oira666_pi-limits-wait 0.4.7 → 0.4.9

package/README.md

@@ -19,6 +19,8 @@ Restart Pi or run `/reload` after installing.
 - Uses provider retry timing when available (`retry-after`, `retry-after-ms`, `retry in ...`, reset messages).
 - If no retry timing is available for a rate limit, waits 30 minutes before retrying.
 - On `server_is_overloaded`, waits 5 minutes, then retries. If the provider is still overloaded after Pi's normal retries, it waits another 5 minutes and repeats.
+- On transient network/transport failures — including undici idle-timeout aborts (`UND_ERR_HEADERS_TIMEOUT` / `UND_ERR_BODY_TIMEOUT`), `fetch failed`, `terminated`, `ECONNRESET`, `ETIMEDOUT`, etc. — treats the error as retryable with a short backoff (default 15s, or the provider's `retry-after`) instead of giving up. This prevents a stalled streaming request from turning into a silent hang.
+- For any other (unclassified) non-retryable error, retries the same model a few times (default 3) before falling back / freezing it, so a one-off hiccup does not immediately sideline a model.
 - Shows a countdown in the Pi status/working line.
 - Press Enter during the countdown to skip the wait and retry immediately.
 - Optionally falls back to configured models when the current/default model is rate-limited.
@@ -27,38 +29,36 @@ Restart Pi or run `/reload` after installing.
 
 By default, if you do not configure fallback models, the extension behaves exactly as before: it waits for the current model's limit to reset and retries.
 
-To enable automatic model fallback, add `oira666_pi-limits-wait.try_models` to Pi's normal `settings.json`.
+To enable automatic model fallback, add `fallback-models` to a `limits-wait.json` file.
 
-Pi settings can be global or project-local:
+The extension reads these files in order; later files override earlier ones:
 
 | Location | Scope |
 |----------|-------|
-| `~/.pi/agent/settings.json` | Global, all projects |
-| `.pi/settings.json` | Project-local |
-
-Project settings override global settings. The extension reads these through Pi's `SettingsManager`, so normal Pi settings paths and `PI_CODING_AGENT_DIR` are respected.
+| `~/.config/.pi/limits-wait.json` | Global defaults |
+| `<Pi agent dir>/limits-wait.json` (for example `~/.pi/agent/limits-wait.json`, or `PI_CODING_AGENT_DIR/limits-wait.json`) | Pi agent directory |
+| `.limits-wait.json` | Project root override |
+| `.pi/limits-wait.json` | Pi project override |
 
 Example:
 
 ```json
 {
-  "oira666_pi-limits-wait": {
-    "try_models": [
-      {
-        "provider": "anthropic",
-        "modelname": "claude-sonnet-4-5",
-        "reasoning effort": "medium"
-      },
-      {
-        "provider": "openai",
-        "modelname": "gpt-5.1-codex"
-      }
-    ]
-  }
+  "fallback-models": [
+    {
+      "provider": "anthropic",
+      "modelname": "claude-sonnet-4-5",
+      "reasoning effort": "medium"
+    },
+    {
+      "provider": "openai",
+      "modelname": "gpt-5.1-codex"
+    }
+  ]
 }
 ```
 
-Each `try_models` entry supports:
+Each `fallback-models` entry supports:
 
 - `provider` — required. The Pi provider name, for example `anthropic`, `openai`, `google`, etc.
 - `modelname` — required. The model id/name as Pi knows it.
@@ -69,13 +69,19 @@ Fallback behavior:
 1. Pi starts with the normal default or user-selected model.
 2. If that model is rate-limited, the extension tries models in this order:
    - the original default/user-selected model;
-   - then every model from `oira666_pi-limits-wait.try_models`, top to bottom.
+   - then every model from `fallback-models`, top to bottom.
 3. The first model that responds without a rate-limit becomes the active Pi model for the rest of the session/task.
 4. If that model later becomes rate-limited too, the extension starts again from the same ordered list.
 5. Rate-limit reset times are remembered only in memory, so known-limited models are skipped until their countdown expires. This memory is cleared when Pi restarts.
 
 When the settings are loaded, the extension shows the full usable fallback model list. When models become rate-limited, it shows a live countdown for each limited model.
 
+## Environment variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `PI_LIMITS_WAIT_FREEZING_ENABLED` | `true` | When a model keeps failing with a non-retryable error, it is normally "frozen" for 1 hour and skipped in favour of other configured models. Set this to `false` (also accepts `0`, `no`, `off`) to disable freezing entirely: the extension will instead try each configured candidate once (after the bounded retries) and then surface the error, never blocking on a long "model-frozen" wait. Useful for non-interactive / subagent runs where no one can press Enter to skip. |
+
 ## License
 
 MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oira666_pi-limits-wait",
-  "version": "0.4.7",
+  "version": "0.4.9",
   "description": "Extension for PI that allows to automatically wait for limits to reset and retry the request",
   "type": "module",
   "license": "MIT",

package/src/index.ts

@@ -1,4 +1,7 @@
-import { SettingsManager, type ExtensionAPI, type ExtensionContext } from "@mariozechner/pi-coding-agent";
+import { existsSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { join, resolve } from "path";
+import { getAgentDir, type ExtensionAPI, type ExtensionContext } from "@mariozechner/pi-coding-agent";
 import type { ThinkingLevel } from "@mariozechner/pi-agent-core";
 import {
   createAssistantMessageEventStream,
@@ -28,14 +31,22 @@ const PI_IDENTITY_SENTENCE_PATTERN =
 
 const DEFAULT_RATE_LIMIT_WAIT_MS = 30 * 60 * 1_000; // 30 minutes
 const DEFAULT_OVERLOADED_WAIT_MS = 5 * 60 * 1_000; // 5 minutes
-const DEFAULT_NON_RETRYABLE_FREEZE_MS = 60 * 60 * 1_000; // 1 hour
-const SETTINGS_KEY = "oira666_pi-limits-wait";
+const DEFAULT_NETWORK_WAIT_MS = 15 * 1_000; // 15 seconds
+const DEFAULT_NON_RETRYABLE_FREEZE_MS = 10 * 60 * 1_000; // 1 hour
+/** How many times a non-retryable error is retried before we freeze/fallback. */
+const NON_RETRYABLE_MAX_ATTEMPTS = 3;
+/** Short backoff between non-retryable retries. */
+const NON_RETRYABLE_RETRY_DELAY_MS = 5 * 1_000; // 5 seconds
+const SETTINGS_FILE_NAME = "limits-wait.json";
+const FALLBACK_MODELS_KEY = "fallback-models";
+/** Env var to toggle the 1-hour model-freeze behaviour. Default: enabled. */
+const FREEZING_ENV_VAR = "PI_LIMITS_WAIT_FREEZING_ENABLED";
 
 /** Key used with ctx.ui.setStatus() for the countdown line. */
 const STATUS_KEY = "limits-wait";
 const MODELS_STATUS_KEY = "limits-wait-models";
 
-type RetryReason = "rate-limit" | "overloaded" | "authentication" | "model-frozen";
+type RetryReason = "rate-limit" | "overloaded" | "authentication" | "model-frozen" | "network" | "retry";
 
 type RetryableError = {
   reason: RetryReason;
@@ -78,6 +89,8 @@ let lastObservedRateLimitError: { at: number; message: string } | undefined;
 const wrappedApis = new Set<Api>();
 const builtinStreamSimpleByApi = new Map<Api, StreamSimpleFn>();
 let fallbackModels: FallbackModel[] = [];
+let nonRetryableMaxAttempts = NON_RETRYABLE_MAX_ATTEMPTS;
+let nonRetryableRetryDelayMs = NON_RETRYABLE_RETRY_DELAY_MS;
 let primaryModel: Model<Api> | undefined;
 let primaryThinkingLevel: ThinkingLevel | undefined;
 let suppressNextModelSelect = false;
@@ -138,8 +151,8 @@ function isThinkingLevel(value: unknown): value is ThinkingLevel {
 }
 
 function parseConfiguredModels(raw: unknown): ConfiguredModel[] {
-  const source = raw && typeof raw === "object" && Array.isArray((raw as { try_models?: unknown }).try_models)
-    ? (raw as { try_models: unknown[] }).try_models
+  const source = raw && typeof raw === "object" && Array.isArray((raw as { [FALLBACK_MODELS_KEY]?: unknown })[FALLBACK_MODELS_KEY])
+    ? (raw as { [FALLBACK_MODELS_KEY]: unknown[] })[FALLBACK_MODELS_KEY]
     : [];
 
   const models: ConfiguredModel[] = [];
@@ -163,37 +176,77 @@ function parseConfiguredModels(raw: unknown): ConfiguredModel[] {
   return models;
 }
 
+function configFileCandidates(cwd: string, agentDir = getAgentDir(), homeDir = homedir()): string[] {
+  return [
+    join(homeDir, ".config", ".pi", SETTINGS_FILE_NAME),
+    join(agentDir, SETTINGS_FILE_NAME),
+    resolve(cwd, `.${SETTINGS_FILE_NAME}`),
+    resolve(cwd, ".pi", SETTINGS_FILE_NAME),
+  ];
+}
+
+function mergeConfig(base: Record<string, unknown>, override: Record<string, unknown>): Record<string, unknown> {
+  return { ...base, ...override };
+}
+
+function readFallbackSettings(cwd: string, agentDir = getAgentDir(), homeDir = homedir()): { config: Record<string, unknown>; loadedPaths: string[]; warnings: string[] } {
+  let config: Record<string, unknown> = {};
+  const loadedPaths: string[] = [];
+  const warnings: string[] = [];
+  const seen = new Set<string>();
+
+  for (const candidate of configFileCandidates(cwd, agentDir, homeDir)) {
+    const path = resolve(candidate);
+    if (seen.has(path)) continue;
+    seen.add(path);
+    if (!existsSync(path)) continue;
+
+    try {
+      const parsed = JSON.parse(readFileSync(path, "utf-8")) as unknown;
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        warnings.push(`${path}: expected a JSON object`);
+        continue;
+      }
+      config = mergeConfig(config, parsed as Record<string, unknown>);
+      loadedPaths.push(path);
+    } catch (err) {
+      warnings.push(`${path}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+
+  return { config, loadedPaths, warnings };
+}
+
+export function __readFallbackSettingsForTests(cwd: string, agentDir: string, homeDir: string): { config: Record<string, unknown>; loadedPaths: string[]; warnings: string[] } {
+  return readFallbackSettings(cwd, agentDir, homeDir);
+}
+
 function loadFallbackSettings(ctx: ExtensionContext): void {
   fallbackModels = [];
 
   try {
-    const settingsManager = SettingsManager.create(ctx.cwd);
-    const globalSettings = settingsManager.getGlobalSettings() as Record<string, unknown>;
-    const projectSettings = settingsManager.getProjectSettings() as Record<string, unknown>;
-    const globalConfig = globalSettings[SETTINGS_KEY];
-    const projectConfig = projectSettings[SETTINGS_KEY];
-    const config = {
-      ...(globalConfig && typeof globalConfig === "object" && !Array.isArray(globalConfig) ? globalConfig : {}),
-      ...(projectConfig && typeof projectConfig === "object" && !Array.isArray(projectConfig) ? projectConfig : {}),
-    };
-    const content = JSON.stringify(config);
+    const { config, loadedPaths, warnings } = readFallbackSettings(ctx.cwd);
+    const content = JSON.stringify({ config, loadedPaths, warnings });
     const shouldNotify = settingsSignature !== content;
     settingsSignature = content;
 
     const configured = parseConfiguredModels(config);
-    if (configured.length === 0) return;
+    if (configured.length === 0) {
+      if (shouldNotify && warnings.length > 0) ctx.ui.notify(`Could not fully load ${SETTINGS_FILE_NAME}: ${warnings.join(", ")}`, "warning");
+      return;
+    }
 
-    const warnings: string[] = [];
+    const modelWarnings: string[] = [];
     const seen = new Set<string>();
 
     for (const entry of configured) {
       const model = ctx.modelRegistry.find(entry.provider, entry.modelname);
       if (!model) {
-        warnings.push(`missing ${entry.provider}/${entry.modelname}`);
+        modelWarnings.push(`missing ${entry.provider}/${entry.modelname}`);
         continue;
       }
       if (!ctx.modelRegistry.hasConfiguredAuth(model)) {
-        warnings.push(`no auth ${entry.provider}/${entry.modelname}`);
+        modelWarnings.push(`no auth ${entry.provider}/${entry.modelname}`);
         continue;
       }
       const key = modelKey(model);
@@ -205,14 +258,16 @@ function loadFallbackSettings(ctx: ExtensionContext): void {
     const lines = fallbackModels.map((entry, index) =>
       `${index + 1}. ${formatModel(entry.model)}${entry.reasoningEffort ? ` (${entry.reasoningEffort})` : ""}`,
     );
+    const source = loadedPaths.length > 0 ? ` from ${loadedPaths.join(", ")}` : "";
     const message = lines.length > 0
-      ? `Loaded ${SETTINGS_KEY}.try_models:\n${lines.join("\n")}`
-      : `Loaded ${SETTINGS_KEY}.try_models, but no usable fallback models were found.`;
+      ? `Loaded ${SETTINGS_FILE_NAME}.${FALLBACK_MODELS_KEY}${source}:\n${lines.join("\n")}`
+      : `Loaded ${SETTINGS_FILE_NAME}.${FALLBACK_MODELS_KEY}${source}, but no usable fallback models were found.`;
+    const allWarnings = [...warnings, ...modelWarnings];
     if (shouldNotify) {
-      ctx.ui.notify(warnings.length > 0 ? `${message}\nSkipped: ${warnings.join(", ")}` : message, warnings.length > 0 ? "warning" : "info");
+      ctx.ui.notify(allWarnings.length > 0 ? `${message}\nSkipped: ${allWarnings.join(", ")}` : message, allWarnings.length > 0 ? "warning" : "info");
     }
   } catch (err) {
-    ctx.ui.notify(`Could not load ${SETTINGS_KEY}.try_models: ${err instanceof Error ? err.message : String(err)}`, "warning");
+    ctx.ui.notify(`Could not load ${SETTINGS_FILE_NAME}.${FALLBACK_MODELS_KEY}: ${err instanceof Error ? err.message : String(err)}`, "warning");
   }
 }
 
@@ -458,6 +513,40 @@ export function isServerOverloadedError(msg: string): boolean {
   );
 }
 
+/**
+ * Transient network / HTTP transport failures. These are NOT API rate-limit or
+ * overload responses, but they are still worth retrying with a short backoff
+ * instead of treating them as a hard non-retryable failure (which would freeze
+ * the model for an hour). Most importantly this covers undici's idle-timeout
+ * aborts (`UND_ERR_HEADERS_TIMEOUT` / `UND_ERR_BODY_TIMEOUT`) that fire when a
+ * streaming request stalls without a response.
+ */
+export function isTransientNetworkError(msg: string): boolean {
+  const lower = msg.toLowerCase();
+  return (
+    lower.includes("und_err_headers_timeout") ||
+    lower.includes("und_err_body_timeout") ||
+    lower.includes("und_err_connect_timeout") ||
+    lower.includes("und_err_socket") ||
+    lower.includes("headers timeout") ||
+    lower.includes("body timeout") ||
+    lower.includes("connect timeout") ||
+    lower.includes("fetch failed") ||
+    lower.includes("terminated") ||
+    lower.includes("socket hang up") ||
+    lower.includes("other side closed") ||
+    lower.includes("network_error") ||
+    lower.includes("network error") ||
+    lower.includes("econnreset") ||
+    lower.includes("econnrefused") ||
+    lower.includes("etimedout") ||
+    lower.includes("enetunreach") ||
+    lower.includes("ehostunreach") ||
+    lower.includes("eai_again") ||
+    lower.includes("enotfound")
+  );
+}
+
 export function isAuthenticationRefreshError(msg: string): boolean {
   const lower = msg.toLowerCase();
   return (
@@ -543,6 +632,9 @@ export function getRetryableError(msg: string): RetryableError | undefined {
   if (isRateLimitError(msg)) {
     return { reason: "rate-limit", waitMs: rateLimitWaitMs(msg) };
   }
+  if (isTransientNetworkError(msg)) {
+    return { reason: "network", waitMs: parseRetryDelayMs(msg) ?? DEFAULT_NETWORK_WAIT_MS };
+  }
   return undefined;
 }
 
@@ -552,9 +644,23 @@ function reasonLabel(reason: RetryReason): string {
   if (reason === "overloaded") return "Server overloaded";
   if (reason === "authentication") return "Authentication refresh pending";
   if (reason === "model-frozen") return "Model frozen after error";
+  if (reason === "network") return "Network/timeout error";
+  if (reason === "retry") return "Retrying after error";
   return "Rate limited";
 }
 
+/**
+ * Whether the 1-hour model-freeze behaviour is enabled. Controlled by the
+ * `PI_LIMITS_WAIT_FREEZING_ENABLED` env var (default enabled). Set it to
+ * `false`/`0`/`no`/`off` to disable freezing entirely.
+ */
+export function freezingEnabled(): boolean {
+  const raw = process.env[FREEZING_ENV_VAR];
+  if (raw === undefined) return true;
+  const value = raw.trim().toLowerCase();
+  return !(value === "false" || value === "0" || value === "no" || value === "off");
+}
+
 function statusText(reason: RetryReason, deadline: number, allowSkip: boolean): string {
   const remaining = Math.max(0, deadline - Date.now());
   const totalSecs = Math.ceil(remaining / 1_000);
@@ -646,14 +752,19 @@ export function waitForRetry(
     };
 
     tick();
+    // The interval only drives the visible 1s countdown; the actual wait is
+    // resolved precisely at the deadline by `timer` below (so a 200ms backoff
+    // resolves in ~200ms instead of being rounded up to the next 1s tick).
     const ticker = setInterval(() => {
       if (Date.now() >= deadline) { cleanup(); resolve("waited"); return; }
       tick();
     }, 1_000);
+    const timer = setTimeout(() => { if (!done) { cleanup(); resolve("waited"); } }, Math.max(0, deadline - Date.now()));
 
     function cleanup() {
       done = true;
       clearInterval(ticker);
+      clearTimeout(timer);
       signal?.removeEventListener("abort", onAbort);
       unsubInput?.();
       ctx?.ui.setStatus(STATUS_KEY, undefined);
@@ -723,6 +834,11 @@ type StreamSimpleFn = (
   options?: SimpleStreamOptions,
 ) => AssistantMessageEventStream | Promise<AssistantMessageEventStream>;
 
+export function __setNonRetryableTuningForTests(maxAttempts: number, retryDelayMs: number): void {
+  nonRetryableMaxAttempts = maxAttempts;
+  nonRetryableRetryDelayMs = retryDelayMs;
+}
+
 export function __configureFallbackModelsForTests(
   models: FallbackModel[],
   ctx?: ExtensionContext,
@@ -775,6 +891,11 @@ export function streamWithLimitsRetry(
     let committed = false;
     const allowFallback = fallbackEnabled() && isFallbackEligibleModel(model);
     let attempt: FallbackModel = allowFallback ? initialAttempt(model) : { model, reasoningEffort: primaryThinkingLevel };
+    // Per-stream bookkeeping: how many times each model has hit a non-retryable
+    // error, and which models we've exhausted (used to advance fallbacks when
+    // freezing is disabled).
+    const nonRetryableAttempts = new Map<string, number>();
+    const triedModels = new Set<string>();
 
     const flush = (buffer: AssistantMessageEvent[]) => {
       for (const event of buffer) output.push(event);
@@ -833,20 +954,11 @@ export function streamWithLimitsRetry(
                   break;
                 }
 
-                if (allowFallback) {
-                  nonRetryableError = { message: errMsg, event };
-                  break;
-                }
-
-                if (buffer.length > 0) {
-                  flush(buffer);
-                } else {
-                  output.push({ type: "start", partial: freshMessage(attempt.model) });
-                  committed = true;
-                }
-                output.push(event);
-                output.end();
-                return;
+                // Defer handling to the post-loop block, which applies the
+                // bounded non-retryable retry / fallback / freeze logic. This
+                // runs whether or not fallbacks are configured.
+                nonRetryableError = { message: errMsg, event };
+                break;
               }
 
               if (event.type === "start") {
@@ -888,25 +1000,21 @@ export function streamWithLimitsRetry(
             if (retryable && observedRateLimit) retryableErrorMessage = observedRateLimit;
           }
           if (!retryable) {
-            if (allowFallback && !aborted) {
-              nonRetryableError = { message: errMsg };
-            } else {
+            if (aborted) {
               if (!committed) {
                 // Synthetic start+error so the stream protocol stays valid.
                 output.push({ type: "start", partial: freshMessage(attempt.model) });
                 committed = true;
               }
               const error = freshMessage(attempt.model);
-              error.stopReason = aborted ? "aborted" : "error";
+              error.stopReason = "aborted";
               error.errorMessage = errMsg;
-              output.push({
-                type: "error",
-                reason: error.stopReason as "error" | "aborted",
-                error,
-              });
+              output.push({ type: "error", reason: "aborted", error });
               output.end();
               return;
             }
+            // Defer to the post-loop block for bounded retries / fallback.
+            nonRetryableError = { message: errMsg };
           }
         }
       } finally {
@@ -918,68 +1026,96 @@ export function streamWithLimitsRetry(
         }
       }
 
-      if (nonRetryableError) {
-        if (allowFallback && !committed) {
-          rememberNonRetryableFailure(attempt.model, nonRetryableError.message);
-          const next = nextAvailableCandidate(attempt.model);
-          if (next) {
-            attempt = next;
-            continue;
-          }
+      if (!retryable) {
+        // Both explicit non-retryable error events/exceptions and a provider
+        // stream that ended without a terminal event land here.
+        const failureEvent = nonRetryableError?.event;
+        const failureMessage = nonRetryableError?.message ?? "Provider stream ended without a terminal event.";
 
-          const deadline = earliestCandidateDeadline(attempt.model);
-          if (deadline) {
-            const waitResult = await waitForRetry("model-frozen", Math.max(0, deadline - Date.now()), options?.signal);
-            if (waitResult !== "aborted") {
-              attempt = nextAvailableCandidate(attempt.model) ?? { model: getPrimaryModel(attempt.model), reasoningEffort: primaryThinkingLevel };
-              continue;
+        const emitFailure = () => {
+          if (!committed) {
+            if (buffer.length > 0) {
+              flush(buffer);
+            } else {
+              output.push({ type: "start", partial: freshMessage(attempt.model) });
+              committed = true;
             }
           }
-        }
-
-        if (!committed) {
-          if (buffer.length > 0) {
-            flush(buffer);
+          if (failureEvent) {
+            output.push(failureEvent);
           } else {
+            const error = freshMessage(attempt.model);
+            error.stopReason = "error";
+            error.errorMessage = failureMessage;
+            output.push({ type: "error", reason: "error", error });
+          }
+          output.end();
+        };
+
+        const emitAborted = () => {
+          if (!committed) {
             output.push({ type: "start", partial: freshMessage(attempt.model) });
             committed = true;
           }
-        }
-        if (nonRetryableError.event) {
-          output.push(nonRetryableError.event);
-        } else {
           const error = freshMessage(attempt.model);
-          error.stopReason = "error";
-          error.errorMessage = nonRetryableError.message;
-          output.push({ type: "error", reason: "error", error });
-        }
-        output.end();
-        return;
-      }
+          error.stopReason = "aborted";
+          error.errorMessage = "Request aborted while retrying after error.";
+          output.push({ type: "error", reason: "aborted", error });
+          output.end();
+        };
 
-      if (!retryable) {
-        if (allowFallback && !committed) {
-          const message = "Provider stream ended without a terminal event.";
-          rememberNonRetryableFailure(attempt.model, message);
-          const next = nextAvailableCandidate(attempt.model);
-          if (next) {
-            attempt = next;
-            continue;
-          }
-        }
+        // Nothing has been streamed yet: give the same model a few quick retries
+        // before we freeze it or fall back. This rides out transient failures
+        // that aren't recognised as retryable (stalls, odd 5xx, malformed
+        // errors) instead of immediately freezing the model for an hour.
         if (!committed) {
-          if (buffer.length > 0) {
-            flush(buffer);
-          } else {
-            output.push({ type: "start", partial: freshMessage(attempt.model) });
-            committed = true;
+          const key = modelKey(attempt.model);
+          const attempts = (nonRetryableAttempts.get(key) ?? 0) + 1;
+          nonRetryableAttempts.set(key, attempts);
+
+          if (attempts < nonRetryableMaxAttempts) {
+            const waitResult = await waitForRetry("retry", nonRetryableRetryDelayMs, options?.signal);
+            if (waitResult === "aborted") {
+              emitAborted();
+              return;
+            }
+            continue; // retry the same model
+          }
+
+          // Retries for this model are exhausted.
+          triedModels.add(key);
+
+          if (allowFallback) {
+            if (freezingEnabled()) {
+              rememberNonRetryableFailure(attempt.model, failureMessage);
+              const next = nextAvailableCandidate(attempt.model);
+              if (next) {
+                attempt = next;
+                continue;
+              }
+
+              const deadline = earliestCandidateDeadline(attempt.model);
+              if (deadline) {
+                const waitResult = await waitForRetry("model-frozen", Math.max(0, deadline - Date.now()), options?.signal);
+                if (waitResult !== "aborted") {
+                  attempt = nextAvailableCandidate(attempt.model) ?? { model: getPrimaryModel(attempt.model), reasoningEffort: primaryThinkingLevel };
+                  continue;
+                }
+              }
+            } else {
+              // Freezing disabled: walk through the remaining configured
+              // candidates (without freezing) and only give up once they are
+              // all exhausted. Never block on a long "model-frozen" wait.
+              const next = candidateOrder(attempt.model).find((entry) => !triedModels.has(modelKey(entry.model)));
+              if (next) {
+                attempt = next;
+                continue;
+              }
+            }
           }
         }
-        const error = freshMessage(attempt.model);
-        error.stopReason = "error";
-        error.errorMessage = "Provider stream ended without a terminal event.";
-        output.push({ type: "error", reason: "error", error });
-        output.end();
+
+        emitFailure();
         return;
       }