gsd-pi 2.76.0 → 2.77.0-dev.2daa994b6

package/packages/pi-coding-agent/src/core/model-registry.ts

@@ -29,7 +29,7 @@ import { getAgentDir } from "../config.js";
 import type { AuthStorage } from "./auth-storage.js";
 import { ModelDiscoveryCache } from "./discovery-cache.js";
 import type { DiscoveredModel, DiscoveryResult } from "./model-discovery.js";
-import { getDefaultTTL, getDiscoverableProviders, getDiscoveryAdapter } from "./model-discovery.js";
+import { getDefaultTTL, getDiscoverableProviders, getDiscoveryAdapter, supportsDiscoveryForApi } from "./model-discovery.js";
 import { clearConfigValueCache, resolveConfigValue, resolveHeaders } from "./resolve-config-value.js";
 import { isLocalModel } from "./local-model-check.js";
 
@@ -48,6 +48,14 @@ const VercelGatewayRoutingSchema = Type.Object({
 	order: Type.Optional(Type.Array(Type.String())),
 });
 
+// Schema for model capability declarations (mirrors ModelCapabilities in pi-ai types)
+const ModelCapabilitiesSchema = Type.Object({
+	supportsXhigh: Type.Optional(Type.Boolean()),
+	requiresToolCallId: Type.Optional(Type.Boolean()),
+	supportsServiceTier: Type.Optional(Type.Boolean()),
+	charsPerToken: Type.Optional(Type.Number()),
+});
+
 // Schema for OpenAI compatibility settings
 const OpenAICompletionsCompatSchema = Type.Object({
 	supportsStore: Type.Optional(Type.Boolean()),
@@ -91,6 +99,7 @@ const ModelDefinitionSchema = Type.Object({
 	maxTokens: Type.Optional(Type.Number()),
 	headers: Type.Optional(Type.Record(Type.String(), Type.String())),
 	compat: Type.Optional(OpenAICompatSchema),
+	capabilities: Type.Optional(ModelCapabilitiesSchema),
 });
 
 // Schema for per-model overrides (all fields optional, merged with built-in model)
@@ -110,6 +119,7 @@ const ModelOverrideSchema = Type.Object({
 	maxTokens: Type.Optional(Type.Number()),
 	headers: Type.Optional(Type.Record(Type.String(), Type.String())),
 	compat: Type.Optional(OpenAICompatSchema),
+	capabilities: Type.Optional(ModelCapabilitiesSchema),
 });
 
 type ModelOverride = Static<typeof ModelOverrideSchema>;
@@ -219,6 +229,11 @@ function applyModelOverride(model: Model<Api>, override: ModelOverride): Model<A
 	// Deep merge compat
 	result.compat = mergeCompat(model.compat, override.compat);
 
+	// Merge capabilities (override wins per-field)
+	if (override.capabilities) {
+		result.capabilities = { ...model.capabilities, ...override.capabilities };
+	}
+
 	return result;
 }
 
@@ -514,6 +529,7 @@ export class ModelRegistry {
 					maxTokens: modelDef.maxTokens ?? 16384,
 					headers,
 					compat: modelDef.compat,
+					capabilities: modelDef.capabilities,
 				} as Model<Api>);
 			}
 		}
@@ -788,11 +804,12 @@ export class ModelRegistry {
 	 * Results are cached and merged into the registry (never overrides existing models).
 	 */
 	async discoverModels(providers?: string[]): Promise<DiscoveryResult[]> {
-		const targetProviders = providers ?? getDiscoverableProviders();
+		const targetProviders = providers ?? this.getAutoDiscoverableProviders();
 		const results: DiscoveryResult[] = [];
 
 		for (const providerName of targetProviders) {
-			const adapter = getDiscoveryAdapter(providerName);
+			const providerApis = this.getProviderApis(providerName);
+			const adapter = getDiscoveryAdapter(providerName, providerApis);
 			if (!adapter.supportsDiscovery) continue;
 
 			// Skip if cache is still fresh
@@ -812,8 +829,10 @@ export class ModelRegistry {
 				const apiKey = await this.authStorage.getApiKey(providerName);
 				if (!apiKey && !this.isProviderRequestReady(providerName)) continue;
 
-				const models = await adapter.fetchModels(apiKey ?? "", undefined);
-				this.discoveryCache.set(providerName, models);
+				const baseUrl = this.getProviderBaseUrl(providerName);
+				const models = await adapter.fetchModels(apiKey ?? "", baseUrl);
+				const ttlMs = this.getDiscoveryTtl(providerName, providerApis);
+				this.discoveryCache.set(providerName, models, ttlMs);
 				results.push({
 					provider: providerName,
 					models,
@@ -865,24 +884,97 @@ export class ModelRegistry {
 		const converted: Model<Api>[] = [];
 		for (const result of results) {
 			if (result.error) continue;
+			const providerDefaults = this.getDiscoveryProviderDefaults(result.provider);
 			for (const dm of result.models) {
 				converted.push({
 					id: dm.id,
 					name: dm.name ?? dm.id,
-					api: "openai" as Api,
+					api: providerDefaults.api,
 					provider: result.provider,
-					baseUrl: "",
+					baseUrl: providerDefaults.baseUrl,
 					reasoning: dm.reasoning ?? false,
-					input: dm.input ?? ["text"],
+					input: dm.input ?? providerDefaults.input,
 					cost: dm.cost ?? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-					contextWindow: dm.contextWindow ?? 128000,
-					maxTokens: dm.maxTokens ?? 16384,
+					contextWindow: dm.contextWindow ?? providerDefaults.contextWindow,
+					maxTokens: dm.maxTokens ?? providerDefaults.maxTokens,
 				} as Model<Api>);
 			}
 		}
 		return converted;
 	}
 
+	private getProviderApis(provider: string): Set<string> {
+		const apis = new Set<string>();
+		for (const model of this.models) {
+			if (model.provider === provider && typeof model.api === "string" && model.api.length > 0) {
+				apis.add(model.api);
+			}
+		}
+
+		const providerConfig = this.registeredProviders.get(provider);
+		if (providerConfig?.api) apis.add(providerConfig.api);
+		for (const modelDef of providerConfig?.models ?? []) {
+			if (modelDef.api) apis.add(modelDef.api);
+		}
+		return apis;
+	}
+
+	private getAutoDiscoverableProviders(): string[] {
+		const discoverable = new Set<string>(getDiscoverableProviders());
+		for (const provider of new Set(this.models.map((m) => m.provider))) {
+			const apis = this.getProviderApis(provider);
+			for (const api of apis) {
+				if (supportsDiscoveryForApi(api)) {
+					discoverable.add(provider);
+					break;
+				}
+			}
+		}
+		return [...discoverable];
+	}
+
+	private getProviderBaseUrl(provider: string): string | undefined {
+		const fromModels = this.models.find((m) => m.provider === provider && typeof m.baseUrl === "string" && m.baseUrl.length > 0);
+		if (fromModels?.baseUrl) return fromModels.baseUrl;
+		return this.registeredProviders.get(provider)?.baseUrl;
+	}
+
+	private getDiscoveryProviderDefaults(provider: string): {
+		api: Api;
+		baseUrl: string;
+		input: ("text" | "image")[];
+		contextWindow: number;
+		maxTokens: number;
+	} {
+		const first = this.models.find((m) => m.provider === provider);
+		if (first) {
+			return {
+				api: first.api,
+				baseUrl: first.baseUrl,
+				input: first.input,
+				contextWindow: first.contextWindow,
+				maxTokens: first.maxTokens,
+			};
+		}
+
+		return {
+			api: "openai-completions",
+			baseUrl: this.registeredProviders.get(provider)?.baseUrl ?? "",
+			input: ["text"],
+			contextWindow: 128000,
+			maxTokens: 16384,
+		};
+	}
+
+	private getDiscoveryTtl(provider: string, providerApis: Set<string>): number {
+		for (const api of providerApis) {
+			if (supportsDiscoveryForApi(api)) {
+				return getDefaultTTL("openai");
+			}
+		}
+		return getDefaultTTL(provider);
+	}
+
 	/**
 	 * Check if a model's baseUrl points to a local endpoint.
 	 * Delegates to standalone isLocalModel() function.

package/packages/pi-coding-agent/src/core/redact-secrets.test.ts

@@ -0,0 +1,86 @@
+// pi-coding-agent — unit tests for session-log secret redaction
+
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+
+import { redactSecrets } from "./redact-secrets.js";
+
+describe("redactSecrets", () => {
+	it("is a no-op on plain text with no secret markers", () => {
+		const input = "Hello world — this is just some prose with numbers 12345 and dashes - - -.";
+		assert.equal(redactSecrets(input), input);
+	});
+
+	it("redacts Anthropic keys before generic openai sk- pattern", () => {
+		const out = redactSecrets("key=sk-ant-api03-abcDEF1234567890abcDEF1234567890");
+		assert.equal(out, "key=[REDACTED:anthropic]");
+	});
+
+	it("redacts legacy OpenAI sk- keys", () => {
+		const out = redactSecrets("OPENAI_API_KEY=sk-abcDEF1234567890abcDEF12");
+		assert.equal(out, "OPENAI_API_KEY=[REDACTED:openai]");
+	});
+
+	it("redacts OpenAI project sk-proj- keys with hyphens/underscores in body", () => {
+		const out = redactSecrets("OPENAI_API_KEY=sk-proj-AbCd_1234-EfGh_5678-IjKl_9012");
+		assert.equal(out, "OPENAI_API_KEY=[REDACTED:openai]");
+	});
+
+	it("redacts OpenAI admin sk-admin- keys", () => {
+		const out = redactSecrets("OPENAI_ADMIN_KEY=sk-admin-AbCd1234EfGh5678IjKl9012");
+		assert.equal(out, "OPENAI_ADMIN_KEY=[REDACTED:openai]");
+	});
+
+	it("redacts LlamaCloud llx- keys", () => {
+		const out = redactSecrets("LLAMA_CLOUD_API_KEY=llx-abcDEF1234567890abcDEF1234567890");
+		assert.equal(out, "LLAMA_CLOUD_API_KEY=[REDACTED:llamacloud]");
+	});
+
+	it("redacts AWS access key ids", () => {
+		const out = redactSecrets("aws_access_key_id = AKIAIOSFODNN7EXAMPLE");
+		assert.equal(out, "aws_access_key_id = [REDACTED:aws-access-key]");
+	});
+
+	it("redacts GitHub personal/oauth/app/server/refresh tokens", () => {
+		const out = redactSecrets("token=ghp_abcdefghijklmnopqrstuvwxyz0123456789");
+		assert.equal(out, "token=[REDACTED:github-token]");
+	});
+
+	it("redacts Slack tokens", () => {
+		const out = redactSecrets("slack=xoxb-1234567890-abcdefghij");
+		assert.equal(out, "slack=[REDACTED:slack-token]");
+	});
+
+	it("redacts Google API keys", () => {
+		// Google API keys are exactly AIza + 35 chars (39 total).
+		const out = redactSecrets("key=AIzaSyA-1234567890abcdefghijklmnopqrstu");
+		assert.equal(out, "key=[REDACTED:google-api-key]");
+	});
+
+	it("redacts PEM private key blocks across newlines", () => {
+		const pem = [
+			"-----BEGIN RSA PRIVATE KEY-----",
+			"MIIEowIBAAKCAQEAabcDEF...",
+			"morekeymaterial==",
+			"-----END RSA PRIVATE KEY-----",
+		].join("\n");
+		const out = redactSecrets(`before\n${pem}\nafter`);
+		assert.equal(out, "before\n[REDACTED:pem-private-key]\nafter");
+	});
+
+	it("redacts multiple secrets in the same string", () => {
+		const out = redactSecrets(
+			"AZURE_CLIENT_SECRET: also llx-abcDEF1234567890abcDEF1234567890 and AKIAIOSFODNN7EXAMPLE",
+		);
+		assert.equal(
+			out,
+			"AZURE_CLIENT_SECRET: also [REDACTED:llamacloud] and [REDACTED:aws-access-key]",
+		);
+	});
+
+	it("does not redact short strings that merely contain sk- prose", () => {
+		// "sk-foo" is too short to match the openai pattern — must be 20+ chars.
+		const input = "the sk- prefix isn't always a secret";
+		assert.equal(redactSecrets(input), input);
+	});
+});

package/packages/pi-coding-agent/src/core/redact-secrets.ts

@@ -0,0 +1,58 @@
+// pi-coding-agent — secret redaction for session log persistence
+//
+// Called by prepareForPersistence() in session-manager.ts on every string
+// before it lands in the JSONL transcript. Replaces well-known secret shapes
+// with [REDACTED:<kind>] placeholders so credentials pasted by the user or
+// read from .env-style files never persist to disk.
+//
+// Pattern selection bias: high-specificity shapes only. Loose patterns
+// (e.g. FOO_SECRET=...) produce too many false positives in docs and code
+// samples and are intentionally excluded.
+
+interface SecretPattern {
+	kind: string;
+	regex: RegExp;
+}
+
+// Order matters: more-specific patterns first (sk-ant- before generic sk-).
+const PATTERNS: readonly SecretPattern[] = [
+	{ kind: "anthropic", regex: /sk-ant-[A-Za-z0-9_-]{20,}/g },
+	{ kind: "llamacloud", regex: /llx-[A-Za-z0-9_-]{20,}/g },
+	// Covers all three official OpenAI key shapes: legacy `sk-…`, project `sk-proj-…`,
+	// and admin `sk-admin-…`. Hyphens and underscores appear inside real project keys
+	// so the remainder class must allow them. `sk-ant-` is matched earlier by the
+	// anthropic pattern and already replaced by the time this runs.
+	{ kind: "openai", regex: /sk-(?:proj-|admin-)?[A-Za-z0-9_-]{20,}/g },
+	{ kind: "aws-access-key", regex: /\b(?:AKIA|ASIA|AROA)[0-9A-Z]{16}\b/g },
+	{ kind: "github-token", regex: /\bgh[pousr]_[A-Za-z0-9]{30,}\b/g },
+	{ kind: "slack-token", regex: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+	{ kind: "google-api-key", regex: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+	{
+		kind: "pem-private-key",
+		regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+	},
+];
+
+export function redactSecrets(input: string): string {
+	// Short-circuit: skip regex work on strings with no plausible secret markers.
+	// Cheap heuristic — if none of these substrings are present, no pattern can match.
+	if (
+		!input.includes("sk-") &&
+		!input.includes("llx-") &&
+		!input.includes("AKIA") &&
+		!input.includes("ASIA") &&
+		!input.includes("AROA") &&
+		!input.includes("gh") &&
+		!input.includes("xox") &&
+		!input.includes("AIza") &&
+		!input.includes("PRIVATE KEY")
+	) {
+		return input;
+	}
+
+	let out = input;
+	for (const { kind, regex } of PATTERNS) {
+		out = out.replace(regex, `[REDACTED:${kind}]`);
+	}
+	return out;
+}

package/packages/pi-coding-agent/src/core/resource-loader-cache-reset.test.ts

@@ -1,42 +1,107 @@
-// GSD-2 — Regression test for #3616: reload() must reset jiti extension loader cache
-// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
+// Regression test for #3616: DefaultResourceLoader.reload() must invalidate
+// the jiti module cache before loading extensions, so that edits to
+// extension source on disk are picked up on the next reload (not served
+// stale from memory).
+//
+// Verified end-to-end behaviourally: we write a .ts extension that
+// registers a tool whose NAME is a module-scope constant, load it,
+// rewrite the source with a new constant value, reload(), and assert
+// the observable tool name reflects the NEW source. Without jiti cache
+// invalidation, the second reload would re-register the stale name.
 
-import test, { describe } from "node:test";
 import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
+import { mkdtempSync, rmSync, utimesSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { afterEach, beforeEach, describe, it } from "node:test";
 
-const source = readFileSync(
-	join(process.cwd(), "packages/pi-coding-agent/src/core/resource-loader.ts"),
-	"utf-8",
-);
+import { DefaultResourceLoader } from "./resource-loader.js";
+import { SettingsManager } from "./settings-manager.js";
+import { resetExtensionLoaderCache } from "./extensions/loader.js";
 
-describe("#3616 — reload() must invalidate jiti module cache", () => {
-	test("resource-loader imports resetExtensionLoaderCache from loader.js", () => {
-		assert.ok(
-			source.includes("resetExtensionLoaderCache"),
-			"resource-loader.ts should import resetExtensionLoaderCache",
-		);
-		assert.ok(
-			source.includes('from "./extensions/loader.js"'),
-			"resetExtensionLoaderCache should be imported from extensions/loader.js",
-		);
+let testDir: string;
+
+function writeExtensionWithToolName(extPath: string, toolName: string): void {
+	// Extension factory signature expected by the loader. Uses `any` so the
+	// test stays decoupled from the ExtensionAPI type shape.
+	writeFileSync(
+		extPath,
+		[
+			`const TOOL_NAME = "${toolName}";`,
+			`export default function activate(api: any) {`,
+			`  api.registerTool({`,
+			`    name: TOOL_NAME,`,
+			`    label: TOOL_NAME,`,
+			`    description: "test tool — source-generated name",`,
+			`    parameters: { type: "object", properties: {}, additionalProperties: false },`,
+			`    execute: async () => ({ content: [], details: undefined }),`,
+			`  });`,
+			`}`,
+			"",
+		].join("\n"),
+	);
+}
+
+describe("#3616 — DefaultResourceLoader.reload() invalidates extension module cache", () => {
+	beforeEach(() => {
+		testDir = mkdtempSync(join(tmpdir(), "resource-loader-cache-reset-"));
+		// Ensure a clean jiti singleton — prior tests in this process may
+		// have populated it with unrelated entries.
+		resetExtensionLoaderCache();
+	});
+
+	afterEach(() => {
+		resetExtensionLoaderCache();
+		rmSync(testDir, { recursive: true, force: true });
 	});
 
-	test("reload() calls resetExtensionLoaderCache before loadExtensions", () => {
-		const reloadStart = source.indexOf("async reload(): Promise<void>");
-		assert.ok(reloadStart >= 0, "should find reload() method");
-		const reloadBody = source.slice(reloadStart, reloadStart + 4000);
+	it("reload() picks up source edits after the extension has been loaded once", async () => {
+		const agentDir = join(testDir, "agent-home");
+		const extPath = join(testDir, "reload-probe.ts");
 
-		const resetIdx = reloadBody.indexOf("resetExtensionLoaderCache()");
-		assert.ok(resetIdx >= 0, "reload() should call resetExtensionLoaderCache()");
+		// v1 — initial content
+		writeExtensionWithToolName(extPath, "probe_v1");
 
-		const loadIdx = reloadBody.indexOf("loadExtensions(");
-		assert.ok(loadIdx >= 0, "reload() should call loadExtensions");
+		const loader = new DefaultResourceLoader({
+			cwd: testDir,
+			agentDir,
+			settingsManager: SettingsManager.inMemory(),
+			noExtensions: true,
+			noPromptTemplates: true,
+			noThemes: true,
+			additionalExtensionPaths: [extPath],
+		});
 
+		await loader.reload();
+
+		const toolsV1 = [...loader.getExtensions().extensions.flatMap((e) => [...e.tools.keys()])];
+		assert.ok(
+			toolsV1.includes("probe_v1"),
+			`first reload should register probe_v1; got=${JSON.stringify(toolsV1)}`,
+		);
+
+		// v2 — overwrite the source on disk with a different tool name.
+		writeExtensionWithToolName(extPath, "probe_v2");
+		// Bump mtime explicitly so file-stat–based cache strategies (jiti's
+		// moduleCache consults Node's require.cache, which some runtimes
+		// tiebreak on mtime) always see "newer than last seen". On Windows
+		// NTFS + node the default fs mtime resolution can silently collapse
+		// two writes in the same tick to an identical mtime — that fooled
+		// the Windows CI run on #3616.
+		const futureTime = new Date(Date.now() + 5000);
+		utimesSync(extPath, futureTime, futureTime);
+
+		await loader.reload();
+
+		const toolsV2 = [...loader.getExtensions().extensions.flatMap((e) => [...e.tools.keys()])];
+		assert.ok(
+			toolsV2.includes("probe_v2"),
+			`second reload must observe the edited source (probe_v2) — if reload() ` +
+				`fails to reset the jiti cache, the stale module returns probe_v1. got=${JSON.stringify(toolsV2)}`,
+		);
 		assert.ok(
-			resetIdx < loadIdx,
-			"resetExtensionLoaderCache() must be called BEFORE loadExtensions to ensure fresh modules",
+			!toolsV2.includes("probe_v1"),
+			`second reload must NOT still expose the stale probe_v1 name; got=${JSON.stringify(toolsV2)}`,
 		);
 	});
 });

package/packages/pi-coding-agent/src/core/resource-loader.ts

@@ -242,7 +242,7 @@ export class DefaultResourceLoader implements ResourceLoader {
 		this.systemPromptOverride = options.systemPromptOverride;
 		this.appendSystemPromptOverride = options.appendSystemPromptOverride;
 
-		this.extensionsResult = { extensions: [], errors: [], runtime: createExtensionRuntime() };
+		this.extensionsResult = { extensions: [], errors: [], warnings: [], runtime: createExtensionRuntime() };
 		this.skills = [];
 		this.skillDiagnostics = [];
 		this.prompts = [];

package/packages/pi-coding-agent/src/core/retry-handler.test.ts

@@ -281,7 +281,11 @@ describe("RetryHandler — long-context entitlement 429 (#2803)", () => {
 			assert.equal(result, true, "retry should be initiated");
 
 			handler.abortRetry();
-			await new Promise((resolve) => setTimeout(resolve, 10));
+			// Yield the microtask queue so any synchronous continuation
+			// scheduled by abortRetry() settles before we assert. This is
+			// deterministic — no magic-sleep dependency (#4798 / #4784).
+			await Promise.resolve();
+			await Promise.resolve();
 
 			assert.equal(continueFn.mock.calls.length, 0, "cancelled retry must not continue after explicit abort");
 			const endEvents = emittedEvents.filter((e) => e.type === "auto_retry_end");

package/packages/pi-coding-agent/src/core/retry-handler.ts

@@ -18,6 +18,7 @@ import type { ModelRegistry } from "./model-registry.js";
 import type { SettingsManager } from "./settings-manager.js";
 import { sleep } from "../utils/sleep.js";
 import type { AgentSessionEvent } from "./agent-session.js";
+import { RETRYABLE_ERROR_RE } from "./retryable-error-regex.js";
 
 /** Dependencies injected from AgentSession into RetryHandler */
 export interface RetryHandlerDeps {
@@ -111,14 +112,7 @@ export class RetryHandler {
 		const contextWindow = this._deps.getModel()?.contextWindow ?? 0;
 		if (isContextOverflow(message, contextWindow)) return false;
 
-		const err = message.errorMessage;
-		// "temporarily backed off" is intentionally excluded: it is an internally-
-		// generated error from getApiKey() when credentials are in a backoff window.
-		// Re-entering the retry handler for that message creates a cascade of empty
-		// error entries in the session file, breaking resume (#3429).
-		return /overloaded|rate.?limit|too many requests|402|429|500|502|503|504|service.?unavailable|server.?error|internal.?error|connection.?error|connection.?refused|other side closed|fetch failed|upstream.?connect|reset before headers|terminated|retry delay|network.?(?:is\s+)?unavailable|credentials.*expired|requires more credits|can only afford|insufficient credits|not enough credits|extra usage is required|(?:out of|no) extra usage|third.party.*draw from extra|third.party.*not.*available/i.test(
-			err,
-		);
+		return RETRYABLE_ERROR_RE.test(message.errorMessage);
 	}
 
 	/**

package/packages/pi-coding-agent/src/core/retryable-error-regex.ts

@@ -0,0 +1,18 @@
+/**
+ * Regex matching retryable provider errors — overloaded, rate limits, transient
+ * server/connection failures, credential-backoff, quota/credit issues.
+ *
+ * Kept in its own zero-import module so tests can consume the live pattern
+ * without pulling in the full RetryHandler dependency graph (Agent /
+ * FallbackResolver / ModelRegistry / @gsd/pi-ai …). The test in
+ * `src/resources/extensions/gsd/tests/provider-errors.test.ts` previously
+ * redefined this regex inline, which meant runtime and test could drift
+ * silently on every edit (see #4837).
+ *
+ * "temporarily backed off" is intentionally excluded: it is an internally-
+ * generated error from getApiKey() when credentials are in a backoff window.
+ * Re-entering the retry handler for that message creates a cascade of empty
+ * error entries in the session file, breaking resume (#3429).
+ */
+export const RETRYABLE_ERROR_RE =
+	/overloaded|rate.?limit|too many requests|402|429|500|502|503|504|service.?unavailable|server.?error|internal.?error|connection.?error|connection.?refused|other side closed|fetch failed|upstream.?connect|reset before headers|terminated|retry delay|network.?(?:is\s+)?unavailable|credentials.*expired|requires more credits|can only afford|insufficient credits|not enough credits|extra usage is required|(?:out of|no) extra usage|third.party.*draw from extra|third.party.*not.*available/i;

package/packages/pi-coding-agent/src/core/sdk.test.ts

@@ -3,7 +3,8 @@
 
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
-import { CredentialCooldownError } from "./sdk.js";
+import { canRestoreSessionModel, CredentialCooldownError } from "./sdk.js";
+import type { Model } from "@gsd/pi-ai";
 
 // ─── CredentialCooldownError ──────────────────────────────────────────────────
 
@@ -87,3 +88,26 @@ describe("CredentialCooldownError", () => {
 		assert.equal(plain.retryAfterMs, 15_000);
 	});
 });
+
+describe("canRestoreSessionModel", () => {
+	const model = {
+		provider: "claude-code",
+		id: "claude-sonnet",
+	} as Model<any>;
+
+	it("allows keyless external providers when the provider is request-ready", () => {
+		const registry = {
+			isProviderRequestReady: (provider: string) => provider === "claude-code",
+		};
+
+		assert.equal(canRestoreSessionModel(registry, model), true);
+	});
+
+	it("blocks restore when the provider is not request-ready", () => {
+		const registry = {
+			isProviderRequestReady: () => false,
+		};
+
+		assert.equal(canRestoreSessionModel(registry, model), false);
+	});
+});

package/packages/pi-coding-agent/src/core/sdk.ts

@@ -31,6 +31,13 @@ export class CredentialCooldownError extends Error {
 		this.retryAfterMs = retryAfterMs;
 	}
 }
+
+export function canRestoreSessionModel(
+	modelRegistry: Pick<ModelRegistry, "isProviderRequestReady">,
+	model: Model<any>,
+): boolean {
+	return modelRegistry.isProviderRequestReady(model.provider);
+}
 import { Agent, type AgentMessage, type ThinkingLevel } from "@gsd/pi-agent-core";
 import type { Message, Model } from "@gsd/pi-ai";
 import { getAgentDir, getDocsPath } from "../config.js";
@@ -262,9 +269,9 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 	// If session has data, try to restore model from it
 	if (!model && hasExistingSession && existingSession.model) {
 		const restoredModel = modelRegistry.find(existingSession.model.provider, existingSession.model.modelId);
-		if (restoredModel && (await modelRegistry.getApiKey(restoredModel))) {
-			model = restoredModel;
-		}
+			if (restoredModel && canRestoreSessionModel(modelRegistry, restoredModel)) {
+				model = restoredModel;
+			}
 		if (!model) {
 			modelFallbackMessage = `Could not restore model ${existingSession.model.provider}/${existingSession.model.modelId}`;
 		}