fix(embedded-runner): preserve takeover during fallback

abnershang · abnershang · commit 3240d6764653 · 2026-05-19T17:20:45.000+08:00
diff --git a/src/agents/failover-error.ts b/src/agents/failover-error.ts
@@ -274,6 +274,9 @@ export function isNonProviderRuntimeCoordinationError(err: unknown): boolean {
   if (isFailoverError(err)) {
     return false;
   }
+  if (isEmbeddedAttemptSessionTakeover(err)) {
+    return true;
+  }
   return resolveFailoverClassificationFromError(err) === null;
 }
 
diff --git a/src/agents/model-fallback.test.ts b/src/agents/model-fallback.test.ts
@@ -797,6 +797,38 @@ describe("runWithModelFallback", () => {
     expect(run).toHaveBeenCalledTimes(1);
   });
 
+  it("aborts fallback when a provider prompt error carries cleanup session takeover", async () => {
+    const cfg = makeCfg({
+      agents: {
+        defaults: {
+          model: {
+            primary: "openai/gpt-5.4",
+            fallbacks: ["anthropic/claude-sonnet-4-6", "openai/gpt-4.1-mini"],
+          },
+        },
+      },
+    });
+    const cleanupTakeover = new Error(
+      "session file changed while embedded prompt lock was released: /tmp/session.jsonl",
+    );
+    cleanupTakeover.name = "EmbeddedAttemptSessionTakeoverError";
+    const providerFacingError = new Error("provider rejected request: rate limit", {
+      cause: cleanupTakeover,
+    });
+    providerFacingError.name = "EmbeddedAttemptSessionTakeoverError";
+    const run = vi.fn().mockRejectedValue(providerFacingError);
+
+    await expect(
+      runWithModelFallback({
+        cfg,
+        provider: "openai",
+        model: "gpt-5.4",
+        run,
+      }),
+    ).rejects.toBe(providerFacingError);
+    expect(run).toHaveBeenCalledTimes(1);
+  });
+
   it("aborts the fallback chain on session write-lock timeout instead of trying every model (#83510)", async () => {
     const cfg = makeCfg({
       agents: {
diff --git a/src/agents/model-fallback.ts b/src/agents/model-fallback.ts
@@ -249,6 +249,9 @@ async function runFallbackCandidate<T>(params: {
     if (isCommandLaneTaskTimeoutError(err)) {
       throw err;
     }
+    if (isNonProviderRuntimeCoordinationError(err)) {
+      throw err;
+    }
     // Normalize abort-wrapped rate-limit errors (e.g. Google Vertex RESOURCE_EXHAUSTED)
     // so they become FailoverErrors and continue the fallback loop instead of aborting.
     const normalizedFailover = coerceToFailoverError(err, {
diff --git a/src/agents/pi-embedded-runner/run/attempt.spawn-workspace.context-engine.test.ts b/src/agents/pi-embedded-runner/run/attempt.spawn-workspace.context-engine.test.ts
@@ -998,31 +998,36 @@ describe("runEmbeddedAttempt context engine sessionKey forwarding", () => {
     expectInitialLockReleasedBeforePostTurnWrite(lockEvents);
   });
 
-  it("preserves provider prompt errors when cleanup detects session takeover", async () => {
+  it("preserves provider prompt errors while carrying cleanup session takeover", async () => {
     const providerError = new Error("provider rejected request: HTTP 400");
     let releasingCleanupLock = false;
+    let cleanupTakeover: EmbeddedAttemptSessionTakeoverError | undefined;
     hoisted.flushPendingToolResultsAfterIdleMock.mockImplementation(async () => {
       releasingCleanupLock = true;
     });
     hoisted.acquireSessionWriteLockMock.mockImplementation(async (params) => ({
       release: async () => {
         if (releasingCleanupLock) {
-          throw new EmbeddedAttemptSessionTakeoverError(params.sessionFile);
+          cleanupTakeover = new EmbeddedAttemptSessionTakeoverError(params.sessionFile);
+          throw cleanupTakeover;
         }
       },
     }));
 
-    const result = await createContextEngineAttemptRunner({
+    const error = await createContextEngineAttemptRunner({
       contextEngine: createContextEngineBootstrapAndAssemble(),
       sessionKey,
       tempPaths,
       sessionPrompt: async () => {
         throw providerError;
       },
-    });
+    }).catch((err: unknown) => err);
 
-    expect(result.promptError).toBe(providerError);
-    expect(result.promptErrorSource).toBe("prompt");
+    expect(error).toBeInstanceOf(Error);
+    expect((error as Error).name).toBe("EmbeddedAttemptSessionTakeoverError");
+    expect((error as Error).message).toBe(providerError.message);
+    expect((error as Error).cause).toBe(cleanupTakeover);
+    expect((error as { promptError?: unknown }).promptError).toBe(providerError);
   });
 
   it("keeps cleanup session takeover fatal when no provider prompt error exists", async () => {
diff --git a/src/agents/pi-embedded-runner/run/attempt.ts b/src/agents/pi-embedded-runner/run/attempt.ts
@@ -1000,6 +1000,18 @@ function shouldPreservePromptErrorAfterCleanupError(params: {
   );
 }
 
+class EmbeddedAttemptPromptErrorWithCleanupTakeoverError extends Error {
+  readonly promptError: unknown;
+  readonly cleanupError: EmbeddedAttemptSessionTakeoverError;
+
+  constructor(params: { promptError: unknown; cleanupError: EmbeddedAttemptSessionTakeoverError }) {
+    super(formatErrorMessage(params.promptError), { cause: params.cleanupError });
+    this.name = "EmbeddedAttemptSessionTakeoverError";
+    this.promptError = params.promptError;
+    this.cleanupError = params.cleanupError;
+  }
+}
+
 function hasVisiblePendingToolMediaReply(
   reply: { mediaUrls?: string[]; audioAsVoice?: boolean } | null | undefined,
 ): boolean {
@@ -4873,6 +4885,12 @@ export async function runEmbeddedAttempt(
               `runId=${params.runId} sessionId=${params.sessionId} ` +
               `promptError=${formatErrorMessage(promptError)} cleanupError=${formatErrorMessage(cleanupError)}`,
           );
+          await Promise.reject(
+            new EmbeddedAttemptPromptErrorWithCleanupTakeoverError({
+              promptError,
+              cleanupError: cleanupError as EmbeddedAttemptSessionTakeoverError,
+            }),
+          );
         } else {
           await Promise.reject(cleanupError);
         }

Original file line number	Diff line number	Diff line change
`@@ -274,6 +274,9 @@ export function isNonProviderRuntimeCoordinationError(err: unknown): boolean {`
`274`	`274`	`if (isFailoverError(err)) {`
`275`	`275`	`return false;`
`276`	`276`	`}`
	`277`	`+ if (isEmbeddedAttemptSessionTakeover(err)) {`
	`278`	`+ return true;`
	`279`	`+ }`
`277`	`280`	`return resolveFailoverClassificationFromError(err) === null;`
`278`	`281`	`}`
`279`	`282`