oira666_pi-limits-wait 0.6.6 → 0.6.7

package/README.md

@@ -12,11 +12,13 @@ pi install npm:oira666_pi-limits-wait
 
 Restart Pi or run `/reload` after installing.
 
+Tested against Pi 1.4.0.
+
 ## What it does
 
-- Targets Pi 0.80.10+ (developed and tested against Pi 0.83.0) and works with model providers that use `ModelRuntime.streamSimple`.
+- Works with model providers that use `ModelRuntime.streamSimple`.
 - Intercepts the current runtime without registering synthetic providers; every retry and fallback re-enters Pi's normal provider/auth/base URL/configured-header composition, including OAuth refresh checks.
-- On Pi 0.86+, stops background cache warming via `cache_warming_decision` while retry interception is enabled, preventing background refreshes from triggering foreground retries or fallbacks. Normal request caching is unchanged. With `PI_LIMITS_WAIT_DISABLE_ALL_WAITING=true`, Pi's cache-warming policy is left untouched. As with any handler for this event, a later extension can override the decision.
+- Stops background cache warming via `cache_warming_decision` while retry interception is enabled, preventing background refreshes from triggering foreground retries or fallbacks. Normal request caching is unchanged. With `PI_LIMITS_WAIT_DISABLE_ALL_WAITING=true`, Pi's cache-warming policy is left untouched. As with any handler for this event, a later extension can override the decision.
 - Reload-safe ownership ensures `/reload` transfers interception cleanly and aborts waits still owned by the previous extension instance. The interception has one process-global active extension owner, matching the interactive Pi CLI's single active session runtime lifecycle; SDK processes running multiple concurrent Pi sessions are not supported.
 - On rate-limit errors (`429`, `rate_limit`, `too many requests`, quota/reset messages), waits and retries in a loop.
 - Remembers provider retry timing exposed through response callbacks or provider errors (`retry-after`, `retry-after-ms`, `retry in ...`, reset messages). Explicit provider retry/reset deadlines are always honored: no early probes occur during that period (unless a wait is manually skipped).
@@ -24,7 +26,7 @@ Restart Pi or run `/reload` after installing.
 - On `server_is_overloaded`, waits 5 minutes, then retries. If the provider is still overloaded after Pi's normal retries, it waits another 5 minutes and repeats.
 - On transient network/transport failures — including undici idle-timeout aborts (`UND_ERR_HEADERS_TIMEOUT` / `UND_ERR_BODY_TIMEOUT`), `fetch failed`, `terminated`, `ECONNRESET`, `ETIMEDOUT`, etc. — treats the error as retryable with a short backoff (default 15s, or the provider's `retry-after`) instead of giving up. This prevents a stalled streaming request from turning into a silent hang.
 - Leaves context-overflow recovery entirely to Pi. The extension uses Pi's own `isContextOverflow()` detector and immediately surfaces matching failures without waiting, retrying, or selecting another fallback. If the overflow came from a fallback already attempted for the request, the extension makes that attempted model current when Pi is still on the request's original model and accepts the switch; it never overrides a newer user model selection. Pi intentionally ignores overflow errors from non-current models. Successful over-window responses and zero-output length stops also pass through unchanged, allowing Pi to compact and perform its built-in recovery.
-- For any other (unclassified) provider error — including an API `Internal server error` and HTTP `400`/`403` failures — waits and retries the same model. There is deliberately no permanent-HTTP-status allowlist. This retry-all behavior is enabled by default and uses a configurable retry limit and interval; it does not alter model-limit wait intervals.
+- For any other (unclassified) provider error — including an API `Internal server error` and HTTP `400`/`403` failures — waits and retries the same model. There is deliberately no permanent-HTTP-status allowlist. This retry-all behavior is enabled by default and uses a configurable retry limit and interval; it does not alter model-limit wait intervals. ChatGPT Business workspace-admin usage limits use this bounded policy, even when accompanied by HTTP `429` or `Retry-After`, rather than an endless timed-limit loop. Disable `PI_LIMITS_WAIT_DEFAULT_WAITING` to surface them immediately, matching Pi's non-retryable classification; the provider's admin guidance is preserved.
 - Reports retry/fallback waits in chat notifications without adding persistent TUI status lines.
 - In non-interactive hosts (`rpc` and `json` modes) the extension never reports a planned retry as an error. While it is waiting to retry, it publishes `info`-level liveliness notifications (plus a `setStatus` entry) describing what it is doing, how long it will wait, and why. An `error`-level notification is emitted only when the extension stops retrying and surfaces the terminal failure. See [Non-interactive (RPC) reporting](#non-interactive-rpc-reporting).
 - During a wait, pressing Enter in an empty editor retries immediately. Typed commands, autocomplete, and model-picker navigation still work normally. Choosing another model with `/model` immediately ends the pending wait and tries that exact model, even if it was previously marked unavailable.
@@ -34,9 +36,17 @@ Restart Pi or run `/reload` after installing.
 
 ### Unsupported interception limitation
 
-Pi 0.83 has no public stream middleware that can intercept a failed provider stream, wait, and re-enter `ModelRuntime` for another attempt. For that reason, limits-wait still installs a reload-safe trampoline on `ModelRuntime.prototype.streamSimple`. This is an unsupported internal interception point and could require changes when Pi changes `ModelRuntime`; it also assumes the interactive CLI's one active session runtime per process. SDK processes with multiple concurrent Pi sessions are not supported.
+Pi 1.4.0 has no public stream middleware that can intercept a failed provider stream, wait, and re-enter `ModelRuntime` for another attempt. For that reason, limits-wait still installs a reload-safe trampoline on `ModelRuntime.prototype.streamSimple`. This is an unsupported internal interception point and could require changes when Pi changes `ModelRuntime`; it also assumes the interactive CLI's one active session runtime per process. SDK processes with multiple concurrent Pi sessions are not supported.
+
+`after_provider_response` is preserved for observers, but cannot replace stream-error interception or own retry/fallback control flow. Pi 1.4.0 also does not expose the active header dispatcher to extensions. To preserve `before_provider_headers` on different-model fallbacks without replaying arbitrary source-bound `transformHeaders` closures, limits-wait intercepts exported `ExtensionRunner.prototype.createContext` to associate the active registry with its runner, then calls `emitBeforeProviderHeaders` on freshly resolved target headers. This is another unsupported integration point, isolated in `src/header-dispatch.ts`. Target auth, endpoint, configured headers and native client attribution remain runtime-owned; hook insertions and `null` deletions apply to the target, including attribution assembled after the hook. Client identity and provider-stream instrumentation are retained across fallback. Standalone SDK calls without an active extension runner still discard source transforms.
+
+## Compatibility tests
+
+Run `npm test`, `npm run test:e2e`, and `npm run pack:check`. There is no separate build or lint task; `npm test` includes the strict TypeScript check.
+
+`test:e2e` requires `PI_EVERGREEN_PI_BIN` pointing to the installed global Pi executable. It explicitly loads this checkout and never installs a CLI. Loopback HTTP tests use dummy OAuth-shaped credentials in an isolated agent directory and exercise retries, tools, prompt changes, manual/overflow compaction, abort, session replacement, and reload. They also verify real cross-provider fallback headers (target insertion/deletion, native attribution, source-secret exclusion and parsed-stream events) across multiple turns and lifecycle transitions, plus OpenAI Responses workspace limits with retry-all enabled/disabled and Pi auto-retry enabled. A negative control without the extension proves the transport assertions detect prompt leaks.
 
-`after_provider_response` is preserved for observers, but it is not an equivalent retry hook: it cannot replace stream-error interception, own retry/fallback control flow, or recreate a complete target-model request. In particular, Pi 0.83 still does not expose a public factory for rebuilding the SDK's target-model-aware `transformHeaders` callback. Reusing the source request's closure on a fallback would apply source-model attribution and could leak extension-added headers, so limits-wait intentionally omits it for every different-model fallback. The target `ModelRuntime` still resolves target auth, base URL, configured provider/model headers, environment, and provider implementation canonically, but `before_provider_headers` cannot be re-fired for that fallback through the current public API.
+The required live two-turn smoke uses normal Pi authentication without reading credential files. Configure it with `PI_EVERGREEN_E2E_PROVIDER`, `PI_EVERGREEN_E2E_MODEL`, and `PI_EVERGREEN_E2E_REASONING` (defaults: `openai`, `gpt-6-luna`, `medium`). It captures request bodies, never auth headers, and removes its repository-local temporary artifacts afterward. Missing CLI or model access fails the suite rather than skipping coverage.
 
 ## Non-interactive (RPC) reporting
 
@@ -267,6 +277,19 @@ The extension rereads these files before every LLM call, so changes made during
 | `PI_LIMITS_WAIT_RETRY_INTERVAL` | `5` | Seconds to wait between unclassified/unknown provider-error retries. Must be a non-negative integer (values above 2147483 are capped to Node's maximum reliable timer delay). This does not affect model-limit wait intervals. |
 | `PI_LIMITS_WAIT_FREEZING_ENABLED` | `true` | When a model keeps failing with a non-retryable error, it is normally "frozen" for 10 minutes and skipped in favour of other configured models. Set this to `false` (also accepts `0`, `no`, `off`) to disable freezing entirely: the extension will instead try each configured candidate once (after the bounded retries) and then surface the error, never blocking on a long "model-frozen" wait. Useful for non-interactive / subagent runs where no one can press Enter to skip. |
 
+## Development
+
+```sh
+npm ci
+mkdir -p tmp
+TMPDIR="$PWD/tmp" npm test
+npm run pack:check
+```
+
+`npm test` installs the direct Pi development dependencies at `@latest` with install scripts disabled, then runs `npm run check` and the tests. Tests target only the latest npm Pi release. Before each release, update the tested version above and the Pi peer dependency baseline after all checks pass. No lint command is configured.
+
+Tests cover retries against a local HTTP server and editor focus/key routing. They do not call live model providers or separately execute README snippets.
+
 ## License
 
 MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oira666_pi-limits-wait",
-  "version": "0.6.6",
+  "version": "0.6.7",
   "description": "Extension for PI that allows to automatically wait for limits to reset and retry the request",
   "type": "module",
   "exports": {
@@ -29,7 +29,9 @@
   },
   "scripts": {
     "check": "tsc -p tsconfig.json --noEmit",
+    "pretest": "npm run check",
     "test": "tsx src/__tests__/test-extension.ts && tsx src/__tests__/test-wait-ui.ts",
+    "test:e2e": "node scripts/test-e2e.mjs",
     "pack:check": "npm pack --dry-run",
     "prepublishOnly": "npm run check && npm test && npm run pack:check"
   },
@@ -38,14 +40,13 @@
       "./src/index.ts"
     ]
   },
-  "dependencies": {},
   "peerDependencies": {
-    "@earendil-works/pi-ai": "*",
-    "@earendil-works/pi-coding-agent": "*"
+    "@earendil-works/pi-ai": ">=1.4.0",
+    "@earendil-works/pi-coding-agent": ">=1.4.0"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "0.83.0",
-    "@earendil-works/pi-coding-agent": "0.83.0",
+    "@earendil-works/pi-ai": "1.4.0",
+    "@earendil-works/pi-coding-agent": "1.4.0",
     "tsx": "^4.20.6",
     "typescript": "^5.9.3"
   }

package/src/header-dispatch.ts

@@ -0,0 +1,35 @@
+import { ExtensionRunner, type ModelRegistry } from "@earendil-works/pi-coding-agent";
+import { state } from "./state.js";
+import type { ModelsSimpleStreamOptions } from "@earendil-works/pi-ai";
+
+// Pi does not expose its header dispatcher to extensions. Recover the runner
+// from the contexts it creates, rather than replaying a source-model closure
+// (which may inject source credentials) against another provider's headers.
+// This exported-class interception is unsupported; keep it isolated and cover
+// actual CLI fallback, reload and session replacement at the transport boundary.
+const SLOT = Symbol.for("oira666.pi-limits-wait.header-dispatch.v1");
+interface DispatchSlot {
+  runners: WeakMap<ModelRegistry, ExtensionRunner>;
+  wrapper: ExtensionRunner["createContext"];
+}
+type RunnerPrototype = ExtensionRunner & { [SLOT]?: DispatchSlot };
+
+export function installHeaderDispatch(): void {
+  const prototype = ExtensionRunner.prototype as RunnerPrototype;
+  if (prototype[SLOT]?.wrapper === prototype.createContext) return;
+  const previous = prototype.createContext;
+  const runners = new WeakMap<ModelRegistry, ExtensionRunner>();
+  const wrapper = function (this: ExtensionRunner) {
+    const context = previous.call(this);
+    runners.set(context.modelRegistry, this);
+    return context;
+  };
+  Object.defineProperty(prototype, SLOT, { configurable: true, value: { runners, wrapper } });
+  prototype.createContext = wrapper;
+}
+
+export function fallbackHeaderTransform(): ModelsSimpleStreamOptions["transformHeaders"] {
+  const registry = state.sharedCtx?.modelRegistry;
+  const runner = registry && (ExtensionRunner.prototype as RunnerPrototype)[SLOT]?.runners.get(registry);
+  return runner ? (headers) => runner.emitBeforeProviderHeaders(headers) : undefined;
+}

package/src/index.ts

@@ -117,13 +117,8 @@ export default function (pi: ExtensionAPI) {
   const retrySummaries = new RetrySummaryCoordinator(pi);
   const releaseInterception = installModelRuntimeInterception(() => retrySummaries.createStream());
 
-  // Pi 0.86+ warms caches through the same runtime as foreground requests.
-  // Stop background refreshes before they can enter our retry/fallback logic.
-  // Keep the older Pi dependency range: its event registry accepts this hook
-  // but never emits it. The narrow overload bridges the pre-0.86 typings.
-  (pi as ExtensionAPI & {
-    on(event: "cache_warming_decision", handler: () => { action: "stop" }): void;
-  }).on("cache_warming_decision", () => ({ action: "stop" }));
+  // Background refreshes must not enter foreground retry/fallback logic.
+  pi.on("cache_warming_decision", () => ({ action: "stop" }));
 
   pi.on("session_start", (event, ctx) => {
     state.sharedCtx = ctx;

package/src/retry-errors.ts

@@ -215,6 +215,11 @@ export function retryAfterHeaderMs(headers: Headers): number | undefined {
 }
 
 export function getRetryableError(msg: string): RetryableError | undefined {
+  // Business workspace limits require an administrator, not a timed reset.
+  // Keep retry-all configurable, but use its bounded unknown-error budget even
+  // when transport metadata adds HTTP 429 / Retry-After to the provider text.
+  if (msg.includes("subscription_sharing_workplace_individual_usage_limit_exceeded")
+    || msg.includes("You've reached your ChatGPT workspace's usage limit.")) return undefined;
   if (isServerOverloadedError(msg)) {
     return { reason: "overloaded", waitMs: parseRetryDelayMs(msg) ?? DEFAULT_OVERLOADED_WAIT_MS };
   }

package/src/stream.ts

@@ -34,6 +34,7 @@ import {
   switchPiModel,
 } from "./models.js";
 import { withAttemptResponseObserver } from "./response-observer.js";
+import { fallbackHeaderTransform, installHeaderDispatch } from "./header-dispatch.js";
 import { errorMessageWithCauses, getRetryableError, isAbortMessage, parseRetryDelayMs, retryAfterHeaderMs } from "./retry-errors.js";
 import type { RetryPeriodTracker } from "./retry-summary.js";
 import { loadFallbackSettings } from "./settings.js";
@@ -166,6 +167,11 @@ function attemptOptions(
     signal,
     onPayload,
     onResponse,
+    // Dispatch the host's hooks on freshly resolved TARGET headers. Do not
+    // replay options.transformHeaders: arbitrary SDK callers may bind secrets.
+    transformHeaders: fallbackHeaderTransform(),
+    identity: options?.identity,
+    onProviderStreamEvent: options?.onProviderStreamEvent,
     cacheRetention: options?.cacheRetention,
     sessionId: options?.sessionId,
     timeoutMs: options?.timeoutMs,
@@ -815,6 +821,7 @@ export function disableModelRuntimeInterception(): void {
 export function installModelRuntimeInterception(
   createRetryPeriod?: () => RetryPeriodTracker,
 ): () => boolean {
+  installHeaderDispatch();
   const prototype = ModelRuntime.prototype as InterceptablePrototype;
   const owner = {};
   const controller = new AbortController();