_status: providerError.upstreamStatus,
-				provider: providerError.provider
+				provider: providerError.provider,
+				retry_attempts: autoRetry.attempts()
 			}, "forwarding model-provider error to client");
 			sseEvent(writer, "error", {
 				type: "error",
@@ -1173,15 +1264,24 @@ function runStream$2({ session, sm, prompt, images, id, sessionId, modelName, lo
 					x_model_provider_error: {
 						code: providerError.code,
 						provider: providerError.provider,
-						upstream_status: providerError.upstreamStatus
+						upstream_status: providerError.upstreamStatus,
+						retry_attempts: autoRetry.attempts()
 					}
 				}
 			});
 		};
 		session.subscribe((event) => {
 			const ev = event;
+			autoRetry.observe(ev);
+			if (ev.type === "auto_retry_end" && ev.success === true) {
+				capturedModelError = null;
+				sawModelErrorStop = false;
+			}
 			const endedMessage = ev.message ?? (Array.isArray(ev.messages) ? ev.messages[ev.messages.length - 1] : null);
-			if (endedMessage?.stopReason === "error" && typeof endedMessage.errorMessage === "string" && endedMessage.errorMessage.length > 0) capturedModelError = endedMessage.errorMessage;
+			if (endedMessage?.stopReason === "error" && endedMessage.errorMessage !== "aborted") {
+				sawModelErrorStop = true;
+				if (typeof endedMessage.errorMessage === "string" && endedMessage.errorMessage.length > 0) capturedModelError = endedMessage.errorMessage;
+			}
 			if (ev.type !== "message_update") return;
 			const inner = ev.assistantMessageEvent;
 			if (!inner) return;
@@ -1239,6 +1339,7 @@ function runStream$2({ session, sm, prompt, images, id, sessionId, modelName, lo
 				postPrompt
 			});
 			if (capturedModelError !== null) emitProviderError(toModelProviderError(new Error(capturedModelError)));
+			else if (sawModelErrorStop) emitProviderError(toModelProviderError(/* @__PURE__ */ new Error("model provider call failed without an error message")));
 		} catch (err) {
 			log.error({
 				err,
@@ -1266,7 +1367,7 @@ function runStream$2({ session, sm, prompt, images, id, sessionId, modelName, lo
 		sseEvent(writer, "message_stop", { type: "message_stop" });
 	});
 }
-async function runBlocking$2({ session, sm, prompt, images, id, sessionId, modelName, log, postPrompt, registry }) {
+async function runBlocking$2({ session, prompt, images, id, sessionId, modelName, log, postPrompt, registry }) {
 	let text = "";
 	const toolUseBlocks = [];
 	const tcByContentIdx = /* @__PURE__ */ new Map();
@@ -1317,7 +1418,7 @@ async function runBlocking$2({ session, sm, prompt, images, id, sessionId, model
 	}
 	for (const block of toolUseBlocks) if (block.type === "tool_use" && typeof block.input === "string") try {
 		block.input = JSON.parse(block.input);
-	} catch {
+	} catch (_err) {
 		block.input = {};
 	}
 	const content = [];
@@ -1379,6 +1480,110 @@ function create$2(options) {
 	};
 }
 //#endregion
+//#region src/billing-blocked-provider-signal.ts
+const BILLING_BLOCKED_PROVIDER_SIGNAL_PREFIX = "ANYONE_BILLING_BLOCKED_V1:";
+/**
+* Duplicated from the billing gate's `BlockReason` (apps/anyone/billing
+* gate/block-reason.ts): pi-server runs inside the sandbox and must not
+* depend on platform packages. A reason the proxy sends that predates this
+* build fails the enum and degrades to the untyped `billing_blocked`
+* handling — never a crash. Exported so agent-lifecycle's chat.test.ts can
+* pin this copy against its own (which billing's block-reason.test.ts in
+* turn pins against the gate), keeping every copy drift-checked.
+*/
+const BILLING_BLOCK_REASONS = [
+	"insufficient_balance",
+	"payment_failed",
+	"hard_spend_limit_reached"
+];
+const payloadSchema = z.object({
+	blockReason: z.enum(BILLING_BLOCK_REASONS),
+	message: z.string()
+}).strict();
+const nestedProxyEnvelopeSchema = z.object({
+	error: z.object({
+		type: z.literal("billing_blocked"),
+		code: z.literal("billing_blocked"),
+		message: z.string()
+	}).strict(),
+	blockReason: z.enum(BILLING_BLOCK_REASONS),
+	message: z.string()
+}).strict();
+/**
+* pi-ai's openai-compatible providers (openrouter, xai, groq, deepseek, …) can
+* NOT fold a proxy's non-2xx body into `error.message`, so `formatProviderError`
+* (@earendil-works/pi-ai utils/error-body) composes the display string as
+* `"<status>: <body>"` or, with a provider label, `"<prefix> (<status>): <body>"`.
+* The billing gate's 402 body therefore reaches us wrapped, e.g.
+* `"402: {\"error\":{...},\"blockReason\":\"insufficient_balance\",\"message\":...}"`
+* or `"OpenRouter (402): {...}"`. Neither the bare `JSON.parse` nor the `"402 "`
+* (space) strip below recognizes that, so a real billing block from an
+* openrouter-routed model degrades to the generic model-provider error. Peel a
+* single leading `"<status>: "` / `"<prefix> (<status>): "` wrapper off the
+* front so the recovered body flows through the existing shape checks. Returns
+* the message unchanged when no wrapper is present.
+*/
+function unwrapOpenAICompatStatusPrefix(message) {
+	const withPrefix = message.match(/^.+ \(\d{3}\): ([\s\S]+)$/);
+	if (withPrefix?.[1] !== void 0) return withPrefix[1];
+	const bare = message.match(/^\d{3}: ([\s\S]+)$/);
+	if (bare?.[1] !== void 0) return bare[1];
+	return message;
+}
+function parsePrefixedSignal(message) {
+	const normalized = message.startsWith("402 ") ? message.slice(4) : message;
+	if (!normalized.startsWith(BILLING_BLOCKED_PROVIDER_SIGNAL_PREFIX)) return null;
+	try {
+		const parsed = payloadSchema.safeParse(JSON.parse(normalized.slice(26)));
+		return parsed.success ? parsed.data : null;
+	} catch (_err) {
+		return null;
+	}
+}
+/**
+* The sandbox proxy's other 402 envelope (verified prod 2026-09-20): the
+* billing gate's body surfaces with the type/code at TOP level and the
+* versioned signal nested inside `message` —
+*   {"type":"billing_blocked","code":"billing_blocked","message":
+*    "ANYONE_BILLING_BLOCKED_V1:{\"blockReason\":\"insufficient_balance\",…}"}
+* — with no blockReason/error wrapper for nestedProxyEnvelopeSchema, so it
+* used to fall through and degrade to a generic model-provider error that
+* read as "The model stopped responding" on an out-of-credit org. The outer
+* shape is validated with a schema instead of ad-hoc casting, and only the
+* top-level `message` is peeled; a signal nested inside `error.message` is
+* handled below through nestedProxyEnvelopeSchema's full integrity checks
+* (validating type, code, blockReason, and message agreement).
+*/
+const topLevelMessageEnvelopeSchema = z.object({ message: z.string().optional() }).passthrough();
+/**
+* Decode only the versioned platform envelope. Anthropic and OpenAI prefix the
+* nested error message with HTTP 402. Google's SDK instead preserves the full
+* proxy response as JSON, so that outer shape is validated separately.
+*/
+function parseBillingBlockedProviderSignal(message) {
+	const unwrapped = unwrapOpenAICompatStatusPrefix(message);
+	const direct = parsePrefixedSignal(unwrapped);
+	if (direct) return direct;
+	let body;
+	try {
+		body = JSON.parse(unwrapped);
+	} catch (_err) {
+		return null;
+	}
+	if (body === null || typeof body !== "object") return null;
+	const nested = topLevelMessageEnvelopeSchema.safeParse(body);
+	if (nested.success && nested.data.message) {
+		const signal = parsePrefixedSignal(nested.data.message);
+		if (signal) return signal;
+	}
+	const envelope = nestedProxyEnvelopeSchema.safeParse(body);
+	if (!envelope.success) return null;
+	const nestedError = parsePrefixedSignal(envelope.data.error.message);
+	const topLevel = parsePrefixedSignal(envelope.data.message);
+	if (!nestedError || nestedError.blockReason !== envelope.data.blockReason || envelope.data.message !== nestedError.message && (!topLevel || topLevel.blockReason !== nestedError.blockReason || topLevel.message !== nestedError.message)) return null;
+	return nestedError;
+}
+//#endregion
 //#region src/protocols/chat-completions.ts
 /**
 * OpenAI Chat Completions–compatible protocol handler.
@@ -1563,7 +1768,7 @@ async function loadHistoryIntoSession({ sm, messages, upToIdxExclusive, modelNam
 				let args = {};
 				try {
 					args = tc.function.arguments ? JSON.parse(tc.function.arguments) : {};
-				} catch {
+				} catch (_err) {
 					args = { _raw: tc.function.arguments };
 				}
 				contentArr.push({
@@ -1605,6 +1810,33 @@ async function loadHistoryIntoSession({ sm, messages, upToIdxExclusive, modelNam
 		}
 	}
 }
+/**
+* Each pi/session message carries the real wall-clock `timestamp` the
+* provider stamped when it produced that message (see @earendil-works/pi-ai
+* Message). Forward it verbatim as `x_created_at` (epoch ms) on the OAI
+* trailer message so the consumer (anyone-messaging completeRun) can stamp
+* each persisted segment at its true emit time and interleave a mid-run steer
+* by createdAt — instead of positionally reconstructing per-turn times, which
+* drifts on parallel tool calls and provider-split replies.
+*/
+function messageTimestampMs(m) {
+	const ts = m?.timestamp;
+	return typeof ts === "number" && Number.isFinite(ts) ? ts : null;
+}
+/**
+* Drop assistant messages recorded as failed model calls (stopReason 'error')
+* from the session-trailer slice. pi keeps an aborted attempt in the session
+* when auto-retry re-runs the model call in place, so a recovered turn carries
+* both the errored attempt and the successful retry. The trailer is only built
+* on the clean path -- a turn that exhausts its retries fails and never emits
+* one -- so any stopReason 'error' assistant message in the slice is an
+* aborted attempt the retry replaced, not a message downstream should join.
+* A user abort ('aborted') is a cancel, not a retried provider failure, and is
+* kept, matching the terminal-error capture above.
+*/
+function dropAbortedModelAttempts(messages) {
+	return messages.filter((m) => !(m?.role === "assistant" && m.stopReason === "error" && m.errorMessage !== "aborted"));
+}
 function piMessagesToOpenAI(messages) {
 	const out = [];
 	for (const m of messages) {
@@ -1633,6 +1865,8 @@ function piMessagesToOpenAI(messages) {
 			};
 			if (toolCalls.length) msg.tool_calls = toolCalls;
 			if (thinking.length) msg.x_thinking = thinking;
+			const createdAtMs = messageTimestampMs(m);
+			if (createdAtMs !== null) msg.x_created_at = createdAtMs;
 			out.push(msg);
 			continue;
 		}
@@ -1644,6 +1878,8 @@ function piMessagesToOpenAI(messages) {
 				content: text
 			};
 			if (m.isError) tm.x_is_error = true;
+			const createdAtMs = messageTimestampMs(m);
+			if (createdAtMs !== null) tm.x_created_at = createdAtMs;
 			out.push(tm);
 			continue;
 		}
@@ -1658,7 +1894,7 @@ async function handleChatCompletions(request, ctx, registry, pendingSteerIds) {
 	let parsed;
 	try {
 		parsed = JSON.parse(await request.text());
-	} catch {
+	} catch (_err) {
 		return jsonError(400, "invalid json");
 	}
 	const { messages, stream = false, model: modelInput, thinkingLevel: thinkingInput, context_window: contextWindowInput, x_model: modelSpecInput } = parsed ?? {};
@@ -1670,7 +1906,7 @@ async function handleChatCompletions(request, ctx, registry, pendingSteerIds) {
 	}
 	if (lastUserIdx < 0) return jsonError(400, "no user message in history");
 	const lastUser = messages[lastUserIdx];
-	const reqUA = request.headers.get("user-agent") ?? void 0;
+	const reqUA = request.headers.get("user-agent") ?? null;
 	const { text: prompt, images } = await extractContent(lastUser.content, {
 		userAgent: reqUA,
 		log
@@ -1701,7 +1937,7 @@ async function handleChatCompletions(request, ctx, registry, pendingSteerIds) {
 	const sessionId = parsedSession.source === "header" ? parsedSession.sessionId : `chatcmpl-${parsedSession.sessionId}`;
 	const shellEnv = parseShellEnv(request);
 	const sessionSetupStart = performance.now();
-	const [{ session, sessionManager: sm }, customTools] = await Promise.all([ctx.createSession({
+	const [{ session, sessionManager: sm }] = await Promise.all([ctx.createSession({
 		cwd: ctx.cwd,
 		sessionId,
 		perRequestApiKeys: withSpecApiKey(resolvePerRequestApiKeys(request), modelSpec),
@@ -1788,6 +2024,8 @@ function runStream$1({ session, sm, prompt, images, sessionId, created, reqStart
 		let usage = null;
 		let lastFollowUpCount = 0;
 		let capturedModelError = null;
+		let sawModelErrorStop = false;
+		const autoRetry = createAutoRetryObserver(log);
 		const sendChunk = (delta, finishReason) => {
 			if (firstChunkAt === null) {
 				firstChunkAt = performance.now();
@@ -1812,14 +2050,22 @@ function runStream$1({ session, sm, prompt, images, sessionId, created, reqStart
 		};
 		const ensureRole = () => {
 			if (roleEmitted) return;
-			sendChunk({ role: "assistant" });
+			sendChunk({ role: "assistant" }, null);
 			roleEmitted = true;
 		};
 		let _evCount = 0;
 		session.subscribe((event) => {
 			const ev = event;
+			autoRetry.observe(ev);
+			if (ev.type === "auto_retry_end" && ev.success === true) {
+				capturedModelError = null;
+				sawModelErrorStop = false;
+			}
 			const endedMessage = ev.message ?? (Array.isArray(ev.messages) ? ev.messages[ev.messages.length - 1] : null);
-			if (endedMessage?.stopReason === "error" && typeof endedMessage.errorMessage === "string" && endedMessage.errorMessage.length > 0) capturedModelError = endedMessage.errorMessage;
+			if (endedMessage?.stopReason === "error" && endedMessage.errorMessage !== "aborted") {
+				sawModelErrorStop = true;
+				if (typeof endedMessage.errorMessage === "string" && endedMessage.errorMessage.length > 0) capturedModelError = endedMessage.errorMessage;
+			}
 			if (ev.type === "queue_update") {
 				const steering = Array.isArray(ev.steering) ? ev.steering.length : 0;
 				const followUp = Array.isArray(ev.followUp) ? ev.followUp.length : 0;
@@ -1835,7 +2081,7 @@ function runStream$1({ session, sm, prompt, images, sessionId, created, reqStart
 					steering,
 					follow_up: followUp,
 					...consumedIds.length > 0 ? { consumed_steer_ids: consumedIds } : {}
-				} });
+				} }, null);
 				return;
 			}
 			_evCount++;
@@ -1858,7 +2104,7 @@ function runStream$1({ session, sm, prompt, images, sessionId, created, reqStart
 				...ev.type === "message_start" || ev.type === "message_end" ? { messageJson: JSON.stringify(ev.message).slice(0, 500) } : {}
 			}, "harness session event");
 			if (ev.type === "tool_execution_start") {
-				sendChunk({ x_tool_execution_start: { tool_call_id: String(ev.toolCallId ?? "") } });
+				sendChunk({ x_tool_execution_start: { tool_call_id: String(ev.toolCallId ?? "") } }, null);
 				return;
 			}
 			if (ev.type === "tool_execution_end") {
@@ -1867,7 +2113,7 @@ function runStream$1({ session, sm, prompt, images, sessionId, created, reqStart
 					tool_call_id: String(ev.toolCallId ?? ""),
 					content: text,
 					...ev.isError ? { is_error: true } : {}
-				} });
+				} }, null);
 				return;
 			}
 			if (ev.type === "agent_end") {
@@ -1879,11 +2125,11 @@ function runStream$1({ session, sm, prompt, images, sessionId, created, reqStart
 			const t = inner?.type;
 			if (t === "text_delta") {
 				ensureRole();
-				sendChunk({ content: inner.delta ?? "" });
+				sendChunk({ content: inner.delta ?? "" }, null);
 				return;
 			}
 			if (t === "thinking_delta") {
-				sendChunk({ x_thinking_delta: inner.delta ?? "" });
+				sendChunk({ x_thinking_delta: inner.delta ?? "" }, null);
 				return;
 			}
 			if (t === "toolcall_start") {
@@ -1901,7 +2147,7 @@ function runStream$1({ session, sm, prompt, images, sessionId, created, reqStart
 						name: tc?.name ?? "",
 						arguments: ""
 					}
-				}] });
+				}] }, null);
 				return;
 			}
 			if (t === "toolcall_delta") {
@@ -1910,7 +2156,7 @@ function runStream$1({ session, sm, prompt, images, sessionId, created, reqStart
 				sendChunk({ tool_calls: [{
 					index: openaiIdx,
 					function: { arguments: inner.delta ?? "" }
-				}] });
+				}] }, null);
 			}
 		});
 		try {
@@ -1922,6 +2168,22 @@ function runStream$1({ session, sm, prompt, images, sessionId, created, reqStart
 				postPrompt
 			});
 			if (capturedModelError !== null) {
+				const billingBlocked = parseBillingBlockedProviderSignal(capturedModelError);
+				if (billingBlocked) {
+					log.warn({
+						event: "billing_blocked",
+						chatcmpl_id: sessionId,
+						source: "stop_reason_error"
+					}, "forwarding platform billing block to client");
+					emitBillingBlocked({
+						writer,
+						sessionId,
+						created,
+						billingBlocked
+					});
+					writer.write("data: [DONE]\n\n");
+					return;
+				}
 				const providerError = toModelProviderError(new Error(capturedModelError));
 				log.warn({
 					event: "model_provider_error",
@@ -1929,13 +2191,34 @@ function runStream$1({ session, sm, prompt, images, sessionId, created, reqStart
 					code: providerError.code,
 					upstream_status: providerError.upstreamStatus,
 					provider: providerError.provider,
+					retry_attempts: autoRetry.attempts(),
 					source: "stop_reason_error"
 				}, "forwarding model-provider error to client");
 				emitModelProviderError({
 					writer,
 					sessionId,
 					created,
-					providerError
+					providerError,
+					retryAttempts: autoRetry.attempts()
+				});
+				writer.write("data: [DONE]\n\n");
+			} else if (sawModelErrorStop) {
+				const providerError = toModelProviderError(/* @__PURE__ */ new Error("model provider call failed without an error message"));
+				log.warn({
+					event: "model_provider_error",
+					chatcmpl_id: sessionId,
+					code: providerError.code,
+					upstream_status: providerError.upstreamStatus,
+					provider: providerError.provider,
+					retry_attempts: autoRetry.attempts(),
+					source: "stop_reason_error_no_message"
+				}, "forwarding model-provider error to client");
+				emitModelProviderError({
+					writer,
+					sessionId,
+					created,
+					providerError,
+					retryAttempts: autoRetry.attempts()
 				});
 				writer.write("data: [DONE]\n\n");
 			} else {
@@ -1957,19 +2240,32 @@ function runStream$1({ session, sm, prompt, images, sessionId, created, reqStart
 				err
 			}, "chat error");
 			if (isModelProviderError(err)) {
+				const billingBlocked = parseBillingBlockedProviderSignal(err instanceof Error ? err.message : String(err));
+				if (billingBlocked) {
+					emitBillingBlocked({
+						writer,
+						sessionId,
+						created,
+						billingBlocked
+					});
+					writer.write("data: [DONE]\n\n");
+					return;
+				}
 				const providerError = toModelProviderError(err);
 				log.warn({
 					event: "model_provider_error",
 					chatcmpl_id: sessionId,
 					code: providerError.code,
 					upstream_status: providerError.upstreamStatus,
-					provider: providerError.provider
+					provider: providerError.provider,
+					retry_attempts: autoRetry.attempts()
 				}, "forwarding model-provider error to client");
 				emitModelProviderError({
 					writer,
 					sessionId,
 					created,
-					providerError
+					providerError,
+					retryAttempts: autoRetry.attempts()
 				});
 			} else sendChunk({ content: `\n[error: ${err?.message ?? err}]` }, "stop");
 			writer.write("data: [DONE]\n\n");
@@ -1986,7 +2282,8 @@ function runStream$1({ session, sm, prompt, images, sessionId, created, reqStart
 	});
 }
 function emitSessionMessagesTrailer({ writer, sm, baselineMessageCount, sessionId, created, usage }) {
-	const sessionMessages = piMessagesToOpenAI(sm.buildSessionContext().messages.slice(baselineMessageCount));
+	const all = sm.buildSessionContext().messages;
+	const sessionMessages = piMessagesToOpenAI(dropAbortedModelAttempts(all.slice(baselineMessageCount)));
 	if (sessionMessages.length === 0 && !usage) return;
 	const chunk = {
 		id: sessionId,
@@ -2010,7 +2307,7 @@ function emitSessionMessagesTrailer({ writer, sm, baselineMessageCount, sessionI
 * cleanly closes the stream for any OpenAI-shaped reader that ignores the
 * extension field.
 */
-function emitModelProviderError({ writer, sessionId, created, providerError }) {
+function emitModelProviderError({ writer, sessionId, created, providerError, retryAttempts }) {
 	const chunk = {
 		id: sessionId,
 		object: "chat.completion.chunk",
@@ -2025,7 +2322,25 @@ function emitModelProviderError({ writer, sessionId, created, providerError }) {
 			message: providerError.message,
 			provider: providerError.provider,
 			type: providerError.type,
-			upstream_status: providerError.upstreamStatus
+			upstream_status: providerError.upstreamStatus,
+			retry_attempts: retryAttempts
+		}
+	};
+	writer.write(`data: ${JSON.stringify(chunk)}\n\n`);
+}
+function emitBillingBlocked({ writer, sessionId, created, billingBlocked }) {
+	const chunk = {
+		id: sessionId,
+		object: "chat.completion.chunk",
+		created,
+		choices: [{
+			index: 0,
+			delta: {},
+			finish_reason: "stop"
+		}],
+		x_billing_blocked: {
+			block_reason: billingBlocked.blockReason,
+			message: billingBlocked.message
 		}
 	};
 	writer.write(`data: ${JSON.stringify(chunk)}\n\n`);
@@ -2091,7 +2406,7 @@ async function runBlocking$1({ session, sm, prompt, images, sessionId, created,
 	};
 	if (toolCalls.length) message.tool_calls = toolCalls;
 	const all = sm.buildSessionContext().messages;
-	const sessionMessages = piMessagesToOpenAI(all.slice(baselineMessageCount));
+	const sessionMessages = piMessagesToOpenAI(dropAbortedModelAttempts(all.slice(baselineMessageCount)));
 	const response = {
 		id: sessionId,
 		object: "chat.completion",
@@ -2122,12 +2437,43 @@ const steerContentPartSchema = z.union([z.object({
 	type: z.literal("image_url"),
 	image_url: z.object({ url: z.string() })
 })]);
+const steerSenderSchema = z.object({
+	kind: z.enum([
+		"user",
+		"system",
+		"agent",
+		"external"
+	]),
+	displayName: z.string().nullable(),
+	participantId: z.string().nullable(),
+	attribute: z.boolean()
+});
 const steerRequestSchema = z.object({
 	content: z.union([z.string().min(1), z.array(steerContentPartSchema).min(1)]).optional(),
 	mode: z.enum(["steer", "follow-up"]).default("steer"),
+	sender: steerSenderSchema.optional(),
 	text: z.string().optional()
 }).refine((v) => v.content !== void 0 || v.text !== void 0, { message: "content or text is required" });
-z.string().uuid();
+/**
+* Render a steer as the user-role text the model reads.
+*
+* Typed senders let the harness own this frame instead of callers embedding a
+* prefix in the text itself — nothing downstream string-matches a marker.
+* Forms mirror the worker's history projection of the same rows
+* (messageToOai / to-oai-history) so the live steer and its re-read next turn
+* agree: system-authored rows project as `[platform] <text>`; attributed
+* humans as `Name: <text>`. Agent steers keep the explicit not-the-user agent
+* form rather than the human `Name:` attribution, per the impersonation fix
+* this carries forward. An attributed steer with no text (attachment-only)
+* still carries its attribution over `(attachments only)`.
+*/
+function frameSteerText({ text, sender }) {
+	if (!sender?.attribute) return text;
+	const body = text.length > 0 ? text : "(attachments only)";
+	if (sender.kind === "system") return `[platform] ${body}`;
+	if (sender.kind === "agent") return sender.displayName ? `[platform] steer from agent ${sender.displayName}: ${body}` : `[platform] steer from agent: ${body}`;
+	return `${sender.displayName ?? "unnamed participant"}: ${body}`;
+}
 async function handleSteer(request, sessionId, registry, pendingSteerIds) {
 	const { log } = requestLogger(request);
 	const session = registry.get(sessionId);
@@ -2135,17 +2481,21 @@ async function handleSteer(request, sessionId, registry, pendingSteerIds) {
 	let body;
 	try {
 		body = JSON.parse(await request.text());
-	} catch {
+	} catch (_err) {
 		return jsonError(400, "invalid json");
 	}
 	const parsed = steerRequestSchema.safeParse(body);
 	if (!parsed.success) return jsonError(400, parsed.error.message);
 	const { mode } = parsed.data;
 	const { text, images } = await extractContent(parsed.data.content ?? parsed.data.text ?? "", {
-		userAgent: request.headers.get("user-agent") ?? void 0,
+		userAgent: request.headers.get("user-agent") ?? null,
 		log
 	});
 	if (!text && images.length === 0) return jsonError(400, "steer has no content");
+	const framedText = frameSteerText({
+		text,
+		sender: parsed.data.sender ?? null
+	});
 	const steerId = randomUUID();
 	let queues = pendingSteerIds.get(sessionId);
 	if (!queues) {
@@ -2157,10 +2507,10 @@ async function handleSteer(request, sessionId, registry, pendingSteerIds) {
 	}
 	if (mode === "follow-up") {
 		queues.followUp.push(steerId);
-		await session.followUp(text, images.length > 0 ? images : void 0);
+		await session.followUp(framedText, images.length > 0 ? images : void 0);
 	} else {
 		queues.steer.push(steerId);
-		await session.steer(text, images.length > 0 ? images : void 0);
+		await session.steer(framedText, images.length > 0 ? images : void 0);
 	}
 	log.info({
 		event: "steer_accepted",
@@ -2295,7 +2645,10 @@ async function extractImagesFromContent(content, log) {
 	for (const part of content) if (part?.type === "input_image") {
 		const url = part.image_url ?? part.url;
 		if (typeof url === "string" && /^https?:\/\//i.test(url)) try {
-			images.push(await fetchImageAsBase64({ url }));
+			images.push(await fetchImageAsBase64({
+				url,
+				userAgent: null
+			}));
 		} catch (err) {
 			log.warn({
 				event: "image_fetch_failed",
@@ -2316,7 +2669,7 @@ async function handleResponses(request, ctx, registry) {
 	let parsed;
 	try {
 		parsed = JSON.parse(await request.text());
-	} catch {
+	} catch (_err) {
 		return jsonError(400, "invalid json");
 	}
 	const { input, stream = false, model: modelInput, instructions, x_model: modelSpecInput } = parsed ?? {};
@@ -2388,6 +2741,7 @@ function runStream({ session, prompt, images, responseId, sessionId, modelName,
 		const tcByContentIdx = /* @__PURE__ */ new Map();
 		let nextOutputIndex = 0;
 		let capturedModelError = null;
+		const autoRetry = createAutoRetryObserver(log);
 		const send = (event) => {
 			writer.write(`data: ${JSON.stringify(event)}\n\n`);
 		};
@@ -2396,7 +2750,8 @@ function runStream({ session, prompt, images, responseId, sessionId, modelName,
 				event: "model_provider_error",
 				code: providerError.code,
 				upstream_status: providerError.upstreamStatus,
-				provider: providerError.provider
+				provider: providerError.provider,
+				retry_attempts: autoRetry.attempts()
 			}, "forwarding model-provider error to client");
 			send({
 				type: "response.failed",
@@ -2410,7 +2765,8 @@ function runStream({ session, prompt, images, responseId, sessionId, modelName,
 						x_model_provider_error: {
 							provider: providerError.provider,
 							type: providerError.type,
-							upstream_status: providerError.upstreamStatus
+							upstream_status: providerError.upstreamStatus,
+							retry_attempts: autoRetry.attempts()
 						}
 					}
 				}
@@ -2446,8 +2802,10 @@ function runStream({ session, prompt, images, responseId, sessionId, modelName,
 		};
 		session.subscribe((event) => {
 			const ev = event;
+			autoRetry.observe(ev);
+			if (ev.type === "auto_retry_end" && ev.success === true) capturedModelError = null;
 			const endedMessage = ev.message ?? (Array.isArray(ev.messages) ? ev.messages[ev.messages.length - 1] : null);
-			if (endedMessage?.stopReason === "error" && typeof endedMessage.errorMessage === "string" && endedMessage.errorMessage.length > 0) capturedModelError = endedMessage.errorMessage;
+			if (endedMessage?.stopReason === "error") capturedModelError = typeof endedMessage.errorMessage === "string" && endedMessage.errorMessage.length > 0 ? endedMessage.errorMessage : "model provider call failed without an error message";
 			if (ev.type !== "message_update") return;
 			const inner = ev.assistantMessageEvent;
 			if (!inner) return;
@@ -2851,4 +3209,4 @@ function chainMiddleware(middlewares) {
 	};
 }
 //#endregion
-export { DEFAULT_MODEL, DEFAULT_PROVIDER, DEFAULT_THINKING_LEVEL, KNOWN_PI_PROVIDERS, PI_AGENT_DIR, VALID_THINKING_LEVELS, buildAgentCard, buildModelFromSpec, chainMiddleware, composeHandlers, createAgentExecutor, createMapSessionRegistry, createPrewarm, createProtocolHandlers, createProtocols, deriveTraceContext, getCurrentTraceparent, logger, modelSpecSchema, mountAt, newTraceContext, parseModelSpec, parseTraceId, requestHeaders, requestLogger, requestUrl, resolveRequestModel, runInTraceContext, setCurrentTraceparent, webHandlerToMiddleware, withSpecApiKey };
+export { BILLING_BLOCK_REASONS, DEFAULT_MODEL, DEFAULT_PROVIDER, DEFAULT_THINKING_LEVEL, KNOWN_PI_PROVIDERS, PI_AGENT_DIR, VALID_THINKING_LEVELS, buildAgentCard, buildModelFromSpec, chainMiddleware, composeHandlers, createAgentExecutor, createMapSessionRegistry, createPrewarm, createProtocolHandlers, createProtocols, deriveTraceContext, getCurrentTraceparent, logger, modelSpecSchema, mountAt, newTraceContext, parseModelSpec, parseTraceId, requestHeaders, requestLogger, requestUrl, resolveRequestModel, runInTraceContext, setCurrentTraceparent, webHandlerToMiddleware, withSpecApiKey };