pi-multi-account 1.0.0 → 1.1.0

package/CHANGELOG.md

@@ -5,6 +5,37 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.0] - 2026-06-10
+
+### Fixed
+
+- **Runaway failover loop that could freeze the machine.** When every account was
+  rate-limited the rotation ping-ponged between accounts every 1–9s indefinitely,
+  growing session history until the system swapped itself to death. The
+  auto-continue counter was reset on every agent start, so `maxAutoContinuesPerPrompt`
+  never actually bounded the loop. The counter is now reset only by a genuine new
+  user prompt, making the cap a real per-task limit.
+- **Escape did not stop the loop.** Auto-continuation ran from background event
+  hooks and a timer, so cancelling the agent was immediately undone. User aborts
+  (`stopReason: "aborted"` / `ctx.signal`) now stop the chain and cancel all timers.
+
+### Added
+
+- Anti-ping-pong guard: immediate failover only switches to an account usable right
+  now and never bounces straight back to the account it just left within 60s.
+- Minimum 15s spacing between auto-continuations (no tight CPU/network loop, and a
+  real window for Esc to take effect).
+- In-session auto-resume: when the whole fallback circle is exhausted, the extension
+  waits and continues the agent's work as soon as any account recovers — for as long
+  as the session stays open.
+
+### Changed
+
+- **Tight session binding.** Background activity is now scoped to the live session:
+  ending or replacing a session (quit, reload, new, resume, fork) cancels all timers
+  and drops any pending resume. A new session starts clean and never inherits a
+  previous session's paused work; nothing survives once Pi exits.
+
 ## [1.0.0] - 2026-06-09
 
 ### Added
@@ -24,4 +55,5 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Plaintext-free credential handling (SHA-256 fingerprints only); `0600`
   config/state files.
 
+[1.1.0]: https://github.com/Sarrius/pi-multi-account/releases/tag/v1.1.0
 [1.0.0]: https://github.com/Sarrius/pi-multi-account/releases/tag/v1.0.0

package/index.ts

@@ -106,6 +106,11 @@ const STATE_VERSION = 3;
 const DEFAULT_COOLDOWN_MS = 6 * 60 * 60 * 1000;
 const DEFAULT_PROBE_COOLDOWN_MS = 5 * 60 * 1000;
 const DEFAULT_INVALID_COOLDOWN_MS = 365 * 24 * 60 * 60 * 1000; // effectively "until re-login"
+// Runaway-loop guards (added). Without these, when every account is rate-limited the
+// failover bounces between accounts every 1-9s forever, growing the session history
+// until the machine swaps itself to death.
+const ANTI_PINGPONG_MS = 60 * 1000; // don't switch straight back to the account we just left
+const MIN_AUTOCONTINUE_INTERVAL_MS = 15 * 1000; // floor between auto-continuations (CPU/network guard)
 
 const ANTHROPIC_BASE = "anthropic";
 const CODEX_BASE = "openai-codex";
@@ -573,6 +578,14 @@ function formatUntil(timestamp: number) {
 	return rest ? `${hours}h ${rest}m` : `${hours}h`;
 }
 
+/** stopReason of the most recent assistant message — "aborted" means the user pressed Esc. */
+function lastAssistantStopReason(messages: any[]): string | undefined {
+	for (let i = messages.length - 1; i >= 0; i--) {
+		if (messages[i]?.role === "assistant") return messages[i]?.stopReason as string | undefined;
+	}
+	return undefined;
+}
+
 function getAssistantErrorText(messages: any[]) {
 	for (let i = messages.length - 1; i >= 0; i--) {
 		const message = messages[i];
@@ -606,10 +619,22 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 	let lastAuthMtime = -1;
 
 	let currentPromptSwitch: SwitchRecord | undefined;
+	// Number of auto-continuations issued for the CURRENT task. Crucially this is NOT
+	// reset by the self-triggered re-prompts failover issues (only by a genuine new user
+	// prompt — see before_agent_start), so config.maxAutoContinuesPerPrompt actually bounds
+	// the failover loop instead of resetting to 0 on every iteration.
 	let autoContinuesThisPrompt = 0;
 	let lastErrorText = "";
 	let latestCtx: any | undefined;
 	let pendingWakeTimer: ReturnType<typeof setTimeout> | undefined;
+	// --- runaway-loop & user-interrupt guards (added) ---
+	let expectingSelfContinuation = false; // true between our sendUserMessage and its agent_start
+	let lastSentContinuationPrompt = ""; // secondary check to recognise our own re-prompt
+	let userAbortedChain = false; // user pressed Esc → stop auto-continuing until a new prompt
+	let lastAutoContinueAt = 0; // for minimum spacing between auto-continuations
+	let autoContinueTimer: ReturnType<typeof setTimeout> | undefined; // pending spaced continuation
+	let lastLeftProvider: string | undefined; // account we just failed away from (anti-ping-pong)
+	let lastLeftAt = 0;
 	// The thinking level the user intended for this turn. pi.setModel() re-clamps and
 	// persists the thinking level on every model switch, so without this it drifts
 	// downward across failovers ("thinking level keeps dropping"). We capture it before
@@ -836,7 +861,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 	 *      cooldown first — i.e. the account that will recover soonest — honoring the
 	 *      per-provider probe interval so we don't hammer a still-limited account.
 	 */
-	function findFallbackModels(ctx: any, currentModel: any) {
+	function findFallbackModels(ctx: any, currentModel: any, options: { availableNowOnly?: boolean } = {}) {
 		const fallbacks = activeFallbacks();
 		if (fallbacks.length === 0) return [];
 
@@ -865,10 +890,21 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 
 		// (1) Anything available right now → soonest-recovered wins (all remaining=0),
 		// deterministic rotation-order tiebreak.
-		const availableNow = scored.filter((s) => s.remaining === 0).sort((a, b) => a.rotIndex - b.rotIndex);
+		let availableNow = scored.filter((s) => s.remaining === 0).sort((a, b) => a.rotIndex - b.rotIndex);
+		// Anti-ping-pong: don't bounce straight back to the account we just left if any
+		// other account is also free right now — that's the loop that freezes the machine.
+		if (lastLeftProvider && now - lastLeftAt < ANTI_PINGPONG_MS && availableNow.length > 1) {
+			availableNow = availableNow.filter((s) => s.model.provider !== lastLeftProvider);
+		}
 		if (availableNow.length > 0) return availableNow.map((s) => s.model);
 
+		// Immediate failover must NEVER switch into a still-exhausted account: that account
+		// would re-fail at once and the rotation would ping-pong forever. When nothing is
+		// available right now, the caller falls back to the delayed pending-resume path.
+		if (options.availableNowOnly) return [];
+
 		// (2) All exhausted → closest-to-recovery first (shortest remaining cooldown).
+		// Only reached by the pending-resume probe, which is rate-limited per provider.
 		const probeable = scored.filter((s) => s.probeReady);
 		const pool = probeable.length > 0 ? probeable : scored;
 		return pool.sort((a, b) => a.remaining - b.remaining || a.rotIndex - b.rotIndex).map((s) => s.model);
@@ -880,16 +916,22 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		if (!currentModel) return false;
 
 		markExhausted(currentModel.provider, cooldownMs);
-		const candidates = findFallbackModels(ctx, currentModel);
+		lastLeftProvider = currentModel.provider;
+		lastLeftAt = Date.now();
+		// Immediate failover only ever switches to an account that is usable RIGHT NOW. If
+		// none is, we don't bounce into an exhausted one — we arm the delayed pending-resume
+		// path, which probes accounts as their cooldowns expire.
+		const candidates = findFallbackModels(ctx, currentModel, { availableNowOnly: true });
 		if (candidates.length === 0) {
 			const cooldowns = [...exhaustedUntilByProvider.entries()]
 				.filter(([, until]) => until > Date.now())
 				.map(([c, until]) => `${c}: ${formatUntil(until)}`)
 				.join(", ");
 			ctx.ui.notify(
-				`Provider failover: no available fallback after ${currentModel.provider}/${currentModel.id}. ${cooldowns ? `Cooldowns: ${cooldowns}` : "All known accounts may be unauthenticated, invalidated, or same account."}`,
+				`Provider failover: no immediately available fallback after ${currentModel.provider}/${currentModel.id}. ${cooldowns ? `Cooldowns: ${cooldowns}` : "All known accounts may be unauthenticated, invalidated, or same account."}`,
 				"warning",
 			);
+			setPendingContinuation(ctx, reason); // wait for an account to recover, then resume
 			return false;
 		}
 
@@ -921,6 +963,37 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		return config.continuationPrompt.replaceAll("{from}", record.from).replaceAll("{to}", record.to).replaceAll("{reason}", record.reason);
 	}
 
+	/** Mark that the next agent run is our own failover continuation, then send it. */
+	function dispatchSelfContinuation(ctx: any, prompt: string) {
+		lastAutoContinueAt = Date.now();
+		lastSentContinuationPrompt = prompt;
+		expectingSelfContinuation = true;
+		pi.sendUserMessage(prompt, ctx.isIdle() ? undefined : { deliverAs: "followUp" });
+	}
+
+	/**
+	 * Send an auto-continuation, but never faster than MIN_AUTOCONTINUE_INTERVAL_MS.
+	 * The spacing keeps a fully rate-limited rotation from pegging CPU/network and gives
+	 * the user a real window in which Esc actually sticks.
+	 */
+	function scheduleAutoContinue(ctx: any, prompt: string) {
+		if (autoContinueTimer) {
+			clearTimeout(autoContinueTimer);
+			autoContinueTimer = undefined;
+		}
+		const wait = Math.max(0, MIN_AUTOCONTINUE_INTERVAL_MS - (Date.now() - lastAutoContinueAt));
+		if (wait === 0) {
+			dispatchSelfContinuation(ctx, prompt);
+			return;
+		}
+		autoContinueTimer = setTimeout(() => {
+			autoContinueTimer = undefined;
+			if (userAbortedChain || ctx.signal?.aborted) return; // user took over while we waited
+			dispatchSelfContinuation(ctx, prompt);
+		}, wait);
+		ctx.ui.notify(`Provider failover: next auto-continue in ~${Math.ceil(wait / 1000)}s (press Esc to cancel).`, "info");
+	}
+
 	function clearPendingContinuation() {
 		if (pendingWakeTimer) {
 			clearTimeout(pendingWakeTimer);
@@ -958,6 +1031,10 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 	}
 
 	function setPendingContinuation(ctx: any, reason: string) {
+		// Don't re-arm or re-notify if a pending resume is already queued — switchToFallback
+		// and agent_end can both reach here for the same exhaustion, and the wake timer is
+		// already running.
+		const alreadyPending = !!persistedState.pendingContinuationPrompt;
 		const current = ctx.model ? ref(ctx.model.provider, ctx.model.id) : ("unknown/model" as ModelRef);
 		const record: SwitchRecord = { from: current, to: "next-available/account" as ModelRef, reason, at: Date.now() };
 		persistedState = {
@@ -968,6 +1045,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		};
 		persist();
 		schedulePendingWake(ctx);
+		if (alreadyPending) return;
 		const delayMs = nextPendingWakeDelayMs();
 		ctx.ui.notify(
 			`Provider failover: all accounts appear exhausted. Will automatically probe/resume in ~${Math.ceil((delayMs ?? config.probeCooldownMs) / 1000)}s if this Pi session stays open.`,
@@ -979,6 +1057,14 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		const ctx = latestCtx;
 		const prompt = persistedState.pendingContinuationPrompt;
 		if (!ctx || !prompt || !config.enabled || !config.autoContinue) return;
+		if (userAbortedChain) {
+			clearPendingContinuation(); // user took over — abandon the background resurrection
+			return;
+		}
+		if (autoContinuesThisPrompt >= config.maxAutoContinuesPerPrompt) {
+			clearPendingContinuation(); // task-level cap reached — stop resurrecting
+			return;
+		}
 		refreshDiscovery();
 		pruneCooldowns();
 		const candidates = findFallbackModels(ctx, ctx.model);
@@ -996,8 +1082,12 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 			restoreDesiredThinking(); // keep the user's thinking level across the switch
 			setLastProbe(candidate.provider);
 			clearPendingContinuation();
+			// A genuine recovery after a real wait earns a fresh continuation budget so the
+			// agent can keep going whenever an account recovers; rapid flapping (resume that
+			// immediately re-limits) does NOT reset, so the cap still bounds a tight loop.
+			if (Date.now() - lastAutoContinueAt >= config.probeCooldownMs) autoContinuesThisPrompt = 0;
 			ctx.ui.notify(`Provider failover: resuming pending work on ${to}`, "warning");
-			pi.sendUserMessage(prompt, ctx.isIdle() ? undefined : { deliverAs: "followUp" });
+			dispatchSelfContinuation(ctx, prompt);
 			return;
 		}
 		schedulePendingWake(ctx);
@@ -1104,23 +1194,65 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		latestCtx = ctx;
 		refreshDiscovery(true);
 		pruneCooldowns();
-		schedulePendingWake(ctx);
+		// Tight session binding: every session starts as a clean slate. Auto-resume only ever
+		// runs *inside the live session that hit the limit* (its timer is armed by
+		// setPendingContinuation). A new session — or a reopened one after a crash — must NEVER
+		// inherit and silently restart a previous session's paused work, so we drop any leftover
+		// pending state and reset all in-memory guards here.
+		if (persistedState.pendingContinuationPrompt) clearPendingContinuation();
+		autoContinuesThisPrompt = 0;
+		userAbortedChain = false;
+		expectingSelfContinuation = false;
+		lastSentContinuationPrompt = "";
 		ctx.ui.notify(
 			`pi-multi-account loaded (${config.enabled ? "enabled" : "disabled"}). ${rotation.length} account(s) in rotation. Config: ${CONFIG_PATH}`,
 			"info",
 		);
 	});
 
+	// CRITICAL: when the current session ends — for ANY reason (quit, reload, or replacement
+	// by a new/resumed/forked session) — the extension's background activity must end with it.
+	// Kill every timer and drop the pending continuation so nothing survives the session.
 	pi.on("session_shutdown", async () => {
 		if (pendingWakeTimer) {
 			clearTimeout(pendingWakeTimer);
 			pendingWakeTimer = undefined;
 		}
+		if (autoContinueTimer) {
+			clearTimeout(autoContinueTimer);
+			autoContinueTimer = undefined;
+		}
+		clearPendingContinuation();
+		userAbortedChain = false;
+		expectingSelfContinuation = false;
+		autoContinuesThisPrompt = 0;
+		lastSentContinuationPrompt = "";
+	});
+
+	// Distinguish a genuine new user prompt from our own failover continuation. Only a
+	// genuine prompt resets the per-task auto-continue counter and cancels any pending
+	// resurrection — this is what stops maxAutoContinuesPerPrompt from resetting every
+	// iteration (the bug that let the failover loop run forever).
+	pi.on("before_agent_start", async (event) => {
+		const prompt = typeof (event as any).prompt === "string" ? (event as any).prompt : "";
+		const isSelfContinuation =
+			expectingSelfContinuation || (!!lastSentContinuationPrompt && prompt.trim() === lastSentContinuationPrompt.trim());
+		if (isSelfContinuation) return;
+		// Genuine user input → fresh task: reset the chain and stop any auto-resume so the
+		// user is fully back in control.
+		autoContinuesThisPrompt = 0;
+		userAbortedChain = false;
+		lastSentContinuationPrompt = "";
+		if (autoContinueTimer) {
+			clearTimeout(autoContinueTimer);
+			autoContinueTimer = undefined;
+		}
+		if (persistedState.pendingContinuationPrompt) clearPendingContinuation();
 	});
 
 	pi.on("agent_start", async () => {
 		currentPromptSwitch = undefined;
-		autoContinuesThisPrompt = 0;
+		expectingSelfContinuation = false; // consume the flag once the run has started
 		lastErrorText = "";
 		captureDesiredThinking(); // remember the level BEFORE any failover can clamp it
 		refreshDiscovery(); // cheap: only re-scans when auth.json changed (new /login)
@@ -1129,6 +1261,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 	pi.on("after_provider_response", async (event, ctx) => {
 		latestCtx = ctx;
 		if (!config.enabled) return;
+		if (userAbortedChain || ctx.signal?.aborted) return; // user is cancelling — don't fail over
 		const status = (event as any).status;
 		if (status === 401) {
 			// Authorization is dead → drop this account, then move on.
@@ -1145,6 +1278,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		latestCtx = ctx;
 		const message = (event as any).message;
 		if (message?.role !== "assistant" || message.stopReason !== "error") return;
+		if (userAbortedChain || ctx.signal?.aborted) return; // user is cancelling — don't fail over
 		const errorText = typeof message.errorMessage === "string" ? message.errorMessage : "";
 		lastErrorText = errorText;
 		if (currentPromptSwitch) return;
@@ -1161,15 +1295,44 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 	pi.on("agent_end", async (event, ctx) => {
 		latestCtx = ctx;
 		if (!config.enabled || !config.autoContinue) return;
+
+		// Respect the user: if they pressed Esc, the last assistant message is "aborted".
+		// Stop the failover chain dead and cancel every background timer so nothing
+		// resurrects the task. It only restarts when the user sends a new prompt.
+		if (lastAssistantStopReason((event as any).messages ?? []) === "aborted" || ctx.signal?.aborted) {
+			userAbortedChain = true;
+			if (autoContinueTimer) {
+				clearTimeout(autoContinueTimer);
+				autoContinueTimer = undefined;
+			}
+			clearPendingContinuation();
+			currentPromptSwitch = undefined;
+			lastErrorText = "";
+			return;
+		}
+		if (userAbortedChain) return;
+
 		const errorText = lastErrorText || getAssistantErrorText((event as any).messages ?? []);
 		if (isAuthError(errorText) && ctx.model) markInvalid(ctx.model.provider, errorText.slice(0, 60));
 		if (!isLimitError(errorText) && !isAuthError(errorText)) return;
-		if (autoContinuesThisPrompt >= config.maxAutoContinuesPerPrompt) return;
+
+		// Task-level cap. Because this counter is no longer reset by our own re-prompts,
+		// it genuinely bounds the failover loop. When it trips we stop completely (and do
+		// NOT arm a resurrection timer) so the machine can't be driven into a swap spiral.
+		if (autoContinuesThisPrompt >= config.maxAutoContinuesPerPrompt) {
+			ctx.ui.notify(
+				`Provider failover: stopped after ${autoContinuesThisPrompt} auto-continues — every account kept hitting limits. Send a new message, or run /multi-account reset to retry.`,
+				"warning",
+			);
+			return;
+		}
 
 		if (!currentPromptSwitch) {
 			const reason = `agent ended with provider limit: ${errorText.slice(0, 120)}`;
 			const switched = await switchToFallback(ctx, reason, cooldownFromErrorText(errorText) ?? config.cooldownMs);
-			if (!switched && !currentPromptSwitch) {
+			// switchToFallback already arms pending-resume when nothing is available now, so
+			// only set it here if it somehow didn't (defensive; alreadyPending makes it a no-op).
+			if (!switched && !currentPromptSwitch && !persistedState.pendingContinuationPrompt) {
 				setPendingContinuation(ctx, reason);
 				return;
 			}
@@ -1178,7 +1341,7 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		if (currentPromptSwitch) {
 			autoContinuesThisPrompt++;
 			const prompt = continuationPrompt(currentPromptSwitch);
-			pi.sendUserMessage(prompt, ctx.isIdle() ? undefined : { deliverAs: "followUp" });
+			scheduleAutoContinue(ctx, prompt); // spaced + Esc-cancellable, not a tight loop
 		}
 	});
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-multi-account",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Automatic multi-account failover & rotation for Pi Agent across Anthropic (Claude), OpenAI/ChatGPT Codex, and Qwen/Alibaba. Auto-discovers authenticated accounts, grows the rotation on login, and drops accounts on logout, expiry, or quota/rate-limit errors.",
   "type": "module",
   "license": "MIT",