@wrongstack/core 0.306.3 → 0.306.4

package/dist/execution/index.js

@@ -1,4 +1,5 @@
 // src/core/context.ts
+import { realpathSync } from "node:fs";
 import * as path from "node:path";
 
 // src/types/blocks.ts
@@ -552,12 +553,15 @@ var ConversationState = class {
    * cap determines the starting index for the sum but does not gate it.
    */
   overflowCount(arr) {
-    let drop = Context.MAX_MESSAGES > 0 ? Math.max(0, arr.length - Context.MAX_MESSAGES) : 0;
-    if (Context.MAX_MESSAGE_TOKENS <= 0) return this.protocolSafeDropCount(arr, drop);
+    const contextClass = this.ctx.constructor;
+    const maxMessages = contextClass.MAX_MESSAGES;
+    const maxMessageTokens = contextClass.MAX_MESSAGE_TOKENS;
+    let drop = maxMessages > 0 ? Math.max(0, arr.length - maxMessages) : 0;
+    if (maxMessageTokens <= 0) return this.protocolSafeDropCount(arr, drop);
     let total = 0;
     for (let i = drop; i < arr.length; i++) total += arr[i]?._estTokens ?? 0;
-    if (total <= Context.MAX_MESSAGE_TOKENS) return this.protocolSafeDropCount(arr, drop);
-    while (drop < arr.length - 1 && total > Context.MAX_MESSAGE_TOKENS) {
+    if (total <= maxMessageTokens) return this.protocolSafeDropCount(arr, drop);
+    while (drop < arr.length - 1 && total > maxMessageTokens) {
       total -= arr[drop]?._estTokens ?? 0;
       drop++;
     }
@@ -1380,6 +1384,19 @@ var Context = class _Context {
       if (rel.startsWith("..") || path.isAbsolute(rel)) {
         throw new Error(`Working directory "${resolved}" is outside project root "${root}"`);
       }
+      let realTarget = resolved;
+      let realRoot = root;
+      try {
+        realTarget = realpathSync.native(resolved);
+        realRoot = realpathSync.native(root);
+      } catch {
+      }
+      const realRel = path.relative(realRoot, realTarget);
+      if (realRel.startsWith("..") || path.isAbsolute(realRel)) {
+        throw new Error(
+          `Working directory "${resolved}" resolves to "${realTarget}", outside project root "${realRoot}"`
+        );
+      }
     }
     const old = this.workingDir;
     this.workingDir = resolved;
@@ -2752,6 +2769,12 @@ function findExchangeStart(messages, userIndex) {
 
 // src/execution/auto-compaction-middleware.ts
 var LEVEL_RANK = { warn: 0, soft: 1, hard: 2 };
+function pressureLevelFor(load, thresholds) {
+  if (load >= thresholds.hard) return "hard";
+  if (load >= thresholds.soft) return "soft";
+  if (load >= thresholds.warn) return "warn";
+  return null;
+}
 var MAX_DIGEST_LOG_CHARS = 4e3;
 function truncateDigest(digest) {
   if (digest.length <= MAX_DIGEST_LOG_CHARS) return digest;
@@ -2797,8 +2820,19 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
    * 1 / 2.5 = 0.4.
    */
   static GUARD_GATE_LOAD = 0.4;
+  /**
+   * How much the context must grow between two history-rewriting hygiene
+   * passes, as a fraction of the available input window and as an absolute
+   * floor. Every pass rewrites already-transmitted messages, which forces the
+   * provider to re-cache the whole prompt; spacing the passes out is what lets
+   * the conversation prefix stay cached for the turns in between.
+   */
+  static HYGIENE_GROWTH_RATIO = 0.15;
+  static HYGIENE_MIN_GROWTH_TOKENS = 2e4;
   /** Tracks the most recent no-op attempt so we can avoid re-firing per turn. */
   lastNoopAttempt = null;
+  /** Context size at the last hygiene pass; anchors the growth interval. */
+  lastHygieneTokens = null;
   /**
    * Cached token estimate from the last handler() invocation. When the
    * message count and tool count haven't changed since the last estimate
@@ -2858,55 +2892,9 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
   handler() {
     return async (ctx, next) => {
       if (!this._enabled) return next(ctx);
-      const rawHygiene = eliseAcknowledgedToolResults(ctx.messages, {
-        maxRetainedTokens: this.resolveToolResultRetention(ctx)
-      });
-      const receiptHygiene = collapseAcknowledgedToolReceipts(rawHygiene.messages, {
-        maxPairs: this.resolveToolReceiptRetention(ctx)
-      });
-      if (rawHygiene.changed || receiptHygiene.changed) {
-        ctx.state.replaceMessages(receiptHygiene.messages);
-        ctx.clearFileTracking();
-        this.invalidateTokenCaches(ctx);
-      }
-      const msgCount = ctx.messages.length;
-      const toolCount = (ctx.tools ?? []).length;
-      const revision = ctx.state?.revision ?? -1;
-      let tokens;
-      const anchorAt = typeof ctx.meta?.["realAnchorMsgCount"] === "number" ? ctx.meta["realAnchorMsgCount"] : void 0;
-      const anchored = realAnchoredInputTokens(ctx.messages, ctx.lastRealInputTokens, anchorAt);
-      if (anchored !== null) {
-        tokens = anchored;
-      } else if (this._estimator) {
-        tokens = this._estimator(ctx);
-      } else if (msgCount === this._cachedMsgCount && toolCount === this._cachedToolCount && revision === this._cachedRevision && ctx.systemPrompt === this._cachedSystemRef && ctx.tools === this._cachedToolsRef && this._cachedTokens >= 0) {
-        tokens = this._cachedTokens;
-      } else if (this.tryStashedTokens(ctx, msgCount, toolCount, revision) !== null) {
-        const stashed = this.tryStashedTokens(ctx, msgCount, toolCount, revision);
-        const cal = getCalibrationState(`${ctx.provider?.id ?? "unknown"}/${ctx.model}`);
-        tokens = cal.calibrated ? Math.round(stashed * Math.min(1.5, Math.max(0.5, cal.ratio))) : stashed;
-        this._cachedTokens = tokens;
-        this._cachedMsgCount = msgCount;
-        this._cachedToolCount = toolCount;
-        this._cachedRevision = revision;
-        this._cachedSystemRef = ctx.systemPrompt;
-        this._cachedToolsRef = ctx.tools;
-      } else {
-        tokens = estimateRequestTokensCalibrated(
-          ctx.messages,
-          ctx.systemPrompt,
-          ctx.tools ?? [],
-          `${ctx.provider?.id ?? "unknown"}/${ctx.model}`
-        ).total;
-        this._cachedTokens = tokens;
-        this._cachedMsgCount = msgCount;
-        this._cachedToolCount = toolCount;
-        this._cachedRevision = revision;
-        this._cachedSystemRef = ctx.systemPrompt;
-        this._cachedToolsRef = ctx.tools;
-      }
+      let tokens = this.estimateContextTokens(ctx);
       const runtimeMaxContext = effectiveMaxContext(ctx, this._maxContext);
-      const budget = computeContextWindowBudget(ctx, tokens, runtimeMaxContext);
+      let budget = computeContextWindowBudget(ctx, tokens, runtimeMaxContext);
       const calibratedLoad = budget.load;
       const policy = this.policyProvider?.(ctx);
       const thresholds = policy?.thresholds ?? {
@@ -2920,22 +2908,27 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
       });
       const aggressiveOn = policy?.aggressiveOn ?? this.aggressiveOn;
       const targetLoad = normalizeTargetLoad(policy?.targetLoad, adaptiveThresholds);
-      let load = calibratedLoad;
-      if (calibratedLoad >= _AutoCompactionMiddleware.GUARD_GATE_LOAD) {
-        const guardTotal = estimateRequestTokensUpperBound(
-          ctx.messages,
-          ctx.systemPrompt,
-          ctx.tools ?? [],
-          `${ctx.provider?.id ?? "unknown"}/${ctx.model}`
-        ).total;
-        const guardLoad = guardTotal / budget.availableInputTokens;
-        if (guardLoad > load) load = guardLoad;
-      }
-      const level = load >= adaptiveThresholds.hard ? "hard" : load >= adaptiveThresholds.soft ? "soft" : load >= adaptiveThresholds.warn ? "warn" : null;
+      let load = this.applySendGuard(ctx, calibratedLoad, budget.availableInputTokens);
+      let level = pressureLevelFor(load, adaptiveThresholds);
       if (!level) {
         this.lastNoopAttempt = null;
         return next(ctx);
       }
+      if (this.shouldRunHygiene(level, tokens, budget.availableInputTokens)) {
+        const changed = this.runHistoryHygiene(ctx);
+        tokens = changed ? this.estimateContextTokens(ctx) : tokens;
+        this.lastHygieneTokens = tokens;
+        if (changed) {
+          budget = computeContextWindowBudget(ctx, tokens, runtimeMaxContext);
+          load = this.applySendGuard(ctx, budget.load, budget.availableInputTokens);
+          const relevelled = pressureLevelFor(load, adaptiveThresholds);
+          if (!relevelled) {
+            this.lastNoopAttempt = null;
+            return next(ctx);
+          }
+          level = relevelled;
+        }
+      }
       if (this.shouldSkipNoopRetry(level, tokens)) {
         return next(ctx);
       }
@@ -2952,6 +2945,123 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
       return next(ctx);
     };
   }
+  /**
+   * Full-request token total for the current context.
+   *
+   * Reuses the last estimate when the context hasn't grown since the previous
+   * check — common in autonomous idle loops. The cached value is invalidated
+   * whenever messages or tools change.
+   *
+   * IMPORTANT: the cache is only valid for the deterministic
+   * `estimateRequestTokensCalibrated` path (messages+system+tools → fixed
+   * output). When a custom `_estimator` is provided (e.g. in tests with a
+   * mutable closure, or a dynamic policy provider), always call it fresh — the
+   * estimator owns its own semantics and the middleware cannot safely cache its
+   * result across calls.
+   */
+  estimateContextTokens(ctx) {
+    const msgCount = ctx.messages.length;
+    const toolCount = (ctx.tools ?? []).length;
+    const revision = ctx.state?.revision ?? -1;
+    const anchorAt = typeof ctx.meta?.["realAnchorMsgCount"] === "number" ? ctx.meta["realAnchorMsgCount"] : void 0;
+    const anchored = realAnchoredInputTokens(ctx.messages, ctx.lastRealInputTokens, anchorAt);
+    if (anchored !== null) return anchored;
+    if (this._estimator) return this._estimator(ctx);
+    if (msgCount === this._cachedMsgCount && toolCount === this._cachedToolCount && revision === this._cachedRevision && ctx.systemPrompt === this._cachedSystemRef && ctx.tools === this._cachedToolsRef && this._cachedTokens >= 0) {
+      return this._cachedTokens;
+    }
+    const stashed = this.tryStashedTokens(ctx, msgCount, toolCount, revision);
+    let tokens;
+    if (stashed !== null) {
+      const cal = getCalibrationState(`${ctx.provider?.id ?? "unknown"}/${ctx.model}`);
+      tokens = cal.calibrated ? Math.round(stashed * Math.min(1.5, Math.max(0.5, cal.ratio))) : stashed;
+    } else {
+      tokens = estimateRequestTokensCalibrated(
+        ctx.messages,
+        ctx.systemPrompt,
+        ctx.tools ?? [],
+        `${ctx.provider?.id ?? "unknown"}/${ctx.model}`
+      ).total;
+    }
+    this._cachedTokens = tokens;
+    this._cachedMsgCount = msgCount;
+    this._cachedToolCount = toolCount;
+    this._cachedRevision = revision;
+    this._cachedSystemRef = ctx.systemPrompt;
+    this._cachedToolsRef = ctx.tools;
+    return tokens;
+  }
+  /**
+   * Never-undercount send guard.
+   *
+   * The calibrated estimate can under-count dense content (CJK, base64,
+   * minified) by >1.5×, which would let an over-limit request slip past the
+   * thresholds and reach the provider. Once the calibrated load is high enough
+   * that even the max density factor (2.5×) *could* overflow (load ≥ 1/2.5 =
+   * 0.4), re-check with the upper-bound estimator and escalate to whichever
+   * load is larger. Below 0.4 an overflow is arithmetically impossible, so the
+   * extra scan is skipped.
+   */
+  applySendGuard(ctx, calibratedLoad, availableInputTokens) {
+    if (calibratedLoad < _AutoCompactionMiddleware.GUARD_GATE_LOAD) return calibratedLoad;
+    const guardTotal = estimateRequestTokensUpperBound(
+      ctx.messages,
+      ctx.systemPrompt,
+      ctx.tools ?? [],
+      `${ctx.provider?.id ?? "unknown"}/${ctx.model}`
+    ).total;
+    const guardLoad = guardTotal / availableInputTokens;
+    return guardLoad > calibratedLoad ? guardLoad : calibratedLoad;
+  }
+  /**
+   * Rewrite acknowledged tool protocol in place.
+   *
+   * Tool results are protocol inputs for the immediately following model
+   * response, not unlimited durable prompt memory. Once a later assistant
+   * message proves the provider consumed them, keep a mode-sized raw window and
+   * replace the rest with semantic head/tail receipts, then fold fully-aged
+   * pairs into the history digest.
+   *
+   * Every one of those edits touches a message the provider has already seen,
+   * so each call costs a full prompt re-cache — it belongs behind
+   * {@link shouldRunHygiene}, never on the per-turn path. Content staleness is
+   * not a reason to bypass that gate: the edit/replace tools guard against
+   * acting on an out-of-date read with their own mtime + sha-256 check.
+   *
+   * @returns whether the conversation was rewritten.
+   */
+  runHistoryHygiene(ctx) {
+    const raw = eliseAcknowledgedToolResults(ctx.messages, {
+      maxRetainedTokens: this.resolveToolResultRetention(ctx)
+    });
+    const receipts = collapseAcknowledgedToolReceipts(raw.messages, {
+      maxPairs: this.resolveToolReceiptRetention(ctx)
+    });
+    if (!raw.changed && !receipts.changed) return false;
+    ctx.state.replaceMessages(receipts.messages);
+    ctx.clearFileTracking();
+    this.invalidateTokenCaches(ctx);
+    return true;
+  }
+  /**
+   * Whether the history-rewriting hygiene pass may run this turn.
+   *
+   * Hard pressure always runs it — staying under the window outranks caching.
+   * Otherwise it runs at most once per growth interval, so the conversation
+   * stays append-only (and therefore cacheable by the provider) in between.
+   */
+  shouldRunHygiene(level, tokens, availableInputTokens) {
+    if (level === "hard") return true;
+    const last = this.lastHygieneTokens;
+    if (last === null) return true;
+    const anchor = Math.min(last, tokens);
+    this.lastHygieneTokens = anchor;
+    const interval = Math.max(
+      _AutoCompactionMiddleware.HYGIENE_MIN_GROWTH_TOKENS,
+      Math.floor(availableInputTokens * _AutoCompactionMiddleware.HYGIENE_GROWTH_RATIO)
+    );
+    return tokens - anchor >= interval;
+  }
   /**
    * H1: try to read a pre-computed token total from `ctx.lastRequestTokens`
    * (set by the agent loop's pre-flight or its restash in emitContextPct).
@@ -4964,6 +5074,12 @@ function normalizeModelRef(ref, defaultProvider) {
 function hasText(value) {
   return typeof value === "string" && value.trim().length > 0;
 }
+function asRefList(value) {
+  return Array.isArray(value) ? value : void 0;
+}
+function asProfileName(value) {
+  return hasText(value) ? value : void 0;
+}
 function providerHasKey(entry) {
   if (!entry) return false;
   if (hasText(entry.apiKey)) return true;
@@ -4974,7 +5090,7 @@ function providerHasKey(entry) {
 }
 function visibleProviderModels(config, providerId, providerModels) {
   const entry = config.providers?.[providerId];
-  return entry?.models !== void 0 ? [...entry.models] : providerModels;
+  return Array.isArray(entry?.models) ? [...entry.models] : providerModels;
 }
 function buildProfiles(config) {
   const entries = /* @__PURE__ */ new Map();
@@ -5011,13 +5127,34 @@ var FallbackProfileManager = class {
   listProfiles() {
     return Object.freeze([...this.profiles.keys()]);
   }
+  /**
+   * The profile the session has selected (`config.fallbackProfile`, set by
+   * `/fallback profile use <name>`), or undefined when none is selected or the
+   * name no longer resolves to a defined profile.
+   *
+   * Consulted by every resolution entry point when the caller does not name a
+   * profile itself. Without this the leader — which passes no profile — could
+   * never use a named profile at all: `config.fallbackProfiles` was reachable
+   * only by copying a chain into `fallbackModels`.
+   */
+  activeProfileName() {
+    const name = asProfileName(this.config.fallbackProfile);
+    return name && this.profiles.has(name) ? name : void 0;
+  }
   // ── Resolution ─────────────────────────────────────────────────────────
   /**
    * Resolve a named fallback profile to a validated, provider-filtered chain.
    *
-   * Returns an empty chain when:
-   * - The profile doesn't exist.
-   * - Every entry's provider is missing, has no key, or has no matching model.
+   * Returns an empty chain when the profile doesn't exist, or when every entry
+   * is excluded, quarantined, or blacked out.
+   *
+   * Filtering is intentionally identical to {@link resolveRefs} (the explicit
+   * `fallbackModels` path): the self-exclusion, the runtime status tracker,
+   * and the availability calendar — nothing else. Anything a named profile
+   * drops, an explicit chain drops too, and vice versa. Profiles used to apply
+   * two extra filters (provider "usability" and the `providers[].models`
+   * snapshot) that the explicit path did not, which silently rerouted roles
+   * pinned to a profile onto a different model than the one configured.
    *
    * @param name - Profile name from config.fallbackProfiles.
    * @param defaultProvider - Used when an entry has no explicit provider.
@@ -5038,13 +5175,9 @@ var FallbackProfileManager = class {
       if (seen.has(key)) continue;
       seen.add(key);
       if (excludeKey && key === excludeKey) continue;
-      const health = this.checkProvider(providerId);
-      if (!health.usable) continue;
       if (this.statusTracker && !this.statusTracker.isAvailable(providerId, parsed.model)) continue;
       if (!evaluateModelCalendar(this.config.modelAvailabilitySchedule, providerId, parsed.model).allowed)
         continue;
-      const allowedModels = this.config.providers?.[providerId]?.models;
-      if (allowedModels && !allowedModels.includes(parsed.model)) continue;
       resolved.push({
         providerId,
         model: parsed.model,
@@ -5062,12 +5195,14 @@ var FallbackProfileManager = class {
   resolveEffective(opts = {}) {
     const bridge = this.resolveBridge(opts.exclude);
     let selected = FREEZER_EMPTY;
-    if (opts.fallbackModels && opts.fallbackModels.length > 0) {
-      const resolved = this.resolveRefs(opts.fallbackModels, opts.exclude);
+    const explicitRefs = asRefList(opts.fallbackModels);
+    const profileName = asProfileName(opts.fallbackProfile) ?? this.activeProfileName();
+    if (explicitRefs && explicitRefs.length > 0) {
+      const resolved = this.resolveRefs(explicitRefs, opts.exclude);
       if (resolved.length > 0) selected = resolved;
     }
-    if (selected.length === 0 && opts.fallbackProfile) {
-      const resolved = this.resolve(opts.fallbackProfile, { exclude: opts.exclude });
+    if (selected.length === 0 && profileName) {
+      const resolved = this.resolve(profileName, { exclude: opts.exclude });
       if (resolved.length > 0) selected = resolved;
     }
     if (selected.length === 0 && opts.fallbackAuto !== false) {
@@ -5143,13 +5278,14 @@ var FallbackProfileManager = class {
     };
     const configFallbackAuto = this.config.fallbackAuto;
     const effectiveFallbackAuto = configFallbackAuto !== void 0 && configFallbackAuto !== null ? configFallbackAuto : !opts.closedWorld;
-    const explicitRefs = opts.fallbackModels ?? this.config.fallbackModels;
+    const explicitRefs = asRefList(opts.fallbackModels) ?? asRefList(this.config.fallbackModels);
+    const profileName = asProfileName(opts.fallbackProfile) ?? this.activeProfileName();
     const explicitUsable = explicitRefs !== void 0 && explicitRefs.length > 0 && this.resolveRefs(explicitRefs, current).length > 0;
-    const profileUsable = opts.fallbackProfile !== void 0 && this.hasProfile(opts.fallbackProfile) && this.resolve(opts.fallbackProfile, { exclude: current }).length > 0;
+    const profileUsable = profileName !== void 0 && this.hasProfile(profileName) && this.resolve(profileName, { exclude: current }).length > 0;
     const fromExplicitSource = explicitUsable || profileUsable;
-    const selectedChain = opts.closedWorld ? explicitRefs && explicitRefs.length > 0 ? this.resolveRefs(explicitRefs, current) : opts.fallbackProfile ? this.resolve(opts.fallbackProfile, { exclude: current }) : FREEZER_EMPTY : this.resolveEffective({
+    const selectedChain = opts.closedWorld ? explicitRefs && explicitRefs.length > 0 ? this.resolveRefs(explicitRefs, current) : profileName ? this.resolve(profileName, { exclude: current }) : FREEZER_EMPTY : this.resolveEffective({
       fallbackModels: explicitRefs,
-      fallbackProfile: opts.fallbackProfile,
+      fallbackProfile: profileName,
       fallbackAuto: effectiveFallbackAuto,
       exclude: current
     });
@@ -5166,7 +5302,7 @@ var FallbackProfileManager = class {
         });
       }
       candidates.push(...selectedChain);
-      if (!fromExplicitSource && effectiveFallbackAuto && opts.fallbackProfile !== "default") {
+      if (!fromExplicitSource && effectiveFallbackAuto && profileName !== "default") {
         candidates.push(...this.resolve("default", { exclude: current }));
       }
       if (!fromExplicitSource && effectiveFallbackAuto) {
@@ -5244,7 +5380,7 @@ var FallbackProfileManager = class {
     const leaderModel = this.config.model;
     const providers = this.config.providers ?? {};
     const favoriteSet = new Set(
-      (this.config.favoriteModels ?? []).map((ref) => {
+      (asRefList(this.config.favoriteModels) ?? []).map((ref) => {
         const p = parseModelRef(ref);
         return `${p.provider ?? leaderProvider}/${p.model}`;
       })
@@ -5324,6 +5460,7 @@ function effectiveFallbackChain(config) {
   const mgr = new FallbackProfileManager(config);
   return mgr.resolveEffective({
     fallbackModels: config.fallbackModels,
+    fallbackProfile: config.fallbackProfile,
     fallbackAuto: config.fallbackAuto
   }).map((e) => `${e.providerId}/${e.model}`);
 }
@@ -19164,26 +19301,29 @@ function escapeRegExp(s) {
 // src/execution/retry-policy.ts
 import { randomInt } from "node:crypto";
 var MAX_RETRY_AFTER_MS = 6e4;
+var MODEL_RETRIES = 3;
 var MAX_ATTEMPTS_BY_KIND = {
-  rate_limit: 5,
+  rate_limit: MODEL_RETRIES,
+  overloaded: MODEL_RETRIES,
+  server: MODEL_RETRIES,
+  timeout: MODEL_RETRIES,
+  network: MODEL_RETRIES,
+  stream_hang: MODEL_RETRIES,
   quota_exhausted: 0,
-  stream_hang: 2,
-  // proxy-level timeout — retrying 5x wastes ~40s before fallback kicks in
-  overloaded: 3,
-  server: 3,
-  timeout: 2,
-  network: 2,
   auth: 0,
   invalid_request: 0,
   context_overflow: 0,
   content_filter: 0,
   unknown: 0
 };
+var FAILOVER_RETRY_AFTER_MS = 15e3;
 var DefaultRetryPolicy = class {
   shouldRetry(err, attempt) {
     const isProviderErr = err instanceof ProviderError || ProviderError.isProviderError(err);
     if (isProviderErr) {
       if (!err.retryable) return false;
+      const hint = retryAfterMsFromError(err);
+      if (hint !== void 0 && hint >= FAILOVER_RETRY_AFTER_MS) return false;
       return attempt < this.maxAttempts(err);
     }
     const msg = err.message ?? "";
@@ -22992,6 +23132,7 @@ export {
   HybridCompactor,
   IntelligentCompactor,
   MAX_COUNCIL_CONCURRENCY,
+  MODEL_RETRIES,
   OneShotOrchestrator,
   ParallelEternalEngine,
   SelectiveCompactor,

package/dist/execution/retry-policy.d.ts

@@ -1,5 +1,32 @@
 import { ProviderError } from '../types/provider.js';
 import type { RetryPolicy } from '../types/retry-policy.js';
+/**
+ * Retries a single model gets before the turn moves on to the next entry in
+ * the fallback chain.
+ *
+ * One number for every recoverable failure kind, on purpose. The per-kind
+ * budgets used to range from 2 (timeout, network, stream_hang) to 5
+ * (rate_limit), which made "how long until we try another model?" depend on
+ * which error came back: a rate-limited model could spend five backoff waits —
+ * each honouring a `Retry-After` up to 60s — before the cross-model fallback
+ * engine, which only engages once in-place retries are exhausted, got its
+ * turn, while a timeout gave up after two. The contract is now uniform and
+ * predictable across every surface that runs the agent loop (leader, host
+ * subagents, Chimera reviewers, SDD workers — they all resolve this one
+ * policy from the container): try the model {@link MODEL_RETRIES} times, then
+ * fail over.
+ *
+ * Exhaustive by construction (`Record<ProviderErrorKind, …>`) — adding a new
+ * kind refuses to compile until it gets an attempt budget.
+ *
+ * Zero means "do not replay this request against this model":
+ * - request-shaped failures (auth / invalid_request / context_overflow /
+ *   content_filter) would fail identically on every attempt;
+ * - `quota_exhausted` is a depleted account or plan, not a transient burst, so
+ *   the route is done until it resets — retrying only delays the hop, and the
+ *   kind IS fallback-worthy, so another provider gets tried immediately.
+ */
+export declare const MODEL_RETRIES = 3;
 export declare class DefaultRetryPolicy implements RetryPolicy {
     shouldRetry(err: Error | ProviderError, attempt: number): boolean;
     maxAttempts(err: Error | ProviderError): number;

package/dist/hq/index.js

@@ -675,6 +675,24 @@ import * as v8 from "node:v8";
 var SESSION_RECIPIENT_PREFIX = "@session:";
 
 // src/security/secret-scrubber.ts
+var JSON_CREDENTIAL_KEY_ANCHORS = [
+  'Key"',
+  'key"',
+  'KEY"',
+  'token"',
+  'Token"',
+  'TOKEN"',
+  'secret"',
+  'Secret"',
+  'SECRET"',
+  'password"',
+  'Password"',
+  'PASSWORD"',
+  'authorization"',
+  'Authorization"',
+  'bearer"',
+  'Bearer"'
+];
 var PATTERNS = [
   // Anchored at the start where possible so partial matches inside larger
   // strings don't trigger false positives.
@@ -777,6 +795,30 @@ var PATTERNS = [
     regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
     anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
   },
+  {
+    type: "json_credential_key",
+    // The JSON counterpart to `high_entropy_env`, and the pattern that the
+    // now-deleted `JSON_KEY_ANCHORS` list was written for. Without it those
+    // anchors only widened the cheap pre-scan — `hasCredentialAnchors` said
+    // "this text may hold a secret", every pattern then declined to match, and
+    // the value went out verbatim. `high_entropy_env` cannot cover these: it
+    // requires an UPPERCASE unquoted key (`API_KEY=…`), so `{"apiKey":"…"}`
+    // never matched.
+    //
+    // Tool results are routinely serialised as JSON, and a credential with no
+    // recognisable prefix (Azure, self-hosted gateways, Anthropic/Codex OAuth)
+    // has no other pattern that can catch it — this is the only thing standing
+    // between such a value and the session JSONL, chronicle, HQ broadcast and
+    // the model's own context.
+    //
+    // The key may carry a prefix (`"anthropicApiKey"`), but the credential word
+    // must END the key: `"tokenCount"` and `"maxTokens"` do not match, because
+    // the closing quote has to follow the word immediately.
+    // Value floor of 8 chars keeps enum-ish values (`"authorization":"none"`)
+    // out. Capture groups: 1=key + punctuation, 2=value, 3=closing quote.
+    regex: /("[A-Za-z0-9_]*(?:apiKey|api_key|token|secret|password|authorization|bearer|private_key|access_token|refresh_token|client_secret)"\s*:\s*")([^"\\]{8,512})(")/gi,
+    anchor: JSON_CREDENTIAL_KEY_ANCHORS
+  },
   // ── Ported from packages/plugins credential-patterns.ts (WS-034) ─────────
   // The plugin runtime carried 37 patterns while this scrubber — the one that
   // guards session JSONL, chronicle, HQ broadcast, WebUI events and the auth
@@ -859,9 +901,12 @@ var PATTERNS = [
     anchor: "GOCSPX-"
   }
 ];
-var SIMPLE_PATTERNS = PATTERNS.filter((p) => p.type !== "high_entropy_env");
+var SIMPLE_PATTERNS = PATTERNS.filter(
+  (p) => p.type !== "high_entropy_env" && p.type !== "json_credential_key"
+);
 var COMBINED_REGEX = new RegExp(SIMPLE_PATTERNS.map((p) => `(${p.regex.source})`).join("|"), "g");
 var HIGH_ENTROPY_REGEX = PATTERNS.find((p) => p.type === "high_entropy_env").regex;
+var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key").regex;
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
@@ -872,20 +917,7 @@ var PATTERN_ANCHORS = [
     )
   )
 ];
-var JSON_KEY_ANCHORS = [
-  '"apiKey"',
-  '"api_key"',
-  '"token"',
-  '"secret"',
-  '"password"',
-  '"authorization"',
-  '"bearer"',
-  '"private_key"',
-  '"access_token"',
-  '"refresh_token"',
-  '"client_secret"'
-];
-var ALL_ANCHORS = [...PATTERN_ANCHORS, ...JSON_KEY_ANCHORS];
+var ALL_ANCHORS = PATTERN_ANCHORS;
 function hasCredentialAnchors(text) {
   for (const anchor of ALL_ANCHORS) {
     if (text.includes(anchor)) return true;
@@ -934,6 +966,9 @@ var DefaultSecretScrubber = class {
     out = out.replace(HIGH_ENTROPY_REGEX, (_match, lead, key, _value) => {
       return `${lead}${key}=[REDACTED:high_entropy_env]`;
     });
+    out = out.replace(JSON_CREDENTIAL_REGEX, (_match, keyPrefix, _value, closingQuote) => {
+      return `${keyPrefix}[REDACTED:json_credential_key]${closingQuote}`;
+    });
     return out;
   }
   /**

package/dist/index.d.ts

@@ -48,7 +48,7 @@ export { Context, type ContextInit, type ProviderMemoryEvidence, type RunOptions
 export { type ContinuationInput, type ContinuationSource, detectContinueIntent, type ResolvedContinuation, resolveContinuation, } from './core/continue-intent.js';
 export { type ContinueDirective, makeContinueToNextIterationTool, parseContinueDirective, } from './core/continue-to-next-iteration.js';
 export { ConversationState, type ReadonlyConversationState, type StateChange, type StateChangeHandler, wrapAsState, } from './core/conversation-state.js';
-export { createFallbackModelExtension, effectiveFallbackChain, type FallbackModelDeps, fallbackProfileChain, formatModelRef, normalizeModelRef, parseModelRef, smartDefaultFallbackChain, } from './core/fallback-model.js';
+export { createFallbackModelExtension, effectiveFallbackChain, type FallbackModelDeps, fallbackProfileChain, formatModelRef, normalizeModelRef, parseModelRef, runtimeFallbackChain, smartDefaultFallbackChain, } from './core/fallback-model.js';
 export type { FallbackChain, FallbackChainEntry, ProviderHealth, } from './core/fallback-profile-manager.js';
 export { FallbackProfileManager } from './core/fallback-profile-manager.js';
 export { InputBuilder, type InputBuilderEvent, type InputBuilderOptions, } from './core/input-builder.js';