oira666_pi-limits-wait 0.6.6 → 0.6.8

package/README.md

@@ -12,11 +12,13 @@ pi install npm:oira666_pi-limits-wait
 
 Restart Pi or run `/reload` after installing.
 
+Tested against Pi 1.4.0.
+
 ## What it does
 
-- Targets Pi 0.80.10+ (developed and tested against Pi 0.83.0) and works with model providers that use `ModelRuntime.streamSimple`.
+- Works with model providers that use `ModelRuntime.streamSimple`.
 - Intercepts the current runtime without registering synthetic providers; every retry and fallback re-enters Pi's normal provider/auth/base URL/configured-header composition, including OAuth refresh checks.
-- On Pi 0.86+, stops background cache warming via `cache_warming_decision` while retry interception is enabled, preventing background refreshes from triggering foreground retries or fallbacks. Normal request caching is unchanged. With `PI_LIMITS_WAIT_DISABLE_ALL_WAITING=true`, Pi's cache-warming policy is left untouched. As with any handler for this event, a later extension can override the decision.
+- Stops background cache warming via `cache_warming_decision` while retry interception is enabled, preventing background refreshes from triggering foreground retries or fallbacks. Normal request caching is unchanged. With `PI_LIMITS_WAIT_DISABLE_ALL_WAITING=true`, Pi's cache-warming policy is left untouched. As with any handler for this event, a later extension can override the decision.
 - Reload-safe ownership ensures `/reload` transfers interception cleanly and aborts waits still owned by the previous extension instance. The interception has one process-global active extension owner, matching the interactive Pi CLI's single active session runtime lifecycle; SDK processes running multiple concurrent Pi sessions are not supported.
 - On rate-limit errors (`429`, `rate_limit`, `too many requests`, quota/reset messages), waits and retries in a loop.
 - Remembers provider retry timing exposed through response callbacks or provider errors (`retry-after`, `retry-after-ms`, `retry in ...`, reset messages). Explicit provider retry/reset deadlines are always honored: no early probes occur during that period (unless a wait is manually skipped).
@@ -24,7 +26,7 @@ Restart Pi or run `/reload` after installing.
 - On `server_is_overloaded`, waits 5 minutes, then retries. If the provider is still overloaded after Pi's normal retries, it waits another 5 minutes and repeats.
 - On transient network/transport failures — including undici idle-timeout aborts (`UND_ERR_HEADERS_TIMEOUT` / `UND_ERR_BODY_TIMEOUT`), `fetch failed`, `terminated`, `ECONNRESET`, `ETIMEDOUT`, etc. — treats the error as retryable with a short backoff (default 15s, or the provider's `retry-after`) instead of giving up. This prevents a stalled streaming request from turning into a silent hang.
 - Leaves context-overflow recovery entirely to Pi. The extension uses Pi's own `isContextOverflow()` detector and immediately surfaces matching failures without waiting, retrying, or selecting another fallback. If the overflow came from a fallback already attempted for the request, the extension makes that attempted model current when Pi is still on the request's original model and accepts the switch; it never overrides a newer user model selection. Pi intentionally ignores overflow errors from non-current models. Successful over-window responses and zero-output length stops also pass through unchanged, allowing Pi to compact and perform its built-in recovery.
-- For any other (unclassified) provider error — including an API `Internal server error` and HTTP `400`/`403` failures — waits and retries the same model. There is deliberately no permanent-HTTP-status allowlist. This retry-all behavior is enabled by default and uses a configurable retry limit and interval; it does not alter model-limit wait intervals.
+- For any other (unclassified) provider error — including an API `Internal server error` and HTTP `400`/`403` failures — waits and retries the same model. There is deliberately no permanent-HTTP-status allowlist. This retry-all behavior is enabled by default and uses a configurable retry limit and interval; it does not alter model-limit wait intervals. ChatGPT Business workspace-admin usage limits use this bounded policy, even when accompanied by HTTP `429` or `Retry-After`, rather than an endless timed-limit loop. Disable `PI_LIMITS_WAIT_DEFAULT_WAITING` to surface them immediately, matching Pi's non-retryable classification; the provider's admin guidance is preserved.
 - Reports retry/fallback waits in chat notifications without adding persistent TUI status lines.
 - In non-interactive hosts (`rpc` and `json` modes) the extension never reports a planned retry as an error. While it is waiting to retry, it publishes `info`-level liveliness notifications (plus a `setStatus` entry) describing what it is doing, how long it will wait, and why. An `error`-level notification is emitted only when the extension stops retrying and surfaces the terminal failure. See [Non-interactive (RPC) reporting](#non-interactive-rpc-reporting).
 - During a wait, pressing Enter in an empty editor retries immediately. Typed commands, autocomplete, and model-picker navigation still work normally. Choosing another model with `/model` immediately ends the pending wait and tries that exact model, even if it was previously marked unavailable.
@@ -34,9 +36,21 @@ Restart Pi or run `/reload` after installing.
 
 ### Unsupported interception limitation
 
-Pi 0.83 has no public stream middleware that can intercept a failed provider stream, wait, and re-enter `ModelRuntime` for another attempt. For that reason, limits-wait still installs a reload-safe trampoline on `ModelRuntime.prototype.streamSimple`. This is an unsupported internal interception point and could require changes when Pi changes `ModelRuntime`; it also assumes the interactive CLI's one active session runtime per process. SDK processes with multiple concurrent Pi sessions are not supported.
+Pi 1.4.0 has no public stream middleware that can intercept a failed provider stream, wait, and re-enter `ModelRuntime` for another attempt. For that reason, limits-wait still installs a reload-safe trampoline on `ModelRuntime.prototype.streamSimple`. This is an unsupported internal interception point and could require changes when Pi changes `ModelRuntime`; it also assumes the interactive CLI's one active session runtime per process. SDK processes with multiple concurrent Pi sessions are not supported.
+
+`after_provider_response` is preserved for observers, but cannot replace stream-error interception or own retry/fallback control flow. Pi 1.4.0 also does not expose the active header dispatcher to extensions. To preserve `before_provider_headers` on different-model fallbacks without replaying arbitrary source-bound `transformHeaders` closures, limits-wait intercepts exported `ExtensionRunner.prototype.createContext` to associate the active registry with its runner, then calls `emitBeforeProviderHeaders` on freshly resolved target headers. This is another unsupported integration point, isolated in `src/header-dispatch.ts`. Target auth, endpoint, configured headers and native client attribution remain runtime-owned; hook insertions and `null` deletions apply to the target, including attribution assembled after the hook. Client identity and provider-stream instrumentation are retained across fallback. Standalone SDK calls without an active extension runner still discard source transforms.
+
+## Compatibility tests
+
+Run `npm run test:evergreen` for the strict TypeScript check, unit tests, integration tests, and required global-CLI e2e tests. Also run `npm run pack:check` before release. There is no separate build or lint task.
+
+Evergreen e2e uses `$EVERGREEN_PI_BIN` (or `pi` on PATH) with stdin ignored. Set `$EVERGREEN_E2E_MODEL` to the live model, e.g. `openai-codex/gpt-6-luna:low`. It exercises a real rate-limit/retry transport, OAuth prompt cleaning, the kill switch, durable retry summaries outside model context, session resume, and a live two-turn conversation using normal Pi authentication. Missing CLI or model access fails rather than skips. Temporary sessions are removed afterward. See [EVERGREEN.md](EVERGREEN.md) for the intent and compatibility risks.
+
+The separate `npm run test:e2e` suite is a legacy RPC diagnostic; unlike Evergreen's print-mode tests it requires a command pipe on stdin.
 
-`after_provider_response` is preserved for observers, but it is not an equivalent retry hook: it cannot replace stream-error interception, own retry/fallback control flow, or recreate a complete target-model request. In particular, Pi 0.83 still does not expose a public factory for rebuilding the SDK's target-model-aware `transformHeaders` callback. Reusing the source request's closure on a fallback would apply source-model attribution and could leak extension-added headers, so limits-wait intentionally omits it for every different-model fallback. The target `ModelRuntime` still resolves target auth, base URL, configured provider/model headers, environment, and provider implementation canonically, but `before_provider_headers` cannot be re-fired for that fallback through the current public API.
+`test:e2e` requires `PI_EVERGREEN_PI_BIN` pointing to the installed global Pi executable. It explicitly loads this checkout and never installs a CLI. Loopback HTTP tests use dummy OAuth-shaped credentials in an isolated agent directory and exercise retries, tools, prompt changes, manual/overflow compaction, abort, session replacement, and reload. They also verify real cross-provider fallback headers (target insertion/deletion, native attribution, source-secret exclusion and parsed-stream events) across multiple turns and lifecycle transitions, plus OpenAI Responses workspace limits with retry-all enabled/disabled and Pi auto-retry enabled. A negative control without the extension proves the transport assertions detect prompt leaks.
+
+The required live two-turn smoke uses normal Pi authentication without reading credential files. Configure it with `PI_EVERGREEN_E2E_PROVIDER`, `PI_EVERGREEN_E2E_MODEL`, and `PI_EVERGREEN_E2E_REASONING` (defaults: `openai`, `gpt-6-luna`, `medium`). It captures request bodies, never auth headers, and removes its repository-local temporary artifacts afterward. Missing CLI or model access fails the suite rather than skipping coverage.
 
 ## Non-interactive (RPC) reporting
 
@@ -267,6 +281,19 @@ The extension rereads these files before every LLM call, so changes made during
 | `PI_LIMITS_WAIT_RETRY_INTERVAL` | `5` | Seconds to wait between unclassified/unknown provider-error retries. Must be a non-negative integer (values above 2147483 are capped to Node's maximum reliable timer delay). This does not affect model-limit wait intervals. |
 | `PI_LIMITS_WAIT_FREEZING_ENABLED` | `true` | When a model keeps failing with a non-retryable error, it is normally "frozen" for 10 minutes and skipped in favour of other configured models. Set this to `false` (also accepts `0`, `no`, `off`) to disable freezing entirely: the extension will instead try each configured candidate once (after the bounded retries) and then surface the error, never blocking on a long "model-frozen" wait. Useful for non-interactive / subagent runs where no one can press Enter to skip. |
 
+## Development
+
+```sh
+npm ci
+mkdir -p tmp
+TMPDIR="$PWD/tmp" npm test
+npm run pack:check
+```
+
+`npm test` runs `npm run check` and the tests against the installed development dependencies. Tests target only the latest npm Pi release; update the pinned Pi development dependencies before testing a newer release. Before each release, update the tested version above and the Pi peer dependency baseline after all checks pass. No lint command is configured.
+
+`npm test` covers retries against a local HTTP server and editor focus/key routing without live model calls. `npm run test:evergreen` adds integration and live global-CLI e2e coverage; README snippets are not separately executed.
+
 ## License
 
 MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oira666_pi-limits-wait",
-  "version": "0.6.6",
+  "version": "0.6.8",
   "description": "Extension for PI that allows to automatically wait for limits to reset and retry the request",
   "type": "module",
   "exports": {
@@ -29,7 +29,12 @@
   },
   "scripts": {
     "check": "tsc -p tsconfig.json --noEmit",
+    "pretest": "npm run check",
     "test": "tsx src/__tests__/test-extension.ts && tsx src/__tests__/test-wait-ui.ts",
+    "test:e2e": "node scripts/test-e2e.mjs",
+    "test:integration": "tsx src/__tests__/test-integration.ts",
+    "test:e2e:evergreen": "node scripts/test-evergreen-e2e.mjs",
+    "test:evergreen": "npm test && npm run test:integration && npm run test:e2e:evergreen",
     "pack:check": "npm pack --dry-run",
     "prepublishOnly": "npm run check && npm test && npm run pack:check"
   },
@@ -38,14 +43,13 @@
       "./src/index.ts"
     ]
   },
-  "dependencies": {},
   "peerDependencies": {
-    "@earendil-works/pi-ai": "*",
-    "@earendil-works/pi-coding-agent": "*"
+    "@earendil-works/pi-ai": ">=1.4.0",
+    "@earendil-works/pi-coding-agent": ">=1.4.0"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "0.83.0",
-    "@earendil-works/pi-coding-agent": "0.83.0",
+    "@earendil-works/pi-ai": "1.4.0",
+    "@earendil-works/pi-coding-agent": "1.4.0",
     "tsx": "^4.20.6",
     "typescript": "^5.9.3"
   }

package/src/constants.ts

@@ -43,7 +43,7 @@ export const DEFAULT_LIVELINESS_INTERVAL_MS = 15 * 1_000; // 15 seconds
 export const LIVELINESS_JSON_STATUS_KEY = "oira666.pi-limits-wait.json";
 /** Payload schema version for LIVELINESS_JSON_STATUS_KEY. Bump only on a breaking change. */
 export const LIVELINESS_JSON_VERSION = 1;
-export const EXTENSION_VERSION = "0.6.6";
+export const EXTENSION_VERSION = "0.6.8";
 
 export const SETTINGS_FILE_NAME = "limits-wait.json";
 export const FALLBACK_MODELS_KEY = "fallback-models";

package/src/header-dispatch.ts

@@ -0,0 +1,35 @@
+import { ExtensionRunner, type ModelRegistry } from "@earendil-works/pi-coding-agent";
+import { state } from "./state.js";
+import type { ModelsSimpleStreamOptions } from "@earendil-works/pi-ai";
+
+// Pi does not expose its header dispatcher to extensions. Recover the runner
+// from the contexts it creates, rather than replaying a source-model closure
+// (which may inject source credentials) against another provider's headers.
+// This exported-class interception is unsupported; keep it isolated and cover
+// actual CLI fallback, reload and session replacement at the transport boundary.
+const SLOT = Symbol.for("oira666.pi-limits-wait.header-dispatch.v1");
+interface DispatchSlot {
+  runners: WeakMap<ModelRegistry, ExtensionRunner>;
+  wrapper: ExtensionRunner["createContext"];
+}
+type RunnerPrototype = ExtensionRunner & { [SLOT]?: DispatchSlot };
+
+export function installHeaderDispatch(): void {
+  const prototype = ExtensionRunner.prototype as RunnerPrototype;
+  if (prototype[SLOT]?.wrapper === prototype.createContext) return;
+  const previous = prototype.createContext;
+  const runners = new WeakMap<ModelRegistry, ExtensionRunner>();
+  const wrapper = function (this: ExtensionRunner) {
+    const context = previous.call(this);
+    runners.set(context.modelRegistry, this);
+    return context;
+  };
+  Object.defineProperty(prototype, SLOT, { configurable: true, value: { runners, wrapper } });
+  prototype.createContext = wrapper;
+}
+
+export function fallbackHeaderTransform(): ModelsSimpleStreamOptions["transformHeaders"] {
+  const registry = state.sharedCtx?.modelRegistry;
+  const runner = registry && (ExtensionRunner.prototype as RunnerPrototype)[SLOT]?.runners.get(registry);
+  return runner ? (headers) => runner.emitBeforeProviderHeaders(headers) : undefined;
+}

package/src/index.ts

@@ -117,13 +117,8 @@ export default function (pi: ExtensionAPI) {
   const retrySummaries = new RetrySummaryCoordinator(pi);
   const releaseInterception = installModelRuntimeInterception(() => retrySummaries.createStream());
 
-  // Pi 0.86+ warms caches through the same runtime as foreground requests.
-  // Stop background refreshes before they can enter our retry/fallback logic.
-  // Keep the older Pi dependency range: its event registry accepts this hook
-  // but never emits it. The narrow overload bridges the pre-0.86 typings.
-  (pi as ExtensionAPI & {
-    on(event: "cache_warming_decision", handler: () => { action: "stop" }): void;
-  }).on("cache_warming_decision", () => ({ action: "stop" }));
+  // Background refreshes must not enter foreground retry/fallback logic.
+  pi.on("cache_warming_decision", () => ({ action: "stop" }));
 
   pi.on("session_start", (event, ctx) => {
     state.sharedCtx = ctx;

package/src/retry-errors.ts

@@ -51,6 +51,8 @@ export function isTransientNetworkError(msg: string): boolean {
     lower.includes("terminated") ||
     lower.includes("socket hang up") ||
     lower.includes("other side closed") ||
+    /websocket closed 1006\b/.test(lower) ||
+    lower.includes("connection ended") ||
     lower.includes("network_error") ||
     lower.includes("network error") ||
     lower.includes("econnreset") ||
@@ -215,6 +217,11 @@ export function retryAfterHeaderMs(headers: Headers): number | undefined {
 }
 
 export function getRetryableError(msg: string): RetryableError | undefined {
+  // Business workspace limits require an administrator, not a timed reset.
+  // Keep retry-all configurable, but use its bounded unknown-error budget even
+  // when transport metadata adds HTTP 429 / Retry-After to the provider text.
+  if (msg.includes("subscription_sharing_workplace_individual_usage_limit_exceeded")
+    || msg.includes("You've reached your ChatGPT workspace's usage limit.")) return undefined;
   if (isServerOverloadedError(msg)) {
     return { reason: "overloaded", waitMs: parseRetryDelayMs(msg) ?? DEFAULT_OVERLOADED_WAIT_MS };
   }

package/src/stream.ts

@@ -34,6 +34,7 @@ import {
   switchPiModel,
 } from "./models.js";
 import { withAttemptResponseObserver } from "./response-observer.js";
+import { fallbackHeaderTransform, installHeaderDispatch } from "./header-dispatch.js";
 import { errorMessageWithCauses, getRetryableError, isAbortMessage, parseRetryDelayMs, retryAfterHeaderMs } from "./retry-errors.js";
 import type { RetryPeriodTracker } from "./retry-summary.js";
 import { loadFallbackSettings } from "./settings.js";
@@ -166,6 +167,11 @@ function attemptOptions(
     signal,
     onPayload,
     onResponse,
+    // Dispatch the host's hooks on freshly resolved TARGET headers. Do not
+    // replay options.transformHeaders: arbitrary SDK callers may bind secrets.
+    transformHeaders: fallbackHeaderTransform(),
+    identity: options?.identity,
+    onProviderStreamEvent: options?.onProviderStreamEvent,
     cacheRetention: options?.cacheRetention,
     sessionId: options?.sessionId,
     timeoutMs: options?.timeoutMs,
@@ -815,6 +821,7 @@ export function disableModelRuntimeInterception(): void {
 export function installModelRuntimeInterception(
   createRetryPeriod?: () => RetryPeriodTracker,
 ): () => boolean {
+  installHeaderDispatch();
   const prototype = ModelRuntime.prototype as InterceptablePrototype;
   const owner = {};
   const controller = new AbortController();