infinicode 2.3.4 → 2.3.6

package/dist/kernel/index.d.ts

@@ -22,7 +22,7 @@ export { VerificationEngine } from './verification-engine.js';
 export type { VerificationEngineDeps } from './verification-engine.js';
 export { RecoveryManager } from './recovery-manager.js';
 export type { RecoveryManagerDeps, RecoveryContext } from './recovery-manager.js';
-export { ConsoleLogger, SilentLogger } from './logger.js';
+export { ConsoleLogger, SilentLogger, FileLogger } from './logger.js';
 export { OllamaProvider } from './providers/ollama-provider.js';
 export type { OllamaProviderOptions } from './providers/ollama-provider.js';
 export { OpenAICompatibleProvider } from './providers/openai-compatible-provider.js';
@@ -37,6 +37,8 @@ export type { MissionPlannerDeps, PlanOptions } from './planner.js';
 export { normalizeCapabilities, CANONICAL_CAPABILITIES } from './capability-map.js';
 export { phaseBenchmarkFloor, phaseLabel } from './scheduler.js';
 export * from './federation/index.js';
+export * from './agents/index.js';
+export * from './gateway/index.js';
 export { createMcpServer, serveMcpStdio } from './mcp/index.js';
 export type { McpServerDeps } from './mcp/index.js';
 export { GoalLoop } from './autonomy/index.js';

package/dist/kernel/index.js

@@ -18,7 +18,7 @@ export { PluginManager } from './plugin-manager.js';
 export { PolicyEngine, PolicyPresets, POLICY_FACTORIES } from './policies.js';
 export { VerificationEngine } from './verification-engine.js';
 export { RecoveryManager } from './recovery-manager.js';
-export { ConsoleLogger, SilentLogger } from './logger.js';
+export { ConsoleLogger, SilentLogger, FileLogger } from './logger.js';
 export { OllamaProvider } from './providers/ollama-provider.js';
 export { OpenAICompatibleProvider } from './providers/openai-compatible-provider.js';
 export { GeminiProvider } from './providers/gemini-provider.js';
@@ -29,6 +29,10 @@ export { normalizeCapabilities, CANONICAL_CAPABILITIES } from './capability-map.
 export { phaseBenchmarkFloor, phaseLabel } from './scheduler.js';
 // Federation — neutral device mesh (peers, telemetry, config sync, MOLTFED interop)
 export * from './federation/index.js';
+// Agents — pluggable executors (native kernel + third-party coding CLIs)
+export * from './agents/index.js';
+// Gateway — local OpenAI-compatible endpoint backed by kernel routing/recovery
+export * from './gateway/index.js';
 // MCP — north-facing control surface (spawn/dispatch/role/voice/map over the mesh)
 export { createMcpServer, serveMcpStdio } from './mcp/index.js';
 // Autonomy — proactive unattended goal loop (interval/idle/once triggers)

package/dist/kernel/logger.d.ts

@@ -1,6 +1,3 @@
-/**
- * OpenKernel — Logger
- */
 import type { Logger } from './types.js';
 export declare class ConsoleLogger implements Logger {
     private prefix;
@@ -16,3 +13,19 @@ export declare class SilentLogger implements Logger {
     warn(): void;
     error(): void;
 }
+/**
+ * Appends structured lines to a log file (best-effort — never throws into the
+ * caller). Used to give the kernel gateway a durable trace of routing/swap/
+ * truncation decisions during a TUI session, since its console is owned by the
+ * TUI. Read the file to see exactly why a turn died mid-task.
+ */
+export declare class FileLogger implements Logger {
+    private file;
+    private prefix;
+    constructor(file: string, prefix?: string);
+    private write;
+    debug(message: string, ...args: unknown[]): void;
+    info(message: string, ...args: unknown[]): void;
+    warn(message: string, ...args: unknown[]): void;
+    error(message: string, ...args: unknown[]): void;
+}

package/dist/kernel/logger.js

@@ -1,3 +1,7 @@
+/**
+ * OpenKernel — Logger
+ */
+import { appendFileSync } from 'node:fs';
 export class ConsoleLogger {
     prefix;
     constructor(prefix = 'openkernel') {
@@ -24,3 +28,37 @@ export class SilentLogger {
     warn() { }
     error() { }
 }
+/**
+ * Appends structured lines to a log file (best-effort — never throws into the
+ * caller). Used to give the kernel gateway a durable trace of routing/swap/
+ * truncation decisions during a TUI session, since its console is owned by the
+ * TUI. Read the file to see exactly why a turn died mid-task.
+ */
+export class FileLogger {
+    file;
+    prefix;
+    constructor(file, prefix = 'gateway') {
+        this.file = file;
+        this.prefix = prefix;
+    }
+    write(level, message, args) {
+        try {
+            // NB: `fs` is imported at module top — a lazy `require()` here throws
+            // "require is not defined" under ESM (which this package runs as), and the
+            // throw was silently swallowed, so NO log was ever written. Static import fixes it.
+            const extra = args.length ? ' ' + args.map(a => (typeof a === 'string' ? a : JSON.stringify(a))).join(' ') : '';
+            const stamp = new Date().toISOString();
+            appendFileSync(this.file, `${stamp} ${level.padEnd(5)} [${this.prefix}] ${message}${extra}\n`);
+        }
+        catch {
+            /* logging must never break the request path */
+        }
+    }
+    debug(message, ...args) {
+        if (process.env.OPENKERNEL_DEBUG === '1')
+            this.write('DEBUG', message, args);
+    }
+    info(message, ...args) { this.write('INFO', message, args); }
+    warn(message, ...args) { this.write('WARN', message, args); }
+    error(message, ...args) { this.write('ERROR', message, args); }
+}

package/dist/kernel/mcp/mcp-server.js

@@ -37,37 +37,76 @@ export function createMcpServer(deps) {
     // ── Spawn + dispatch (parallel agents across devices, no SSH) ───────────────
     server.registerTool('spawn_agent', {
         title: 'Spawn agent on a device',
-        description: 'Hand a task to a device\'s local agent (by name or id). Non-blocking: returns a runId immediately — use follow_task to monitor. Pass wait:true to block until done (short tasks). Runs on the target with its persistent role.',
+        description: 'Hand a task to a device\'s local agent (by name or id). Non-blocking: returns a runId immediately — use follow_task to monitor. Pass wait:true to block until done (short tasks). Runs on the target with its persistent role. Set agent to run it with a third-party CLI on the target ("claude" | "codex" | "opencode") instead of the native kernel.',
         inputSchema: {
             task: z.string().describe('what the agent should do'),
             device: z.string().optional().describe('target device name or node id'),
             capabilities: z.array(z.string()).optional().describe('required capabilities, e.g. ["coding"]'),
+            agent: z.string().optional().describe('executor on the target: "kernel" (default), "claude", "codex", or "opencode"'),
             role: z.string().optional().describe('override the role context for this task'),
             wait: z.boolean().optional().describe('block until the run finishes (default false)'),
         },
-    }, async ({ task, device, capabilities, role, wait }) => {
+    }, async ({ task, device, capabilities, agent, role, wait }) => {
+        const caps = [...(capabilities ?? []), ...(agent && agent !== 'kernel' ? [`backend:${agent}`] : [])];
         const t = {
             description: task.slice(0, 80),
             prompt: task,
-            capabilities: (capabilities ?? []),
+            capabilities: caps,
+            agent,
             role,
         };
         const res = await federation.dispatch(t, { preferName: device, preferNodeId: device }, { wait });
         if (!res)
             return text({ ok: false, error: 'no capable device online for this task' });
-        return text({ ok: true, peerId: res.peerId, runId: res.runId, status: res.record.status, record: res.record });
+        return text({ ok: true, peerId: res.peerId, runId: res.runId, agent: agent ?? 'kernel', status: res.record.status, record: res.record });
     });
     server.registerTool('dispatch', {
         title: 'Dispatch to best device',
-        description: 'Route a task to the best-fit device by capability + load (no device named). Non-blocking; returns a runId. Pass wait:true to block.',
+        description: 'Route a task to the best-fit device by capability + load (no device named). Non-blocking; returns a runId. Pass wait:true to block. Set agent to require a device that has that third-party CLI ("claude" | "codex" | "opencode").',
         inputSchema: {
             task: z.string(),
             capabilities: z.array(z.string()).optional(),
+            agent: z.string().optional().describe('executor: "kernel" (default), "claude", "codex", or "opencode"'),
             wait: z.boolean().optional(),
         },
-    }, async ({ task, capabilities, wait }) => {
-        const res = await federation.dispatch({ description: task.slice(0, 80), prompt: task, capabilities: (capabilities ?? []) }, undefined, { wait });
-        return text(res ? { ok: true, peerId: res.peerId, runId: res.runId, status: res.record.status, record: res.record } : { ok: false, error: 'no capable device' });
+    }, async ({ task, capabilities, agent, wait }) => {
+        const caps = [...(capabilities ?? []), ...(agent && agent !== 'kernel' ? [`backend:${agent}`] : [])];
+        const res = await federation.dispatch({ description: task.slice(0, 80), prompt: task, capabilities: caps, agent }, undefined, { wait });
+        return text(res ? { ok: true, peerId: res.peerId, runId: res.runId, agent: agent ?? 'kernel', status: res.record.status, record: res.record } : { ok: false, error: 'no capable device' });
+    });
+    // ── Agent mailbox (CLI sessions message each other across devices) ──────────
+    server.registerTool('list_agents', {
+        title: 'List messageable agents',
+        description: 'Every CLI agent session across the mesh you can message — live or dormant-but-resumable. Each has an address (nodeId/sessionId) and the backend that runs it.',
+        inputSchema: {},
+    }, async () => text(await federation.agents()));
+    server.registerTool('send_message', {
+        title: 'Message an agent',
+        description: 'Send a message to a CLI agent session anywhere on the mesh (by address "nodeId/sessionId", or a sessionId/runId). Resumes that exact session so it keeps its context, and returns a runId to follow the reply. This is how one agent talks to another. Pass wait:true to block for the reply.',
+        inputSchema: {
+            address: z.string().describe('target agent: "nodeId/sessionId", a sessionId, or the runId that spawned it'),
+            text: z.string().describe('the message to deliver'),
+            wait: z.boolean().optional().describe('block until the agent replies (default false)'),
+        },
+    }, async ({ address, text: message, wait }) => {
+        const res = await federation.sendTo(address, message, { wait });
+        if (!res)
+            return text({ ok: false, error: `no agent found for address: ${address}` });
+        return text({ ok: true, runId: res.runId, nodeId: res.nodeId, status: res.record?.status ?? 'running', record: res.record });
+    });
+    server.registerTool('list_backends', {
+        title: 'List executors on a device',
+        description: 'Which executors a node can run tasks with — "kernel" plus any installed coding CLIs (claude/codex/opencode). Omit nodeId for this node.',
+        inputSchema: { nodeId: z.string().optional().describe('target node; omit for local') },
+    }, async ({ nodeId }) => {
+        if (!nodeId || nodeId === federation.identity.nodeId) {
+            return text({ nodeId: federation.identity.nodeId, backends: federation.availableBackends() });
+        }
+        const status = federation.nodeStatuses().find(s => s.nodeId === nodeId);
+        const backends = (status?.capabilities ?? [])
+            .filter(c => typeof c === 'string' && c.startsWith('backend:'))
+            .map(c => c.slice('backend:'.length));
+        return text({ nodeId, backends });
     });
     server.registerTool('follow_task', {
         title: 'Follow a run',

package/dist/kernel/orchestrator.d.ts

@@ -39,6 +39,10 @@ export declare class Orchestrator {
     /** How many times each task has been replanned (bounds the replan loop). */
     private taskReplans;
     private maxReplans;
+    /** How many times each task has parked waiting for capacity to return. */
+    private taskWaitRetries;
+    /** Generous cap so a long outage keeps the task alive without looping forever. */
+    private maxWaitRetries;
     constructor(deps: OrchestratorDeps);
     run(mission: Mission, input: MissionInput): Promise<Mission>;
     private runTasks;

package/dist/kernel/orchestrator.js

@@ -10,6 +10,10 @@ export class Orchestrator {
     /** How many times each task has been replanned (bounds the replan loop). */
     taskReplans = new Map();
     maxReplans = 2;
+    /** How many times each task has parked waiting for capacity to return. */
+    taskWaitRetries = new Map();
+    /** Generous cap so a long outage keeps the task alive without looping forever. */
+    maxWaitRetries = 20;
     constructor(deps) {
         this.deps = deps;
     }
@@ -237,6 +241,36 @@ export class Orchestrator {
                 task.error = message;
                 break;
             }
+            case 'wait-retry': {
+                // Transient exhaustion (rate limit / all providers cooling down / outage).
+                // Park the task and retry after an escalating backoff — do NOT count it
+                // against the attempt limit, so a temporary outage can't fail the mission.
+                // Bounded by maxWaitRetries so a permanent dead-end still resolves.
+                const waits = (this.taskWaitRetries.get(task.id) ?? 0) + 1;
+                this.taskWaitRetries.set(task.id, waits);
+                if (waits > this.maxWaitRetries) {
+                    task.status = 'FAILED';
+                    task.error = `${message} (no capacity after ${waits} waits)`;
+                    this.deps.eventBus.emit({
+                        type: 'TASK_FAILED',
+                        timestamp: Date.now(),
+                        missionId: mission.id,
+                        taskId: task.id,
+                        workerId: instance.id,
+                        data: { error: task.error, attempts: task.attempts, waits },
+                    });
+                    break;
+                }
+                await this.deps.checkpoints.save(mission, this.collectWorkerStates(mission.id), 'crash');
+                const waitMs = Math.min(60_000, 5_000 * waits); // 5s → capped at 60s
+                this.deps.logger.warn(`Task ${task.id}: waiting ${Math.round(waitMs / 1000)}s for capacity (wait #${waits})`);
+                if (task.attempts > 0)
+                    task.attempts--; // don't burn an attempt on a park
+                await this.sleep(waitMs);
+                task.status = 'PENDING';
+                task.error = message;
+                break;
+            }
             case 'abort':
             default: {
                 task.status = 'FAILED';

package/dist/kernel/provider-manager.d.ts

@@ -8,6 +8,8 @@
 import type { ProviderInfo, ProviderInterface, ProviderModel } from './types.js';
 import type { EventBus } from './event-bus.js';
 import type { Logger } from './types.js';
+/** How long a provider is excluded from routing after each failure class. */
+export declare const COOLDOWN_MS: Record<string, number>;
 export declare class ProviderManager {
     private eventBus;
     private logger;
@@ -23,6 +25,17 @@ export declare class ProviderManager {
     listInfos(): ProviderInfo[];
     getAvailableModels(): Promise<ProviderModel[]>;
     getHealthyProviders(): Promise<ProviderInterface[]>;
+    /** Is this provider currently parked on a recovery cooldown? */
+    isCoolingDown(info: ProviderInfo): boolean;
+    /**
+     * Park a provider out of routing for a window (out of credits, bad key, rate
+     * limited, down). The health check will NOT resurrect it until the cooldown
+     * expires — this is what stops a broke provider (whose /models still answers)
+     * from being re-picked on every task.
+     */
+    markCooldown(providerId: string, ms: number, reason: string): void;
+    /** Apply the standard cooldown for a classified failure. Returns the ms used. */
+    penalize(providerId: string, failureType: string, reason?: string): number;
     /** Record a successful completion for success-rate + quota tracking. */
     recordSuccess(providerId: string): void;
     /** Record a failed completion (non-429) for success-rate tracking. */

package/dist/kernel/provider-manager.js

@@ -1,5 +1,13 @@
 const QUOTA_WINDOW_MS = 60_000;
 const QUOTA_MAX_PER_MIN = 60;
+/** How long a provider is excluded from routing after each failure class. */
+export const COOLDOWN_MS = {
+    '429': 15_000, //           rate limit — clears fast
+    'provider-down': 60_000, // network blip / 5xx
+    'quota-exhausted': 30 * 60_000, // out of credits — long
+    'auth-failure': 6 * 60 * 60_000, // bad key — effectively out for the session
+    'content-filter': 0, //     not the provider's fault — no cooldown, just rotate
+};
 // A real 1-token completion costs a little, so re-verify with a token at most
 // this often; cheaper /models refreshes fill the gaps between verifications.
 const VERIFY_INTERVAL_MS = 5 * 60_000;
@@ -48,7 +56,7 @@ export class ProviderManager {
     async getAvailableModels() {
         const models = [];
         for (const provider of this.providers.values()) {
-            if (!provider.info.healthy)
+            if (!provider.info.healthy || this.isCoolingDown(provider.info))
                 continue;
             try {
                 const caps = await provider.capabilities();
@@ -61,7 +69,39 @@ export class ProviderManager {
         return models;
     }
     async getHealthyProviders() {
-        return this.list().filter(p => p.info.healthy);
+        return this.list().filter(p => p.info.healthy && !this.isCoolingDown(p.info));
+    }
+    /** Is this provider currently parked on a recovery cooldown? */
+    isCoolingDown(info) {
+        return info.cooldownUntil !== undefined && Date.now() < info.cooldownUntil;
+    }
+    /**
+     * Park a provider out of routing for a window (out of credits, bad key, rate
+     * limited, down). The health check will NOT resurrect it until the cooldown
+     * expires — this is what stops a broke provider (whose /models still answers)
+     * from being re-picked on every task.
+     */
+    markCooldown(providerId, ms, reason) {
+        const info = this.providers.get(providerId)?.info;
+        if (!info || ms <= 0)
+            return;
+        info.cooldownUntil = Date.now() + ms;
+        info.healthy = false;
+        info.available = false;
+        info.error = reason;
+        this.logger.warn(`Provider ${providerId} cooled down ${Math.round(ms / 1000)}s: ${reason}`);
+        this.eventBus.emit({
+            type: 'PROVIDER_HEALTH',
+            timestamp: Date.now(),
+            data: { providerId, healthy: false, cooldownUntil: info.cooldownUntil, reason },
+        });
+    }
+    /** Apply the standard cooldown for a classified failure. Returns the ms used. */
+    penalize(providerId, failureType, reason) {
+        const ms = COOLDOWN_MS[failureType] ?? 0;
+        if (ms > 0)
+            this.markCooldown(providerId, ms, reason ?? failureType);
+        return ms;
     }
     /** Record a successful completion for success-rate + quota tracking. */
     recordSuccess(providerId) {
@@ -107,10 +147,11 @@ export class ProviderManager {
             if (info) {
                 info.quotaRemaining = Math.max(0, (info.quotaRemaining ?? 0) - 1);
                 info.successRate = s.totalRequests > 0 ? s.successfulRequests / s.totalRequests : undefined;
-                if ((info.quotaRemaining ?? 0) <= 0) {
-                    info.healthy = false;
+                // Short cooldown so the next few turns skip this provider while the rate
+                // limit clears, instead of hammering it and burning attempts.
+                this.markCooldown(providerId, COOLDOWN_MS['429'], 'rate-limited');
+                if ((info.quotaRemaining ?? 0) <= 0)
                     info.error = 'rate-limited (quota exhausted)';
-                }
             }
         }
     }
@@ -134,6 +175,13 @@ export class ProviderManager {
         const provider = this.providers.get(providerId);
         if (!provider)
             return;
+        // Respect an active cooldown — do NOT resurrect a parked provider (out of
+        // credits / bad key), even though its cheap /models probe would succeed.
+        if (this.isCoolingDown(provider.info))
+            return;
+        if (provider.info.cooldownUntil !== undefined) {
+            provider.info.cooldownUntil = undefined; // expired — allow a fresh check
+        }
         const start = Date.now();
         const s = this.stats.get(providerId);
         const now = Date.now();
@@ -164,6 +212,11 @@ export class ProviderManager {
                 await provider.capabilities();
                 latency = Date.now() - start;
             }
+            // A cooldown may have been applied WHILE this async check was in flight
+            // (e.g. a credits failure on a concurrent request). Honor it — don't let a
+            // late-completing health probe resurrect a just-parked provider.
+            if (this.isCoolingDown(provider.info))
+                return;
             provider.info.healthy = true;
             provider.info.available = true;
             provider.info.latencyMs = latency;

package/dist/kernel/providers/openai-compatible-provider.d.ts

@@ -37,6 +37,12 @@ export declare class OpenAICompatibleProvider implements ProviderInterface {
     }>;
     private parseTokenLimit;
     private fetchModels;
+    /**
+     * Infer capabilities for a live-fetched model from its id. Excludes non-chat
+     * endpoints (embeddings/audio/rerank/guard) from coding; everything else — a
+     * general instruct/chat LLM — is treated as coding+reasoning capable.
+     */
+    private inferCapabilities;
     private toProviderModel;
     private headers;
     private buildMessages;

package/dist/kernel/providers/openai-compatible-provider.js

@@ -183,15 +183,34 @@ export class OpenAICompatibleProvider {
             return this.knownModels.map(m => this.toProviderModel(m.id, m.contextLength));
         }
     }
+    /**
+     * Infer capabilities for a live-fetched model from its id. Excludes non-chat
+     * endpoints (embeddings/audio/rerank/guard) from coding; everything else — a
+     * general instruct/chat LLM — is treated as coding+reasoning capable.
+     */
+    inferCapabilities(lower) {
+        const nonChat = /(embed|embedding|rerank|reranker|bge-|e5-|gte-|whisper|tts|text-to-speech|speech|audio|voice|moderat|guard|safety|\bocr\b|stable-diffusion|flux|image-gen|dall)/;
+        if (nonChat.test(lower))
+            return ['reasoning'];
+        const caps = ['coding', 'reasoning'];
+        if (/(vision|vl|multimodal|omni|image|-vlm|maverick|scout)/.test(lower))
+            caps.push('vision');
+        return caps;
+    }
     toProviderModel(id, contextLength) {
         const known = this.knownModels.find(m => m.id === id);
         const lower = id.toLowerCase();
-        const capabilities = known?.capabilities ?? ['reasoning'];
+        // Known models keep their curated tags. For a LIVE-fetched model, infer:
+        // modern instruct/chat LLMs (GLM, Kimi, DeepSeek, Qwen, Llama, Mistral…) are
+        // all coding-capable, so default to coding+reasoning — tagging them
+        // reasoning-only would drop their capabilityScore on coding routes and hand
+        // every build to whatever curated model happens to carry the 'coding' tag.
+        const capabilities = known?.capabilities ? [...known.capabilities] : this.inferCapabilities(lower);
         if (!capabilities.includes('reasoning'))
             capabilities.push('reasoning');
-        if (lower.includes('code') || lower.includes('coder'))
+        if ((lower.includes('code') || lower.includes('coder')) && !capabilities.includes('coding'))
             capabilities.push('coding');
-        if (lower.includes('vision') || lower.includes('vl'))
+        if ((lower.includes('vision') || lower.includes('vl') || lower.includes('multimodal')) && !capabilities.includes('vision'))
             capabilities.push('vision');
         return {
             id,

package/dist/kernel/recovery-manager.js

@@ -5,11 +5,25 @@ export class RecoveryManager {
     }
     classify(error) {
         const lower = error.toLowerCase();
+        // Billing/credits FIRST — a 402 or "insufficient credits" must not be read as
+        // a transient rate limit; it needs a long provider cooldown, not a fast retry.
+        if (/402|payment required|insufficient (funds|credit|credits|balance|quota)|out of (credit|credits|quota)|no credit|quota exceeded|exceeded your current quota|billing|not enough (credit|credits|balance|funds)|add credits|purchase|top up|spending limit/.test(lower)) {
+            return 'quota-exhausted';
+        }
+        if (/401|403|unauthorized|forbidden|invalid api key|invalid.{0,4}key|incorrect api key|authentication|auth.{0,12}fail|permission denied|api key not/.test(lower)) {
+            return 'auth-failure';
+        }
         if (/429|rate.?limit|too many requests/.test(lower))
             return '429';
+        if (/context length|maximum context|context window|too many tokens|reduce.{0,24}(length|tokens)|token limit|maximum.{0,12}tokens|input is too long|string too long|prompt is too long/.test(lower)) {
+            return 'context-overflow';
+        }
+        if (/content (filter|policy|management)|moderation|flagged|safety (system|policy)|responsible ai|jailbreak/.test(lower)) {
+            return 'content-filter';
+        }
         if (/timeout|timed out|deadline exceeded|abort/.test(lower))
             return 'timeout';
-        if (/econnrefused|enotfound|unreachable|provider down|network|socket hang up|fetch failed/.test(lower)) {
+        if (/econnrefused|enotfound|unreachable|provider down|network|socket hang up|fetch failed|\b5\d\d\b|service unavailable|bad gateway|overloaded/.test(lower)) {
             return 'provider-down';
         }
         if (/hallucinat|fabricat|invented|not grounded/.test(lower))
@@ -35,24 +49,50 @@ export class RecoveryManager {
         let newWorkerType;
         let escalateToBenchmark;
         switch (failureType) {
+            case 'quota-exhausted':
+            case 'auth-failure':
+            case 'content-filter':
             case '429':
             case 'provider-down': {
-                if (belowLimit) {
-                    const alt = await this.findAlternateProvider(ctx);
-                    if (alt) {
-                        action = 'rotate-provider';
-                        reason = `${failureType}: rotate to ${alt.providerId}/${alt.modelId}`;
-                        rotateToProviderId = alt.providerId;
-                        rotateToModelId = alt.modelId;
-                    }
-                    else {
-                        action = belowLimit ? 'retry' : 'abort';
-                        reason = `${failureType}: ${action} (no alternate provider)`;
-                    }
+                // Park the failing provider so it isn't re-picked next task, then move the
+                // work to another provider. If none is available right now, WAIT and retry
+                // rather than abort — the credits/limit/outage is usually temporary.
+                if (ctx.currentProviderId) {
+                    this.deps.providerManager.penalize(ctx.currentProviderId, failureType, `${failureType}: ${ctx.error.slice(0, 120)}`);
                 }
-                else {
+                const alt = await this.findAlternateProvider(ctx);
+                if (alt) {
+                    action = 'rotate-provider';
+                    reason = `${failureType}: rotate to ${alt.providerId}/${alt.modelId}`;
+                    rotateToProviderId = alt.providerId;
+                    rotateToModelId = alt.modelId;
+                }
+                else if (failureType === 'auth-failure') {
+                    // A bad key won't self-heal and there's nowhere else to go.
                     action = 'abort';
-                    reason = `${failureType}: attempts exhausted (${ctx.attempts}/${maxAttempts})`;
+                    reason = `${failureType}: no working provider (fix the API key)`;
+                }
+                else {
+                    // Rate limit / credits / outage with no alternate → keep the task alive.
+                    action = 'wait-retry';
+                    reason = `${failureType}: no alternate provider — parking, will retry`;
+                }
+                break;
+            }
+            case 'context-overflow': {
+                // The request is too big for this model — climb to a larger model, else
+                // replan (fresh routing / decomposition) rather than retry the same size.
+                const bigger = await this.findMoreCapableModel(ctx);
+                if (bigger) {
+                    action = 'escalate-model';
+                    reason = `context-overflow: escalate → ${bigger.providerId}/${bigger.modelId}`;
+                    rotateToProviderId = bigger.providerId;
+                    rotateToModelId = bigger.modelId;
+                    escalateToBenchmark = bigger.benchmarkScore;
+                }
+                else {
+                    action = 'replan';
+                    reason = 'context-overflow: at model ceiling → replan (decompose/compact)';
                 }
                 break;
             }

package/dist/kernel/router.js

@@ -193,8 +193,21 @@ export class CapabilityRouter {
             score = 44;
         else
             score = 58; // unknown-size cloud model — assume mid-tier
-        // Frontier families punch above their parameter count.
-        if (/(gpt-4o|gpt-4\.1|gpt-5|gpt-oss|o[1-9]\b|claude|deepseek-?(r1|v3|v4)|gemini-[23]|gemini-1\.5-pro|llama-3\.3|llama-4|qwen2?\.5|qwen3|qwq|glm-[45]|nemotron|mistral-large|kimi|minimax|command-r-plus|ernie)/.test(text)) {
+        // Flagship frontier models — top-tier reasoning/coding that punch well above
+        // their (often unknown) parameter count. Scored above a 70B open model so the
+        // router actually reaches for them instead of defaulting to a fast mid model.
+        if (/(gpt-5|gpt-4\.1|o[1-9]\b|claude-?(3\.[57]|4|opus|sonnet|haiku-4)|deepseek-?(r1|v3|v3\.1|v4)|gemini-2(\.\d)?-pro|gemini-2\.5|glm-(4\.6|[5-9])|kimi|qwen-?3|qwen2\.5-?(72b|max)|minimax|nemotron-?(ultra|340b|4)|mistral-large-2|command-a|grok-[3-9])/.test(text)) {
+            // True frontier = unknown/large-size flagship MoEs (GLM-4.6, Kimi-K2,
+            // DeepSeek-V3). A flagship FAMILY at a small/mid param size (e.g. qwen3-27b)
+            // is fast but NOT frontier — a flat 91 floor let it tie those at 94 and, via
+            // first-match-wins, steal the default for whichever provider lists first
+            // (Groq). Floor mid-size flagships lower so genuine frontier wins outright.
+            score = Math.max(score, paramSize > 0 && paramSize < 30 ? 88 : 91);
+        }
+        // Strong models — capable, a tier below flagship. Llama 4 (Scout/Maverick) lands
+        // here, NOT flagship: bare `llama-4` in the top tier let a fast 17B MoE (Scout)
+        // tie GLM-4.6/Kimi at 94 and, via first-match-wins, steal the default for Groq.
+        else if (/(gpt-4o|gpt-oss|claude|deepseek|gemini-1\.5-pro|llama-4|llama-3\.3|qwen2?\.5|qwq|glm-4|nemotron|mistral-large|command-r-plus|ernie)/.test(text)) {
             score = Math.max(score, 85);
         }
         // Small/fast variants are capable but not top-tier (avoid demoting MoE "air"

package/dist/kernel/types.d.ts

@@ -186,6 +186,13 @@ export interface ProviderInfo {
      */
     maxRequestTokens?: number;
     error?: string;
+    /**
+     * When set and in the future, the provider is on a recovery cooldown (out of
+     * credits, bad key, rate-limited, or down) and is excluded from routing until
+     * this time. Prevents a broke/dead provider — whose /models still responds —
+     * from being resurrected by the health check and re-picked every task.
+     */
+    cooldownUntil?: number;
 }
 export interface ProviderCapabilities {
     streaming: boolean;
@@ -407,8 +414,11 @@ export interface LlmJudgeOptions {
     providerId?: string;
     modelId?: string;
 }
-export type FailureType = '429' | 'timeout' | 'provider-down' | 'hallucination' | 'tool-failure' | 'verification-failure' | 'planning-failure' | 'browser-failure' | 'unknown';
-export type RecoveryAction = 'retry' | 'rotate-provider' | 'escalate-model' | 'spawn-different-worker' | 'replan' | 'checkpoint' | 'continue' | 'abort';
+export type FailureType = '429' | 'timeout' | 'provider-down' | 'quota-exhausted' | 'auth-failure' | 'context-overflow' | 'content-filter' | 'hallucination' | 'tool-failure' | 'verification-failure' | 'planning-failure' | 'browser-failure' | 'unknown';
+export type RecoveryAction = 'retry' | 'rotate-provider' | 'escalate-model' | 'spawn-different-worker' | 'replan' | 'checkpoint' | 'continue'
+/** Park the task and retry after a backoff — for transient exhaustion (rate
+ *  limit / all providers cooling down) where the work must NOT be abandoned. */
+ | 'wait-retry' | 'abort';
 export interface RecoveryDecision {
     action: RecoveryAction;
     reason: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infinicode",
-  "version": "2.3.4",
+  "version": "2.3.6",
   "description": "OpenKernel — provider-agnostic AI execution kernel. Native coding agent + mission-driven execution runtime.",
   "type": "module",
   "main": "./dist/kernel/index.js",