@te-river/opencode-team-mode 1.7.10 → 1.8.1

package/dist/host/v2-retry.js

@@ -3,15 +3,20 @@
  * throttles us".
  *
  * THE HONEST BOUNDARY, stated first because everything below is shaped by it:
- * a plugin has NO seam that intercepts the model's own retry.  We cannot delay a
- * request the model decides to send, and we must not pretend to.  So this layer
- * does exactly three things, and says so:
+ * a plugin has NO seam that INTERCEPTS the model's own retry — we cannot delay a
+ * request the model decides to send, and we must not pretend to.  But the method
+ * surface does let a plugin RE-DRIVE execution: `ctx.session.synthetic` is callable
+ * on 2.1.2 (zero-token probe 2026-10-21, docs/v2-port-notes.md) and the host
+ * documents it as "Durably admit synthetic session input and schedule execution
+ * unless resume is false".  So this layer does four things, and says so:
  *
  *   1. RECOGNISE a provider throttle from the event feed (`session.error`), by
  *      matching explicit signatures only — never by guessing.  A text that
  *      not carry a known signature classifies as `unknown` and changes nothing.
- *   2. COMPUTE an exact wait (the fixed 5s/10s/20s ladder for retries #1/#2/#3, doubling
- *      to the cap after that; jitter applies only when retryJitter > 0) — but ONLY for the
+ *   2. COMPUTE an exact wait (a per-request ladder: retries #1..#5 wait
+ *      5s/10s/20s/40s/60s; the chain never accumulates across requests, and the
+ *      host's own `session.retry.scheduled` stands our directive down — the desktop
+ *      is already rendering that countdown; jitter applies only when retryJitter > 0) — but ONLY for the
  *      kinds a wait can fix.  A HARD quota (allocated-exceeded / increase-your-limit /
  *      token-limit / 余额不足) names no wait: the directive says stop and raise-or-reset,
  *      and the breaker trips on the SECOND consecutive hard-quota error instead of
@@ -24,6 +29,13 @@
  *      trips and new `subagent` dispatches are DENIED for `cooldownMs`, on the
  *      same `permission.evaluate` seam the permission guards use.  Both only ever
  *      make a rule stricter, so they compose without fighting.
+ *   4. RE-DRIVE: when a rung's wait is over and nobody moved — the host scheduled no
+ *      retry of its own and the session assembled no request — the layer admits a
+ *      synthetic continuation for that session (`session.synthetic`, resume:true).
+ *      One re-drive per rung, capped by `maxRetries` per chain, NEVER for a session
+ *      the scope has not seen, and cancelled the moment the session or the host
+ *      continues first.  A hard quota is re-driven only when the provider stated a
+ *      retry time — otherwise waiting is the one thing that cannot help.
  *
  * Discipline (the same as every other v2 layer): Team-scoped, never throws (a
  * failure allows the call through and is counted), never rewrites args, and
@@ -71,11 +83,15 @@ function parseRetryAfter(s) {
     return Number.isFinite(n) && n >= 0 ? n * 1000 : 0;
 }
 /**
- * The default ladder is FIXED and deterministic: consecutive errors #1/#2/#3
- * wait exactly 5s / 10s / 20s (base 5000 doubling, jitter 0).  Jitter stays a
- * knob — a user who would rather parallel sessions not re-fire in lockstep can
- * set `retryJitter` back to a fraction — but the shipped default promises the
- * 5/10/20 ladder, and a promise with jitter in it is not that promise.
+ * The default ladder is FIXED, deterministic AND PER REQUEST: retries #1..#5 of the
+ * SAME failed request wait 5s / 10s / 20s / 40s / 60s (base 5000 doubling, jitter 0),
+ * then that request's budget is spent (`maxRetries` 5) and the chain stops.  A chain
+ * never accumulates across requests (idle / gap / post-exhaustion all restart it), and
+ * the host's own `session.retry.scheduled` stands our ladder directive down because the
+ * desktop is already showing that countdown.  Jitter stays a knob — a user who would
+ * rather parallel sessions not re-fire in lockstep can set `retryJitter` back to a
+ * fraction — but the shipped default promises the fixed ladder, and a promise with
+ * jitter in it is not that promise.
  */
 export const RETRY_DEFAULTS = {
     enabled: true,
@@ -84,6 +100,8 @@ export const RETRY_DEFAULTS = {
     jitter: 0,
     breakAfter: 5,
     cooldownMs: 60000,
+    maxRetries: 5,
+    chainGapMs: 600_000,
 };
 const isOff = (raw) => /^(off|false|0|no)$/i.test(String(raw ?? "").trim());
 /**
@@ -99,6 +117,8 @@ export function resolveRetryConfig(config = resolveConfig()) {
         jitter: config.retryJitter,
         breakAfter: config.retryBreakAfter,
         cooldownMs: config.retryCooldownMs,
+        maxRetries: config.retryMaxRetries,
+        chainGapMs: config.retryChainGapMs,
     };
 }
 /**
@@ -112,6 +132,23 @@ export function backoffMs(attempt, baseMs, maxMs, jitter, random) {
     const factor = 1 + (random() * 2 - 1) * j;
     return Math.max(0, Math.round(raw * factor));
 }
+/** The turn-ending event spellings across host generations (2.0.28 renamed them). */
+export function isTurnEndEvent(type) {
+    return type === "session.idle" || type === "session.execution.succeeded" || type === "session.execution.interrupted";
+}
+/** The session→role question, pure so a test can pin it without the host. */
+export function roleOfSession(sid, children, agentOf, leadAgent = "team") {
+    const kid = children.find((c) => c.sessionID === sid);
+    if (kid)
+        return { role: "sub", parentSessionID: kid.parentSessionID, agent: kid.agent };
+    const agent = agentOf(sid);
+    // A Team specialist that has not reached the child registry yet (registration lands
+    // in the dispatch tool's execute.after, so there is a window) is still a SUB-agent:
+    // scope.agentOf only ever stores Team names, and only the lead is "team".
+    if (agent && agent !== leadAgent)
+        return { role: "sub", agent };
+    return { role: agent === leadAgent ? "main" : "unknown", agent };
+}
 const isThrottle = (kind) => kind === "quota" || kind === "rate";
 const kindLabel = (kind) => kind === "quota" ? "配额" : kind === "rate" ? "限流" : kind === "transient" ? "临时" : "未知";
 /**
@@ -143,30 +180,85 @@ export function createRetryGovernor(opts = {}) {
         cooldownDenied: 0,
         foreignSkipped: 0,
         threw: 0,
+        childExhausted: 0,
+        mainExhausted: 0,
+        chainsReset: 0,
+        leadNotices: 0,
+        hostRetries: 0,
+        pluginRetries: 0,
+    };
+    const ANON = "~anon";
+    const MAX_CHAINS = 512;
+    const chains = new Map();
+    const pending = new Map();
+    /** The exact ladder this config promises, for the messages ("5s/10s/20s/40s/60s"). */
+    const ladderLabel = () => {
+        const out = [];
+        for (let i = 0; i < cfg.maxRetries; i++) {
+            out.push(`${Math.round(Math.min(cfg.baseMs * Math.pow(2, i), cfg.maxMs) / 1000)}s`);
+        }
+        return out.join("/");
+    };
+    const chainOf = (sid) => {
+        let c = chains.get(sid);
+        if (c)
+            return c;
+        if (chains.size >= MAX_CHAINS) {
+            // The map is keyed by session id; an unbounded map in a long-lived host is a
+            // leak.  Evict the stalest session — its ladder state is worthless anyway.
+            let oldest = "";
+            let at = Infinity;
+            for (const [k, v] of chains) {
+                if (v.lastAt < at) {
+                    at = v.lastAt;
+                    oldest = k;
+                }
+            }
+            if (oldest) {
+                chains.delete(oldest);
+                pending.delete(oldest);
+            }
+        }
+        c = { attempts: 0, lastAt: 0, streak: 0, hardStreak: 0, cooldownUntil: 0, role: "unknown", done: false, redrives: 0 };
+        chains.set(sid, c);
+        return c;
     };
-    let streak = 0;
-    let hardStreak = 0;
-    let cooldownUntil = 0;
-    let pending = null;
-    const inCooldown = () => now() < cooldownUntil;
-    const buildDirective = (cls, delayMs) => {
+    const inCooldown = (sessionID) => now() < chainOf(sidOf(sessionID)).cooldownUntil;
+    const cooldownRemainingMs = (sessionID) => Math.max(0, chainOf(sidOf(sessionID)).cooldownUntil - now());
+    const buildDirective = (cls, delayMs, attempt) => {
         if (cls.hardQuota) {
             const hint = cls.retryAfterMs > 0 ? `（错误文本给出的重试时间：约 ${Math.round(cls.retryAfterMs / 1000)} 秒）` : "";
             return {
                 text: `${RETRY_MARKER}（配额耗尽，不是故障）\n检测到 provider 配额耗尽（hard quota）：等待与重试都无法解决——请停止向该 provider 重发${hint}，等其配额重置，或请用户提升配额/更换模型。需要完成的工作请主代理自己执行（再派子代理只会被同样的配额打回）。这是配额保护，不是插件故障；可用 retry: "off" 关闭。`,
                 delayMs: 0,
+                kind: "hard",
             };
         }
-        return buildLadderDirective(cls.kind, delayMs);
+        return buildLadderDirective(cls.kind, delayMs, attempt);
+    };
+    const buildExhaustedDirective = (cls, role) => {
+        const text = role === "sub"
+            ? `${RETRY_MARKER}（重试预算耗尽）\n本请求已重试 ${cfg.maxRetries} 次（${ladderLabel()} 阶梯）仍失败（${kindLabel(cls.kind)}）：停止重试，把失败原因交回主代理——由主代理接手该步骤，或换模型/换来源。这是配额保护，不是插件故障；可用 retry: "off" 关闭。`
+            : `${RETRY_MARKER}（重试预算耗尽）\n同一请求已重试 ${cfg.maxRetries} 次（${ladderLabel()} 阶梯）仍失败（${kindLabel(cls.kind)}）：停止重试——向用户如实报告失败原因与已等待时间，并给出选项（换模型 / 补充配额 / 稍后再试）。这是配额保护，不是插件故障；可用 retry: "off" 关闭。`;
+        return { text, delayMs: 0, kind: "exhausted" };
+    };
+    const buildLeadNotice = (cls, sid, agent) => {
+        const who = String(agent ?? "").trim() || "子代理";
+        return {
+            text: `${RETRY_MARKER}（子代理被配额打回）\n子代理 ${who}（${sid.slice(-6)}）同一请求已重试 ${cfg.maxRetries} 次仍失败（${kindLabel(cls.kind)}）：不要再派发该步骤——请主代理自己执行，或换模型/等配额恢复。这是配额保护，不是插件故障；可用 retry: "off" 关闭。`,
+            delayMs: 0,
+            kind: "notice",
+        };
     };
-    const buildLadderDirective = (kind, delayMs) => {
+    const buildLadderDirective = (kind, delayMs, attempt) => {
         const secs = Math.max(1, Math.round(delayMs / 1000));
-        const text = inCooldown()
-            ? `${RETRY_MARKER}（配额保护，不是故障）\n连续 ${cfg.breakAfter} 次配额/限流错误，已进入冷却：请等待 ${secs} 秒后再发下一次请求，这是配额保护，不是插件故障；可用 retry: "off" 关闭。`
-            : `${RETRY_MARKER}（配额保护，不是故障）\n检测到 provider ${kindLabel(kind)} 错误：请等待 ${secs} 秒后再发下一次请求。这是配额保护，不是插件故障；可用 retry: "off" 关闭。`;
-        return { text, delayMs };
+        // Native wording (the desktop renders `尝试 N - 在 X 秒内重试` from the host's own
+        // retry event).  We reuse the shape so the model reads one consistent cadence.
+        const text = `${RETRY_MARKER}（配额保护，不是故障）\n检测到 provider ${kindLabel(kind)} 错误：尝试 ${attempt} - 在 ${secs} 秒内重试。这是配额保护，不是插件故障；可用 retry: "off" 关闭。`;
+        return { text, delayMs, kind: "ladder" };
     };
-    const observe = (text, structuredRetryAfterMs = 0) => {
+    const observe = (text, rawOpts) => {
+        const o = typeof rawOpts === "number" ? { structuredRetryAfterMs: rawOpts } : (rawOpts ?? {});
         const cls = classifyProviderError(text);
         if (cls.kind === "unknown") {
             report.unknownSeen++;
@@ -178,52 +270,185 @@ export function createRetryGovernor(opts = {}) {
             report.rateSeen++;
         else
             report.transientSeen++;
-        streak++;
-        hardStreak = cls.hardQuota ? hardStreak + 1 : 0;
-        const structured = Number.isFinite(structuredRetryAfterMs) && structuredRetryAfterMs > 0 ? structuredRetryAfterMs : 0;
+        // With `retry: "off"` the layer registers no hook, so arming directives would only
+        // grow the map nobody reads.
+        if (!cfg.enabled)
+            return { ...cls, delayMs: 0 };
+        const sid = sidOf(o.sessionID);
+        const chain = chainOf(sid);
+        // A chain that already spent its budget is finished: a further error starts a fresh
+        // chain (back at 5s).  Otherwise a long quiet gap starts one.  One reset, one count.
+        if (chain.done) {
+            chain.attempts = 0;
+            chain.done = false;
+            chain.redrives = 0;
+            report.chainsReset++;
+            emit({ event: "chain_reset", session: sid, why: "post-exhausted" });
+        }
+        else if (chain.lastAt > 0 && now() - chain.lastAt > cfg.chainGapMs) {
+            chain.attempts = 0;
+            chain.redrives = 0;
+            report.chainsReset++;
+            emit({ event: "chain_reset", session: sid, why: "gap" });
+        }
+        if (o.role && o.role !== "unknown")
+            chain.role = o.role;
+        chain.lastAt = now();
+        chain.streak++;
+        chain.hardStreak = cls.hardQuota ? chain.hardStreak + 1 : 0;
+        const structured = Number.isFinite(o.structuredRetryAfterMs) && o.structuredRetryAfterMs > 0 ? o.structuredRetryAfterMs : 0;
         const retryAfterSource = structured > 0 ? "structured" : cls.retryAfterMs > 0 ? "text" : "none";
-        // A hard quota names NO wait — the ladder would be a promise a reset cannot keep.
-        const delayMs = cls.hardQuota ? 0 : Math.max(backoffMs(streak - 1, cfg.baseMs, cfg.maxMs, cfg.jitter, random), structured, cls.retryAfterMs);
+        // This error is the one PAST the ladder when the request already spent all its retries.
+        const exhausted = !cls.hardQuota && chain.attempts >= cfg.maxRetries;
+        // The ladder is indexed by THIS request's cumulative retries: #1 → 5s, #2 → 10s, #3 → 20s.
+        const delayMs = cls.hardQuota || exhausted
+            ? 0
+            : Math.max(backoffMs(chain.attempts, cfg.baseMs, cfg.maxMs, cfg.jitter, random), structured, cls.retryAfterMs);
+        if (!cls.hardQuota && !exhausted)
+            chain.attempts++;
         report.lastDelayMs = delayMs;
-        emit({ event: "classified", kind: cls.kind, hard_quota: cls.hardQuota, delay_ms: delayMs, streak, retry_after_source: retryAfterSource });
-        // The breaker: consecutive errors of a throttle class.  A hard quota is different
-        // work — two in a row means the provider is out of allocation, and waiting for
-        // breakAfter only burns the user's tokens on a dead endpoint.
-        if (isThrottle(cls.kind) && (cls.hardQuota ? hardStreak >= 2 : streak >= cfg.breakAfter)) {
-            const wasIn = inCooldown();
-            cooldownUntil = now() + cfg.cooldownMs;
+        emit({
+            event: "classified",
+            kind: cls.kind,
+            hard_quota: cls.hardQuota,
+            delay_ms: delayMs,
+            attempt: chain.attempts,
+            exhausted,
+            session: sid,
+            role: chain.role,
+            retry_after_source: retryAfterSource,
+        });
+        // The breaker is the SESSION's provider-health signal (independent of the
+        // per-request budget): consecutive throttle errors cool that session's dispatches.
+        // A hard quota is different work — two in a row means the provider is out of
+        // allocation, so waiting for breakAfter only burns tokens on a dead endpoint.
+        if (isThrottle(cls.kind) && (cls.hardQuota ? chain.hardStreak >= 2 : chain.streak >= cfg.breakAfter)) {
+            const wasIn = now() < chain.cooldownUntil;
+            chain.cooldownUntil = now() + cfg.cooldownMs;
             report.cooldowns++;
             if (!wasIn)
                 report.breakTrips++;
-            streak = 0;
-            hardStreak = 0;
-            emit({ event: "cooldown", break_trips: report.breakTrips, cooldowns: report.cooldowns, cooldown_ms: cfg.cooldownMs });
+            chain.streak = 0;
+            chain.hardStreak = 0;
+            emit({ event: "cooldown", break_trips: report.breakTrips, cooldowns: report.cooldowns, cooldown_ms: cfg.cooldownMs, session: sid });
+        }
+        if (exhausted) {
+            chain.done = true;
+            if (chain.role === "sub") {
+                report.childExhausted++;
+                pending.set(sid, buildExhaustedDirective(cls, "sub"));
+                const target = sidOf(o.parentSessionID);
+                if (target !== ANON && !pending.has(target)) {
+                    pending.set(target, buildLeadNotice(cls, sid, o.agent));
+                    report.leadNotices++;
+                }
+            }
+            else {
+                report.mainExhausted++;
+                pending.set(sid, buildExhaustedDirective(cls, chain.role));
+            }
+        }
+        else {
+            pending.set(sid, buildDirective(cls, delayMs, chain.attempts > 0 ? chain.attempts : 1));
+            if (cls.hardQuota && chain.role === "sub") {
+                const target = sidOf(o.parentSessionID);
+                if (target !== ANON && !pending.has(target)) {
+                    pending.set(target, buildLeadNotice(cls, sid, o.agent));
+                    report.leadNotices++;
+                }
+            }
+        }
+        // ③ PLUGIN-DRIVEN RE-DRIVE: the ladder's wait is not just advice — the layer
+        // schedules a synthetic continuation for this session (ctx.session.synthetic,
+        // verified callable on 2.1.2).  Hard quota re-drives ONLY when the provider
+        // stated a retry time; otherwise waiting is futile and the stop directive is
+        // all we can honestly say.  Budget: one re-drive per rung of the chain.
+        if (opts.redrive && cfg.enabled && sid !== ANON) {
+            const floor = Math.max(structured, cls.retryAfterMs);
+            if (!cls.hardQuota && !exhausted && delayMs > 0 && chain.redrives < cfg.maxRetries) {
+                chain.redrives++;
+                opts.redrive({ sessionID: sid, delayMs, attempt: chain.redrives, kind: cls.kind, hardQuota: false });
+            }
+            else if (cls.hardQuota && floor > 0 && chain.redrives < cfg.maxRetries) {
+                chain.redrives++;
+                opts.redrive({ sessionID: sid, delayMs: floor, attempt: chain.redrives, kind: cls.kind, hardQuota: true });
+            }
         }
-        pending = buildDirective(cls, delayMs);
         return { ...cls, delayMs };
     };
     return {
         observe,
         observeEvent(raw) {
             const text = errorTextOf(raw);
-            if (text)
-                observe(text, structuredRetryAfterOf(raw));
+            if (!text)
+                return;
+            const sid = sessionIDOf(raw);
+            const info = sid && opts.roleOf ? opts.roleOf(sid) : undefined;
+            observe(text, {
+                sessionID: sid,
+                structuredRetryAfterMs: structuredRetryAfterOf(raw),
+                role: info?.role,
+                parentSessionID: info?.parentSessionID,
+                agent: info?.agent,
+            });
+        },
+        observeHostRetry(raw) {
+            if (!raw || typeof raw !== "object")
+                return;
+            const o = raw;
+            const props = (o.properties ?? o.payload ?? o.data);
+            const p = props && typeof props === "object" ? props : o;
+            const sid = sidOf(sessionIDOf(raw) || (typeof p.sessionID === "string" ? p.sessionID : ""));
+            const attempt = typeof p.attempt === "number" && Number.isFinite(p.attempt) ? Math.max(0, Math.floor(p.attempt)) : 0;
+            const at = typeof p.at === "number" && Number.isFinite(p.at) ? p.at : 0;
+            const err = p.error;
+            const retryAfterMs = err && typeof err === "object" && typeof err.retryAfterMs === "number" && err.retryAfterMs > 0 ? err.retryAfterMs : 0;
+            const chain = chainOf(sid);
+            // The host is already retrying this request: align our bookkeeping with its
+            // attempt count and stand the ladder directive down.  A second “wait N
+            // seconds” from us would contradict the countdown the UI is showing; the
+            // exhausted/hard directives stay — those are the cases the host does NOT retry.
+            chain.attempts = Math.max(chain.attempts, attempt);
+            chain.lastAt = now();
+            const d = pending.get(sid);
+            if (d && d.kind === "ladder")
+                pending.delete(sid);
+            report.hostRetries++;
+            emit({ event: "host_retry", session: sid, attempt, at, retry_after_ms: retryAfterMs });
+        },
+        observeIdle(sessionID) {
+            const sid = sidOf(sessionID);
+            const c = chains.get(sid);
+            if (!c)
+                return;
+            // The turn ended: the REQUEST's ladder starts over, but the session-level
+            // breaker state (streak / hardStreak / cooldown) is a provider-health signal
+            // and must survive — a hard quota in one turn and another in the next are
+            // still two consecutive hits on the same provider.
+            const meaningful = c.attempts > 0 || c.done;
+            c.attempts = 0;
+            c.done = false;
+            if (meaningful) {
+                report.chainsReset++;
+                emit({ event: "chain_reset", session: sid, why: "idle" });
+            }
         },
-        directive: () => pending,
-        takeDirective() {
-            const d = pending;
-            pending = null;
+        directive: (sessionID) => pending.get(sidOf(sessionID)) ?? null,
+        takeDirective(sessionID) {
+            const sid = sidOf(sessionID);
+            const d = pending.get(sid) ?? null;
+            if (d)
+                pending.delete(sid);
             return d;
         },
         inCooldown,
-        cooldownRemainingMs: () => Math.max(0, cooldownUntil - now()),
+        cooldownRemainingMs,
         breakAfter: cfg.breakAfter,
+        maxRetries: cfg.maxRetries,
         report,
         reset() {
-            streak = 0;
-            hardStreak = 0;
-            cooldownUntil = 0;
-            pending = null;
+            chains.clear();
+            pending.clear();
         },
     };
 }
@@ -301,6 +526,19 @@ export function structuredRetryAfterOf(raw) {
     }
     return 0;
 }
+/** The session id an event refers to — defensive, the payload shape is not promised. */
+export function sessionIDOf(raw) {
+    if (!raw || typeof raw !== "object")
+        return "";
+    const o = raw;
+    if (typeof o.sessionID === "string" && o.sessionID)
+        return o.sessionID;
+    const props = (o.properties ?? o.payload ?? o.data);
+    if (props && typeof props === "object" && typeof props.sessionID === "string")
+        return props.sessionID;
+    return "";
+}
+const sidOf = (v) => (typeof v === "string" && v.trim() ? v.trim() : "~anon");
 const rank = { allow: 0, ask: 1, deny: 2 };
 /**
  * Register the two hooks the retry layer owns:
@@ -316,22 +554,102 @@ export async function applyV2RetryGovernor(ctx, input) {
     const { scope, governor } = input;
     const report = governor.report;
     const registrations = [];
+    const timers = input.timers ?? {
+        set: (cb, ms) => setTimeout(cb, ms),
+        clear: (h) => clearTimeout(h),
+    };
+    // ③ The re-drive machinery lives HERE because this layer owns the session domain,
+    // the scope and the trajectory sink; the governor only decides WHEN (with budget).
+    const pendingRedrive = new Map();
+    const emit = (row) => {
+        try {
+            input.onEvent?.(row);
+        }
+        catch {
+            /* the trajectory line is an extra, never a reason to fail the call */
+        }
+    };
+    const scheduleRedrive = (req) => {
+        // Only sessions this plugin has actually seen as Team (lead or a specialist).
+        // An unknown id is never re-driven — a throughput helper may not push input
+        // into somebody else's conversation.
+        if (!scope || !scope.agentOf(req.sessionID))
+            return;
+        const prev = pendingRedrive.get(req.sessionID);
+        if (prev !== undefined)
+            timers.clear(prev);
+        const secs = Math.max(1, Math.round(req.delayMs / 1000));
+        const text = `[Team 自动重试 ${req.attempt}] 上一次请求因 provider ${kindLabel(req.kind)} 失败` +
+            (req.hardQuota ? "（配额，已按服务端给出的重试时间等待）" : "") +
+            `，已等待 ${secs} 秒。请继续该会话未完成的工作；若再次失败，按 Team Retry 指令处理。`;
+        const handle = timers.set(() => {
+            pendingRedrive.delete(req.sessionID);
+            void (async () => {
+                const synthetic = ctx.session?.synthetic;
+                if (typeof synthetic !== "function") {
+                    emit({ event: "plugin_retry_failed", session: req.sessionID, attempt: req.attempt, reason: "no seam: ctx.session.synthetic missing" });
+                    return;
+                }
+                try {
+                    await synthetic.call(ctx.session, { sessionID: req.sessionID, text, description: "Team retry", resume: true });
+                    report.pluginRetries++;
+                    emit({ event: "plugin_retry_admitted", session: req.sessionID, attempt: req.attempt, delay_ms: req.delayMs, kind: req.kind });
+                }
+                catch (err) {
+                    emit({ event: "plugin_retry_failed", session: req.sessionID, attempt: req.attempt, reason: String(err?.message ?? err).slice(0, 140) });
+                }
+            })();
+        }, req.delayMs);
+        pendingRedrive.set(req.sessionID, handle);
+        emit({ event: "plugin_retry_scheduled", session: req.sessionID, attempt: req.attempt, delay_ms: req.delayMs, kind: req.kind, hard_quota: req.hardQuota });
+    };
+    const cancelRedrive = (sessionID) => {
+        const sid = typeof sessionID === "string" && sessionID.trim() ? sessionID.trim() : "";
+        if (!sid)
+            return;
+        const h = pendingRedrive.get(sid);
+        if (h === undefined)
+            return;
+        timers.clear(h);
+        pendingRedrive.delete(sid);
+        emit({ event: "plugin_retry_cancelled", session: sid });
+    };
+    input.bindRedrive?.(scheduleRedrive);
+    registrations.push({
+        dispose: async () => {
+            for (const h of pendingRedrive.values()) {
+                try {
+                    timers.clear(h);
+                }
+                catch {
+                    /* a timer that will not clear is already gone */
+                }
+            }
+            pendingRedrive.clear();
+        },
+    });
     const session = ctx.session;
     if (session && typeof session.hook === "function") {
         registrations.push(await session.hook("context", (event) => {
             try {
                 if (scope && scope.count(scope.decide(event)) !== "ours")
                     return;
-                scope?.learn(event?.agent, event.sessionID);
+                const sid = typeof event.sessionID === "string" ? String(event.sessionID) : "";
+                scope?.learn(event?.agent, sid);
+                // The session is assembling a request on its own (host retry, or the model
+                // re-issued): stand the scheduled re-drive down — the revival happened.
+                cancelRedrive(sid);
                 if (!Array.isArray(event?.system))
                     return;
-                const d = governor.takeDirective();
+                // Per-session delivery: a child's wait directive must never ride the
+                // lead's request (and vice versa) — the two chains are independent.
+                const d = governor.takeDirective(sid);
                 if (!d)
                     return;
                 event.system.push({ type: "text", text: d.text });
                 report.directivesInjected++;
                 try {
-                    input.onEvent?.({ event: "injected", delay_ms: d.delayMs });
+                    input.onEvent?.({ event: "injected", delay_ms: d.delayMs, session: sid });
                 }
                 catch {
                     /* the trajectory line is an extra */
@@ -352,16 +670,17 @@ export async function applyV2RetryGovernor(ctx, input) {
                     report.foreignSkipped++;
                     return;
                 }
-                if (!governor.inCooldown())
+                const sid = typeof event.sessionID === "string" ? String(event.sessionID) : "";
+                if (!governor.inCooldown(sid))
                     return;
                 report.cooldownDenied++;
                 try {
-                    input.onEvent?.({ event: "denied", remaining_ms: governor.cooldownRemainingMs() });
+                    input.onEvent?.({ event: "denied", remaining_ms: governor.cooldownRemainingMs(sid), session: sid });
                 }
                 catch {
                     /* the trajectory line is an extra */
                 }
-                const secs = Math.max(1, Math.round(governor.cooldownRemainingMs() / 1000));
+                const secs = Math.max(1, Math.round(governor.cooldownRemainingMs(sid) / 1000));
                 const message = `配额保护：上游配额/限流已连续打回请求，冷却中（剩余约 ${secs} 秒）。期间不派发新的子代理——子代理的模型请求会继续被打回，需要完成的工作请主代理自己执行，或等冷却结束/提升配额。这是配额保护，不是故障；可用 retry: "off" 关闭。`;
                 // Only ever stricter: a host that already denied keeps its decision.
                 if (rank.deny <= rank[event.effect ?? "allow"])
@@ -374,6 +693,6 @@ export async function applyV2RetryGovernor(ctx, input) {
             }
         }));
     }
-    return { registrations, report };
+    return { registrations, report, cancelRedrive };
 }
 //# sourceMappingURL=v2-retry.js.map