takomi 2.1.28 → 2.1.29

package/.pi/extensions/oauth-router/commands.ts

@@ -404,15 +404,13 @@ async function handleRouterLogin(pi: ExtensionAPI, runtime: RouterRuntime, args:
           updatedAt: Date.now(),
         });
         runtime.clearAccountHealth(duplicate.id);
-        await runtime.refreshUsageSnapshot(duplicate.id);
         setFooterStatus(ctx, runtime);
-        emitReport(pi, `Updated existing account ${duplicate.id} (${duplicate.label}) with fresh credentials instead of adding a duplicate.`);
+        emitReport(pi, `Updated existing account ${duplicate.id} (${duplicate.label}) with fresh credentials instead of adding a duplicate. Run /router-refresh-usage ${duplicate.id} to refresh provider quota metadata.`);
         return;
       }
       runtime.addAccount(account);
-      await runtime.refreshUsageSnapshot(account.id);
       setFooterStatus(ctx, runtime);
-      emitReport(pi, `Added account ${account.id} (${account.label}) for upstream ${upstream.id}.`);
+      emitReport(pi, `Added account ${account.id} (${account.label}) for upstream ${upstream.id}. Run /router-refresh-usage ${account.id} to refresh provider quota metadata.`);
       ctx.ui.notify(`Added ${account.id}`, "info");
       return;
     }
@@ -461,17 +459,15 @@ async function handleRouterLogin(pi: ExtensionAPI, runtime: RouterRuntime, args:
         updatedAt: Date.now(),
       });
       runtime.clearAccountHealth(existing.id);
-      await runtime.refreshUsageSnapshot(existing.id);
       setFooterStatus(ctx, runtime);
-      emitReport(pi, `Re-logged account ${existing.id} (${existing.label}) and cleared auth state.`);
+      emitReport(pi, `Re-logged account ${existing.id} (${existing.label}) and cleared auth state. Run /router-refresh-usage ${existing.id} to refresh provider quota metadata.`);
       return;
     }
     case "refresh": {
       const account = await pickAccount(runtime, ctx, first, "Choose account to refresh");
       const refreshed = await runtime.refreshAccount(account.id);
-      await runtime.refreshUsageSnapshot(refreshed.id);
       setFooterStatus(ctx, runtime);
-      emitReport(pi, `Refreshed account ${refreshed.id} (${refreshed.label}).`);
+      emitReport(pi, `Refreshed account ${refreshed.id} (${refreshed.label}). Run /router-refresh-usage ${refreshed.id} to refresh provider quota metadata.`);
       return;
     }
     case "help":
@@ -554,7 +550,7 @@ export function registerRouterCommands(pi: ExtensionAPI, runtime: RouterRuntime)
   });
 
   pi.registerCommand("router-refresh-usage", {
-    description: "Refresh oauth-router account metadata from token claims",
+    description: "Refresh oauth-router account metadata and best-effort provider quota",
     handler: async (args, ctx) => {
       const [requestedId] = parseArgs(args || "");
       const target = await pickUsageTarget(runtime, ctx, requestedId);

package/.pi/extensions/oauth-router/config.ts

@@ -98,6 +98,7 @@ const DEFAULT_UPSTREAMS: RouterUpstreamConfig[] = [
     modelIds: ["gpt-5.1", "gpt-5.4", "gpt-5.4-mini", "gpt-5.5"],
     usageProbe: {
       enabled: true,
+      timeoutMs: 2_500,
       endpoints: [
         "/wham/usage",
         "/codex/usage",
@@ -138,6 +139,8 @@ function sleepSync(ms: number): void {
 }
 
 const HELD_JSON_LOCKS = new Set<string>();
+const JSON_LOCK_WAIT_TIMEOUT_MS = 2_000;
+const JSON_LOCK_STALE_AFTER_MS = 5_000;
 
 export function withJsonFileLock<T>(filePath: string, fn: () => T): T {
   const lockPath = `${filePath}.lock`;
@@ -150,12 +153,12 @@ export function withJsonFileLock<T>(filePath: string, fn: () => T): T {
     } catch {
       try {
         const ageMs = Date.now() - statSync(lockPath).mtimeMs;
-        if (ageMs > 30_000) rmSync(lockPath, { recursive: true, force: true });
+        if (ageMs > JSON_LOCK_STALE_AFTER_MS) rmSync(lockPath, { recursive: true, force: true });
       } catch {
         // The lock disappeared between mkdir attempts.
       }
-      if (Date.now() - started > 10_000) {
-        throw new Error(`Timed out waiting for oauth-router JSON lock: ${lockPath}`);
+      if (Date.now() - started > JSON_LOCK_WAIT_TIMEOUT_MS) {
+        throw new Error(`Timed out after ${JSON_LOCK_WAIT_TIMEOUT_MS}ms waiting for oauth-router JSON lock: ${lockPath}`);
       }
       sleepSync(50);
     }

package/.pi/extensions/oauth-router/oauth-flow.ts

@@ -331,6 +331,30 @@ function collectRateLimitHeaders(headers: Headers): Record<string, string> {
   return result;
 }
 
+const DEFAULT_USAGE_PROBE_TIMEOUT_MS = 2_500;
+
+function getUsageProbeTimeoutMs(upstream: RouterUpstreamConfig): number {
+  const configured = upstream.usageProbe?.timeoutMs;
+  return typeof configured === "number" && Number.isFinite(configured) && configured > 0
+    ? Math.min(configured, 10_000)
+    : DEFAULT_USAGE_PROBE_TIMEOUT_MS;
+}
+
+async function fetchJsonWithTimeout(url: string, init: RequestInit, timeoutMs: number): Promise<{ response: Response; text: string }> {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(url, { ...init, signal: controller.signal });
+    const text = await response.text();
+    return { response, text };
+  } catch (error) {
+    if (controller.signal.aborted) throw new Error(`timed out after ${Math.round(timeoutMs)}ms`);
+    throw error;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 export async function refreshProviderUsageSnapshot(account: StoredRouterAccount, upstream: RouterUpstreamConfig): Promise<RouterProviderUsageSnapshot> {
   const base = inspectAccountToken(account);
   if (account.provider !== "openai-codex" || upstream.usageProbe?.enabled === false) return base;
@@ -345,12 +369,20 @@ export async function refreshProviderUsageSnapshot(account: StoredRouterAccount,
   let lastEndpoint: string | undefined;
   let lastHeaders: Record<string, string> | undefined;
   const errors: string[] = [];
+  const startedAt = now();
+  const totalTimeoutMs = getUsageProbeTimeoutMs(upstream);
 
   for (const endpoint of endpoints) {
+    const remainingMs = totalTimeoutMs - (now() - startedAt);
+    if (remainingMs <= 0) {
+      errors.push(`probe timed out after ${Math.round(totalTimeoutMs)}ms`);
+      break;
+    }
+
     const url = resolveProbeUrl(upstream.baseUrl, endpoint);
     lastEndpoint = url;
     try {
-      const response = await fetch(url, {
+      const { response, text } = await fetchJsonWithTimeout(url, {
         method: "GET",
         headers: {
           Authorization: `Bearer ${account.access}`,
@@ -361,10 +393,9 @@ export async function refreshProviderUsageSnapshot(account: StoredRouterAccount,
           "User-Agent": "codex_cli_rs/0.133.0 (Windows; x86_64) pi/oauth-router",
           accept: "application/json",
         },
-      });
+      }, Math.max(1, remainingMs));
       lastStatus = response.status;
       lastHeaders = collectRateLimitHeaders(response.headers);
-      const text = await response.text();
       const json = text ? JSON.parse(text) : undefined;
       const extracted = extractProviderUsage(json);
       const hasQuota = Boolean(extracted.fiveHour || extracted.weekly || extracted.planType);

package/.pi/extensions/oauth-router/types.ts

@@ -27,6 +27,8 @@ export interface RouterModelConfig {
 export interface RouterProviderUsageProbeConfig {
   enabled?: boolean;
   endpoints?: string[];
+  /** Total best-effort probe budget per account. Provider usage checks must not block login/refresh UX. */
+  timeoutMs?: number;
 }
 
 export interface RouterUpstreamConfig {

package/.pi/extensions/takomi-runtime/context-panel.ts

@@ -70,6 +70,15 @@ type BoardCounts = {
   blocked: number;
 };
 
+type BoardCountsCacheEntry = {
+  checkedAt: number;
+  mtimeMs: number;
+  counts?: BoardCounts;
+};
+
+const BOARD_COUNTS_CACHE_MS = 1_000;
+const boardCountsCache = new Map<string, BoardCountsCacheEntry>();
+
 function createEmptyState(sessionStart = Date.now(), runtime: ContextRuntimeState = {}): ContextPanelState {
   return {
     fileChanges: [],
@@ -186,8 +195,19 @@ function formatDisplayPath(filePath: string, cwd?: string): string {
 
 function loadBoardCounts(cwd: string, sessionId?: string): BoardCounts | undefined {
   if (!sessionId) return undefined;
+  const stateFile = path.join(cwd, ".pi", "takomi", "orchestrator", `${sessionId}.json`);
+  const cached = boardCountsCache.get(stateFile);
+  const checkedAt = Date.now();
+
+  if (cached && checkedAt - cached.checkedAt < BOARD_COUNTS_CACHE_MS) return cached.counts;
+
   try {
-    const stateFile = path.join(cwd, ".pi", "takomi", "orchestrator", `${sessionId}.json`);
+    const mtimeMs = statSync(stateFile).mtimeMs;
+    if (cached && cached.mtimeMs === mtimeMs) {
+      boardCountsCache.set(stateFile, { ...cached, checkedAt });
+      return cached.counts;
+    }
+
     const parsed = JSON.parse(readFileSync(stateFile, "utf8")) as { tasks?: Array<{ status?: string }> };
     const counts: BoardCounts = { completed: 0, pending: 0, inProgress: 0, blocked: 0 };
     for (const task of parsed.tasks ?? []) {
@@ -196,8 +216,10 @@ function loadBoardCounts(cwd: string, sessionId?: string): BoardCounts | undefin
       else if (task.status === "blocked") counts.blocked += 1;
       else counts.pending += 1;
     }
+    boardCountsCache.set(stateFile, { checkedAt, mtimeMs, counts });
     return counts;
   } catch {
+    boardCountsCache.set(stateFile, { checkedAt, mtimeMs: 0, counts: undefined });
     return undefined;
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "takomi",
-  "version": "2.1.28",
+  "version": "2.1.29",
   "description": "🎯 Stop wrestling with AI. Start building with purpose. The artisan's toolkit for agent workflows, Codex skills, and original Takomi capabilities like 21st.dev integration.",
   "type": "module",
   "bin": {
@@ -23,7 +23,7 @@
   ],
   "scripts": {
     "postinstall": "node src/postinstall.js",
-    "test": "echo \"Error: no test specified\" && exit 1",
+    "test": "node scripts/test-skill-selection.js",
     "test:skills": "node scripts/test-skill-selection.js"
   },
   "repository": {
@@ -45,6 +45,11 @@
   "author": "J StaR Films Studios",
   "license": "ISC",
   "dependencies": {
+    "@earendil-works/pi-ai": "^0.78.1",
+    "@mariozechner/pi-agent-core": "^0.70.6",
+    "@mariozechner/pi-ai": "^0.70.2",
+    "@mariozechner/pi-coding-agent": "^0.70.2",
+    "@mariozechner/pi-tui": "^0.70.6",
     "commander": "^13.1.0",
     "figlet": "^1.8.0",
     "fs-extra": "^11.3.0",
@@ -58,11 +63,8 @@
   "homepage": "https://github.com/JStaRFilms/VibeCode-Protocol-Suite#readme",
   "devDependencies": {
     "@earendil-works/pi-agent-core": "^0.78.1",
-    "@earendil-works/pi-ai": "^0.78.1",
     "@earendil-works/pi-coding-agent": "^0.78.1",
     "@earendil-works/pi-tui": "^0.78.1",
-    "@mariozechner/pi-ai": "^0.70.2",
-    "@mariozechner/pi-coding-agent": "^0.70.2",
     "@types/node": "^25.5.2",
     "typebox": "^1.1.33",
     "typescript": "^6.0.2"

package/src/pi-harness.js

@@ -213,6 +213,42 @@ function runCommand(command, args) {
   return spawnSync(command, args, { stdio: 'pipe', encoding: 'utf8', shell: process.platform === 'win32' });
 }
 
+function runCommandWithTimeout(command, args, timeoutMs) {
+  return new Promise((resolve) => {
+    let stdout = '';
+    let stderr = '';
+    let settled = false;
+    let timedOut = false;
+
+    const child = spawn(command, args, {
+      stdio: ['ignore', 'pipe', 'pipe'],
+      shell: process.platform === 'win32',
+      windowsHide: true,
+    });
+
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({ stdout, stderr, timedOut, ...result });
+    };
+
+    const timer = setTimeout(() => {
+      timedOut = true;
+      try { child.kill(); } catch {}
+      setTimeout(() => {
+        try { child.kill('SIGKILL'); } catch {}
+      }, 1500).unref?.();
+    }, timeoutMs);
+    timer.unref?.();
+
+    child.stdout?.on('data', (chunk) => { stdout += chunk.toString(); });
+    child.stderr?.on('data', (chunk) => { stderr += chunk.toString(); });
+    child.on('error', (error) => finish({ status: 1, error }));
+    child.on('close', (code) => finish({ status: timedOut ? null : code }));
+  });
+}
+
 export async function ensurePiInstalled() {
   const before = await detectPiCommand();
   if (before.installed) {
@@ -300,17 +336,28 @@ export function printPiSubagentsInstallResult(result) {
   if (result.report) console.log(pc.dim(result.report.split(/\r?\n/).slice(-8).join('\n')));
 }
 
-export async function updatePiManagedPackages() {
+export async function updatePiManagedPackages({ timeoutMs = 20_000 } = {}) {
+  if (process.env.TAKOMI_SKIP_PI_PACKAGE_UPDATE === '1') {
+    return { ok: true, changed: false, report: 'Skipped Pi package update because TAKOMI_SKIP_PI_PACKAGE_UPDATE=1.' };
+  }
+
   const pi = await detectPiCommand();
   if (!pi.installed) return { ok: false, changed: false, report: 'Pi is not installed.' };
 
-  // `pi update` reconciles every package listed in Pi settings, including
-  // user-installed npm/git/local packages. Keep this broad so Takomi refresh
-  // updates old, new, custom, and optional feature packages without needing to
-  // know their names ahead of time.
+  // `pi update` reconciles packages from Pi settings, including user-installed
+  // npm/git/local packages. Treat this as a best-effort follow-up: third-party
+  // packages or manual extension entries must never hang Takomi installation.
   const command = pi.path || 'pi';
-  const result = runCommand(command, ['update']);
+  const result = await runCommandWithTimeout(command, ['update'], timeoutMs);
   const output = [result.stdout, result.stderr].filter(Boolean).join('\n').trim();
+  if (result.timedOut) {
+    return {
+      ok: false,
+      changed: false,
+      report: `Timed out after ${Math.round(timeoutMs / 1000)}s while running \`pi update\`. Takomi setup is complete; retry package updates later with \`pi update\` or skip this step with TAKOMI_SKIP_PI_PACKAGE_UPDATE=1. Last output:\n${output}`.trim(),
+    };
+  }
+
   return {
     ok: result.status === 0,
     changed: result.status === 0,